# Penetration Test Report

fishinabarrel.sittingduck.com
4
4
TBD
TBD
bla
something
black-box
Melanie Rieback
Melanie Rieback
Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security.
Melanie Rieback
Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security.
Aristotle
Greek philosopher and scientist born in the Macedonian city of Stagira, Chalkidice, on the northern periphery of Classical Greece.
George Boole
English mathematician, philosopher and logician. Works in the fields of differential equations and algebraic logic, and is now best known as the author of The Laws of Thought.
William of Ockham
English Franciscan friar and scholastic philosopher and theologian. Considered to be one of the major figures of medieval thought. At the centre of some major intellectual and political controversies.
Ludwig Josef Johann Wittgenstein
Austrian-British philosopher who works primarily in logic, the philosophy of mathematics, the philosophy of mind, and the philosophy of language.
Confidential
Patricia Piolon
Initial draft
Ernest Hemingway
Structure & contents revision
Patricia Piolon
Added threat levels and recommendations
Patricia Piolon
JRR Tolkien
Revision
Patricia Piolon
Revision
Arthur Conan Doyle
Finalizing

# Executive Summary

## Introduction

Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a Penetration Test of the FishInABarrel Web Application to Radically Open Security BV (hereafter “ROS”). Sitting Duck has made this request to better evaluate the security of the application and to identify application level vulnerabilities in order to see whether the FishInABarrel Web Application is ready, security-wise, for production deployment.

This report contains our findings as well as detailed explanations of exactly how ROS performed the penetration test.

## Scope of work

The scope of the Sitting Duck penetration test was limited to the following target:

The penetration test was carried out from a black box perspective: no information regarding the system(s) tested was provided by Sitting Duck or FishInABarrel, although FishInABarrel did provide ROS with two test user accounts.

## Project objectives

The objective of the security assessment is to gain insight into the security of the host and the FishInABarrel Web Application.

## Timeline

The FishInABarrel Security Audit took place between January 14 and January 16, 2015.

## Results in a Nutshell

During this pentest, we found quite a number of different security problems – Cross-site Scripting (XSS) vulnerabilities, both stored and reflected, Cross-site Request Forgery (CSRF) vulnerabilities, information disclosures (multiple instances), and lack of brute force protection.

## Summary of Findings

## Summary of Recommendations

## Charts

### Findings by Threat Level

### Findings by Type

# Reconnaissance and Fingerprinting

Through automated scans we were able to gain the following information about the software and infrastructure. Detailed scan output can be found in the sections below.

Fingerprinted Information
Windows XP Microsoft IIS 6.0 PHP 5.4.29 jQuery 1.7.2 Mailserver XYZ FTPserver ABC

## Automated Scans

As part of our active reconnaissance we used the following automated scans:

- nmap – http://nmap.org
- skipfish - https://code.google.com/p/skipfish/
- sqlmap – http://sqlmap.org
- Wapiti – http://wapiti.sourceforge.net

Of these, only the output of nmap turned out to be useful; consequently only nmap and output will be discussed in this section.

## nmap

Command:

    $ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
    fishinabarrel.sittingduck.com

Outcome:

     Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
    Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
    Initiating ARP Ping Scan against 10.10.10.1 [1 port] at 15:43
    The ARP Ping Scan took 0.01s to scan 1 total hosts.
    Initiating SYN Stealth Scan against fishinabarrel.sittingduck.com (10.10.10.1) [1680 ports] at 15:43
    Discovered open port 22/tcp on 10.10.10.1
    Discovered open port 80/tcp on 10.10.10.1
    Discovered open port 8888/tcp on 10.10.10.1
    Discovered open port 111/tcp on 10.10.10.1
    Discovered open port 3306/tcp on 10.10.10.1
    Discovered open port 957/tcp on 10.10.10.1
    The SYN Stealth Scan took 0.30s to scan 1680 total ports.
    Host fishinabarrel.sittingduck.com (10.10.10.1) appears to be up ... good.
    Interesting ports on fishinabarrel.sittingduck.com (10.10.10.1):
    Not shown: 1674 closed ports
    PORT     STATE SERVICE
    22/tcp   open  ssh
    25/tcp   open  smtp
    80/tcp   open  http
    110/tcp  open  pop3
    111/tcp  open  rpcbind
    957/tcp  open  unknown
    3306/tcp open  mysql
    4000/tcp open  dangerous service

    Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
    Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

The scan revealed a very large number of open services on this machine, which greatly increases the attack surface; see for more information on the security risk.

# Findings

We have identified the following issues:

## PHPInfo Disclosure

The phpinfo() function of the PHP language is readable, resulting in a listing of all the runtime information of the environment, thus disclosing potentially valuable information to attackers.

This is where the good stuff goes. We give a detailed technical description of the problem.

Illustrative picture of an evil hacker pondering dark deeds:

This is where we explain how the sh*t is hitting the fan, exactly.

Here is where we write some tips to solve the problem.

## A terrible XSS issue

A general description of the problem.

This is we go into great detail about the vulnerability.

This is where we explain why this vulnerability is a problem.

This is where we solve everything and the sun starts shining again.

## A not quite so terrible XSS issue

A description of the problem.

Vulnerability described in detail.

Impact on security.

A ready solution.

# Non-Findings

In this section we list some of the things that were tried but turned out to be dead ends.

## FTP

The server was running FTPserver ABC, the most recent version of this particular piece of software. Anonymous login was turned off and no relevant vulnerabilities or exploits were found.

## Mail Server

The server was running Mailserver XYZ, the most recent version of this particular piece of software. No relevant vulnerabilities or exploits were found.

## SQL Code Injection

The following parameters are not vulnerable to SQL injection.

All parameters have been checked manually.

    -file1.php
    -file2.php
    -file3.php

## Heartbleed

System was not vulnerable to heartbleed.

## Windows XP

The host is running Windows XP. As we all know, Windows XP is bulletproof.

# Conclusion

In the course of this penetration test, we have demonstrated that the FishInABarrel Web Application faces a range of security issues which makes it vulnerable to a number of different attacks. Vulnerabilities found included: cross-site scripting (both stored and reflected), cross-site request forgery, information disclosure and lack of brute force protection.

Our conclusion is that there are a number of things that FishInABarrel BV has to fix before Sitting Duck should use their software. A number of the security issues highlighted in this report have fairly simple solutions, but these should nevertheless be fixed before use of the FishInABarrel Web App continues.

We finally want to emphasize that security is a process – and this penetration test is just a one-time snapshot. Security posture must be continuously evaluated and improved. Regular audits and ongoing improvements are essential in order to maintain control of your corporate information security. We hope that this pentest report (and the detailed explanations of our findings) will contribute meaningfully towards that end. Don't hesitate to let us know if you have any further questions or need further clarification of anything in this report.

# Testing team