Dynamic attack path selection during penetration testing
Disclosed herein are methods, systems, and processes to facilitate and perform dynamic best path determination for penetration testing. An action path that includes a kill chain that involves performance of exploit actions for a phase of a penetration test is generated by identifying the exploit actions based on a penetration parameter, a detection parameter, and/or a time parameter associated with the exploit actions. Performance of the identified exploit actions permits successful completion of the phase of the penetration test and designates the action path for inclusion as part of a best path for the penetration test.
1. A computer-implemented method, comprising:
initiating a penetration test to simulate an attack on a computer network;
interrupting the penetration test at a particular hop to select a next action path of the penetration test, comprising:
identifying a plurality of available action paths to a plurality of next hops achievable from the particular hop,
calculating a penetration parameter for each of the available action paths, the calculation comprising:
determining a positive reward associated with a next hop associated with the available action path,
negatively adjusting the positive reward with a detection parameter associated with the available action path, and
negatively adjusting the positive reward with a time parameter associated with the available action path, and
selecting one of the available action paths as the next action path based on the penetration parameters of the available action paths; and
executing the next action path to continue the penetration test.
2. The computer-implemented method of claim 1 , further comprising:
repeating the interruption of the penetration test, the selection of the next action path, and the execution of the next action path until a specified penetration test goal is reached.
3. The computer-implemented method of claim 1 , further comprising:
determining a network topology of the computer network, and
using the network topology to determine the plurality of available action paths from the particular hop.
4. The computer-implemented method of claim 1 , wherein
the penetration parameter is calculated based on one or more penetration attributes including a data attribute, a credentials attribute, and an exploit attribute.
5. The computer-implemented method of claim 1 , wherein
the selected next action path has a highest net benefit with a lowest net risk among the plurality of available action paths.
6. The computer-implemented method of claim 1 , wherein
the penetration parameter is calculated by a penetration test server, and the penetration test server stores configurable parameter weights for the calculation.
7. The computer-implemented method of claim 6 , wherein
the penetration test server stores configurable boundaries for the penetration test, wherein the available action paths are limited by the configurable boundaries.
8. The computer-implemented method of claim 6 , wherein
the penetration test server schedules an execution time for the next action path.
9. The computer-implemented method of claim 1 , wherein identifying a particular available action path comprises:
detecting a vulnerability of the computer network, and
identifying an exploit that targets the vulnerability in a catalog of known vulnerabilities and exploits.
10. The computer-implemented method of claim 1 , further comprising:
performing reconnaissance of the computer network to collect network metadata about the computer network into a database, and
using the network metadata in the database to calculate the penetration parameters.
11. A system comprising:
one or more computers that implement a penetration test server, configured to:
initiate a penetration test to simulate an attack on a computer network;
interrupt the penetration test at a particular hop to select a next action path of the penetration test, including to:
identify a plurality of available action paths to a plurality of next hops achievable from the particular hop,
calculate a penetration parameter for each of the available action paths, the calculation including to:
determine a positive reward associated with a next hop associated with the available action path,
negatively adjust the positive reward with a detection parameter associated with the available action path, and
negatively adjust the positive reward with a time parameter associated with the available action path, and
select one of the available action paths as the next action path based on the penetration parameters of the available action paths; and
execute the next action path to continue the penetration test.
12. The system of claim 11 , wherein the penetration test server is configured to:
repeat the interruption of the penetration test, the selection of the next action path, and the execution of the next action path until a specified penetration test goal is reached.
13. The system of claim 11 , wherein
the penetration parameter is calculated based on one or more penetration attributes including a data attribute, a credentials attribute, and an exploit attribute.
14. The system of claim 11 , wherein
the selected next action path has a highest net benefit with a lowest net risk among the plurality of available action paths.
15. The system of claim 11 , wherein
the penetration parameter is calculated according to configurable parameter weights stored by the penetration test server.
16. The computer-implemented method of claim 11 , wherein
the available action paths are identified according to configurable boundaries for the penetration test stored by the penetration test server.
17. The system of claim 11 , wherein the penetration test server is configured to:
perform reconnaissance of the computer network to collect network metadata about the computer network into a database, and
use the network metadata in the database to calculate the penetration parameters.
18. The system of claim 11 , wherein
the penetration test server is configured to schedule an execution time for the next action path.
19. One or more non-transitory computer readable storage media storing program instructions executable by one or more processors of a penetration test server to cause the penetration test server to:
initiate a penetration test to simulate an attack on a computer network;
interrupt the penetration test at a particular hop to select a next action path of the penetration test, including to:
identify a plurality of available action paths to a plurality of next hops achievable from the particular hop,
calculate a penetration parameter for each of the available action paths, the calculation including to:
determine a positive reward associated with a next hop associated with the available action path,
negatively adjust the positive reward with a detection parameter associated with the available action path, and
negatively adjust the positive reward with a time parameter associated with the available action path, and
select one of the available action paths as the next action path based on the penetration parameters of the available action paths; and
execute the next action path to continue the penetration test.
20. The one or more non-transitory computer readable storage media of claim 19 , wherein to identify a particular available action path, the program instructions are executable by the one or more processors to cause the penetration test server to:
detect a vulnerability of the computer network, and
identify an exploit that targets the vulnerability in a catalog of known vulnerabilities and exploits.