Scripting Myself Out of a Job - Automating the Penetration Test with APT2

Presented at DerbyCon 6.0 Recharge (2016), Sept. 24, 2016, 3 p.m. (50 minutes).

Nearly every penetration test begins the same way; run a NMAP scan, review the results, choose interesting services to enumerate and attack, and perform post-exploitation activities. What was once a fairly time consuming manual process, is now automated! Automated Penetration Testing Toolkit (APT2) is an extendable modular framework designed to automate common tasks performed during penetration testing. APT2 can chain data gathered from different modules together to build dynamic attack paths. Starting with a NMAP scan of the target environment, discovered ports and services become triggers for the various modules which in turn can fire additional triggers. Have FTP, Telnet, or SSH? APT2 will attempt common authentication. Have SMB? APT2 determines what OS and looks for shares and other information. Modules include everything from enumeration, scanning, brute forcing, and even integration with Metasploit. Come check out how APT2 will save you time on every engagement.

Presenters:

• Adam Compton / tatanus   as Adam Compton
• Austin Lane

Similar Presentations:

• DEF CON 19 (2011) / Metasploit vSploit Modules
• AppSec USA 2014 / Nmap 101 Workshop
• DerbyCon 2.0 Reunion (2012) / Introduction to Metasploit Post Exploitation Modules