Question

An external red team is brought into an organization to perform a penetration test of a new network-based application. The organization deploying the network application wants the red team to act like remote, external attackers, and instructs the team to use a black-box approach.

Which of the following is the BEST methodology for the red team to follow?

A. Run a protocol analyzer to determine what traffic is flowing in and out of the server, and look for ways to alter the data stream that will result in information leakage or a system failure.

B. Send out spear-phishing emails against users who are known to have access to the network-based application, so the red team can go on-site with valid credentials and use the software.

C. Examine the application using a port scanner, then run a vulnerability scanner against open ports looking for known, exploitable weaknesses the application and related services may have.

D. Ask for more details regarding the engagement using social engineering tactics in an attempt to get the organization to disclose more information about the network application to make attacks easier.

Answer 1

The best methodology for an external red team performing a black-box penetration test on a network-based application is to use port scanning to identify open ports and then run vulnerability scanners to discover weaknesses.

Step-by-step explanation:

The best methodology for an external red team to follow when instructed to use a black-box approach for a network-based application penetration test would be to go for option C: Examine the application using a port scanner, then run a vulnerability scanner against open ports looking for known, exploitable weaknesses the application and related services may have. This approach represents a typical methodology for external penetration testing, by first identifying accessible services through port scanning and then assessing those services for known vulnerabilities without any prior knowledge of the system's internals. Alternative methodologies, like protocol analyzers (option A) or social engineering tactics (option D), might also be useful at certain stages of the test but are not as central to the black-box approach as directly probing for vulnerabilities.