Practical Pen Testing - Security Audit

Learning Outcome 1: Use appropriate tools to discover the structure of a network, the services running on it, and identify and classify potential security flaws

Learning Outcome 2: Demonstrate understanding of the core theoretical concepts that lead to insecurity in computer systems, and how there can be used to exploit and mitigate threats identified in a computer system or network

Learning Outcome 3: Discuss common penetration testing methodologies, vulnerability risk rating systems and how they relate to the security audit process

Penetration Test Report

In this assignment you will need to write a comprehensive pen-test report on ONE of the challenge systems provided in the labs.

Unlike in CW1 where you are expected to give an overview of the portfolio tasks. The report should be aimed at a non technical audience, and provide a detailed description of the process used to identify any vulnerabilities, methods used to exploit, and relevant suggestions for mitigation.

You should refer back to the generic pentest process discussed in the class, and discuss how the information gathered at each stage informed the decisions made.

You will also need to provide some discussion around the issues discovered. Providing an explanation of the cause of the problems, links to other similar real world examples, discussion of the risk involved.

Example Pen Test Process
A Generic Penetration test process discussed in class was:
Scope Reconnaissance Exploitation Post-Exploitation
Your report should address each of these stages:

SCOPE
As there is no formal contract defined, your scope stage should discuss any assumptions you make around the process. What methods of testing are you going to use, are there elements that are out of scope etc.

Reconnaissance
Discussion of recon methodology, and any tools used. Results, and analysis of the reconnaissance phase. This may stage should also include any reconnaissance from post initial foothold on the system.

Exploitation
Description of any tools, techniques and strategies for the exploitation phase. Discussion of the vulnerabilities found, and how you were able to exploit them.
As with reconnaissance, this should include details of any further exploitation after the initial foothold.

Post Exploitation
Suggestions for mitigation, and any other post-exploit tasks carried out.

Attachment:- Penetration Test Report.rar