Printable View
Im looking to do a remote pen test on an active server of mine running Redhat 7.3. I was wondering if anyone could provide assisantce on how to go about this by conducting the test myself. I was wondering if you knew any links and stuff to cover scanning and emmeration. Thanks
There are several ways to Enumerate (check your spelling) an OS. Since you already know it is Red Hat 7.3 you can check out Bugtraq and know exactly what to look for. Founstones' Hacking Exposed (TM) books devote entire chapters to tools and usage for enumeration. Although that shouldn't be necessary since it is your box and you know the OS and presumably what services are running.
However, for a simple Pentest just use nessus:
http://www.nessus.org/
It will do it all for you and give you tips on how to fix it.
I agree with gump. Nessus is a great tool for remote vul testing.
However... don't do just remote... check your local too..
I've found Tiger to be a great tool for this.
http://freshmeat.net/projects/tiger-audit/Quote:
TIGER is a set of Bourne shell scripts, C programs, and data files which are used to perform a security audit of Unix systems. The security audit results are useful both for system analysis (security auditing) and for real-time, host-based intrusion detection.
I've found it to be very useful when securing a box...
Download it from http://savannah.nongnu.org/download/tiger/
SARA is also a great tool... however, its a bit outdated?
Still has useful info. Not quite as good as nessus though.
http://www-arc.com/sara/sara.html
Also, examine your services. There are vuln scanners based just on services... cgi scanners, http scanners, etc. Sometimes they will give you more detailed info.
Greetings All:
I have never understood the logic of people that do their own penetration tests.
You set up a server to the best of your ability and the limits of your knowledge, then you examine it for vulnerability based on that same skill set and knowledge base? What is that supposed to accomplish?
It would seem to me, if you're lacking proficiency in an area when you set up the server, you would lack the same proficiency in finding the error you made in the first place?
Sure there are a bunch of point-and-click, or type-command-and-hit-enter vulnerability scanners available, but each checks for its own set of things. Again, for the most part you're only going to be checking for things that you know to look for.
I've found it to be much more beneficial, when the need is not significant enough, or the budget isn't big enough, to have a professional do a penetration test, to simply have a friend or colleague that you trust do one for you.
At the very least, you know that someone's looking at your system that has a different knowledge base about him or her, and that will be seeing things from a different perspective than your own.
Redemption. If you'd like, I can run a non DoS Nessus scan against your host. PM me with the details (IP, etc.)
JP indeed thats true for most pen test you'd be much better off having a second or third person doing the audit. If you're patching up certain holes, I believe its ok to do your own penetration test by using tools which exploit those holes. One thing that many users will do though, is run the tests from the same box that they're patching up. Correct me if I'm wrong but wouldn't it be much more effective and productive running the tests from a computer outside the network. At least run the test from an outside computer first then check for intrusion from inside the network.
Quote:
Originally posted here by JP
Greetings All:
I have never understood the logic of people that do their own penetration tests.
You set up a server to the best of your ability and the limits of your knowledge, then you examine it for vulnerability based on that same skill set and knowledge base? What is that supposed to accomplish?
It would seem to me, if you're lacking proficiency in an area when you set up the server, you would lack the same proficiency in finding the error you made in the first place?
Sure there are a bunch of point-and-click, or type-command-and-hit-enter vulnerability scanners available, but each checks for its own set of things. Again, for the most part you're only going to be checking for things that you know to look for.
I've found it to be much more beneficial, when the need is not significant enough, or the budget isn't big enough, to have a professional do a penetration test, to simply have a friend or colleague that you trust do one for you.
At the very least, you know that someone's looking at your system that has a different knowledge base about him or her, and that will be seeing things from a different perspective than your own.
A few years back, this would be a valid argument/position. Today, there are so many tools that "do it all for you" that an indepth understanding is no longer a requirement when doing pen testing. A perfect example of this is when auditors show up on-site with 100K worth of vulnerability assessment software yet none of them know what a PGP key is.
While I am from the oldskool and truly believe that you should be an expert when doing these sort of things, current industry conditions dictate otherwise.
Oh! oH! I wanna be old school!! I am looking into stuff so I can be l337 like horse :P. It's not very fun to pen-test by running someone else's little proggy.
-Cheers-
I've found that before going to outside sources to do pen testing, doing it myself is most useful - Nessus told me several things I wasn't aware of and that then allowed me to take action before I 'phoned a friend'Quote:
Originally posted here by JP
Greetings All:
I have never understood the logic of people that do their own penetration tests.
Actually, using the right tools it can accomplish a lot, since most are updateable to test for the latest exploitsQuote:
You set up a server to the best of your ability and the limits of your knowledge, then you examine it for vulnerability based on that same skill set and knowledge base? What is that supposed to accomplish?
Not entirely accurate JPQuote:
It would seem to me, if you're lacking proficiency in an area when you set up the server, you would lack the same proficiency in finding the error you made in the first place?
Sure there are a bunch of point-and-click, or type-command-and-hit-enter vulnerability scanners available, but each checks for its own set of things. Again, for the most part you're only going to be checking for things that you know to look for.
That's the beauty of using the automated tools - you are relying on the authors' proficiency in vunerability testing, and the more tools you use, the more proficiency you will bring to bear. Better still most tools (nessus esp.) will tell you about the problem and then either tell you how to resolve it, or point you in the direction of further info. Contrary to what you are suggesting, the use of these tools will actually improve your proficiency & knowledge.
Using nessus pointed out a low risk problem with my SSH - First fixing the problem and then further reading had important benefits.
1) I gained more knowledge, enough to use private keys for ssh authentication, disabling password authentication so that disctionary/brute force is not now a concern. I use a usb flash drive for physical security to store the key on.
2) I wrote a basic tutorial on SSH here.
3) Further research assisted me understanding SHFS and another tutorial here.
I think I've heard it mentioned before that you should never perfrom vunerability/pen testing without a contract ;)Quote:
I've found it to be much more beneficial, when the need is not significant enough, or the budget isn't big enough, to have a professional do a penetration test, to simply have a friend or colleague that you trust do one for you.
I don't want to knock the benefits of getting someone else to do the testing as well, but don't understimate the value of doing it yourself.Quote:
At the very least, you know that someone's looking at your system that has a different knowledge base about him or her, and that will be seeing things from a different perspective than your own.
Steve
I'm inclined to agree with JP.... But only up to a point. I also agree with others that have taken issue with him too...... I'm a fence-sitter you see..... ;)
It really all comes down to skill/knowledge level. Even if you are not proficient in certain areas if you have a level of knowledge that allows you to understand the potential threats and comprehend a deficiency and be able to mitigate it yourself then doing a pen test yourself will probably result in you selecting various tools that you know will work in slightly different ways, that will cover the entire spectrum and will result in a thorough test of the exposed system. OTOH, if your base of knowledge is only sufficent to be able to set up you shiny new web server so that it serves pages to the public network then I side with JP. You simply aren't aware of the threats _and_ you don't know the tools that will enumerate them for you. Even if you get lucky and use a tool that enumerates a threat you probably don't understand it and are therefore less likely to be able to mitigate said threat.
Best practice, (at least the versions of it I have read), indicate that a professional, independent security audit should take place when your systems first become exposed to the public network, every three years subsequent and any time significant changes take place in the general structure/stance of those exposed assets. In the two years between independent audits a thorough annual audit should be carried out by qualified IT staff.
I recently altered significantly the stance of my exposed machines. Best practice says I should have spent the reather large quantity of cash to have an independent audit.... But I work for a non-profit...<sigh>... so I can't afford the big bucks required for that. So I took a two pronged approach. I thoroughly audited my systems myself from the inside prior to opening the firewall to the boxes and immediately after. This was just to make sure that I hadn't made a mistake. Then I took Hoss up on his offer of a scan by him. I granted him permission on a proper fashion, laid out what was acceptable and what was not and let him go ahead. I'm far from a lawyer but the sanitized text below is what I wrote to him and I believe it covers both our rears.
When I asked Hoss for his assistance I was actually quite confident that he wasn't going to find anything I don't already know about. He didn't. But there is nothing quite like that warm fuzzy feeling you get knowing that you are right..... :cool:Quote:
I, "Tiger Shark", (name replaced), Manager of Information Systems for xxxxxxxx company in Detroit, MI authorize you to run non-invasive and non-destructive scans using NMap, Nessus and any other non-destructive tools you wish to determine the systems and services that are accessible from the public internet on the server located at XXX.XX.XXX.XX only. Your scans and techniques are to be restricted to determining what is available, whether it could be exploited without actually carrying out the exploits themselves. Denial of Service, (DoS) attacks are not to be used be they of the bandwidth consumption methods, crashing/overworking exposed services or any other DoS against that IP address or any other IP you may find within the address block.
So you can "do it yourself", you can have competent friends do it and you can have high priced professionals do it too. When you get right down to it though you, and only you, determine the quality. If you don't know what is required in the first place you will end up getting it wrong or spending far too much and have too much "sold" to you by "professionals" who, in some cases, know how to talk a good game but their proficiency stops there... But you can't tell that if you don't know what is required and acceptable in the first place.
Preach on brother Tiger... LOL.
Yes, I also approach friends in the industry (in the same fashion that Tiger and I worked his scan) and have them give a crack at my internet facing servers. Typically they just verify what I already know (again, just like in Tiger's case) and then I feel very confident that I have been thorough in my tasks.
My post wasn't exactly an opposing stance to JP's but rather a realistic glimps into what the industry has degraded to (in my humble opinion of course).
Quote:
My post wasn't exactly an opposing stance to JP's but rather a realistic glimps into what the industry has degraded to (in my humble opinion of course).
See this is the root of the whole problem. It is very true also. You give somebody who has no real desire at all a degree. Then s/he goes and works for Midnight Oil Server Company. They set up some stuff for your business. Two weeks later when your servers get owned, you realize all they have is a generic degree. Which allowed them to plug in all your ****, and then run a few config utilities. Out of the box techs.
Long and the short. I disagree with you Jp 100%. The industry has degraded alot. Hell I don't even work in the business and I can tell you that. When I have been "gaming" with the admin at my place of employment for a few months now. Using the same "feature in IE" to do what ever I want to his time clock computers via systemroot in the address line. But he is a MSCE.
What I am saying is this. If you allowed your friend to check your set up. You might as well of checked it yourself. Chance are he knows and proably cares as much as you do. With the exception of a 10% group which if you look around here you will find alot of these folks.
That is why we use tools like Nmap. When is the last time you or one of your friends wrote a tool even compariable to Nmap? (I withdraw my question if you personally know fydor [spelling of handle?])
Be safe and stay free
Well, that's all fine and dandy Steve, use automated tools, and learn things. Great! I just know that I wouldn't want it to be the security of MY company or MY servers that you're using these automated systems on so that you can "improve proficiency & knowledge".Quote:
Originally posted here by steve.milner
Not entirely accurate JP
That's the beauty of using the automated tools - you are relying on the authors' proficiency in vunerability testing, and the more tools you use, the more proficiency you will bring to bear. Better still most tools (nessus esp.) will tell you about the problem and then either tell you how to resolve it, or point you in the direction of further info. Contrary to what you are suggesting, the use of these tools will actually improve your proficiency & knowledge.
Steve
Live servers on live networks that are performing real work for real companies or real projects are not the place to be playing around to "improve your proficiency & knowledge". That's what test bed networks and your lan at home are for.
I think that the points that you made in your post do little but to bolster my point that it's incredibly beneficial to have others do penetration tests for you.
BTW: The little thing with you keeping your ssh keys on a usb drive to keep them "safe" is absolutely adorable. Unforunately, a lot of other people think like you, and there are a bunch of trojans out there now that exist for the single purpose of downloading all of the important information that people keep on these things the second they're plugged in, then shipping it off to a host computer somewhere. Data is no safer on these than it is on your hard drive. And data on both are only as safe as the security of your system and network are.
For one, it points out the flaws in your skillset and lack of knowledge regarding specific issues. People should do their own penetration testing for the same reason developers should do their own alpha testing: To pick up on the rather obvious things that can be overlooked.Quote:
Originally posted here by JP
I have never understood the logic of people that do their own penetration tests.
You set up a server to the best of your ability and the limits of your knowledge, then you examine it for vulnerability based on that same skill set and knowledge base? What is that supposed to accomplish?
Who said it had to be as a consultation, where a third party is being put at risk?Quote:
Originally posted here by JP
Well, that's all fine and dandy Steve, use automated tools, and learn things. Great! I just know that I wouldn't want it to be the security of MY company or MY servers that you're using these automated systems on so that you can "improve proficiency & knowledge".
Of course, you are 100% correct. Pen-testing on live systems is utter foolishness IMO. I don't see what was said that contradicted that idea.Quote:
Live servers on live networks that are performing real work for real companies or real projects are not the place to be playing around to "improve your proficiency & knowledge". That's what test bed networks and your lan at home are for.
As a second step yes, but if a tool catches something incredibly obvious, or even a slight oversight, then why not? Where is the harm in doing it yourself?Quote:
I think that the points that you made in your post do little but to bolster my point that it's incredibly beneficial to have others do penetration tests for you.
An in-depth understanding is no longer required for any sort of security/vulnerability testing -- network-wise, system-wise, or even in the context of app development. There are so many tools out there for all areas it is literally becoming a job for people who are semi-computer literate. It's not a good thing IMO.Quote:
Originally posted here by thehorse13
A few years back, this would be a valid argument/position. Today, there are so many tools that "do it all for you" that an indepth understanding is no longer a requirement when doing pen testing. A perfect example of this is when auditors show up on-site with 100K worth of vulnerability assessment software yet none of them know what a PGP key is.
I agree, too many people are eager to wave around their paperwork which proves they passed some such cert or other, but are incapable of doing much more than working with a specific application or set of applications, and have little knowledge in whichever field they are doing this sort of thing in.Quote:
While I am from the oldskool and truly believe that you should be an expert when doing these sort of things, current industry conditions dictate otherwise.
Hey Hey,Quote:
I agree, too many people are eager to wave around their paperwork which proves they passed some such cert or other, but are incapable of doing much more than working with a specific application or set of applications, and have little knowledge in whichever field they are doing this sort of thing in.
This is only part of the problem. Half the people we have are incompetent, but what about the other half? The knowledgeable people? They're so afraid of someone new coming in, that even when they are told about something or warned about something, they chose to disregard it. The problem is that IT people in general are cocky and arrogant, anyone that says otherwise is ignorant :). We see it on here all the time, I, myself, am guilty of it. We don't want to be proven wrong, or dislike being showed up. I see a lot of this at work and it really pains me to see it. My supervisor asked me the other day if I wanted to move over to Network Services for my next co-op term, and I laughed and said it would never happen. She basically said they didn't hire me because they're scared of me... in my opinion you shouldn't be afraid of knowledge... you should welcome it with open arms, however a good chunk of IT people don't do that. I've see people from NS tell me that a cisco router won't operate without a password... and I've seen people with 30 years of industry experience tell me that you can sniff all the packets on any port of a switch with ethereal. You correct these people and they just get mad, and look down on you because they have the "experience".
Personally when it comes to pen testing, I think doing it yourself first is a good idea. I say screw the high priced consultants with their "experience" who says they have good experience. We scan at the college for viruses (a good chunk of you have seen pyscan that i developped for this period). Since they won't give us a port on the switch with port monitoring enabled, we have to simply scan for viruses that open ports. However they recently took away our ability to turn off these ports, we now have to go through them (they didn't like sharing the power). Now they are challenging our finds. After I find a port open, I service fingerprint it with nmap. If i get back a fingerprint it doesn't know, I look at it and see if it's anything or if it's just kazaa on a random port. If I get an unknown with no fingerprint I assume virus (I prefer to hedge my bets and scan a few extra PCs rather than leave an infected machine). Anyways one of the viruses we scan for is the outdated Nachi/Welchia Worm because these are student machines and no one forces them to patch them. Now according to both Symantec and Trend Micro, the worm uses ports 666-765.. however most occurances are found on port 707. In my last series of scans I found a machine with port 701 open, service couldn't be identified. I put in a request to have the connection terminated (they then call us and we fix it and they are re-enabled)... however I was vetoed because NS insisted that Nachi/Welchia only opens port 707. A debate ensued and I provided sources. However, apparently Symantec and Trend Micro know nothing about viruses and the admins at NS know everything. The result is that only 707 is an accepted port... everything else we're going to let go. In this case, I'd say the little guy (me) would be a better person to have working on the system than them (the experienced people). I'd be very upset if someone said oh you've got 15 ports open.. but they aren't common ports so we're not going to worry about them.
The problem is people with experience can't be proven wrong, don't really care about their work and are only interested in the money. If you are running your own server and spending time in places like this learning more... then do the audit yourself. So what if it's a learning experience... the more you learn, the better job you'll do next time. Just make sure everything is logging and you have back-ups. If something happens and someone breaks in.. restore... read the logs and you've learned a little more. If you pay someone to come in and do it for you... you are never going to learn anything.. and they could be sloppy and miss.. or not care.. about a bunch of things. Audit yourself, get a friend to do it.. hell get a second friend to do it... You don't want to be hacked/cracked... no one does, however look around the internet. It happens quite often... to many people. If it happens to you... you won't be the first and you definately won't be the last.
Peace,
HT
HT: I don't disagree with your summation of many in the IT field.
What follows is a broad generalization and will probably badly put..... read into it to understand what I am saying and if you match the characteristics.... Don't be offended..... Learn from it - you'll be a better "geek" in the end..... ;)
Most of the people, especially those that have been around for a while, are not the most outgoing, well liked by their peers "college quarterback" types. For many computers were something that "evened their playing field". They were a place they could "excel", (compared with others), and competition was not something that was an issue. Many got their jobs on the fact that they were some of the few who could make the computers work. Many of them suffered from some misconceptions such as those that HT mentioned but since there was no-one around that knew what a Cisco router was the misconception could never be challenged. Having spent enough time in this "godlike" place it is easy to begin to begin to believe that you are special, always right and irreplacable.
Times have changed and while the times still generate similar kinds of people the industry is a lot more "open" than it was several years ago. The "old hacks" are still there, in more powerful positions, carrying the same bad information and having not learned a lot of the new stuff, (or not learned it well enough). Now they are confronted with the young "hotshots". Kids that grew up with computers from the time they could walk. A far greater proportion of these "young un's" are the antithesis of the "old hacks", they are outgoing, well liked by their peers, "quarterback" types. They aren't afraid, (like the "old hacks" were when they started), to challenge misconceptions and misinformation.
After many years in the "godlike" state, with their often errant ideas firmly in place these people are scared. After all these years of harboring the misinformation unchallenged the one thing they did learn is economics..... It's cheaper and more efficient to hire a young "hotshot" who knows his stuff than it is to pay the aging "hack" who has built a nice salary over his years of tenure that isn't necessarily getting the best out of the network. That's a bloody scarey thought for many. Couple that with the "normal" personality of the older "hacks" and you find that their only means of maintaining their position and "godlike" status is to protect it by keeping the "hotshots" at arms length. Don't grant them access to things they they know may be wrong, don't listen to what they have to say - do what you always did - issue an edict that doesn't really make sense but that protects your "godlike" status.
It's all quite understandable if you look at the personalities involved. It's not right, far from it, but it's one of those nasty little facts of life. "Godlike" status _must_ remain unchallenged because it always has. Any challenge to the "godlike" status must be quashed for fear of being proven a false 'god".
These people are the bain of our industry, but they are there, they are entrenched and there's no-one who's going to do anything to remove them because they have trusted them for years..... Therefore they must be right.