Skip to content
academia.sh
tr
Log in

Course Advanced

Security Tooling and Penetration Testing

Published Updated

By the end of this course

Start course

01

Reconnaissance

The externally visible inventory of an authorized assessment: how many of the attack-surface candidates surfacing from public sources actually belong to the organization, which record in domain name and registration lookup proves ownership and which remains only a lead, the dangling item found by subdomain and asset discovery, the balance between the candidates port scan types find and the record they leave on the defense side, and how many candidates service fingerprinting can narrow down to a single version.

  1. 01 Open-Source Intelligence From a publicly available item to an attack surface candidate: 29 items yielding 26 mentions and 20 unique candidates, 9 of which are evidence and 6 false positives (30%), the most accurate source producing 83% evidence and the least productive 0%, 12 of 45 validation steps returning zero evidence, the evidence count flattening after four sources while accuracy drops from 69% to 45%, and only 9 of a 13-item inventory being visible from outside.
  2. 02 Domain Name and Registration Lookup Measuring a record's evidentiary strength: four record criteria's hit rates on 20 candidates ranging from 100% to 25%, the three strong criteria combined splitting off 10 candidates and capturing 8 evidence with zero false positives, the weak fourth criterion bringing 0 new evidence and dropping the hit rate from 80% to 62%, 60% of the 10 silent candidates being false positives while one is a real asset, and the cache path leaving 0 records while missing 1 evidence item and adding 2 false positives.
  3. 03 Subdomain and Asset Discovery Counting dangling items in the name space: 7 of 24 zone records pointing to a target that no longer responds, three methods' coverage ranging from 66.7% to 29.2%, the method that leaves no trace finding the most candidates, the 120-attempt method producing 8.57 records per name found, linked-item inference finding none of the dangling items, the request that triggers 4 alerts bringing back 0 candidates, and the combination finding 21 records while never seeing 3 of them.
  4. 04 Port Scanning Comparing scan types on the trace axis: in a 96-port space, 23 open ports being definitively distinguished by type between 78.3% and 0%, the one-way probe producing 21 ambiguous candidates and 3 false positives, the trace per piece of evidence ranging from 3.13 to 8.00 records, the same type slowed down producing the same 18 pieces of evidence with the same 72 records but 0 alerts instead of 2, and 91.3% coverage requiring a combination of two types.
  5. 05 Service and Version Detection Measuring fingerprinting in terms of precision: at the first probe level, 13 of 21 services narrowing to a single version but 4 of them being assigned the wrong version, the evidence rate rising from 42.9% to 76.2% while the trace climbs from 42 records to 168 records and 6 alerts, the confirmed count dropping from 14 to 11 at the third level while accuracy is completed, and incorrect version information carrying 9 wrong lines into the finding list while missing 10 lines.

02

Analysis Tools

Measuring the gap between a candidate and an evidenced finding produced by traffic, request, and file-analysis tools: which field in packet capture is direct evidence, which is inference, and which is a spoofable claim; how protocol analyzers leave only metadata in an encrypted flow; how many requests and which risk class intercepting-proxy validation requires; the suppressed behavior in sandbox analysis; the false-positive rate of the majority decision in multi-engine reputation services; what exploitation frameworks can and cannot prove; and the skill that legal practice labs do not cover.

  1. 01 Packet Capture and Analysis Measuring the evidentiary value of captured traffic: 10 flows from 24 fictional packets, 18, 44, and 85 claim candidates at three capture points, 50 of the 85 candidates at the core mirror turning out to be evidence and 7 spoofable, low-value claims being proven at a rate of 20/20 while high-value claims are proven at only 10/25, and passive capture leaving zero records on the target while requiring one configuration change.
  2. 02 Protocol Analyzers Measuring application-layer inspection in terms of visibility: only 16 of the 30 application fields defined across ten flows can be read, two flows are mislabeled by an analyzer that looks at the transport number, 43 of 91 claim candidates are evidence and 48 are inference drawn from metadata, three of five encrypted flows have in-org access to key material, and passive analysis leaves zero records on the target.
  3. 03 Request Manipulation Measuring intercepting-proxy request manipulation as a validation step: 18 candidates' 40 planned requests, 6 candidates decided with observation-only requests producing zero alerts, 14 candidates decided under the broadest rule set producing 16 alerts, the number of requests to an out-of-scope target staying at zero across all three rule sets, and two candidates that are actually open being unprovable under any rule set.
  4. 04 Sandbox Analysis Measuring sandbox analysis in terms of suppressed behavior: 5 of 14 items noticing the environment on a stock image and not showing their decisive behavior, the number of resolved items rising from 7 to 12 while total time rises from 288 minutes to 965 minutes, one environment hint being impossible to hide in any environment, and analysis leaving zero records on the target while dropping a trace on the other side.
  5. 05 File and Link Reputation Services Measuring the combination of multi-engine reputation results: recall falling from 92 percent to 8 percent as the majority threshold rises across 24 items and 12 engines, precision instead rising from 50 percent to 86 percent at the seventh threshold and then returning to 50 percent, the majority decision within a single engine family turning out identical to picking a single engine, 10 of the 24 items never being queryable at all because of the privacy limit, and every query leaving a trace on the other side.
  6. 06 Exploitation Frameworks Measuring an exploitation framework strictly by its validation limit: of 16 candidates 9 are actually open while only 3 turn into evidence, only one of four validation options has a negative result that shows the vulnerability's absence, two of the three candidates that come back negative are actually open, three candidates get wrongly closed if negative and weak results are counted as closure grounds, and two targets are never touched at all because of scope.
  7. 07 Test Distributions and Labs Measuring legal practice labs in terms of scope: 13 of the 18 skill items produced by the topic's six lessons are covered by the union of three lab types, no single type exceeds 10, a security-focused test distribution covers zero skills on its own, and the five uncovered items stem from the absence of a real record and real risk.

03

Testing Process

The process of an authorized assessment: turning the scope definition into a programmatic audit and catching out-of-scope items, the candidate gap produced by black-, gray- and white-box assessments, running the candidate list through validation rules and eliminating false positives, scoring the same finding in two business contexts, measuring the report in terms of reproducibility, and calculating responsible disclosure as time and steps.

  1. 01 Rules of Engagement A written scope definition for a 64-item fictional inventory is turned into a programmatic audit: 20 items come out in scope, 11 on the border, 33 out of scope. Through five shared front ends, 29 out-of-scope and borderline items can be reached by mistake; 11 of them are banned by name in the rules of engagement. The raw window exceeds the planned work by 4 hours, while subtracting the meter-reading interval leaves it 6 hours short; two of the four thresholds carry no on-call coverage, and for one of them the actual notification time comes to one and a half times what the contract states.
  2. 02 Test Types Black-, gray- and white-box assessments are run against the same 20 items and the same 41 fictional flaws. Black box produces 78 candidates and yields 6 evidenced findings (7.7%), gray box turns 63 candidates into 20, white box turns 60 candidates into 31; 10 flaws cannot be evidenced by any type because proving them requires an action the rules of engagement forbid. Time per evidenced finding drops from 8.82 hours to 1.87 hours, and the defense-side trace per evidenced finding drops from 78 to 2.9; 17 of white box's 31 evidenced findings are meaningful only from the inside.
  3. 03 Vulnerability Validation 240 raw candidates are run through four validation rules: deduplication removes 101 candidates without dropping a single finding, the version support rule removes 23, the impact boundary removes 9 candidates, validation eliminates 46 false positives, and 61 evidenced findings remain. 43 percent of the candidates come from version info, but only 16.3 percent of that class is real. When the validation order is tied to the chain, the validated candidates drop from 107 to 74, risk from 17.8 to 11.9, and the defense-side trace from 461 to 313 records; the cost is that 16 real flaws whose precondition is treated as closed stay unevidenced.
  4. 04 Impact Assessment 61 evidenced findings are first scored by technical weight, then in two separate business contexts. Not one finding stays in the same position between the two business rankings, the mean shift is 22.23 positions, and the top-ten lists share no finding in common; 41.6 percent of pairwise comparisons invert. Under a 40-person-day budget, the technical ranking remediates 12 findings and closes 24.6 percent of the field context's impact while its own ranking closes 28.8 percent, and the ranking that divides business score by remediation day closes 39.4 percent.
  5. 05 Reporting 61 report records are audited in terms of reproducibility. Even though each of the five mandatory fields is individually filled at a high rate, the rate at which all five are filled together is 31.1 percent; a second reader can reproduce 8 findings, and 3 can be called closed after a retest round. Writing the missing fields takes 9.4 hours and raises the closeable count to 49; 12 findings carry an environment variable and cannot be reproduced step by step under any circumstance. The remediation suggestion is directly actionable for 29 findings, requires a separate decision for 22, and is entirely absent for 10.
  6. 06 Responsible Disclosure The time from notification to publication is measured across six stages: single-party findings close in an average of 12.7 days, four-party findings in 96.0 days, and the longest stage is remediation. Comparing three publication policies, the fixed 90-day window publishes 13 findings unfixed, the fix-linked window publishes none unfixed but pushes the latest publication to day 226, and the extendable window stays at 3. The lesson closes the course and gathers the candidate, evidence, and trace counts of eighteen lessons into a single table.

Final exam

Security Tooling and Penetration Testing — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close