ISSAF assessment layers

ISSAF assessment layers

1. information gathering

   • find information about the target using both technical and non-technical methods
     • active
     • passive

2. network mapping

   • find live hosts
     • ping sweep
     • ARP scan
     • nmap -sn
   • port scans
   • map network perimeter
     • routers
     • firewalls
   • identify critical services
   • fingerprint OSs
   • use MIBs identify routes
     • mgt info base
   • fingerprint services

3. vulnerability identification

   • service banner grabbing
   • vulnerability scans
   • check public DBs
     • CERT
     • CVE
   • perform false positive and false negative verification
   • enumerate vulnerabilities
   • identify attack paths and exploitation scenarios

4. penetration

   • get tools
     • preexisting
     • develop
   • test tools before full execution
   • use tools

5. gaining escalation and privilege

   • gain least privilege
     • discover username / password
     • blank password, default password
     • vendor default settings
     • discover public servcies that allow system operations
   • compromise
   • privilege escalation
     • gain system access

6. enumerating further

   • obtain passwords for offline cracking
   • obtain password by sniffing
   • sniff traffic, analyze it
   • gather cookies and exploit sessions
   • email address gathering
   • map routes and networks
   • perform previous stages with compromised starting point

7. compromise remote users and sites

8. maintaining access

   • maintain access to be able to perform further analysis
   • saves time, detection
   • methods
     • set up user account
     • set up covert channel
       • ICMP tunnel
       • HTTP tunnel
     • set up backdoor service
       • netcat
       • Cryptcat
     • root kit
   • leaves exploitable artifacts on system, get permission first

9. cover the tracks

   • hide files
   • clear logs
   • defeat integrity checking
   • defeat antivirus