Question

Put yourself in the shoes of an attacker for a moment. Do you believe you would be following a methodology like the OSSTMM or the Pentesting Execution Standard? Would you use a more rudimentary identify, scan, enumerate, attack methodology? Would you use no methodology at all other than blindly launching attacks in hopes of having something stick? Explain your decision and consider what sort of attacker might use which approach if there is a difference. Provide at least 2 resources to support your response

Answer 1

The attackers can be classified as –

(a) Ethical hacker (a certified hacker who uses penetration testing techniques),

(b) Joyriders (attacker is doing it for amusement),

(c) Accidental attacker (network administrator),

(d) Spies (want to steal information to sell it later),

(e) Destructors (want to ruin computer systems, delete data), etc.

Being an attacker, one would like to try all the possible methodologies or no methodology at all. But, the choice depends on the type of attacker.

Different methodologies can be used by the attacker depending on the type of attacker.  

• The OSSTMM (Open Source Security Testing Methodology Manual) or the Pen testing Execution Standard Methodology: The aim of this methodology is to set forth a standard for internet security testing.
• A set of steps (i.e. Information Collection, Active Testing, Data Analysis, and Gap Analysis) is followed to test the security of the client's site.
• The "Gap Analysis" step informs about the enhancements needed in the system under test. This methodology is used by the certified pen-test providers (ethical hackers).
• Rudimentary identify, scan, enumerate, and attack methodology: In this methodology, attacker identifies the target, scan the system for open ports, search for the systems with known weakness, and plan the attack. A common attack is DDoS (Distributed Denial of Service).
• Without using any methodology (blindly launching attacks): This type of attack is usually done by naive attackers.
• I would like to follow the standard methodology (i.e. OSSTMM, Pen-test execution standard) to become an ethical hacker. By doing this I would get the knowledge and experience of hacking without breaking any laws.