Even though each penetration test is an individual service, each implementation is characterized by its systematic and methodical approach. The methodology we use consists of the following components.

1. Kick-off

   Depending on the complexity of the penetration test, the kick-off takes place one month to one week before the agreed implementation period. The aim is to evaluate roadblocks and agreements for successful implementation. AWARE7 GmbH’s penetration testers and project management team will take part in this meeting. The following stakeholders should take part in the kick-off meeting:
   – All relevant risk or project owners
   – Information security officer
   – Technical personnel with knowledge of the target system
   
   

2. Recon

   Reconnaissance is the work of gathering information before a real attack is carried out. The idea is to gather as much information as possible about the target. To achieve this, many different, publicly accessible sources of information are used. The extracted information often provides a detailed insight into the affected systems.
   
   In a penetration test of the Active Directory, for example, this means that all systems that are part of the Active Directory are enumerated as a first step. The systems are identified in parallel with the identification of the network services using standard network scanners such as nmap or massscan.
   
   

3. Enumeration and Vulnerability Identification

   In the enumeration phase, there is a transition from a passive collection of information, as in the recon phase, to an active one, thus further enriching the collection of information. In addition, the information from the recon phase is used to identify potential attack vectors. In the enumeration phase, automated scans are started and a vulnerability assessment is carried out against the relevant systems. During the enumeration phase, an examination of the Active Directory configuration, for example, would take place in the context of an Active Directory penetration test. The pentesters would collect information about groups, users, GPOs (Group Policy Object), policies and shares.
   
   

4. Exploitation

   In the exploitation phase, the penetration testers try to actively exploit security vulnerabilities. Exploits are developed, for example, to collect sensitive information or to enable pentesters to compromise a system and manifest themselves on it. For new targets, the reconnaissance and enumeration phases are repeated in order to gather information about these new systems and to exploit them. For example, as part of an Active Directory penetration test, password attacks are carried out on previously collected user accounts in order to take over these accounts. In addition, many other different attacks such as relay attacks are also carried out.
   
   

5. Post Exploitation

   In the post-exploitation phase, the changes to systems, processes and users are reversed in collaboration with the relevant technical contacts and administrators. Since a penetration test cannot rule out the possibility of system configurations being manipulated or exploit scripts being placed, it is important to ensure that these are deleted and reset after the test.
   
   

6. Report

   Documentation is an essential part of every penetration test. During the penetration test, all steps leading to a successful attack are documented in detail. This ensures that everything can be traced in detail after the test. At the end of the penetration test, this documentation serves as the basis for an individual report that makes the test results comprehensible for both the technical administration and the management. Recommendations for action are an important part of the documentation.