Beginning Pen-200

0:00Welcome back to our continuing journey of pen testing here where we kick off

0:04pin 200.

0:05And we're going to be covering a wide variety of topics all throughout this

0:09course as we start to get into advanced tool usage and also some very advanced

0:15techniques when we start to actually exploit some of the boxes themselves.

0:20First things first, let's always remember if we're pen testing, let's get our

0:24system or network owners permission.

0:26And when we do conduct that pen test, make sure it's within the bounds of the

0:30agreed upon scope. We don't want to begin in trouble as we're going out doing

0:34our exploring.

0:35But there are a few things that we're going to be covering along the way. First

0:38and foremost, like we've always talked about before, we're going to be doing

0:42information gathering where we do a lot of reconnaissance and the theme going

0:46throughout this is you're going to notice that we've and we've covered this

0:49before.

0:50The basic five phases of going into pen testing, which will get more in detail

0:55here in just a moment as we get into our first topic of note taken.

1:00And that's a part of information gathering as we continue on after we establish

1:05how do we do our notes just as a baseline. You ain't got to do everything by

1:10the way I say.

1:11We also want to go into vulnerability scanning because we don't know what to

1:16exploit if we don't have a fair idea of what it is that we're actually

1:19leveraging against.

1:20We're going to be going over a lot of the tool usage and how to actually read

1:25some of those reports and get an idea on if we can leverage something or if it

1:30's worth our actual time to try and do.

1:33Because as we know there are many different ways to scan that orange and once

1:37we get past the actual vulnerability assessment and understanding our

1:40plane and scope of how we're actually going to be pen testing an organization

1:46or an individual system.

1:47We're going to get into the actual attacks themselves and start going way more

1:51deeper into some of the tools that we introduced in the 100 and 103 courses

1:56along the way.

1:57And once we get through all that we're going to start putting all the pieces

2:01together and kind of wrap up on how we can actually come back around and fill

2:04out that executive summary for our finalize report.

2:07Now we'll be getting into the executive summary here in this particular skill,

2:11but I wanted to let you know it's good to know the note taking and executive

2:15summary stuff now.

2:17So that way we can have it as a baseline of understanding as we go throughout

2:21all the different techniques that we've learned for pen testing.

2:25Now with all that out of the way, let's go ahead and do it to it and start

2:28getting into our note taking

0:00One of the biggest questions that we ask ourselves inside of cybersecurity

0:04pen testing and anything business related, not just the IT portion,

0:09is why do we take notes?

0:11And it's very critical that we understand the beginning middle of end of every

0:15practice that we took along the way.

0:17And this is where it starts time into the actual pen testing itself.

0:21Pen testing is a very specific practice.

0:24And whenever we go through and conduct a pen test on an organization,

0:29it's critical that we keep notes because if a

0:33vulnerability leveraging technique goes outside the scope of what we're

0:39allowed to actually pen test, we need to keep meticulous notes on what command,

0:43what tool, basically the five W's on what it was that we did that caused that

0:50incident. Likewise, we need to make sure that we keep notes so that way we can

0:55give an basic report of what actually happened throughout the pen test itself

1:01in the executive summary.

1:02And we'll be going more into the executive summary as we continue throughout

1:06this skill. But what is it that we're actually covering inside of our note

1:12taken? Well, basically the five W's.

1:14So who, what, when, where, and why?

1:16And when we take a look at those five W's, we're taking a look at who is it

1:20that we're attacking?

1:21Basically, who is it that we're working for?

1:24Who is it that we're conducting the pen testing against?

1:27And who is it that's actually with us on our pen testing team?

1:31There's a whole lot of who involved in all this.

1:33And what is it that we're doing?

1:36Well, we're conducting a pen test, obviously, but what tool are we using?

1:40What technique are we using?

1:42What system or network scope are we actually going up against when we do

1:48that actual pen test or wouldn't we use a specific tool?

1:52When are we doing this?

1:55Because this plays a big factor in what's actually going on on the actual

1:58network itself.

1:59Let's say we're actually conducting a network scan during peak business

2:05hours.

2:05That's critical information to know because some of the traffic that we

2:09generate from our pen testing tools could potentially affect what's actually

2:15going on during regular business hours.

2:17And it could also reveal to us some vulnerabilities during peak and off peak

2:23hours.

2:23Let's say, for instance, we're running a vulnerability assessment against port

2:2880.

2:28And during the day when peak hours are at their highest, port 80 is being

2:35utilized

2:35the most.

2:36And so you would potentially see more avenues of approach when it comes to port

2:4180

2:42on that particular threat assessment, maybe, maybe not.

2:46Or maybe at night when nobody's paying attention to the web server, you see

2:49more

2:50there or less there.

2:51But this is a big part of going into wind and depending on the agreement that

2:55we

2:55have with the organization, we're actually pen testing that plays a factor as

2:59well.

3:00We may not be allowed to actually pen test during peak business hours.

3:03Good information to know though.

3:05And that's why we log when this stuff is actually happening because it all

3:09comes

3:09back to time stamps.

3:11Where are we actually doing this at?

3:12Are we doing this in the actual building itself?

3:15Are we doing this remotely from a different location that's nondescript in its

3:20nature?

3:20Or we actually doing this as a part of a collective for, let's say, Amazon

3:27cybersecurity red team and they're doing a pen test against Microsoft pick one.

3:32But the where in this is very critical too, because let's say, for instance,

3:37you

3:37decide that you want to run a pen test that's leveraging FTP servers and you're

3:43doing it from outside the network perimeter of the organization with pen

3:47testing.

3:48Well, there may be different firewall rules for internal versus external

3:53network

3:53configurations.

3:54And that's always a big consideration when we're going through and doing

3:59different

3:59types of pen testing and vulnerability assessments.

4:02You may see things that are quote vulnerable from the outside, but are

4:08completely different reporting on the inside.

4:11And why are we doing all this?

4:14Well, we're doing this because basically we're getting paid.

4:18I'm just kidding.

4:19We're doing this because we want to protect all of the systems and networks

4:23that we're being contracted to protect.

4:25And pen testing is a large part of making sure that we are fully defended

4:31against cybersecurity attacks that are in real time.

4:34Pen testers use the technique of best practice in real time in order to be able

4:41to build defenses against those threats.

4:45If we go in and we do a controlled and coordinated attack and the defense team

4:50on the for the organization going against the pen test knows about it, there's

4:55a

4:56strong possibility that they're going to be well prepared for that attack.

5:01Also, one practice to keep in mind too is that if you're pen testing yourself,

5:06you're not always going to be 100% truthful in your actual reporting because

5:11you may find it that there you may find that sometimes there are defense

5:17personnel

5:18out there that are a little embarrassed about letting people know some of the

5:21faults that they had within their own system or network.

5:23There's no shame in pen testing, but it is human nature that one of the biggest

5:29concerns is embarrassment from the system administrator's part made in

5:36some of those lines.

5:37So we usually get a third party team that comes out and does all of that pen

5:41testing because they have no shame.

5:44I have no shame.

5:45And when we go in and print out our results in executive summary form and go

5:51back to the C suite that's actually contracted us out, we're not worried

5:55about making friends on the inside of that organization.

5:58We're just there to do a job and make sure that all vulnerabilities are either

6:02identified or patched.

0:00Now, if there's one thing I want you to remember more than anything else when

0:03it comes to note-taking is time stamps.

0:05And I'm going to show you an example here in just a second.

0:08But the reason I point this out is because we need to make sure that we're syn

0:12ced with the actual time of the system that we're using or systems that we're

0:18conducting the pen test with and the actual organization that we're doing

0:22conducting the pen test on.

0:23And this is the same for an investigation that we would be conducting on the

0:27digital forensic side of the house.

0:30Because the time stamps don't match up or if there's not a best way to put it

0:34like a footnote inside of our executive summary that states what our timestamp

0:39scheme is, then it could be that the organization that we're conducting the pen

0:44test for thinks that we're outside of our scope in some way.

0:48Let's say business hours or peak hours are from nine to five and the

0:53organization that we're working for doesn't want us conducting pen test between

0:59nine and five.

1:00So basically, five, oh one in the afternoon, all the way up to eight, fifty

1:05nine in the morning and through the night.

1:08And if our time stamps are off and there's no indication that there is a skew

1:12of any kind whatsoever, this could cause problems when we're presenting the

1:17executive summary to those that were who are responsible for paying us.

1:21So let's take a look at an example real quick.

1:25This operating system should be very familiar by now because we're going to be

1:29using it a lot throughout this course and it is Kali Linux.

1:32So let's take a look at something real quick and that is on the top right

1:36corner, sorry, I had to turn my zoom in on you see a little bit of my OBS not

1:39apologize for that.

1:40But you see you up at the top where it says my time is four, fifteen, forty

1:44eight p.m. This is where we get a little bit outside and timescued because I

1:49want to pull this up real quick for my actual system itself.

1:55Right here and right there, you can see that it is six six TPM on the same day.

2:02Now I can verify that it's the same day if we go inside of here and just click

2:06right there. It's May 14 2025.

2:09But that's time is off from what the actual system is showing the host system.

2:16And if I'm conducting the pen test here, I need to account for that and state

2:20that there is a two hour timescue between the actual system that's conducting

2:25the pen test, which is Kali and the host system that we're on this our host

2:29system or whichever system that is that we're going to be attacking.

2:32Now, there's a couple of different things that you need to look out for when

2:36you're doing this. And that is is our system time synced with any kind of GPS

2:42are

2:43a time server, I say GPS because that's where I get my time from. We could go

2:47into properties here and go into time and date settings and you can see here

2:53that it's manually said.

2:55Configuration is manual. And then pull you real quick right there.

3:00And I'm not going to mess with that because inside of VMware, which is where I

3:04'm at right here, I'm moving it over so you could see.

3:08I'm going to right click on the actual VM that we're operating on and go into

3:11the actual settings.

3:13Experiences may vary if you're using virtual box. But if I go into the options

3:20of the actual VM that I'm on and go into VM tools, I'm going to zoom in and

3:25show you here real quick.

3:26You can see that there is a feature that's unchecked inside of the box called

3:31synchronous guest time with host.

3:34And that makes sure that our virtual machine is synced with the actual host

3:39that we're using for our virtualized environment.

3:42Now, this only goes so far as to make to ensure that the actual host itself is

3:49synced.

3:50So that's why I'm using time servers and GPS to make sure that this host system

3:54is good.

3:55So that way the actual virtual systems are good. Now, you can see here, if I

4:00click on date and time again, just like that,

4:03we have our time synced with what's actually on the actual host system itself.

4:09Move that there real quick and then move this over so you can see both at the

4:13same time.

4:14And right there, 618 on both systems, the host and the virtual one.

4:20So in a perfect world, I wouldn't have to account for any kind of time skew

4:26between the system that I'm pen testing with Cali,

4:30which is my virtual about virtualized environment and the target, which is

4:34actually going to be the host system for a lot of this.

4:36There will be exceptions, but that's just because everything's right here in

4:40the same location.

4:41It's important to remember that we're not always going to be in the same time

4:45zone as the actual targets themselves.

4:48Could be that we're a third party pen tester that's located here in Texas

4:52working against an organization for cybersecurity readiness in Eugene, Oregon,

4:58who knows.

4:59But if you're well aware of time zones, you know that Eugene, Oregon is two

5:03hours behind Texas.

5:05So when you're doing your reports and your note taking, it's always imperative

5:09to remember that there either has to be a standardized way of keeping time, let

5:13's say, like GMT or zoom time for your DOD folks out there,

5:17or you account for the time skew in your report by stating that there is a two

5:22hour skew between the target targeted systems and the ones that are actually

5:27conducting the pen test.

5:29So I just wanted to bring that up and let you know that when this is happening,

5:32time stamps are a very critical thing because that can be the make or break

5:37between staying within the scope, also reporting results correctly and seeing

5:42if the

5:43vulnerabilities that you find based on that time are in fact true, but when you

5:48found them.

5:49[BLANK_AUDIO]

0:00Number one or number two number one or number two number three or number four

0:07number three or number four

0:10You might have noticed a difference between number one and number two

0:14Being that one was just a command and the other one had the full syntax with it

0:20And number three and number four with the full syntax and output along with

0:25time stamps versus no time stamps

0:28And if you want you can go back and take a look

0:30But the point behind this is is that we want to be able to provide as much

0:34information as possible and provide those time stamps

0:36So let's add time stamps here. We are in our handy-dandy Cali box and we want

0:41to run a simple command of

0:43In-map we're doing a very quick and nitty-gritty

0:47reconnaissance to figure out what's actually out there on the network and

0:50By doing so it'll tell us what's open and what's available at that particular

0:55time of scan

0:56Well, there's that keyword again time because we want to make sure that we are

1:01within

1:01Compliance of our scope and our rules of engagement to make sure that we are

1:06doing everything when we're allowed to do it

1:08If there are any time constraints

1:10So if I zoom in for you here real quick, you'll notice that there's no time

1:15stamps whatsoever

1:16and even if we run a simple command, let's say in-map and

1:22We're just going to do a quick scan real quick. We could hit enter on this and

1:26we can see that

1:27Let me pause and zoom in for you there real quick

1:29There is a timestamp on the actual in-map command them itself

1:33But there won't be actually anything in the actual terminal other than what's

1:38in that command or tool that you're using at that time

1:41So now there are different ways to do this and what I like to do when I'm

1:45getting into want to keep track of every

1:48Thing that's going on to the second I can actually

1:52Incorporate time stamps inside of the channel itself to make things a little

1:56bit easier on me now

1:58I've cleared the screen and we're gonna walk through this together because I

2:00want to make sure that we all

2:01Can follow along and make sure that we're installing tools correctly first and

2:05foremost

2:06I want to make sure that we have a pseudo apt

2:08update that's ran to make sure that we have all the available packages to us

2:14from the Cali repository

2:16Now I've done this offline and already did all of our upgrades

2:19So this shouldn't take too terribly long now. I've cleared so we're gonna go

2:23ahead and do a pseudo apt install more utils

2:27and

2:28You can see there that it's gonna add a couple of different things to it

2:32But yes, we want to go ahead and install that and timestamp is one of the

2:35things that's included inside of the morning tilt

2:38And we'll be able to pipe it with some of the commands that we're actually

2:42using

2:43Such as in map now obviously that didn't take too long

2:46But I want to give you an example real quick

2:48We're going to do an if config - a and pipe in

2:52TS and you can see here that we get time stamps now

2:57With every line of output that's going through to include the actual initiation

3:02of the command itself

3:04Which was 18 to be 859 now if I run this by itself

3:08if config - a you can see that there are no time stamps there and

3:13that

3:15Just to give you a compare contrast now this comes into play a whole lot better

3:20when we go into in map and

3:21We ran it while while ago

3:24But now we're going to pipe a TS on the end of it and you can see here for a

3:29fact

3:29I'm gonna stop and zoom in for you real quick not only do we get the actual

3:33timestamp on the end of it itself

3:35But at the beginning of it we get the full

3:38formatted to our system timestamp May 14 659 32 seconds and

3:43Starting in map 7.95 and you'll notice that on the end map

3:48It doesn't actually have the seconds on there now is that getting two in the

3:51weeds on the time stamps?

3:52Maybe but for me it makes sense and if I zoom out you can see that

3:58The the entire program ran it took about four seconds to complete a quick scan

4:03of the overall network

4:05And we have time stamps to prove every little thing that happened

4:09so when we start going and comparing two logs on the network for our

4:13Roundup meeting with the actual

4:16Administration teams they can actually go through in their network logs and see

4:21at that particular time

4:22Based on timeskew if there is any and see if that lines up with their systems

4:28If not it could be an indication of the vulnerability or if it does yes

4:33they got it and it was duly noted.

0:00Alright, so we've got time stamps, commands, got the history configured to be

0:04able to

0:05include time stamps, then over some of the things that we need to be on the

0:08lookout for

0:09for time skew.

0:11Let's get into taking notes.

0:12And this is going to be a big part of everything else we do all throughout the

0:16skill, so I

0:16kind of want a hammer on this now instead of having to nickel and dime it all

0:20the way

0:20throughout the entirety of the course.

0:23So let's go back and remember.

0:28The five phases of pen testing and they go down to reconnaissance, scanning,

0:34vulnerability

0:35assessment, exploitation and reporting.

0:39Now I know what you're thinking important has its own section that should be

0:42where all

0:42the notes are, right?

0:44Wrong.

0:45We need to make sure that we're keeping notes the entirety of the time because

0:48when we do

0:49get to reporting, it's going to be that executive summary that we're going to

0:53cover in a little

0:53bit, but we also need to make sure that with the notes that we do have that we

0:59either don't

1:00repeat a step by accident, don't mess up a step by accident or do anything else

1:03by accident.

1:05And during the reconnaissance phase, we're going through and basically scoping

1:10out the

1:10entirety of what's entire within the organization that's within our rules of

1:16engagement.

1:17This is our time for us to gather that preliminary information.

1:22And the note taking comes critical because there may be items or systems within

1:27the organization

1:28that were pen testing that don't need to be touched.

1:31And that would be something that we need to make note of.

1:34And I've said this before in terms of like, make a note of it.

1:39This is what we're actually talking about now because if there's a particular

1:43target

1:43system out there that does not need to be touched and it was inside the rules

1:47of engagement

1:48and we didn't make a note of it, that could really come back to bite us in the

1:52butt because

1:52it's either going to get us canceled out of a contract, we may have to recoup

1:57some

1:57costs and that does happen.

1:59When we're actively scanning, just like we saw in the N-Map earlier, there's

2:03going to

2:03be a lot of information that comes back and the scope within the rules of

2:06engagement can

2:07go even deeper.

2:09We're allowed to attack some ports but not others.

2:12We're allowed to attack some systems based on time and not others.

2:16And the notes that we get during the scanning process basically allow us to be

2:20able to keep

2:21track of the different vulnerabilities, the different systems out there and

2:26also be able

2:27to know what kind of a service plane that we're attack surface that we have for

2:34those

2:34particular systems within the scope of our pen test.

2:38So the notes for this one would be if you wanted to imagine real quick, a

2:43spreadsheet

2:44could be something like this.

2:45One nine two one six eight zero dot one through two fifty five and then based

2:50on the ports,

2:51you know, the commonly found ports are the ones that you want to attack or the

2:55ones that

2:55are open, you could say zero dot one had port 80 open and 443 and go through

3:01line by line.

3:02Instead of having to rerun thing all the time or rerun your scanning.

3:07Now you will rerun scans as you go throughout your pen testing process because

3:12certain systems

3:12do different things based on different times of day and different activity with

3:17the user.

3:17But it's good to have a baseline of notes taken on the side to make sure that

3:21we're

3:21all in line with this.

3:23And the same thing goes with vulnerability.

3:24If you have a specific system out there that has a vulnerability report or

3:30different

3:30whole network systems out there, you can actually go through the actual

3:35vulnerability report

3:36itself and go through and make notes on it of hey, I scanned it at this time,

3:41which will

3:41be in the vulnerability assessment itself or you can go through and note on

3:45there, hey,

3:46I've ran across this vulnerability before and I've leveraged it with Metasploit

3:50using

3:50this plug in and just something to keep note on the side of.

3:55Exploitation kind of in the same vein of this, you know, what results are you

3:58getting

3:59back and did you find something else during the exploitation that you wanted

4:02nine deeper

4:03on and you can make a note of that.

4:05And then all of it gets pulled all together and tallied up between you, me and

4:10the team

4:10that we have together to be able to build out that executive summary.

0:00Now, I just want to hit on one more thing before we start even noting it into

0:03our executive summary of the wrap up of the skill.

0:06And that is, where do we take notes at?

0:09Well, this is more of a shooter's preference thing.

0:12All I'll say for sure is that there needs to be a surefire way of backing that

0:18up and being able to call upon those notes for reference later on, be it an

0:23investigation or verification or whatever the case may be.

0:28Now, my method of taking notes is usually pen and paper and something as simple

0:34as a regular notes booklet is and I keep one of these per

0:40pen test or investigation that I use.

0:43And the reason I do this is because some of these, if you can see up at the top

0:48right there, it has month and date that I could just simply circle on there and

0:54the title up at the top.

0:56Now, I put bullet points in there, things like I walked up to the system, I

1:01began my pen test.

1:03This is the tool that I use, this is the command that I use.

1:06Now, for the purposes of this course and being that we are computer based

1:10training online, I know that this is not always applicable to the things that

1:15we do because I'd have to be able to write and scan every page that I took

1:20notes on.

1:21That being the case, as you can see over here on this screen, I have a Word

1:25document opened up and I just want to pull that over here in just a second and

1:30show you a couple of tricks real quick.

1:32So here I am in Microsoft Word and I promise that this is elbows at hand, but

1:37it comes in handy if you want to use it.

1:41So I'm going to go to file and go down to options real quick and make sure that

1:46in my customization river ribbon that on the right side, I have right there

1:51developer checked for us to be able to do this.

1:55Once that's done, you should be able to go to the developer tab, which is what

1:59I'm on now and up on the top left is I'm going to zoom in for you real quick is

2:03the macros button.

2:05Inside of macros, you can see that I have one in there called timestamp and I

2:09've exported this and I want to put it in as an attachment right below this

2:13video.

2:13Go into edit it. You will see that I just put in a simple selection there that

2:19allows me to be able to do the timestamp of your month day with the actual time

2:23itself.

2:24By all means, with this as you want based on how you are your organization does

2:30. But the reason I've pointed this out is because I also go through and go into

2:36file.

2:36Options.

2:38Customize ribbon and then go into customize keyboard shortcuts. And if I go all

2:45the way down to macros on the left, you'll see that I already have one set for

2:50timestamps, which is that macro we just created.

2:53Along with all control one as being my actual keyboard shortcut to that. So

2:59long story short, if I go inside of word now and specifically inside of this

3:04document or I have a separate word overall.

3:07But if I go through and say all control one. There's my actual timestamp right

3:14there and I can say opened case or pen test.

3:19And then and then all control one again and then say.

3:25Assigned Eric to pen test.

3:33And you get the idea is we can go through and hit the timestamp anytime that we

3:37need on our keyboard. So that way, as we're making notes and annotations about

3:42different tools that we use different things that you ran across.

3:45We can put the actual timestamp in there correlate with what we've learned

3:50inside of Cali by going through and comparing it to the actual bash history or

3:55even in the terminal itself.

3:58And this allows us to be able to alleviate times to all together. So that way,

4:02when we do get to our executive summary, we can nip this in the bud and make

4:06sure that everything's all on the same sheet sheet and use it.

4:10We can also annotate in our notes here if there's a time zone difference or if

4:15there's a problem with the virtual machines.

4:18Specifically with the other site, not always have an access to NTP or yeah.

4:25Now you may think that's a 10 bit silly, but I'm here to tell you that not all

4:29networks out there have NTP or

4:31GPS available to them for time synchronization. You will run across different

4:37networks, specifically in sign of DoD

4:40That are secret and above that don't have access to regular internet resources.

4:46And there are GPS and NTP solutions on those specified networks of class

4:50ifications. However, they're not always readily available, especially in I give

4:57you a little bit behind the curtain here in those mobile command environments

5:00where you don't always have access to the rest of the actual

5:05network. So if you set everything up and you're running internally, they should

5:10have all their systems sync to the domain controller or a central point within

5:15that network.

5:16And if you're brought in the pen test, you need to make sure that whatever time

5:20it is in real time,

5:21along with the notes of what time it actually shows on those individual systems

5:26, because in those closed network scenarios,

5:30you will see timescue happen all over the place. And with the advancement of

5:36CPUs and GPUs and all the other fun parts that are a computer nowadays,

5:41there is still a little bit of timescue the longer those systems are left on or

5:46being utilized. So it's not like that day. It's not as bad as the days is

5:51286, 386 and 46 and having to manually set your time at Pascal. Yes, I remember

5:57those, but it does happen over time and it can cause discrepancies within your

6:02reporting.

0:00We've been over how to take notes, make sure that all of our time stamps are

0:03aligned.

0:04Basically, we're building out references for our final executive summary.

0:08Now, I want to point out that in executive summary, you will not have all the

0:13nitty-gritty details of every vulnerability exploit or problem that was found

0:19throughout

0:19the course of our pen test. An executive summary is really just for the C-suite

0:24or

0:26anybody in charge of the organization or network that we're actually doing the

0:31pen test on.

0:32It's a synopsis or a very brief summary of what's actually happened throughout

0:38the course

0:39of our pen test. Key bullet points is the topic here. We don't want to

0:45overwhelm everybody

0:46throughout the executive summary, and we want to try to keep it as short as

0:50possible.

0:51Now, generally, executive summaries are going to be a page or two. That should

0:56be enough information

0:58right there to tell you that only the most important information is only going

1:03to be inside of the

1:04executive summary. Now, as we go through this, I kind of want to point out a

1:08couple of different

1:09areas real quick, and that is, first, starting off, we need to have an

1:13engagement overview.

1:15This will basically be the opening paragraph of our executive summary that

1:19explains

1:20what exactly happened and when did it happen. So, how long did our pen test

1:26take?

1:26When or who did we pen test against and what were we looking for? Followed

1:31right after that are

1:32going to be our key findings. Just for me, and you may be a little bit

1:37different based on

1:39space available within your executive summary or how detailed you want to go,

1:42I generally try to keep this between three and four of the biggest points taken

1:48away from

1:49the actual pen test itself. Again, we're not trying to get too far into the

1:54weeds of what

1:55actually happened, but let's say throughout the course of our pen test that we

1:58discovered that

1:59there was a serious password breach on a critical server within the

2:04organization that were pen

2:06test against. That's something that needs to be highlighted, especially if it

2:10has something to do

2:11with PII or information that is federally regulated, like HIPAA or FERPA or

2:17something along those lines.

2:19And inside of those different three or four areas, we want to bring out the

2:24biggest things that

2:26need to be addressed. Along with those could be like, let's say we did a

2:31username and password

2:33test on the actual network itself against active directory and we found that a

2:38bunch of default

2:39passwords were being utilized or that there were some weak passwords all across

2:44the network,

2:45so easily guessed and things like that. It might be something that you want to

2:49bring up. So many

2:50accounts, XX accounts had the weak passwords that were able to be penetrated

2:55and exploited and

2:57basically just key points. We don't want to go too deep on this one. This is

3:03going to be followed

3:04by our risk assessment and this is just a quick paragraph of where do we as pen

3:11testers see the

3:12overall organization, not one particular system, not an idea of multiple

3:18systems,

3:19but the overall organization itself, low, medium, high, critical, whatever the

3:24case may be, because

3:25it's also possible that you can run a NASA scan and find a high or critical

3:31vulnerability within

3:33the organization and this is an accepted risk by that network or system owner

3:38that's already been

3:39identified as an exception inside of our scope and rules of engagement. If that

3:45's the case,

3:45then that shouldn't really be included here. We just want to have a quick, hey,

3:51where do we see

3:51the organization? Overall, I rate you as medium. There are a couple of

3:55different things on there

3:57that you should take a look at and that should really be it. We're then

4:02followed up by the

4:04recommendations section. What are some quick tidbits that the C-suite can

4:09identify to issue out

4:12orders to the tech team to be able to remediate issues that were found within

4:18the course of our

4:19pen test? These would be very quick and to the point. You don't want to go into

4:24the actual technical

4:25details. For example, let's say those passwords that we were talking about

4:29earlier, we just want

4:31to be able to identify that as a recommendation, maybe users should go in and

4:36strengthen up their

4:37passwords. Maybe the administration team can implement a policy of minimum

4:43strength passwords,

4:44something along those lines, not the actual CB or the configuration idea inside

4:51of the system

4:52itself. Lastly, we wrap up with the conclusion and this is going to be a quick,

4:58this is what happened.

5:00We revealed many different things that were wrong with your organization and we

5:04're going to recommend

5:05a follow-up or not and when that follow-up should take place. For me, on my

5:12executive summaries,

5:14I'm always going to have an included section at the very bottom as well. This

5:18is basically an old

5:20DoD habit because for memorandums for record or anything like that, you'll

5:26always have an

5:27included section at the bottom. Now it's good to have an executive summary be a

5:31synopsis of

5:32everything that happened really quick but also include the detailed information

5:38such as the

5:39vulnerability assessment such as the actual network scan that we did throughout

5:43the pen test itself

5:45and some of the CDE reports of the different things that we found that were

5:49causing or are

5:50raising attention to earlier on in our executive summary. Now all this is

5:55pretty much straightforward

5:57and I will give you an example in the challenge because I just wanted to go

6:02over some of the

6:03different things that we needed to consider when it comes to executive summary

6:07and that's

6:07going to take us into our challenge.

0:00It's challenge time and this one we're going to be making an executive summary.

0:04Now again, it's a summary. It's not supposed to be a dissertation, but I'm

0:09going to cover some of

0:10the information here and put some bullet points right below this video so that

0:15way you can compile

0:16together how you at home would like to compile or present your executive

0:21summary. One thing I

0:23really want to stress here is that there's no single answer for an executive

0:27summary.

0:29Different folks have different ways of presenting information and putting

0:33together and preparing

0:34an executive summary for a pen test, but the idea remains the same with the

0:39five areas that we

0:40covered in the previous portion of the skill. Now between one May and 14 May

0:462025, we conducted a

0:48pen test against CBT nuggets and there were a bunch of areas that we were

0:52looking to test out against

0:55such as systems that could lead to credentials that could lead to unauthorized

1:02access, maybe even

1:03some data that was being exposed and see if we could cause disruption services

1:09based on some of the

1:11exploitation practices that we're going to be trained up in throughout this

1:15course.

1:15And some of those findings that we had are going to be reported in our key

1:21finding section. Now I

1:23have again right below this challenge video some of the findings that we had so

1:28you can expand on

1:29them at your leisure inside of the executive summary. Now based on this

1:33information that I've

1:35given you so far, we have a risk assessment that needs to be made and I'm going

1:41to let you choose

1:42how you want to be able to identify this as a low, medium, high or critical. I

1:48have my own which

1:49will be coming up here in the solution and we'll review it together. And then

1:53whatever recommendations

1:55that you would like to make and they usually are tied to the key finding. So if

1:58you have key

1:59finding number one, you should have recommendation number one and they should

2:03kind of be tied together.

2:05And then whatever your conclusion is and if you want to be able to sign and

2:09validate your executive

2:10summary. So now that you have that information and what you see right below

2:14this video, let's go

2:15go ahead and do it to it and I shall see you in the solution.

0:00It's solution time and I wanted to show you the executive summary that I've

0:04come up with based on the information that we had in the challenge.

0:06Remember, we had the bullet points above and some of the key information in the

0:11actual challenge video itself.

0:13So let's take a look at how I attack this one.

0:16Here we are in my executive summary PDF version of this below so that way you

0:20could use it as a template.

0:22I don't mind.

0:23And there are many other templates out there that you could take a look at.

0:27But the key factor here is that we have all five areas discussed and we start

0:32out with our overview, which is between one May in 14 May 2025.

0:37We did a pen test on CBT nuggets and we basically just gave a five W's of what

0:43happened there.

0:44We move on into the key findings and that was exactly what I put inside of the

0:49challenge bullet points.

0:52And again, you don't have to word them the exact same way I do and I don't want

0:56them the exact same way anybody else does just whatever fits based on the

1:00organization and whatever templates that you require to use or maybe achieve

1:04your preference.

1:05Who knows.

1:06But these are the four areas that we found and after that we put together a

1:11risk assessment and this one I rated it as high.

1:15And the reason for this is mostly due to the vulnerability inside of the web

1:20facing web server along with the amount of user credentials that were either

1:26simple or default passwords.

1:28Now, I do want to take a side here real quick and point something out and that

1:33on the DoD you know who you are.

1:36There are many systems of record that are implemented that have default

1:41passwords assigned to them and whenever I conduct pen testing for DoD or when I

1:46actively did it full time for the army.

1:49This was always a major problem. So if you're with the DoD and you are using

1:53let's say CPC or any kind of command and control software change the default

1:58password because I'm tired of popping them.

2:02So yeah, take that, but our risk assessment is overall high due to those

2:06default passwords and that vulnerability on the web server, which leads us into

2:11the recommendations on how we would actually go about changing this up.

2:15Now these are quick and to the point how I would actually go through

2:19immediately patch.

2:22Go in and take care of that insecure code that's inside of that web server, put

2:27in a group of policy or just find a way to enforce those strong passwords

2:31within the organization.

2:33And then we wrap everything up with our conclusion and my conclusion is that

2:38several areas required our new intention to strengthen the organizations

2:42security posture are needed and I want to come back in 90 days.

2:46And my signature block along with on the bottom left and what's in there

2:50included network scan report vulnerability assessment user and password report.

2:55That way, if after the executive summary is presented to the C suite upstairs

3:00that way the folks in the tech office and I can pull to a side and go into some

3:05of the nitty gritty nerd talk that goes along with this.

3:09Now this isn't trying to insult anybody inside the C suite, but most of times

3:14when we put together an executive summary or do any kind of tech work for an

3:19organization that has a C suite involved.

3:21More often than not that C suites not going to be to in the weeds are hip to

3:27what it is that we as techies do within the organization.

3:32Anyways, you ever form. So it's always good to make sure that the executive

3:36summary is written to where anybody can pick it up within any organization and

3:41understand the base principles of what it is that needs to be done or addressed

3:45inside of that organization after we're done with our pen test.

3:50So now that we have all of our note taken out of the way and have an

3:53understanding of what it is that the baseline is for the rest of this course.

3:58And we know how to properly record it up to those executives upstairs. Let's

4:03start getting into some of the breaking of testing of things as we continue out

4:08through pin 200. I hope this has been a formative for you and I'd like to thank

4:12you for viewing.

4:13[BLANK_AUDIO]