This slide deck covers Networking Fundamentals, Various Penetration testing standards, OWASP TOP 10 Vulnerabilities of Web Application and the Lab Setup required for Penetration testing.

1. Basic Foundation

2. Agenda
BASIC FOUNDATION
• Networking Basics
• Discussion on Various Penetration testing standards (like NIST,
OWASP, PTES etc.)
• OWASP TOP 10 Web Vulnerabilities - 2021
• Deploying a Vulnhub machine in same network for hacking
• Tools Installation

3. Networking Basics
What is Networking ?
Networks are simply things connected. For example, your friendship
circle: you are all connected because of similar interests, hobbies,
skills and sorts.
Networks can be found in all walks of life:
• A city's public transportation system
• Meeting and greeting your neighbors
• Postal systems for sending letters and parcels

4. Networking(Contd.)
• In computing, networking is the same idea, just dispersed to
technological devices.
• A network can be formed by anywhere from 2 devices to billions.
These devices include everything from your laptop and phone to
security cameras, traffic lights and even farming!
• Networks are integrated into our everyday life. Be it gathering data
for the weather, delivering electricity to homes or even determining
who has the right of way at a road. Because networks are so
embedded in the modern-day, networking is an essential concept to
grasp in cybersecurity.

5. Example of Networking

6. What is Internet ?
• The Internet is one giant network that consists of many, many small
networks within itself.
• The first iteration of the Internet was within the ARPANET project in
the late 1960s. This project was funded by the United States
Defense Department and was the first documented network in action.
• However, it wasn't until 1989 when the Internet as we know it was
invented by Tim Berners-Lee by the creation of the World Wide Web
(WWW). It wasn't until this point that the Internet wasn't used as a
repository for storing and sharing information (like it is today).

7. Example of Internet

8. Example of Internet (Contd.)

9. Network devices
• Computer networks can also include multiple devices/mediums
which help in the communication between two different devices;
these are known as Network devices and include things such as
routers, switches, hubs, and bridges.

10. Network Topology
• The layout arrangement of the different devices in a network.
Common examples include: Bus, Star, Mesh, Ring, and Daisy chain

11. OSI Model (Open Systems Interconnection)

12. TCP/IP Model
• when we talk about the TCP/IP model, it was designed and developed
by Department of Defense (DoD) in 1960s and is based on standard
protocols. It stands for Transmission Control Protocol/Internet
Protocol. The TCP/IP model is a concise version of the OSI model. It
contains four layers, unlike seven layers in the OSI model. The layers
are:
• Process/Application Layer
• Host-to-Host/Transport Layer
• Internet Layer
• Network Access/Link Layer

13. TCP/IP Model (Contd.)

14. Protocol
• A protocol is the set of rules or algorithms which define the way how
two entities can communicate across the network and there exists
different protocol defined at each layer of the OSI model.
• Few of such protocols are TCP, IP, UDP, ARP, DHCP, FTP and so on.

15. Identifying Devices on a network
• Human Identification – Name, Address & Fingerprints
• Device Identification – IP address & MAC Address (Media Access
control)

16. IP Address
• An IP address (or Internet Protocol) can be used as a way of
identifying a host on a network for a period of time, where that IP
address can then be associated with another device without the IP
address changing.
• An IP address is a set of numbers that are divided into four octets.
The value of each octet will summaries to be the IP address of the
device on the network. This number is calculated through a
technique known as IP addressing & subnetting.

17. Example of IP address

18. Types of IPs
• Private IP – Used in Internal Network
• Public IP – Helps to Connect with Internet
• Static IP – Never Changes
• Dynamic IP – Periodically changes

19. Example of Private & Public IP

20. How Public IP address are assigned
• Public IP addresses are given by your Internet Service Provider (or ISP)
at a monthly fee (your bill!)

21. IPv4 & IPv6
• As more and more devices become connected, it is becoming increasingly
harder to get a public address that isn't already in use.
• So far, we have only discussed one version of the Internet Protocol
addressing scheme known as IPv4, which uses a numbering system of
• 2^32 IP addresses (4.29 billion) -- so you can see why there is such a shortage in
IPv4!
• IPv6 is a new iteration of the Internet Protocol addressing scheme to help
tackle this issue. Although it is seemingly more daunting, it boasts a few
benefits:
• Supports up to 2^128 of IP addresses (340 trillion-plus), resolving the issues faced
with IPv4
• More efficient due to new methodologies

22. Example of IPv4 & IPv6

23. MAC Addresses
• Devices on a network will all have a physical network interface,
which is a microchip board found on the device's motherboard.
• This network interface is assigned a unique address at the factory it
was built at, called a MAC (Media Access Control ) address. The MAC
address is a 12 -character hexadecimal number

24. Example of MAC Address

25. MAC Spoofing !
• An interesting thing with MAC addresses is that they can be faked or
"spoofed" in a process known as spoofing.
• This spoofing occurs when a networked device pretends to identify as
another using its MAC address.

26. Example of Mac Spoofing

27. ARP (Address Resolution Protocol)
• It is the technology that is responsible for allowing devices to identify
themselves on a network.
• Simply, the ARP protocol allows a device to associate its MAC address
with an IP address on the network.
• Each device on a network will keep a log of the MAC addresses
associated with other devices

28. How does ARP works ?
• Each device within a network has a ledger to store information on,
which is called a cache. In the context of the ARP protocol, this cache
stores the identifiers of other devices on the network.
• In order to map these two identifiers together (IP address and MAC
address), the ARP protocol sends two types of messages:
1) ARP Request
2) ARP Reply

29. Example of ARP

30. DHCP (Dynamic Host Configuration Protocol)
• IP addresses can be assigned either manually, by entering them
physically into a device, or automatically and most commonly by
using a DHCP (Dynamic Host Configuration Protocol) server.

31. Example of DHCP Server

32. Port
• A port can be referred to as a logical channel through which data can
be sent/received to an application.
• Any host may have multiple applications running, and each of these
applications is identified using the port number on which they are
running.
• A port number is a 16-bit integer

33. Port types & Range

34. How to check which ports are listening in the
system ?
• In the Windows Command Prompt, Type “netstat -a” in the command
prompt and press ‘Enter’, this lists all the ports being used.

35. DNS Server
• When users type domain names into the URL bar in their browser,
DNS servers are responsible for translating those domain names to
numeric IP addresses, leading them to the correct website.

36. RARP & Socket
• RARP stands for Reverse Address Resolution Protocol.
It provides the IP address of the device given a physical address as
input. But RARP has become obsolete since the time DHCP has come
into the picture.
• Socket
The unique combination of IP address and Port number together are
termed as Socket.

37. NAT
• NAT stands for network address translation.
• It's a way to map multiple local private addresses to a public one
before transferring the information.
• Organizations that want multiple devices to employ a single IP
address use NAT

38. Discussion on Various Penetration testing
standards
OWASP - Open Web Application Security Project
• The OWASP is a nonprofit foundation that works to improve the
security of software.
• Widely known, this standard is developed and updated by a
community keeping in trend with the latest threats. Apart from
application vulnerabilities, this also accounts for logic errors in
processes. The testing guides are listed below for the web/cloud
services, Mobile app (Android/iOS), or IoT firmware respectively.
• Web Security Testing Guide (WSTG)
• Mobile Security Testing Guide (MSTG)
• Firmware Security Testing Methodology

39. Penetration Testing Execution Standard
• Penetration Testing Execution Standard (PTES) defines penetration testing
as 7 phases. Particularly, PTES Technical Guidelines give hands-on
suggestions on testing procedures, and recommendation for security
testing tools.
• Pre-engagement Interactions
• Intelligence Gathering
• Threat Modeling
• Vulnerability Analysis
• Exploitation
• Post Exploitation
• Reporting
Reference link - http://www.pentest-
standard.org/index.php/PTES_Technical_Guidelines

40. Payment Card Industry Data Security Standard
(PCI DSS)
• PCI DSS Requirement 11.3 defines the penetration testing. PCI also
defines Penetration Testing Guidance.
PCI DSS Penetration Testing Guidance
The PCI DSS provides guidance on the following:
• Penetration Testing Components
• Qualifications of a Penetration Tester
• Penetration Testing Methodologies
• Penetration Testing Reporting Guidelines

41. PCI DSS Penetration Testing Requirements
• The PCI DSS requirement refer to Payment Card Industry Data
Security Standard (PCI DSS) Requirement 11.3
• Based on industry-accepted approaches
• Coverage for CDE and critical systems
• Includes external and internal testing
• Test to validate scope reduction
• Application-layer testing
• Network-layer tests for network and OS

42. Penetration Testing Framework (PTF)

43. NIST 800-115
• National Institute of Standards and Technology (NIST) offers very specific
penetration testing guidelines for pentesters to help them improve the accuracy
of the test. Both large and small companies, in various industries, can leverage
this framework for a penetration test.
• Technical Guide to Information Security Testing and Assessment (NIST 800-115)
was published by NIST, it includes some assessment techniques listed below.
• Review Techniques
• Target Identification and Analysis Techniques
• Target Vulnerability Validation Techniques
• Security Assessment Planning
• Security Assessment Execution
• Post-Testing Activities

44. Open Source Security Testing Methodology Manual

45. OWASP TOP 10 Web Vulnerabilities - 2021

46. 1) Broken Access Control
• Access control enforces policy such that users cannot act outside of
their intended permissions.
• Failures typically lead to unauthorized information disclosure,
modification, or destruction of all data or performing a business
function outside the user's limits.

47. Mitigation

48. 2) Cryptographic Failures
• Many web applications and APIs do not properly protect sensitive
data with strong encryption. Attackers may steal or modify such
weakly protected data to conduct credit card fraud, identity theft,
or other crimes. Sensitive data must be encryption at rest and in
transit, using a modern (and correctly configured) encryption
algorithm.

49. Mitigation

50. 3) Injection
• Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur
when untrusted data is sent to an interpreter as part of a command
or query. The attacker’s hostile data can trick the interpreter into
executing unintended commands or accessing data without proper
authorization.

51. Mitigation

52. 4) Insecure Design
• Pre-coding activities are critical for the design of secure software.
The design phase of you development lifecycle should gather security
requirements and model threats, and development time should be
budgeted to allow for these requirements to be met. As software
changes, your team should test assumptions and conditions for
expected and failure flows, ensuring they are still accurate and
desirable. Failure to do so will let slip critical information to
attackers, and fail to anticipate novel attack vectors.

53. Mitigation

54. 5) Security Misconfiguration
• Your software is only as secure as you configure it to be. Using ad hoc
configuration standards can lead to default accounts being left in
place, open cloud storage, misconfigured HTTP headers, and
verbose error messages containing sensitive information. Not only
must all operating systems, frameworks, libraries, and applications
be securely configured, but they must be patched/upgraded in a
timely fashion.

55. Mitigation

56. 6) Vulnerable and Outdated Components
• Components, such as libraries, frameworks, and other software
modules, run with the same privileges as the application. If a
vulnerable component is exploited, such an attack can facilitate
serious data loss or server takeover. Applications and APIs using
components with known vulnerabilities may undermine application
defenses and enable various attacks and impacts.

57. Mitigation

58. 7) Identification and Authentication Failures
• Application functions related to authentication and session
management are often implemented incorrectly, allowing attackers
to compromise passwords, keys, or session tokens, or to exploit
other implementation flaws to assume other users’ identities
temporarily or permanently.

59. Mitigation

60. 8) Software and Data Integrity Failures
• Software and data integrity failures relate to code and infrastructure that
does not protect against integrity violations.
• An example of this is where an application relies upon plugins, libraries, or
modules from untrusted sources, repositories, and content delivery
networks (CDNs).
• An insecure deployment pipeline can introduce the potential for
unauthorized access, malicious code, or system compromise.
• Lastly, many applications now include auto-update functionality, where
updates are downloaded without sufficient integrity verification and
applied to the previously trusted application. Attackers could potentially
upload their own updates to be distributed and run on all installations.

61. Mitigation

62. 9) Security Logging and Monitoring Failures
• Insufficient logging and monitoring, coupled with missing or
ineffective integration with incident response, allows attackers to
further attack systems, maintain persistence, pivot to more systems,
and tamper, extract, or destroy data. Most breach studies show time
to detect a breach is over 200 days, typically detected by external
parties rather than internal processes or monitoring.

63. Mitigation

64. 10) Server-Side Request Forgery
• Server-Side Request Forgery (SSRF) flaws occur whenever a web
application fetches a remote resource without validating the user-
supplied URL. It allows an attacker to coerce the application to send
a crafted request to an unexpected destination, even when
protected by a firewall, VPN, or another type of network access
control list (ACL).

65. Mitigation

66. System Requirements for Network Penetration
Testing
• Minimum System Configuration
• Windows 10 in Host Machine
• Machine Specification: 4GB to 8GB RAM, 100GB HDD or SSD, 2CPU
• Virtualisation Platform
• Virtual box (https://www.virtualbox.org/)
(or)
• VMware (https://www.vmware.com/in/products/workstation-
player/workstation-player-evaluation.html)
• OS needs to be installed inside VM
• Kali Linux (https://www.kali.org/get-kali/#kali-platforms)

67. Deploying a Vulnhub machine in same network for
hacking
Download Metasploitable 2 Image - https://www.vulnhub.com/entry/metasploitable-2,29/

68. Deploying a Vulnhub machine in same network for
hacking (Contd.)

69. Deploying a Vulnhub machine in same network for
hacking (Contd.)

70. Tools Installation
• Nessus & OpenVas
• Burp suite Community Edition (Inbuilt with Kali)
• Nmap (Inbuilt with Kali)
• Metasploit Framework (Inbuilt with Kali)
• Hydra (Inbuilt with Kali)
• Searchsploit (Inbuilt with Kali)
• Wireshark (Inbuilt with Kali)
• Netcat (Inbuilt with Kali)

71. Nessus Installation
• Download Tenable Nessus - https://www.tenable.com/downloads/nessus
• Once it is installed visit https://localhost:8834/#/ in Web Browser
• Choose Nessus Essentials in welcome screen

72. Obtain Activation code for Nessus Essentials
• Visit - https://www.tenable.com/products/nessus/nessus-essentials

73. Nessus Scanner Interface

74. OpenVAS Installation
• sudo add-apt-repository ppa:mrazavi/openvas (press ENTER when
prompted)”
• sudo apt-get update
• sudo apt-get install -y sqlite3
• sudo apt-get install -y openvas9 (select YES when prompted)
• sudo service openvas-manager restart
• sudo greenbone-nvt-sync
• greenbone-scapdata-sync
• greenbone-certdata-sync
• sudo openvasmd --rebuild --progress
• sudo service openvas-manager restart

75. OpenVAS Scanner Interface

76. THANK YOU !