Copyright Goodheart-Willcox Co., Inc. 79 Chapter 3 Security Evaluation ■ ■ SMTP querying is the act of using the Simple Mail Transfer Protocol (SMTP) system to obtain e-mail account information. This operation will directly query an e-mail server to locate valid e-mail addresses. E-mail servers run the SMTP protocol and can be located using DNS lookup functionality. These servers maintain a database of every e-mail address in its organization. Using the SMTP command or other utilities can provide these addresses if not blocked by security configurations. Penetration Techniques There are multiple techniques used to conduct a penetration test. These techniques test the controls that are supposed to prevent access to the network, as well as move- ment and gaining higher privileges within the network. Initial Exploitation After research is complete, a pen tester moves on to the initial exploitation stage of the test. An initial exploitation is the act of a pen tester using the information gath- ered during reconnaissance in an attempt to gain entry to a network. At this stage, the tester will also attempt to exploit any vulnerabilities found. Pivot When a network is breached, the tester will conduct a pivot. A pivot is a point of a penetration test in which the tester refocuses attention from the initial point of entry to begin looking for targets and other resources on a network. Pivoting allows a tester, and potentially a hacker, to use a system, collect more information, and access other areas of a computer or network. Lateral Movement Another pen testing technique used is lateral movement. Lateral movement is mov- ing from one compromised host to another host within the network. When the ini- tial access of the network has been gained, the tester maintains ongoing access to the network by moving through compromised areas using tools to gain higher-level privileges. Persistence Persistence is the act of a pen tester attempting to maintain a connection after a successful exploit. One way to do this is to place tools on key devices in the net- work so data can still be obtained. Examples include installing keyloggers, which are devices or software that track a user’s keystrokes, and rootkits, which are viruses that infect computers before their operating systems load. They may also create fake user accounts to establish backdoors and change passwords. Escalation of Privilege An escalation of privilege is a test that attempts to move from a normal user to achieve root or admin privileges while accessing a system. If successful, the tester takes control of the system. In addition to creating higher-level administrative back- doors, areas can be accessed where the tester can remove log files, change metadata, and make other changes to hide hacking actions. 1.8 1.8 1.8 1.8