hoofdstuk 2 stuff
Jef Roosens
parent
feb7ef7bd3
commit
d5287c4f1b
|
|
@ -0,0 +1 @@
|
|||
*.pdf
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
# Introduction
|
||||
|
||||
## Teams involved in security
|
||||
|
||||
* red: attack team
|
||||
* test effectiveness of security by performing attacks
|
||||
* blue: defend team
|
||||
* defend against attacks by constantly surveiling the network
|
||||
* yellow: build team
|
||||
* builds applications that can be used by the other teams
|
||||
* sharing knowledge
|
||||
* orange: builders learn from attackers
|
||||
* green: builder learn from defenders
|
||||
* purple: defenders learn from attackers
|
||||
|
||||
|
||||
|
||||
## Penetration testing
|
||||
|
||||
### Penetration testers <-> red teams
|
||||
|
||||
* penetration testing
|
||||
* methodical approach
|
||||
* limited by Rules of Engagement (restricted scope)
|
||||
* 1-2 week engagement
|
||||
* generally announced
|
||||
* goal is to assess security of network and systems
|
||||
* red team
|
||||
* flexible approach
|
||||
* anything goes (as long as it's legal)
|
||||
* 1 week to 6 months engagement
|
||||
* no announcement
|
||||
* goal is to test general security posture of company
|
||||
|
||||
### Penetrating testing <-> vulnerability assessments
|
||||
|
||||
* penetration testing
|
||||
* find vulnerabilities, both automated and manually
|
||||
* exploit them
|
||||
* attempt to gather confidential data
|
||||
* intended to go deeper and focus on technical issues
|
||||
* vulnerability assessment
|
||||
* find vulnerabilities through automated means
|
||||
* don't exploit them or gather data
|
||||
* broader and often includes explicit policy and procedure review
|
||||
|
||||
### assumed breach exercise
|
||||
|
||||
* pentest where attackers are assumed to already be inside
|
||||
* malware is dropped inside company boundaries
|
||||
* getting caught not the end -> reset and try again
|
||||
* **Time To Detect** (TTD): how long it takes to notice breach
|
||||
* **Time To Mitigate** (TTM): how long it takes to perform corrective action
|
||||
|
||||
### Useful resources
|
||||
|
||||
* [MITRE](https://attack.mitre.org/): knowledge base of attack tactics and
|
||||
techniques
|
||||
* explanation of **TTP**s (Tactics, Techniques and Procecures)
|
||||
* [APT Groups and Operations](https://apt.threattracking.com/): Google doc containing
|
||||
list of dangerous groups
|
||||
* [Cyber Fundamentals](https://atwork.safeonweb.be/nl/tools-resources/cyberfundamentals-framework)
|
||||
* concrete measures on how to protect data and ensure safety in company
|
||||
* four assurance levels
|
||||
* five core functions
|
||||
1. identify
|
||||
2. protect
|
||||
3. detect
|
||||
4. respond
|
||||
5. recover
|
||||
|
|
@ -0,0 +1,234 @@
|
|||
# Planning, Scoping, Recon and OSINT
|
||||
|
||||
* **Threat**: agent or actor that can cause harm
|
||||
* **Vulnerability**: flaw that can be exploited to cause harm
|
||||
* **Risk**: overlap between threat and vulnerability
|
||||
* **Exploit**: code or technique that a threat uses to take advantage of a
|
||||
vulnerability
|
||||
* **Hacking**: manipulate technology to make it do something it's not designed
|
||||
to do
|
||||
* **Ethnical hacking** (white hat): hacking with the permission of the target
|
||||
* **Penetration testing**: ethical hacking with the goal of finding and
|
||||
exploiting security vulnerabilities in target environment and reporting
|
||||
them
|
||||
* modelling techniques used by real-world attackers
|
||||
* determine risk to company
|
||||
* **Security audit**
|
||||
* testing against a rigorous set of standards
|
||||
* detailed checklists
|
||||
* more in-depth than pen test
|
||||
|
||||
## Types of penetration tests
|
||||
|
||||
* Network services test
|
||||
* find target systems on network
|
||||
* look for openings in OS or running network services and exploit them
|
||||
* over the internet or from within breached network
|
||||
* Client-side software test
|
||||
* look for vulnerabilities in client-side software (e.g. browsers)
|
||||
* Web application test
|
||||
* look for vulnerabilities in web-based applications deployed in the target
|
||||
environment
|
||||
* Social engineering / phishing test
|
||||
* attempt to trick user into revealing sensitive information
|
||||
* using phishing mails to make users click malicious links
|
||||
* Wireless security test
|
||||
* find unauthorized wireless access points or authorized ones with security
|
||||
weaknesses
|
||||
* Physical security test
|
||||
* look for flaws in physical security practices
|
||||
* literally try to break in
|
||||
* dumpster diving
|
||||
* Stolen equipment test
|
||||
* "obtain" (steal) a piece of equipment (e.g. laptop) and analyse it for
|
||||
sensitive info
|
||||
* Cryptanalysis attack
|
||||
* break or bypass encryption on local or intercepted data
|
||||
* Product security test
|
||||
* look for security flaws in software products that can be installed in
|
||||
tester's lab
|
||||
* Remote war dial test (obsolete)
|
||||
* attempt to log into discovered modems
|
||||
|
||||
## Phases of an attack
|
||||
|
||||
1. Reconnaissance: OSINT, social engineering, dumpster diving...
|
||||
2. Scanning: finding openings in the systems, listening ports...
|
||||
3. Exploitation / gaining access: attempt to access and take control of target
|
||||
devices
|
||||
|
||||
* Malicious actors go further
|
||||
* install backdoors and rootkits
|
||||
* cover tracks with covert channels, log editing...
|
||||
|
||||
* public/free testing methodologies
|
||||
* Open Source Security Testing Methodology Manual ([OSSTMM](https://www.isecom.org/research.html))
|
||||
* Pen Testing Execution Standard ([PTES](Pen Testing Execution Standard))
|
||||
* [NIST](https://csrc.nist.gov/publications/detail/sp/800-115/final) (US National Institute of Standards and Technology)
|
||||
* ...
|
||||
|
||||
## Lab
|
||||
|
||||
* **Testing machine**: system used by pentester to attack other machines
|
||||
* don't use for anything personal
|
||||
* should be hardened to avoid being attacked themselves
|
||||
* scrub results between tests (avoid confusion, leave no trace)
|
||||
* **Target machine**: machine being attacked/evaluated
|
||||
|
||||
## The pentesting process
|
||||
|
||||
* three phases
|
||||
1. preparation
|
||||
* perform necesary paperwork
|
||||
* clearly define rules of engagement
|
||||
2. testing: conduct the test
|
||||
3. conclusion
|
||||
* detailed analysis of results
|
||||
* write report
|
||||
|
||||
### rules of engagement
|
||||
|
||||
* must be defined in advance
|
||||
* clear outline of what's allowed and what's not
|
||||
* emergency contact information
|
||||
* safe means of communication
|
||||
* possible briefing calls
|
||||
* agreement on period of engagement
|
||||
* whether sysadmins are informed or not
|
||||
* how much info is shared
|
||||
* **black box**: no info shared
|
||||
* more closely mimicks a true attack
|
||||
* takes longer
|
||||
* **grey box**: some info, e.g. password for non-privileged user
|
||||
* balance between efficiency and realism
|
||||
* **white box**: testers get everything
|
||||
* what data can be viewed
|
||||
* remove personal data from sniffed packets
|
||||
* sometimes samples are allowed to prove they were there
|
||||
* should be signed off before anything is done
|
||||
|
||||
### Scoping
|
||||
|
||||
* determine what should be focused on
|
||||
* ask organisation what their biggest weaknesses are
|
||||
* avoid scope creep
|
||||
* ensure all targetted systems are allowed within scope
|
||||
* third-party systems should give *written* permission
|
||||
* large cloud ventors usually have pen testing rules in place
|
||||
* ideally run test on staging environment (don't break prod)
|
||||
* checking inside vulnerabilities
|
||||
* team travels onsite
|
||||
* team gets vpn or ssh access
|
||||
* scope must specify level of testing allowed
|
||||
* ping sweep
|
||||
* port scanning
|
||||
* full on `nmap -A`
|
||||
* physical penetration attempts
|
||||
* social engineering
|
||||
* DoS checks
|
||||
* use of dangerous exploits
|
||||
|
||||
### Reporting and inventory management
|
||||
|
||||
* report is important
|
||||
* only thing the client will read
|
||||
* should clearly define what's the problem
|
||||
* write it as you go
|
||||
* convince client the problem is real and in the room with them
|
||||
* rank vulnerabilities according to severity
|
||||
* executive summary
|
||||
* statement of confidentiality: how to treat this document
|
||||
* engagement contacts: who was involved
|
||||
* summary for management to read
|
||||
* most important conclusions
|
||||
* what should be fixed
|
||||
* what's been done
|
||||
* pentest assessment summary: overview of most important findings
|
||||
* detailed walktrhough: technical overview
|
||||
* technical
|
||||
* deep technical findings
|
||||
* big nerd talk for the nerds
|
||||
* remediation summary
|
||||
* short, medium and long-term recommendations
|
||||
* summarize project, scope and security state of target
|
||||
* appendices
|
||||
* output of commands
|
||||
* data dumps
|
||||
* password reviews
|
||||
|
||||
## Reconnaissance
|
||||
|
||||
* collect as much information as possible before launching any attack
|
||||
* **Passive**: gather info without direct interaction with target
|
||||
* via social media
|
||||
* corporate website
|
||||
* search engines
|
||||
* ...
|
||||
* **Active**: interact directly with target system
|
||||
* scanning
|
||||
* enumeration
|
||||
* higher risk of detection
|
||||
* social engineering
|
||||
* important role in information gathering
|
||||
* life cycle
|
||||
1. investigate
|
||||
* gather information about targets
|
||||
* find details about them (job, personal interests...)
|
||||
2. hook
|
||||
* create plausible scenario to engage with target
|
||||
* establish trust
|
||||
3. play
|
||||
* manipulate target into providing desired information
|
||||
* trick target into revealing sensitive information
|
||||
4. exit
|
||||
* cover tracks to avoid detection
|
||||
* document metadata analysis
|
||||
* gather information from e.g. pdf metadata tags
|
||||
* reveals what software they use, who works there
|
||||
* lots of documents are (accidentally) publicly available
|
||||
* use crawlers and search engines
|
||||
* domain info
|
||||
* WHOIS ([Belgium](https://www.dnsbelgium.be/))
|
||||
* query registries about domains
|
||||
* can contain contact information of sysadmins
|
||||
* list domain servers
|
||||
* not as useful now due to privacy laws
|
||||
* Regional Internet Registries (RIRs) offer databases for IP -> domain lookup
|
||||
* subdomain discovery
|
||||
* enumerate subdomains used by target
|
||||
* usually stored on target dns servers
|
||||
* useful tools
|
||||
* [knock](https://github.com/guelfoweb/knock/): brute-forcing tool
|
||||
* [sublist3r](https://github.com/aboul3la/Sublist3r): uses search engines for domain names
|
||||
* [SubBrute](https://github.com/TheRook/subbrute): uses open resolvers as proxies for dns queries
|
||||
* search engines can provide useful info
|
||||
* search for employees or company websites
|
||||
* look at job offers
|
||||
* ...
|
||||
* use fancy lookup syntax
|
||||
* DNS
|
||||
* translates domain names to IP addresses
|
||||
* **NS**: nameserver
|
||||
* **A**: address
|
||||
* **MX**: mail server address for domain
|
||||
* **TXT**: plain text strings for domain
|
||||
* **CNAME**: aliases for domain names
|
||||
* **SOA**: indicates that server is authoritative for DNS zone
|
||||
* **PTR**: pointer for inverse lookup (IP -> domain)
|
||||
* zone transfer: mechanism used to replicate DNS DB info to other server
|
||||
* allow secondary servers to sync with primary one
|
||||
* can be exploited to receive full information from DNS server
|
||||
* should be disabled for properly configured server
|
||||
* useful tools
|
||||
* recon-ng framework
|
||||
* open reconaissance framework
|
||||
* does a lot automatically
|
||||
* the perfect automated stalker tool
|
||||
* can detect antivirus by checking which dns entries are cached in domain servers
|
||||
* spiderfoot framework
|
||||
* OSINT automation tool
|
||||
* OWASP AMASS framework
|
||||
* GitHub
|
||||
* filled with leaked secrets
|
||||
* trufflehog and git-all-secrets automatically scan GitHub for leaks
|
||||
* [have i been pwned](https://haveibeenpwned.com/)
|
||||
|
|
@ -0,0 +1 @@
|
|||
# Scanning
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
samenvatting.pdf: *.md metadata.yml
|
||||
pandoc --toc -o $@ $^
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
geometry:
|
||||
- top=30mm
|
||||
- left=30mm
|
||||
---
|
||||
130
samenvatting.md
130
samenvatting.md
|
|
@ -1,130 +0,0 @@
|
|||
# Introduction
|
||||
|
||||
## Teams involved in security
|
||||
|
||||
* red: attack team
|
||||
* test effectiveness of security by performing attacks
|
||||
* blue: defend team
|
||||
* defend against attacks by constantly surveiling the network
|
||||
* yellow: build team
|
||||
* builds applications that can be used by the other teams
|
||||
* sharing knowledge
|
||||
* orange: builders learn from attackers
|
||||
* green: builder learn from defenders
|
||||
* purple: defenders learn from attackers
|
||||
|
||||
|
||||
|
||||
## Penetration testing
|
||||
|
||||
### Penetration testers <-> red teams
|
||||
|
||||
* penetration testing
|
||||
* methodical approach
|
||||
* limited by Rules of Engagement (restricted scope)
|
||||
* 1-2 week engagement
|
||||
* generally announced
|
||||
* goal is to assess security of network and systems
|
||||
* red team
|
||||
* flexible approach
|
||||
* anything goes (as long as it's legal)
|
||||
* 1 week to 6 months engagement
|
||||
* no announcement
|
||||
* goal is to test general security posture of company
|
||||
|
||||
### Penetrating testing <-> vulnerability assessments
|
||||
|
||||
* penetration testing
|
||||
* find vulnerabilities, both automated and manually
|
||||
* exploit them
|
||||
* attempt to gather confidential data
|
||||
* inteded to go deeper and focus on technical issues
|
||||
* vulnerability assessment
|
||||
* find vulnerabilities through automated means
|
||||
* don't exploit them or gather data
|
||||
* broader and often includes explicit policy and procedure review
|
||||
|
||||
### assumed breach exercise
|
||||
|
||||
* pentest where attackers are assumed to already be inside
|
||||
* malware is dropped inside company boundaries
|
||||
* getting caught not the end -> reset and try again
|
||||
* **Time To Detect** (TTD): how long it takes to notice breach
|
||||
* **Time To Mitigate** (TTM): how long it takes to perform corrective action
|
||||
|
||||
### Useful resources
|
||||
|
||||
* [MITRE](https://attack.mitre.org/): knowledge base of attack tactics and
|
||||
techniques
|
||||
* [APT Groups and Operations](https://attack.mitre.org/): Google doc containing
|
||||
list of dangerous groups
|
||||
* [Cyber Fundamentals](https://atwork.safeonweb.be/nl/tools-resources/cyberfundamentals-framework)
|
||||
* concrete measures on how to protect data and ensure safety in company
|
||||
* four assurance levels
|
||||
* five core functions
|
||||
1. identify
|
||||
2. protect
|
||||
3. detect
|
||||
4. respond
|
||||
5. recover
|
||||
|
||||
# Planning, Scoping, Recon and OSINT
|
||||
|
||||
* **Threat**: agent or actor that can cause harm
|
||||
* **Vulnerability**: flaw that can be exploited to cause harm
|
||||
* **Risk**: overlap between threat and vulnerability
|
||||
* **Exploit**: code or technique that a threat uses to take advantage of a
|
||||
vulnerability
|
||||
* **Hacking**: manipulate technology to make it do something it's not designed
|
||||
to do
|
||||
* **Ethnical hacking** (white hat): hacking with the permission of the target
|
||||
* **Penetration testing**: ethical hacking with the goal of finding and
|
||||
exploiting security vulnerabilities in target environment and reporting
|
||||
them
|
||||
* **Security audit**
|
||||
* testing against a rigorous set of standards
|
||||
* detailed checklists
|
||||
* more in-depth than pen test
|
||||
|
||||
## Types of penetration tests
|
||||
|
||||
* Network services test
|
||||
* find target systems on network
|
||||
* look for openings in OS or running network services and exploit them
|
||||
* over the internet or from within breached network
|
||||
* Client-side software test
|
||||
* look for vulnerabilities in client-side software (e.g. browsers)
|
||||
* Web application test
|
||||
* look for vulnerabilities in web-based applications deployed in the target
|
||||
environment
|
||||
* Social engineering / phishing test
|
||||
* attempt to trick user into revealing sensitive information
|
||||
* using phishing mails to make users click malicious links
|
||||
* Wireless security test
|
||||
* find unauthorized wireless access points or authorized ones with security
|
||||
weaknesses
|
||||
* Physical security test
|
||||
* look for flaws in physical security practices
|
||||
* literally try to break in
|
||||
* dumpster diving
|
||||
* Stolen equipment test
|
||||
* "obtain" (steal) a piece of equipment (e.g. laptop) and analyse it for
|
||||
sensitive info
|
||||
* Cryptanalysis attack
|
||||
* break or bypass encryption on local or intercepted data
|
||||
* Product security test
|
||||
* look for security flaws in software products that can be installed in
|
||||
tester's lab
|
||||
* Remote war dial test (obsolete)
|
||||
* attempt to log into discovered modems
|
||||
|
||||
## Phases of an attack
|
||||
|
||||
1. Reconnaissance: OSINT, social engineering, dumpster diving...
|
||||
2. Scanning: finidngo penings in the systems, listening ports...
|
||||
3. Exploitation / gaining access: attempt to access and take control of target
|
||||
devices
|
||||
|
||||
* Malicious actors go further
|
||||
* install backdoors and rootkits
|
||||
* cover tracks with covert channels, log editing...
|
||||
Loading…
Reference in New Issue