WELCOME TO CIS 55 – LECTURE 3

Topics to cover:�Threat Modeling�Incident Management Exercise

Tools for Penetration Testing:

NMAP, NESSUS, METASPLOIT, SQLMAP

Guest Appearance (Microsoft engineer)

COURSE LOGISTICS

Review of Lab 2

Threat Modeling

THREAT MODELING

• What is Threat Modeling
• Assessing security risks of a software system from an adversary’s perspective.

GOALS OF THREAT MODELING

• Understand threats to guard against during requirements analysis.
• Provide basis for which security mechanisms to include during design.
• Verify security of system design.
• Provide basis for prescribing secure implementation practices.
• Provide basis for testing system security after implementation.

​

THREAT MODELING PROCESS

KNOW THY ENEMY

1. Identify System Assets.

System resources that an adversary might attempt to access, modify, or steal.

Ex: credit cards, network bandwidth, user access.

• Identify Entry Points.

Any location where data or control transfers between the system being modeled and another system.

Ex: network sockets, web forms, files

• Determine Trust Levels.

Privileged external entities have to legitimately use system resources.

​

IDENTIFY SYSTEM ASSETS

• User login data
• User personal data
• Web process resources

Execute code as web server

Network/disk resources

• Application resources
• Database server resources

Access to stored data

• Organization’s reputation

​

ANALYZE ENTRY POINTS

CHARACTERIZE SYSTEM SECURITY

1. Use and misuse scenarios.

How do users use the system to fulfill needs?

How could an adversary use these system interfaces to attack the system?

• Identify assumptions and dependencies.

How does system security depend on external systems?

What assumptions do components make about data or control transfers with other components?

• Model the system.

Model how system processes data from each entry point using tools

​

EVALUATE THREATS

DREAD

QUANTIFYING THREATS

Calculate risk value for nodes in attack tree

Start at bottom of tree.

Assign a number 1-10 to each DREAD item.

Assign average of numbers to node.

Propagate risk values to nodes.

Alternate technique: monetary evaluation

Estimate monetary value to carry out attacks.

Propagate values to parent nodes as above.

Note: smaller values are higher risks in this method.

​

Resources

Microsoft: https://www.microsoft.com/en-us/securityengineering/sdl

Threat Modeling:

https://owasp.org/www-community/Threat_Modeling

2017 EQUIFAX DATA BREACH

• https://www.wired.com/story/equifax-hack-china/
• In March 2017, personally identifying data of hundreds of millions of people was stolen from Equifax, one of the credit reporting agencies that assess the financial health of nearly everyone in the United States.
• The company was initially hacked via a consumer complaint web portal, with the attackers using a widely known vulnerability that should have been patched but, due to failures in Equifax's internal processes, wasn’t.
• The attackers were able to move from the web portal to other servers because the systems weren't adequately segmented from one another, and they were able to find usernames and passwords stored in plain text that then allowed them to access still further systems.
• The attackers pulled data out of the network in encrypted form undetected for months because Equifax had crucially failed to renew an encryption certificate on one of their internal security tools.
• Equifax did not publicize the breach until more than a month after they discovered it had happened; stock sales by top executives around this time gave rise to accusations of insider trading.

​

​

EQUIFAX

• The crisis began in March of 2017. In that month, a vulnerability, dubbed CVE-2017-5638, was discovered in Apache Struts, an open-source development framework for creating enterprise Java applications that Equifax, along with thousands of other websites, uses. If attackers sent HTTP requests with malicious code tucked into the content-type header, Struts could be tricked into executing that code, and potentially opening up the system Struts was running on to further intrusion
•  On March 7, the Apache Software Foundation released a patch for the vulnerabilities; on March 9, Equifax administrators were told to apply the patch to any affected systems, but the employee who should have done so didn't. Equifax's IT department ran a series of scans that were supposed to identify unpatched systems on March 15; there were in fact multiple vulnerable systems, including the aforementioned web portal, but the scans seemed to have not worked, and none of the vulnerable systems were flagged or patched.

Incident Response -- Backdoors and Breaches

https://www.blackhillsinfosec.com/backdoors-breaches-tabletop-simulator-guide/

Pentesting Tools

Review & In Depth

WHO NEEDS PENTESTING?

• - Banks/Financial Institutions, Government Organizations, Online Vendors, or any organization processing and storing private information 

​

• - Most certifications require or recommend that penetration tests be performed on a regular basis to ensure the security of the system. 

​

• - PCI Data Security Standard's Section 11.3 requires organizations to  perform application and penetration tests at least once a year.

​

• - HIPAA Security Rule's section 8 of the Administrative Safeguards requires security process audits, periodic vulnerability analysis and penetration testing.

​

PENTESTING VIEWPOINTS

• External vs. Internal

​

• Penetration Testing can be performed from the viewpoint of an external attacker or a malicious employee.

​

• Overt vs. Covert

​

• Penetration Testing can be performed with or without the knowledge of the IT department of the company being tested.

​

PHASES OF PENTESTING

RECONNAISSANCE AND INFORMATION GATHERING

• Purpose: To discover as much information about a target (individual or organization) as possible without actually making network contact with said target. 

​

• Methods:
• Organization info discovery via WHOIS
• Google search
• Website browsing

​

NETWORK ENUMERATION AND SCANNING

• Purpose:  To discover existing networks owned by a target as well as live hosts and services running on those hosts.

​

• Methods:
• Scanning programs that identify live hosts, open ports, services, and other info (Nmap, autoscan)
• DNS Querying
• Route analysis (traceroute)

​

NMAP

• Short for network mapper.
• Open-Source utility which can quickly scan broad ranges of devices and provide valuable info about the devices on your network. May be used for IT auditing as well as security profiling of the network
• Uses IP packets to determine running services, open ports, versions, operating systems…
• Wide range of scans: some are aggressive, some are very hush-hush

NMAP RUN EXAMPLES

• What can you tell me from the output?

NMAP FLAGS

• SYN scan (-sS)which is very quick and relatively stealthy since it doesn’t complete the TCP connection.
• If the SYN scan is unavailable due to privileges, then the TCP scan (-ST) will be used by default. The TCP scan is less efficient and offers less control than the SYN scan.
• SCTP combines the architecture of TCP and UDP and includes congestion avoidance, resistance to flooding and features such as multi streaming and multi homing. Like the SYN scan, SCTP scan is fast, stealthy and clearly defines the port states. It can be performed by using the -sY option.
• The aggressive scan option (-A) combines various different scan types such as operating system detection, script scanning and trace route. Its a good option for when you want a complete scan report without caring how intrusive you are.

NMAP: FLAGS EXAMPLE

• nmap -sS 192.168.1.1 => SYN scan
• nmap -sT 192.168.1.1 => TCP scan
• nmap -sU 192.168.1.1 => UDP scan
• nmap -sY 192.168.1.1 => SCTP scan
• nmap -A 192.168.1.1 => Aggressive scan

​

• Nmap command for version detection: -sV

​

NMAP: FLAGS EXAMPLE

• A helpful alias is -A, which will enable OS detection, service version detection, script scanning, and traceroute.
• $ nmap -A host
• --oscan-limit = Limits the OS detection to targets with at least an open and closed port resulting in higher chance of success
• --fuzzy = Used for when Nmap can't make a clear guess, displays confidence score
• --max-os-tries = The default is 5, set to a lower number to speed up the scan.

NMAP: FIREWALL AVOIDANCE

• This separates the amateur hackers from the more experienced ones. Inexperienced hackers will often use the default settings of Nmap and end up getting their IP blocked by the target IDS or their packets dropped by the network firewall.
• An experienced hacker will be patient and probe the target using different MAC/IP addresses to gain information about the targets system. Next the hacker will use their skill to avoid firewall rules using proxies or different routes and evade the IDS by overwhelming it with decoy attacks.

​

• Note: “All of the major IDSs ship with rules designed to detect Nmap scans because scans are sometimes a precursor to attacks”

​

SCAN SPEED

• You can also adjust the speed that nmap scans at. using -T<0–5>. A higher number means a higher speed.
• Higher speed means less accuracy, and vice versa.
• $ nmap -T3 host

TESTING AND EXPLOITATION

• Purpose:  To check hosts for known vulnerabilities and to see if they are exploitable, as well as to assess the potential severity of said vulnerabilities. 

​

• Methods: 
• Remote vulnerability scanning (Nessus, OpenVAS)
• Active exploitation testing
• Login checking and bruteforcing
• Vulnerability exploitation (Metasploit, Core Impact)
• Zero day and exploit discovery (Fuzzing, program analysis)
• Post exploitation techniques to assess severity (permission levels, backdoors, rootkits, etc.)

​

INTRO TO NESSUS

• Nessus is a remote security scanning tool, which scans a computer and raises an alert if it discovers any vulnerabilities that malicious hackers could use to gain access to any computer you have connected to a network.
• It does this by running over 1200 checks on a given computer, testing to see if any of these attacks could be used to break into the computer or otherwise harm it.

NESSUS

• - Up to date information about new vulnerabilities and attacks. The Nessus team updates the list of what vulnerabilities to check for on a daily basis in order to minimize the window between an exploit appearing in the wild, and you being able to detect it with Nessus.
• - Open-source. Nessus is open source, meaning it costs nothing, and you are free to see and modify the source as you wish.
• Patching Assistance: When Nessus detects a vulnerability, it is also most often able to suggest the best way you can mitigate the vulnerability.

​

NESSUS

NESSUS

NESSUS

INTRO METASPLOIT

• Metasploit is a penetration testing framework that helps you find and exploit vulnerabilities.
• The Metasploit Framework is one of the most useful testing tools available to security professionals. Using Metasploit, you can access disclosed exploits for a wide variety of applications and operating systems. You can automatically scan, test, and exploit systems using code that other hackers have written.
• Metasploit also provides a development platform for you to write your own security tools or exploit code.

​

METASPLOIT

• msf > help
• msf > search mysql
• Search is very useful
• search cve:2009 type:exploit platform:-linux

ONCE YOU PICKED A MODULE

• msf > info exploit/linux/http/librenms_collectd_cmd_inject
• After you have decided on a module to use, run use to select it.
• msf > use exploit/linux/http/librenms_collectd_cmd_inject
• This will change the context of your commands and allow you to run commands specific to this module.

​

​

​

​

INSIDE THE MODULE

• Now that you are inside the module, run options to see what you can do.
• msf exploit(linux/http/librenms_collectd_cmd_inject) > options

EXPLOIT

• For example, to set the target host for exploitation, you can run:
• msf exploit(linux/http/librenms_collectd_cmd_inject) > set RHOSTS 172.16.194.134
• You will need to set all the required variables before you can run the exploit. For this particular module, you have to provide the PASSWORD, RHOSTS, RPORT, TARGETURI, and USERNAME.
• msf exploit(linux/http/librenms_collectd_cmd_inject) > exploit

SQL INJECTIONS

• To start, let’s quickly review what SQL injection is.
• Put simply, it's a vulnerability that allows for the execution of SQL statements into an entry field on a website. This could be a username and password field or any other area on a site requiring user input.
• SQL injection can also be performed via the URL by injecting statements into a parameter on a particular page.
• You may be asking, “well how do I know if a website is vulnerable to SQL injection?”
• There are manual ways of checking, for example, inputting ' or 1=1-- -&password=aaa into the username field on a site and leaving the password field blank. If a statement like this returns a SQL error, you have yourself a SQL injection vulnerability.

�

SQL INJECTIONS

• This is a common query used in SQL injection where the apostrophe marks the beginning of a SQL statement and “or 1=1” is a statement that is always true and will return everything for your query
• Sometimes though, this may not work and we have to try some other forms of injection tests.
• Another common statement used is SELECT * FROM Users WHERE UserID = 105 OR 1=1; . This statement is essentially telling the SQL database to get me any user (the asterisk is a wildcard) from a table called “Users” where the user ID is 105 or True (1=1).

​

SQL INJECTIONS

• http://10.0.0.101/peruggia/?action=comment&pic_id=-1 union all select 1,2,3,@@version

​

​

SQLMAP

• The first task at hand is performing a scan of the web application. In my case, I’m still working with a vulnerable version of peruggia. To perform a scan, we’re going to use the -u option, which checks each of the input parameters within the URL and reports whether or not they’re susceptible to injection.
• python ./sqlmap.py -u http://10.0.0.101/peruggia/

​

SQLMAP

Given this result, I decided the scan the

URL where I previously discovered

I could perform injection:

“http://10.0.0.101/peruggia/?action=comment&pic_id=1”.

SQLMAP: THIS SEEMS TO BE MORE INTERESTING

During this scan, sqlmap found the pic_id parameter vulnerable to injection. So now we can add another flag at the end of our scan of this URL to return any databases it finds:

python ./sqlmap.py -u "http://10.0.0.101/peruggia/" -dbs

The -dbs option adds database enumeration to the scan and with that, I was able to retrieve four databases that exist on this web server.

​

SQLMAP – TABLE ENUMERATION

Now I don’t know about you, but the “target” database kind of stood out to me,

so I chose to further enumerate that one:

python ./sqlmap.py -u "http://10.0.0.101/peruggia/" -tables -D target

​

In the above command, I used the -tables option to enable table enumeration

and the -D option to specify which database I wanted sqlmap to scan.

SQLMAP – PWNED!

• And look at that! We have a table called users that likely contains usernames and passwords, and remember we’ve done all of this without having entered any credentials anywhere.
• While this is an intentionally vulnerable application, there are legitimate applications out there with exposed database. This is why it’s crucial to perform regular web application assessments and immediately remediate critical flaws like this.
• Now, all we have to do is perform a dump of it and we’ll have successfully compromised this database along with each of the user accounts stored within it.
• To do this, we’ll use the same command we’ve been using to enumerate the databases and tables, but this time add the -dump flag. This command will output the table data to our terminal but it’ll also dump a .csv file containing the data as well.

​

SQLMAP – PWNED!

• And to top it off, sqlmap has built-in password cracking capabilities that you can choose to run. In the below screenshot, we’re looking at the two users that exist in the “users” table, their hashed password, and the cracked value (both “password”).

REPORTING

• Purpose:  To organize and document information found during the reconnaissance, network scanning, and vulnerability testing phases of a pentest. 

​

• Methods:  
• Documentation tools (Dradis)
• Organizes information by hosts, services, identified hazards and risks, recommendations to fix problems

​

HOW TO BECOME A PENTESTER

• - Stay up to date on recent developments in computer security, reading newsletters and security reports are a good way to do this.
• - Becoming proficient with a scripting language such as python
• - Microsoft and Cisco certifications
• - Penetration Testing Certifications

Certified Ethical Hacker (CEH)

eLearnSecurity Junior Penetration Tester

GIAC Certified Penetration Tester (GPEN)

CompTIA Pentest+

Offensive Security Certified Professional (OSCP)

​

​

​

​

Personal Security

​

• Password Manager
• Do Not Track
• Phishing awareness

THE END

• Lab 3 is due on Feb 23
• Quiz 2 is open from 12pm till Sunday 10 pm

GUEST

Vassil Bakalov

https://www.linkedin.com/in/vassilbakalov/

• Microsoft SDL - https://www.microsoft.com/en-us/securityengineering/sdl
• Defense: Static Analysis
• Attack: Buffer Overflow Attacks
• Defense: Control Flow Guard
• Attack: Return Oriented Attacks
• Defense: Shadow Stack
• Attack: Hardware Stack Not Available
• Microsoft Tools
• Offline

​

​