Chapter 10. Bypassing Security Controls

"The only thing that stands between you and outrageous success is continuous progress"

Often, when the testers achieve root or internal network access they are done with the test assuming testers have the knowledge and toolset to completely compromise the network or enterprise. One of the neglected aspects during a penetration test activity is bypassing security controls to assess the target organization's prevention and detection techniques deployed. In all the penetration testing activity, penetration testers or attackers need to understand what renders the exploit ineffective while performing an active attack on the target network or system and bypassing the security controls that are set by the target organization; this becomes crucial as part of the kill-chain methodology. In this chapter, we will review the different types of security controls in place, identify a systematic process for overcoming these controls, and demonstrate this using the...