Analyze, Testing, and Strategy

Analysis of a situation can provide the greatest returns as long as it is accurate data you are analyzing.

Analysis

If you followed along with the recon article and have gathered some much crucial intel on the target system(s). This is where those devices that we grabbed right after the new year(article link) come into play. With our reconnaissance, we can derive if they are running on x86, arm, or some other architecture. With this information, we can set up a proper testing environment to flesh out a strategy to execute. Not to get ahead of ourselves here, there still is a lot of ground to cover in the analysis phase. Rushing any of the phases before strategy will ultimately result in a weaker strategy. The worst case being the strategy fails due to inaccurate current information all because you failed to execute recon correctly.

Analysis will take time and you should never rush it, be always vigilant as the situation can always change.

Testing

We now have a solid understanding of the system, the services, and even some of the known or possible exploits against a system. This is a solid start and now we need to take our devices and mimic an environment to get some solid testing without risking disclosing our intents to a potential target. I must reiterate, this information is for educational purposes and I am not responsible for your actions. That being said, let’s go set up our environment on our devices to replicate what we are planning to target. This will include installing an operating system, services like a database, web server, forum, et al. These tasks will seem tedious but they will pay dividends in developing our strategy.

Control testing and application of variant changes will prove to provide the best results.
Target analysis, testing, and strategy are the same with hacking and with chess. Strategic advantages in either should result in success if leveraged correctly. Improper leverage and failure is found.

Strategy and Planning

After testing and analysis of our testing, we can now strategize the execution as well as the threat model against our plan. A common mistake is not threat modeling against the strategy of attack, this has led to some unexpected results such as target changing their infrastructure, their code, or upgrading to prevent the vectors from existing. Each step along the way you must consider there are counters and in some cases preventative measures that could be taken if the target becomes aware of the potential threat. This is where OpSec and threat modeling culminates into the reality of the situation and are no longer as measures taken as a perceived attack. Once you do execute, all bets are off.

Maybe chess is not your idea of strategy, utilize the same thought exercises you would in a game of Dungeons & Dragons. Get creative, you might surprise yourself with the outcome.

Closing Thoughts

In this article, we went covered analyzing the data obtained from recon, setting up a test environment, how to scrutinize an exploit, and how those steps build a strategy for success. We now have to do some serious thinking on the matter. Next week we will be covering execution, so before you get wild you got to do some more work before actually following through. Next week’s article will be on fortitude and should be read before taking any actions further than our testing and analysis. Remember, being impatient and hasty in our processes will lead to poor executions and add attack vectors to our operational security.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
nixops

nixops

47 Followers

General purpose hacker and deadhead. Sometimes I do things…