Dynamic best path determination for penetration testing
Disclosed herein are methods, systems, and processes to facilitate and perform dynamic best path determination for penetration testing. An action path that includes a kill chain that involves performance of exploit actions for a phase of a penetration test is generated by identifying the exploit actions based on a penetration parameter, a detection parameter, and/or a time parameter associated with the exploit actions. Performance of the identified exploit actions permits successful completion of the phase of the penetration test and designates the action path for inclusion as part of a best path for the penetration test.
1. A computer-implemented method, comprising:
generating an action path for a phase of a penetration test, wherein
the action path comprises a kill chain,
the kill chain comprises a plurality of exploit actions, and the generating the action path comprises identifying one or more exploit actions of the plurality of exploit actions based on a weighted combination of exploit action attributes, wherein
the exploit action attributes comprise a penetration parameter, a detection parameter, and a time parameter associated with each of the one or more exploit actions,
the penetration parameter indicates a positive reward associated with a penetration test goal, and
the weighted combination negatively adjusts the reward based on the detection parameter and the time parameter;
determining that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test; and
based on the determining, designating the action path for inclusion as part of a best path for the penetration test.
2. The computer-implemented method of claim 1 , further comprising:
performing a scan action to determine a topology of a network environment; and
storing the topology of the network environment, wherein the topology comprises metadata associated with a plurality of nodes operating in the network environment.
3. The computer-implemented method of claim 2 , further comprising:
generating a next action path for a next phase of the penetration test, wherein
the next action path is part of the kill chain, and
the generating the next action path comprises adjusting the penetration parameter, the detection parameter, and/or the time parameter based on the metadata and the designation of the action path;
identifying one or more other exploit actions of the plurality of exploit actions based on the adjusted penetration parameter, the adjusted detection parameter, and/or the adjusted time parameter;
determining that performance of the one or more other exploit actions permits successful completion of the next phase of the penetration test; and
based on the determining, designating the next action path for inclusion as part of the best path for the penetration test.
4. The computer-implemented method of claim 1 , wherein
the penetration parameter comprises one or more penetration attributes, wherein the one or more penetration attributes comprise at least a data attribute, a credentials attribute, and an exploit attribute,
the detection parameter comprises at least a detection attribute,
the time parameter indicates an execution time attribute associated with performing the one or more exploit actions,
the one or more penetration attributes are positive attributes, and
the detection attribute and the execution time attribute are negative attributes.
5. The computer-implemented method of claim 1 , wherein
the determining that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test comprises receiving indication that the one or exploit actions identified as part of generating the action path result in a lowest risk of detection during performance of the penetration test.
6. The computer-implemented method of claim 3 , wherein
the penetration test is performed by a penetration testing server, and
the penetration testing server is not part of the network environment.
7. The computer-implemented method of claim 3 , further comprising generating the best path for the penetration test including:
configuring a penetration testing server to schedule performance of the next action path after performance of the action path; and
modifying the kill chain based on the scheduling.
8. The computer-implemented method of claim 1 , wherein
the action path is one of a plurality of available action paths that permit successful completion of the phase of the penetration test, and
performing the one or more exploit actions comprised in the action path results in a lowest risk of detection during the penetration test compared to performing one or more other exploit actions comprised in one or more other action paths of the plurality of available action paths.
9. A non-transitory computer readable storage medium comprising program instructions executable to:
generate an action path for a phase of a penetration test, wherein
the action path comprises a kill chain,
the kill chain comprises a plurality of exploit actions, and the generating the action path comprises identifying one or more exploit actions of the plurality of exploit actions based on a weighted combination of exploit action attributes, wherein
the exploit action attributes comprise a penetration parameter, a detection parameter, and a time parameter associated with each of the one or more exploit actions,
the penetration parameter indicates a positive reward associated with a penetration test goal, and
the weighted combination negatively adjusts the reward based on the detection parameter and the time parameter;
determine that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test; and
based on the determining, designate the action path for inclusion as part of a best path for the penetration test.
10. The non-transitory computer readable storage medium of claim 9 , wherein the program instructions executable to:
perform a scan action to determine a topology of a network environment; and
store the topology of the network environment, wherein
the topology comprises metadata associated with a plurality of nodes operating in the network environment.
11. The non-transitory computer readable storage medium of claim 10 , wherein the program instructions executable to:
generate a next action path for a next phase of the penetration test, wherein
the next action path is part of the kill chain, and the generating the next action path comprises adjusting the penetration parameter, the detection parameter, and/or the time parameter based on the metadata and the designation of the action path;
identify one or more other exploit actions of the plurality of exploit actions based on the adjusted penetration parameter, the adjusted detection parameter, and/or the adjusted time parameter;
determine that performance of the one or more other exploit actions permits successful completion of the next phase of the penetration test; and
based on the determining, designate the next action path for inclusion as part of the best path for the penetration test.
12. The non-transitory computer readable storage medium of claim 9 ,
wherein
the penetration parameter comprises one or more penetration attributes, wherein the one or more penetration attributes comprise at least a data attribute, a credentials attribute, and an exploit attribute,
the detection parameter comprises at least a detection attribute,
the time parameter indicates an execution time attribute associated with performing the one or more exploit actions,
the one or more penetration attributes are positive attributes, and
the detection attribute and the execution time attribute are negative attributes.
13. The non-transitory computer readable storage medium of claim 9 ,
wherein
the determining that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test comprises receiving indication that the one or exploit actions identified as part of generating the action path result in a lowest risk of detection during performance of the penetration test,
the action path is one of a plurality of available action paths that permit successful completion of the phase of the penetration test, and
performing the one or more exploit actions comprised in the action path results in a lowest risk of detection during the penetration test compared to performing one or more other exploit actions comprised in one or more other action paths of the plurality of available action paths.
14. The non-transitory computer readable storage medium of claim 11 , wherein
the penetration test is performed by a penetration testing server,
the penetration testing server is not part of the network environment, and
the program instructions are executable to generate the best path for the penetration test including
configuring the penetration testing server to schedule performance of the next action path after performance of the action path, and
modifying the kill chain based on the scheduling.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
generate an action path for a phase of a penetration test, wherein
the action path comprises a kill chain,
the kill chain comprises a plurality of exploit actions, and the generating the action path comprises identifying one or more exploit actions of the plurality of exploit actions based on a weighted combination of exploit action attributes, wherein
the exploit action attributes comprise a penetration parameter, a detection parameter, and a time parameter associated with each of the one or more exploit actions,
the penetration parameter indicates a positive reward associated with a penetration test goal, and
the weighted combination negatively adjusts the reward based on the detection parameter and the time parameter;
determine that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test; and
based on the determining, designate the action path for inclusion as part of a best path for the penetration test.
16. The system of claim 15 , wherein the program instructions are executable to:
perform a scan action to determine a topology of a network environment; and
store the topology of the network environment, wherein
the topology comprises metadata associated with a plurality of nodes operating in the network environment.
17. The system of claim 16 , wherein the program instructions are executable to:
generate a next action path for a next phase of the penetration test, wherein
the next action path is part of the kill chain, and
the generating the next action path comprises adjusting the penetration parameter, the detection parameter, and/or the time parameter based on the metadata and the designation of the action path;
identify one or more other exploit actions of the plurality of exploit actions based on the adjusted penetration parameter, the adjusted detection parameter, and/or the adjusted time parameter;
determine that performance of the one or more other exploit actions permits successful completion of the next phase of the penetration test; and
based on the determining, designate the next action path for inclusion as part of the best path for the penetration test.
18. The system of claim 15 , wherein
the penetration parameter comprises one or more penetration attributes, wherein
the one or more penetration attributes comprise at least a data attribute, a credentials attribute, and an exploit attribute,
the detection parameter comprises at least a detection attribute,
the time parameter indicates an execution time attribute associated with performing the one or more exploit actions,
the one or more penetration attributes are positive attributes, and
the detection attribute and the execution time attribute are negative attributes.
19. The system of claim 15 , wherein
the determining that performance of the one or more identified exploit actions permits successful completion of the phase of the penetration test comprises
receiving indication that the one or exploit actions identified as part of generating the action path result in a lowest risk of detection during performance of the penetration test,
the action path is one of a plurality of available action paths that permit successful completion of the phase of the penetration test, and
performing the one or more exploit actions comprised in the action path results in a lowest risk of detection during the penetration test compared to performing one or more other exploit actions comprised in one or more other action paths of the plurality of available action paths.
20. The system of claim 17 , wherein
the penetration test is performed by a penetration testing server,
the penetration testing server is not part of the network environment, and
the program instructions are executable to generate the best path for the penetration test including to
configure the penetration testing server to schedule performance of the next action path after performance of the action path, and
modify the kill chain based on the scheduling.