Methods for External Exploitation

A.

During a security assessment, the security assessment team may employ various methods to test the security posture of an organization. In this scenario, the assessment activities were divided into two phases: internal and external exploitation. The team also set a hard time limit on external activities before moving to a compromised box within the enterprise perimeter. This means that the team will conduct external exploitation for a limited time and then move to a compromised box within the organization's network to continue the assessment.

Next, the assessment team is most likely to employ the method of pivoting from the compromised box, moving laterally through the enterprise, and trying to exfiltrate data and compromise devices. Pivoting is a technique used by attackers to move from one compromised system to another within the target organization's network. Once the security assessment team has compromised a box within the organization's perimeter, they can use this as a starting point to move laterally through the network to gain access to other systems and resources. This technique allows the team to simulate an actual attack and test the organization's ability to detect and respond to such an attack.

The team's goal is to exfiltrate data and compromise devices, which means they will attempt to extract sensitive information from the organization's network and compromise additional systems. This technique helps to identify vulnerabilities that an attacker could exploit to gain unauthorized access to the organization's resources.

Conducting a social engineering attack attempt with the goal of accessing the compromised box physically is not the best choice for the assessment team at this stage. Physical security assessments are usually conducted separately and are not part of an external or internal exploitation assessment.

Exfiltrating network scans from the compromised box as a precursor to social media reconnaissance may be useful for the assessment team to gather information about the organization's network infrastructure. However, this technique is not the most likely next step for the team at this stage of the assessment.

Open-source intelligence gathering to identify the network perimeter and scope to enable further system compromises is also not the best choice for the assessment team at this stage. This technique is usually employed in the early stages of a security assessment to gather information about the organization's network infrastructure and identify potential attack vectors.