Updated examplereport.xml so it’s valid again
This commit is contained in:
skyanth
parent
6ffdf28be0
commit
1918cdfac5
@ -1,10 +1,24 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?><pentest_report xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" findingCode="SID" xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd">
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<pentest_report xmlns:xi="http://www.w3.org/2001/XInclude"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" findingCode="SID"
|
||||
xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd">
|
||||
<meta>
|
||||
<title>Penetration Test Report</title>
|
||||
<xi:include href="client_info.xml"/>
|
||||
<targets>
|
||||
<target>fishinabarrel.sittingduck.com</target>
|
||||
</targets>
|
||||
<activityinfo>
|
||||
<duration>4</duration>
|
||||
<persondays>4</persondays>
|
||||
<test_planning>bla</test_planning>
|
||||
<report_due>bla</report_due>
|
||||
<nature>something</nature>
|
||||
<type>black-box</type>
|
||||
</activityinfo>
|
||||
<permission_parties>
|
||||
<xi:include href="client_info.xml"/>
|
||||
</permission_parties>
|
||||
|
||||
<collaborators>
|
||||
<reviewers>
|
||||
<reviewer>Melanie Rieback</reviewer>
|
||||
@ -68,48 +82,50 @@ who is also the co-founder/CEO of Radically Open Security.</bio>
|
||||
</version_history>
|
||||
<xi:include href="snippets/company_info.xml"/>
|
||||
</meta>
|
||||
|
||||
|
||||
<generate_index/>
|
||||
|
||||
|
||||
<section id="executiveSummary">
|
||||
<title>Executive Summary</title>
|
||||
<section id="introduction">
|
||||
<title>Introduction</title>
|
||||
<p>Sitting Duck B.V. (“Sitting Duck”) has assigned
|
||||
the task of performing a Penetration Test of the FishInABarrel Web
|
||||
Application to Radically Open Security BV (hereafter “ROS”).
|
||||
Sitting Duck has made this request to better evaluate the security of the application and
|
||||
to identify application level vulnerabilities in order to see whether the FishInABarrel
|
||||
Web Application is ready, security-wise, for production deployment.</p>
|
||||
<p>This report contains our findings as well as detailed explanations of exactly how ROS performed
|
||||
the penetration test.</p>
|
||||
<p>Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a
|
||||
Penetration Test of the FishInABarrel Web Application to Radically
|
||||
Open Security BV (hereafter “ROS”). Sitting Duck has made this
|
||||
request to better evaluate the security of the application and to
|
||||
identify application level vulnerabilities in order to see whether
|
||||
the FishInABarrel Web Application is ready, security-wise, for
|
||||
production deployment.</p>
|
||||
<p>This report contains our findings as well as detailed explanations of
|
||||
exactly how ROS performed the penetration test.</p>
|
||||
</section>
|
||||
<section id="scope">
|
||||
<title>Scope of work</title>
|
||||
<p>The scope of the Sitting Duck penetration test was limited to the following
|
||||
target:</p>
|
||||
<p>The scope of the Sitting Duck penetration test was limited to the
|
||||
following target:</p>
|
||||
<generate_targets/>
|
||||
<p>The penetration test was carried out from a black box perspective: no information
|
||||
regarding the system(s) tested was provided by Sitting Duck or FishInABarrel, although FishInABarrel
|
||||
did provide ROS with two test user accounts.</p>
|
||||
<p>The penetration test was carried out from a black box perspective: no
|
||||
information regarding the system(s) tested was provided by Sitting
|
||||
Duck or FishInABarrel, although FishInABarrel did provide ROS with
|
||||
two test user accounts.</p>
|
||||
</section>
|
||||
<section id="objectives">
|
||||
<title>Project objectives</title>
|
||||
<p>The objective of the security assessment is to gain insight into the security of
|
||||
the host and the FishInABarrel Web Application.</p>
|
||||
<p>The objective of the security assessment is to gain insight into the
|
||||
security of the host and the FishInABarrel Web Application.</p>
|
||||
</section>
|
||||
<section id="timeline">
|
||||
<title>Timeline</title>
|
||||
<p>The FishInABarrel Security Audit took place between January 14 and January 16,
|
||||
2015.</p>
|
||||
<p>The FishInABarrel Security Audit took place between January 14 and
|
||||
January 16, 2015.</p>
|
||||
</section>
|
||||
<section id="results">
|
||||
<title>Results in a Nutshell</title>
|
||||
<p>During this pentest, we found quite a number of different security problems –
|
||||
Cross-site Scripting (XSS) vulnerabilities, both stored and reflected, Cross-site
|
||||
Request Forgery (CSRF) vulnerabilities,
|
||||
information disclosures (multiple instances), and lack of
|
||||
brute force protection.</p>
|
||||
<p>During this pentest, we found quite a number of different security
|
||||
problems – Cross-site Scripting (XSS) vulnerabilities, both stored
|
||||
and reflected, Cross-site Request Forgery (CSRF) vulnerabilities,
|
||||
information disclosures (multiple instances), and lack of brute
|
||||
force protection.</p>
|
||||
</section>
|
||||
<section id="findingSummary">
|
||||
<title>Summary of Findings</title>
|
||||
@ -125,47 +141,59 @@ who is also the co-founder/CEO of Radically Open Security.</bio>
|
||||
<title>Charts</title>
|
||||
<section id="threatlevelpie">
|
||||
<title>Findings by Threat Level</title>
|
||||
<generate_piechart pieAttr="threatLevel" pieElem="finding" pieHeight="200"/>
|
||||
<generate_piechart pieAttr="threatLevel" pieElem="finding"
|
||||
pieHeight="200"/>
|
||||
</section>
|
||||
<section id="typepie">
|
||||
<title>Findings by Type</title>
|
||||
<generate_piechart pieAttr="type" pieElem="finding" pieHeight="200"/>
|
||||
<generate_piechart pieAttr="type" pieElem="finding" pieHeight="200"
|
||||
/>
|
||||
</section>
|
||||
|
||||
|
||||
<!-- generated from Findings section -->
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="snippets/report/methodology.xml"/>
|
||||
|
||||
|
||||
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
|
||||
href="snippets/report/methodology.xml"/>
|
||||
|
||||
<section id="recon">
|
||||
<title>Reconnaissance and Fingerprinting</title>
|
||||
<p>Through automated scans we were able to gain the following information about the
|
||||
software and infrastructure. Detailed scan output can be found in the sections
|
||||
below.</p>
|
||||
|
||||
<table border="1"><tr><th>Fingerprinted Information</th></tr>
|
||||
<tr><td>Windows XP<br/>Microsoft IIS 6.0<br/>PHP 5.4.29<br/>jQuery 1.7.2<br/>Mailserver XYZ<br/>FTPserver ABC</td></tr></table>
|
||||
|
||||
software and infrastructure. Detailed scan output can be found in the
|
||||
sections below.</p>
|
||||
|
||||
<table border="1">
|
||||
<tr>
|
||||
<th>Fingerprinted Information</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Windows XP<br/>Microsoft IIS 6.0<br/>PHP 5.4.29<br/>jQuery
|
||||
1.7.2<br/>Mailserver XYZ<br/>FTPserver ABC</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<section id="scans">
|
||||
<title>Automated Scans</title>
|
||||
<p>As part of our active reconnaissance we used the following automated scans:</p>
|
||||
<p>As part of our active reconnaissance we used the following automated
|
||||
scans:</p>
|
||||
<ul>
|
||||
<li>nmap – <a href="http://nmap.org">http://nmap.org</a></li>
|
||||
<li>skipfish - <a href="https://code.google.com/p/skipfish/">https://code.google.com/p/skipfish/</a></li>
|
||||
<li>skipfish -
|
||||
<a href="https://code.google.com/p/skipfish/">https://code.google.com/p/skipfish/</a></li>
|
||||
<li>sqlmap – <a href="http://sqlmap.org">http://sqlmap.org</a></li>
|
||||
<li>Wapiti – <a href="http://wapiti.sourceforge.net">http://wapiti.sourceforge.net</a></li>
|
||||
<li>Wapiti –
|
||||
<a href="http://wapiti.sourceforge.net">http://wapiti.sourceforge.net</a></li>
|
||||
</ul>
|
||||
<p>Of these, only the output of nmap turned out to be
|
||||
useful; consequently only nmap and output will be discussed in
|
||||
this section.</p>
|
||||
<p>Of these, only the output of nmap turned out to be useful; consequently
|
||||
only nmap and output will be discussed in this section.</p>
|
||||
</section>
|
||||
<section id="nmap">
|
||||
<title>nmap</title>
|
||||
<p>Command:</p>
|
||||
<pre>$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
|
||||
fishinabarrel.sittingduck.com</pre>
|
||||
|
||||
|
||||
<p>Outcome:</p>
|
||||
<pre> Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
|
||||
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
|
||||
@ -194,57 +222,65 @@ PORT STATE SERVICE
|
||||
|
||||
Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
|
||||
Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
|
||||
|
||||
<p>The scan revealed a very large number of open services on this machine, which
|
||||
greatly increases the attack surface; see <a href="#f2"/> for more information on the
|
||||
security risk.</p>
|
||||
|
||||
|
||||
<p>The scan revealed a very large number of open services on this machine,
|
||||
which greatly increases the attack surface; see <a href="#f2"/> for
|
||||
more information on the security risk.</p>
|
||||
|
||||
</section>
|
||||
|
||||
|
||||
</section>
|
||||
<section id="techSummary">
|
||||
<title>Pentest Technical Summary</title>
|
||||
<section id="findings">
|
||||
<title>Findings</title>
|
||||
|
||||
|
||||
<p>We have identified the following issues:</p>
|
||||
|
||||
|
||||
<finding id="f1" threatLevel="Moderate" type="Information Leak">
|
||||
<title>PHPInfo Disclosure</title>
|
||||
<description>
|
||||
<p>The phpinfo() function of the PHP language is readable,
|
||||
resulting in a listing of all the runtime information of the environment,
|
||||
thus disclosing potentially valuable information to attackers.</p>
|
||||
resulting in a listing of all the runtime
|
||||
information of the environment, thus disclosing
|
||||
potentially valuable information to attackers.</p>
|
||||
</description>
|
||||
<technicaldescription>
|
||||
<p>This is where the good stuff goes. We give a detailed technical description of the problem.</p>
|
||||
<p>Illustrative picture of an evil hacker pondering dark deeds:</p>
|
||||
<p>This is where the good stuff goes. We give a detailed
|
||||
technical description of the problem.</p>
|
||||
<p>Illustrative picture of an evil hacker pondering dark
|
||||
deeds:</p>
|
||||
<img height="10" src="../graphics/screenshot.jpg"/>
|
||||
</technicaldescription>
|
||||
<impact>
|
||||
<p>This is where we explain how the sh*t is hitting the fan, exactly.</p>
|
||||
<p>This is where we explain how the sh*t is hitting the fan,
|
||||
exactly.</p>
|
||||
</impact>
|
||||
<recommendation>
|
||||
<p>Here is where we write some tips to solve the problem.</p>
|
||||
<p>Here is where we write some tips to solve the
|
||||
problem.</p>
|
||||
</recommendation>
|
||||
</finding>
|
||||
|
||||
|
||||
<finding id="f2" threatLevel="High" type="XSS">
|
||||
<title>A terrible XSS issue</title>
|
||||
<description>
|
||||
<p>A general description of the problem.</p>
|
||||
</description>
|
||||
<technicaldescription>
|
||||
<p>This is we go into great detail about the vulnerability.</p>
|
||||
<p>This is we go into great detail about the
|
||||
vulnerability.</p>
|
||||
</technicaldescription>
|
||||
<impact>
|
||||
<p>This is where we explain why this vulnerability is a problem.</p>
|
||||
<p>This is where we explain why this vulnerability is a
|
||||
problem.</p>
|
||||
</impact>
|
||||
<recommendation>
|
||||
<p>This is where we solve everything and the sun starts shining again.</p>
|
||||
<p>This is where we solve everything and the sun starts
|
||||
shining again.</p>
|
||||
</recommendation>
|
||||
</finding>
|
||||
|
||||
|
||||
<finding id="f3" threatLevel="Low" type="XSS">
|
||||
<title>A not quite so terrible XSS issue</title>
|
||||
<description>
|
||||
@ -261,23 +297,24 @@ Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
|
||||
</recommendation>
|
||||
</finding>
|
||||
</section>
|
||||
|
||||
|
||||
<section id="nonFindings">
|
||||
<title>Non-Findings</title>
|
||||
<p>In this section we list some of the things that were tried but turned out to be
|
||||
dead ends.</p>
|
||||
|
||||
<p>In this section we list some of the things that were tried but turned out
|
||||
to be dead ends.</p>
|
||||
|
||||
<non-finding id="ftp">
|
||||
<title>FTP</title>
|
||||
<p>The server was running FTPserver ABC, the most recent
|
||||
version of this particular piece of software. Anonymous login was turned off and no
|
||||
relevant vulnerabilities or exploits were found.</p>
|
||||
<p>The server was running FTPserver ABC, the most recent version of
|
||||
this particular piece of software. Anonymous login was
|
||||
turned off and no relevant vulnerabilities or exploits were
|
||||
found.</p>
|
||||
</non-finding>
|
||||
<non-finding id="mail">
|
||||
<title>Mail Server</title>
|
||||
<p>The server was running Mailserver XYZ, the most recent
|
||||
version of this particular piece of software. No relevant vulnerabilities or
|
||||
exploits were found. </p>
|
||||
<p>The server was running Mailserver XYZ, the most recent version of
|
||||
this particular piece of software. No relevant
|
||||
vulnerabilities or exploits were found. </p>
|
||||
</non-finding>
|
||||
<non-finding id="sqlInjection">
|
||||
<title>SQL Code Injection</title>
|
||||
@ -286,37 +323,43 @@ Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
|
||||
<pre>-file1.php
|
||||
-file2.php
|
||||
-file3.php
|
||||
</pre></non-finding>
|
||||
</pre>
|
||||
</non-finding>
|
||||
<non-finding id="heartbleed">
|
||||
<title>Heartbleed</title>
|
||||
<p>System was not vulnerable to heartbleed.</p> </non-finding>
|
||||
<p>System was not vulnerable to heartbleed.</p>
|
||||
</non-finding>
|
||||
<non-finding id="sp2">
|
||||
<title>Windows XP</title>
|
||||
<p>The host is running Windows XP. As we all know, Windows XP is bulletproof.</p>
|
||||
<p>The host is running Windows XP. As we all know, Windows XP is
|
||||
bulletproof.</p>
|
||||
</non-finding>
|
||||
</section>
|
||||
</section>
|
||||
<section id="conclusion">
|
||||
<title>Conclusion</title>
|
||||
<p>In the course of this penetration test, we have demonstrated that the FishInABarrel
|
||||
Web Application faces a range of security issues which makes it vulnerable to a number
|
||||
of different attacks. Vulnerabilities found included: cross-site scripting (both stored
|
||||
and reflected), cross-site request forgery, information disclosure
|
||||
and lack of brute force protection.</p>
|
||||
<p>Our conclusion is that there are a number of things that FishInABarrel BV has to fix before
|
||||
Sitting Duck should use their software. A number of the security issues highlighted in this
|
||||
report have fairly simple solutions, but these should nevertheless be fixed before use
|
||||
of the FishInABarrel Web App continues.</p>
|
||||
<p>We finally want to emphasize that security is a process – and this penetration test is
|
||||
just a one-time snapshot. Security posture must be continuously evaluated and improved.
|
||||
Regular audits and ongoing improvements are essential in order to maintain control of
|
||||
your corporate information security. We hope that this pentest report (and the detailed
|
||||
explanations of our findings) will contribute meaningfully towards that end. Don't
|
||||
hesitate to let us know if you have any further questions or need further clarification
|
||||
of anything in this report.</p>
|
||||
<p>In the course of this penetration test, we have demonstrated that the
|
||||
FishInABarrel Web Application faces a range of security issues which makes
|
||||
it vulnerable to a number of different attacks. Vulnerabilities found
|
||||
included: cross-site scripting (both stored and reflected), cross-site
|
||||
request forgery, information disclosure and lack of brute force
|
||||
protection.</p>
|
||||
<p>Our conclusion is that there are a number of things that FishInABarrel BV has to
|
||||
fix before Sitting Duck should use their software. A number of the security
|
||||
issues highlighted in this report have fairly simple solutions, but these
|
||||
should nevertheless be fixed before use of the FishInABarrel Web App
|
||||
continues.</p>
|
||||
<p>We finally want to emphasize that security is a process – and this penetration
|
||||
test is just a one-time snapshot. Security posture must be continuously
|
||||
evaluated and improved. Regular audits and ongoing improvements are
|
||||
essential in order to maintain control of your corporate information
|
||||
security. We hope that this pentest report (and the detailed explanations of
|
||||
our findings) will contribute meaningfully towards that end. Don't hesitate
|
||||
to let us know if you have any further questions or need further
|
||||
clarification of anything in this report.</p>
|
||||
</section>
|
||||
<appendix id="testteam">
|
||||
<title>Testing team</title>
|
||||
<generate_testteam/>
|
||||
</appendix>
|
||||
</pentest_report>
|
||||
</pentest_report>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user