How CORE IMPACT Pro Penetration Testing Works
The CORE IMPACT Pro Rapid Penetration Testing (RPT) methodology streamlines testing of servers, desktop systems, end users systems, web applications, wireless networks, and network devices by automating tasks that would traditionally require significant time, effort and expertise to perform.
The RPT automates the accepted best practice for performing penetration tests through six
key steps:
For additional information, click on the steps in the diagram below.
IMPACT provides integrated Rapid Penetration Testing capabilities across five attack categories
- Network Rapid Penetration Testing: replicates the actions of an attacker launching remote exploits on your network
- Client-Side Rapid Penetration Testing: replicates phishing, spear phishing, spam and other social engineering attacks against end users
- Web Application Rapid Penetration Testing: replicates SQL injection and remote file inclusion attacks against e-commerce, customer self-service, ERP and other web applications
- Wireless Network Rapid Penetration Testing: replicates attempts at discovering Wi-Fi access points, cracking encryption keys, and joining exposed networks
- Network Device Penetration Testing: replicates attempts to access networks and intercept data by detecting and exploiting network router and switch vulnerabilities
The five test approaches differ in the Information Gathering and Attack and Penetration stages, as outlined below. The remaining steps of the Rapid Penetration Test are the same once network access is achieved.
Each step is automated using easy-to-use wizards that simplify testing for new users and allow advanced users to efficiently execute common tasks. Advanced users can also manually run specific product modules to further customize the penetration testing process.
Information Gathering
Network Rapid Penetration Testing |
The Information Gathering step collects data about the targeted network, typically using Network Discovery, Port Scanner, and OS and Service Identification modules. Alternately, you can complete this step by importing information from your network mapping tool or vulnerability scanner. Access to a vulnerability scanner is not required to use IMPACT. Key Capabilities
|
Client-Side Rapid Penetration Testing |
In the case of end-user testing, Information Gathering involves the collection of email addresses to target with phishing, spear phishing or other social engineering attacks. IMPACT offers a number of modules for gathering email addresses of individuals in your organization, or you can enter or import your own list of email addresses to test. Key Capabilities
|
Web Application Rapid Penetration Testing |
During this phase of the Web Application Rapid Penetration Test, IMPACT crawls through web pages and identifies pages to test. Alternately, you can import the results from popular web application vulnerability scanners and validate imported vulnerabilities for exploitability. Key Capabilities
|
Wireless Rapid Penetration Testing |
IMPACT Pro’s discovery capabilities allow users to identify both authorized networks and unauthorized points of access. It then profiles any networks discovered by analyzing signal and packet data to measure network strength, determine security protocols, and identify devices interacting with the involved network.
|
Network Device Rapid Penetration Testing |
IMPACT Pro’s locates network devices as part Network Rapid Penetration Testing. If IMPACT discerns the operating system of a target and confirms it to be a network device, it will attempt to collect information about the device. Alternately, IMPACT includes a Passive CDP network discovery module that listens for broadcasts from Cisco devices. Key Capabilities
|
Attack and Penetration
Network Rapid Penetration Testing |
During Attack and Penetration, CORE IMPACT Pro automatically selects and launches remote attacks leveraging IP, OS, architecture, port and service information obtained in the Information Gathering step. You can choose to launch every potential attack against each target computer, or you can have the system stop once it successfully deploys a single Network Agent, which carries the attack payload. You maintain full control over which computers are attacked and the order in which exploits are launched. In addition, you can further simplify and speed tests by excluding exploits that may leave a target service unavailable or take a long time to run. Key Capabilities
|
Client-Side Rapid Penetration Testing |
In the Attack and Penetration stage of the Client-Side Rapid Penetration Test, you create an email, associate it with an exploit, and go phishing. The product includes sample email templates that mimic common phishing attacks. You can also create your own custom spear phishing emails that leverage inside knowledge of your organization. IMPACT’s extensive library of client-side exploits includes attacks that target endpoint applications, endpoint security solutions, and endpoint operating systems and services. The product also takes care of sending the email, giving you options such as selecting an SMTP server or spoofing a specific “from” email address. Key Capabilities
|
Web Application Rapid Penetration Testing |
CORE IMPACT Pro enables you to test web applications for Persistent Cross-Site Scripting (XSS), Reflective XSS (both for static HTML and Adobe Flash® objects), Remote File Inclusion for PHP applications, SQL Injection, and Blind SQL Injection. IMPACT then dynamically creates exploits to prove whether the vulnerabilities pose actual threats. If an exploit is successful, IMPACT establishes an Agent that allows you to take a number of actions to reveal at-risk information assets. Key Capabilities
|
Wireless Rapid Penetration Testing |
CORE IMPACT Pro determines keys by taking advantage of known vulnerabilities in WEP-secured networks. The solution also assesses networks secured by WPA and WPA2 (using a Pre-Shared Key) via dictionary attacks that leverage information from sniffed authentication attempts. Finally, IMPACT enables you to intercept wireless transmissions and conduct Man-in-the-Middle attacks.
|
Network Device Rapid Penetration Testing |
IMPACT Pro uses dictionary attacks to guess passwords and gain access to network devices. Once the device is compromised, IMPACT offers various modules to demonstrate the ramifications of the breach. Key Capabilities:
|
At this point in Client-Side and Web Application* Rapid Penetration Tests, you can deploy a Network Agent on the compromised end-user system/web server. In Wireless and Network Device Rapid Penetration Tests, you could begin a Network RPT against systems revealed by the compromised wireless network or network device. This pivoting capability enables you to replicate sustained, real-world attacks that attempt to traverse paths of vulnerabilities throughout your environment.
*Applies to Microsoft SQL and Oracle servers compromised via SQL injection and web servers compromised via remote file inclusion for PHP.
Local Information Gathering
The Local Information Gathering step collects information about computers that have IMPACT agents deployed on them. During this step, you leverage Network Agents to interact with compromised computers and gather previously unavailable information about the OS, privileges, users and installed applications. CORE IMPACT Pro can collect information from all deployed Agents or only from those that you specify.
Key Capabilities
- Browse file structures and view file contents on compromised machines
- View rights obtained on compromised machines
- Interact with compromised machines via command shells
- Demonstrate the consequences of security breaches by replicating the steps an attacker would take after gaining access to a system
Privilege Escalation
During the Privilege Escalation step, CORE IMPACT Pro attempts to penetrate deeper into a compromised computer by running local exploits in an attempt to obtain administrative privileges. After Privilege Escalation, you can shift the source Agent to one of the newly compromised systems and cycle back to the initial Information Gathering step, thereby establishing a beachhead from which to run attacks deeper into the network.
Key Capabilities
- Run local exploits to attack systems internally, rather than from across the network
- Gain administrative privileges on compromised systems
- View the networks to which a compromised computer is connected
- Launch attacks from any compromised system to other computers on the same network, gaining access to systems with increasing levels of security
Cleanup
The Cleanup step automatically uninstalls every connected Agent. Agents are uninstalled in post order to support complex Agent chains. In addition, all Agents are automatically uninstalled when closing the active workspace, regardless of whether the Cleanup step is executed or not.
Key Capabilities
- Run penetration tests without installing modules or tools on compromised systems (or altering them
in any way) - Quickly and easily remove all Agents from compromised machines, leaving your network and end-user systems in their original states
Penetration Testing Report Generation
CORE IMPACT Pro generates clear, informative reports that provide data about targeted systems and applications, results of end-user penetration tests, audits of all exploits performed, and details about proven vulnerabilities. You can view and print reports using Crystal Reports or export them in popular formats such as HTML, PDF and Microsoft Word.
Key Capabilities
- Obtain actionable information about exploited vulnerabilities, compromised end-user systems, web application weaknesses and associated risks
- Create activity audits to satisfy compliance and regulatory requirements
- Export report content in popular formats that can be easily customized and shared
