Core Technical Knowledge

Hardware Security

WEB

Understands common risks associated with Bluetooth, including: • Bluesnarfing • Bluejacking • Bluebugging

Industry Roles:

Assessment Methods:

Understands how side-channel attacks can aid cryptanalysis and otherwise expose sensitive data

Industry Roles:

Assessment Methods:

Understands the concepts behind side-channel attacks such as timing analysis and power analysis

Industry Roles:

Assessment Methods:

Understands the concepts behind common microprocessor vulnerabilities such as Spectre and Meltdown

Industry Roles:

Assessment Methods:

Build Review

WEB

Can map technical controls to a customer’s business requirements and intents, justifying the need to tighten or relax them where necessary to meet business needs

Industry Roles:

Assessment Methods:

Understands and can test against common build standards such as CIS benchmarks

Industry Roles:

Assessment Methods:

Demonstrate the ability to perform a security build review of common operating systems

Industry Roles:

Assessment Methods:

Patch Levels

WEB

Can obtain operating system patch levels on UNIX-like and Windows operating systems.

Industry Roles:

Assessment Methods:

Understands Microsoft patch management strategies and tools, including: • Microsoft Systems Management Server (SMS) • Microsoft Software Update Service (SUS) • Microsoft Windows Server Update Services (WSUS) • Microsoft Baseline Security Analyser (MBSA)

Industry Roles:

Assessment Methods:

Traffic Filtering and Access Control

WEB

Understands network access control systems, such as 802.1x and MAC address filtering, and can demonstrate how these technologies can be bypassed

Industry Roles:

Assessment Methods:

Can demonstrate methods by which traffic filters can be bypassed

Industry Roles:

Assessment Methods:

Understands the devices and technology that implement traffic filtering, such as firewalls, and can advise on their configuration.

Industry Roles:

Assessment Methods:

Understands network traffic filtering and where this may occur in a network

Industry Roles:

Assessment Methods:

Fingerprinting

WEB

Understands active and passive operating system fingerprinting techniques and can demonstrate their use during a penetration test

Industry Roles:

Assessment Methods:

Service Identification

WEB

Understands advanced analysis techniques for unknown services and protocols.

Industry Roles:

Assessment Methods:

Understands the methods associated with unknown service identification, enumeration and validation

Industry Roles:

Assessment Methods:

Can state the purpose of an identified network service and determine its type and version

Industry Roles:

Assessment Methods:

Can identify the network services offered by a host by banner inspection

Industry Roles:

Assessment Methods:

Port Scanning

WEB

Understands and can demonstrate active techniques for discovery of nodes on a network, such as: • SYN and TCP-Connect scanning • FIN/NULL and XMAS scanning • UDP port scanning • TCP ping scanning • ICMP scanning

Industry Roles:

Assessment Methods:

Understands different TCP connection states

Industry Roles:

Assessment Methods:

Packet Generation

WEB

Understands ARP spoofing and can demonstrate this technique in a safe and reliable way.

Industry Roles:

Assessment Methods:

Can generate arbitrary packets, including TCP, UDP, ICMP and ARP, modifying packet parameters as required, e.g. source and destination IP addresses, source and destination ports, and TTL.

Industry Roles:

Assessment Methods:

Understands packet fragmentation

Industry Roles:

Assessment Methods:

Understands the different types of packets that are likely to be encountered during a penetration test

Industry Roles:

Assessment Methods:

Using tools and interpreting output

WEB

Demonstrate ability to carry out testing when tools are not available or functional

Industry Roles:

Assessment Methods:

Can effectively use command line during assurance testing

Industry Roles:

Assessment Methods:

Can identify when tool output can and can not be trusted. Can demonstrate an approach to verifying tool output

Industry Roles:

Assessment Methods:

Interpret and understand the output of tools, including those used for port scanning, vulnerability scanning, enumeration, exploitation and traffic capture

Industry Roles:

Assessment Methods:

Understand the limitations of automated testing

Industry Roles:

Assessment Methods:

Can use a variety of tools during a penetration test, selecting the most appropriate tool to meet a particular requirement

Industry Roles:

Assessment Methods:

Pivoting

WEB

Network Pivoting Techniques e.g. • Windows netsh Port Forwarding • SSH • SOCKS Proxy • Local Port Forwarding • Remote Port Forwarding • Proxychains • Graphtcp • Web SOCKS – reGeorg • Metasploit • sshuttle • chisel • SharpChisel • gost • Rpivot • RevSocks • plink • ngrok • Basic Pivoting Types • Listen – Listen • Listen – Connect • Connect – Connect

Industry Roles:

Assessment Methods:

Can demonstrate pivoting through a number of devices in order to gain access to targets on a distant subnet

Industry Roles:

Assessment Methods:

Understand the concept of pivoting through compromised devices

Industry Roles:

Assessment Methods:

Cryptography

WEB

Identify and exploit weaknesses in custom cryptography

Industry Roles:

Assessment Methods:

File System Permissions and System Processes

WEB

Understands and can demonstrate the detection and manipulation of weak registry ACLs

Industry Roles:

Assessment Methods:

Understands technical, logistical, financial and other constraints and is able to take these into account without compromising the effectiveness of the penetration test

Industry Roles:

Assessment Methods:

Can identify running processes on UNIX-like and Windows operating systems and exploit vulnerabilities to escalate privileges

Industry Roles:

Assessment Methods:

Can find “interesting’ files on an operating system, e.g. those with insecure or “unusual” permissions, or containing user account passwords

Industry Roles:

Assessment Methods:

Understands and can demonstrate the manipulation of file system permission on UNIX-like and Windows operating systems

Industry Roles:

Assessment Methods:

IP Protocols

WEB

Understands the security implications of using clear-text protocols,such as Telnet and FTP

Industry Roles:

Assessment Methods:

Understands common IP/Ethernet protocols and their associated security attributes, including: • TCP • UDP • ICMP • ARP • DHCP • DNS • CDR HSRP • VRRP • VTP • STP • TACACS+

Industry Roles:

Assessment Methods:

Understands lPv4 and IPv6 and their associated security attributes

Industry Roles:

Assessment Methods:

Please wait...