The Art of Network Penetration Testing with Royce Davis

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Royce Davis, all about the art of network penetration testing. Royce is a co founder of Pentestgeek.com and security expert specializing in network and application penetration testing. He is highly recognizable throughout the the security industry as a thought leader, open source software contributor, author and public speaker. Royce's primary focus is to train and develop ethical hacking professionals. He's also the author of the upcoming book From Manning the Art of Network Penetration Testing Taking Over Any Company in the World. If you go to his pentestgeek.com website, he has a bunch of training. He also has a really cool training on Burp suite and how to build a virtual pen test platform and more. So you don't want to miss this episode. Check it out. It's no secret that this the number and complexity of applications are growing. But what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fordify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you can start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security.

Hey Rice. Welcome to the Guild.

Hey Joe. Thank you very much. I'm happy to be here. Thanks for having me.

Awesome to have you. You have a lot of experience in Sarah, so I'm really excited to get into it. But before we get, before we do, is there anything else you want the Guild to know about that I missed in your bio?

No, I think that was. That was just about everything.

Great. So this is. I like starting off with the softball question for books, people that write books, because I think it takes a lot of time and effort. So I always ask what made you want to write this book on the art of network penetration testing?

Yeah. Okay, great. I always thought that, you know, writing a book would be something that I would be interested in doing if I just ever got good enough at doing something that maybe someone would want to hear what I have to say. So network penetration testing is something that I've done for quite a While, and to be honest, the opportunity kind of presented itself to me, someone from Manning reached out to me and said that they were interested in getting into security penetration testing, ethical hacking. I don't believe Manning has a lot of books on that topic just yet. And they had seen some of the stuff that I'd done on Pen Test Geek and other places. And so they wanted to know if that was an interest of mine. And so I took that as an opportunity to kind of jot down some of my thoughts on pen testing. Specifically. I wanted to create a methodology, sort of a recipe, if you will, that people could follow step by step. And I put everything down on paper and came up with what looked like a decent table of contents and submitted that to Manning. And after some back and forth discussions, we decided on a book. And now here we are, we're almost done, we're almost ready to publish.

Very nice. So yeah, the book is made up of four main sections. You have phase one, info gathering, phase two, focused pen, phase three, exploitations, and phase four documentation. So I thought it'd be great to maybe hit on each area. I guess the first dumb question is, as I mentioned in the pre show, I am kind of a newbie to security testing. I've been doing automation for 20 years, but security testing is fairly new. So is network penetration testing the same as penetration testing or is it a subset of penetration testing?

Sure. So I would say the term penetration testing can be used interchangeably to describe maybe several dozen different types of exercises or activities that all fall within the realm of, you know, what I'll call offensive security testing. That is testing the security of a thing. Could be a company, could be a network, could be a website, an application, a mobile device, could be something physical, whatever. Have you testing it for security vulnerabilities, security weaknesses, in an effort to identify something that an attacker might take advantage of if they had the opportunity to do so, and then ultimately provide a recommendation to the person or persons that are in charge of that thing in order to fix it in order to close those security gaps. So network penetration testing deals specifically with enterprise networks. So you have a company, company xyz, they have a thousand employees who do whatever they do to help make that business run, make money, to help that business make money. And so in order to do those things, they probably have a laptop and a mobile phone and those devices are connected together with the centralized authentication system, usually Microsoft Active Directory, and they share files back and forth and talk to each other. And they have VPNs, et cetera and so network penetration testing is looking at that entire landscape for potential attack vectors that a malicious person, should they be sitting on the Internet or should they stumble into an unused conference room? What could they use to gain access to something that they shouldn't have access to? That's kind of what network penetration testing is all about.

Great. In the intro, you mentioned that the phases you have, actually, you mentioned that they're part of a workflow that you normally go through. Is this a workflow you came up with or is this a common one when you do information gathering and then you do the focus penetration, the documentation, and the privilege escalation?

Sure. So I think it's kind of a hybrid of both. So, you know, it's definitely a logical workflow that a lot of penetration testers and people that do this type of work would do. Would execute. But the book definitely has my sort of, you know, flavor, my experience baked into it, because I've done this for a long time. I've done a few hundred penetration tests for various companies over the last 10 years. And anytime you do something over and over and over again, you develop techniques and tricks to, you know, speed up workflows, to enhance work output, and to just be overall more effective. So I wouldn't feel comfortable to say that, you know, certainly I didn't come up with the concept of information gathering and post exploitation and privilege escalation and documentation, but kind of the method that's illustrated in the book is exactly what I would do sequentially in order to. If you were to hire me to conduct a penetration test for your company, for example.

Nice. Now, I'm still on the intro piece because it's so good. You have a bunch of different, really nice intros of different areas. So I like you have a section on when penetration testing is least effective. I think for some reason people I talk to when they take a security test and they automatically think penetration testing, get a tool like Metasploit, bam, and they're off and running. So what situation do you think penetration testing probably is not as effective as other techniques?

Well, that question kind of goes back to what I said about the term penetration testing, meaning different things to different people. So if I were to define penetration testing as a somewhat active simulation or an attack simulation, and I don't want to confuse that with an advanced adversary simulation that someone will call like a red team, but just the act of having someone pretend to be an attacker and actively try to break in. If I just define a penetration test as that, then I think There are a lot of organizations that probably don't need that type of testing simply because they haven't reached a level of maturity where it makes sense. And what I mean by that is there's a lot of low hanging fruit things that they can do before moving on to a full pen test. Does that answer your question?

Yeah, absolutely. And it also leads into the next. You have another section in the book that talks about before you actually buy a penetration test. Here's six areas you should, you should do before buying. And I think that sets, I think someone up. Really nice to know when is the right time maybe to invest in something like this. So it gets us now into phase one, once we get past that intro and what are some key takeaways you think folks need to know about phase one, the information gathering. You think that some people get tripped up on on the first phase?

Sure, absolutely. And it's probably a good idea before we go into information gathering, just to set the tone for what exactly are we talking about in the book? Because in penetration testing you have internal penetration testing and external penetration testing and you could have physical, you can have application pen testing. There's full gamut of services that a company that does penetration testing would offer. If you are someone that works for a company like that day to day, I would say 80% of your time or more, you're going to conduct what I'm referring to in the book as a typical internal network penetration test or an inpt. And so when we say information gathering, if you're doing an external test, that might mean going out to Google and searching for, you know, IP address ranges, or going up to LinkedIn and searching for employees. But specifically, everything within the art of network penetration testing, we're talking about what I'm calling just a typical 40 hour pen test. That is simulating an internal attacker who's already physically on the network. They're plugged in, they're connected to the corporate network for whatever reason, and now they're trying to essentially take over or escalate their privileges that way. So with that kind of long intro to your question, what information gathering means in that context is it means where are all the computer systems, where are all the IP addresses? And when I have that list of IP addresses, what services are listening on those IP addresses? What version of Apache or Microsoft IIS or Microsoft SQL is this particular server running so that I can cross reference that with a list of known exploitable vulnerabilities or attack vectors and things of that nature. Information gathering is about kind of building your attack surface. Because penetration testing by definition is opportunistic, meaning we don't know what we're going to do until we see what's available to us in the book. I do, I'll admit it. A bit of a far fetched illustration of kind of Ocean's Eleven style heist crew trying to break into a big secure environment. I use that illustration because if you ask that person, well, what are you going to do? How are you going to break into this environment? But they would say, well, what is the, what is, what does the environment have to offer? They would go do reconnaissance, they would look, how many doors and windows does it have? What you know, how often does the cleaning crew go in and out? So this is what we're doing in this phase is we're looking at what network services are available to us so that we can come up with a plan for how we might try to compromise those systems.

Nice. And I also like in this first chapter, you talk about how to set up a lab environment and you have an open source project, I believe that helps with this. Could you just talk a little bit about that for folks that may want to dip their toes in the waters but not compromise in a production environment?

Absolutely, absolutely. So I really wanted to write this book for someone that was conducting an actual penetration test because I felt that there was a bit of a gap between some not so real world training that you might have received to get, you know, certification and an actual pen test that, you know, the company that you just got a job at would ask you to do. And so I wanted to kind of create and illustrate a set of steps that, that you could follow to conduct a thorough pen test. But realizing that not everybody has access to do that or maybe the comfort level to do that, I created an open source project that's called the Capsule Corp. Network. And that's just because I'm a huge Dragon Ball Z fan. That's the corny name that I came up with. But what it is, it's a small Windows network that models a lot of the things that I've seen and other people see every day when they do enterprise network penetration testing. So it has active directory, it has database services, it has web applications, it has systems with shared credentials, so on and so forth. All of the things in the book that you see me demonstrating an attack against, you can actually do those attacks against the Capsule Corp. Network and you know, you won't break anything or if you do, it's, you can just, just reset it.

Great. Besides jumping into tools, hardcore tools to help you with the information gathering, are there any like must know commands folks should know about that they can use that maybe a command line that can get them some information to get some of this information?

Well, definitely. Familiarity with the Linux command line environment in general is certainly a requirement just to do penetration testing in general. In the book I know I included a short, you know, a very short list of just some kind of useful commands that help you search through, you know, large outputs of data and search for specific text strings and you know, order them in a specific way that you want that's useful to you. I put that in a small appendix in the book. But that's really just a very tiny, you know, tiny drop in the bucket. I would say just knowing how to use the command line in general is going to be, it's gonna be very critical for you. If penetration testing is something that you're interested in doing, even if it's just something you want to do for fun, great.

So once you have your information gathered, the next phase or next section you have is focus penetration. I guess once you have the information, what are some key takeaways, then that's what needs to know about with the second phase.

Sure. So one thing I probably didn't mention when we talk about information gathering is all the things that we're looking to discover. We're looking to discover hosts, we're looking to discover services listening on those hosts. And ultimately the reason why we do that because we want to discover vulnerabilities. So it's probably best to understand what is a vulnerability. We could define that in a number of different ways. The way I define it is something that you could take advantage of either authentication, a missing patch, or a configuration issue that would allow you to gain access to something that you shouldn't otherwise have access to do. So we're. So I'm calling that a vulnerability. So during the information gathering phase, you should have discovered a lot of vulnerabilities that you could potentially take advantage of. So during focus penetration you are going through in an organized fashion. And I say organized fashion because I talk about creating what I call protocol specific target lists. So if I have all the, you know, if I have a thousand IP addresses in my pen test scope and maybe 30 of them are running Microsoft SQL Server, well, I'll stick those all in a single text file. Stick those IP addresses in a single text file so that when I use automated tools like metasploit or Medusa or some other tool that's going to do something in an automated way that I can just target those IP addresses relatively quickly. So in focus penetration we just want to go through and all of the low hanging fruit vulnerabilities that we identified, we want to try to compromise systems. Ultimately we're trying to get as big of a foothold as we can on the network so that next phase we can elevate our privileges or elevate our network access as high as we can.

Cool. So you mentioned a few tools there, but I was wondering what kind of automation tools or what tools do you usually use in this phase for actually finding to focus on the penetration phase of it.

So that can definitely be somewhat of a loaded question in real world penetration testing. Again, because it's opportunistic because what you see is what you get. So what I chose to do in the art of network penetration testing is model, you know, common vulnerabilities, common attack vectors that I would say I probably find, you know, 80% of the time or more. And so in that case, you know, we use Metasploit, we use Crack Map, Exec, we use Medusa, we use just really a few tools that are all really doing the same thing for us, which is we're either just brute forcing an authentication prompt, looking for weak or easily guessable credentials, taking advantage of some sort of insecure configuration of an application that allows us to do something that we shouldn't be able to do, or in some cases exploiting a missing security patch or security update that allows us to get a remote shell with a vulnerable system.

Awesome. So once they're able to actually compromise your system, they're in what do they typically do or what are the main objectives you do in the, I guess it's your post exploitation type privilege escalation phase.

So one thing we haven't talked about is the scope or specifically the statement of work, which is obviously going to be the driving factor or the driving force rather determining what you're going to do on your engagement. However, in a typical SAL for a typical internal network penetration test, more often than not the goal is pretty much just world domination on the network. Achieve as much access as you possibly can and find as many vulnerabilities and weaknesses as you can. So you can report that to your client and give them recommendations on how to improve. So with that said, with that being your goal, I like to think of a penetration test as a game. And so I introduced this concept of level one systems and level two systems. And so to your question, when I compromise a system That's a level one system. And it's a level one system because it had some type of directly accessible weakness, whether it had a weak password or a missing patch or some insecure configuration that allowed me to jump in and access that system. Now, somewhere on the network there are level two systems that maybe are by themselves somewhat secure or I'm not able to compromise them directly, but because of some piece of information that I obtain, usually a username or a password, username and a password from a level one system, I can now access these level two systems. And so this is escalating our privileges, moving us up the chain. Ultimately we're just trying to get closer and closer to that world domination level access where we own the entire network.

So who determines in the engagement what you would look for in this phase then? Is it you as the consultant showing them, hey, look, your system probably is more vulnerable to this type of thing because you're an E commerce website or you're a healthcare website, or do they tell you, hey look, here's what we're worried about?

That's actually a really great question. So I'm going to answer that in a couple of ways. So the first thing I want to say is you would be surprised how similar all companies are from a network attack perspective, regardless of how different your business is and in what area or arena it is that you operate and make money. You, you have a bunch of computers and those computers are either running Microsoft Windows OS X or some form, some flavor of Linux or Unix. And so those systems are going to have more or less the same configurations, the same weaknesses or potential weaknesses, I should say, regardless of what type of business you're in. So on the one hand, as a penetration tester, I'm not as concerned, but on the other hand, they're in an effective scenario. There's some scoping conversations happening before the pen test takes place and there's people sitting down asking questions like, what does your business do? How does your business make money? What systems are critical to your business? What would keep you up at night if an attacker were to get here or get there or do this or do that? And asking those types of questions can definitely help drive the direction of a pen test. But at the end of the day, I will treat just about every network the same. Once I've plugged into a data jack and I've got an IP address, I'm just going to go through this methodology. And this methodology, it's kind of foolproof. It doesn't matter what the business is once I figure out where all the hosts are and once I figure out what all services are listening on those hosts, I can then start to check all those services for authentication, patching and configuration weaknesses, and the ones that I find I can compromise. And in my experience, and I think most people that do this type of work would agree with this experience, if you can get on even just one system, one level one system, you can usually find credentials or other pieces of information that allow you to get onto other systems.

So once again, I think it depends. But in this phase, are there any common tools you like to use, maybe to harvest type passwords and things like that?

So in the book I talk a lot about the meterpreter shell within the metasploit framework. I think that's a great remote access tool that's very accessible, especially to someone who's just getting started in penetration testing. We cover, we use a tool called mimikatz, which is really useful when you've compromised a Windows system that allows you to extract credentials. But ultimately, I think, I hope that what I teach is, is more tool agnostic. It's not as much about what tool you use, it's knowing where things are. Once you've been on a Windows system or once you've been on a Linux system, where would you look in order to find credentials? So, for example, in Windows we talk about local account credentials being stored in replayable password hashes that you can obtain from the system and the SAM Windows Registry hive. And I explain, you know, where those files are, how to copy them, how to take them off of a compromised system, and then you could use any tool under the sun. There's probably 100 tools on GitHub that you could use in order to extract password hashes from those files. So I try to remain tool agnostic when possible, instead, teach a process, teach a methodology. But there of course are tools that I will use and that I will highlight. And metasploit is definitely one of those just because of its, again, its widespread popularity and its accessibility to newcomers.

Great. So I think this takes us to phase four, or part four, documentation and delivery. So in this phase, I'm just thinking, when I used to do a lot of performance testing, I generate a huge report of all these different metrics and I'd hand it over to, say, management and their eyes would just roll because they'd have no idea how to follow it. So what do you mean by documentation and delivery? Are there different reports you give to different people within the organization as well?

Yeah, so I Talk about this concept of a solid pen test deliverable. And so let me just back up by saying I realized early on when I started in this career that clients were paying sometimes tens of thousands of dollars, depending on the engagement, for a penetration test. And there was very little output that they were receiving beyond what I was doing and the weaknesses that I was uncovering for them. And the report, if you will, the document I've sometimes joked is, you know, could be it's a $20,000 PDF report because it's the only tangible thing that they're actually buying. So that. So I say that tongue in cheek because the information that goes in that report is very expensive to the client. And so I believe it should be very valuable. And to your point that you just made spitting out a huge list of metrics from automated tools, that's not very valuable and that's not what you should put in your pen test report. So I talk about what I consider to be eight key sections of a good pen test. Deliverable. Knowing, of course, that, you know, different companies and different individuals are going to add their own flavor, they're going to add their own, you know, secret sauce, if you will. But the kind of eight key components that make up a solid pen test, deliverable. And what information should be there and why. And ultimately, the purpose of your deliverable is to provide your client with actionable steps that they can take to make their network, to make their environment, to make their scope, whatever it is that you tested, more secure, more resistant to attacks than it was before you started your engagement.

So great. I love your approach. As you mentioned, this book is geared towards folks that it's not tool specific, so it's agnostic. So anyone to be able to pick up this book, regardless what tools they may be into and should be able to follow along to improve their particular pen testing phases or pen testing framework or routine, I assume.

Yeah, because I learned early on the more different pen testers that I met at security conferences and working for different companies and on the Internet and wherever have you, that I would meet someone that they would do the same thing that I did, but they would use a different tool. Sometimes a tool I'd never even heard of. And so you learn that it's not necessarily you have to use this tool, you have to use that tool. You just have to know how to do this properly, process and that process. And once you know it and understand it. And to be honest, I think a lot of really skilled pen testers, when they get to a certain point, they write all their own tools because they format the output exactly the way that they want them to for their reporting style.

Okay, Royce, before we go, is there one piece of actionable advice you can give to someone to help them with the security testing or penetration testing efforts? What's the best way to find contact you or get our hands on the book the Art of Network Penetration Testing.

Oh, perfect. Perfect. Okay, so definitely the actionable advice that I would say, that I would give people is to take action, right? Penetration testing is a very hands on thing. It's very hard to learn just conceptually in your mind. You have to do stuff and you probably have to break stuff in order to learn things. Which is exactly why I created the Capsule Corp. Pen test environment. I think that's a tremendous resource to someone getting started. I wish they had something like that when I was getting started. It's a fully functioning enterprise Windows environment that you can stand up with vagrant and Ansible and you can pen test it, you can break it, you can reset it. But just be curious. Just be curious. And maybe if you want to be good, you probably have to be a little bit obsessive. And as far as how to get in contact with me, you can email me@roycentestgeek.com or you can hit me up on Twitter DY. That's R3D. Yes, with two underscores at the end because the first R3BY was already taken when I signed up for Twitter.

Thank you Royce for your security testing awesomeness. The links to everything of value we covered in this episode, head on over to testguild.com S25. And while you're there, make sure to click on the Try Today link under the exclusive sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader and application security. So that's it for this episode of the Test Guild Security podcast. I'm Joe and my mission is to help you succeed with creating Full Stack Security Testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security podcast. Head on over to testguild.com for full show notes, amazing blog articles and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.