A Day in the Life of an Ethical Hacker / Penetration Tester

Key Takeaways

hey everybody so today we're going to talk about a question that I get asked quite a bit which is what do you do on a day to day basis as a penetration tester and/or ethical hacker so we're gonna cover that we're gonna talk about some of the jobs that I do and go a little bit more detail on the type of assessment work that we do and even the not so fun stuff like report writing so before we get started I do have one favor to ask you guys if you enjoy the video at the end please do hit that like button please do hit that subscribe button and if you really do like it please consider sharing it with a friend as well word of mouth is the way we grow we just hit 4,000 subscribers I am in debt to all of you thank you so much for your constant support and love so let's go ahead and talk about what I do on a day to day basis alright we're in front of the computer now because it's gonna make things a little bit easier I could show you some of the tools I use and you get to see not only me for a second you get to see my fat cat cleaning yourself I asked her to move out of the screen and she refused so that's Ava in joy Ava so some of the things that I do on a day-to-day basis let's bring this up so I roll out of bed about 755 a.m. I work at 8 o'clock I am my day typically around 5:00 I work from home so I have this luxury of being able to roll to bed and you know just start working pretty much right after I wake up very very nice thing to be able to have some other things that we do and that I'm going to talk about are external and internal network assessments we do web application assessments Wireless assessments physical social engineering phishing assessments we do sock assessments or we call those purple teaming assessments we do report writing of course and we do client debrief so depending on the day we're wearing a lot of different hats and it never is consistent day to day so I wish I could make a video and to show you the day and and have one consistent roll through but I don't so what I'm going to do is I'm going to take you through a brief description of every single little task that I might do in a day and you can kind of get an idea or a feel for what it's like to be a consultant slash penetration tester slash ethical hacker so let's talk about network and internal penetration testing all right so I just recorded this whole thing and realize that I muted my microphone so we're going to redo this so let's talk about external and internal penetration testing so we talked about external penetration testing we're talking about hacking from the outside internal penetration testing is hacking from the inside so we're going to look at this from a very high level so we have external penetration testing we are acting like we are sitting at our computer because that's what we're doing and we're using a scope given to us by the client of IP address range we're going to use our methodology of information gathering scanning a numeration exploitation etc so we're going to run through the gamut on the client and hopes of finding a way onto the inside of the network so some things that we may do without going into too much detail if we're doing information gathering typically it's not to do social engineering that's typically out of scope but we may gather user names and breach credentials from the past and do credential stuffing we may do password spraying if we have the opportunity we're gonna be running nmap and necess to gather a some data to put into our report in terms of or at least get to give to the client and to help us out to see what kind of information that we see are there any vulnerabilities there and can we exploit them so that's what the exploitation comes into play now as a penetration tester you don't always break in from the outside that's fine but there's usually something to report on whether it's patching or otherwise that that is there that maybe you weren't able to exploit but at least as some sort of a finding that the client could improve on their security posture now from the inside it's it's the same concept the same methodology however you're acting like you have already breached their network so either you you social engineered your way in you you know sent them malware and they opened it you got on to the VPN heck you could even went in there and plug directly into their network and left the device and walked away so what we're assuming is there some sort of inside threat now the methodology is the same the tools change a little bit because typically most environments are Active Directory based so you're running tools now like responder tools like incognito Kiwi etc so you're going to use those tools to try to escalate yourself into whatever the goal of the client is it may be hey go get domain admin it may be hey we've got sensitive PII that we want to see if you can capture or we've got you know we got intellectual property that we want to see if you can find and steal so it's not always domain admin at the end of the day it's just whatever the client wants you to get from that internal side of things so from a pen test perspective these are typically 40-hour assessments with report writing included in that now if the client is on the larger side those may go up to 80 hours or even 120 hours you may see a two or three-week internal-external per segment I should say so typically in external is about 40 hours the internal can get up to two to three weeks if it's a really big large client on the flip side you may see some at like 20 hours that they're a very small client so scoping is important in terms of timing but typically you're seeing 40 hours per segment here but if they're a smaller client you may see 40 hours for the whole the whole gamut that you run on them moving on to web application penetration testing this is where we are testing a web app so when we're talking about external internal you may find a web app running on a server but you typically leave that alone you make prod it a little bit but you're not looking for things like cross-site scripting for example that's not something that you would fall into scope for an external internal but that would fall into scope for a web allocation penetration test so there's a fine line there and the web app is basically you're assessing that web app and you're prodding it as much as you can to see all the little things that you could find with it so I have a checklist that's an OAuth checklist I'll run through that sucker completely through and make sure that I check every single box in that because there are so many things to look for for a web app so if you are a beginner in penetration testing you'll probably start out on external assessments and then once you've built trust you know you've got good methodology you'll get trained up or worked into internal assessments and eventually you'll work your way into web application penetration testing there are people that do web app penetration testing solely they do bug bounties solely whatever it's a field all in its own so it's a good skill to learn my advocate anybody that's interested in pen testing to learn web app side of it as well because it opens up more opportunities for you on the job side and there's just more money there on that as well the clients are all working towards web app pen tests I would say more so than network pen tests most of my assessments nowadays are fully web app penetration testing so and you got to think about it you may have one client that does and builds or has a bunch of web apps and they only have the one network to pen test so you charge them for each different web app that you do but you only charge them for the one network that you test right so you have many more opportunities to to earn money and earning potential when it comes to the web app testing now on a day-to-day the tools well the methodology stays the same the tools differ just a little bit so we're gonna be using burp suite now if there's anything that I would suggest somebody buy burp suite pro is probably the one tool that I suggest if you say I'm gonna buy one tool for a tool kit what should it be a burp suite if you're doing web app pen testing there's no doubt about it the Free Edition does not stack up at all to the Pro Edition will also be running nmap and necess because typically when we do a web app assessment what we're doing is we're doing internal and external on that web application as well so meaning we'll take the IP of that web application server and we'll scan against it as long as it's owned by the client right we'll scan against it and we'll see if there's any ports open other than 80 and 443 what are they running on there is something like RDP open for no reason you know so you're doing a pen test to see if you can get into that server in any other way outside of the web application and from the internal side of things as well you're gonna you're gonna pen test against anything that might touch that web app so if it's a load balancer if it's the server itself if it's a separate server that interacts with the with web app you're gonna you're gonna do a internal on that it's gonna be a very limited scope so it's not gonna apply to the same internal testing that you saw before with you know using tools like respond or that we talked about it's mainly just pen testing against or scanning and trying to exploit against that internal network so again scope for these are typically 40 hours sometimes 80 hours I've never seen it under 40 hours and sometimes they can even go longer but typically you need a lot of time for web app because there's so many little nuances and so many boxes of check that you need to make sure you can get through everything all right let's step away from the PowerPoint for a minute and I'm going to show you a wireless card here so for Wireless assessments we use a wireless card something like this that's injectable this is an alpha aw u.s. 0 3 6 and H this is a 2.4 gigahertz card some networks are now running on 5 gigahertz so even for me this is a little out of date I need to up my game just a bit but this works pretty well for most assessments what we're doing is we're taking one of these and we'll probably take a GPS dongle with us as well and most clients are running on wpa2 personal or pre shared key so what that means is it's just like a home network right so you'll try to go in there and you'll do what's called capturing a four-way handshake you'll take that four-way handshake and try to crack it you'll try to see what the how strong their password is for their network if you can crack it you'll start scanning and seeing what what's available in that Network does that network get you anything sensitive or is it just kind of like its own subset lockdown area the same thing for a guest network you're gonna go lock on to a guest network especially one that's like supposed to be isolated and see if you can touch internal servers from that guest Network because that's typically a no-no so there are also wpa2 enterprise so you may be using tools like EEP hammer or host APD but those are very similar I guess in in process really those are you can look those up and do those in a blog pretty quick most of the things you're going to be seeing are our wpa2 personal you may run into evil twin attacks as well so the the methodology is is the same you're still gonna do information gathering if you have to do some sort of password spraying against an enterprise client you might do that or a even credential stuffing so important to get that you'll do scanning again because we're gonna look at the network if we get on to it and maybe even some exploitation especially of the network password itself so you'll write a report on that and debrief the client but we'll cover reporting and debriefing here in a second all right and moving on to physical testing so for physical testing we can loop this into we can loop this into physicals as in I'm trying to break and enter we can loop this into social engineering which you can use in phishing attacks or phishing attacks or you can use on the physical side of things as well so when we talk about the physical assessments we're doing information gathering reconnaissance there we're gonna go on on Facebook on Twitter on LinkedIn we're gonna see what kind of pictures you have out there do you have pictures of your desks you have pictures of your badge what's the company clothing policy you know any kind of information we can gather from that aspect is really good we'll also take a drone and go on site fly it around the site to see what kind of doors might get propped open where the smoke areas are at we'll also do the same thing with like Google satellite images to see what information we can find and then we'll go on-site we'll either try to you know break our way in if we use some sort of you know lock-picking or if we can even use a can of air against some sensors we might do batch cloning where you clone your badge and use that to break in we might just social engineer our way in right we might just sit outside the smoke area or the break area and chat somebody up and just walk right in with them yeah you can even walk right through the front door sometimes so you know it's it's a wide variety of what you get typically when you say physical assessment you're going on-site and trying to get into some sort of critical space that being a a server or whatever the client deems as the critical place they want you to get into now not everybody does physical assessments but most most shops do and you don't have to do a physical assessment if that makes you uncomfortable for us we've got people on our team that don't want to do them and that just gives us more for the guys who are into doing that so if you get a rush out of it and you like to do it please volunteer because not everybody likes to and it's just you know it's fun so outside the physical side of things we also do phishing assessments where we'll send well-crafted emails or will do phishing assessments where we'll call somebody we'll call help desk and say hey I'm so-and-so I need my password reset can you let me in and see where we can get with that so methodology is still the same again there's exploitation there and then we're gonna write a report on it and we're gonna debrief the client on what we find okay so one other assessment that we do is called purple teaming this is also known as a sock assessment so we take purple teaming by combining red and blue what that means is we sit down as a red team we sit down with the blue team and we run exploits we say hey I'm running this exploit do you see this typically we've got a list of like I don't know 30 to 50 types of activities we can do we'll let the client pick from that list which ones they want to do some of them for example are if the client has a knack a network access control and you're able to just plug into their network and they don't see you that's bad right so they should be seeing you there should be some sort of baselining there something venting you large file transfers coming in or out of the network should they be seeing that should their sim see it yeah probably so it's fine-tuning things like that we may upload malware onto a machine and then start running all kinds of commands that an attacker would run to see if they could see those commands basically it's an attack and then hey blue team did you see this attack and they'll say yes I saw it or no I didn't see it so you're really helping them fine-tune their sim and their baselines and it really benefits you as well from two different perspective perspectives one is that when you're doing this and they catch you you can say okay well how can I make this office gated how can I make it so I'm more quiet and they don't catch me or two when they don't catch you you can help them fine tune the blue side of things and you learn the defensive strategies as well which makes you just a better consultant overall and a better pen tester so you really get a lot out of these purple teaming assessments but they are at least in my experience few and far between I've only done a couple in my time as a pen tester but I do think they're highly beneficial and I do recommend them as we can get them alright so lastly let's talk about report writing and debriefing and before we do that this is my second run through this as I said and I've been recording probably for like three hours now the cat the cat has not moved look at that the size of that cat she is at least 20 pounds and just a gigantic blob I don't know how she's still alive she's she's so old and so fat and doesn't move so part of me envies her I think but I digress so when we talk about report writing and we talk about debriefing so you're gonna have a report for every single thing you do if you looked at the the slides and when I commented on the types of assessments every single one of them included a report and a debrief so when we talk about client assessments typically there is a kickoff call before you do any sort of assessment you're saying hey this is what we're planning to do we're starting their activities and then you send you know kickoff emails while you're actually doing the activities but once your activities are done you write your report and typically that's about eight hours per 40 hours I would say so you you have those eight hours and you improve over time on your report writing you get a repository of findings that you've had in the past and you can just kind of you know copy and paste to replace and fill in the blanks right for the client specifics but you know you still have to write the report and if you're doing multiple assessments say you have an external internal and a web app all for one client then you have to write three reports that you aggregate into one for that client at the end of the day you are report writing every time and your debriefing every time so you might just debrief one segment you might debrief the whole report depending on what you did right if you worked on one section and your coworker working on another section then you might do brief one and he might be brief the other part of the report you might debrief the whole thing it just depends on how your shop runs it but do know that report writing and debriefing are a big big part of pen testing and should not go unnoticed where you get to to do all the hacking but then there's the okay I've got to put my consultant hat on and help these people understand at a really high level how I'm gonna explain this you know or how to fix this right so you got to kind of explain it like they're five to a lot of them because it's not always going to be a client where they have a high technical knowledge you're gonna have a lot of c-level executives or owners in the room that don't understand from an IT perspective and that's kind of why they hired you so you really have to be able to break it down to them as best as you can and really explain what the remediation steps are what the critical critical tasks are they need to focus on first all right ladies and gentlemen and that's it hopefully I answered some of your questions about what it's like on a day to day basis I know there's not a typical you know I go to work I do this from 9:00 to 5:00 every day is a little bit different and hopefully that's exciting for some you they're looking to get into the field because you wear so many different hats every single day that really you know it's it's never the same thing it's not monotonous and that's awesome for me so if I if I did answer your questions you know please do hit that like button please do subscribe share with a friend if you've got any additional questions please feel free to comment down below and I will respond back to you as quickly as I can so until next time I'm the cyber mentor and I thank you for joining me [Music]