0

Do pentesting tools leave behind any information in order to identify the attacker?

Improve this question

1 Answer 1

Reset to default
2

Yes, and no.

Yes, they do leave behind log entries, TCP and UDP connections, login attempts, a lot of forensic data. Depending on the tool, it's possible to determine which tool is being used and what the attacker intends to do.

No, it's usually not possible to identify the attacker. If the attacker uses its own IP address, you can have an IP address. Linking that IP to the person behind it takes a lot of work. If there was little or no damage, it's almost impossible to do anything about an attack.

If the attacker does not used its own IP address, but logged in at a public WIFI network, used Tor or another open proxy, you will not be able to identify the attacker. It's possible, but not for you or me. International justice systems have to agree on the search, different law enforcement forces from different countries have to work together, and takes a lot of time (months, years) to identify the person. And if the country of residency of the attacker is on a jurisdiction that does not cooperate with yours, you can do nothing.

Improve this answer
4
  • I think you misunderstood my question. Let me give you an example. There's a metasploit for embedding executable code in pdf files. Does this metasploit save any information about the attacker? For exmple mac address, computer name, etc.
    – user62771
    Feb 23, 2022 at 21:55
  • 1
    No, they don't. And even if they put the computer name, that's not an unique identifier and are not accepted as proof of anything. MAC addresses are the same case: they can be forged, they are not unique, and you cannot scan the entire world searching for a MAC address...
    – ThoriumBR
    Feb 23, 2022 at 21:56
  • 1
    @user62771 "There's a metasploit..." - a metasploit what? A module? Does the PDF metasploit module embed info about the attacking machine into the payload? Are you aware that metasploit is open source and you can see exactly what it does and does not do? Each module is also a script so that you can see what it does?
    – schroeder ♦
    Feb 24, 2022 at 9:29
  • 1
    @user62771 is your question "are there pentest tools that intentionally embed data about the attacking machine into payloads like printers embed data about themselves into paper copies to identify the machine that performed potentially illegal activity?" Thorium's answer is the same to that question. Yes and no. Some commercial tools do. Open source tools do not.
    – schroeder ♦
    Feb 24, 2022 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .