Topical issues of teaching students to information security are considered. It is concluded that security testing training is a fundamental factor in professional staff training. The well-known documents, techniques and tools for security testing are briefly reviewed. The need to accumulate training efforts on comprehensive solving of real-world problems is specified. A single platform for practical training is offered. A review of the original training course is given. It is concluded that the final stage of thematic training should be integrated with cyber exercises. The scheme of typical cyber exercises is considered. Recommendations for cyber exercises are given.
To protect your IT infrastructure from modern cyber threats, you need to constantly test
the security of information systems. To assess the real level of security, you need to use
the tools and approaches used by real attackers (ethical hacking) [
Training to ethical hacking involves a number of problems, among which the main
one is the lack of a unified security testing methodology based on the main technical
aspects and adopted in the professional community. The other challenges include: the
need to teach in the context of existing legal norms, maintain an up-to-date set of
targeted vulnerable systems and test tools, and to constantly update teachers’ knowledge
and practical skills [
It is obvious that the methodology of comprehensive security testing should include a description of the project phases and methods of conducting specific technical checks.
Regarding how to structure the phases of the security testing project, there are
generally accepted methods, governed by such documents as: NSA IEM, NIST SP
800115, BSI Penetration Testing Model [
As to specific checks, it is worth paying attention to the presence of at least three
conceptual approaches [
A classic penetration test, which is the search and exploitation of the most dangerous vulnerabilities to demonstrate the possibility of hacking systems. The main advantage of the approach is detection of real attack vectors, and the main disadvantage is potential violating of the availability of services and systems.
Vulnerabilities scanning. Vulnerabilities scanning uses special software – vulnerability scanners. The scanner determines the versions of network services and checks to ensure that information about the published vulnerabilities is available in its constantly updated database. The main advantage is a high audit speed, the main disadvantage is “linear” logic of the scanner and inability to detect non-trivial attack vectors.
Configuration analysis. During the system configuration analysis, various system security settings are checked, for example, password policy, access rights to system resources, availability of installed updates etc. The main advantage is the possibility of finding vulnerabilities associated not only with errors in software development, but also because of errors made during administration.
The methods of specific technical checks should also be based on hacking methods used by real attackers. A potential sequence of their actions is shown in Fig. 1.
Analysis of the possibility of combining the well-known security testing methods and hacker approaches has allowed us to formulate a common integration testing methodology, which includes the following steps: Inventory of resources/search for testing goals; Vulnerability search (manual search, scanning, configuration analysis); Exploiting vulnerabilities and conducting attacks (penetration testing); Expansion of access (see Fig. 2).
The advantages of this approach are as follows [
It should be noted that such a common class of security analysis tools as vulnerability scanners is just a small part of the complete set of tools of an ethical hacking specialist.
To implement a set of checks, Kali Linux environment is often used to launch a set
of unix utilities. Unfortunately, its disadvantage is the absence of a unified report and a
friendly shell focused on different levels of training and privileges of specialists
[1619]. These shortcomings can be eliminated by using the certified security analysis
complex “Scanner-VS” [
Based on a comprehensive approach to security, we have developed the structure of our training course, including the following 8 sections: Chapter 1. Introduction to the penetration testing. Chapter 2. Intelligence Gathering. Chapter 3. Vulnerability Analysis. Chapter 4. Exploitation. Chapter 5. Exploitation of Web-applications. Chapter 6. Social engineering. Chapter 7. Maintaining access. 5
In the very first section of the course, students get acquainted with the basic concepts
(vulnerability, APT, exploit, payload etc.), comprehensive testing methods,
documenting penetration testing results. This section of the course examines the
structure of the penetration test report: the chapters “Summary for Management”,
“Project Scope” and chapters with descriptions of detected vulnerabilities. The
descriptions of vulnerabilities contain subsections: finding – risk – recommendation
[
Throughout all other sections of the course, students develop and supplement the report on vulnerabilities detected in the course of laboratory work.
This section analyses methods of collecting and analysing information to identify the
purposes for which security testing will be conducted. Students perform laboratory
work to find network nodes on the Internet related to a particular organization (using
whois service, various queries to DNS servers), as well as to identify nodes during
internal security testing (scanning of network ports, tracing of network routes). This
section also teaches to Structured Analysis Techniques, which are used for efficient
information retrieval [
The third section of the course covers two approaches to vulnerability search: manual
and automated (using vulnerability scanners) search [
Manual search for vulnerabilities involves determining the software version and the list of vulnerabilities known for this version of the product. You can find out the version of the software product in a number of ways. For example, many network services, when accessing them, demonstrate a so-called banner containing version data. Sometimes the version can be determined analytically. For example, you can find a press release of a developer or integrator company that created an Internet portal to be hacked by an attacker. The press release often contains all the necessary information about the technologies used, and comparing the release date of this news with the information about the release dates of the corresponding product allows you to easily determine which versions were used. Performing the appropriate laboratory work, students master the methods of analysis and comparison of data obtained using techniques mastered in the previous section of the course (port scanning and search for information on the Internet).
Vulnerability search can be automated using special vulnerability scanners. Students perform laboratory work to search for vulnerabilities using a vulnerability scanner, learn how to choose and form scanning policies correctly, as well as apply scanning modes with and without an administrative account. An equally important skill that is developed within the framework of this section is the ability to interpret scanning results.
In the fourth section of the course students learn techniques of exploiting
vulnerabilities, as well as a number of common attacks. Metasploit Framework is used
as the main tool for exploiting vulnerabilities in the laboratory [
Students gain practical experience in both bruteforce and dictionary attacks. In the
first case, passwords are generated based on the set rules [
Exploitation of vulnerabilities in web applications is considered in a separate section. The main attacks related to web applications are considered: Cross Site Scripting - CSS and SQL injection. In the case of CSS, the script is implemented on the website pages, which is executed in the user’s browser when viewing the page. This can happen, for example, due to an error of the programmer, who did not implement the correct filtering of data entered by the user, for example, when a user posts a message on the forum. SQL injection consists in the fact that due to an error in the data filtering or web application architecture, an attacker can directly interact with the application database via SQL commands through the web interface.
The sixth section of the course addresses social engineering techniques aimed at provoking users to take actions that are beneficial for attackers. In the course of laboratory work, students learn phishing attack techniques and exploitation methods for vulnerabilities in the application software used by users.
The final section of the course is devoted to expanding the zone of influence and maintaining comfortable access to the infrastructure under test, simulating similar actions by attackers.
Expansion of the zone of influence is discussed using the following two examples. In the course of the laboratory work, students gain access to a web server at the operating system level. This access allows them to find configuration files of web applications running on the server and extract passwords from them to access databases hosted on other servers. The second example is related to obtaining user passwords and verifying their validity to other systems deployed in the test infrastructure.
In the laboratory work, devoted to creating comfortable access to the target system, students learn how to implement a backdoor in the installation deb package based on Metasploit Framework components. 6
The course uses a specialized Linux build, containing vulnerable network services, Metasploitable 2. Metasploitable 2 contains more than 200 vulnerabilities in such services as FTP server, Web server, Postgres, MySQL, IRC, VNC etc. The build also contains vulnerable Web applications like DVWA. 7
The next step in ethical hacking development is cyber exercises involving creation of a virtual infrastructure to be protected by one team of students and to be attacked by the other. Let us look at Locked Shields drills conducted by the NATO Cooperative Cyber Defence Centre of Excellence as open examples of such cyber exercises.
Let us start with Locked Shields cyber drills that were conducted in 2013. The organizers of the exercises have created a virtual infrastructure that includes about 400 nodes. The infrastructure is called Gamenet. Each team of defenders (Blue team) received a network of 34 machines, including a router, firewalls, Linux and Windows workstations, domain controllers, file, mail, DNS and web servers, and database servers.
It should be noted that the protected systems were as close to the reality as possible, and the organizers of exercises prepared the following points: A few patches were missing on the operating systems, the application software was mainly vulnerable; Two backdoors were introduced in advance, which started to access the management servers at the appointed time; The network had a connected vulnerable laptop of the contractor’s specialist.
Each protected infrastructure was also accessed by a representative of the organizing team (White Team), who acted as a “blonde”, imitating a curious user who clicks on all the links in the emails received and opens all attachments.
The attackers (Red Team) were armed with full knowledge of the target IT infrastructure, as well as the tools used during the cyber attacks: Kali Linux and Metasploit. Attackers were divided into groups by the following specializations: workstations, Web and DBMS, networks etc. The team of “Reds” was assigned 20 tasks, which had to be performed in stages during the exercise. Examples of tasks: to change the content of an important Web page, organize denial of service, get administrative access, introduce malicious code, get access to certain emails, receive a specific report, replace a video file etc. The duration of the active phase of the exercise was 3 days.
Such cyber exercises following the ethical hacking course will help to consolidate the acquired skills of security testing in practice. 8
The main factors of successful training of students in ethical hacking are the following: the availability of methods, an appropriate set of vulnerable systems and tools for security testing. In our opinion, we have managed to create a practical course on ethical hacking, which allows students to master the key skills required by information security specialists. Cyber exercises are the logical continuation of such training, which is the subject of our further research.
The proposed training course and the support platform were tested for a long time in the Echelon training course, as well as in the framework of the international thematic Olympiad-contest Echelon Defence.