How to run a penetration test in my network ?

[gihansvn24]

Hello,

We have a small test network separated by the public internet from a cisco ASA 5506 firewall ( Completely different network from the corporate network with own ISP) There are few test workstations and servers on this test network. I would like to run a penetration test on this network. I am new to security and not sure what is the most reliable way to do this. Do I have to run internal and external pen test? If so, How do I do this. Basically, I would like to know someone from outside can have access to the  this test network. I would be really appreciated if someone could give me step by step details. Lets assume the attacker already know my public ip address.

Thank  very much.

[Rishabh Seth]

Hi,

Are you trying to do pen test on the ASA to find what configuration is missing in order to  secure your network or; do you want to do pen test on machines located on your test network?

Based on your requirement you will get different results. If you try to perform pen test on the public IP then ASA being a security device will block the attacks.

But if you try to find out vulnerabilities in devices present in the test network then you should arrange some pen testing tool on your test network.

In case you have a trusted external pen testing tool and you know the public IP then you can try allowing traffic from that IP to the internal test network for pen testing.

But how you would like to proceed will all depend on your network requirement and your company security norms.

I think this isn't a correct forum as the ASA being a firewall will identify the attack and block it.

Hope it answers your question.

[gihansvn24]

Risseth,

Thank your for your respond. I would like to perform the pen test using the public IP address. Assuming the attacker already knows my public ip address. From the attacker's prospective, how do I perform this test ?  If I can get in to the internal network via  the ASA firewall then I would know my firewall rules are secure enough. I have done some research and found this Nmap tool, but it wasn't very descriptive about how to perform the test. 

[Rishabh Seth]

You are on the correct path keep exploring more pen testing tools.

NMAP is a good tool you can also use Kali linux but this is something you will have to learn and perform pen test. You can also search for some online tools. 

Hope it helps.

Don't forget to mark a correct answer!!!

[pepiscop]

Hello gihansvn24,

Seems like you have a neat project at hand.

In terms on having a comprehensive security analysis, running both an internal and external pen test will give perspective of vulnerabilities from outside your network and within your network (disgruntled employee, access limitations/privileges, endpoint protection, etc). Here's an article (http://www.csoonline.com/article/2943524/data-protection/8-penetration-testing-tools-that-will-do-the-job.html)  which lists some useful pen-testing tools which should prove some usefulness at your task.

Let me know if you have any other questions!

Peter

[janicean11]

PENTESTON is a simple and easy to use security assessment tool. No need for a special IT guy, just test and examine your online weaknesses.Take a Test-Drive Today at http://www.penteston.com/