20.500.12556/DKUM-37424 RAZVOJ DOKUMENTACIJE O TESTIRANJU VDOROV V INFORMACIJSKE SISTEME Z OGRODJEM METASPLOIT DEVELOPMENT OF DOCUMENTATION ON PENETRATION TESTING WITH METASPLOIT FRAMEWORK Magistrska naloga obravnava izdelavo dokumentacije za testiranje vdorov v informacijske sisteme (penetration testing, ethical hacking). Zaradi pomanjkanja standardov, ki bi natančneje opredelili testirno dokumentacijo, smo kot osnovo uporabili standard IEEE 829 (1998 in 2008). Standard je zrelejši in obsežnejši od obstoječih standardov (npr. standard PTES), namenjenih izdelavi dokumentacije za testiranje vdorov v informacijske sisteme. Izdelali smo testno okolje in izvedli test vdora v informacijski sistem. Za izvedbo testiranja vdorov v informacijske sisteme smo uporabili Metasploit ogrodje. Na podlagi tega testa smo izdelali dokumentacijo po standardu IEEE829. Dokumentacije nismo izdelali natančno po standardu. Upoštevali smo tiste dele, ki so za testiranje vdorov v informacijske sisteme smotrni. Izpustili smo na primer poročilo o napakah in poročilo stanja vmesnih testov. Dodane so nekatere točke, ki jih priporoča standard PTES (npr. skala za ocenjevanje informacijske ogroženosti). Navedeni so možni načini uporabe. Podali smo nasvete za izdelavo in bodoči razvoj dokumentacije za testiranje vdorov v informacijske sisteme. This master thesis presents development of documentation for penetration testing. The field is affected with the lack of standards for documentation development. We suggested usage of standard IEEE 829 for that purpose. Standard IEEE 829 is primarly used for development of documentation for software testing. It can also be aplied to a fileld of penetration testing. In comparison with documentation developement standards for penetration testing, IEEE 829 is maturer and more comprehensive. Penetration testing lab was set up and tests were performed. Metasploit framework was used for that purpose. According to standard IEEE 829 penetration testing documentation was developed on basis of one of our tests. We used only material of standard that is relavant for penetration testing. For example anomaly report and interim test status report were not included in documentation. Some recommendations of PTES standard were also applied to our documentation (Information security risk rating scale). Usage possibilities of documentation are pointed out. We also recommended some guidelines for future development of standard. Testiranja vdorov v informacijske sisteme Dokumentacija za testiranje vdorov v informacijske sisteme Ogrodje Metasploit Standard IEEE 829 Standard PTES Penetration testing Penetration testing documentation Metasploit Framework Standard IEEE 829 Standard PTES true true false Slovenski jezik Angleški jezik Magistrsko delo 2012-08-30 13:08:05 2013-01-16 12:01:36 2022-04-23 23:08:02 2021-04-18 03:25:45 2012 0 Kranj 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 7112467 URN:SI:UM:DK:6G59WILS MAG_Leskovar_Rok_2012.pdf MAG_Leskovar_Rok_2012.pdf 1 BAF78FA1C296C80219DAD63709C6F396 16e1fb0763d2a609e93a2ac94cd8a0938295cbd76acb286f5582355d4697a543 3d47ec49-7c08-11eb-bb7a-00155d0001ca 20.500.12556/dkum/3081c9d9-2e26-4fce-9eec-799264faed0f https://dk.um.si/Dokument.php?lang=slv&id=49294 Fakulteta za organizacijske vede 0 0 0