Action:
| Learning Domains/Level of Learning:
|
Army General Learning Outcomes:
| Safety Requirements:
|
Penetration tests provide a relatable methodology that promotes critical thought and technical problem solving in all aspects of the Cyber domain. It promotes these things because the fundamental technical problems and tactics in a pentration test are nearly identical to offensive and defensive operations. Penetration testers and offensive operators use these skills, tactics, and knowledge to quietly exploit and pivot throughout a network. Defenders use these skills, tactics, and knowledge to prevent/detect/recover from intrusions, verify host integrity, and find/fix bugs in software and systems.
What is a penetration test?
Define mission goals and targets
Determine scope of mission
Define RoE
Information gathering about the target through public sources
Accumulate data through scanning and/or interaction with the target/target resources
Gain an initial foothold on network
Establish persistence
Escalate privileges
Cover your tracks
Exfiltrate target data
Document and report mission details
Operation Notes (OPNOTES) vs Formalized Reporting
Executive Summary
Technical Summary
Reasons to report
What to report
Screen captures