Difference between Penetration testing and Vulnerability scan

Penetration Testing Windows 7 Machine for Remote Desktop Vulnerability

Penetration Testing Windows 7 by Crashing the Machine Using Remote Desktop Connection Vulnerability.

This is a tutorial for penetration testing the Windows 7 machine for the remote desktop connection vulnerability using everyone’s favorite exploitation, Framework. Earlier there were exploits for the unpatched XP Machines, but those don’t exist in modern Operating Systems such as Windows 7.

Generally, we have seen client side exploits and payloads all the time for Windows 7. Social Engineering Toolkit is great for these attacks; however, Windows 7 still has a vulnerability living in it, in the RDP (Remote Desktop Protocol) Port 3389 which is accessible over the LAN and the internet. Over the internet, this gets a little complicated due to the need for port forwarding, but over the LAN this attack is as easy as pie.

All you need to perform this penetration testing tutorial is a Kali machine and a Victim Windows 7 Machine.

Penetration testing Windows 7 with Kali Linux

Let’s begin the tutorial with a scenario where the victim’s Windows 7 machine is over LAN. All we need to get started is the IP address of the Windows 7 machines, which you can easily get either by NMAP or IPCONFIG command.

Start MeTaSploit : msfconsole

Next we need to select the exploit that we are planing to use i.e ms12_020_maxchannelids

Command: use auxillary/dos/windows/rdp/ms12_020_maxchannelids

Now if you don’t know what options this exploit needs, then type the command ” show options ” in msfconsole. This will present you with all the options this exploit needs to be set.

Set the Remote Host IP Address:

Command : set RHOST <Vict-windows 7 IP>

And you are finished!

Just type “exploit”

The target machine will get a blue screen and the machine will crash. The Machine will reboot.

Android Penetration Testing Applications

For any IT Security Enthusiastic , Android Penetration Testing has always been a topic of intrest . The number of Android Users is ever increasing and has crossed the number of Computer users far back . Android supports many penetration testing tools within itself for the IT security reseach analysts to perform the penetration tests from the mobile devices themselves . Well if penetration testing is possible by using the Android Smartphones , then who would care to carry bulky system to various locations to carry out your penetration testing. Penetration testing requiers the involvement of the person into their system, but by using your Android Smartphone, you can perform it at any location in the best way you can at any time.

List of Penetration testing Applications for the Android OS

Networking Testing Applications for Android

Port Scanner: This Application allows the penetration tester to scan ports on a remote host via its IP or domain name (in case of a website) so you can know which ports are open on the host. The Application supports 3G network , protocol recognition among other features .

Fing: Fing is a professional App for network analysis. A simple and intuitive interface helps you evaluate security levels, detect intruders and resolve network issues. It helps you to find out which devices are connected to your Wi-Fi network, in just a few seconds.

Network Discovery: Network Discovery Application is quiet similar to Fing. This Application is used for the Live host discovery and works as a port scanner for a local area network as well.

tPacketCapture: tPacketCapture does packet capturing without using any root permissions. tPacketCapture uses VpnService provided by Android OS. Captured data are saved as a PCAP file format in the external storage.

Droidsheep: Droidsheep Android application is written by Andrew Koch. It works as a session hijacker for non-encrypted sites and allows you to save cookies files/sessions for later analysis. It is no longer available from the developer’s site i.e. droidsheep.de , however you can still find it on freeweb hosting sites uploaded in the groups . Download and Install at your own risk .

FaceNiff: FaceNiff is an app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to. It is possible to hijack sessions only when WiFi is not using EAP, but it should work over any private network.

These applications gives the Penetration Tester the liberty to do major network security analysis with just the Android phone .

Nessus: Nessus the most popular penetration testing tool that is used to perform vulnerability scans with its client/server architecture. Nessus Android app can perform following tasks.

Connect to a Nessus server (4.2 or greater)
Launch existing scans on the server
Start, stop or pause running scans
Create and execute new scans and scan templates
View and filter reports

Shark for Root: Traffic sniffer, works on 3G and WiFi (works on FroYo tethered mode too). To open dump, use WireShark or similar software, to preview dump on phone, use Shark Reader.

PacketShark: This is a packet sniffer application. Features include friendly capture options interface, filter support, live capture view, and Dropbox upload of captured files. It allows viewing of the captured packets — no need to install other application as a viewer.

Network Mapper:

A very fast net scanner for network admins that can scan your network in the office and export as CSV via Gmail to give you a map of what devices are on your LAN.
Includes a port scanner for security audit scans and a MAC vendor database to identify NIC manufacturers.
Can detect firewalled and stealthed computers, quite useful if you are looking for a Windows/firewall box that you can’t see on your network.
Useful if you want to find FTP servers, SSH servers, SMB servers, etc. on your network and would help you to diagnose faults.
You can save the scan results as a CSV file, which can be imported into Excel/Google Spreadsheet/LibreOffice.

DroidSQLi: DroidSQLi is the first automated MySQL Injection tool for Android. It allows you to test your MySQL-based web application against SQL injection attacks.

DroidSQLi supports the following injection techniques:

Time based injection
Blind injection
Error based injection
Normal injection

It automatically selects the best technique to use and employs some simple filter evasion methods.

Sqlmapchik: sqlmapchik is a cross-platform sqlmap GUI for the popular sqlmap tool. It is primarily aimed to be used on mobile devices. The easiest way to install sqlmapchik on an Android device is to download it from Google Play.

dSploit: dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assessments on a mobile device. Once dSploit is started, you will be able to easily map your network, fingerprint alive host’s operating systems and running services, search for known vulnerabilities, crack logon procedures of many tcp protocols, perform man in the middle attacks such as password sniffing, real time traffic manipulation, etc.

These are the available modules in the app:

RouterPWN
Trace
Port Scanner
Inspector
Vulnerability Finder
Login Cracker
Packet Forger
MITM

Revenssis Penetration Suite: Revenssis Penetration Suite is a set of all the useful types of tools used in Computer and Web Application security.

Web Vulnerability Scanners including:
SQL injection scanner
XSS scanner
DDOS scanner
CSRF scanner
SSL misconfiguration scanner
Remote and Local File Inclusion (RFI/LFI) scanners
Useful utilities such as:
WHOIS lookup, IP finder, Shell, SSH, Blacklist lookup tool, Ping tool
Forensic tools (in implementation) such as malware analyzers, hash crackers, network sniffer, ZIP/RAR password finder, social engineering toolset, reverse engineering tool.
Vulnerability research lab (sources include: Shodan vulnerability search engine, ExploitSearch, Exploit DB, OSVDB and NVD NIST)
Self scan and defense tools for your Android phone against vulnerabilities
Connectivity Security Tools for Bluetooth, Wifi and Internet. (NFC, Wifi Direct and USB in implementation)

zANTI: zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety.

zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks – including rogue access points.

Orbot: Orbot is a free proxy app that empowers other apps to use the Internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world. Tor is an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

Orbot is the safest way to use the Internet on Android. Period. Orbot bounces your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.
Use with Orweb, the most anonymous way to access any website, even if it’s normally blocked, monitored, or on the hidden web.
Use Gibberbot with Orbot to chat confidentially with anyone, anywhere for free.
Any installed app can use Tor if it has a proxy feature, using the settings. You can use private web searching with DuckDuckGo.
Orbot can be configured to transparently proxy all of your Internet traffic through Tor. You can also choose which specific apps you want to use through Tor.
Orbot is free software.

OpenVPN: OpenVPN Connect is the official full-featured Android VPN client for the OpenVPN Access Server, Private Tunnel VPN and OpenVPN Community, developed by OpenVPN Technologies, Inc.

Does not require a rooted device.
Easily import .ovpn profiles from SD card, OpenVPN Access Server, Private Tunnel or via a browser link.
Improved power management – preferences setting allows VPN to pause in a low-power state whenever screen is blanked or network is unavailable.
Android Keychain integration – OpenVPN profiles may reference a cert/key pair in the Android keychain.
Supports hardware-backed keystores
Support for multi-factor authentication using OpenVPN static and dynamic challenge/response protocols.
Full IPv6 support (at both the tunnel and transport layer).

Orweb: Orweb is the most privacy-enhancing web browser on Android for visiting any website, even if it’s normally censored, monitored, or on the hidden web. Orweb is the safest browser on Android. Orweb evades tracking and censorship by bouncing your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.

Orweb bypasses almost every kind of network restriction.
Orweb does not store any information about the websites you visit.
You can prevent sites you visit from installing any cookies (which could track your web activities), allow them selectively, or allow any site to create cookies.
JavaScript, a common attack method for malicious software, is disabled by default.
Orweb is opensource.
Orweb attempts to prevent Flash from loading on sites you visit, blocking many common security threats.
Orweb is available in: Arabic, Chinese, Dutch, English, Esperanto, Farsi, French, German, Hungarian, Italian, Norwegian, Russian, Spanish, Swedish and Tibetan.

Due to the rapid increase in the Android Operating System , these tools and applications come quiet in handy while penetration testing . Achieve anonimity and perform web application Assessments on a Palm size Androis Smart Phone, a dream come true for the penetration testers .

Discalimer : Penetration testing without authorisation is punshable offence in Law . This artical is meant for the educational purposes only .

Nmap Cheat Sheet – Port Scanning Basics for Ethical Hackers

Network mapper, also known as nmap, is an open-source network reconnaissance, port scanning, and security auditing tool. It is one of the most basic and widely used cybersecurity tools that has evolved from a simple port scanner to a multifunctional toolset. It is an ideal tool for security practitioners, network, IT, and system administrators to customize the open source code for specialized environments. Hence, it’s a Swiss Army knife for cybersecurity and IT professionals.

The article is a basic-intermediate level guide on analyzing networks using the Nmap utility. You will understand Nmap functionality to scan entire networks and check for available services and unpatched vulnerabilities to help you advance in the cyber kill chain process.

Types of Nmap Scan

Nmap offers multiple scanning techniques such that each method significantly contributes to the results after a port scan. However, it only allows one scan type at a time with a format of -s<scan_type>. Some of the most common nmap scan types are:

nmap -s<scan_type> <target_host>

Ping Sweep (-sn): This type of nmap scan sends ICMP packets to discover the number of devices that respond to it. Ping sweep helps determine the number of available or active devices on the network. It is fast and hard to detect.
TCP (-sT): TCP connect scan completes the three-way handshake between the scanning machine and the target host, such that it’s noisy and triggers the packet filtering platforms like firewalls and intrusion detection systems.
UDP (-sU): The -sU option in nmap looks for the active UDP protocol ports listening for a connection. Nmap combines this scan with the TCP connect scan to check open ports for both protocols. However, its results can be falsely positive, and the response is slow as a precautionary measure by target machines to such packets.
SYN (-sS): Also known as the half-open or stealth scan because the scanner immediately responds with the RST packet after receiving the SYN-ACK packet from the target host. Hence, it closes the connection before completing the handshake.
FIN (-sF): It’s the same as the SYN scan except that Nmap sends the FIN flag instead of an RST in a packet for closing the connection.
NULL (-sN): The target systems do not know how to respond to a Null scan as all the flags inside the TCP header are off or set to null.
XMAS (-sX): XMAS is the same as the null scan, except that nmap turns on all the flags in the TCP header.

Specifying Targets for Nmap Scan

Anything that isn’t an option or a flag in nmap is dealt with as a target host. It allows us to specify a range of hosts in a single command. The most simple among them is the specification of a single hostname or the target host address.

sudo nmap <www.hostname.com>

On providing the hostname as a target, nmap uses DNS resolution to resolve the hostname to an IP address and perform the target discovery process to confirm its availability. The hostname may resolve to more than one IP address, in which case, by default, it considers the first one. You can use the –all-resolve option for nmap to scan all addresses.

sudo nmap --all-resolve <www.hostname.com>

Nmap allows you to specify targets in three various ways:

Multiple Specifications: Nmap allows to specify multiple IP addresses at a time as follows:

sudo nmap X.X.X.21, X.X.X.28, X.X.X.45

CIDR notation: The CIDR notation-based addressing allows scanning of a whole network or a range of adjacent IP addresses. All it requires is to append the IP address/hostname with the network suffix/bits as follows:

sudo nmap <X.X.X.0/24>

sudo nmap <www.hostname.com/24>

Hence, nmap will scan all the IP addresses from X.X.X.0 to X.X.X.255. Nmap also allows you to exclude an IP address with the help of the –exclude option as follows:

sudo nmap <X.X.X.0/24> --exclude X.X.X.25, X.X.X.35

However, it’s not flexible in a scenario when you want to exclude IPs including .0 and .255 for subnetworks and broadcast addresses, as in the case of X.X.0.0/16. Nmap resolves this issue by introducing octet-based addressing.

Octet range: It allows you to use wild cards * and – for a comma-separated range of numbers for each octet. For instance, for the target address, X.X.0-255,1-254 nmap will skip all addresses that end in .0 and .255.

Similarly for the address range X.X.2-5,8.1 nmap will scan addresses X.X.2.1, X.X.3.1, X.X.4.1, X.X.5.1, and X.X.8.1.

nmap X.X.2-5,8.1

Lastly, given the ip address of X.X.X.* nmap will scan all addresses from 0 to 255.

Input Target Address List to Nmap

Even though Nmap provides multiple ways to specify target host addresses, it’s infeasible to write down all of them in a single command. Specifically, in a scenario when a DHCP leases around 100 IPs that you wish to scan.

Use the -iL argument to pass Nmap the .txt file containing a list of hosts for scan, such that each entry can be in any of the formats (discussed above) supported by the utility.

sudo nmap -iL <target_hosts.txt>

Specifying Ports for Nmap Scan

Port scanning is the heart of nmap as it helps to identify ports state and running services. Port scanning in nmap works by specifying targets to find information, but it isn’t necessary as mostly we don’t have a complete picture of the network. Nmap recognizes ports state based on six types:

Open: the application or service is listening for tcp or udp connections.
Filtered: nmap cannot determine the port state due to packet filtering via firewall or routing rules.
Closed: the probes were successful, but no service is listening for a connection on this port.
Unfiltered: the probes were successfully received, but nmap can not determine their state. In this scenario, the SYN and FIN scans may help determine if the port is open or not.
Open|Filtered: nmap can not establish if the port state is listening for connections or filtered. It happens when the open port does not respond to the probe. It also occurs when a packet filter drops the nmap probes or any response sent by the target.
Closed|Filtered: it is a state when it is unclear if the port is closed or filtered.

Nmap provides a list of essential options to perform a port scan. To begin with, the bare minimum, specify the target IP address, hostname, or network range as follows:

nmap <IP_address>/<www.hostname.com>

The above command performs a default scan that will probe 1000 TCP ports and provide all the host-related information, their states, and the services running. However, it takes a lot of time and may invoke firewall or intrusion detection systems. To avoid firewall or IDS detection, you can use the following nmap options:

To scan a single port:

sudo nmap -p 80 <hostname>

To scan a single port:

sudo nmap -p 1-100 <hostname>

To perform a fast scan on the 100 most common ports:

sudo nmap -F <hostname>

To scan port based on service:

sudo nmap -p smtp,https <hostname>

To find more about all available port scanning options via the nmap -h command.

Service and Host Discovery

Nmap offers various options to grab information about the operating system and the running services to determine open ports.

To detect the operating system alone:

nmap -O <target_host>

To detect the service and host machine:

nmap -A <target_host>

Service Version Discovery

Nmap allows you to find more details about the services running on the target machine ports. Add the -sV option to the nmap scan for a standard service version discovery:

nmap -sS -sV <target_host>

It also enables us to set the intensity of the scan with the help of a –version-intensity option for an aggressive and light service detection scan. High version intensity for service scanning provides more accurate results however, it takes more time, creates noise, and has high chances of detection.

nmap -sV --version-intensity 5 <target_host>

While the banner grabbing lightweight detection has more advantages in terms of staying undetected during services enumeration.

nmap -sV --version-intensity 0 <target_host>

Saving Nmap Output

Nmap offers various file formats to save its output. By default, nmap stores the scan output in .txt format with a simple redirect >.

nmap -sS -p 80,443 <target_host> > nmap_outputfile

Whereas the nmap -oN option stores the scan results and displays the output at the same time.

nmap -oN nmap_outputfile.txt <target_host>

For XML and grep formats use -oX and-oG options as follows:

nmap -sS -sV --version-intensity 5 -oX nmap_outputfile.xml <target_host>

nmap -sS -sV --version-intensity 5 -oX nmap_outputfile.txt <target_host>

To save the results in all formats:

nmap -oA nmap_outputfile <target_host>

Nmap Scripting Engine (NSE)

NSE is a powerful nmap functionality that expands its features considerably. The NSE scripts are written in Lua language and help perform various tasks such as scanning for vulnerabilities (vuln), brute forcing credentials (brute), and bypassing authentication (auth) of running services. Use the –script option to activate the script as follows:

nmap -sV -p 80 --script=vuln <target_host>

To find more about the available database of NSE scripts, cd into the /usr/share/nmap/scripts/ directory:

cd /usr/share/nmap/scripts

head scripts.db

Or grep all the available scripts for a particle protocol as follows:

grep "ftp" /usr/share/nmap/scripts/scripts.db

Conclusion

Nmap is a command-line utility with versions for both Windows and Linux. It’s a versatile tool for network administrators and security practitioners to resolve issues and find flaws. The article is a beginner’s guide for getting started with the Nmap tool, analyzing network services and their vulnerabilities.

Difference between Penetration testing and Vulnerability Scan

In our previous tutorial we have learnt what is penetration testing or pen testing. Today we will learn what is the difference between penetration testing and Vulnerability scanning or assessment. Most users believe that penetration testing is just an vulnerability scan but its a myth as Vulnerability scan or assessment is just one step or part of Penetration testing i.e. we can say vulnerability scan is just an subset of Penetration testing. Vulnerability scan or vulnerability assessment is limited to scanning of known vulnerabilities and reports potential exposures of an web based or network based IT system.

Difference between Penetration testing and Vulnerability Scan

A vulnerability assessment is the process of running automated tools against defined systems to identify known vulnerabilities or flaws in the environment. Vulnerabilities typically include unpatched or mis-configured systems. The purpose of a vulnerability scan is to identify known vulnerabilities so they can be mitigated, normally through vendor supplied patches.

Penetration testing takes the vulnerability assessment to the next level. One of the initial phases performed by a penetration tester is to perform a vulnerability scan to do information gathering like get IP addresses, device type, operating systems, services running and vulnerabilities present on the systems, however unlike the vulnerability scan, the penetration tester does not stop there. The next phase of a penetration test is exploitation which takes advantage of the vulnerabilities identified in the system to escalate privileges to gain control of the network or to steal sensitive data from the system. The exploitation phase also uses automated tools which the penetration tester can configure to execute automate exploits against the systems. However, one key difference between penetration testers is their ability to also perform manual exploits of the system.

Although Vulnerability assessment and Penetration testing has different goals,but both should be performed to improve the overall security of the information system by a skilled information security professional.The penetration test should be performed at least annually and after significant changes in the information systems environment to identify exploitable vulnerabilities in the environment that may give a hacker unauthorized access to the system while the vulnerability assessment should be performed regularly to identify and mitigate known vulnerabilities on an ongoing basis.

I found difference list between Penetration testing and vulnerability scan by Berkeley Security quite interesting, so sharing that with all of you.

	Vulnerability Scan	Penetration Test
How often to run	Continuously, especially after new equipment is loaded	Once a year
Reports	Comprehensive baseline of what vulnerabilities exist and changes from the last report	Short and to the point, identifies what data was actually compromised
Metrics	Lists known software vulnerabilities that may be exploited	Discovers unknown and exploitable exposures to normal business processes
Performed by	In house staff, increases expertise and knowledge of normal security profile	Independent outside service
Required in regulations	FFIEC; GLBA; PCI DSS	FFIEC; GLBA; PCI DSS
Expense	Low to moderate: about $1200 / yr + staff time	High: about $5,000 per year outside consultancy
Value	Detective control, used to detect when equipment is/could be compromised	Preventative control used to reduce exposure

That’s all about difference between penetration testing and vulnerability scan. So we can conclude that vulnerability scan is basically first phase of Penetration testing. Keep Learning and Keep Connected.

Refreneces :

1. Berkeley Security, University of California

2. A-lign – Ask A-lign