Penetration Testing - part 3

Web App Attack Tools and Techniques

Hello everyone i am continuing form where i left in last part 2. Now will discuss further more tools for penetration testing.

Web Application Audit and Attack Framework

• w3af is a well-known web attack framework

– Very similar in model to Metasploit

• w3af combines all of the necessary pieces to accomplish an entire web attack

– Mapping to determine how the application works
– Discovery to find vulnerabilities
– Exploitation to take control of a target application or its underlying server

• With network access, w3af provides an excellent framework to take our attack to the next level

w3af Console Interface

• Here is the beginning w3af’s information gathering
• We are setting up a scan of a target web application
• We are able to choose our plug-ins and targets

– Most plug-ins provide configurable options

• We can use this interface to scan an application for exploitable vulnerabilities

w3af Exploits
• w3af includes a number of web app exploits, including:
– xssBeEF is the XSS tool
– sqlmap is an entire SQL injection exploit tool
• Includes an OS shell used through SQLi
– mysqlWebShell provides shell access using SQL injection on MySQL target
– osCommandingShell is a command shell created through command injection flaws

A Combined Pen Test Scenario

Start with Client-Side Exploit of XP Box

Pivot Through XP Box to Exploit Vista Machine

RFMON Wireless Network Enumeration and Discovery

Leveraging Compromised Client Wireless Preferences

Use w3af to Scan Intranet Web Application

Retrieve PII Files from Corporate Web Server

That's it, Done. Now let's have some conclusion from this. That will help you going forward.

Conclusions

• Combined attack vectors allow for far deeper penetration into most target networks than separate vectors allow

– Combining web app, network, and wireless penetration testing isvery powerful

• This combination provides a much more accurate view of the business risks posed by vulnerabilities than offered by completely separate network, wireless, and web app tests
• We’ve looked at useful features of  Metasploit, Vista wireless power tools, and w3af
• In Part IV of this webcast trilogy, we’ll look at additional attack vectors and tools for further combining these three disciplines and discuss where this type of testing may be headed in the Future.