People new to professional penetration testing almost always ask “what do I do first? What do I do next?” Fortunately, there are a few different methodologies you should be aware of, and then simply pick one and stick with it. One problem is that people think a methodology tells them step-by-step how to hack, so first we need to understand what a methodology is, and what a framework is with respect to professional penetration testing.
So, let’s define exactly what is a methodology and a framework, and how do they differ. Unfortunately, in the pentesting industry, these two terms are used almost interchangeably and makes things confusing when communicating with customers the steps used during an engagement. I’m also going to throw another concept into the mix as well and that is the concept of playbooks. Often when I’m asked how to attack something specific (like a SQL server, or layer 2 network communication), they are really asking for step-by-step guidance, which isn’t something that methodologies or frameworks typically provide.
Methodology
A methodology is a very high-level discussion of the steps required to complete a task and in which order they need to be performed. A methodology is used to ensure that as we perform the task, which in our case is a penetration test, we are thorough and complete. In the project management world, there is a cost in having to step back within a methodology and the farther back we need to step the more expensive it becomes. So, from a management perspective, it’s critical to follow a methodology and perform all activities within each step before moving onto the next step.
Framework
A Framework provides us with a list of steps needed to be performed within each stage of a methodology. The steps within a framework are not mandatory and can be modified to meet the specific requirements of the engagement.
Playbook
Playbooks are the step-by-step process that really defines how to perform a task within whichever framework we have chosen. A Playbook is often what people are REALLY asking for when they want to know “what to do next,” but the use of a playbook only makes sense when you understand the target environment and are following a methodology and framework.
Industry Methodologies
There are a couple I want to mention that relate indirectly to professional penetration testing, and those are:
- Cyber Kill Chain, created by Lockheed Martin
- ATT&CK Framework by Mitre
Although ATT&CK identifies as a framework, it provides multiple functions, including that of a methodology. In fact, both are very similar in concept (ATT&CK took the CKC framework as its core and modified it from there), the primary difference is that the CKC believes all its stages are requirements for an attack, while ATT&CK believes stages can be skipped. I don’t want to get into the weeds on the difference, but the CKC methodology has the following steps that explain how an attack goes from ideation to successful exploitation and compromise of systems:
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command & Control (C2)
- Actions on Objectives
We can follow those steps when performing a professional penetration test which satisfies the question of “what do I do first / what do I do next?”
Industry Frameworks
Frameworks are there to make sure we examine everything we need to during a professional penetration test. While the Methodology gives us the order in which to do them, Frameworks answers “what should I test?” which can only be answered once we have an understanding of our methodology. There are numerous Frameworks out there and which one you use will depend on client requirements:
- Penetration Testing Execution Standard (PTES)
- OWASP Continuous Penetration Testing Framework
- PCI Penetration Testing Guide
- NIST 800-115
- Information Systems Security Assessment Framework (ISSAF)
- Penetration Testing Framework
Frameworks also differ from Methodologies in that everything included is optional. They recognize that enterprise environments are unique, so therefore your pentest will be unique as well.
Industry Playbooks
Unfortunately, there aren’t any industry-recognized playbooks, but that’s because this is when we use tools against our targets within a professional penetration test. Playbooks are a personal thing, and as you journey through your career as a professional penetration tester, I strongly recommend you start saving the commands you use within your own playbook, and as time progresses, you will have a robust and unique playbook that will improve your effectiveness and efficiency during a penetration test.
Summary
Hope that helped clear up what the differences between Methodologies, Frameworks, and Playbooks are, and when to use them. Although the title of this blog was “Picking a Methodology,” limiting the conversation to just methodologies doesn’t really explain the whole ecosystem within a professional penetration test. If you have any questions about this post or need clarification on anything, best way to connect is to join our Discord server and chat with me directly, which can be found at:
https://discord.gg/3T7mfDu5Px
In the meantime, Happy Hacking!