Comptia pentest chapter 4: Scanning and Identifying vulnerabilties

Kube Hunter tool

Kube-hunter is an open-source vulnerability scanner for Kubernetes clusters. Kube-hunter is able to probe a domain or address range for Kubernetes clusters and verify any found configuration issues.

Authenticated Scans

Authenticated scans, also referred to as credentialed scans, are performed by providing user credentials. Depending on the credentials used, these scans can result in much more detailed and accurate scan results.

Authenticated scans are able to scan system configurations, installed software, user-specific settings, access controls, and permissions.

Because these scans require valid credentials, they can be difficult to perform and are very time consuming.

Manual Assessments

In a manual assessment, the PenTester manually reviews and analyzes systems and applications for security vulnerabilities.

Some examples of manual assessment techniques include the following:

Manually reviewing source code or webpage code to identify flaws.

Reviewing configuration settings on host systems and servers to identify potential security issues.

Testing applications manually to identify vulnerabilities such as cross-site scripting and SQL injection attacks.

Reviewing log files to identify anything out of the ordinary that might point to potential vulnerabilities or misconfigurations.

Containers

Containerization supports microservices and serverless architecture and is also being widely used to implement corporate workspaces on mobile devices.

Two of the more popular container programs are Docker and Kubernetes. Docker is typically used for the containers themselves, whereas Kubernetes is used to manage containers on the network.

Containers vulnerabilities

Configuration issues

Network policy misconfigurations

Application vulnerabilities

Pentesting containers: what types

Vulnerability scanning

Configurations audits

runtime security

network security

compliance checks

Web applications

are scripts and executables designed to improve the functionality of a website and offer services to clients. Web servers will generally run on standard TCP port 80 and port 443; however, they can be configured to use nontraditional ports as well.

API requests

a set of commands that is used to send and receive data between systems, such as a client and a server. When used, the API provides an additional layer of security as the client never interfaces directly with the server.

DAST :Dynamic Application Security Testing

done after the code is placed into production. Unlike SAST, dynamic testing will unearth vulnerabilities that are evident after the code is in production.

One example of DAST is the mobile scan, which is performed on an application that is installed on a mobile device, such as a cell phone. The mobile scan attempts to mimic real-world user interaction to discover potential security vulnerabilities in mobile apps.

Static Application Security Testing (SAST)

is done early in the software development life cycle to examine the code for security vulnerabilities. SAST examines the source code itself without running it to identify any potential security vulnerabilities. This early identification allows the developers to address security concerns before the application is deployed into a production environment.

Interactive Application Security Testing (IAST)

combines aspects of both SAST and DAST to provide a more comprehensive and accurate assessment of an application's security. IAST analyzes the application's behavior while it is running to get the most accurate assessments.

Software Composition Analysis (SCA)

identifies the open-source and third-party libraries and components, along with their versions and licensing information, used in an application. SCA tools can then look up these libraries and components on vulnerability databases to see if there are any known risks.

Security Content Automation Protocol (SCAP)

U.S. standard used to ensure applications meet mandated security requirements. Scanning uses a predetermined security baseline that checks for vulnerabilities, either on site or cloud based. Once identified, the next step is to mitigate the vulnerabilities to decrease overall organizational risk.

Vulnerability scanning tools

Nessus and OpenVAS

Nessus: free for home or personal use, but must be purchased to unlock all features and use it on an enterprise network.

Openvas: free opensource vulnerability scanner

Both of these tools have built in predefined tests that can run on network or even individual systems on network

Network vulnerability scanners use both the TCP and UDP protocols to discover open ports and vulnerabilities:

TCP scans manipulate the 3 way handshake to discover what ports are open on the target machine

UDP scans use the ICMP protocol to look for port unreachable which means the port is closed, if the message is not received then the scanner can infer that the port is open

CVSS rankings are determined using a CVSS calculator, which determines the risk and severity of a vulnerability based on the following three metrics:

Base: Denotes a vulnerability's unique characteristics.

Temporal: Denotes the changeable attributes of a vulnerability.

Environmental: Denotes vulnerabilities that are present only in certain environments or implementations.

Host based scans using what tools

OpenVas; OpenVAS will compile a report listing potential vulnerabilities based on the severity ranking.

BloodHound is a powerful tool used to identify vulnerabilities in Active Directory domain environments. BloodHound starts by mapping the relationships between users, groups, computers, and other objects within an AD environment

Powersploit; PowerSploit is a collection of PowerShell scripts that can be used to perform a variety of tasks on a Windows-based system such as the following:

Code execution

Script modification

Gain persistence

Bypass antivirus

Exfiltration

Privilege escalation

Reconnaissance

Scanning and discovering vulnerabilities in industrial control systems (ICSs) can present unique challenges for the PenTester.

In ICS in host scans, what unique challenges can be posed on these systems

ICSs may use legacy systems that were not initially developed with security in mind, which makes them more vulnerable to attack.

ICSs are often now integrated fully with the traditional network, which can create additional attack vectors for the network.

Many ICSs operate under a real-time constraint, which essentially means that an operation or task must be completed within a specified period of time. This can make testing them and implementing additional security measures even more complicated.

Port mirroring, also known as SPAN (Switched Port Analyzer),

is a technique used to copy network traffic from one or more ports on a network switch to another port where it can be monitored and analyzed.

Secret scanning: using what tools

Trufflehog: designed to scan through code repositories, Docker images, ticket systems, and more to discover secrets. It can be installed and run from Windows, MacOS, or Linux-based systems.

Once installed, the PenTester simply runs the program and specifies what needs to be scanned, and TruffleHog will comb through the system and list any discovered secrets, as shown in the below screenshot:

Wireless transmissions

are sent through the air using a radio wave and are not protected by a bounded media, such as a cable. Any human or device within range and direction of the signal can intercept that signal without needing to access or disrupt a physical networking infrastructure. Some wireless technology, like Wi-Fi, is omni-directional— the intercepting entity does not have to face a specific direction, just be within range. Because of this, wireless networking technology is at a greater risk of compromise from several types of attacks.

Exploiting the Four-Way Handshake- using tools like airmon-ng

Once a wireless network has been discovered, the PenTester can attempt to intercept the four-way handshake that occurs when a device attempts to connect to the wireless network. The pre-shared key and SSID are used to generate a session key during this process.

First, the access point sends a clear text challenge, which is a randomly generated number.

Next, the client encrypts the challenge text using the preconfigured pre-shared key and sends it back to the access point in another authentication request.

The access point decrypts the material it receives and compares it with the clear text it sent in the first place. If the decryption process was accurate and the text is correct, the access point will send back a positive response along with another shared key.

The client verifies everything and, if it all matches, sends an acknowledgment to the access point and the connection is established.

Identifying False Positives

Automated scans have the potential to produce large numbers of false positives. There are numerous triggers for a false positive, including the following:

The scanner vendor is trying to make their product look good by programming the scanner to report more vulnerabilities than there truly are.

The scanner is unable to recognize that another control is compensating for some identified deficiency.

The scanner is using a vulnerability database with outdated definitions.

The scanner incorrectly scores a vulnerability as more severe, or more easily exploited, than it actually is.

Customizations in the target environment are inadvertently triggering the scanner to identify a vulnerability.

The scanner is not properly configured; for example, it has been supplied with an incorrect target or credentials.

Metasploit

multipurpose computer security and penetration testing framework that is used worldwide for both legitimate security analysis and unauthorized activities.

Metasploit capabilies

Exploit: Attack software that delivers a payload

Payload: Code that runs remotely

Post: Additional tasks that can be performed on a compromised host

Auxillary: Scanners, sniffers, fuzzers, spoofers, and other nonexploit features

Encoder: Ensures that payloads make it to their destination intact and undetected

Nop: Keeps payload sizes consistent across exploit attempts

Each type includes many modules, grouped by subtype or platform. Particular modules are specified by their path, as shown in the graphic below:

Metasploit example commands

search EternalBlue type:exploit will search for all exploits that reference EternalBlue.

search Windows/MSSQL type:exploit will find exploits that can be used against Microsoft SQL running on Windows.

search Windows/SMB type:exploit -S excellent will list all Windows-based SMB exploits that have an excellent (most reliable) rating.

Site surveys; parts of it

Fences, motion detection,

USB drop key

Form of baiting where malicious actors will drop an thumb drive in public area for someone to take and expose to their own computer

RFID

a standard for identifying and keeping track of objects' physical locations through the use of radio waves. RFID has many applications, but in the context of physical security, it is often used with identification badges and works in the following manner:

An RFID tag that contains an antenna and a microchip is attached to the badge.

A door lock that contains an RFID reader continuously sends a signal into the area surrounding the reader.

The RFID tag's antenna picks up this signal when in close proximity and the microchip generates a return signal.

The RFID reader receives this signal and opens the lock if the signal is authenticated.

A security student wants to start conducting vulnerability scans on their own network. The student wants to be able to use a commercial tool, but that is available for free for home use.

Which of the following could the security student use?

Nessus

Which of the following statements BEST describes how containers operate and how they can be tested for vulnerabilities during a penetration test?

Containers rely on operating system-level resource separation rather than a hypervisor, and typical container vulnerabilities include configuration issues, application flaws, and network policy misconfigurations

An organization is planning to perform a security assessment to identify vulnerabilities in its network. Which of the following approaches will provide the MOST detailed information about internal system configurations, installed software, and user-specific settings?

Authenticated scan

Which of the following tools is BEST suited for scanning a web server for outdated versions, vulnerable files, and programs, but may leave a large footprint in the server's log files?

nikto

When performing a secrets scanning task during a penetration test, which of the following is the MOST appropriate approach to efficiently identify sensitive information such as credentials, API keys, and encryption keys?

Using an automated tool like TruffleHog to scan code repositories and other assets

A penetration tester is tasked with assessing a wireless access point (WAP) in a coffee shop offering free Wi-Fi. The tester discovers that the connection is not encrypted, and decides to intercept the 4-way handshake to attempt a brute-force attack on the pre-shared key.

Which of the following is the most appropriate first step the penetration tester should take in this scenario?

Passively listen for network traffic to capture the 4-way handshake using a wireless sniffer

A penetration tester is assessing a web application for vulnerabilities. After initial manual testing, the pentester decides to use automated tools to speed up the process. The assessment includes scanning for exposed API keys, examining form fields, and looking for vulnerabilities such as SQL Injection and insecure server configurations.

The pentester uses both SAST and DAST methods to test the application, and SCAP to ensure compliance with security standards.

Which of the following actions best exemplifies the pentester's dynamic testing process?

Using automated tools to scan for vulnerabilities in the live web application during production

As a security analyst, you are using Metasploit to test the security of a web application. You need to perform additional tasks on a compromised host after successfully exploiting it.

Which Metasploit module type should you use?

post