Transcript Hacking and Penetration Testing Windows Utilizing Backtrack 4

By
Bruce Ellis
Western Governors University





Demonstrate the need for updating
information systems
Build security awareness
Inform management of the risk
Inform organizations of the potential
consequences
Most used operating system in the business
industry




Failure to apply security patches
Failure to update application/software
Failure to upgrade operating systems
Failure to provide continuous security
assessments
UTILIZED BACKTRACK 4

Tested security of
Windows Operating
Systems using tools
from Backtrack 4



Nessus
Metasploit
Nmap
OPERATING SYSTEMS TESTED




Windows XP SP 1
Windows XP SP 3
Windows Vista
Business
Windows Server 2003



Scanned systems first using Nessus to find
potential vulnerabilities, shares, user accounts,
computer name etc.
Scanned systems to find open ports
Utilized metasploit to set payloads for potential
vulnerabilities found using open ports.
Hacking and
Penetration Results
CRV
MRV
LRV
OPF
#VE
Windows XP SP 1
12
1
27
12
7
Windows XP SP 3
1
1
23
5
3
Windows Vista
0
0
4
1
0
Windows Server 2003
5
0
21
8
3
CRV= Critical Risk Vulnerabilities
MRV= Medium Risk Vulnerabilities
LRV= Low Risk Vulnerabilities
OPF= Open Ports Found
#VE= Vulnerabilities Exploited
12
10
8
Open Ports
6
4
2
0
Criticals Risk /Vul

Milestones were met as predicted except for
successful exploitation of Windows Vista
Business


At the beginning of the testing phase there
were problems exploiting Windows XP SP 1
due to lack of proficiency in metasploit.
Finding detailed information on Backtrack 4
and use of metasploit.