23 penetration testing.pptx
-
Upload
rap-payne -
Category
Technology
-
view
203 -
download
0
description
Transcript of 23 penetration testing.pptx
Vulnerability Scanning and Penetration Testing
Automated security testing
Security Testing can be static or dynamic
Static tools o Scan source code o Before deployment o Find potential
holes from a list of known vectors
o Called static code analysis
o Negative testing
Dynamic tools o Scan site o After deployment o Find actual holes
from previously unknown vectors
o Called security scanning
o Positive testing
There are many penetration testers
o Burp Suite o Metasploit o OWASP ZAP o WebScarab o Paros o W3af o Peach Fuzzer o Nikto
o Watipi o CANVAS o CORE Impact o White Phosphorous o Agora o VulnDisco o Nessus
How we protect ourselves
o Choose good scanning tools o Run a vulnerability scan o Run a penetration test o Fix the holes found
Let’s look at what they do and how they work.
Nikto is a good vulnerability scanner
Many of these tools run as a proxy.
1. Run the pen tester 2. Open your browser 3. Set the browser’s proxy:
4. Browse to a site you want to test.
You can spider a site
o Allows the tool to auto-discover all pages so it can run scans on any or all.
You can examine and edit requests
You can examine responses
You can intercept requests
You can crawl an entire site.
You can run an automated scan. o Tell it which pages and it surfs to those
pages.
You can fuzz a site
Running a site and putting all kinds of nonsense in fields.
You can record and re-play sessions
Intercepting Proxy
ZAP has an active and a passive scanner
o Passive mode can be used against any site because it doesn't do any penetration.
o Active mode should only be used against sites you own (or have permission to)
Spider
Brute
o Based on OWASP
Fuzz testing
o Uses fuzzdb and JBroFuzz
Session comparison
o Allows you to
Synchronizer tokens
How to run a test
o Point your browser's proxy at ZAP o Surf the application manually o Let ZAP crawl the site with its spider o Examine the problems found in passive
mode o Turn on active scanning
Summary
o Protecting sites shouldn’t be left to common sense alone.
o Static tools scan the source code. o Dynamic tools scan the deployed site. o Penetration tests allow you to …
• Run as a proxy • Spider a site • Run automated scans • Fuzz test • Get reports of the vulnerabilities
Further study
o Fuzz testing tools: • http://bit.ly/FuzzTestingTools
o Pen testing vs. Vulnerability scanning: o http://www.tns.com/PenTestvsVScan.asp
o Burp suite repeater and intruder tutorial: o http://bit.ly/BurpRepeaterTutorial