Automated Penetration Testing With Core Impact

Automated Penetration Testing with CORE IMPACT Tom Eston NEO Information Security Forum February 20, 2008

Topics
What makes a good penetration testing framework?
What is CORE IMPACT?
How does it work?
Cool features
Limitations
Live demonstration
Network Side RPT (Rapid Penetration Test)
Client Side RPT

Disclaimer
I am not a paid spokesman for Core Security Technologies
Opinions are from a customer perspective
“ Automated penetration testing does not replace the need for manual, detailed penetration testing!”

What makes a good penetration testing framework?
Platform independent
Install on Windows, Mac, Linux
Good exploit collection w/regular updates
A intuitive, robust GUI
Ability to add new exploits
Open source or ability to customize
Good reporting tools

What frameworks are available?
Metasploit Framework
Inguma
SecurityForest
Attack Tool Kit
Immunity Canvas ($)
CORE IMPACT ($)
Some are application or web specific…
Orasploit (Oracle)
PIRANA (email content filtering framework)
BeEF (Browser Exploitation Framework)
W3af (Web Application Exploit Framework)

What is CORE IMPACT?
Commercial penetration testing framework ($$)
Uses a common pen test methodology
Information Gathering
Attack and Penetration
Privilege Escalation
Clean Up and Reporting
Network, client-side and web (SQL Injection and PHP remote file inclusion) RPT functions
Detailed logging
Easy to use
Safe
Exploits are extensively tested by the CORE IMPACT team
Develop custom modules and exploits (Python)
Pretty reports…

How does it work?
Launch agents and modules against target systems from the console
Agents - Small programs you install on compromised systems and use to advance an attack.
Memory resident! (think Metasploit’s meterpreter)
Level of agents give you additional functionality (pivoting)
Modules - Operations that can be launched against target systems
OS fingerprinting, port scanning, and targeted exploits
View detailed information about target systems
Keeps a record of all activity, module output, and the results of attacks

Cool Features
Pivoting
Use compromised host to attack hosts on internal network
Collect Windows password hashes in-memory
Log keystrokes, sniff passwords and hashes
Collect saved login credentials from popular applications such as Internet Explorer, Firefox and MSN
Install agents with valid username, password, hash combinations
MSRPC fragmentation and traffic encryption
Test IDS/IPS defenses

Limitations
Importing external vulnerability data
Nessus, Qualys, etc…
Slow and buggy at times
Console sometimes unstable
Crash will cause agents to disconnect
Know Python?
Expensive!

Live Demonstration
Lab Setup
VMware Server, CORE IMPACT Console
4 Windows Systems, 1 Linux
Network Side Rapid Penetration Test
Information Gathering
Attack and Penetration w/multiple exploits
Clean Up
Client Side Rapid Penetration Test
Phishing simulation
Windows XP target running Outlook Express
Microsoft WMF Exploit

Questions
[email_address]
CORE IMPACT from Core Security Technologies http://www.coresecurity.com/

Automated Penetration Testing With Core Impact

by Tom Eston on Dec 01, 2008

Accessibility

Categories

Tags

Upload Details

Usage Rights

2 Embeds 14

Statistics

Automated Penetration Testing With Core Impact — Presentation Transcript

http://www.slideshare.net	12
http://babajung.blogspot.com	2