Penetration Testing Anand Sudula, CISA,CISSP SSA Global Technologies, India Anand Sudula, CISA,CISSP SSA Global Technologies, India

Before We Start  My Introduction.  Audience Type.  Expectations from this presentation.  Disclaimer.  Not a professional Tester  Based on my learning, Understanding.

Agenda  Background.  What is Penetration Testing.  Need for Penetration Testing.  Methods and Techniques of Pen Test.  Demo.  Tiger tools.  MetaSploit.  ExploitTree  Whopix.  ERD Commander(local Password Craking).  Questions.  Resources.

Background What is Penetration Testing  A form of stress testing, which exposes weaknesses or flaws in a computer system.  Art of finding an open door.  A valued assurance assessment tool.  PT can be used to find Flaws in  Policies  Specifications  Architecture,  Implementation,  Software,  Hardware,  And many more ………………

Background Need for Penetration Testing  To find poorly configured machines.  Verify that security mechanisms are working.  Help organizations to tighten the Security system. FACT!!!! 99.9% secure = 100%vulnerable !

Methods and Techniques of Pen Test.  Black Box  zero-knowledge testing  Tester need to acquire the knowledge and penetrate.  Acquire knowledge using tools or Social Engineering techniques  Publicly available information may be given to the penetration tester, Benefits: Black box testing is intended to closely replicate the attack made by an outsider without any information of the system. This kind of testing will give an insight of the robustness of the security when under attack by script kiddies

Methods and Techniques of Pen Test. White Box  complete-knowledge testing  Testers are given full information about the target system they are supposed to attack.  Information includes,  Technology overviews,  Data flow diagrams  Code snippets  More….. Benefits:  reveals more vulnerabilities and may be faster.  compared to replicate an attack from a criminal hacker that knows the company infrastructure very well. This hacker may be an employee of the company itself, doing an internal attack

Methods and Techniques of Pen Test. Gray-box or crystal-box test The tester simulates an inside employee. The tester is given an account on the internal network and standard access to the network. This test assesses internal threats from employees within the company.

Methodology of Penetration Testing. There are NO formal methods of Penetration testing!!!!!!!!  Typically has Seven Stages  Scope/Goal Definition  Information Gathering  Vulnerability Detection  Information Analysis and Planning.  Attack& Penetration/Privilege Escalation.  Result Analysis & Reporting.  Cleanup. REPEAT

Methodology of Penetration Testing. STAGE 1: Scope/Goal Definition  Which attacker profile the tester will use  Hacker with no knowledge about the target.  Hacker with knowledge about the target.  Internal user with access.  Which systems or networks the test will be conducted.  How long will the test last.

Methodology of Penetration Testing. STAGE 2: Information Gathering.  Information about the Targets.  Publicly available information( nslookup)  Technical Information provided by organisation.

Methodology of Penetration Testing. STAGE 3: Vulnerability Detection.  Manual Detection  manually probe the target host for common misconfigurations or flaws because a vulnerability scanner can fail to identify certain vulnerabilities.  Ex: database configurations etc….  Using Software.  Use of commercial or Freeware Scanners to enumerate known flaws or vulnerabilities, Ex: Retina,Hfnectcheck, GFI Languard, Nikito, nmap so on. PLENTY TOOLS available in Market/Internet.

Methodology of Penetration Testing. STAGE 4: Information Analysis and Planning.  Collating the information gathered in previous stages.  Preparation of High level attack planning  Overall Approach  Target identification.

Methodology of Penetration Testing. STAGE 5: Attack & Penetration/Privilege Escalation. Has Two Sub Stages  I. Attack & Penetration  Known/available exploit selection  Tester acquires publicly available s/w for exploiting.  Exploit customization  Customize exploit s/w program to work as desired.  Exploit development  Develop own exploit if no exploit program available.  Exploit testing  Exploit must be tested before formal Test to avoid damage.  Attack.  Use of exploit to again unauthorized access to target

Methodology of Penetration Testing. STAGE 5: Attack & Penetration/Privilege Escalation.  II. Privilege Escalation  What can be done with acquired access/privileges.  Alter.  Damage.  What not …… Repeat the Stages (2 to 5)

Methodology of Penetration Testing. STAGE 6:Result Analysis & Reporting Organize Data/related results for Management Reporting.  Consolidation of Information gathered.  Analysis and Extraction of General conclusions.  Recommendations.

Methodology of Penetration Testing. STAGE 7:Cleanup Cleaning of all that has been done during the testing  Any System alterations  Exploits

Resources.  Guidelines  OSSTMM : The Open Source Security Testing Methodology Manual.  OWASP : Open Web Application Security Project.  Tools  NMAP,Nikito,John,CAIN&able and many more………….  Whopix  Tigertools (Commercial Tool)  Metasploit.  ExploitTree.  Core Impact (Commercial Tool)

Metasploit Framework

ExploitTree Framework

MilWorm

Demos  DCOM vulnerability using ExploitTree.  Password Cracker –Tiger Tools.  WHOPIX.  Security Auditor.  Pasword Craking (Raptor Chown-Recorded Demo).  ExploitTree.  MetaSploit.

Questions Questions?.