SANS 560 GPEN STUDY GUIDE
1:8 Strategic planning - Answers -deep analysis and understanding of the state of
business and the threats faced by the organization
1:8 Value to the organization - Answers -develop your objectives based on the
organization's vision and mission, stake holder risk appetite and opportunities
1:8 Driving engagement - Answers -execute on the plan by navigating the internal
values and culture, developing a business case to get support and funding, and
promoting your activities
1:8 Organizational Transformation - Answers -as a leader you must strive to lead,
motivate, and inspire your team members and colleagues to accomplish their goals of
the overall strategic planning process
1:11 Successful security planning - Answers -requires an understanding of not only
security threats and capabilities but also a deep understanding of the business
environment & organizational goals.
1:14 Verizon Data Breach Investigations Report - Answers -Shows the percentages of
breaches per threat action, i.e. Hacking, malware, social engineering
1:28 "30/60/90" - Answers -30 second elevator pitch, 60 minutes with a business
partner, 90 minutes for a presentation
1:29 - Answers -Understanding the business 1. Understand where you've been
2.Understand business Strategy 3.Understand macro factors that affect business
4.understand and develop realtionships with key stakeholders
1:31 - Answers -George Santayana "Those who cannot remember the past are
condemned to repeat it."
1:41 - Answers -Business Model 1. describes how you operate 2. generate revenue
and make profit 3. deliver value at a resonable cost
1:45 - Answers -Vertical Business Model combines multiple steps in a value chain into
one organization e.g. development -> distro
1:45 - Answers -Horizontal Business model focus on one area of the value chain e.g.
Product development
1:47 - Answers -PFF -Porter's Five Forces Developed by Micheal E Porter in 1979 who
was an authority on competitive strategy and economic development
,1:47 - Answers -PFF -Porter's Five Forces Method used to develop business strategy
by understanding where power lies in a business situation
1:47 - Answers -PFF - Power of Customers Impact Customers have on your business.
Force Driven by the # of customers you have, their importance to your business, and
cost of switching them from you to another company
1:48 - Answers -PFF - Substitute Products The ability for your customer to find
substitute products or an easier way to do what you do
1:48 - Answers -PFF - Power Of Suppliers how easy is it for suppliers to influence and
drive up your prices. Uniqueness of their products, their strength/control of you
1:48 - Answers -PFF - Threats of new entrants how easy is it for people to join the
market and can they become a threat and compete with your company
1:48 - Answers -PFF - Competitive Rivalry Look at the competition and their
capabilities. If no one can do what you do, e.g. products/services, you will have
tremendous strength
1:56 - Answers -Strategic objectives "-Based on understanding the business model,
strategy and competitive forces
-Very high level and often vague" - Answers -
1:56 Strategy Maps - Answers -"- Links high-level strategic objectives to specific
projects, initiatives
-Shows how to turn strategy into tangible outcomes - Answers -
-highlights gaps in strategy implementation - Answers -
-helps communicate strategy to entire organization" - Answers -
Account Lockout (4:106) - Answers -Damage could be done to the target organizations
network, if a password guessing attack locks out valid accounts. Coordinate with target
personnel to monitor any account lock outs as a result of password guessing. The
lockoutstats.exe tool, from Microsoft, pulls info about locked-out accounts from AD,
letting an admin pull the status regularly to see if accounts have been locked out
recently while running tests
Account Lockout on Windows (4:107) - Answers -Lockout Threshold: number of bad
PW attempts for an acct that will be accepted before the account is locked out. Values
range from 0 to 999; values of 0 will never lock out. Lockout duration: measure in
minutes the amount of time an account will be locked out until it's re-enabled. Max value
9999; Lockout Observation Window: configuration sets the time duration, in minutes,
,over which bad logon attempts are counted. After this time passes counter is reset to 0.
C:\> net accounts, will show you these statistics
Account Lockout: Safer approaches (4:110) - Answers -Avoid password guessing
attacks; it may lower the value of the pen test because the target may not have a feel
for this kind of attack would be successful. You may augment the test with a password
cracking phase to audit PW strength to supplant PW strength. Secondly ask
administrators if account lock out us utilized on target network. This may work for you,
or the admin may give you misinformation
Additional Collaboration Tools (1:109) - Answers -EtherPad: free, web-based collab
tool; LAIR: written by Tom Steele & Dan Kottman can import data from a variety of
scanning tools, including NMAP, Nessus, Nexpose, BurpSuite & more. Metasploit
Databases: an store hosts, services, vulns, creds, loot table, and more
Admin Account lockout on Windows (4:108) - Answers -By default the original admin
account cannot be locked out on a WIN machine even if it's been renamed. To check
the SID for each account use C:\> wmic useraccount list brief; the original admin
account SID will have a suffix of 500. Microsoft includes a feature within Active Directory
that will allow any admin account to be locked out on a machine, as long as there is one
other admin account that is not locked.
Always create a Report (1:91) - Answers -Creating a high quality report will not only
provide proof of the work you did, but will be used well into the future. Reports need to
provide value to the network owner. Start writing the report as you conduct your testing
in order to grab screenshots or illustrate your findings. If you discover a significant
finding, write it up immediately, while you have all the details fresh
Analying a System: Interacting with the Registry (4:23) - Answers -The ability to interact
with the registry is important to know via the command line. To read a registry key use
the command C:\> reg query [KeyName] you could use the add functionality. If the key
already exists the information will be over written. Reg add [keyname] /v [valuename] /t
[type] /d [data] ****See page for grabbing a series of keys; and importing a registry key
setting
Analyzing a System: Changing Firewall Settings (4:22) - Answers -***See page for
specific details on adjusting firewall rules and profiles***
Analyzing a System: Determining Firewall Settings (4:21) - Answers -using the
C:\>netsh /? You can control most aspects of the Windows networking, including IP
address, bridging, and routing. Using netsh advfirewall show allprofiles shows the
settings of the Windows firewall, but not of third party installed firewalls.
Analyzing a System: Displaying/Scraping files (4:16) - Answers -type: displays contents
of a file on Standard Output. It can be used to display multiple files using the * .xxx or
, listing the file names. More: will display the contents of a file one page at a time. You
can also search within the document for specific strings ***see page for examples***
Analyzing a System: Searching the File System (4:18) - Answers -You can search the
file system recursively with the command C:\> dir /b /s [directory]\[file].
Analyzing a System: Using Environmental Variables (4:17) - Answers -To see the
environmental variables set within the shell use the set command. You can see who's
logged in with the c:\> set username and you can also use path to determine what
ancillary packages installed on the machine.
Announced Testing (1:71) - Answers -If your sys admins have any type of deliberate
backdoors or side businesses they will likely be shut down during testing and avoid
detection
Antivirus Evasion Tactics (3:64) - Answers -Shutdown the AV software: Not
recommended and could expose system to malicious traffic. Ghost Writing: altering the
malicious exe in a disassembler or hex editor and adding inocuous machine-language
instructions that preserve the behavior of the file but alter the file contents. In some
cases adding a NOP can prevent triggering the AV. Encoding malware so it doesn't
match signatures: modifying the malicious file in a systematic way, applying a round of
encoding or even encryption and then applying a decoding/decrypting header in front.
Custom compile the malware: Compiling the malware from source code and choosing
different instructions and compiler options, the AV will not trigger
Approach for Evading AV (3:65) - Answers -Instead of trying to beat all the AV software
out there, simply conduct recon to find out what the target organization is using. Social
engineer the system personnel, calling users and asking them the AV solution. Once
the AV has been identified attempt to gain access to a copy as close to the product in
use and create malicious files in an attempt to circumvent it
ARIN Lookup (1:132) - Answers -ARIN will respond with summary records if there are
any matches. With each summary taking up one line and providing a link for more
detailed info
Automating Service String Info Gathering (2:134) - Answers -Netcat can grab multiple
service strings from a series of ports on a target. This setting tries to connect to ports,
starting at port Y and then decrementing by 1, going down until it tries to connect to port
X. ***See book for more***
Avoiding Scope Creep (1:78) - Answers -Discuss threats, risks, and already known
vulnerabilities. This will help narrow the focus of the test and prevent Scope creep.
Biondi, Philippe (2:77) - Answers -Created Scapy in an environment based on the
python programming language.
1:8 Strategic planning - Answers -deep analysis and understanding of the state of
business and the threats faced by the organization
1:8 Value to the organization - Answers -develop your objectives based on the
organization's vision and mission, stake holder risk appetite and opportunities
1:8 Driving engagement - Answers -execute on the plan by navigating the internal
values and culture, developing a business case to get support and funding, and
promoting your activities
1:8 Organizational Transformation - Answers -as a leader you must strive to lead,
motivate, and inspire your team members and colleagues to accomplish their goals of
the overall strategic planning process
1:11 Successful security planning - Answers -requires an understanding of not only
security threats and capabilities but also a deep understanding of the business
environment & organizational goals.
1:14 Verizon Data Breach Investigations Report - Answers -Shows the percentages of
breaches per threat action, i.e. Hacking, malware, social engineering
1:28 "30/60/90" - Answers -30 second elevator pitch, 60 minutes with a business
partner, 90 minutes for a presentation
1:29 - Answers -Understanding the business 1. Understand where you've been
2.Understand business Strategy 3.Understand macro factors that affect business
4.understand and develop realtionships with key stakeholders
1:31 - Answers -George Santayana "Those who cannot remember the past are
condemned to repeat it."
1:41 - Answers -Business Model 1. describes how you operate 2. generate revenue
and make profit 3. deliver value at a resonable cost
1:45 - Answers -Vertical Business Model combines multiple steps in a value chain into
one organization e.g. development -> distro
1:45 - Answers -Horizontal Business model focus on one area of the value chain e.g.
Product development
1:47 - Answers -PFF -Porter's Five Forces Developed by Micheal E Porter in 1979 who
was an authority on competitive strategy and economic development
,1:47 - Answers -PFF -Porter's Five Forces Method used to develop business strategy
by understanding where power lies in a business situation
1:47 - Answers -PFF - Power of Customers Impact Customers have on your business.
Force Driven by the # of customers you have, their importance to your business, and
cost of switching them from you to another company
1:48 - Answers -PFF - Substitute Products The ability for your customer to find
substitute products or an easier way to do what you do
1:48 - Answers -PFF - Power Of Suppliers how easy is it for suppliers to influence and
drive up your prices. Uniqueness of their products, their strength/control of you
1:48 - Answers -PFF - Threats of new entrants how easy is it for people to join the
market and can they become a threat and compete with your company
1:48 - Answers -PFF - Competitive Rivalry Look at the competition and their
capabilities. If no one can do what you do, e.g. products/services, you will have
tremendous strength
1:56 - Answers -Strategic objectives "-Based on understanding the business model,
strategy and competitive forces
-Very high level and often vague" - Answers -
1:56 Strategy Maps - Answers -"- Links high-level strategic objectives to specific
projects, initiatives
-Shows how to turn strategy into tangible outcomes - Answers -
-highlights gaps in strategy implementation - Answers -
-helps communicate strategy to entire organization" - Answers -
Account Lockout (4:106) - Answers -Damage could be done to the target organizations
network, if a password guessing attack locks out valid accounts. Coordinate with target
personnel to monitor any account lock outs as a result of password guessing. The
lockoutstats.exe tool, from Microsoft, pulls info about locked-out accounts from AD,
letting an admin pull the status regularly to see if accounts have been locked out
recently while running tests
Account Lockout on Windows (4:107) - Answers -Lockout Threshold: number of bad
PW attempts for an acct that will be accepted before the account is locked out. Values
range from 0 to 999; values of 0 will never lock out. Lockout duration: measure in
minutes the amount of time an account will be locked out until it's re-enabled. Max value
9999; Lockout Observation Window: configuration sets the time duration, in minutes,
,over which bad logon attempts are counted. After this time passes counter is reset to 0.
C:\> net accounts, will show you these statistics
Account Lockout: Safer approaches (4:110) - Answers -Avoid password guessing
attacks; it may lower the value of the pen test because the target may not have a feel
for this kind of attack would be successful. You may augment the test with a password
cracking phase to audit PW strength to supplant PW strength. Secondly ask
administrators if account lock out us utilized on target network. This may work for you,
or the admin may give you misinformation
Additional Collaboration Tools (1:109) - Answers -EtherPad: free, web-based collab
tool; LAIR: written by Tom Steele & Dan Kottman can import data from a variety of
scanning tools, including NMAP, Nessus, Nexpose, BurpSuite & more. Metasploit
Databases: an store hosts, services, vulns, creds, loot table, and more
Admin Account lockout on Windows (4:108) - Answers -By default the original admin
account cannot be locked out on a WIN machine even if it's been renamed. To check
the SID for each account use C:\> wmic useraccount list brief; the original admin
account SID will have a suffix of 500. Microsoft includes a feature within Active Directory
that will allow any admin account to be locked out on a machine, as long as there is one
other admin account that is not locked.
Always create a Report (1:91) - Answers -Creating a high quality report will not only
provide proof of the work you did, but will be used well into the future. Reports need to
provide value to the network owner. Start writing the report as you conduct your testing
in order to grab screenshots or illustrate your findings. If you discover a significant
finding, write it up immediately, while you have all the details fresh
Analying a System: Interacting with the Registry (4:23) - Answers -The ability to interact
with the registry is important to know via the command line. To read a registry key use
the command C:\> reg query [KeyName] you could use the add functionality. If the key
already exists the information will be over written. Reg add [keyname] /v [valuename] /t
[type] /d [data] ****See page for grabbing a series of keys; and importing a registry key
setting
Analyzing a System: Changing Firewall Settings (4:22) - Answers -***See page for
specific details on adjusting firewall rules and profiles***
Analyzing a System: Determining Firewall Settings (4:21) - Answers -using the
C:\>netsh /? You can control most aspects of the Windows networking, including IP
address, bridging, and routing. Using netsh advfirewall show allprofiles shows the
settings of the Windows firewall, but not of third party installed firewalls.
Analyzing a System: Displaying/Scraping files (4:16) - Answers -type: displays contents
of a file on Standard Output. It can be used to display multiple files using the * .xxx or
, listing the file names. More: will display the contents of a file one page at a time. You
can also search within the document for specific strings ***see page for examples***
Analyzing a System: Searching the File System (4:18) - Answers -You can search the
file system recursively with the command C:\> dir /b /s [directory]\[file].
Analyzing a System: Using Environmental Variables (4:17) - Answers -To see the
environmental variables set within the shell use the set command. You can see who's
logged in with the c:\> set username and you can also use path to determine what
ancillary packages installed on the machine.
Announced Testing (1:71) - Answers -If your sys admins have any type of deliberate
backdoors or side businesses they will likely be shut down during testing and avoid
detection
Antivirus Evasion Tactics (3:64) - Answers -Shutdown the AV software: Not
recommended and could expose system to malicious traffic. Ghost Writing: altering the
malicious exe in a disassembler or hex editor and adding inocuous machine-language
instructions that preserve the behavior of the file but alter the file contents. In some
cases adding a NOP can prevent triggering the AV. Encoding malware so it doesn't
match signatures: modifying the malicious file in a systematic way, applying a round of
encoding or even encryption and then applying a decoding/decrypting header in front.
Custom compile the malware: Compiling the malware from source code and choosing
different instructions and compiler options, the AV will not trigger
Approach for Evading AV (3:65) - Answers -Instead of trying to beat all the AV software
out there, simply conduct recon to find out what the target organization is using. Social
engineer the system personnel, calling users and asking them the AV solution. Once
the AV has been identified attempt to gain access to a copy as close to the product in
use and create malicious files in an attempt to circumvent it
ARIN Lookup (1:132) - Answers -ARIN will respond with summary records if there are
any matches. With each summary taking up one line and providing a link for more
detailed info
Automating Service String Info Gathering (2:134) - Answers -Netcat can grab multiple
service strings from a series of ports on a target. This setting tries to connect to ports,
starting at port Y and then decrementing by 1, going down until it tries to connect to port
X. ***See book for more***
Avoiding Scope Creep (1:78) - Answers -Discuss threats, risks, and already known
vulnerabilities. This will help narrow the focus of the test and prevent Scope creep.
Biondi, Philippe (2:77) - Answers -Created Scapy in an environment based on the
python programming language.
