2 of 32

This project main aim is to perform penetration test automation, where both the red and the blue team have significant roles to play.

The Red Team will carry on with the realistic attack simulations to check the ability of the network to stand against these attacks and will do this with the help of a team collaboration that will in the end lead to an improvement on the cybersecurity posture through use of intelligent automation and shared insights.

The Blue Team heavily focuses on being proactive in terms of security by performing continuous monitoring and securing employees through constant training and compliance automation to repel threats and vulnerabilities.

Project

Scope

3 of 32

Introduction

Introduction of a novel approach to penetration testing, combining automation and teamwork between Blue and Red Teams.
Blue Team focuses on threat detection, security awareness training, and compliance automation, while Red Team conducts simulations to expose deficiencies and test countermeasures.
Primary objective: Enhance and expedite penetration testing processes through automation tools and frameworks, fostering a culture of continuous improvement in organizational cybersecurity.
Exploiting automation alongside collaboration between Blue and Red Teams to bolster organizational defenses, continuously identify vulnerabilities, and enhance cybersecurity resilience against evolving threats.

4 of 32

Automation

Red teams are offensive specialists who use tools and techniques to test and break through an organization's defenses, while blue teams are on defense, trying to detect and respond to these attacks

Read Team

A red team acts as an attacker, trying to find vulnerabilities and break through cybersecurity defenses.

Blue Team

A blue team defends against attacks and responds to incidents when they occur.

Roadmap

5 of 32

Requirements

A test environment provides a secure place to perform penetration testing and security research.

A router is a networking device that forwards data packets between computer networks. It manages traffic between networks by forwarding data packets to their intended IP addresses and allows multiple devices to use the same internet connection.

Sunfire x4270 0926XF

NETGEAR N600

Go-phish

Metasploite Framework

NMAP

SOAR

SIEM

WAZUH

CROWDSEC

Openvas

Tablue

SPSS

Kali Linux is an open-source, running on Sunfire x4270 0926XF

, Debian-based Linux distribution geared towards various information security tasks, such as Testing, Security Research, Computer Forensics and Reverse Engineering.

Kali Server

Metasploitable 2

NETGREAR Router

Tools

6 of 32

Architecture

8 of 32

Red Team

A group of people who are authorized to simulate a potential attacker's tactics and procedures against an organization's systems.

Goal: Emulate real-world adversaries to infiltrate targeted systems.

Our Red Team Tools

NMAP
Metasploit
Automation script to attack Metasploitable 2 machine
Bruteforce and Reverse Shell Payload

9 of 32

NMAP

Nmap is a powerful network scanning tool used by penetration testers to identify live hosts, open ports, running services, and operating systems, enabling the identification of potential vulnerabilities.

Its scripting engine automates tasks, and stealth scanning techniques avoid detection, making it a crucial tool for thorough network assessment and security auditing.

In this project, Nmap was used to scan the targets for open ports and check the services running on the open ports for further attack.

The scan lasted for 21.27 seconds and listed 23 open ports with outdated service versions.

10 of 32

Simplifying Tasks with Scripting

The Bash is the language we used for Automation Testing.
Bash is a shell scripting language basically used for automatizing tasks and for executing further commands on Unix-like operating systems.
Bash scripts are essentially versatile and functional in carrying out a number of mean tasks relating to administration, automation, file manipulation and process management.�

11 of 32

Automated Port Scanning and Exploitation�

Automates the process of scanning open ports on a target IP address.
Enables quick identification of potential vulnerabilities.

Efficient Vulnerability Assessment:

Executes different tasks based on the open ports discovered.
Streamlines the exploitation of identified vulnerabilities.

Task-Based Execution:

Facilitates systematic testing for common services and their vulnerabilities.
Improves the overall security posture by identifying and addressing weaknesses.

Enhanced Security Testing:

Supports multiple ports and corresponding tasks, adaptable to various scenarios.
Can be expanded with additional port-task mappings for comprehensive testing.

Flexible and Extensible:

Reduces manual effort and time required for port scanning and vulnerability assessment.
Maximizes the efficiency of security professionals by automating repetitive tasks.

Time and Resource Optimization:

12 of 32

Exploiting Samba Vulnerability on Port 445

Port 445 on Metasploitable 2 is running Samba version 3.0.20-Debian, which has a known vulnerability.
The vulnerability allows for command execution by exploiting the "username map script" configuration option.
Metasploit has an exploit module available to take advantage of this vulnerability.

13 of 32

Exploiting NFS Misconfiguration on Port 2049

Port 2049 on Metasploitable 2 is running the Network File System (NFS) service.
The NFS service is misconfigured to share the root directory (/) with all clients.
This allows any unauthenticated user to mount the remote filesystem and access sensitive data.

14 of 32

Bruteforce And Reverse Shell Payload

Steps

SSH Brute Force

Run custom Python script for SSH Brute Force on host IP 192.168.138.3 from the attack machine using a list of dictionary word list

Reverse Shell

Set up a listening using Netcat on port 1234 from the attacking machine
Execute reverse shell payload on the host server to successfully establish the connection.

16 of 32

Social Engineering: Go-phish

Social engineering is a method used by attackers to manipulate individuals into divulging confidential information, performing actions, or compromising security protocols.

Go-phish is an extremely powerful and user-friendly open-source phishing simulator to be used by both testers and businesses to perform real-world phishing tests.�
Go-phish is a phishing framework that makes the simulating of real-world phishing attacks as the easiest thing in the world.

Step by Step for a successful campaign:

17 of 32

Vulnerability Scanner: OpenVAS

A vulnerability assessment is a systematic review of security weaknesses in an information system.
Scalable open-source vulnerability assessment system for in-depth network and web application security analysis.
Integrates with existing frameworks, including commercial version Greenbone Security Manager, for comprehensive vulnerability identification and mitigation.

Step by Step for a successful campaign:

18 of 32

Outcomes of Go-phish & OpenVAS

19 of 32

SIEM

SIEM is a tool that gathers logs and other data, alert security teams of suspicious activity, and help with
Wazuh is a free and open-source security platform that unifies XDR and SIEM capabilities.

Wazuh Components & Dataflow:

20 of 32

SOAR platform is the comprehensive tool of automation with incident response capabilities with merging threat intelligence data.
CrowdSec is an Open source & collaborative security tool protect servers, services, containers, VMs, and IoT devices form various malicious attacks by investigating logs and by custom playbooks.

CrowdSec Ecosystem:�

S.O.A.R

23 of 32

Distribution Of Vulnerabilities by Severity

Bar chart representing the Vulnerabilities identified on the Lab infra by the OpenVAS tool.
Vulnerabilities distribution based on Severity.
The severity of Vulnerabilities are calculated based on CVSS score.

24 of 32

Vulnerabilities and ports

The chart representing the Vulnerabilities count based on Ports.
The high number of vulnerabilities are observed on port 80, commonly used for internet communication protocol, HTTP.
The least number of vulnerabilities were found on port 6200 and 514, used for TCP/UDP communications.

The chart shows the Top 10 vulnerabilities detected.

25 of 32

Distribution Of CVSS Score

This represents the distribution of CVSS score over the observed vulnerabilities from OpenVAS.

CVSS or Common Vulnerability Scoring System, an Industry standard for assessing severity of the system or vulnerability.

CVSS score is ranges from 0-10.

26 of 32

IP vs PORT vs Severity

Packed graph, representing the severity and the machine IP w.r.t the port of the machine.
Data from OpenVAS.

27 of 32

Results by the CVSS Score

Representing the Vulnerabilities count based on Severity,
There are 7-10 High

4-6.9 Medium

0-3.9 Low

Info/Log alerts

28 of 32

Phishing Campaign Report

Graph representing the Phishing campaign results w.r.t the timeline.
This also shows the user reaction towards the Phishing email.

Pie Chart representing the user(s) reaction towards the phishing campaign.

29 of 32

Future Scope

Developing in-house Threat Intelligence and integrating with SOAR tools.
Extending security protection to Assets including servers, mobiles (Both Android & Ios, Supervised& Supervised ), endpoints.
Developing and Implementing IDS and IPS for Network protection.

30 of 32

HIPPA Integration

Our organization adheres to critical regulations like HIPAA, enhancing our incident management and access control systems to protect sensitive information.
We enforce strict compliance with privacy and security standards to ensure the integrity and confidentiality of patient and staff data.
Advanced password management protocols are implemented, including regular updates, multi-factor authentication, and encrypted storage, to prevent unauthorized access.
By combining regulatory compliance with advanced security measures, we effectively safeguard sensitive data and maintain our reputation as a reliable healthcare provider.

1 of 32