Computer System Penetration Testing Tools

U ovome su radu opisani osnovni pojmovi računalne sigurnosti potrebni za bolje razumijevanje rada. Opisan je postupak procjene rizika te pravni dokumenti sigurnosne infrastrukture u Republici Hrvatskoj. Opisan je postupak provođenja ispitivanja ranjivosti računalnih sustava i razlozi za njegovo provođenje. Opisane su najčešće ranjivosti računalnih sustava i uzroci njihovog nastanka. Opisana je podjela alata za ispitivanje s obzirom na područje njihove primjene. U praktičnom djelu ovoga rada uspostavljeno je radno okruženje za potrebe ispitivanja ranjivosti nezaštićenog virtualnog stroja, detaljnije su opisani alati Metasploit i OWASP ZAP, te su provedena različita ispitivanja uporabom tih alata.This paper describes the basic concepts of computer security required for a better understanding. The risk asessment procedure and the legal documents of the security infrastructure in the Republic of Croatia are described. The procedure of conducting vulnerability testing of computer systems is described as well as the reasons for its implementation. The most common computer systems vulnerabilities are described and the causes of their ocurrence. The distribution of testing tools is described with respect to the scope of their application. In the practical part of this paper, a working environment is established for vulnerability testing of an unprotected virtual machine. Vulnerability testing tools Metasploit and OWASP ZAP are described in more detail and various tests have been carried out using these tools