I have recently completed CEH exam and am planning to enroll myself for OSCP certification. I did research on penetration testing and read penetration testing: A hands-on introduction to hacking written by Georgia Weidman. But I am not able to understand one thing; how to determine the exploit to gain access to different machines?

For example to gain access to Windows XP machine there will be plenty of exploits and for Linux as well. So how to conclude that certain exploit can be used to gain access to the servers?

I am in learning phase of penetration testing. Any help would be really appreciated.

  • 1
    the "info gathering" and "enumeration" steps – schroeder Dec 18 '16 at 15:58
  • The more you enumerate...The more you know about the target machine and then you can easily determine possible vulnerabilities that you can exploit using well known exploit code. – Shiv Sahni Feb 22 '18 at 17:59

I am pretty sure your book will have discussed this as well. Penetration testing is more about gathered information than actually using tools and programs to get the job done. To a certain degree these steps are involved; gather information, analyse situation, prepare strategy, execute. Obviously the last is least important.

Gather information: Who and what is the target? What do we already know? Can we exclude systems, methods, tools? What do we need to gain more info? Who to contact?

Analyse situation: Do we notice strange patterns, files, responses? Do we have a clear image about the internals of the system? Are there obvious problems, weaknesses, exploits?

Prepare strategy: What is the best way to reach our goal with the information that we have? Can we prepare a plan for attack, and a backup plan? How to deal with unexpected situations? Who to contact?

Execute: Execute the plan.

Your book may have different steps, but they at least involve the information gathering part.


Software fingerprinting

There are various ways to determine what software and what versions of it are running on the target computer - for example, a machine "listening" on TCP 443 port is more likely to be a Linux machine and less likely to be a Windows XP computer; also, some connections will show the name and version of the particular server software, which can also be a good indicator of the operating system. You might start learning from nmap basics e.g. https://nmap.org/book/man-os-detection.html

Blind attacks

A possible but "noisy" (easier to detect) approach is simply to attempt a particular exploit - if it succeeds, then obviously the target was running the vulnerable version.

  • Port 443 is the standard HTTPS port. Lots and lots of operating systems can be used as web servers. Also, you would be needing to look for vulns in the web server, not so much the OS. And I think the term you are looking for is 'banner grabbing' to identify the service (not the OS). – schroeder Dec 19 '16 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.