for the exercise recap "Using SET to perform social engineering" can you detail how SET the social engineering toolkit can be used to send mass emails and include a malicious meterpreter session. describe what metasploit is and how we use it to catch the reverse shell, also describe what a reverse shell is. Include extra guidance on a few of the interesting functions of the meterpreter payload like keyscan_start, Keyscan_dump, uictl, screenshare and webcam_stream. Of course include the legal and ethical disclaimer.
Vulnerabilities, Threats and Risk
All activity is subject to a degree of risk
Risk can be defined as:
In order to manage risk proportionally we must quantify risk
We can do this:
Qualitatively
Quantitatively
We cannot eliminate risk entirely
Instead we must reduce risk to an acceptable level
* ISO 31000 risk management standard
Risk: The effect of uncertainty on objectives *
Content with Half Vertical Image
Calculating Risk
Likelihood
X
Impact
Vulnerability
=
Threat
+
A weakness in an asset
An event or actor which could exploit a vulnerability
An event or actor which could exploit a vulnerability
RISK
Gap Analysis
Where we want to be
Where we are
GAP
Recording Risk
Risk
A measure of threats, vulnerabilities, impact, and probability
Risk Registers
Risk description
Severity
Owner of the risk item
Identified mitigations
Often utilize heat maps
Responding To Risk
Risk management strategies
Describe the proactive and systematic approaches used to:
identify
assess
prioritize
mit…
