Vulnerability and Penetration testing

I have this new project in which i am involved at moment. We have to develop a methodology for penetration testing of Internet, extranet and any remote connection modules.

The objective of External Penetration and Vulnerability Testing is to
measure the exposure of online services to attacks from the Internet and
other external access points, and evaluate the effectiveness of our network
controls, including firewalls, routers, IDS and servers, to guard against
such attacks.

I would like to identify vulnerable entry points into the network through various
Internet and Extranet links as well as dial-up access and other untrusted
connectivity. While doing all this i thought it would be good idea to test all web apps and
databases for any known problems.

Does anyone have any advice how would one go about doing this? What else am i missing?
When we get to actual testing should we use any commercially available products? Any
good links on Locking down RADIUS servers? Do you think its worth getting someone from
the oustide as the consultant to help out?

Or just any advice or suggestion on the topic would be helpful.

Quote:

---

Do you think its worth getting someone from the oustide as the consultant to help out?

---

Definitely.. For several reasons, the first being objectivity.. Second being experience.. Third, you get to watch and learn from a pro ;)

But for some more info on the subject, did you take a look through the SANS reading room?

If you have to do it yourself make sure you get your 'liability waiver' letter (stay out of jail card) from SENIOR management. You have to make sure you are clear of blame should your testing damage/incapacitate/slow the network.
You'll probably also need written permission from your ISP.

Hey,

I have attached a report on Penetration testing , May be it will help.

MRG.

Thanks to evreyone who replied.

<quoting SirDice's thoughts on this>

...first being objectivity
Absolutely. "Oh, I built that server myself last week and secured it to the XYZ standard. I *know* it's ok, let's save time and not scan it..."

...Second being experience
Have you ever installed, configured, and run NMAP, Nessus, Nikto, Watchfire, Websphere, etc.? Daunting task, just to learn to make them all work and get accurate results back, for a proper evaluation. Then using them to perform a specific audit for your company? That's a lot to ask, especially if you are on a tight timeline.

...Third, you get to watch and learn from a pro
<Not knowing who all SD is referring to, I'll abstain from making any comments...just because they have business cards and can talk the talk does NOT mean they are especially good at what you need. Many companies claim to play in this area...fewer are probably quite good at doing a legitimately decent job.>

There are some underlying questions that will help you decide the best course of action.
1- Why is the company doing this? Are they really that interested in Information Security and Assurance, or are they afraid of exposure to liability (under GLBA, SOx, HIPAA, PCI, etc. ad naseum?)
2- (Probably related to 1) Is there budget to manage this project, or are they more interested in having an internal resource use his own system(s) to run the technical portion and provide a report. A consultant would simply drain on the IT budget for this internal resources group.
3- Are you willing to stake your reputation on the outcome of this endeavor, if 1 and 2 are answered unfavorably?

I'm not trying to dissuade you, I simply want you to make some informed decisions. If this is an assessment to satisfy the curiosity of the IT manager, awesome, go for it! If some C-level exec is worried about compliance but won't spend money to do things properly, CYA!

I am not sure what company you are doing the pen testing for... but don't forget, like Mitnick and several others have said, humans are often the weakest link in security... so you might want to include some social engineering attacks in the pen test.

I used to do some pen-testing back in the day.

Not only do you want someone that knows what they are doing, but you want someone who REALLY knows what they are doing.

If all they know how to do is to use Hyena to analyze your network for blank passwords (or some weak **** like that), and not actually try to "buffer overflow" anything in your network. Then they aren't doing a pen-test. A hacker wouldn't be as merciful and neither should your pen-tester.

Go all out.

Quote:

---

Originally posted here by westin
I am not sure what company you are doing the pen testing for... but don't forget, like Mitnick and several others have said, humans are often the weakest link in security... so you might want to include some social engineering attacks in the pen test.

---

Uhm, thanks and all, but he pretty clearly states what the objective of this excercise is...

"to measure the exposure of online services to attacks from the Internet and other external access points, and evaluate the effectiveness of our network controls, including firewalls, routers, IDS and servers, to guard against such attacks."

Yes, social engineering is a big deal and needs to be addressed. So is virus/malicious software that could enter the network by means of a floppy/CD/usb storage device (basically, sneakernet infection), or browsing hostile websites/servers without adequate protections. None of these are, in fact, directly related to the stated objective.

But thanks.

Yeah, I'm gonna have to agree with zencoder on that one.

I do Pen Testing here and everyone tells me that Social Engineering is a critical part of the process. I just dont include that in most of my pen testing. That comes down to security awareness for your employees. Any smooth talking individual can social engineer into anything. I know a few women that I have social engineer myself into their... well, you get my point.

The bigger concern in most cases (like what bAgZ started with) is "network controls, including firewalls, routers, IDS and servers". I prefer the good ol fashion computer based attack there! If you want to social engineer, I believe that is more of a test of your security awareness program, not your network controls.

-Deeboe

Yup, the point is he doesn't want/need an all out PenTest-crackthesystem-getinhoweveryoucan test. They want a specific and narrowly focused review of their TECHNICAL controls and solutions. Social Engineering shouldn't have anything to do with the TECHNICAL controls...maybe their use and application but again...that's a human problem, not a systems problem.

Quote:

---

Orginally posted by bAgZ

I have this new project in which i am involved at moment. We have to develop a methodology for penetration testing of Internet, extranet and any remote connection modules.

The objective of External Penetration and Vulnerability Testing is to
measure the exposure of online services to attacks from the Internet and
other external access points, and evaluate the effectiveness of our network
controls, including firewalls, routers, IDS and servers, to guard against
such attacks.

I would like to identify vulnerable entry points into the network through various
Internet and Extranet links as well as dial-up access and other untrusted
connectivity. While doing all this i thought it would be good idea to test all web apps and
databases for any known problems.

Does anyone have any advice how would one go about doing this? What else am i missing?
When we get to actual testing should we use any commercially available products? Any
good links on Locking down RADIUS servers? Do you think its worth getting someone from
the oustide as the consultant to help out?

Or just any advice or suggestion on the topic would be helpful.

---

Having done a few penetration tests - I can refer you to one online doc by ISACA that highlights some areas you have mentioned - including what some of the others have posted on - social engineering - it's amazing what can be gleaned with those tactics. Also - an outside consultant, as mentioned already, would be a novel idea - if nothing else, than to just confirm or disconfirm your plans.

Links:

ISACA: http://www.isaca.org/

ISACA doc on penetration testing and vulnerability analysis: http://www.isaca.org/ContentManageme...ontentID=18750

And as Aspman has already mentioned and I will reinforce: Ensure your methodology includes a means to obtain written permission (highest echelon of internal management) to perform any testing before any testing begins. This should be part of your plan and management and/or internal or IT Security should know approximately when you will run your tests - this is also covered in the doc from ISACA.

Let me know of any questions.

Hope this helped a lil'bit.

Deeboe - yeah right - how can you socially engineer anyone from the bingo hall? Heh.

Quote:

---

Originally posted here by genXer
Deeboe - yeah right - how can you socially engineer anyone from the bingo hall? Heh.

---

Dangit! Busted!

Well, I figure if I can social engineer the pretty geriatric runnning th ball machine, maybe she'll call my numbers. Or I'll get me some of that sweet sweet ... ummm ... don't judge me!

-Deeboe

Thanks everyone. At the moment its all just planing. I got lot of info on the net
but would appriciate any links to resources anyway. I am busy developing the whole
approcah to this which would be something like this:

1. Scope and objectives
2. Research about the target
3. Fingerprinting
4. Find vulnerabilities no tools and with tools.
5. Execution and moving further(deeper) into the network.
7. Report and analyze

I would also need to setup exact rules upfront before we begin, how far is far enough?
Should i make it grab and break all that you can or should i focus on very specific areas
what would give me better results? For example should i include DoS tests? Do we notify
managment after every problem we find or do we just proceed until we feel that we have
done enough or we feel its enough? If i test from the user point of view do i need to
hide identity or i dont care about it, this is to simulate real life attack? Should this be run
annualy or at what time frames?

Basically i am looking on some real life feed back from people who have done this sort
of thing, what were their experiences? Is there anything else i am missing?

Hey I agree with the other suggestions. Go to SANS reading room, do some social engineering but the real work is getting your corporate echelons to agree and ratify standards. We were tasked with similar exposures and had to get compliant with the SoX and ISO's real fast. Here are some of the challenges and tools:

[list=1][*] Know your assumptions of the operating environment. If the project plan says that the servers are being backed up make sure they are before exercising any of the methods.[*] Make sure you have a company adopted Security Policy - scanning and reporting gaps will mean nothing if you don't have buy in from the enterprise.[*] Create a best-practices approach to writing standards using the NSA or SANS material. Distribute these standards to the Tech teams and try to get them to ratify the standards. In most cases I had to provide the necessary remediation details and examples as well.[*] Make sure you have accurate, up to date documentation and drawings for all of your topologies and any as-built documentation.[*] Ensure that all of your router, switch and firewall configurations are being backed up to a central server on a nightly basis so the day you start auditing the configurations you know they are 0-day.[*] Download CISecurity's Router Audit Tool for Routers and PIXs and do what I did, I re-wrote all of the regular expressions configurations for the scanner to match the standards (including section titles and numbers) adopted by my organization. I have working scripts for Cisco routers, IOS switches and PIX firewalls which generate a nice website that I do some basic aesthetic clean-up with CSS afterward and allow the Network folks to access the secure site when the report is ready.[*] If you are overwhelmed by coordinating and tracking assessments and remediation have a third-party assist you in conducting the Pen-Test and VA from outside the perimeter. This is a separation of duties that should be conducted by a non-biased source. That doesn't mean you don't still have to query the in-house equipment for vulnerabilities and stay on people's ass to fix their equipment.[*] Finally, in developing the methodology you must test it by actually doing it. Don't forget to create process and procedure documents as you go, they may be rough but they can be refined later. Leaving all the documentation until the end will make the project seem very rushed.[*] As far as notifications during the audit, save that for the high severity vulnerabilities. Otherwise leave it all for the final report that you will be presenting to each of your Tech teams. That way you can differentiate the AUDIT from the REMEDIATION phase of the project with digestible scopes.[/list=1]
Good luck: D

Well, setting up a HoneyPot / HoneyNet wouldn't be a bad idea. A little help from the "underground" wouldn't be an bad idea either. But, you do what you want to do, I just wanted to help.

Good luck with your project! :)