Senior penetration testers - a few questions

Hi,

I know there have been questions like this before: "What tools do you use?" But, I'm trying to gather some information for a survey, so I would be interested in finding out some more recent information.

Q. What are your favourite pen testing tools, which you would use in a standard pen test on a webserver?

Only answer if you feel like it - I'm not locking myself down to gathering information from AO alone, but I'd like to know what you all use, whether professionally or as a hobby.

I've also got another, slightly related question, which was inspired by some emails yesterday on the SecFocus Penetration Testing mailing list.

Q. What method do you usually use to trigger an IDS?

I know there is no de facto standard way of doing this, but I was wondering how each individual does it.

Thanks,

-jk

1. Define scope of the pen test - Determine targets, time of test, departments involved, etc. I will assume this is a network pen test because app pen tests are a different animal altogether.
2. based on #1, tool selection and "talent" are assembled but generally speaking, Nessus, NMAP, nikto (setup to run with Nessus), ip sorcery, Open STA and HPING are part of all of my tests.
3. Based on the type of IDS being used, different events will trigger different alerts. The question is too vague. That said, statistical and signature based IDS systems both flip out when they see large amounts of half open SYN scans. If that doesn't set off an IDS, rip it out and get a new one.

Anyway, there are many things to consider other than what tools to use. Remember, you're approaching this as an outsider and you can use many, many things in the test. I also gather information from public information sources and such. The actual logical tools used are a small subset of an overall complicated and involved process. Don't simply rely on a few open source (or closed for that matter) tools to do a pen test.

2 cents ala TheHorse13

Hi TH,

I know the tools don't make up the full pen test - like you said, other aspects like background research and social engineering are vital parts of it. I was just wondering what you used tool-wise ;)

Thanks for your post - helpful and some more statistics to add to the chart.

Any others? :)

Horse - How would do you rate LANGuard for use when pen testing?

Quote:

---

Originally posted here by J_K9
Q. What are your favourite pen testing tools, which you would use in a standard pen test on a webserver?

---

Like horse said, scope is critical. That said, tools I use...

Achilles - browser proxy
Internet Explorer
Wikto (like Nikto but added functionality)
N-Stealth (not free)
E-or (web app scanner)
WGET
my hands

Hope this helps.

Quote:

---

Originally posted here by ric-o
Like horse said, scope is critical. That said, tools I use...

Achilles - browser proxy
Internet Explorer
Wikto (like Nikto but added functionality)
N-Stealth (not free)
E-or (web app scanner)
WGET
my hands

Hope this helps.

---

Have you guys ever used Ike-scan? Is it still a good utility?


http://www.nta-monitor.com/index.htm

Quote:

---

Horse - How would do you rate LANGuard for use when pen testing?

---

In the past GFI LanGuard proved to be slow and inaccurate. They have a new build out and although they gave me a free copy, I've yet to take it out of the wrapper. I'm not impressed with their product.

Quote:

---

Thanks for your post - helpful and some more statistics to add to the chart.

Any others?

---

Sure, there are always others depending on what the scope and target of interest happens to be. For instance, if I'm looking to see if I've compromised a VM instance, I use a tool called "red pill".

The tools I gave you are in my core toolbox. I use literally hundreds of tools depending upon intent.

--TH13

For a web application audit try Webscarab its very good.

Thanks all for your help - I'd never even heard of red pill before - although it really is just a couple of (four) lines of code :D

But, let me approach this from another angle. Let's say you're hired by a small company, and you're taking a black box approach; you will eventually find out that all the network is is a router and several computers behind it, which are all workgrouped together. The router has a DMZ on port 80 to one of the computers (which is a webserver). In this hypothetical situation, what tools do you think you would have used to draw up this conclusion, and then to find holes in the network?

Thanks for all your contributions so far - especially TH13. ;)

-jk

Run nmap several times, using a variety of switches. -sV, -sS, -O, -P0, etc. Run it from inside and outside the network. That'll give you a good look at all the computers and what's open.

Nessus will give you more detailed information on any vulnerabilities. Ettercap will help find the hosts on your network. I'm not up to speed on Nikto/Wikto, so can't help much there.

Get on the webserver and test the DMZ. Some cheap routers have lousy DMZ's that let you get back into the rest of the network. A good DMZ isolates that computer from the rest of the network. Some cheap routers have very ineffective DMZ's. Smoothwall's DMZ, on the other hand, is very effective. So was Linksys's.

1) Enumerate open ports and draw a network map. As already stated, NMAP and Nessus can do this for you. The services running and banners are an excellent starting point for building an attack strategy.
2) Determine exactly how robust the router is by using tools like HPING and IP Sorcery to see how the router responds to various types of malformed packets. You may choke it at this point so be careful. A smoked router will certainly draw attention.
3) "FireWalk" the router to see exactly how the rules are setup. Typically you will find something at this stage because many people who write the rules don't do a good job. I've heard that NMAP has this capability now but I have yet to try it out.
4) Review your findings and develop an attack strategy. For the record, a DOS is not an appropriate attack strategy if you can't compromise the router.
5) Conduct your attack.
6) Document your results and present them to management/customer.

Now, if I was able to get into the network and root a box, I would use additional tools such as ettercap or dsniff to gather even more information to continue forward in the penetration. However, before I even attempted that, I would do some basic traffic analysis to see if:
a) I would impact network performance to the point of bringing down the network by using one of the aforementioned tools. Remember, you're going to route all network traffic through the rooted host. Be SURE that it can handle it.
b) determine if I would blind any monitoring devices which may cause someone to start investigating. If an IDS suddenly stopped working or reporting unusual information, someone will be looking into it before long.

* This all assumes that the network is switched.

Anyway, this is how I would conduct the technical part of the attack. If indeed this was a network that was accessable by the public, there would be several social engineering attacks to go along with this and perhaps even a physical one or two.

--TH13

On the tools discussion, in addition to the tools mentioned already, we also use Foundstone's SuperScan to enumerate ports ( http://www.foundstone.com/ - Resources->Free Tools).

In addition, we have been working on developing our social engineering skills to test our help desk and the clients at various sites during a pen test.

Application pen testing - we are working to come up with an effective methodology to test this area, as you can presume and as TH13 already mentioned, it is quite different an animal to take down. We have been working through the databases right now and then attacking the OS/OE. Crude - but effective in a lot of cases. However - it still does not look at the application so much.

WARNING - SIDE QUESTION TO FOLLOW:

TH13 and any others willing to answer: In your pen test results and your report to management - do you explain your results in regards to what risk(s) are facing the organization based on your findings? Do your reports go to people outside of an IT organization? If so - do you have to word your reports, such that non-IT management can understand the business impact of the results of a penetration test, in regards to potential risk to that organization?

like what thehorse said, pen test can be categories to different type: - Network, Application and System. Although Network & System might seems alike to each other, but actually they are not. Maybe u can said they are inter-related to each other.

For Network pen test, u need to have great knowledge of networking stuff(protocol, layer,packet, standard...) not to mention deep understanding of architecture of how different layer & tier communicate to each other. Tools that you used, are gather info for u within the infrastructure, what u need is to accumulate these info and make it useful to u(e.g. chart out the whole backbone architecture layout).

In System pen test, u more specific focusing on the system architecture itself. U need to get urself familiar with the kernel, how the system handle process, vulnerabilities & etc.. then u also need to have good documentation skill like generate some checklist, policies & guideline...(u will never wanna present ur report that are directly geneate fr those pen test tools) and later stage might involve System Hardening and patchup.

For Application pen test, which is what i moving my direction to(as well as the most lack of expertise in market). Basically u need to know in-and-out for programming (not all, but most common), u need to understand how API called fr each other(fr web,app or db tier), u need to do code-review & walk-thru. u need to understand web services technology(weblogic,websphere, ant, tomcat..) if it involve a banking or ecommerce system.

Lastly also depend what type of the nature u dealing with. The solution u doing pen test for is on what basis. Likewise, u also need to get urself involve in software(encryption-SSL,IPSec, 3DES,VPN, SSH++) & hardware(Firewall, IPS, Token, Smart-card, HSM+++) based security products.

Opss, damn.. i'm like writing a guide to choose Pen Tester as ur career~~~

Well, for the tools that i used, bascially i will choose 1 or 2 best on particular area & focus on it. for instance, to perform traceroute, i will just used Scapy, etc... beside i used combination of virtual machine, Live CD and other commerical tools like CoreImpact, Nessus, SATAN+++

But most of the time, i more reply on the tools/environment i developed myself.. just like building some fuzzy framework, update and repository huge latest exploit and fly the test.

I'm not an expert, this all based on my previous experience, so i might be wrong or the method i used might not suitable for u ^_^

Quote:

---

do you explain your results in regards to what risk(s) are facing the organization based on your findings? Do your reports go to people outside of an IT organization? If so - do you have to word your reports, such that non-IT management can understand the business impact of the results of a penetration test, in regards to potential risk to that organization?

---

The purpose of our pen tests are:
1) To asses risk - what could happen, how likely is it, how bad can it be, how accurate are my responses to the first three questions. Then place a dollar value on it.
2) IT management receives the report along with business unit management that is effected and C level personnel.
3) We produce a single report that begins with an executive summary and follows with technical details.

--TH13

Cool - thanks Sky_Angus and TH13! That is what I needed... well that and another vacation on the beach - but I'll takes what I can gets. It confirms what I already know - it's just that we have had some difficulty explaining the actual impact to the business from vulnerabilities or attack vectors discovered from a pen test; usually to non-IT management - ok - they're finance management. Your explanations will help me better frame my responses when asked "So you can compromise a server - so what?"

Thanks again!

Translating risks to business units is a skill. The best thing to do, it attempt to use some type of quantitative measure, typically in the form of value or loss there of, or perhaps in qualitative form, i.e., negative perceptions, etc. I find a good mix of both does the trick.

would someone kindly point out what a pen test is? I might know the concept without knowing the vocabulary...

Quote:

---

Originally posted here by Spekter1080
would someone kindly point out what a pen test is? I might know the concept without knowing the vocabulary...

---

ignore my last statement, I didn't read the 2nd page...*feels like a newbie*....I think I know what you guys are talking about now...lol