CEH – Penetration Testing

Step
Knowledge NET
 Penetration Testing
Overview
• Penetration testing is a security testing methodology that
gives an attacker insight into the target’s security
posture and the strength of the target’s network security.
A complete security snapshot includes:
 Level I, High-level assessment. A top-down look at the
organization’s policies, procedures, standards and
guidelines. A Level I assessment is not usually hands-on,
in that the system’s security is not actually tested.
 Level II, Network evaluation. More hands-on than a
Level I assessment, a Level II assessment has some of
the Level I activities with more information gathering and
scanning.
 Level III, Penetration test. A penetration test is not
usually concerned with policies. It’s more about taking
the adversarial view of a hacker, by seeing what can be
accomplished and with what difficulty.
 The need of Penetration
Testing
• The reason a security professional may wish to conduct a
penetration test of his or her company is the same as the
reason a business has a security policy
• Several factors have converged in the marketplace to make
penetration testing a necessity.
• The skill level required to execute a hacker exploit has
steadily decreased.
• The size and complexity of the network environment has
mushroomed.
• The number of network and Web-based applications has
increased.
• The detrimental impact of a security breach on corporate
assets and goodwill is greater than ever.
 Penetration Testing Phases
• Penetration testing is most commonly carried out
within a black-box (that is, with no prior knowledge
of the infrastructure to be tested). At its simplest
level, the penetration test involves three phases
 Preparation phase. A formal contract is executed
containing nondisclosure of the client’s data and legal
protection for the tester. At a minimum, it also lists the IP
addresses to be tested and the time to test.

 Execution phase. The penetration test is executed, with

the tester looking for potential vulnerabilities

 Delivery phase. The results of the evaluation are

communicated to the tester’s contact in the organization,
and corrective action is advised.
 Legal and Ethical
Implications
• Attacking a network from the outside carries ethical and
legal risk to the tester,and remedies and protections
must be spelled out in detail before the test is begun.
• For example, the Cyber Security Enhancement Act 2002
implicates life
• sentences for hackers who “recklessly” endanger the
lives of others, and several
• U.S. statutes address cyber crime. Statute 1030, Fraud
and Related Activity in Connection with Computers,
specifically states that whoever intentionally accesses a
protected computer without authorization
 Legal and Ethical
Implications…..
• as a result of such conduct recklessly causes damage or
impairs medical treatment, can receive a fine or
imprisonment of five to 20 years.
• It’s vital that the tester receive specific written
permission to conduct the test from the most senior
executive possible. A tester
• should be specifically indemnified against prosecution
for the work of testing.
 The Three Pretest Phases
• Penetration testing usually starts with three pretest phases:
footprinting, scanning, and enumerating.
• These pretest phases are very important and can make the
difference between a successful penetration test that provides
a complete picture of the target’s network and an
unsuccessful test that does not
• Together, the three pretest phases are called reconnaissance
 Gather initial information
 Determine the network range
 Identify active machines
 Discover open ports and access points
 Fingerprint the operating system
 Uncover services on ports
 Map the network
 Footprinting
• “Footprinting” is the blueprinting of the security profile of an
organization.
• It involves gathering information about your target’s network to
create a profile of the organization’s networks and systems.
• It’s an important way for an attacker to gain information about
an organization passively (that is, without the organization’s
knowledge).
• “Footprinting” employs the first two steps of reconnaissance:
gathering the initial target information and determining the
network range of the target
• Common tools and resources used in the footprinting phase
are:
 Whois
 SmartWhois
 Nslookup
 Sam Spade
Footprinting (Manual Research)
• Company contact names, phone numbers, and email addresses
• Company locations and branches
• Other companies with which the target company partners or deals
• News, such as mergers or acquisitions
• Links to other company-related sites
• Company privacy policies, which may help identify the types of
security mechanisms in place
• Other resources that may have information about the target
company are:
 The SEC’s EDGAR database if the company is publicly traded
 Job boards, either internal to the company or external sites
 Disgruntled employee blogs and Web sites
 Trade press
Scanning
• The next four steps of gathering information (identifying active
machines, discovering open ports and access points, fingerprinting
the operating system, and uncovering services on ports) are
considered part of the scanning phase
• Your goal here is to discover open ports and applications by
performing external or internal network scanning, pinging machines,
determining network ranges, and scanning the ports of individual
systems
• Some common tools used in the scanning phase are
 Nmap
 Ping
 Traceroute
 SuperScan
 Netcat
 NeoTrace
 Visual Route
Enumerating
• The last step mentioned, mapping the network, is the result of the
scanning phase and leads us to the enumerating phase. As the final
pretest phase, the goal of enumeration is to paint a fairly complete
picture of the target
• To enumerate a target, a tester tries to identify valid user accounts or
poorly protected resource shares using directed queries and active
connections to and from the target
• The type of information sought by testers during the enumeration
phase can be names of users and groups, network resources and
shares, and applications. The techniques used for enumerating
include
 Obtaining Active Directory information and identifying vulnerable user
accounts
 Discovering the NetBIOS name with Nbtscan
 Using SNMPutil for SNMP
 Employing Windows DNS queries
 Establishing null sessions and connections
Note:- Document every step taken during penetration testing
Penetration Testing Tools and
Techniques
• Several tools, including public sources such as Whois and
Nslookup, can help you gather information about your target
network
• With “Whois”, you can find information like the domain’s
registrant, its administrative and technical contacts, and a
listing of their domain servers
• Nslookup allows you to query Internet domain name servers.
• It displays information that can be used to diagnose Domain
Name System (DNS) infrastructure and find additional IP
addresses.
• The common traceroute utility is also very handy. Traceroute
works by exploiting a feature of the Internet Protocol called
Time to Live (TTL).
Penetration Testing Tools and
Techniques……….
• It reveals the path IP packets travel between
two systems by sending out consecutive UDP
packets with ever-increasing TTLs
• As each router processes an IP packet, it
decrements the TTL. When the TTL reaches
zero, the router sends back a “TTL exceeded”
ICMP message to the origin.
• Thus, routers with DNS entries reveal their
names, network affiliations, and geographic
locations
Penetration Testing Tools and
Techniques……….
• Here are other useful Windows-based tools for gathering
information:
 VisualRoute. VisualRoute by VisualWare includes integrated
traceroute, ping tests, and reverse DNS and Whois lookups. It also
displays the actual route of connections and IP address locations
on a global map.
 SmartWhois. Like Whois, SmartWhois by TamoSoft obtains
comprehensiveinfo about the target: IP address, host name or
domain, including country, state or province, city, name of the
network provider, administrator and technical support, and contact
information.SmartWhois can find the information about a computer
located in any part of the world, intelligently querying the right
database and delivering all the related records within a few seconds
 Sam Spade. Sam Spade, a freeware tool primarily used to track
down spammers, can also be used to provide information about a
target. It comes with a host of useful network tools, including ping,
Nslookup, Whois, IP block Whois, dig, traceroute, finger, SMTP,
VRFY, Web browser, keep-alive, DNS zone transfer, SMTP relay
check, and more
Port Scanners
• Port scanning is one of the most common
reconnaissance techniques used by testers to
discover the vulnerabilities in the services listening
to well-known ports.
• Once you’ve identified the IP address of a target
through footprinting, you can begin the process of
port scanning:
• looking for holes in the system through which you,
or a malicious intruder, can gain access. A typical
system
• has 2^16 -1 port numbers, each with its own TCP
and UDP port that can be used to gain access if
unprotected.
Port Scanners “nmap”
• Nmap, the most popular port scanner for Linux, is also
available for Windows
• Nmap can scan a system in a variety of stealth modes,
depending upon how undetectable you want to be
• Nmap can determine a lot of information about a target, such
as what hosts are available, what services are offered, and
what OS is running
Vulnerability Scanners
• Nessus, a popular open-source tool, is an extremely powerful
network scanner that can be configured to run a variety of
scans. While a Windows graphical front-end is available, the
core Nessus product requires Linux to run.
• Microsoft’s Baseline Security Analyzer is a free Windows
vulnerability scanner. MBSA can be used to detect security
configuration errors on local computers or on computers
across a network, and it is now in its second release.
• It does have some issues with Windows Update, however,
and can’t always tell if a patch has been installed.
• Popular commercial vulnerability scanners include Retina
Network Security Scanner, which runs on Windows, and
SAINT, which runs on various Unix/ Linux versions
Password Crackers
• Three basic types of password-cracking tests can be
automated with tools:
 Dictionary. A file of words is run against user accounts; if
the password is a simple word, it can be found pretty
quickly.
 Hybrid. A hybrid attack works like a dictionary attack
but adds simple numbers or symbols to the file of words.
This attack exploits a weakness of many passwords: They
are common words with numbers or symbols tacked to the
ends.
 Brute force. The most time-consuming but
comprehensive way to crack a password. Every
combination of character is tried until the password is
broken.
Password Crackers
• Brutus.
 Brutus is a password-cracking tool that can perform both
dictionary attacks and brute force attacks where
passwords are randomly generated from a given
character. It can crack the multiple authentication types,
HTTP (Basic authentication, HTML Form/CGI), POP3,
FTP, SMB, and Telnet.
 WebCracker. WebCracker is a simple tool that takes
text lists of usernames and passwords and uses them as
dictionaries to implement basic password guessing.
 ObiWan. ObiWan is a password-cracking tool that can
work through a proxy. It uses wordlists and alternates
numeric or alphanumeric characters with Roman
characters to generate possible passwords.
Trojan Horses
• An unauthorized program contained within a
legitimate program
• A legitimate program that has been altered by the
placement of unauthorized code within it
• Any program that appears to perform a desirable
and necessary function but does something
unintended
• Trojans can be transmitted to the computer in
several ways
 Email attachments
 freeware, physical installation
 ICQ/IRC chat
 infected websites
Trojan Horses
• The list of Trojan horses in the wild is expanding quickly, but a
few of the earliest have remained relevant since the
beginning, and many of these serve as platforms for the
development of more lethal variations
• Trojans can be:
 Remote access Trojans
 Keystroke loggers or password-sending Trojans
 Software detection killers
 Purely destructive or denial-of-service Trojans
Buffer Overflows
• A buffer overflow (or overrun) occurs when a program
allocates a specific block length of memory for something but
then attempts to store more data than the block was intended
to hold.
• This overflowing data can overwrite memory areasand
interfere with information crucial to the normal execution of the
program
• To generate the overflow, the attacker must create a specific
data feed to induce the error, as random data will rarely
produce the desired effect
• For a buffer overflow attack to work, the target system must
fail to test the data or stack boundaries and must also be able
to execute code that resides in the data or stack segment
• Once the stack is smashed, the attacker can deployhis or her
payload and take control of the attacked system
Buffer Overflows
• Three common ways to test for a buffer
overflow vulnerability are as follows:
 Look for strings declared as local variables in
functions or methods, and verify the presence of
boundary checks in the source code.
 Check for improper use of input/output or string
functions.
 Feed the application large amounts of data and
check for abnormal behavior.
SQL Injection Attack
• SQL injection is an example of a class of injection exploits that
occur when one scripting language is embedded inside
another scripting language.
• The injection targets the data residing in a database through
the firewall in order to alter the SQL statements and retrieve
data from the database or execute commands.
• It accomplishes this by modifying the parameters of a Web-
based application.
• An injection attack will allow an attacker to execute SQL
codeon a server, such as SHUTDOWN WITH NOWAIT, which
causes the server to shut down and stop services
immediately.
• For example, creating a username with 1=1, a’, or ‘t’=’t or any
text within single quotes could force the execution of SQL
commands on a vulnerablesystem
SQL Injection Attack Prevention
• Preventing SQL injection vulnerability involves enforcing
better coding practices and database administration
procedures. Here are some specific steps to take
 Disable verbose error messages that give information to the
attacker
 Protect the system account (sa). It’s very common for the sa
passwordto be < blank >
 Enforce the concept of least privilege at the database connection
 Secure the application by auditing the source code to
• Restrict length of input
• Avoid single quotes
• Whitelist good input
• Blacklist bad input
Cross Site Scripting (XSS)
• Web application attacks are often successful because the
attack is not noticed immediately. One such attack exploits the
Cross Site Scripting (XSS) vulnerability
• An XSS vulnerability is created by the failure of a Web-based
application to validate user-supplied input before returning it to
the client system
• Attackers can exploit XSS by crafting malicious URLs and
tricking users into clicking on them
• These links enable the attacker’s client-side scripting
language, such as JavaScript or VBScript, to execute on the
victim’s browser
• Many Web application vulnerabilities can be minimized by
adhering to proper design specifications and coding practices
and implementing security early in the application’s
development lifecycle
MAC Address Vulnerabilities
• MAC addresses are easily sniffed by an
attacker since they must appear in the clear
even when WEP is enabled.
• An attacker can masquerade as a valid
MAC address by programming the wireless
card to enter the wireless network.
• Spoofing MAC addresses is also very easy.
Using packet capturing software, an attacker
can determine a valid MAC address by
setting up a rogue access point near the
target wireless network
WLAN Vulnerabilities
• Wireless LANs are susceptible to the same
protocol-based attacks that plague wired
LAN but also have their own set of unique
vulnerabilities.
• Since wireless access points may
proliferate in the organization, unsecured
wireless access points can be a danger to
organizations because they offer the
attacker a route around the company’s
firewall and into the network
SSID Issues
• The service set identifier (SSID) is an identification value
programmed in the access point or group of access points to
identify the local wireless subnet
• This segmentation of the wireless network into multiple
networks is a form of an authentication check
• SSID acts as a simple password, providing a measure of
security. When a client computer is connected to the access
point
• The wireless access point is configured to broadcast its SSID.
When enabled, any client without an SSID is able to receive it
and have access to the access point
• Many access points use default SSIDs provided by the
manufacturers, and a list of those default SSIDs is available for
download on the Internet
• This means that it’s very easy for a hacker to determine an
access point’s SSID and gain access to it via software tools
Wireless Network Penetration
Testing
• The rapid popularity of wireless networking technologies has
introduced a host of new security issues
• War driving is a term used to describe the process of a hacker
who, armed with a laptop and a wireless adapter card and
traveling by car, bus, subway train, or other form of
mechanized transport, goes around sniffing for WLANs
• War walking refers to the same process, commonly in public
areas like malls, hotels, or city streets, but using shoe leather
instead of the transportation methods listed earlier
• The hacker moves from place to place, letting these devices
do their jobs. Over time, the hacker builds up a database
containing the network name, signal strength, location, and
IP/namespace in use for all of the discovered wireless
hotspots
Wireless Network Penetration
Testing……….
• With SNMP, the hacker may even log packet samples
and probe the access points for available data
• This is called war chalking and alerts other intruders
that an exposed WLAN is nearby
• Common war-driving exploits find many wireless
networks with WEP disabled and using only the SSID
for access control.
• The SSID for wireless networks can be found quickly.
This vulnerability makes these networks susceptible
to what’s called the parking lot attack, where, at a safe
distance from the building’s perimeter, an attacker
gains access to the target network
WEP Weaknesses
• Wired Equivalent Privacy (WEP) is a component of the IEEE
802.11 wireless local area network WLAN standard. Its
primary purpose is to provide confidentiality of data on
wireless networks at a level equivalent to that of wired LANs
• This is accomplished by encrypting data with the RC4
encryption algorithm
• Nevertheless, WEP is vulnerable because of relatively short
keys that remain static.
• Most WEP products implement a 64-bit shared key, using 40
bits of this for the secret key and 24 bits for the initialization
vector.
• The key is installed at the wired network AP and must be
entered into each client as well
• WEP was not designed to withstand a directed cryptographic
attack
Wireless Scanning Tools
• AirSnort
 AirSnort is a WLAN tool that cracks WEP encryption keys.
AirSnort passively monitors wireless transmissions and
automatically computes the encryption key when enough
packets have been gathered.
• MiniStumbler
 This is a smaller version of NetStumbler designed to work
on PocketPC 3.0 and PocketPC 2002 platforms. It rovides
support for ARM, MIPS, and SH3 CPU types
• NetStumbler
 NetStumbler displays wireless access points, SSIDs,
channels, whether WEP encryption is enabled, and signal
strength. NetStumbler can connect with GPS technology to
log the precise location of access points
Wireless Scanning Tools……….
• WifiScanner
 WifiScanner analyzes traffic and detects 802.11b stations
and access points. It can listen alternatively on all 14
channels, write packet information in real time, and search
access points and associated client stations. All network
traffic may be saved in the libpcap format for analysis
• SSID Sniff
 A tool to use when looking to discover access points
andsave captured traffic. Comes with a configured script and
supportsCisco Aironet and random prism2 based cards
• Kismet
 Kismet is an 802.11 wireless network detector, sniffer, and
intrusion detection system. Kismet identifies networks by
passively collecting packets and detecting standard named
networks, detecting (and given time, decloaking) hidden
networks, and inferring the presence of nonbeaconing
networks via data traffic.
Some prevention
• Change the AP’s default admin password.
• Change the access point’s default SSID.
• Disable the Broadcast SSID function on the AP.
• Enable WEP with the stronger 128-bit encryption, not the
breakable 40-bit.
• Employ MAC address filtering.
• Implement an authentication server to provide strong
authentication.
• Physically locate the AP in an area that limits its radio
emanations.
Some prevention..........
• Logically put the AP in a DMZ with the firewall between the
DMZ and the internal network.
• Implement VPN tunnels.
• Disable DHCP, and assign static IP addresses.
• Test penetration vulnerability regularly.
• Research migrating to 802.11i technologies and new WEP
encryption
• workarounds
Social Engineering
• Common techniques used by an intruder to gain either
physical access or system access are
 Asserting authority or pulling rank
 Professing to have the authority, perhaps supported
with altered identification to enter a facility or system
 Browbeating the access control subjects with harsh
language or threatening behavior to permit access or
release information
 Praising, flattering, or sympathizing
 Using positive reinforcement to coerce a subject into
providing access or information for system access
Social Engineering……….
 Some examples of successful social engineering attacks
are:
• Emails to employees from a tester requesting their
passwords to validate
• the organizational database after a network intrusion
has occurred
• Emails to employees from a tester requesting their
passwords because work has to be done over the
weekend on the system
• An email or phone call from a tester impersonating an
official who is conducting an investigation for the
organization and requires passwords for the
investigation
Social Engineering……….
 Some examples of successful social engineering attacks
are:
• An improper release of medical information to
individuals posing as medical personnel and
requesting data from patients’ records
• A computer repair technician who convinces a user
that the hard disk on his or her PC is damaged and
irreparable, and installs a new hard disk for the user,
then takes the hard disk, extracts the information, and
sells the information to a competitor or foreign
government
IDS and Penetration
• The IDS monitors packets on the network wire and endeavors
to discover if a tester is attempting to break into a system
• Anomaly detection systems employ a baseline of statistics
such as CPU utilization, disk activity, user logins, file activity,
and so on. Then network activity is matched against this
baseline
• After capturing packets, a good IDS uses several techniques
to identify information in the packets indicative of an attack,
such as protocol stack verification and application protocol
verification
• Protocol stack verification looks for intrusions, such as Ping-
O-Death and TCP Stealth Scanning, that use violations of the
IP protocols to attack.
• The verification system can flag invalid packets, which can
include valid but suspicious behavior such as frequent,
fragmented IP packets
IDS and Penetration……….
• Application protocol verification looks for intrusions that use
invalid protocol behavior, such as WinNuke. WinNuke uses
the NetBIOS protocol
• Since many IDS simply rely on matching the patterns of well-
known attack scripts, they can easily be evaded by simply
changing the script and altering the appearance of the attack.
• For example, some POP3 servers are vulnerable to a buffer
overflow when a long password is entered. This may be easy
to evade by simply changing the password script
ASSESSMENT
QUESTIONS