Backtrack Footprints

Question

I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.)

While training, I have been doing most of my pentest with vmware backtrack, installed the tools required, fix any issues with the wifi drivers, have a nice theme and so on.

What are my options on using a updated backtrack, with the custom tools I need and patches without leaving any footprints? If I use vmware, what kind of footprint could I be leaving behind?

I would feel ashamed that my peers view logs and see a pentest assessment leaving behind footprint & logs.

Answer 1

Depending on the engagement, leaving footprints and log traces might be important. If the admins are reviewing their logs, they might need to know that an anomaly came from a non-malicious source or be able to determine later that an event was caused by your actions. But, it depends on the engagement.

One of the steps of a pentest is the Cleanup, which involves removing your traces. If your engagement involves this, then it does not matter what footprints are left behind, you will sweep them away.

So what if others can determine that you performed a pentest? It may be masterful to leave no trace, but if you are learning and new to the field, you are going to leave traces. Does the engagement require complete stealth? Are you given enough time to be completely stealthy? Does the client care that you leave no trace, or is this concern based on your pride? If it is a pride thing, then it as admirable that you want to increase your skill level, but it seems like you need to build a stronger foundation in the field first before you get too concerned about the masterful strokes.

For your specific question about VMWare, your MAC address will come from a virtual MAC that will indicate that it is from VMWare, and you can test this by using Wireshark. I am unaware of any other trace the VM will leave. The MAC will show up in network device logs that are directly connected to your machine.

Other footprints are left by web security tools (like nmap html scripts) that usually provide a custom useragent setting that can be changed.

So, my response boils down to:

• is it important that you do not leave traces?
• are you going to clear the logs anyway?
• does it matter that your peers know what you were doing?

Answer 2

Pen testing is a delicate and potentially fraught undertaking, and not the sort of thing to teach yourself on-the-job.

Beyond just leaving footprints, I'd also be worried about accidentally leaving destruction behind, or accidentally overstepping the limits of your target set.

Rather than being afraid of your peers, you ask them to assist on your first several jobs and observe what your doing; ostensibly so that they can catch things you miss, but primarily to prevent you from doing something stupid. And it helps to have someone to ask questions to.