Beginning Pen-200

0:00Welcome back to our continuing journey of pen testing here where we kick off pin 200. And we're going to be covering a wide variety of topics all throughout this course as we start to get into advanced tool usage and also some very advanced techniques when we start to actually exploit some of the boxes themselves. First things first, let's always remember if we're pen testing, let's get our system or network owners permission. And when we do conduct that pen test, make sure it's within the bounds of the agreed upon scope. We don't want to begin in trouble as we're going out doing our exploring.

0:35But there are a few things that we're going to be covering along the way. First and foremost, like we've always talked about before, we're going to be doing information gathering where we do a lot of reconnaissance and the theme going throughout this is you're going to notice that we've and we've covered this before. The basic five phases of going into pen testing, which will get more in detail here in just a moment as we get into our first topic of note taken. And that's a part of information gathering as we continue on after we establish how do we do our notes just as a baseline. You ain't got to do everything by the way I say.

1:11We also want to go into vulnerability scanning because we don't know what to exploit if we don't have a fair idea of what it is that we're actually leveraging against. We're going to be going over a lot of the tool usage and how to actually read some of those reports and get an idea on if we can leverage something or if it 's worth our actual time to try and do. Because as we know there are many different ways to scan that orange and once we get past the actual vulnerability assessment and understanding our plane and scope of how we're actually going to be pen testing an organization or an individual system.

1:47We're going to get into the actual attacks themselves and start going way more deeper into some of the tools that we introduced in the 100 and 103 courses along the way. And once we get through all that we're going to start putting all the pieces together and kind of wrap up on how we can actually come back around and fill out that executive summary for our finalize report. Now we'll be getting into the executive summary here in this particular skill, but I wanted to let you know it's good to know the note taking and executive summary stuff now. So that way we can have it as a baseline of understanding as we go throughout all the different techniques that we've learned for pen testing.

2:25Now with all that out of the way, let's go ahead and do it to it and start getting into our note taking

0:00One of the biggest questions that we ask ourselves inside of cybersecurity pen testing and anything business related, not just the IT portion, is why do we take notes? And it's very critical that we understand the beginning middle of end of every practice that we took along the way. And this is where it starts time into the actual pen testing itself. Pen testing is a very specific practice. And whenever we go through and conduct a pen test on an organization, it's critical that we keep notes because if a vulnerability leveraging technique goes outside the scope of what we're allowed to actually pen test, we need to keep meticulous notes on what command, what tool, basically the five W's on what it was that we did that caused that incident. Likewise, we need to make sure that we keep notes so that way we can give an basic report of what actually happened throughout the pen test itself in the executive summary.

1:02And we'll be going more into the executive summary as we continue throughout this skill. But what is it that we're actually covering inside of our note taken? Well, basically the five W's. So who, what, when, where, and why? And when we take a look at those five W's, we're taking a look at who is it that we're attacking? Basically, who is it that we're working for? Who is it that we're conducting the pen testing against? And who is it that's actually with us on our pen testing team? There's a whole lot of who involved in all this.

1:33And what is it that we're doing? Well, we're conducting a pen test, obviously, but what tool are we using? What technique are we using? What system or network scope are we actually going up against when we do that actual pen test or wouldn't we use a specific tool? When are we doing this? Because this plays a big factor in what's actually going on on the actual network itself. Let's say we're actually conducting a network scan during peak business hours.

2:05That's critical information to know because some of the traffic that we generate from our pen testing tools could potentially affect what's actually going on during regular business hours. And it could also reveal to us some vulnerabilities during peak and off peak hours. Let's say, for instance, we're running a vulnerability assessment against port 80. And during the day when peak hours are at their highest, port 80 is being utilized the most.

2:36And so you would potentially see more avenues of approach when it comes to port 80 on that particular threat assessment, maybe, maybe not. Or maybe at night when nobody's paying attention to the web server, you see more there or less there. But this is a big part of going into wind and depending on the agreement that we have with the organization, we're actually pen testing that plays a factor as well. We may not be allowed to actually pen test during peak business hours. Good information to know though. And that's why we log when this stuff is actually happening because it all comes back to time stamps.

3:11Where are we actually doing this at? Are we doing this in the actual building itself? Are we doing this remotely from a different location that's nondescript in its nature? Or we actually doing this as a part of a collective for, let's say, Amazon cybersecurity red team and they're doing a pen test against Microsoft pick one. But the where in this is very critical too, because let's say, for instance, you decide that you want to run a pen test that's leveraging FTP servers and you're doing it from outside the network perimeter of the organization with pen testing.

3:48Well, there may be different firewall rules for internal versus external network configurations. And that's always a big consideration when we're going through and doing different types of pen testing and vulnerability assessments. You may see things that are quote vulnerable from the outside, but are completely different reporting on the inside. And why are we doing all this? Well, we're doing this because basically we're getting paid.

4:18I'm just kidding. We're doing this because we want to protect all of the systems and networks that we're being contracted to protect. And pen testing is a large part of making sure that we are fully defended against cybersecurity attacks that are in real time. Pen testers use the technique of best practice in real time in order to be able to build defenses against those threats. If we go in and we do a controlled and coordinated attack and the defense team on the for the organization going against the pen test knows about it, there's a strong possibility that they're going to be well prepared for that attack.

5:01Also, one practice to keep in mind too is that if you're pen testing yourself, you're not always going to be 100% truthful in your actual reporting because you may find it that there you may find that sometimes there are defense personnel out there that are a little embarrassed about letting people know some of the faults that they had within their own system or network. There's no shame in pen testing, but it is human nature that one of the biggest concerns is embarrassment from the system administrator's part made in some of those lines.

5:37So we usually get a third party team that comes out and does all of that pen testing because they have no shame. I have no shame. And when we go in and print out our results in executive summary form and go back to the C suite that's actually contracted us out, we're not worried about making friends on the inside of that organization. We're just there to do a job and make sure that all vulnerabilities are either identified or patched.

0:00Now, if there's one thing I want you to remember more than anything else when it comes to note-taking is time stamps. And I'm going to show you an example here in just a second. But the reason I point this out is because we need to make sure that we're syn ced with the actual time of the system that we're using or systems that we're conducting the pen test with and the actual organization that we're doing conducting the pen test on. And this is the same for an investigation that we would be conducting on the digital forensic side of the house.

0:30Because the time stamps don't match up or if there's not a best way to put it like a footnote inside of our executive summary that states what our timestamp scheme is, then it could be that the organization that we're conducting the pen test for thinks that we're outside of our scope in some way. Let's say business hours or peak hours are from nine to five and the organization that we're working for doesn't want us conducting pen test between nine and five.

1:00So basically, five, oh one in the afternoon, all the way up to eight, fifty nine in the morning and through the night. And if our time stamps are off and there's no indication that there is a skew of any kind whatsoever, this could cause problems when we're presenting the executive summary to those that were who are responsible for paying us. So let's take a look at an example real quick. This operating system should be very familiar by now because we're going to be using it a lot throughout this course and it is Kali Linux.

1:32So let's take a look at something real quick and that is on the top right corner, sorry, I had to turn my zoom in on you see a little bit of my OBS not apologize for that. But you see you up at the top where it says my time is four, fifteen, forty eight p.m. This is where we get a little bit outside and timescued because I want to pull this up real quick for my actual system itself. Right here and right there, you can see that it is six six TPM on the same day.

2:02Now I can verify that it's the same day if we go inside of here and just click right there. It's May 14 2025. But that's time is off from what the actual system is showing the host system. And if I'm conducting the pen test here, I need to account for that and state that there is a two hour timescue between the actual system that's conducting the pen test, which is Kali and the host system that we're on this our host system or whichever system that is that we're going to be attacking. Now, there's a couple of different things that you need to look out for when you're doing this. And that is is our system time synced with any kind of GPS are a time server, I say GPS because that's where I get my time from. We could go into properties here and go into time and date settings and you can see here that it's manually said.

2:55Configuration is manual. And then pull you real quick right there. And I'm not going to mess with that because inside of VMware, which is where I 'm at right here, I'm moving it over so you could see. I'm going to right click on the actual VM that we're operating on and go into the actual settings. Experiences may vary if you're using virtual box. But if I go into the options of the actual VM that I'm on and go into VM tools, I'm going to zoom in and show you here real quick.

3:26You can see that there is a feature that's unchecked inside of the box called synchronous guest time with host. And that makes sure that our virtual machine is synced with the actual host that we're using for our virtualized environment. Now, this only goes so far as to make to ensure that the actual host itself is synced. So that's why I'm using time servers and GPS to make sure that this host system is good. So that way the actual virtual systems are good. Now, you can see here, if I click on date and time again, just like that, we have our time synced with what's actually on the actual host system itself.

4:09Move that there real quick and then move this over so you can see both at the same time. And right there, 618 on both systems, the host and the virtual one. So in a perfect world, I wouldn't have to account for any kind of time skew between the system that I'm pen testing with Cali, which is my virtual about virtualized environment and the target, which is actually going to be the host system for a lot of this. There will be exceptions, but that's just because everything's right here in the same location.

4:41It's important to remember that we're not always going to be in the same time zone as the actual targets themselves. Could be that we're a third party pen tester that's located here in Texas working against an organization for cybersecurity readiness in Eugene, Oregon, who knows. But if you're well aware of time zones, you know that Eugene, Oregon is two hours behind Texas. So when you're doing your reports and your note taking, it's always imperative to remember that there either has to be a standardized way of keeping time, let 's say, like GMT or zoom time for your DOD folks out there, or you account for the time skew in your report by stating that there is a two hour skew between the target targeted systems and the ones that are actually conducting the pen test.

5:29So I just wanted to bring that up and let you know that when this is happening, time stamps are a very critical thing because that can be the make or break between staying within the scope, also reporting results correctly and seeing if the vulnerabilities that you find based on that time are in fact true, but when you found them. [BLANK_AUDIO]

0:00Number one or number two number one or number two number three or number four number three or number four You might have noticed a difference between number one and number two Being that one was just a command and the other one had the full syntax with it And number three and number four with the full syntax and output along with time stamps versus no time stamps And if you want you can go back and take a look But the point behind this is is that we want to be able to provide as much information as possible and provide those time stamps So let's add time stamps here. We are in our handy-dandy Cali box and we want to run a simple command of In-map we're doing a very quick and nitty-gritty reconnaissance to figure out what's actually out there on the network and By doing so it'll tell us what's open and what's available at that particular time of scan Well, there's that keyword again time because we want to make sure that we are within Compliance of our scope and our rules of engagement to make sure that we are doing everything when we're allowed to do it If there are any time constraints So if I zoom in for you here real quick, you'll notice that there's no time

1:15stamps whatsoever and even if we run a simple command, let's say in-map and We're just going to do a quick scan real quick. We could hit enter on this and we can see that Let me pause and zoom in for you there real quick There is a timestamp on the actual in-map command them itself But there won't be actually anything in the actual terminal other than what's in that command or tool that you're using at that time So now there are different ways to do this and what I like to do when I'm getting into want to keep track of every Thing that's going on to the second I can actually Incorporate time stamps inside of the channel itself to make things a little bit easier on me now I've cleared the screen and we're gonna walk through this together because I want to make sure that we all Can follow along and make sure that we're installing tools correctly first and foremost I want to make sure that we have a pseudo apt update that's ran to make sure that we have all the available packages to us from the Cali repository Now I've done this offline and already did all of our upgrades So this shouldn't take too terribly long now. I've cleared so we're gonna go ahead and do a pseudo apt install more utils and You can see there that it's gonna add a couple of different things to it

2:32But yes, we want to go ahead and install that and timestamp is one of the things that's included inside of the morning tilt And we'll be able to pipe it with some of the commands that we're actually using Such as in map now obviously that didn't take too long But I want to give you an example real quick We're going to do an if config - a and pipe in TS and you can see here that we get time stamps now With every line of output that's going through to include the actual initiation of the command itself Which was 18 to be 859 now if I run this by itself if config - a you can see that there are no time stamps there and that Just to give you a compare contrast now this comes into play a whole lot better when we go into in map and We ran it while while ago But now we're going to pipe a TS on the end of it and you can see here for a fact I'm gonna stop and zoom in for you real quick not only do we get the actual timestamp on the end of it itself But at the beginning of it we get the full formatted to our system timestamp May 14 659 32 seconds and Starting in map 7.95 and you'll notice that on the end map

3:48It doesn't actually have the seconds on there now is that getting two in the weeds on the time stamps? Maybe but for me it makes sense and if I zoom out you can see that The the entire program ran it took about four seconds to complete a quick scan of the overall network And we have time stamps to prove every little thing that happened so when we start going and comparing two logs on the network for our Roundup meeting with the actual Administration teams they can actually go through in their network logs and see at that particular time Based on timeskew if there is any and see if that lines up with their systems If not it could be an indication of the vulnerability or if it does yes they got it and it was duly noted.

0:00Alright, so we've got time stamps, commands, got the history configured to be able to include time stamps, then over some of the things that we need to be on the lookout for for time skew. Let's get into taking notes. And this is going to be a big part of everything else we do all throughout the skill, so I kind of want a hammer on this now instead of having to nickel and dime it all the way throughout the entirety of the course. So let's go back and remember. The five phases of pen testing and they go down to reconnaissance, scanning, vulnerability assessment, exploitation and reporting.

0:39Now I know what you're thinking important has its own section that should be where all the notes are, right? Wrong. We need to make sure that we're keeping notes the entirety of the time because when we do get to reporting, it's going to be that executive summary that we're going to cover in a little bit, but we also need to make sure that with the notes that we do have that we either don't repeat a step by accident, don't mess up a step by accident or do anything else by accident. And during the reconnaissance phase, we're going through and basically scoping out the entirety of what's entire within the organization that's within our rules of engagement.

1:17This is our time for us to gather that preliminary information. And the note taking comes critical because there may be items or systems within the organization that were pen testing that don't need to be touched. And that would be something that we need to make note of. And I've said this before in terms of like, make a note of it. This is what we're actually talking about now because if there's a particular target system out there that does not need to be touched and it was inside the rules of engagement and we didn't make a note of it, that could really come back to bite us in the butt because it's either going to get us canceled out of a contract, we may have to recoup some costs and that does happen.

1:59When we're actively scanning, just like we saw in the N-Map earlier, there's going to be a lot of information that comes back and the scope within the rules of engagement can go even deeper. We're allowed to attack some ports but not others. We're allowed to attack some systems based on time and not others. And the notes that we get during the scanning process basically allow us to be able to keep track of the different vulnerabilities, the different systems out there and also be able to know what kind of a service plane that we're attack surface that we have for those particular systems within the scope of our pen test.

2:38So the notes for this one would be if you wanted to imagine real quick, a spreadsheet could be something like this. One nine two one six eight zero dot one through two fifty five and then based on the ports, you know, the commonly found ports are the ones that you want to attack or the ones that are open, you could say zero dot one had port 80 open and 443 and go through line by line. Instead of having to rerun thing all the time or rerun your scanning. Now you will rerun scans as you go throughout your pen testing process because certain systems do different things based on different times of day and different activity with the user.

3:17But it's good to have a baseline of notes taken on the side to make sure that we're all in line with this. And the same thing goes with vulnerability. If you have a specific system out there that has a vulnerability report or different whole network systems out there, you can actually go through the actual vulnerability report itself and go through and make notes on it of hey, I scanned it at this time, which will be in the vulnerability assessment itself or you can go through and note on there, hey, I've ran across this vulnerability before and I've leveraged it with Metasploit using this plug in and just something to keep note on the side of.

3:55Exploitation kind of in the same vein of this, you know, what results are you getting back and did you find something else during the exploitation that you wanted nine deeper on and you can make a note of that. And then all of it gets pulled all together and tallied up between you, me and the team that we have together to be able to build out that executive summary.

0:00Now, I just want to hit on one more thing before we start even noting it into our executive summary of the wrap up of the skill. And that is, where do we take notes at? Well, this is more of a shooter's preference thing. All I'll say for sure is that there needs to be a surefire way of backing that up and being able to call upon those notes for reference later on, be it an investigation or verification or whatever the case may be. Now, my method of taking notes is usually pen and paper and something as simple as a regular notes booklet is and I keep one of these per pen test or investigation that I use.

0:43And the reason I do this is because some of these, if you can see up at the top right there, it has month and date that I could just simply circle on there and the title up at the top. Now, I put bullet points in there, things like I walked up to the system, I began my pen test. This is the tool that I use, this is the command that I use. Now, for the purposes of this course and being that we are computer based training online, I know that this is not always applicable to the things that we do because I'd have to be able to write and scan every page that I took notes on.

1:21That being the case, as you can see over here on this screen, I have a Word document opened up and I just want to pull that over here in just a second and show you a couple of tricks real quick. So here I am in Microsoft Word and I promise that this is elbows at hand, but it comes in handy if you want to use it. So I'm going to go to file and go down to options real quick and make sure that in my customization river ribbon that on the right side, I have right there developer checked for us to be able to do this.

1:55Once that's done, you should be able to go to the developer tab, which is what I'm on now and up on the top left is I'm going to zoom in for you real quick is the macros button. Inside of macros, you can see that I have one in there called timestamp and I 've exported this and I want to put it in as an attachment right below this video. Go into edit it. You will see that I just put in a simple selection there that allows me to be able to do the timestamp of your month day with the actual time itself. By all means, with this as you want based on how you are your organization does . But the reason I've pointed this out is because I also go through and go into file.

2:36Options. Customize ribbon and then go into customize keyboard shortcuts. And if I go all the way down to macros on the left, you'll see that I already have one set for timestamps, which is that macro we just created. Along with all control one as being my actual keyboard shortcut to that. So long story short, if I go inside of word now and specifically inside of this document or I have a separate word overall.

3:07But if I go through and say all control one. There's my actual timestamp right there and I can say opened case or pen test. And then and then all control one again and then say. Assigned Eric to pen test. And you get the idea is we can go through and hit the timestamp anytime that we need on our keyboard. So that way, as we're making notes and annotations about different tools that we use different things that you ran across.

3:45We can put the actual timestamp in there correlate with what we've learned inside of Cali by going through and comparing it to the actual bash history or even in the terminal itself. And this allows us to be able to alleviate times to all together. So that way, when we do get to our executive summary, we can nip this in the bud and make sure that everything's all on the same sheet sheet and use it. We can also annotate in our notes here if there's a time zone difference or if there's a problem with the virtual machines.

4:18Specifically with the other site, not always have an access to NTP or yeah. Now you may think that's a 10 bit silly, but I'm here to tell you that not all networks out there have NTP or GPS available to them for time synchronization. You will run across different networks, specifically in sign of DoD That are secret and above that don't have access to regular internet resources. And there are GPS and NTP solutions on those specified networks of class ifications. However, they're not always readily available, especially in I give you a little bit behind the curtain here in those mobile command environments where you don't always have access to the rest of the actual network. So if you set everything up and you're running internally, they should have all their systems sync to the domain controller or a central point within that network.

5:16And if you're brought in the pen test, you need to make sure that whatever time it is in real time, along with the notes of what time it actually shows on those individual systems , because in those closed network scenarios, you will see timescue happen all over the place. And with the advancement of CPUs and GPUs and all the other fun parts that are a computer nowadays, there is still a little bit of timescue the longer those systems are left on or being utilized. So it's not like that day. It's not as bad as the days is 286, 386 and 46 and having to manually set your time at Pascal. Yes, I remember those, but it does happen over time and it can cause discrepancies within your reporting.

0:00We've been over how to take notes, make sure that all of our time stamps are aligned. Basically, we're building out references for our final executive summary. Now, I want to point out that in executive summary, you will not have all the nitty-gritty details of every vulnerability exploit or problem that was found throughout the course of our pen test. An executive summary is really just for the C-suite or anybody in charge of the organization or network that we're actually doing the pen test on.

0:32It's a synopsis or a very brief summary of what's actually happened throughout the course of our pen test. Key bullet points is the topic here. We don't want to overwhelm everybody throughout the executive summary, and we want to try to keep it as short as possible. Now, generally, executive summaries are going to be a page or two. That should be enough information right there to tell you that only the most important information is only going to be inside of the executive summary. Now, as we go through this, I kind of want to point out a couple of different areas real quick, and that is, first, starting off, we need to have an engagement overview.

1:15This will basically be the opening paragraph of our executive summary that explains what exactly happened and when did it happen. So, how long did our pen test take? When or who did we pen test against and what were we looking for? Followed right after that are going to be our key findings. Just for me, and you may be a little bit different based on space available within your executive summary or how detailed you want to go, I generally try to keep this between three and four of the biggest points taken away from the actual pen test itself. Again, we're not trying to get too far into the weeds of what actually happened, but let's say throughout the course of our pen test that we discovered that there was a serious password breach on a critical server within the organization that were pen test against. That's something that needs to be highlighted, especially if it has something to do with PII or information that is federally regulated, like HIPAA or FERPA or something along those lines.

2:19And inside of those different three or four areas, we want to bring out the biggest things that need to be addressed. Along with those could be like, let's say we did a username and password test on the actual network itself against active directory and we found that a bunch of default passwords were being utilized or that there were some weak passwords all across the network, so easily guessed and things like that. It might be something that you want to bring up. So many accounts, XX accounts had the weak passwords that were able to be penetrated and exploited and basically just key points. We don't want to go too deep on this one. This is going to be followed by our risk assessment and this is just a quick paragraph of where do we as pen testers see the overall organization, not one particular system, not an idea of multiple systems, but the overall organization itself, low, medium, high, critical, whatever the case may be, because it's also possible that you can run a NASA scan and find a high or critical vulnerability within the organization and this is an accepted risk by that network or system owner

3:38that's already been identified as an exception inside of our scope and rules of engagement. If that 's the case, then that shouldn't really be included here. We just want to have a quick, hey, where do we see the organization? Overall, I rate you as medium. There are a couple of different things on there that you should take a look at and that should really be it. We're then followed up by the recommendations section. What are some quick tidbits that the C-suite can identify to issue out orders to the tech team to be able to remediate issues that were found within the course of our pen test? These would be very quick and to the point. You don't want to go into the actual technical details. For example, let's say those passwords that we were talking about earlier, we just want to be able to identify that as a recommendation, maybe users should go in and strengthen up their passwords. Maybe the administration team can implement a policy of minimum strength passwords, something along those lines, not the actual CB or the configuration idea inside of the system itself. Lastly, we wrap up with the conclusion and this is going to be a quick,

4:58this is what happened. We revealed many different things that were wrong with your organization and we 're going to recommend a follow-up or not and when that follow-up should take place. For me, on my executive summaries, I'm always going to have an included section at the very bottom as well. This is basically an old DoD habit because for memorandums for record or anything like that, you'll always have an included section at the bottom. Now it's good to have an executive summary be a synopsis of everything that happened really quick but also include the detailed information such as the vulnerability assessment such as the actual network scan that we did throughout the pen test itself and some of the CDE reports of the different things that we found that were causing or are raising attention to earlier on in our executive summary. Now all this is pretty much straightforward and I will give you an example in the challenge because I just wanted to go over some of the different things that we needed to consider when it comes to executive summary and that's going to take us into our challenge.

0:00It's challenge time and this one we're going to be making an executive summary. Now again, it's a summary. It's not supposed to be a dissertation, but I'm going to cover some of the information here and put some bullet points right below this video so that way you can compile together how you at home would like to compile or present your executive summary. One thing I really want to stress here is that there's no single answer for an executive summary. Different folks have different ways of presenting information and putting together and preparing an executive summary for a pen test, but the idea remains the same with the five areas that we covered in the previous portion of the skill. Now between one May and 14 May 2025, we conducted a pen test against CBT nuggets and there were a bunch of areas that we were looking to test out against such as systems that could lead to credentials that could lead to unauthorized access, maybe even some data that was being exposed and see if we could cause disruption services based on some of the exploitation practices that we're going to be trained up in throughout this

1:15course. And some of those findings that we had are going to be reported in our key finding section. Now I have again right below this challenge video some of the findings that we had so you can expand on them at your leisure inside of the executive summary. Now based on this information that I've given you so far, we have a risk assessment that needs to be made and I'm going to let you choose how you want to be able to identify this as a low, medium, high or critical. I have my own which will be coming up here in the solution and we'll review it together. And then whatever recommendations that you would like to make and they usually are tied to the key finding. So if you have key finding number one, you should have recommendation number one and they should kind of be tied together.

2:05And then whatever your conclusion is and if you want to be able to sign and validate your executive summary. So now that you have that information and what you see right below this video, let's go go ahead and do it to it and I shall see you in the solution.

0:00It's solution time and I wanted to show you the executive summary that I've come up with based on the information that we had in the challenge. Remember, we had the bullet points above and some of the key information in the actual challenge video itself. So let's take a look at how I attack this one. Here we are in my executive summary PDF version of this below so that way you could use it as a template. I don't mind. And there are many other templates out there that you could take a look at. But the key factor here is that we have all five areas discussed and we start out with our overview, which is between one May in 14 May 2025.

0:37We did a pen test on CBT nuggets and we basically just gave a five W's of what happened there. We move on into the key findings and that was exactly what I put inside of the challenge bullet points. And again, you don't have to word them the exact same way I do and I don't want them the exact same way anybody else does just whatever fits based on the organization and whatever templates that you require to use or maybe achieve your preference. Who knows. But these are the four areas that we found and after that we put together a risk assessment and this one I rated it as high.

1:15And the reason for this is mostly due to the vulnerability inside of the web facing web server along with the amount of user credentials that were either simple or default passwords. Now, I do want to take a side here real quick and point something out and that on the DoD you know who you are. There are many systems of record that are implemented that have default passwords assigned to them and whenever I conduct pen testing for DoD or when I actively did it full time for the army.

1:49This was always a major problem. So if you're with the DoD and you are using let's say CPC or any kind of command and control software change the default password because I'm tired of popping them. So yeah, take that, but our risk assessment is overall high due to those default passwords and that vulnerability on the web server, which leads us into the recommendations on how we would actually go about changing this up. Now these are quick and to the point how I would actually go through immediately patch.

2:22Go in and take care of that insecure code that's inside of that web server, put in a group of policy or just find a way to enforce those strong passwords within the organization. And then we wrap everything up with our conclusion and my conclusion is that several areas required our new intention to strengthen the organizations security posture are needed and I want to come back in 90 days. And my signature block along with on the bottom left and what's in there included network scan report vulnerability assessment user and password report.

2:55That way, if after the executive summary is presented to the C suite upstairs that way the folks in the tech office and I can pull to a side and go into some of the nitty gritty nerd talk that goes along with this. Now this isn't trying to insult anybody inside the C suite, but most of times when we put together an executive summary or do any kind of tech work for an organization that has a C suite involved. More often than not that C suites not going to be to in the weeds are hip to what it is that we as techies do within the organization.

3:32Anyways, you ever form. So it's always good to make sure that the executive summary is written to where anybody can pick it up within any organization and understand the base principles of what it is that needs to be done or addressed inside of that organization after we're done with our pen test. So now that we have all of our note taken out of the way and have an understanding of what it is that the baseline is for the rest of this course. And we know how to properly record it up to those executives upstairs. Let's start getting into some of the breaking of testing of things as we continue out through pin 200. I hope this has been a formative for you and I'd like to thank you for viewing.

4:13[BLANK_AUDIO]