Subvert (Controls Bypass)

The definition of subvert is to undermine and get within control. Subvert attacks bring their own intense brand of nastiness to the security equation. This chapter examines the tools for conducting a pen test to simulate subvert attacks, which are attacks that get past security controls. Many subvert attacks originate from malware. Because of this, the best tool pen testers have in their arsenal is antivirus software platforms used in their enterprise. There is no better tool used to probe, map, and identify holes and ways through them than Nmap. Nessus, Metasploit, and even Kali offer many tools to perform this function, but Nmap itself is the go‐to for this type of attack. One of the main options for a hacker is to gain access to a host computer through phishing, which is a technical version of social engineering. Spoofing is the way an attacker disguises their identity and remains hidden.