Penetration Testing For Beginners

Interop workshop instructor discusses what it takes for networking pros to start wrapping their arms around security testing basics

As experienced networking professionals with beginner security skills seek to dip their toes in the waters of penetration testing, step one is to look at their network infrastructures through the eyes of an attacker.
Put people in attackers shoes, and theyll learn to defend their networks better, says Steve Pinkham, a security consultant for Maven Security Consulting and the guy behind the Web Security Dojo project. Plus, lets be honest, its fun to break things, especially when you usually build and maintain things all day.
Breaking things will definitely be on the agenda when Pinkham and colleague David Rhoades hit the ground in New York for Interop. The pair plan to lead a workshop for beginners, titled Hands-On Introduction to Common Hacking Tools, that will push attendees to think like attackers while getting hands-on experience with the types of tools that both white hat and black hat hackers use to compromise enterprise systems. The class, Pinkham says, will walk through basic attack tests while using the penetration testing execution standard as a platform.
[Do you see the perimeter half empty or half full? See
Is The Perimeter Really Dead?
.]
Students will be exposed to how penetration testers use tools such as Kali Linux, OpenVulnerability Assessment System (OpenVAS), Nmap, Metasploit, and Maltego to help them get a better picture of how to assess a network for security.
You need to deeply understand your network and how everything interacts, Pinkham says. What happens typically is that everybody lives inside their silo inside the corporate world, and theres not often someone who does a good job of integrating everything to find bigger-picture flaws. Theres always some old box thats totally forgotten. Thats a lot of what we in the security industry do. I draw a big map and figure out how different parts of that map interact.
Whether theyre students in his workshop at Interop or those who seek to learn more about penetration and security testing elsewhere, Pinkham emphasizes the importance of hands-on learning when starting out.
Really, the only way people seem to get it is to either do it themselves or have someone else demonstrate how it happens, Pinkham says. You want to give people free tools online and a real-world target. Theyre going to pop a shell on it, extract data from it, and do all these things to break it themselves.
He also believes beginners should understand that if they know where to look for free tools, a lot of the heavy-lifting is done for them through automation. In particular, networking veterans such as those at Interop should seek to get more from Nmap than they may even know is possible.
Nmap is so good -- every other tool takes its data and goes from there, he says. So you run your Nmap scan, and then you can import it into Metasploit, you can import it into OpenVAS, and all of these other tools and get further integration.
Not only that, Pinkham says, but Nmap is becoming a very good vulnerability assessment tool in and of itself.
It has tons of scripts built in, and theres more coming out every day that look for a lot of the low-hanging fruit, he says. When you have new advisories come out, theres often an Nmap plug-in that will be out in a few days, and you can look through your network and see if you have any of those just using that tool.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Penetration Testing For Beginners