1. BackTrack Penetration Testing Workshop Michael Holcomb, CISSP Upstate ISSA Chapter

2. Agenda Introductions Schedule Workshop Format The Attacker Methodology Penetration Testing Execution Standard (PTES) Pentester Job Requirements

3. Disclaimer Do not try this at home… without permission!

4. Introductions Name Company Position Previous Experience  Windows & Linux  Penetration Testing  BackTrack

5. Schedule Hours (9:00AM to 4:30PM)  10:20 to 10:30 - Break  11:00 to 12:30 – ISSA Chapter Meeting  2:45 to 3:00 - Break

6. Workshop Format Session Materials Practice Exercises Workshop Survey

7. The Hacker Methodology Information Gathering Vulnerability Assessment Exploitation Privilege Escalation Maintaining Access

8. Penetration Testing Execution Standard (PTES) Pre-engagement Interactions Intelligence Gathering Threat Modeling Vulnerability Analysis Exploitation Post Exploitation Reporting

9. Pentester Job Requirements System and application scanning using analysis tools Validate automated testing results Conduct manual analysis Evaluate and communicate risk Provide feedback and guidance Certifications (CEH, CISA, CISSP, OCSP)

10. Physical Security Most overlooked area of Information Security If you can touch it, you can p0wn it!

11. www.securitywizardry.com/radar.htm

12. Bookmarks VMware (vmware.com) BackTrack 5 R3 (backtrack-linux.org) Metasploitable (offensive-security.com) Web Security Dojo (mavensecurity.com) Pauldotcom (pauldotcom.com) OCSP (offensive-security.com) Katana (hackfromacave.com)