Cатсн²² (in)sесuяitу / ChrisJohnRiley

Because we're damned if we do, and we're damned if we don't!

Tag Archives: 542

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 4

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 4

DAY 4:

Today was a long day… my hint for a SANS conference in Europe, is never going drinking with Terry Neal. No, seriously, save yourself before it’s too late 😉 Still, it’s amazing what you can accomplish on 4 hours of sleep.

Today was finally the Exploitation day… and as we know exploitation is always the fun part (insert evil laugh here). The coverage of a WordPress vulnerability from last year was interesting, but needed a little bit more in-depth explanation of how it functions. Due to the limitation of the class running time though, I think that wasn’t really a possibility. Still, consider it as homework 😉 Although this was a lab designed to cover blind SQL injection, the use of a pre-written script for the lab was a little disappointing. I’d like to have seen something with SQLBF or SQLmap personally.

The section on advanced script injection covered a lot of what I came to the course for. If I had a choice the whole 4 days would have been at this level. At the very end of the day we looked at a couple of exploitation frameworks (Attack API, BeEF and XSS Proxy). I’ve not had a chance to play with these much before, so it was good to get some hands-on time with the tool. Although I would have liked to look more at the Atack API setup and configuration. BeEF looks good, but lacks some functions that would improve the functionality. Given the chance I’ll write up some modules to fill the gap.

Overall the course was enjoyable, although a little basic for people already doing web-app testing on a regular basis. I’m looking forward to seeing how the SEC:542 course changes when it goes 6 days (see next years conference lists). I’m expecting something special from the InGuardian guys.

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 3

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 3

DAY 3:

Well day 3 has begun, and we’ve passed the half way mark. I’m expecting some serious in-depth parts over the next 2 days. The presentations last night were really interesting. Raul covered Bluetooth attacks, which was interesting on a number of levels. Some people attending didn’t seem to get it from a business point of view. The opinion of one person was that the manufacturers won’t make a more secure version of these devices because it would cost more, and therefore not get enough market share to be effective. A typical argument against security. What he failed to understand was that this is a business problem. As nasty as it is to have your conversations listened to, the real return on investment for attackers lays with attacking businesses. Therefore businesses need to demand the extra level of security for their Bluetooth devices, even if it costs €5 more than a normal device. This will filter down to the cheaper handsets, headsets and other devices after a while, and secure even the lowest end of the market. The second presentation covered NIC and Graphics card firmware, and what can be done to attack and control the firmware in these devices. An eye opener indeed, especially when you learn that an infected firmware can use PCI to PCI communications to bypass your firewall entirely. It’s still a little beyond today’s attackers to use this avenue, but it’s something well within the boundaries of a large government or well financed crime syndicate. Something to look out for in the future…

The day kicked off with some basics on user enumeration. The Burp suite byte/word level page comparison is interesting, and something I’ve used before for cookies, but not for comparing 2 server responses. Coverage of the usual suspects, SQL Injection (including blind SQL injection), Cross-Site Scripting and Cross-Site Request Forgery. The coverage on Web Services was a little sparse for my liking. We’re going to start seeing more of these in the wild during tests, and a in-depth overview with examples would have been nice. Still, you can’t have it all. I think we could have done with some more hands on today, but hopefully we’ll cover some of that in tomorrows Exploitation day 😉

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 2

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 2

DAY 2:

Well after a evening drinking on a Thames riverboat, it’s time for day 2 of the Web App course. We begin by covering the usual suspects in recon. A few slides on Google hacking (even stuff I’ve not seen on G groups hacking) and then onto whois, DNS and fingerprinting the remote server. This is all pretty much basic stuff. It seems these topics end up in every class on penetration testing, as the content was covered in SEC:560 as well.

The afternoon covered a little more in-depth stuff, including the use of transparent proxies, and the comparison between the various proxy tools available. Some more information on the RATSPROXY would have been nice, but I guess we can’t cover them all. It’s the small gems that make the course worthwhile for me though. The w3m tool for example. Using it with the -dump command allows you to strip out the HTML tags from a page. This is great for forming wordlists from spidered sites.

w3m -dump index.html > index.txt

Second gem for the day, Wireshark display filters for HTTP content. I’ve not had much call to play with these in the past, another thing on the list as always. Things like “http.content_type contains “jpeg”” “http.response.code == 404” and “http.user_agent contains Wget” are great (incase you wondered, jpeg is a reserved word in Wireshark, so needs to be in quotes). If you’re using the contains option though, it’s case sensitive. To make things easier you can use “lower(http.user_agent) contains wget” to make everything lowercase for the matching process. This kind of thing makes me want to play with Wireshark and TCPDUMP filters some more. Sad, but true….

These kinds of display filtering would come in handy for large captures, like those you make when performing a penetration test. After all, we all capture all traffic while we’re doing a penetration test, right 😉

A quick look at the session and cookie analysis of WebScarab and day 2 is over. I’d like to have seen Burp Suite as the analysis tool of choice personally. The Burp analysis of cookie values is so much more in-depth than the single spread chart provided by WebScarab. Still, each to their own.

Things are warming up. Start slow and end fast, that’s what I say 😉

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 1

SANS Web App Penetration Testing and Ethical Hacking Class – DAY 1

DAY 1:

The first day on most classes of this type seems to be a basic outline day. As usual everybody needs to be at the same level for the remaining 3 days of the course, this is a must. Overall the first day covered things that most people who work as a penetration tester will already know. Then again, there are others moving into this area that need the review. A review on the HTTP METHODS was interesting, especially the section on the CONNECT method. The real benefit for me though was the detailed run-through of the authentication options. I managed to get a few minutes to read through the RFC on Digest Authentication and reenact the challenge response process at the command line (using openssl with the MD5 option). It’s always good to understand how it works behind the scenes.

Raul Siles has a good teaching style (as I learned in the VoIP Security class) so I’m looking forward to the next 3 days. I’m hoping for a couple of nuggets of pure gold from the course. We’ll see how days 2,3 and 4 go.

Update: From comments on Twitter it looks like Ed Skoudis is working on an update to the class. From what I’ve heard it looks like it will be a 6 day class in the future, so should cover some more in-depth topics in later versions of the class.