BCWSC/26/0900 Lessons from PenTesting

• REN/ISAC - Person/Kyle Enlow
  • from University/Indiana
  • they offer penetration testing services
  • he got some CSAP credential
  • what makes a good penetration tester?

    • all their tests were conducted by human beings at REN-ISAC
      • no AI
    • you need knowledge of active directory.services
    • high level of knowledge of group policy
    • sans or equivalent trainint
      • TODO what's SANS?
    • high level of understanding of networks
    • passion and persistence
      • these people are driven
  • vulnerability scan vs penetration test

    • based on nist sp 800-115
      • vulnerability scan
        • precurser to penetration test
      • penetration test
        • try to exploit them
  • types of penetration tests

    • 1 - external
    • 2 - internal or assumed breach
      • see later
    • OWASP/Top 10/2021 vs OWASP/Top 10/2025
      • this should be in your SDLC
      • two added:
        • A03:2025 - software supply chain failures
        • other one ... ?
  • why conduct a penetration test?

    • ftc safeguards rules
      • requirements to monitor and testing can be accomplished through continuous monitoring of that system. if you don't do that then you must conduct annual penetration testing as well as vulnerability assessments, including system-wide scans every six months designed to test for publicly known security vuls
  • why conduct penetration test?

    • 1 - may be required for cyber insurance
    • 2 - no better way to identify misconfigurations and weaknesses in your environment.
  • lesson 1 - infrastructure

    • aws environment
    • customer supplied
    • vpn compatibility amongst linux devices - headaches
      • compatibility
    • they changed it so request that client set up the infra and a kali linux box
  • assumed breach penetration test

    • credentials + vulnerabilities = compromise
    • what is the most common type of activity is for breaching?
      • phishing - why? it's easy
    • the movie "war games"
      • most people are just looking for an easy way in
      • why hack into a system when there are plenty of doors open?
  • Kerberoastable accounts Kerberos

    • "kerberoastable" refers to a security vulnerability Active Directory environm,ents where you can easily obtain a hash for and compromise that account. they've given it a criticality of medium.
    • how it works
      • attacker auth's as a regular user
      • request Kerberos service ticket TGS (ticket granting service), for a service account with an SPN (Service Principal Name)
      • TBS is encrypted with service accounts NTLM hash
      • ... (continued, not transcribed)
    • mitigation
      • rotate passwords - but not so sure?
      • use group managed service accounts?
      • monitor
  • CIS Benchmarks
  • SMB signing
  • TLS 43 day renewal "is coming"

    • that sounds like a short
    • cipher suites
  • MITRE/ATT&CK/Heat Map

    • ports
      • 443 - HTTPS
      • 445 (SMB)
      • 3389 (RDP)
      • 5985 - WinRM - Windows remote management - PowerShell
        • ansible on Windows requires this
      • 22 - ssh
    • they scan and look for ports. they even look at the version of the service running on this port
    • use ai: "take these common ports and map it to the mitre attack process"
    • heat map
      • high is exploitable consistently
      • medium
      • low
    • They have a list of techniques that have all the known possible exploits for common ports
      • so if you get report of possible attacks, then you can see that, and they even have
    • Rogue IT also called Shadow IT

      • hardware, software, or cloud services used within an organization without explicit approval or oversight from the IT department
        

      • "I pick on engineers and physicists and mathematicians"
        • they often stand up systems and don't put systems in place
        • especially if they are segmented on a particular IP subnet
  • Questions
    • What is your career progression?

      • worked on missile detection, then exited military
      • worked at help desk, thinks that's important for becoming a great pen tester.
    • Have you ever discovered something outside the scope of engagement?

      • advance: heavily think about scope. one client wanted 7M ip addresses. think about where the stuff is that you really want them to look at.
      • think about whether you share ip space with anyone else (like police dept!, not uncommon)
      • have you sold any of your ip space? if you don't have good documentation, then you can break the law without knowing it.
      • BYOD - if your policies don't cover that
    • Why don't you use AI?

      • Claude is now in KaliLinux
      • Does everyone remember "Zero Trust?"
        • we don't hear about it anymore

        • AI is kind of like a Sasquatch, I've heard there's been lots of sightings but nobody's ever found one. I don't even know how I'd handle it from a legal perspective if you were releasing an agent into an environment to do a test. That was the consensus of my five pen testers. It's just not there. Until someone can prove to me that there's no risk..."
          

        • let's say you want to write a script with AI, you can use AI and that's where it's powerful
          

    • Some people mention OpenVAS