Jsky User Guide
Upcoming SlideShare
Loading in...5
×
 

Jsky User Guide

on

  • 1,696 views

NOSEC JSky is another product produced by NOSEC who build Pangolin. It helps you test for the latest vulnerabilities in current Web technologies so that you can find security problems in your ...

NOSEC JSky is another product produced by NOSEC who build Pangolin. It helps you test for the latest vulnerabilities in current Web technologies so that you can find security problems in your applications before the hackers do.NOSEC JSky is a website security testing tool that automates vulnerability assessments. Support all Web application technologies – including ASP, ASP, NET,Java, PHP, JavaScript, Flash, Ajax. Jsky is a fast scanner which covers all Web application vulnerabilities including SQL-Injection and Cross-Site Scripting, WASC TC 2, OWASP TOP 10 compliance. JSky lack the intelligence required to scan the complexities of today's interactive Web 2.0 applications.

Statistics

Views

Total Views
1,696
Views on SlideShare
1,692
Embed Views
4

Actions

Likes
0
Downloads
7
Comments
0

3 Embeds 4

http://www.slashdocs.com 2
http://www.slideshare.net 1
http://www.docseek.net 1

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Jsky User Guide Jsky User Guide Document Transcript

  • NOSEC JSky v3.5.1User GuideDocument Release Date: Jan 2011Software Release Date: Jan 2011
  • Legal NoticesWarrantyThe only warranties for NOSEC products and services are set forth in the express warrantystatements accompanying such products and services. Nothing herein should be construed asconstituting an additional warranty. NOSEC shall not be liable for technical or editorial errors oromissions contained herein. The information contained herein is subject to change without notice.Copyright Notice© Copyright 2006-2011 NOSECTrademark AcknowledgementsMicrosoft and Windows are U.S. registered trademarks of Microsoft Corporation. Windows Vista iseither a registered trademark or trademark of Microsoft Corporation in the United States and/orother countries. Adobe and Acrobat are trademarks of Adobe Systems Incorporated.Other AcknowledgementsRedistributions of source code must retain the above copyright notice, this list of conditions and thefollowing disclaimer:THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ANDCONTRIBUTORS "AS IS"AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR APARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHTOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOTLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ONANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THEUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCHDAMAGE.Redistributions in binary form must reproduce the above copyright notice, this list of conditions andthe disclaimer in the documentation and/or other materials provided with the distribution. 2
  • Neither the name of the organization nor the names of its contributors may be used to endorse orpromote products derived from this software without specific prior written permission.SupportFor information or assistance regarding JSky, contact customer support:E-mail: support@nosec.orgTelephone: +86 133-168-80733 3
  • I. Content I. Content ........................................................................................................................................ 4 II. Getting Started............................................................................................................................ 6 Software Installation ................................................................................................................. 6 Licensing..................................................................................................................................... 7 III. Using the JSky .................................................................................................................... 9 Introduction ............................................................................................................................... 9 Site Navigation Panel ...................................................................................................... 9 Vulnerability Navigation Panel ....................................................................................10 Summary Panel ...............................................................................................................11 Information Panel ..........................................................................................................11 Message/Log Panel .......................................................................................................13 JSky Menu Bar ................................................................................................................14 JSky Tool Bar..................................................................................................................16 Scanning Your Website ..........................................................................................................17 Starting a Scan ................................................................................................................17 Authentication .........................................................................................................................23 IV. Analyzing the Scan Results ............................................................................................24 Introduction ....................................................................................................................24 Shortcut menu command .............................................................................................24 V. Report ........................................................................................................................................26 4
  • Report Template ............................................................................................................26 Page ..................................................................................................................................27 Generate report ..............................................................................................................27VI. Troubleshooting ..............................................................................................................28 Features ...........................................................................................................................28 Request Support .............................................................................................................28HTTP Status Codes .........................................................................................................................29 5
  • II. Getting StartedSoftware InstallationBefore installing JSky make sure that your system meets the following minimum requirements: 1 GB of memory 2 GB of free disk space 1600 GHz Processor or better Microsoft Internet Explorer 6.0 Windows 2000/Windows XP/Windows Vista 32bit/ Windows Vista 64bit /Windows 7 32bit/Windows 7 64bit Use the following procedure to install JSky.1. Start the installation program.2. Choose setup language “English”. On the Welcome page, click Next. 6
  • 3. Review the license agreement. If you accept, select the check box and click Next; otherwise click Cancel.4. On the Destination Folder window, select the folder into which you want to install the software and click Next.5. Click Next until you see Ready to InstallThe Ready to Install Windows appears6. On the Ready to Install window, click Install.7. When the process is complete, click Finish.LicensingThe first time you start JSky, the program displays the JSky ProductRegistration Wizard, which prompts you to select one of the following options: Register for a 15-day trial 7
  •  Use an existing activation tokenTrial RegistrationUse the following procedure to begin a free 5-day trial of JSky.1. On the JSky Tool Bar, Click License Manager. You will be link to NOSEC License Management Center.2. Following steps and enter the target website (Url) and other requested information.3. License Management Center will access target website to complete generate key.4. Click Apply Key. Now you have finished Trial Registration.Important NoticeCreate a BackupBefore assess production system, create a backup copy of their database and then restore itafter the assessment is complete.Delete Uploaded FilesFinally, JSky tests for certain vulnerabilities by attempting to upload files to your server. Ifyour server allows this, JSky will record this susceptibility in its scan report and attempt todelete the file. Sometimes, however, the server will not allow a file to be deleted. For thisreason, part of your post-scan maintenance should include searching for and deleting fileswhose name begins with “jsky.” 8
  • III. Using the JSkyIntroductionJSky work area is divided into following regions:Site Navigation PanelWhen conducting or viewing a scan, the navigation pane is on the left side of the JSky window. 9
  • Right-clicking an item displays a shortcut menu with the commands described in the following table.Table 1 Site Navigation Panel CommandsCommand DefinitionExpand All Expands all branching nodes in the site tree.Collapse All Contracts all branching nodes into the superior node.Browse this URL Browse the URL in a Web browser.Copy URL Copies the URL of the selected item to the clipboard.Vulnerability Navigation PanelDuring the scan, a list of alerts which are found while scanning the website starts being populated. 10
  • Summary PanelThe panel displays a real-time summary of the scan results with severity level.Information PanelDisplays a description of the current vulnerability, advice, provides extensive detailed informationabout the vulnerability in question and some reference about current vulnerability. Also, displayssensitive information of Web server. 11
  • This panel has two tabs. Session Info CommunicationSession InfoMore detailed information will be shown including:Vulnerability description - A description of the current vulnerability.Vulnerability Impact - What impact can this vulnerability have on the website or web server.Vulnerability Recommendation - This section provides a recommendation on how the problemcan be fixed.Additional Info - Sensitive information on Web server was exploited.Vulnerability content - Sensitive information when hacker takes advantage of this vulnerability.Reference - A list of web links from where more information could be gathered about the currentvulnerability and how to fix it.Communication 12
  • Display the server‟s raw HTTP response to JSky‟s request. This contains two sections: JSky Requestand Web server response.Message/Log PanelBy viewing this panel you can get information about your JSky assessment action. For instance, thetime at which certain audit methodologies are applied against your Web presence will be listed here. 13
  • JSky Menu BarThe menu bar contains the following menus: • File • Scan • Edit • Tools • View • Advanced • HelpFile MenuNew Scan - Launches the Scan Wizard, which steps you through the process of starting a scan.Open Scan - Open a scan file.Save Scan - After scan completed, you can save results to .save file.Report - Generate scan report after scan completed.Authentication - Enforce login session before user run JSky. Please read “Authentication” fordetails.Exit - Closes the JSky program.Scan MenuStart - Starts or resumes a scan after you pause the process.Pause - Suspend a crawl or audit. Click Scan to continue the scan. 14
  • Stop- Stop a scan.Restart Test - Restart scan with current settings.Configuration MenuLanguage - Modify JSky GUI language settings.Scan setting - Displays the Scan Settings window, allowing you to modify options used forscanning.Scanning Profile - Displays the Scanning Profile Setting window, allowing you to modify policyused for scanningPreference - Modify preference for assessment.View MenuTree View - Configure Site Navigation Panel show site structure with file name or file title.Progress Trace - Show detailed information when crawling and auditing.Advanced MenuFrom Watcher - Display all forms web application.External Links - Display external links or scripts.HTML Comments - Display HTML contents which are hidden.Help MenuHelp - Opens help file.Show Plugins - Show JSky Plugins.License - Show license information. 15
  • Update - Start an update check.About - Displays information about the JSky application.JSky Tool BarTable 2 Tool bar Button and FunctionsButton Function Launches the Scan Wizard, which steps you through the process of starting a scan. Open a scan file. After scan completed, you can save results to .save file. Generate scan report after scan completed. Enforce authorization before user run JSky. Please read “Authentication” for details. Closes the JSky program. Start or resume a scan after you pause the process. Suspend a crawl or audit. Click Scan to continue the scan. Stop a scan. Modify JSky GUI language settings. 16
  • Displays the Scan Settings window, allowing you to modify options used for scanning. Displays the Scanning Profile Setting window, allowing you to modify policy used for scanning. Displays the Preference Manager window, allowing you to modify settings used for scanning. Opens help file. Show license information. Displays information about the JSky application. Display all forms web application. Display external links or scripts. Display HTML contents which are hidden.Scanning Your WebsiteStarting a ScanThe Scan Wizard allows you to quickly set-up an automated crawl and scan of your website. Anautomated scan provides a comprehensive and deep understanding of the level website securityby simply reviewing the individual alerts returned. This chapter explains the process of launchinga security audit of your website through the Scan wizard. 17
  • NOTE: DO NOT SCAN A WEBSITE WITHOUT AUTHORISATION!If you are not the sole administrator of the website please make sure to warn otheradministrators before performing a scan. Some scans might cause a website to crash requiring arestart of the website.Step 1: ScanClick on „File > New Scan‟ to start the Scan Wizard or click „New Scan‟ button on the tool bar toopen JSky Scan Wizard.Url - Target website url.Load Scan List - Load t a plain text file which contains a list of target websites specified.Scan Range - This will scan a specific range of IPs (e.g.192.168.0.1-254) for target sites whichare open on the specified portsNeighbours - You can search other domain names on the machine which a specified domainhosted. This function is very useful for Web hosting providers. 18
  • Additional Domains - Specify domain to be excluded or included.NotesAny changes you make will be used for this scan only. You can click “Save configurationas DEFAULT” to save current settings.Scan Multiple Websites simultaneouslyYou can do this with one of following: Separate multiple website with space and fill to Url. For example: “http://www.exapmple.com http://www.site.com” Put a list of target websites specified in a plain text file (one target per line). Then click “Load Scan List” to load the text file.Step 2: Spider OptionThe spider traverses the entire website and identifies its structure. The following crawling optionsmay be configured: 19
  • Crawler threads - The default thread count setting is 8. In some environments, you may need tospecify a lower number to avoid crashing the Web application or your server.Crawler direction - Define spider crawl direction. Default is “Can go down”.Urls are case sensitive - Some website treat upper case Url and lower case Url not the same.For example: Apaches runs on Linux.Parse Java Classes - JSky will parse Java Classes to read Url and crawl these Urls.Extract urls from java script - Crawl Urls which will generate by Java Script also.Extract urls from Flash - Crawl Urls in Flash.Crawl all links of site - Default is not checked. JSky will analyze Url and ignore Urls with sameformat.Follow robots.txt - Default is not checked. JSky will not crawl Url which robots.txt defined notallowed if checked. 20
  • URL Filter - Specify Urls to be excluded or included.MIME Filter - Specify MIME type to be excluded or included.File Type Filter - Specify file type to be excluded. For example: zip file.Limits - Specify crawl depth limit , file size limit, transfer rate limit.Step 3: Scanning ProfileThe Scanning Profile will determine which tests are to be carried out against the target site. Forexample, if you only want to test your website(s) for SQL injection, select the profile “SQLInjection” and no additional tests would be performed. You can create customized profile byclick “Edit Profile”.Scan modeCrawl and then audit - Crawl the entire site and then conducting an audit.Crawl and then audit - When JSky maps the Websites structure, it audits each Url. 21
  • Crawl only - This option completely maps a site‟s tree structure. AfterEdit Form Value - A generic submit form rule which will submit generic details to any kind ofweb form it might encounter during scanning.Custom values that are sent to HTML forms on websites are configured. These values will besubmitted by the Scanner during an automated scan when accessing certain parts of the websiteswhich are only accessible when a specific input is given such as a download links page which isonly accessible if a valid email address is submitted to the form.Edit Custom error pages - With customized 404 error page, JSky will be able to identify thesepages to detect the difference between a non existing URL and a valid web page. You mustconfigure this if websites show a page formatted according to the look and feel of the websiteto inform the user that the page requested does not exist.Step 4: Other ConfigurationSpecify user agent, session, network parameters. 22
  • User Agent - Define user agent header string JSky should use when accessing a target website.Pre-load session - If URL required login to access. Use this feature to login the page then startcrawl and audit.Network configuration - Displays Connection window. There are two tabs. Authentication and SSL. Support NTLM, HTTP authentication. And support SSL with CA, private key. Proxy and Network. Allow you to configure proxy to access the target website.Step 5: Starting a scanAfter click “Finish” on scan wizard window JSky is ready to start scan. Click “Start”. Dependingon the size of the website a scan may take several hours.AuthenticationTo allow only authorized user can scan websites we developed this function. AuthenticationWindow appears after click “File”->“Authentication” from Menu Bar or click “Authentication”from the Tool Bar. Check “Active Authentication” and input the default Old Password “admin”.Set new password in “New Password” and reenter new password in “Retry Password”. Click“Ok” your new password have been set. 23
  • IV. Analyzing the Scan ResultsIntroductionA list of vulnerabilities which are found while scanning the website starts being populated. Thelist of vulnerabilities can be seen in the Vulnerability Navigation Panel. „Site Structure‟ is alsopopulated with a list of files and folders can be seen in Site Navigation Panel.The severity of vulnerabilities is indicated by the following icons. High Medium Low InfoThe Vulnerability Navigation Panel displays the issues relevant to the node selected in the SiteNavigation Panel. Issues are grouped by threat type. Under each type, all URLs are listed. Eachnode in the tree has a severity icon, indicating issue severity; and a counter, indicating how manyissues of this type were found. In the case of Type and URL, the severity icon indicates theseverity of the most severe issue included under the node.You can change the way the issues are sorted by click “Vulnerabilities” or “Total” on the top ofVulnerability Navigation Panel.Shortcut menu commandRight-clicking a item displays a shortcut menu with the commands described in the followingtable.Table 3 Vulnerability Navigation Panel CommandsCommand DefinitionExpand All Expands all branching nodes in the site tree.Collapse All Contracts all branching nodes into the superior 24
  • node.Copy URL Copies the URL of the selected item to the clipboardPen-test this vulnerability Use JSky Penetration testing tools to test this vulnerabilityBrowse this URL Browse the URL in JSky browse module.Browse this URL at Browser Browse the URL in a Web browser.Change severity You can change the severity assigned to any node by right-clicking on the node and selecting Severity, and select a new severity level. You can change severity to High, Medium, Low, Info or False Positive. 25
  • V. ReportAfter JSky has assessed your site‟s vulnerability, you can generate customized reports configuredfor the various personnel in your organization. The report provides the ability to generate severaltypes or reports. You can open and view the reports from within JSky, and you can save a reportas a file to be opened with a third-party application. JSky support DOC, PDF, HTML and XMLformat report.Report TemplateThe Reporter offers the functionality for creating different type of reports. The packagedtemplates allow you to launch the specific wizard for a selected report-style, and to quicklypresent your scan results into the desired format. And you can filter severity level of vulnerabilityto be export to report by selecting “Severity level above”.DeveloperThe developer report contains scan results with http communication. This creates an easyworkflow for the developer to quickly identify and resolve vulnerabilities detected on the site.Executive SummaryThe executive report creates a summary of the total number of exploits in every vulnerabilityclass. This makes it ideal for management to review the results without needing to includeunnecessary technical detailing.DetailedIncluding all information of scanned hosts info, test policy, security risk, vulnerable URLs whichinclude all info above. 26
  • PageYou can customize Report title, Description, Company logo and Your Logo to match yourneeds.Generate reportClick “Preview Report” to preview or “Save” to save report to file. 27
  • VI. TroubleshootingFeaturesJSky provides following ways you can use to more efficiently locate and solve problems.Message/Log PanelBy viewing this panel you can get information about your JSky assessment action. If JSkyencountered error, message will show here. You can right click the panel and select “Select All”then another right click and select “Copy”. Paste the log inside Message/Log Panel into a text file.Save it to “message-log.txt”.Bug Report fileIn the event of it crashing JSky create “bugreport.txt” in JSky installation directory. You shouldsend this file to JSky support team for further investigation.Log file“debug.log” and “error.log” will be created in JSky installation directory about JSky functionalitywhen error happens.Request SupportIf you have problems that you cannot resolve, please contact the NOSEC support department byEmail at support@nosec.org. Please attach “message-log.txt, “bugreport.txt”, “debug.log” and“error.log” to enable us to solve the issues you have more quickly. 28
  • HTTP Status CodesIntroductionThe following list of status codes was extracted from the Hypertext Transfer Protocol version1.1 standard (rfc 2616). You can view the complete standard at http://www.w3.org/Protocols/rfc2616/rfc2616.html.Table 4: HTTP Status CodesStatus Reason Phrase DescriptionCode100 Continue Client should continue sending its request. This is a special status code; see below for details.101 Switching Protocols The client has used the Upgrade header to request the use of an alternative protocol and the server has agreed.200 OK Generic successful request message response. This is the code sent most often when a request is filled normally.201 Created The request was successful and resulted in a resource being created. This would be a typical response to a PUT method.202 Accepted The request was accepted by the server but has not yet been processed. This is an intentionally “non-commital” response that does not tell the client whether or not the request will be carried out; the client determines the eventual disposition of the request in some unspecified way. It is used only in special circumstances.203 Non-Authoritative The request was successful, but some of the information Information returned by the server came not from the original server 29
  • associated with the resource but from a third party.204 No Content The request was successful, but the server has determined that it does not need to return to the client an entity body.205 Reset Content The request was successful; the server is telling the client that it should reset the document from which the request was generated so that a duplicate request is not sent. This code is intended for use with forms.206 Partial Content The server has successfully fulfilled a partial GET request. See the topic on methods for more details on this, as well as the description of the Range header.300 Multiple Choices The resource is represented in more than one way on the server. The server is returning information describing these representations, so the client can pick the most appropriate one, a process called agent-driven negotiation.301 Moved Permanently The resource requested has been moved to a new URL permanently. Any future requests for this resource should use the new URL. This is the proper method of handling situations where a file on a server is renamed or moved to a new directory. Most people dont bother setting this up, which is why URLs “break” so often, resulting in 404 errors as discussed below.302 Found The resource requested is temporarily using a different URL. The client should continue to use the original URL. See code 307.303 See Other The response for the request can be found at a different URL, which the server specifies. The client must do a fresh GET on that URL to see the results of the prior request. 30
  • 304 Not Modified The client sent a conditional GET request, but the resource has not been modified since the specified date/time, so the server has not sent it.305 Use Proxy To access the requested resource, the client must use a proxy, whose URL is given by the server in its response.306 (unused) Defined in an earlier (draft?) version of HTTP and no longer used.307 Temporary Redirect The resource is temporarily located at a different URL than the one the client specified. Note that 302 and 307 are basically the same status code. 307 was created to clear up some confusion related to 302 that occurred in earlier versions of HTTP (which Id rather not get into!)400 Bad Request Server says, “huh?”  Generic response when the request cannot be understood or carried out due to a problem on the clients end.401 Unauthorized The client is not authorized to access the resource. Often returned if an attempt is made to access a resource protected by a password or some other means without the appropriate credentials.402 Payment Required This is reserved for future use. Its mere presence in the HTTP standard has caused a lot of people to scratch their chins and go “hmm…” 403 Forbidden The request has been disallowed by the server. This is a generic “no way” response that is not related to authorization. For example, if the maintainer of Web site blocks access to it from a particular client, any requests from that client will result in a 403 31
  • reply.404 Not Found The most common HTTP error message, returned when the server cannot locate the requested resource. Usually occurs due to either the server having moved/removed the resource, or the client giving an invalid URL (misspellings being the most common cause.)405 Method Not The requested method is not allowed for the specified resource. Allowed The response includes an Allow header that indicates what methods the server will permit.406 Not Acceptable The client sent a request that specifies limitations that the server cannot meet for the specified resource. This error may occur if an overly-restrictive list of conditions is placed into a request such that the server cannot return any part of the resource.407 Proxy Similar to 401, but the client must first authenticate itself with Authentication the proxy. Required408 Request Timeout The server was expecting the client to send a request within a particular time frame and the client didnt send it.409 Conflict The request could not be filled because of a conflict of some sort related to the resource. This most often occurs in response to a PUT method, such as if one user tries to PUT a resource that another user has open for editing, for example.410 Gone The resource is no longer available at the server, which does not know its new URL. This is a more specific version of the 404 code that is used only if the server knows that the resource was intentionally removed. It is seen rarely (if ever) compared to 404. 32
  • 411 Length Required The request requires a Content-Length header field and one was not included.412 Precondition Failed Indicates that the client specified a precondition in its request, such as the use of an If-Match header, which evaluated to a false value. This indicates that the condition was not satisfied so the request is not being filled. This is used by clients in special cases to ensure that they do not accidentally receive the wrong resource.413 Request Entity Too The server has refused to fulfill the request because the entity Large that the client is requesting is too large.414 Request-URI Too The server has refused to fulfill the request because the URL Long specified is longer than the server can process. This rarely occurs with properly-formed URLs but may be seen if clients try to send gibberish to the server.415 Unsupported Media The request cannot be processed because it contains an entity Type using a media type the server does not support.416 Requested Range The client included a Range header specifying a range of values Not Satisfiable that is not valid for the resource. An example might be requesting bytes 3,000 through 4,000 of a 2,400-byte file.417 Expectation Failed The request included an Expect header that could not be satisfied by the server.500 Internal Server Generic error message indicating that the request could not be Error fulfilled due to a server problem.501 Not Implemented The server does not know how to carry out the request, so it cannot satisfy it.502 Bad Gateway The server, while acting as a gateway or proxy, received an invalid response from another server it tried to access on the 33
  • clients behalf.503 Service Unavailable The server is temporarily unable to fulfill the request for internal reasons. This is often returned when a server is overloaded or down for maintenance.504 Gateway Timeout The server, while acting as a gateway or proxy, timed out while waiting for a response from another server it tried to access on the clients behalf.505 HTTP Version Not The request used a version of HTTP that the server does not Supported understand. 34