Olivia A. Gallucci

Offensive security phases and frameworks

Offensive security means attacking systems, with permission, to find weaknesses before criminals do. This cheat sheet covers the three pen test types (black, white, and grey box), internal vs. external testing, the six phases of a penetration test, and Mandiant’s attack lifecycle with the malware seen at each stage.

What is offensive security

Offensive security is testing defenses by attacking them with permission. It includes penetration tests, red team exercises, and social engineering assessments. A pen test is scoped and time-boxed. A red team engagement is broader and also tests whether defenders notice the attack.

Penetration testing

Pen tests follow phases that mirror a criminal intrusion.

Testing types

Source: N-able Types of Penetration Techniques and Methods

Name	Black Box	White Box	Grey Box
Attack style	Brute-force Trial and error	Testing specific parts of the system	White and black box hybrid
Common labor	Automated	Manual	Automated + manual
Attacker knowledge of infrastructure	Nothing	All-knowing (i.e., access to the source code and software architecture)	Partial knowledge (i.e., receive software code, but not system architecture details)
Speed	Slow	Fast	Medium
Notes	Closest to an outside attacker’s view	Sophisticated tools (i.e., debugging and code analyzers)

Approaches

Types

Source: Redlegg Blog’s Pen Testing: Internal vs External and Why Both Are Important

Approach	Definition
Internal	Identifies how far an attacker can laterally move through a network (aka within the organization) once an external breach has occurred.
External	Attacker assesses the externally facing assets for an organization.
Others	Blind testing, double-blind, and targeted testing.

Techniques

Source: Pratum’s Internal Penetration Testing vs External Penetration Testing: Why You Need Both

Name	Internal / External	Definition
Checking Public Information for Leakages	E	Online lists publicize which companies have been hacked; check those sources to see if the company’s name appears
Foot-printing/Banner Grabbing	E	Gathering information from a system in order to launch attacks against it.
IDS/IPS	I E	Examines whether Intrusion Detection Systems and Intrusion Prevention Systems are doing their job of analyzing network traffic and packets for known cyberattack signatures.
Manual Testing of Identified Vulnerabilities	E	Attacker exploits vulnerabilities that are widely known in the hacking community. This is a key step, considering that an estimated 60% of breaches involve vulnerabilities for which patches are available.
Open Source Intelligence (OSINT) reconnaissance	E	Looking for clues in social media, websites, etc.
Compliance-based Testing (e.g., PCI and HIPAA)	E	Many frameworks have specific requirements organizations must meet to achieve compliance.
Segmentation Testing	E	Checks if networks are properly separated to keep an attack from pivoting from one to the other.
Social Engineering	I E	Verizon’s Data Breach Investigations Report finds that most breaches involve a human element, such as phishing or stolen credentials, so security tests should include phishing (bogus emails) and vishing (bogus phone calls).
System/Service/Port Scanning for Vulnerabilities	E	Automated network tests that look for open ports, services, and systems.

Internal things to examine include WiFi networks, physical access, mobile devices, HVAC, cameras, and firewalls.

Attack phases

Attack phases are the phases of a penetration test.

Source: N-Able’s Penetration Techniques and Methods

1. Planning for penetration testing
   • Goal: Understand scope, client logistics, and objectives.
   • Usually involves speaking directly with the client
2. Reconnaissance and information gathering
   • General Reconnaissance (recon)
     • Gather information about end uses, systems, and applications
     • Used for precision
   • Active recon → directly probing a system
   • Passive recon → info on the internet without direct interaction with the target system
     • Usually OSINT (e.g., search engine queries, domain name searches, internet foot-printing, social engineering, and looking up tax records to find personal information).
3. Scanning and discovery
   • Goal: discover how the target system responds to various intrusion attempts
   • Usually involves automated tools for initial vulnerability scanning
   • Approach types:
     • Static analysis → inspects an app’s code, attempting to predict how it will react to an incursion.
     • Dynamic analysis → examining an app’s code as it runs, providing a real-time view of how it performs.
     • Other aspects attackers discover include network systems, servers, and devices, as well as network hosts.

Attack, access, and reporting phases

4. Attack and gaining access
   • Goal: see how far the attacker can get into an environment without detection in a controlled environment
   • Scope determines the limits of the test (e.g., protect PI and other sensitive data)
   • Example attacks: may take control of a device to extract data; cross-site scripting; SQL injection; physical attacks.
5. Maintaining access and penetration
   • Goal: stealthily expand access and maintain presence via expanding permissions, and finding user data
   • Already compromised target
6. Risk analysis, assessment, and reporting
   • Goal: update the clients.
   • The last phase of the engagement.
   • Once the attacker is caught or the timeline is complete, a final report is generated.
   • Report provides:
     • Testing summary
     • How the attacker infiltrated systems and processes
     • All vulnerability details and suggestions for security fixes.
     • How the tester cleaned up afterward (removed tools, accounts, and files).
     • The estimated value of the compromised systems (i.e., how much financial impact would incursion cost?)

Mandiant attack lifecycle

The Mandiant attack lifecycle is a model used to describe the stages of a typical advanced persistent threat (APT) attack. Note that the attack phases described previously are the phases of a penetration test, while the Mandiant attack lifecycle details the phases of a malicious attack. Still, they are very similar. P.S., I presented on the Mandiant attack lifecycle during my first-year of college.

---

Source

---

Stages

The all-caps names below are Mandiant’s names for malware families tied to financially motivated groups such as FIN11 and TA505. They are attacker malware, not pen-testing tools.

---

Source

---

Initial compromise

Initial compromise is the moment an attacker first gets code running or an account inside the target. It usually follows reconnaissance, where the attacker learns who works there, what systems face the internet, and which of those are unpatched.

Common ways in include phishing or spear-phishing emails with malicious attachments or links, exploiting an unpatched internet-facing system, and logging in with stolen or guessed credentials.

• Phishing

Establishing foothold

Once attackers are in, they set up persistence so they keep access after a reboot, a password change, or a cleanup attempt. Common methods include backdoors, new user accounts, scheduled tasks, and changes to system settings. (In a pen test, anything the tester installs is removed at the end of the engagement.)

Tooling

• Amadey – A loader botnet (see Maintain presence).
• AndroMut – A Windows downloader that TA505 used to deliver FlawedAmmyy.
• BARBWIRE – A backdoor that gives the attacker remote access to an infected machine.
• BEACON – Cobalt Strike’s implant, used for command and control, persistence, and lateral movement.
• FlawedAmmyy – A RAT that can control a victim’s machine and exfiltrate data.
• FLOWERPIPE – A backdoor.
• FORKBEARD – A backdoor.
• FRIENDSPEAK – A RAT used to gain control of a victim’s machine and exfiltrate data.

More foothold tooling (M–W)

• MADRABBIT – Malware (Mandiant name).
• Metasploit – A widely used open-source penetration testing framework.
• METASTAGE – A downloader that fetches the next stage of malware. Despite the name, it is not part of Metasploit.
• MINEDOOR – Malware (Mandiant name).
• MIXLABEL – Malware (Mandiant name).
• POPFLASH – A tool used to exploit vulnerabilities in Adobe Flash Player and gain access to a network.
• RMS – Remote Manipulator System, a legitimate remote-administration tool that attackers abuse for remote access.
• ServHelper – A TA505 backdoor that can tunnel RDP access over SSH.
• SPOONBEARD – A backdoor.
• TIMEWARP – A tool used to manipulate timestamps on files to evade detection.
• TINYLOADER – A small loader that downloads additional malware onto a victim’s machine.
• TINYMET – A small Meterpreter stager that downloads and runs the full Meterpreter payload.
• WOOLLYBEAR – Malware (Mandiant name).

Escalate privilege

In the escalate privilege stage, the attacker tries to gain administrative or privileged access to the target system or network. With admin rights, they control the system.

To escalate privileges, attackers exploit vulnerabilities in the operating system or installed applications, brute-force login credentials, or manipulate access control lists. Common tools at this stage include Metasploit, PowerShell, Mimikatz, and John the Ripper, which exploit known vulnerabilities, extract password hashes, and crack passwords.

Tooling

• Domain Admin rights – the top privilege level in an Active Directory domain.
• BARBWIRE – A backdoor (see Establishing foothold).
• CVE-2018-8120 – A Microsoft Windows vulnerability that can be exploited by attackers to gain elevated privileges.
• FORKBEARD – A backdoor (see Establishing foothold).
• Harvested credentials – stolen usernames and passwords used to log in as someone else.
• Metasploit – Its local exploit modules target privilege escalation bugs.
• Mimikatz – A tool used to extract plaintext passwords, hashes, and other credentials from memory on Windows systems.
• Modified Windows DLL – a tampered DLL that runs the attacker’s code.

Internal reconnaissance

• AdFind
• Built-in Windows commands
• EMASTEAL
• Metasploit
• Mimikatz
• NetScan
• PingCastle
• PowerShell
• ProcessHacker
• SPOONBEARD
• TINYMET

Move laterally

• BARBWIRE
• BEACON
• FORKBEARD
• Metasploit
• Meterpreter. Learn the basics.
• SPOONBEARD
• TINYMET
• PuTTY
• Remote Desktop Protocol (RDP)

Maintain presence

• Amadey* – Emerged on Russian-speaking hacking forums, where it is sold for approximately $500. The botnet operates by regularly sending system and anti-virus software information to its command and control (C2) server, and by requesting new instructions from it. Its primary feature is the ability to install other malicious payloads, referred to as “tasks”, on all or specific computers that have been compromised by the malware.
• Appshim
• BARBWIRE
• BEACON
• FlawedAmmyy
• FLOWERPIPE
• FORKBEARD
• Metasploit
• METASTAGE
• MIXLABEL
• ScheduledTasks
• ServHelper
• SHORTBENCH
• SPOONBEARD
• TINYMET
• WINDSPAN
• WOOLLYBEAR

Complete mission

• BLUESTEAL
• CLOP
• Compress data using WinRAR
• Data theft for later use in extortion
• MBRKiller
• NAILGUN
• SALTLICK
• SPOONBEARD

Conclusion

Pen test phases and attack lifecycles describe the same thing from two sides: how a tester works through an engagement, and how a real intruder moves from first access to their goal. Knowing both helps defenders decide where to put detections and which gaps to close first. Regular penetration tests then show whether those fixes hold up. If you need one, see my offensive security services.