General strategies - Red Teaming Analysis
- Abuse identity and authentication -> Target: People and credentials -> RDP, SSH, more consoles, portals
- Exploit privilege and trust -> Target: Infrastructure -> Utility Manager, Sticky Keys, NT Domain administrator, Unix root accounts
- Attack data structures and data handling -> Target: Services, Apps -> Client executables, Client-to-server traffic, Server-side controls
- Subvert the supply chain -> Target: OEM software and hardware -> "Get there first"
You may want to check out the recent attack vectors and strategies on the Irongeek Derbycon 4 video page.
Specific strategies - Scenario Analysis
Trustwave has a few blog posts that link to some of their homegrown tools, as well as links to other known attack tools/techniques.
For general strategy 1, most professionals tend to employ "social engineering" techniques, perhaps using the Social Engineering Toolkit (SET) or related tools such as recon-ng, esearchy-ng, FOCA, et al.
General strategy 2 is the most common attack vector from your position, and these Trustwave blog posts mostly suggest ways of focusing in on this strategy (or perhaps also general strategy 4, which may require patience or social engineering to get people to act on your well-placed traps). However, a great resource are the first few chapters of the book, "Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It". There are also many Metasploit and nmap mechanisms that can aid in the general strategies. Attacking infrastructure may sometimes begin with a classic vulnerability scan. Custom vulnerability scan development will teach you the basics that network vuln scanners will not, so I do recommend using vulscan over OpenVAS, Tenable Nessus, Rapid7 NeXpose, or Qualys QG if you are a completist.
If you do plan on attacking either networks or apps, I suggest learning a lot about those domains. For example, knowing networks could involve learning Wireshark-related tools and methods, along with strong network engineering skills. You'll typically want to learn all of the internals of traceroute/0trace/lft, sslyze/ike-scan, and bnat/nmap/amap. When you start using firewalk, qscan, osscan-guess, traceroute, and packet-trace with nmap, then you'll understand how to combine methods well -- although basic issues like banner grabbing must also be mastered.
Apps are the hardest domain of penetration testing. My suggestion is to learn as much as you can about your target applications: their primary interfaces (e.g., for webapps, try webshot) and their various configurations. Then, move on to their internals by learning how to build and code apps in a variety of environments. If you understand the entry points to the applications, you can begin to learn to look for low-hanging vulnerabilities and spend an extra amount of time bringing them to full exploitation once you verify a vulnerability. Typically, for web apps, you'll need a good crawler to back up your existing domain knowledge (e.g., the Discovery-section of seclists found in Kali Linux) and a proxychain to analyze and attack using fault injections. My favorite open-source crawler and my favorite open-source fault-injection tool is Arachni (the autothrottle and other plugins are good introductions to web app pen testing). Eventually, you'll want to move to commercial tools such as Burp Suite Professional or Acunetix WVS, but there is no need to rush it when you don't understand the basics (as I alluded to with net vuln scanners above).
