Preface
Tools have recently seen heated debates within the security industry's social media circles. Some discussions revolved around the personal preference
of some groups, while others aimed towards the evaluation of tool disclosure policies to the public. Nevertheless, there is a need to point out the
importance of automated tools in the industry today.
The general opinion we have indeed heard or will hear is that using automated tools during a security assessment is not the right choice. This is
because they offer the security analyst or penetration tester no chance to 'prove' themselves when interacting with a vulnerable environment.
Furthermore, many say that tools make the job too easy for the auditor to receive any recognition for their assessment.
Another vocal group disagrees - those consisting of newer members of the infosec community, who are just starting and making their first steps, and
those who sustain the argument that tools help us learn better by offering us a more user-friendly approach to the plethora of vulnerabilities that exist in
the wild while saving us time for the more intricate parts of an assessment. We will also be taking this confrontational approach to the issue.
Tools can indeed, in some cases, present us with some downsides:
Create a comfort zone that will be hard to break out of to learn new skills
Create a security risk just because they are published online for everyone to see and use
Create a tunnel vision effect. If the tool cannot do it, neither can I.
Like in other industries where the creative part of the work can be combined with automated tasks, tools can limit our view and actions as new users.
We can mistakenly learn that they provide the solutions to all problems, and we start to rely on them more and more. This, in turn, creates a tunnel
vision effect that can and will limit the possible interactions that the user might think about and act upon for their assessment.
✎
At the same time, the fact that more and more of these automated tools make their way into the public sector (see the NSA release of security tools to
the public) creates more possibilities for would-be malicious actors with little to no knowledge of the industry to act upon their desires to make a quick
profit or flaunt their endeavors inside dark rooms filled with smaller people.
Discipline
If there are any discerning factors to be drawn from the current state of the information security industry, they are to be drawn on the premise that we
are in a continuous, accelerated evolution of existing technologies, protocols, and systems. With the cumulus of environment variables that we
encounter during an assessment, time must be saved where it can, and a strong security paradigm is formed for the auditor. Discipline is critical in all
fields of work, and the conclusions are as follows:
We will never have enough time to complete the assessment. With the number of technologies in use in every single environment variation, we will not be offered the time to do a
complete, comprehensive assessment. Time is money, and we are on the clock for a non-tech-savvy customer, and we need to complete the bulk of the work first: the issues with the
most potential impact and highest remediation turnover.
Credibility can be an issue even if we make our tools or manually exploit every service. We are not competing against other industry members but rather against pre-set economic
conditions and personal beliefs from the customer management level. They would not comprehend or give much importance to accolades. They just want the work done in the
highest possible quantity, in the least amount of time.
You only have to impress yourself, not the infosec community. If we achieve the first, the latter will come naturally. Using the same example as above, many artists with an online
presence stray from their original goals in pursuit of online validation. Their art becomes stale and generic to the keen eye, but to the everyday user, it contains the wanted visual
elements and themes, not those their followers do not yet know they want. As security researchers or penetration testers, we only must validate vulnerabilities, not validate our ego.
Conclusion
We have to analyze and know our tools inside and out to keep our tracks covered and avoid a cataclysmic event during our assessment. Many tools can
prove to be unpredictable. Some can leave traces of activity on the target system, and some may leave our attacker platform with open gates.
Nevertheless, as long as we follow the rules here, they can be a valuable educational platform for beginners and a needed time-saver mechanism for
professionals.
Do not get tunnel vision. Use the tool as a tool, not as a backbone or life support for our complete assessment.
Please read all the technical documentation you can find for any of our tools. Please get to know them intimately. Leave no stone (or function or class)
unturned. This will help us avoid unintended behaviors or an irate customer and a team of lawyers.
Suppose we audit our tools and set ourselves up with a solid methodology for preliminary checks and attack paths. In that case, tools will save us time
for further research and a long-lasting concrete exploration of our security research paradigm. Considering the accelerated pace at which more and
more technologies appear in today's environments, this further research should focus on a deeper understanding of security mechanisms, furthering
our audit towards more abstract security objects on broadening the spectrum under which the analysis is made. This is how we evolve as a
professional.
Next Mark Complete & Next
Cheat Sheet
Table of Contents
Introduction
Preface
Introduction to Metasploit ✎
Introduction to MSFconsole
MSF Components
Modules
Targets
Payloads
Encoders
Databases
Plugins & Mixins
MSF Sessions
Sessions & Jobs
Meterpreter
Additional Features
Writing & Importing Modules
Introduction to MSFVenom
Firewall and IDS/IPS evasion
Metasploit-Framework Updates - August 2020
My Workstation
OFFLINE
Start Instance
/ 1 spawns left
