1 00:00:01,930 --> 00:00:03,940 The principles of testing. 2 00:00:05,180 --> 00:00:10,490 So we can directly just dive into technical details for this cause it's going to be quick and fun, 3 00:00:11,330 --> 00:00:17,090 but to add even greater value to testing experience, you're going to need more. 4 00:00:17,240 --> 00:00:19,490 You're going to need to know how to do the right things. 5 00:00:20,540 --> 00:00:28,130 A Web tester needs to look widely at the testing process, broaden your perspective, so it's also a 6 00:00:28,130 --> 00:00:31,050 good skill for when you go into a job interview, right? 7 00:00:32,760 --> 00:00:37,800 So in other words, if you're going to lead a pen test, you really do need to understand why you do 8 00:00:37,920 --> 00:00:38,930 what you're going to do. 9 00:00:39,570 --> 00:00:40,750 You understand what I'm talking about. 10 00:00:41,460 --> 00:00:41,850 So. 11 00:00:43,040 --> 00:00:46,580 Let's get up to speed with these rules or principles. 12 00:00:47,640 --> 00:00:48,660 And you'll know what I mean. 13 00:00:50,280 --> 00:00:52,290 Define the scope of security. 14 00:00:53,570 --> 00:00:59,390 So the scope of security is not exactly the same as the scope of the test. 15 00:01:00,800 --> 00:01:07,730 The scope of security helps you define how you will behave once you obtain some data and how much further 16 00:01:07,730 --> 00:01:09,020 you go within a test. 17 00:01:10,390 --> 00:01:16,440 Although there are some specific legal issues within the scope of security, I want to give you some 18 00:01:16,440 --> 00:01:19,110 important information for the technical part. 19 00:01:20,490 --> 00:01:29,550 So it's important to know why you are doing this test, will it be part of an ISO 27 one process or 20 00:01:29,580 --> 00:01:33,180 will it be done under a regulation or directive? 21 00:01:34,100 --> 00:01:35,690 That needs to be clarified. 22 00:01:36,620 --> 00:01:42,830 Because sometimes the way you conduct a penetration test varies due to a particular regulation. 23 00:01:44,080 --> 00:01:50,890 It's even going to affect your reports, for example, the European Union Data Protection Directive 24 00:01:51,220 --> 00:01:53,800 defines how you should treat personal data. 25 00:01:55,240 --> 00:01:56,710 Use the right tools. 26 00:01:58,000 --> 00:02:01,390 Tools, of course, play a critical role and penetration testing. 27 00:02:02,880 --> 00:02:08,130 And after you gain more experience, you'll be able to have your own toolkits or scripts. 28 00:02:09,190 --> 00:02:13,060 But you first need to start with the tools that are already in the market. 29 00:02:14,590 --> 00:02:20,620 There are many open source and commercial tools that you can use to conduct a pen test, but the point 30 00:02:20,620 --> 00:02:27,780 is here, tools have some limitations, so under certain circumstances, they may not work. 31 00:02:28,930 --> 00:02:32,770 So you need to direct and rule the tool. 32 00:02:34,230 --> 00:02:36,180 Thinking out of the box. 33 00:02:37,300 --> 00:02:43,210 I know I might talk a little too much about rules and orders, don't want to kill your creativity while 34 00:02:43,210 --> 00:02:45,340 testing, but it's not going to. 35 00:02:46,320 --> 00:02:53,410 So you know that you have to follow certain rules, but you also need to have your own unique approach. 36 00:02:54,210 --> 00:03:02,040 So in addition to normal use cases going beyond what's expected by a developer or the owner of the application, 37 00:03:02,580 --> 00:03:03,450 that's important. 38 00:03:04,610 --> 00:03:07,520 Another key here for creativity is. 39 00:03:08,470 --> 00:03:16,420 Simulating the behavior of a hacker and thinking strategically so that you can even go beyond with that 40 00:03:16,420 --> 00:03:17,860 hacker is capable of. 41 00:03:19,230 --> 00:03:20,940 Focus on the details. 42 00:03:21,930 --> 00:03:25,410 And try to know everything you get about the application. 43 00:03:26,360 --> 00:03:29,720 You can combine this information to do some extra attacks. 44 00:03:30,620 --> 00:03:37,070 And if it is allowed by the scope, don't even hesitate to manipulate all the data between you and the 45 00:03:37,070 --> 00:03:37,520 server. 46 00:03:38,850 --> 00:03:41,240 OK, so there is no silver bullet. 47 00:03:42,600 --> 00:03:45,840 Security is a process and not a product. 48 00:03:46,930 --> 00:03:50,140 So an application can gradually be secure. 49 00:03:51,440 --> 00:03:55,640 But when you do a test, you should try to look at every aspect of the application. 50 00:03:56,760 --> 00:03:59,760 But you still might be able to miss a few points. 51 00:04:00,680 --> 00:04:02,300 Report the findings. 52 00:04:03,440 --> 00:04:07,190 So after you conclude the test, it's time to show your reporting skills. 53 00:04:08,130 --> 00:04:13,320 Now, some testers fail at this phase because of their lack of writing skills. 54 00:04:14,150 --> 00:04:20,540 And, you know, I'm sorry, but it's no excuse if you want to accomplish the goal of being a pen tester. 55 00:04:21,460 --> 00:04:24,210 Of course, there will be some vital rules. 56 00:04:25,170 --> 00:04:30,490 In reporting, first of all, you were your findings should be reproducible. 57 00:04:31,110 --> 00:04:33,890 What if, you know, they hire another pen tester? 58 00:04:34,470 --> 00:04:41,340 Can the other pen tester easily follow your way and your method and validate the result? 59 00:04:42,150 --> 00:04:43,380 Replicable data. 60 00:04:43,800 --> 00:04:51,180 Your report should also target all concerned parties such as developers, executives, the IT department 61 00:04:51,180 --> 00:04:52,260 and so on and so forth. 62 00:04:53,340 --> 00:04:59,730 Now I prepare at least two reports, one for the tech guys who will solve the problems and then the 63 00:04:59,730 --> 00:05:05,250 other one for the executive or the business owners to help them understand what's going on in their 64 00:05:05,250 --> 00:05:05,690 system. 65 00:05:06,570 --> 00:05:13,680 The executive report should not include overly technical details, and it should be short and impressive 66 00:05:15,210 --> 00:05:18,120 so that it forces them to take this seriously. 67 00:05:19,000 --> 00:05:27,610 Now, both reports should clearly point out what you did with your associated recommendations for resolving 68 00:05:27,610 --> 00:05:28,300 their issues.