DEVELOPMENT OF DOCUMENTATION ON PENETRATION TESTING WITH METASPLOIT FRAMEWORK

Magistrska naloga obravnava izdelavo dokumentacije za testiranje vdorov v informacijske sisteme (penetration testing, ethical hacking). Zaradi pomanjkanja standardov, ki bi natančneje opredelili testirno dokumentacijo, smo kot osnovo uporabili standard IEEE 829 (1998 in 2008). Standard je zrelejši in obsežnejši od obstoječih standardov (npr. standard PTES), namenjenih izdelavi dokumentacije za testiranje vdorov v informacijske sisteme. Izdelali smo testno okolje in izvedli test vdora v informacijski sistem. Za izvedbo testiranja vdorov v informacijske sisteme smo uporabili Metasploit ogrodje. Na podlagi tega testa smo izdelali dokumentacijo po standardu IEEE829. Dokumentacije nismo izdelali natančno po standardu. Upoštevali smo tiste dele, ki so za testiranje vdorov v informacijske sisteme smotrni. Izpustili smo na primer poročilo o napakah in poročilo stanja vmesnih testov. Dodane so nekatere točke, ki jih priporoča standard PTES (npr. skala za ocenjevanje informacijske ogroženosti). Navedeni so možni načini uporabe. Podali smo nasvete za izdelavo in bodoči razvoj dokumentacije za testiranje vdorov v informacijske sisteme.This master thesis presents development of documentation for penetration testing. The field is affected with the lack of standards for documentation development. We suggested usage of standard IEEE 829 for that purpose. Standard IEEE 829 is primarly used for development of documentation for software testing. It can also be aplied to a fileld of penetration testing. In comparison with documentation developement standards for penetration testing, IEEE 829 is maturer and more comprehensive. Penetration testing lab was set up and tests were performed. Metasploit framework was used for that purpose. According to standard IEEE 829 penetration testing documentation was developed on basis of one of our tests. We used only material of standard that is relavant for penetration testing. For example anomaly report and interim test status report were not included in documentation. Some recommendations of PTES standard were also applied to our documentation (Information security risk rating scale). Usage possibilities of documentation are pointed out. We also recommended some guidelines for future development of standard