Penetration Testing: Concepts,Attacks and Defence Stratagies WELCOME Penetration Testing: Concepts,Attacks and Defence Stratagies Presented by: ADARSH.S S7-C For Educational Purpose

Part one: the concept of penetration testing 2

What is a penetration test?(informal) Port scanning Vulnerability Scanning Penetration Testing 3

Why conduct a penetration test? Prevent data breach Test your security controls Ensure system security Discover new bugs in existing software 4

Why conduct a penetration test? Prevent data breach Test your security controls Ensure system security Discover new bugs in existing software 5

Steps of penetration test Step 1: Introduction and Objectives Step 2:Information gathering Step 3:Vulnerability analysis Step 4:Simulation (Penetrate the system to provide the proof) Step 5:Risk assessment Step 6:Recommendations for reduction or recovery and providing the report 10

Penetration Testing Operating Systems Linux Destro Contain a pre-packaged and pre-configured set of tools Open source license 7

Kali Linux Linux Destro for forensics 600 Penetration testing tools. Wide range of wireless devices Includes almost all security flaws in machines 8

The EXPLOIT The basic steps for exploiting a system using the Framework include: Choosing and configuring an exploit; Optionally checking whether the intended target system is susceptible to the chosen exploit; Choosing the encoding technique so that the intrusion-prevention system (IPS) ignores the encoded payload; Executing the exploit. 7

ATTACKS HACKED ANDROID HACKING USING METASPLOIT MAN IN THE MIDDLE ATTACK HACKED

ANDROID HACK USING METASPLOIT → Computer security project → Provides information about security vulnerabilities and aids in penetration testing. → Contains 1517 exploits and 437 payloads. → Quick updates of recent exploits.

HOW TO HACK Step 1:Create the Payload Step 2: Transfer the apk

HOW TO HACK Step 3: Load metasploit console(msfconsole)

HOW TO HACK Exploit name: multi/handler. Step 4: Identify the exploit and launch the attack Exploit name: multi/handler. 14

Explaining The Attack Creates a listener (meterpreter) Makes a handler to handle the incoming requests(multi-handler) Exploit command the final word. Android Services like camera,contacts,voice recorder gets compromised. 15

DEFENSE STRATEGIES ANDROID METASPLOIT: Verify Permissions of each apps. Get Updated. Do not enter into public Wifi. Do not install apps from unknown sources. 16

MAN IN THE MIDDLE ATTACK attacker secretly relays and possibly alters the communication between two parties Terminology Ettercap: ec_uid/ec_gid: ARP(Address Resolution Protocol) Driftnet: Network Interface: 17

HOW TO ATTACK Step1:Change the configration file of Ettercap.

HOW TO ATTACK Step2:Packet Capturing and Sniffing. Identifying Interfaces: (wlan0/eth0) Scanning for hosts. Selecting Targets: Start Sniffing: 19

Capturing Image/Audio Data Packets  DRIFTNET : a program which listens to network traffic and picks out images/audio data from TCP streams it observes. Only runs in root privilege Command: sudo driftnet -i wlan0 20

DEFENSE STRATEGIES MAN IN THE MIDDLE ATTACK(ARP Spoofing). Method 1: Protect the ARP mapping table:(static ip) 21

DEFENSE STRATEGIES When an attacker performs an ARP MITM attack, computer sends an ARP packet to the victim’s machine telling it that his MAC address is the router. Attacker will spoof the victim with false MAC id. Only strategie is to use a static physical address. Use Virtual Private Networks: mode of transmission and data is also encrypted. even if your network is compromised by ARP spoofing,decryption is impossible. 22

References: [1] http://en.wikipedia.org/wiki/White_hat_%28computer_security%29 [2] https://community.rapid7.com/docs/DOC-2248 [3] http://searchsoftwarequality.techtarget.com/definition/penetration-testing [4] http://en.wikipedia.org/wiki/Penetration_test [5] https://www.securitymetrics.com/pentest_steps.adp [6] http://www.kali.org/ [7] http://en.wikipedia.org/wiki/Kali_Linux [8] https://www.paterva.com/web6/ [9] http://en.wikipedia.org/wiki/Whois [10] https://subgraph.com/vega/ [11] http://www.youtube.com/watch?v=plitHS8Tqdo 23

THANK YOU

25