Download to read offline
pentest
- 1. ANATOMY OF APENTEST: PROACTIVE STEPS TO ADDRESS VULNERABILITIES IN YOUR NETWORK Presenter: Robbie Corley Robbie.Corley@KCTCS.EDU Organization: KCTCS Senior Information Security Analyst
- 2. Personal Life /Interests • Married • Bachelor’s in Music Business??? • Favorite Show: Seinfeld • Favorite Movie(s): Lord of the Rings / Hobbit Trilogy • Favorite Aspects of IT Security: • Reverse Engineering / Studying Shellcode • Finding and Exploiting Software Vulnerabilties ABOUT ME
- 3. What is apentest? • A pentest is a simulated attack against a system to prove or disprove the existence of vulnerabilities previously detected by a vulnerability scan. How does it work? • You are the attacker: • You will use exploits custom tailored to target specific flagged vulnerabilities from your previous vulnerability scan LET’S TALK ABOUT PENTESTING
- 4. Some history onPentesting… • Pentesting originally required manually compiling each individual exploit to test a vulnerability, all of which were usually coded in different programming languages and specific to OS builds (XP sp1, XP sp2, etc) What’s the advantage over a Vulnerability Scan and why conduct one? • A Vulnerability Scan merely lays out the foundation for your network risk assessment • A Pentest helps you fortify your network by discovering and patching security holes before the attackers do and keeps your auditors happy, which also keeps your boss happy • Pentesting “weeds out” false positives from a Vulnerability Scan while also validating vulnerabilities LET’S TALK ABOUT PENTESTING
- 5. • Our Goal:To Scan and Validate vulnerabilities in a simulated environment to demonstrate the effectiveness of a Pentest • Recommended Vendor: Rapid7 (Approved PCI scan vendor an added plus) • Other recommendations: Tenable Nessus • Open Source: OpenVAS • Why Rapid7? • Exploits are pre-compiled and you do not need to go online to search for them. Readily available, built into the software • Scanner and Pentesting software both free to try • Software Resources Used: • Nexpose Vulnerability Scan Solution • Metasploit Pentesting Solution CONDUCTING YOUR FIRST PENTEST
- 6. • Breakdown: Yourboss has requested a blind vulnerability/pentest assessment for your HVAC network • Attack Vectors used: Client Side and Web • A Blind Scan? • A blind scan/pentest is when you scan/pentest a network without using known credentials. This helps to mimic a realistic cyber attack scenario •HVAC Network Layout: • HVAC A: Windows XP for server HVAC software: • 192.168.56.101 • HVAC B: Linux Web Server for HVAC Web Services • 192.168.56.102 HVAC SYSTEM SCAN & PENTEST SIMULATION
- 7. HVAC SERVER A:SCAN SIMULATION Vulnerability Scan Results using HVAC A: IP: 192.168.56.101 OS: Windows XP HVAC CONSOLE SERVER
- 8. HVAC SERVER A:PENTEST SIMULATION Pentest Live Demo using HVAC A: IP: 192.168.56.101 OS: Windows XP HVAC CONSOLE SERVER
- 9. HVAC SERVER B:SCAN SIMULATION Vulnerability Scan Results using HVAC B: IP: 192.168.56.102 OS: Linux HVAC WEB SERVER Shellshock!!!!!!
- 10. HVAC SERVER B:PENTEST SIMULATION Pentest Live Demo using HVAC B: IP: 192.168.56.102 OS: Linux HVAC WEB SERVER
- 11. PENTEST SHELL COMMANDSUSED Commands used for future reference: To pull up web console, type : Alt +Tilde “~”, then… • “use exploit/multi/http/apache_mod_cgi_bash_env_exec” • “set RHOST 192.168.56.102” (our victim box ip address) • “set TARGETURI /cgi-bin/status” (path to vulnerable cgi-script) • “set PAYLOAD linux/x86/meterpreter/bind_tcp” (exploit module) • “run” Once in the compromised victim’s machine session, you can open a shell by simply typing “shell”. You will then be greeted with a linux shell
- 12. • Why haveUser Awareness Training? • Users can be more mindful of simple operations that can effectively help keep their documents and data safe • We simply cannot monitor all of our users’ actions • Hacker’s are keen on well structured network security, and seek out easier pathways of entry, i.e.: A phishing email directed to an unsuspecting, un-training user • On a personal note: Training gives our users a boost of confidence, knowing they are collectively making a difference in keeping themselves and the company more secure USER AWARENESS TRAINING PENTESTING USING SOCIAL ENGINEERING MODULES
- 13. • How doesit work? • Phishing Modules use pre-made email templates that resemble common Phishing emails in the wild • Emails can be tailored to re-direct users to informative phishing awareness videos upon the user interacting with a phishing email • What tools do I need? • Easiest solution and what we will be using: SPTOOLKIT • SPTOOLKIT is Opensource and requires little effort to setup • Rapid7’s Metasploit Pentesting Software also includes a Social Engineering module with a pro license USER AWARENESS TRAINING PENTESTING USING SOCIAL ENGINEERING PHISHING MODULES
- 14. • Demo time! •Link: https://github.com/sptoolkit/sptoolkit • Requirements: • SMTP server • Any Linux OS box with Apache and MySQL installed • Recommended approach: Install Kali Linux which has Apache and MySql installed and enabled by default • http://www.kali.org/downloads/ • Commands to start MYSQL and Apache: • Service apache2 start • Service mysql start USER AWARENESS TRAINING PHISHING AROUND WITH SPTOOLKIT
- 15. USER AWARENESS TRAINING PHISHINGAROUND WITH SPTOOLKIT
- 16. THAT’S ALL FOLKS Thispresentation and its supplemental video and software content can be downloaded by using the following link: http://tinyurl.com/l46flvo (Secure Google-Drive repository) Links to Resources outside of this repository: SPTOOLKIT Setup Guide: http://www.dafthack.com/blog/howtospearphishyouremployeespart1thesetup www.rapid7.com -> download Community edition of Metasploit and Nexpose http://www.kali.org/downloads/ -> Kali Linux to be used as a pentesting environment and for SPTOOLKIT Social Engineering Module Want to chat with me outside of this conference about more IT Security topics? Shoot me an email at: Robbie.Corley@kctcs.edu
- 17.