Network Penetration testing

 

Network Penetration testing determines vulnerabilities on the network posture by discovering Open ports,Live systems, services and grabbing system banners.

The pen-testing helps administrator to close unused ports, additional services, Hide or Customize banners, Trouble shooting services and to calibrate firewall rules.

Let’s see how can we conduct step by step network penetration testing.

STEP-1: Host Discovery:

The first step of network penetration testing is to detect live hosts on the target network.

We can detect live hosts, accessible hosts in the target network by using network scanning tools such as Advanced IP scanner, NMAP, HPING3, NESSUS.

STEP-2: Port Scanning:

Perform port scanning using tools such as Nmap, Hping3, Netscan tools, Network monitor. These tools help us to probe a server or host on the target network for open ports.

Open ports are the gateway for attackers to enter in and to install malicious backdoor applications.

 

STEP-3: Banner Grabbing or OS Fingerprinting:

Perform banner Grabbing/OS fingerprinting such as Telnet, IDServe, NMAP determines the operating system of the target host and the operating system.Once you know the version and operating system of target, we need to find the vulnerabilities and exploit.Try to gain control over the system.

STEP-4: Scan for Vulnerabilities:

Scan the network using Vulnerabilities using GIFLanguard, Nessus, Ratina CS.  These tools help us in finding vulnerabilities with the target system and operating systems.

 

STEP5: Draw Network Diagrams

Draw a network diagram about the organisation that helps you to understand logical connection path to the target host in network.The network diagram can be drawn by LANmanager, LANstate, Friendly pinger.

STEP6:Prepare Proxies

Prepare proxies such as Proxifier,SSL Proxy, Proxy Finder..etc, to hide our-self from being caught.

STEP7: Document all Findings

The last and the very important step is to document all the Findings from Penetration testing. This document will help you in finding potential vulnerabilities in your network. Once you determine the Vulnerabilities you can plan counteractions accordingly.

source

Cloud Computing Penetration Testing Checklist and Important Considerations

What is Cloud Penetration Testing ?

Cloud Penetration Testing is a method of actively  checking and examining the Cloud system by simulating the attack from the malicious code .

Cloud computing is the shared responsibility with Cloud provider and client who earn the service from the provider.

Due to impact of the infrastructure , Penetration Testing not allowed in SaaSEnvironment.

Cloud Penetration Testing allowed in PaaS,IaaS with some Required coordination.

Regular Security monitoring should be implemented to monitoring the presents of threats, Risks, and Vulnerabilities.

SLA contract will decide what kind pentesting should be allowed and How often it can be done.

Important Cloud Computing Penetration Testing Checklist:

1.Check the Service level Agreement and make sure that proper policy has been covered between Cloud service provider (CSP) and Client.

2.To maintaining the Governance & Compliance ,check the proper responsibility between Cloud service provider and subscriber.

3.Check the service level agreement Document and track the record of CSP determine role and responsibility to maintain the cloud resources.

4.Check the computer and Internet usage policy and make sure it has been implemented with proper policy.

5.Check the unused ports and protocols and make sure services should be blocked.

6.check the data which is stored in cloud servers is Encrypted by Default.

7.Check the Two Factor Authentication used and validate the OTP ensure the network security.

8.Check the SSL certificates for cloud services in the URL  and make sure certificates purchased from repudiated Certificate Authority (COMODO, Entrust, Geoturst , Symantec,Thawte etc.)

9.Check the Component of access point, data center, devices, using Appropriate security Control.

10.check the policies and procedure for Disclose the data to third parties.

11.Check if CSP offers for cloning and virtual machines when Required.

12.Check the proper input validation for Cloud applications to avoid the web application Attacks such as XSS, CSRF,SQLi etc .

Cloud Computing Attacks:

Session Riding ( Cross-Site Request Forgery)

CSRF is an attack designed to entice a victim into submitting a request, which is
malicious in nature, to perform some task as the user.

Side Channel Attacks

This type of attack is unique to the cloud and potentially very devastating, but it requires
a lot of skill and a measure of luck.

This form of attack attempts to breach the confidentiality of a victim indirectly by exploiting the fact that they are using shared resources in the cloud.

Signature Wrapping Attacks

Another type of attack is not exclusive to a cloud environment but is nonetheless
a dangerous method of compromising the security of a web application.

Basically, the signature wrapping attack relies on the exploitation of a technique used in web services.

Other Attacks in Cloud Environment:

• Service hijacking using network sniffing
• Session hijacking using XSS attacks
• Domain Name System (DNS) attacks
• SQL injection attacks
• Cryptanalysis attacks
• Denial-of-service (DoS) and Distributed DoS attacks

Important Consideration of Cloud Penetration Testing:

1.Performing the Vulnerability Scanning in available host in Cloud Environment

2. Determine the Type of Cloud whether it is SaaS or IaaS or PaaS.

3.Determine what kind of testing permitted by the Cloud Service provider

4.Check the Coordination, scheduling and performing the test by CSP.

5.Performing Internal and External Pentesing.

6. Obtain Written consents for performing the pentesting.

7. Performing the web pentesting on the web apps/services without Firewall and Reverse Proxy

Important Recommendation for Cloud Penetration Testing:

1.Authenticate users with User name and Password.

2. Secure the coding policy by giving attention Towards Services Providers Policy

3.Strong Password Policy must be Advised.

4.Change Regularly by Organization such as user account name, password assigned by the cloud Providers.

5.Protect information which is uncovered during the Penetration Testing.

6. Password Encryption Advisable.

7. Use centralized Authentication or single sign-on for SaaS Applications.

8.Ensure the Security Protocols are up to date and Flexible.

Important Tools For Cloud Penetration Testing:

SOASTA CloudTest:

This suite can enable four types of testing on a single web platform: mobile functional and performance testing and web-based functional and performance testing.

LoadStorm:

LoadStorm is a load-testing tool for web and mobile applications and is easy
to use and cost effective.

BlazeMeter:

BlazeMeter is used for end-to-end performance and load testing of mobile
apps, websites, and APIs.

Nexpose:

Nexpose is a widely used vulnerability scanner that can detect vulnerabilities,
misconfiguration, and missing patches in a range of devices, firewalls, virtualized
systems, cloud infrastructure.

AppThwack:

AppThwack is a cloud-based simulator for testing Android, iOS, and web
apps on actual devices. It is compatible with popular automation platforms like
Robotium, Calabash, UI Automation, and several others.

Source

Web Application Penetration Testing Checklist – A Detailed Cheat Sheet

• Click to share on WhatsA

What is Web Application Penetration Testing?

Web Application Pen testing is a method of identifying, analyzing and Report the vulnerabilities which is existing in the Web application including buffer overflow, input validation, code Execution, Bypass Authentication, SQL Injection, CSRF, Cross sight scripting in the target web Application which is given for Penetration Testing.

Repeatable Testing and Conduct a serious of method One of the Best Method conduct Penetration testing for all kind of web application vulnerabilities.

Information Gathering

1. Retrieve and Analyze the robot.txt files by using a tool called GNU Wget.

2.Examine the version of software.database Details, the error technical component, bugs by the error codes by requesting invalid pages.

3.Implement the techniques such as DNS inverse queries, DNS zone Transfers, web based DNS Searches.

4.Perform Directory style Searching and vulnerability scanning, Probe for URLs, using tools such as NMAP and Nessus.

<

5.Identify the Entry point of the application using Burp Proxy,OWSAP ZAP, TemperIE, WebscarabTemper Data.

6.By using traditional Fingerprint Tool such as Nmap,Amap, perform TCP/ICMP  ansd service Fingerprinting.

7 .By Requesting Common File Extension such as .ASP, .EXE, .HTML, .PHP ,Test for recognized file types/Extensions/Directories.

8.Examine the Sources code From the Accessing Pages of the Application front end.

Authentication Testing

1.Check if it is possible to “reuse” the session after Logout.also check if the application automatically logs out a user has idle for a certain amount of time.

2.Check whether any sensitive information  Remain Stored stored in browser cache.

3.Check and try to Reset the password, by social engineering crack secretive questions and guessing.

4.check if the “Remember my password” Mechanism is implemented by checking the HTML code of the login page.

5.Check if the hardware devices directly communicate and independently with authentication infrastructure using additional communication channel.

6. Test CAPTCHA for authentication vulnerabilities presented or not.

7.Check whether any weak security questions/Answer are presented.

Authorization Testing

1. Test the Role and Privilege Manipulation to Access the Resources.

2.Test For Path Traversal by Performing input Vector Enumeration and analyze the input validation functions presented in the web application.

3.Test for cookie and parameter Tempering using web spider tools.

4.Test for HTTP Request Tempering and check whether gain illegal access to reserved resources.

Configuration  Management Testing

1.Check directory and File Enumeration review server and application Documentation. also, check the infrastructure and application admin interfaces.

2.Analyze the Web server banner and Performing network scanning.

3.Check and verify the presence of old Documentation and Backup and referenced files such as sources codes, passwords, installation paths.

4.check and identify the ports associated with the SSL/TLS services using NMAP and NESSUS.

5.Review OPTIONS HTTP method using Netcat and Telnet.

6. Test for HTTP methods and XST for credentials of legitimate users.

7.Perform application configuration management test to review the information of the source code, log files and default Error Codes.

Session Management Testing

1.Check the URL’s in the Restricted area to Test for Cross sight Request Forgery.

2.Test for Exposed Session variables by inspecting Encryption and reuse of session token, Proxies and caching, GET&POST.

3.Collect sufficient number of cookie samples and analyze the cookie sample algorithm and forge a valid Cookie in order to perform an Attack.

4.Test the cookie attribute using intercept proxies such as Burp Proxy, OWASP ZAP, or traffic intercept proxies such as Temper Data .

5.Test the session Fixation, to avoid seal user session.(session Hijacking )

Data Validation Testing

1.Performing Sources code Analyze for javascript Coding Errors.

2. Perform Union Query SQL injection testing, standard SQL injection Testing, blind  SQL querY Testing, using tools such as sqlninja,sqldumper,sql power injucter .etc.

3.Analyze the HTML Code,Test for stored XSS,leverage stored XSS,using tools such as XSS proxy,Backframe,Burp Proxy, OWASP, ZAP,XSS Assistant.

4.Perform LDAP injection testing for sensitive information about users and hosts.

5.Perform IMAP/SMTP injection Testing for Access the Backend Mail server.

6.Perform XPATH Injection Testing for Accessing the confidential information

7.Perfrom XML injection testing to know information about XML Structure .

8.Perform Code injection testing to identify input validation Error .

9.Perform Buffer Overflow testing for Stack and heap memory information and application control flow.

10.Test for HTTP Splitting and smuggling for cookies and HTTP redirect information .

Denial of Service Testing

1.Send Any Large number of Requests that perform database operations and observe any Slowdown and  New Error Messages.

2.Perform manual source code analysis and submit a range of input varying lengths to the applications

3.Test for SQL wildcard attacks for application information testing.

4.Test for User specifies object allocation whether a maximum number of object that application can handle.

5.Enter Extreme Large number of the input field that used by the application as a Loop counter.

6.Use a script to automatically submit an extremely long value for sever can be logged the request.

Source