Penetration testing

Penetration testing

1. 2. Determine the scope and planning

   • What systems/apps?
   • Internal or external systems?
   • Black, White or Grey Box testing
     • Black box refers to a test with no previous info given by the enterprise to be tested. It is important to understand that a pen tester will have much less time and resources than an APT, so maybe it would be more interesting give to the tester the network diagram and some othe informatuon previously.
   • Deliverables reports and summaries
     • Daily /Weekly summaries? Executive Summary after finding reports? After finding vulnerabilties, specially if they are important, the company should be contacted in case they want to stop the test and fix the hole.

2. 1. Discuss and agree upon Rules of Engagement

   • Mainly if you are testing an external enterprise.
   • Time and date to perform the test
     • Take into account that the time of the day is important. During business hours, there's much more network noise and it is more difficult to detect attacks.
   • Contact Information
     • Who should be contacted if something is broken during the test? Who will receive the final report?
   • Endpoint of a specific test
     • What should we do if we find a vulnerability? Stop and report or continue to try to extract information?
   • Legal liability
     • Which countries will be potentially affected. They have different laws and rules regarding network testing.

3. 3. Perform testing

   • Network testing
     • Discovery of systems, open ports and services
       • Usually 1,2 and 3 are done together, and posibly 4 too. nmap and netcat are the most useful tools. Also pf03 (passive scan), Sparta and getting info from snmp protocol through snmpwalk or Solarwinds SNMP MIB Browser. Also Scapy is very useful to create customed packets.
       • 1. Network mapping
       • 2. Port mapping
         • nmap -sT target (1000 main ports)
       • 5. Wireless Scanning
     • Enumeration of OS and apps in use
       • 3. OS fingerprinting
         • nmap -sT -O target p0f3 (passive)
     • Enumerating data sources
       • most common for internal tests
     • Discovery of new flaws (fuzzing)
       • 4. Vulnerability Scanning
         • Openvas (Kali - Open source) Commercial tools: Tenable Nessus Qualysguard Rapid7 Nexpose Tripwire IP360 GFI Languard
   • Exploiting Systems & Apps
     • Web app testing
       • Web scanning tools: Nikto/Wikto Burp (Web App Scanning Proxy) ZAP (Zed Attack Proxy) Commercial "dynamic analysis" tools: HP SPI Dynamics web Inspect IBM App Scan Trustwave App Scanner Fuzzers like Immunity's Canvas
       • Injection Flaws
         • SQL injection
           • http://sqlmap.org http://sqlninja.sourceforge.net https://github.com/Neohapsis/bbqsql http://pentestmonkey.net/category/cheat-sheet/sql-injection
           • Standard
             • We see results on screen
           • Blind
             • We don't see results on screen but we notice the time to response is longer
         • XSS
           • Cross Site Scripting: The attacker makes the victim’s browser execute a script (mostly JavaScript) that has been injected by the attacker while visiting a trusted web site.
         • CSRF
           • In a Cross-Site Request Forgery attack, a malicious web site tells the victim’s web browser to send a malicious request to an honest site, as if the request were part of the victim’s interaction with the honest web site, making use of the existing victim’s context, such as cookies. So, both attacks have in common that they are client-side attacks and need some action of the end user, such as clicking on a link or visiting a web site. XSS executes a malicious script in your browser, CSRF sends a malicious request on your behalf.
         • Command injection
       • Server config issues
         • Open directory Shares
         • Missing patches
         • Weak credentials
         • Default/old content
       • Authentication issues
         • Weak credentials
         • Auth bypass flaws
           • Example: SQL injection
         • Usernames harvesting
           • When the response to login form is different if the username is correct than when it is not. (Web, source code, time it takes to respond...
       • Data exposure
         • Inside code or accidentally linking to a private document
         • Open directory listings
         • Source code comments
         • Unprotected assets on the cloud.
           • Check Bucket Finder by Robin Wood
       • Session management attacks
         • Predictable session tokens that allows to hijack another user's session. Look for Session variables on Cookies (http headers, browser cookies...) Form fields hidden on source code. Url parameters. You can use Burp Sequencer to try to find if they are predictable. Session fixation. 
     • Standalone exploits
       • http://exploitpack.com https://packetstormsecurity.com/files/tags/exploit https://www.exploit-db.com/ Standalone exploits are often the first available and code can be modified.  They can have been coded by questionable people, so they could have backdoors or infections 
     • MIM and session hijacking
       • Apps: Ettercap (or newer Bettercap) Cain
     • Passwords attacks
       • Password guessing
         • Hydra pw-inspector (custom password-guessing lists)
       • Password dumping
         • Metaexploit meterpreter. Cain pwdump family (3 to 7) and fgdump can try to extract Windows hashes from running memory. http://openwall.com/passwords/windows-pwdump Quarks PwDump can be used to do the same in some Windows versions (Win 7 and some Win 8 platforms) Mimikatz (Also extracts hashes from memory) Probably these tools will fail on new Windows versions. Needed admin credentials on all cases.
       • Password cracking (knowing the hash)
         • Cain,John the Ripper, Hashcat, l0phtcrack7 (Comercial) 
       • Pass the hash
         • Used before to authenticate on some services (like smb) passing the hash (without knowing the password)
       • Precomputing hashes: Rainbow tables
         • Only useful for hashes without salt (So just for LANMAN and NTLM) http://rainbowtables.shmoo.com http://project-rainbowcrack.com
     • Wireless
     • Remote control & Backdoors
       • DNScat easiest remote control backdor, although it is usually detected by endpoint malware apps. VNC can be set up for remote GUI-base access. Available as a metaexploit module. Custom Remote Access Trojans. Powershell tools like Powershell empire and even native Unix sockets like /dev/tcp
     • Social engineering
     • Exploitation frameworks
       • Metasploit includes: Exploits Payloads:      - Stagers: Establish communication channels with target)      - Stages: Leverage communication channel to perform some action       Single: Stage and stagers combined Documentation Tools for exploit creation Multiple user interfaces Other frameworks: Veil framework (Menu driven to generate custom payloads) WinPayloads (custom Payloads) TheFatRat (custom Payloads)
   • Pivoting & Post-explotation
     • Things to consider:
       • Threat vectors
         • What systems are vulnerable from what systems? Are trust relationships and/or access controls too weak from the inside?
       • Time
         • How long does it take to exploit target 1, 2...?
       • Security measures
         • Security measures in place for local hosts.
     • Apps
       • Spider labs responder
         • Useful in a post-exploitation scenario for pivoting and harvesting massive amounts of useful data, hashes, credentials, etc. Speaks Windows protocols in particular.
       • Powershell tools
         • Powershell Empire. Many modules available (Mimikatz, Token manipulation to try to hijack accounts within domains, Keyloggers, Screenshots, Lateral movements/Pivoting) PS>Atack has 110 Powershell attack modules. Easy to find the right module with the commanda Get-Attack and a keyword (like password). Mimikittenz. To grab passwords from memory and web email, RAT, Development tools...). Administrator credentials doesn't needed Magic Unicorn. Downgrades Powershell to version 2 (more insecure than the last ones.
       • Mimikatz and Kiwi in Metasploit
   • Online Recon & Offensive Counterintelligence
     • Gathering info from open sources
       • It must be passively, without being noticed by the target enterprise.
       • Initial info about target
       • Network ranges, Emails, Contact info, Devices and apps used, Public systems/data, Data exposed inadvertentenly
       • Discover services / Access points of entry
       • Recon on employees and related people
       • Look for info useful to exploit people and targets
       • Sources
         • Domain names lookups and zone transfers
         • Newsgroups
         • Search engines
           • https://www.exploit-db.com/google-hacking-database Interesting Google Dorks: site:domain.com Search in the domain only intitle:index.of bash_history intitle:index.of /admin filetype:ini inurl:ws_ftp inurl:printer/main.html intext:settings -ext:mp3 (excludes mp3 extensions) Shodan: Search engine of online systems and apps. Lots of vulnerabilities.
           • Google Dorks
           • Shodan.io
         • Target websites
           • Explore the website to get names, emails, phone numbers... Check also html code: Comments, additional links, metatags... Free tools: ZAP from OWASP Burp free edition wget Look for Metada on public files.
           • Files Metadata
             • Exiftool (Kali) Extracts lots of information from pictures and other data. FOCA: Open source and also extracts lots of info from files metadata.
             • Exiftool (Kali)
             • FOCA
         • Social Media
         • News articles
         • Blogs and wikis
         • Maltego (Kali)
           • Matego (Kali) is a very powerful App that searchs info from people, enterprises and more. Has a 
         • Spiderfoot
           • Similar to Maltego. Available for Windows and Linux
     • Social Engineering
       • Manipulation of people to gain access to data and informations and, as a secondary goal of gaining systems or data access. Social Engineering tool (SET), included in Kali, is a powerful app whicj is menu-driven and easy to use. There are some other commercial phising tools like Cofense PhisMe and Wombat Security
       • Tailgaiting
         • Try to illicity gain entry into facilies by following others or circumventing the access control
       • Phising
         • Sending malicious emails to entice users intu clicking links or opening attachments.
       • Pretexting
         • Calling targets on the phone attemting to convince them to perform some action
       • Media drops (post-drop)
         • Drop a device (USB pendrive usually) with malware in it in order to infect and gain access their internal networks or personal computers.

4. 4. Reporting

   • Probably, the most important phase of the process.
   • Executive Summary
   • Introduction
   • Technical Summary
   • Technical detail (Findings from Low to High Risk)
   • Conclution
   • Appendices
     • Methodology
     • Tool Results