The Ultimate Penetration Testing Checklist for Secure Systems

2019

Protection of network systems and platforms from cyber-attack and unauthorized access is an important issue facing all organizations and businesses in this era of internet of things. This project work focuses on the overall and complete protection strategy of a cloud-based startup company. Special thanks to my Supervisor Hans-Petter Halvorsen for the great supervision and encouragement during this project Special thanks to Erling Ekrene the Founder of Cevia Solutions for his quick response to all my inquiries To my wife Gift and son Nathan, thanks for the many midnights of staying awake with me.

International Journal of Advanced Network, Monitoring and Controls, 2024

This research exploration presents a comprehensive methodology for conducting penetration testing for networking security protocols and vulnerabilities on the Wi-Fi networks using Kali Linux, an open-source penetration testing platform. The methodology also encompasses four main stages which are Preparation, Information Gathering, Simulated Attack, Reporting. In the Preparation Stage, the scope of the penetration test is defined, authorization is obtained, and within the testing environment the experimentation is prepared. The Information Gathering Stage involves scanning for associated nearby wireless access points (APs), identifying encryption modes, and assessing network coverage. The Simulated Attack Phase verifies the types of vulnerabilities through password cracking, infrastructure penetration tests, and client-side attacks. Finally, the Reporting Phase entails compiling of a very detailed test report with results visualized, findings and recommendations with directions. Experimental results validate the overall effectiveness of the methodology in identifying and mitigating Wi-Fi network vulnerabilities. Through systematic testing and analysis, Kali Linux facilitates proactive security measures to enhance Wi-Fi network defenses.

PhD Thesis @uO Research , 2020

Cyber attacks by domestic and foreign threat actors are increasing in frequency and sophistication. Cyber adversaries exploit a cybersecurity skill/knowledge gap and an open society, undermining the information security/privacy of citizens and businesses and eroding trust in governments, thus threatening social and political stability. The use of open digital hacking technologies in ethical hacking in higher education and within broader society raises ethical, technical, social, and political challenges for liberal democracies. Programs teaching ethical hacking in higher education are steadily growing but there is a concern that teaching students hacking skills increases crime risk to society by drawing students toward criminal acts. A cybersecurity skill gap undermines the security/viability of business and government institutions. The thesis presents an examination of opportunities and risks involved in using AI powered intelligence gathering/surveillance technologies in ethical hacking teaching practices in Canada. Taking a qualitative exploratory case study approach, technoethical inquiry theory (Bunge-Luppicini) and Weick’s sensemaking model were applied as a sociotechnical theory (STEI-KW) to explore ethical hacking teaching practices in two Canadian universities. In-depth interviews with ethical hacking university experts, industry practitioners, and policy experts, and a document review were conducted. Findings pointed to a skill/knowledge gap in ethical hacking literature regarding the meanings, ethics, values, skills/knowledge, roles and responsibilities, and practices of ethical hacking and ethical hackers which underlies an identity and legitimacy crisis for professional ethical hacking practitioners; and a Teaching vs Practice cybersecurity skill gap in ethical hacking curricula. Two main S&T innovation risk mitigation initiatives were explored: An OSINT Analyst cybersecurity role and associated body of knowledge foundation framework as an interdisciplinary research area, and a networked centre of excellence of ethical hacking communities of practice as a knowledge management and governance/policy innovation approach focusing on the systematization and standardization of an ethical hacking body of knowledge.

This research focused on detailed analysis of Ethiopian governmental office server side and client side "Web Security Vulnerability Analysis of Ethiopian Government Offices". The purpose of this assessment is to discover weak links (vulnerabilities) and provide recommendations and guidelines to vulnerable entities found in its web application. however, choose to qualitatively assess impact and probability explicitly. For each term has been assign high, medium, or low vulnerability. A simple matrix is developed to estimate overall exposure. Vulnerability analysis is a series of activities undertaken to identify the weaknesses and holes to exploit security vulnerabilities. It helps to confirm the effectiveness of the security measures that have been analyzed. The methodology of vulnerability analysis includes three phases: test preparation, conducting test and test result analysis. Each of them involves a series of further steps and tasks. This report further illustrates how to apply this methodology to conduct vulnerability analysis on ten (10) sample governmental office web applications, finally the result of the research shows all the possible number of Vulnerabilities rate and system weakness perspective attack of governmental office network asset vulnerability analysis finding results of both approaches based on vulnerability impact rate or risk level and system technology weakness or attack perspective by using black box testing.

Journal of Computer Science, 2022

A reconnaissance attack is a commonly overlooked step in penetration testing but a critical step that could help increase the effectiveness of an attack on a target. However, it is a common attack faced by companies and institutions, among others. It enables the attacker or penetration tester to gain valuable information on the target and select the best tools and methods that would make the attack successful. This study aims to identify and review existing state-of-the-art methodology for reconnaissance attacks based on certain techniques and evaluation metrics which will be beneficial to professional, ethical hackers in selecting the bestfit tool for a successful reconnaissance attack and enlighten organizations and the general public of the potential harm of a successful reconnaissance attack. This study explored seven online databases, which include Springer, Elsevier, Wiley, IEEE, ACM, ArXiv and Google Scholar. A total of 1306 publications were retrieved. Several screening criteria were executed to select relevant articles. Finally, 19 articles were identified for in-depth analysis. A quantitative evaluation was conducted on the selected articles using two search strategies: Techniques and source. A Quantitative Analysis (QA) was conducted on the selected articles and the outcome based on existing reconnaissance tools shows that 95.2% of the tools allowed experts to gather information by running their necessary command from the command line. While 4.8% of the tools do not provide a command-line interface allowing users to launch it from the command line interface while specifying some parameters to customize how it runs. 61.9% of the tools are network-based as they can be used to gather about the target's network infrastructure such as protocols, ports, DNS, IP address, hosts and the general network architecture. At the same time, 28.5% could be classified as hybrid as they allow the attacker to gather system-based and network-based information. This study concludes with findings that show that some of the tools operate in a different capacity; the best-fit tool is massively dependent on the attacker or penetration tester and the scenario's situations. Therefore, a tool should be selected based on the user's preference and the attack style.

2012

In today’s modern era crucial company information is accessed, stored, and transferred electronically. The security of this information and the systems storing this information are critical to the reputation and prosperity of companies. Therefore, vulnerability assessment of computer systems to obtain a complete evaluation of the security risks of the systems under investigation. In current era there is more complex enterprise IT infrastructures consist of hundreds or thousands of systems. Each component of these infrastructures is meticulously configured and integrated into complex systems architecture. Professional IT staffs are responsible for securely establishing and maintaining these IT infra structures are assessing, on an ongoing basis, the real risks presented by system vulnerabilities. Attacks against computer systems and the data contained within these systems are becoming increasingly frequent and evermore sophisticated. Advanced Persistent Threats (APTs) can lead to ex ...

2017

The main objective of this research paper is to identify common network threats and define countermeasures to prevent these threats. In this modern era, all of the persons are using the facility of internet. SECURITY is one of the major issue faced by everyone. Everyday professional hackers crack the security and take the advantage of vulnerabilities to access the top secret and confidential data. To avoid these threats we proposed a solution named vulnerability assessment and penetration testing (VAPT). In this technique CIA principal are achieved, CIA is abbreviated Confidentiality, Integrity and Availability. All three goals refer your data to keep secure and not to go in wrong hands. Confidentiality refers to the concept of keeping data out of reach of unauthorized persons, integrity refers the data must not be alters in case on unauthorized access and availability refers to the concept of high availability i.e. data is available to all the users when needed. So in vulnerability...

2024

Esta obra colaborativa es el resultado del esfuerzo conjunto de los miembros de la Red Internacional de Cuerpos Académicos e Investigadores para el Desarrollo Humano Sustentable (RICAIDHS). Reúne investigaciones contemporáneas que examinan la interrelación entre la salud y el desarrollo humano, abordando problemáticas que afectan la calidad de vida de diversas poblaciones. A lo largo de sus capítulos, se enfatiza la necesidad de enfoques integrales y sostenibles en la práctica de la salud pública y la promoción de los derechos humanos, ofreciendo un análisis profundo y actual sobre estrategias para mejorar la calidad de vida desde una perspectiva de sostenibilidad y derechos humanos.

62 p. : tabs. Inclui bibliografia Curso Técnico em Hospedagem, desenvolvido pelo Programa Escola Técnica Aberta do Brasil. ISBN: 978-85-63576-18-7 1. Eventos especiais -Organização. I. Título. II.Título: Curso Técnico em Hospedagem. CDU: 380.31 Nós acreditamos em você! Desejamos sucesso na sua formação profissional! Ministério da Educação Janeiro de 2010 Nosso contato [email protected] 3 Apresentação e-Tec Brasil e-Tec Brasil e-Tec Brasil 5

Eskiyeni, 2024

The debate over the unity or division of sciences is a significant topic in the history and philosophy of science. From ancient philosophers to today, scientists have attempted to unify, classify, or segment the sciences. Greek philosophers approached this issue through the concepts of “One” and “Many.” For instance, Parmenides focused on static substances, whereas Heraclitus emphasized becoming and flux. Empedocles pointed to the four elements, Democritus to atoms, Pythagoras to numbers, Plato to forms, and Aristotle to categories. In the Islamic world, Ibn Khaldun expanded the unity of sciences through social sciences, while Avicenna classified sciences based on practical and universal aspects. With the return to nature in the 16th century, sciences were reshaped through natural sciences. F. Bacon emphasized the importance of experiment and observation, categorizing sciences in a pyramid. Galileo proposed that nature is structured on mathematical symbols, while Descartes and Leibniz developed their scientific views based on Newtonian physics. Kant evaluated sciences not by searching behind phenomena but as a cognitive unity based on principles. In the modern era, positivism gained prominence. Since the 19th century, thinkers of the Vienna Circle advocated for the unity of sciences, reducing all epistemic activities to positive science. These thinkers envisaged scientific philosophy grounded in physical science. Reductionism was considered the most important method for achieving the unity of sciences. This paper will critique Fodor’s physicalism based on reductionism and defend Dupre’s idea of the disunity of sciences. Dupre argues that the reductionist method cannot be applied to special sciences like biology and that, although occasionally interacting, sciences should be considered independent modes of knowledge with their specific domains and methods. The paper will begin by presenting the historical development of the unity of sciences within the context of the philosophy of science, focusing on the views of the Vienna Circle philosophers. It will examine the thoughts of neo-positivist philosophers such as Carnap (1928, 1934) and Nagel (1961) on the unity of sciences, Hempel’s nomological-deductive explanation model (1965), and the claims of Oppenheim/Putnam (1958) regarding the unity of sciences. Subsequently, Fodor’s views on the unity of sciences will be evaluated, and physicalism based on reductionism will be analysed. After discussing the shortcomings and errors of this view, Dupre’s argument for the disunity of sciences will be examined, particularly highlighting the inapplicability of reductionism in special sciences like biology. Ultimately, it will be argued that, rather than achieving a unified science reduced to physical laws, the contemporary understanding of science is better served by recognizing the distinct and autonomous nature of different scientific fields.