End-to-End Methodology

Testing Phases  Reconnaissance  Mapping  Discovery  Exploitation  Repeat…  Report

Reconnaissance  Whois records  Architecture diagrams  IPs and Hostnames  DNS information  Google Searches  Social Networks  Blogs and Other Web Sites

Whois ~]$ whois generalstatics.com [Querying whois.verisign-grs.com] domain: generalstatics.com owner: Neale Pickett organization: WoozleWorks address: th St city: Los Alamos state: NM postal-code: country: US phone: admin-c: CCOM tech-c: CCOM billing-c: CCOM nserver: ns1.afraid.org contact-hdl: CCOM person: Neale Pickett organization: WoozleWorks address: th St city: Los Alamos state: NM postal-code: country: US phone: source: joker.com live whois service

Architecture Diagram

Mapping  Port scans  Version Checking  OS Fingerprinting  Spidering  Pieces/flow of the application User/admin/public areas Login screens Configuration and Management Session identifiers  Learning the various components that make up a web application

Network Scan

Discovery  Focus is on finding issues  User interfaces  Information leakage  Authentication systems  Error messages  Some exploitation will happen as part of this step Directory browsing

Directory Browsing

Exploitation  Attacking the flaws in an application Injection XSS Authentication/Authorization bypass  Determine implications of an attack What can happen as a result…  What other parts of the application infrastructure are exposed through the attack?

Repeat…  Some knowledge of the application may be gained that wasn’t found in the Recon, Mapping, or Discovery phases  Jump back into the workflow, utilizing the newly discovered information

Reporting  Documentation for Reporting is collected during all phases  Executive Summary Appears first, but written last Audience is management  Introduction Scope, objectives, personnel  Methodology Step-by-step, including tools used Sufficient detail to allow verification and repeat of test

Reporting (2)  Findings Categorized according to risk Include recommendations  Conclusions Short summary Like Executive Summary, but audience is technical  Appendix Permission memo, data discovered, tools outputs