Archive for the ‘Penetration Test’ Category
Posted by ChrisJohnRiley on December 10, 2008
SANS SEC:709 – Developing Exploits for Penetration Testers – Day 2
I didn’t get a chance to post up my thoughts on the second day of the SEC:709 class before leaving London, so here’s a quick recap of the second day.
Today we began looking at the Windows side of exploit writing. Although in theory things are slightly harder with Windows exploitation than with Linux (at least at the level we were working at), things seemed to click on the second day. Whereas the first day was new concepts mixed with exercises to show how things work, the second day looked at the same points made in day 1 from a Windows standpoint. The examples were a chance to review some points from day 1 in a new light, and introduce some new points. The day was finished off with a Capture the Flag. Most people managed to get a couple of flags at least, but with the limited time, and a raging brain ache from “drinking from the fire-hose” so to speak, it was slow going. One person managed to get almost all the flags, which was impressive given the time spent learning these points. I guess with some more reviewing of the topics and some practice, I’ll be able to get the hang of this mystical side to penetration testing and security research.
Overall the course was very fun. As it’s a 700 level course (from my understanding SANS does 400, 500, 600 and now 700 level courses. 400 being the basics, through to 700, which is, more than a little advanced) so you get what you ask for. It’s high-tech from moment 1, and the pace is fast and furious. It’s not one of those courses where you can get into class 10 minutes late from lunch and still catchup. If you miss a concept, then everything that follows will be that much harder to grasp. Stephen Sims (the class author and the teacher for the London class) is looking to take the class to 4 days. I think this would make the concepts easier to grasp, as more time could be spent in labs to drill the concepts into your head. One of the other facilitators (class helpers, of which I was lucky enough to be one) said that the 4 day course should be the contents from days 1 and 2 repeated twice 
. Still Stephen said he wants to put more into the 4 day course. So keep your eyes peeled for that in the near future.
Overall my time in London was great. I managed to meet some really smart people, and the SANS Christmas dinner was really fun. Working as a facilitator for a SANS conference is fun, but a lot of work. If you’re thinking of try it out, expect a lot of >12 hour days, and bleeding fingers. Still, from my experiences it’s 100% worth it. Just getting a chance to work with the SANS instructors and staff is reward enough. If anybody will be attending the upcoming SANS Munich 2009 (June/July time) then looking for a stressed and tired looking facilitator, it’ll probably be me…
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 709, Exploit, exploitation, GIAC, Penetration Test, SANS | Leave a Comment »
Posted by ChrisJohnRiley on December 8, 2008
SANS SEC:709 – Developing Exploits for Penetration Testers – Day 1
Day 1 of the SEC:709 course is finished. Before I give some points on the course, I want to say that I’m not a coder, and to be honest, scripting is enough of a challenge for me. So, when I said I’d facilitate for the course, I knew things would be above my head. Still, 50% through and I’m surprised at how much clearer things seem.
Day 1 covered the Linux side of exploit writing, as well as covering the basic points needed for tomorrows trip into the world of Windows. The pace is hectic and fast paced. Then again, with the amount to cover and the topics being highly technical (this is a SANS 700 level course), the exercises will need to be redone, and redone, and then once more to be sure. These are not the kind of labs you can GET in one try. Sure some of the basics fit together without too much brain ache, but the more advanced (well advanced for me) stuff will need some more work.
If you’re a penetration tester who wants to move beyond Metasploit and into the world of custom proof of concepts, then this is a great introduction. No 2 day course will take you from A to Z, but this one will give you the foundation to build on. I’ll let you know how day 2 does tomorrow… that is, if I survive
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 709, Exploit, exploitation, GIAC, Penetration Test, SANS | 2 Comments »
Posted by ChrisJohnRiley on December 6, 2008
SANS Web App Penetration Testing and Ethical Hacking Class – DAY 4
DAY 4:
Today was a long day… my hint for a SANS conference in Europe, is never going drinking with Terry Neal. No, seriously, save yourself before it’s too late Still, it’s amazing what you can accomplish on 4 hours of sleep.
Today was finally the Exploitation day… and as we know exploitation is always the fun part (insert evil laugh here). The coverage of a WordPress vulnerability from last year was interesting, but needed a little bit more in-depth explanation of how it functions. Due to the limitation of the class running time though, I think that wasn’t really a possibility. Still, consider it as homework Although this was a lab designed to cover blind SQL injection, the use of a pre-written script for the lab was a little disappointing. I’d like to have seen something with SQLBF or SQLmap personally.
The section on advanced script injection covered a lot of what I came to the course for. If I had a choice the whole 4 days would have been at this level. At the very end of the day we looked at a couple of exploitation frameworks (Attack API, BeEF and XSS Proxy). I’ve not had a chance to play with these much before, so it was good to get some hands-on time with the tool. Although I would have liked to look more at the Atack API setup and configuration. BeEF looks good, but lacks some functions that would improve the functionality. Given the chance I’ll write up some modules to fill the gap.
Overall the course was enjoyable, although a little basic for people already doing web-app testing on a regular basis. I’m looking forward to seeing how the SEC:542 course changes when it goes 6 days (see next years conference lists). I’m expecting something special from the InGuardian guys.
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 542, GIAC, Penetration Test, penetration testing, SANS, web app | Leave a Comment »
Posted by ChrisJohnRiley on December 5, 2008
SANS Web App Penetration Testing and Ethical Hacking Class – DAY 3
DAY 3:
Well day 3 has begun, and we’ve passed the half way mark. I’m expecting some serious in-depth parts over the next 2 days. The presentations last night were really interesting. Raul covered Bluetooth attacks, which was interesting on a number of levels. Some people attending didn’t seem to get it from a business point of view. The opinion of one person was that the manufacturers won’t make a more secure version of these devices because it would cost more, and therefore not get enough market share to be effective. A typical argument against security. What he failed to understand was that this is a business problem. As nasty as it is to have your conversations listened to, the real return on investment for attackers lays with attacking businesses. Therefore businesses need to demand the extra level of security for their Bluetooth devices, even if it costs €5 more than a normal device. This will filter down to the cheaper handsets, headsets and other devices after a while, and secure even the lowest end of the market. The second presentation covered NIC and Graphics card firmware, and what can be done to attack and control the firmware in these devices. An eye opener indeed, especially when you learn that an infected firmware can use PCI to PCI communications to bypass your firewall entirely. It’s still a little beyond today’s attackers to use this avenue, but it’s something well within the boundaries of a large government or well financed crime syndicate. Something to look out for in the future…
The day kicked off with some basics on user enumeration. The Burp suite byte/word level page comparison is interesting, and something I’ve used before for cookies, but not for comparing 2 server responses. Coverage of the usual suspects, SQL Injection (including blind SQL injection), Cross-Site Scripting and Cross-Site Request Forgery. The coverage on Web Services was a little sparse for my liking. We’re going to start seeing more of these in the wild during tests, and a in-depth overview with examples would have been nice. Still, you can’t have it all. I think we could have done with some more hands on today, but hopefully we’ll cover some of that in tomorrows Exploitation day
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 542, GIAC, penetration testing, SANS, sec, web app | Leave a Comment »
Posted by ChrisJohnRiley on December 5, 2008
SANS Web App Penetration Testing and Ethical Hacking Class – DAY 2
DAY 2:
Well after a evening drinking on a Thames riverboat, it’s time for day 2 of the Web App course. We begin by covering the usual suspects in recon. A few slides on Google hacking (even stuff I’ve not seen on G groups hacking) and then onto whois, DNS and fingerprinting the remote server. This is all pretty much basic stuff. It seems these topics end up in every class on penetration testing, as the content was covered in SEC:560 as well.
The afternoon covered a little more in-depth stuff, including the use of transparent proxies, and the comparison between the various proxy tools available. Some more information on the RATSPROXY would have been nice, but I guess we can’t cover them all. It’s the small gems that make the course worthwhile for me though. The w3m tool for example. Using it with the -dump command allows you to strip out the HTML tags from a page. This is great for forming wordlists from spidered sites.
w3m -dump index.html > index.txt
Second gem for the day, Wireshark display filters for HTTP content. I’ve not had much call to play with these in the past, another thing on the list as always. Things like “http.content_type contains “jpeg”” “http.response.code == 404” and “http.user_agent contains Wget” are great (incase you wondered, jpeg is a reserved word in Wireshark, so needs to be in quotes). If you’re using the contains option though, it’s case sensitive. To make things easier you can use “lower(http.user_agent) contains wget” to make everything lowercase for the matching process. This kind of thing makes me want to play with Wireshark and TCPDUMP filters some more. Sad, but true….
These kinds of display filtering would come in handy for large captures, like those you make when performing a penetration test. After all, we all capture all traffic while we’re doing a penetration test, right
A quick look at the session and cookie analysis of WebScarab and day 2 is over. I’d like to have seen Burp Suite as the analysis tool of choice personally. The Burp analysis of cookie values is so much more in-depth than the single spread chart provided by WebScarab. Still, each to their own.
Things are warming up. Start slow and end fast, that’s what I say
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 542, GIAC, penetration testing, SANS, web app | Leave a Comment »
Posted by ChrisJohnRiley on December 4, 2008
SANS Web App Penetration Testing and Ethical Hacking Class – DAY 1
DAY 1:
The first day on most classes of this type seems to be a basic outline day. As usual everybody needs to be at the same level for the remaining 3 days of the course, this is a must. Overall the first day covered things that most people who work as a penetration tester will already know. Then again, there are others moving into this area that need the review. A review on the HTTP METHODS was interesting, especially the section on the CONNECT method. The real benefit for me though was the detailed run-through of the authentication options. I managed to get a few minutes to read through the RFC on Digest Authentication and reenact the challenge response process at the command line (using openssl with the MD5 option). It’s always good to understand how it works behind the scenes.
Raul Siles has a good teaching style (as I learned in the VoIP Security class) so I’m looking forward to the next 3 days. I’m hoping for a couple of nuggets of pure gold from the course. We’ll see how days 2,3 and 4 go.
Update: From comments on Twitter it looks like Ed Skoudis is working on an update to the class. From what I’ve heard it looks like it will be a 6 day class in the future, so should cover some more in-depth topics in later versions of the class.
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: 542, GIAC, penetration testing, SANS, web app | 1 Comment »
Posted by ChrisJohnRiley on December 4, 2008
While at the SANS London conference I attended the VoIP Security class held by Raul Siles. VoIP is not a small topic, and the field is still in flux when it comes to security. We had 2 days to cover a range of topics, and to fit it all into the 2 days the course was run bootcamp style (9am to 8pm). Overall I got a lot out of the course, in particular the lab exercises and the review of the underlying protocols (SIP and RTSP).
The first day lays the foundation by reviewing the protocols, and learning the networking side of VoIP security. The second day concentrates more on attacks against the environment, and where possible, remediation to defend against these attacks. As theVoIP arena is in flux, and growing day by day, the solutions are not 100%. However a majority of issues are covered from both attack and defence viewpoints.
Overall I though the course was well formed, although it could do with a little less theory and more on the hands on side. After all, we can all read a book on the theory side, but not everyone has the facilities to do the hands-on exercises. This is the first time theVoIP course has been done in Europe, so I hope they take our comments back and streamline the course for future attendees.
Next is the Web App Penetration Testing and Ethical Hacking class (SEC:542)
Posted in Conference, Penetration Test, Security, Study, Technology | Tagged: SANS, Security, voip | 1 Comment »
Posted by ChrisJohnRiley on November 25, 2008
I finally had the chance to catch up on a couple of the OWASP videos over the past few days. Of all the presentations, the one from Chris Eng entitled “Cryptography for Penetration Testers” jumped out at me as a good watch. The information contained in the 45 minute presenation is something that I know personally will be very useful to me as a penetration tester. I would encourage anybody interested in Web-Application penetration testing but not so much into the maths behind encryption, to take the time to watch. It’s a lot to take in at once, but a couple of pauses and a copy of the slides make things a lot easier to understand.
Video / Slides (HQ)
Posted in Penetration Test, Security, Study, Technology | Tagged: cryptography, owasp, penetration testing | Leave a Comment »
Posted by ChrisJohnRiley on October 16, 2008
Lots of people are aware of the Exploitme Firefox plug-ins (xssme, SQLInjectme, accessme) from Security Compass. I’ve used these tools on a couple of occasions for quick and dirty checks before looking at things in more depth. However, since the move to Firefox 3, the exploitme plug-ins haven’t been available. That is, until now. The guys at Security compass have just released new versions of the plug-ins for FF3 users. The new versions seem to be better designed, allowing you to kick off a test and still use your browser. That’s a step in the right direction, as the old plug-ins took total control of the browser to perform the checks.
http://securitycompass.com/exploitme.shtml
Have fun…
Posted in Penetration Test, Security, Technology | Tagged: exploitme, penetration testing, tool | Leave a Comment »
Posted by ChrisJohnRiley on September 19, 2008
I’ve recently passed the big 6 month mark as a penetration tester. It doesn’t seem like much in the scheme of things, and it certainly doesn’t give me the right to preach to you. It has however made me think about what I’ve really learned since starting work as a full-time penetration tester. In the true style of incident responders, I’ve entered the “lessons learned” phase, and here’s what I came up with (in no particular order) .:
- The report is the most important part of a test.
- Exploits are only a small peice of what a penetration test is all about.
- If you don’t understand the protocols, all is lost. RFC’s are your friend here.
- Testing your tools and exploits before a test is more than just a good idea.
- Writing testing notes in a notebook may seem old fashioned, but it really helps.
- Charts and Screenshots make people go “Ooooh” when they read the report.
- No matter what you say in the final report, someone will always disagree on some point or another
- Linux is your friend. Windows is also your friend, albeit a slightly slower friend that annoys you at times.
- When you test something and can’t find a weakness, this is not a bad thing… and yes the good parts should also be in the report.
- No one person can know everything (except Ed Skoudis) so knowing where to find the facts, and who to ask is an important skill to possess.
With the above said, I’ll try and expand on a few of these points in the coming weeks.
Happy hunting…
Posted in Penetration Test, Security, Study, Technology | Tagged: Penetration Test, penetration testing, Security | 3 Comments »
