Penetration Test Report fishinabarrel.sittingduck.com 4 4 TBD TBD bla something black-box Melanie Rieback Melanie Rieback Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security. Melanie Rieback Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security. Aristotle Greek philosopher and scientist born in the Macedonian city of Stagira, Chalkidice, on the northern periphery of Classical Greece. George Boole English mathematician, philosopher and logician. Works in the fields of differential equations and algebraic logic, and is now best known as the author of The Laws of Thought. William of Ockham English Franciscan friar and scholastic philosopher and theologian. Considered to be one of the major figures of medieval thought. At the centre of some major intellectual and political controversies. Ludwig Josef Johann Wittgenstein Austrian-British philosopher who works primarily in logic, the philosophy of mathematics, the philosophy of mind, and the philosophy of language. Confidential Patricia Piolon Initial draft Ernest Hemingway Structure & contents revision Patricia Piolon Added threat levels and recommendations Patricia Piolon JRR Tolkien Revision Patricia Piolon Revision Arthur Conan Doyle Finalizing
Executive Summary
Introduction

Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a Penetration Test of the FishInABarrel Web Application to Radically Open Security BV (hereafter “ROS”). Sitting Duck has made this request to better evaluate the security of the application and to identify application level vulnerabilities in order to see whether the FishInABarrel Web Application is ready, security-wise, for production deployment.

This report contains our findings as well as detailed explanations of exactly how ROS performed the penetration test.

Scope of work

The scope of the Sitting Duck penetration test was limited to the following target:

The penetration test was carried out from a black box perspective: no information regarding the system(s) tested was provided by Sitting Duck or FishInABarrel, although FishInABarrel did provide ROS with two test user accounts.

Project objectives

The objective of the security assessment is to gain insight into the security of the host and the FishInABarrel Web Application.

Timeline

The FishInABarrel Security Audit took place between January 14 and January 16, 2015.

Results in a Nutshell

During this pentest, we found quite a number of different security problems – Cross-site Scripting (XSS) vulnerabilities, both stored and reflected, Cross-site Request Forgery (CSRF) vulnerabilities, information disclosures (multiple instances), and lack of brute force protection.

Summary of Findings
Summary of Recommendations
Charts
Findings by Threat Level
Findings by Type
Reconnaissance and Fingerprinting

Through automated scans we were able to gain the following information about the software and infrastructure. Detailed scan output can be found in the sections below.

Fingerprinted Information
Windows XP
Microsoft IIS 6.0
PHP 5.4.29
jQuery 1.7.2
Mailserver XYZ
FTPserver ABC
Automated Scans

As part of our active reconnaissance we used the following automated scans:

Of these, only the output of nmap turned out to be useful; consequently only nmap and output will be discussed in this section.

nmap

Command:

$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
fishinabarrel.sittingduck.com

Outcome:

 Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
Initiating ARP Ping Scan against 10.10.10.1 [1 port] at 15:43
The ARP Ping Scan took 0.01s to scan 1 total hosts.
Initiating SYN Stealth Scan against fishinabarrel.sittingduck.com (10.10.10.1) [1680 ports] at 15:43
Discovered open port 22/tcp on 10.10.10.1
Discovered open port 80/tcp on 10.10.10.1
Discovered open port 8888/tcp on 10.10.10.1
Discovered open port 111/tcp on 10.10.10.1
Discovered open port 3306/tcp on 10.10.10.1
Discovered open port 957/tcp on 10.10.10.1
The SYN Stealth Scan took 0.30s to scan 1680 total ports.
Host fishinabarrel.sittingduck.com (10.10.10.1) appears to be up ... good.
Interesting ports on fishinabarrel.sittingduck.com (10.10.10.1):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
4000/tcp open  dangerous service

Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

The scan revealed a very large number of open services on this machine, which greatly increases the attack surface; see for more information on the security risk.

Findings

We have identified the following issues:

PHPInfo Disclosure

The phpinfo() function of the PHP language is readable, resulting in a listing of all the runtime information of the environment, thus disclosing potentially valuable information to attackers.

This is where the good stuff goes. We give a detailed technical description of the problem.

Illustrative picture of an evil hacker pondering dark deeds:

This is where we explain how the sh*t is hitting the fan, exactly.

Here is where we write some tips to solve the problem.

 A terrible XSS issue

A general description of the problem.

This is we go into great detail about the vulnerability.

This is where we explain why this vulnerability is a problem.

This is where we solve everything and the sun starts shining again.

 A not quite so terrible XSS issue

A description of the problem.

Vulnerability described in detail.

Impact on security.

A ready solution.
Non-Findings

In this section we list some of the things that were tried but turned out to be dead ends.

FTP

The server was running FTPserver ABC, the most recent version of this particular piece of software. Anonymous login was turned off and no relevant vulnerabilities or exploits were found.

 Mail Server

The server was running Mailserver XYZ, the most recent version of this particular piece of software. No relevant vulnerabilities or exploits were found.

SQL Code Injection

The following parameters are not vulnerable to SQL injection.

All parameters have been checked manually.

-file1.php
-file2.php
-file3.php
Heartbleed

System was not vulnerable to heartbleed.

 Windows XP

The host is running Windows XP. As we all know, Windows XP is bulletproof.
Conclusion

In the course of this penetration test, we have demonstrated that the FishInABarrel Web Application faces a range of security issues which makes it vulnerable to a number of different attacks. Vulnerabilities found included: cross-site scripting (both stored and reflected), cross-site request forgery, information disclosure and lack of brute force protection.

Our conclusion is that there are a number of things that FishInABarrel BV has to fix before Sitting Duck should use their software. A number of the security issues highlighted in this report have fairly simple solutions, but these should nevertheless be fixed before use of the FishInABarrel Web App continues.

We finally want to emphasize that security is a process – and this penetration test is just a one-time snapshot. Security posture must be continuously evaluated and improved. Regular audits and ongoing improvements are essential in order to maintain control of your corporate information security. We hope that this pentest report (and the detailed explanations of our findings) will contribute meaningfully towards that end. Don't hesitate to let us know if you have any further questions or need further clarification of anything in this report.

Testing team