Gunadarma workshop security
-
Upload
rungga-reksya-sabilillah -
Category
Technology
-
view
247 -
download
2
Transcript of Gunadarma workshop security
Who Am I ?Rungga Reksya Sabilillah
rungga_reksya
3
Teacher of TIK SDIT (2007)Assistant IT Lab (2008-2009)IT SupportIT Auditor at Conventional BankIT Auditor at Islamic BankSecurity and Infrastructure Auditor at MediaIT Consultant
Certified Risk Management 1st / BSMR (2010)Certified Ethical Hacking / CEH (2013)Lead Auditor ISO 27001 (2013)Lead Auditor ISO 20000 (2014)Security Analyst / ECSA (2015)Security Certified Professional / OSCP (2015)Certified Network Defender / CND (2016)Lead Auditor ISO 22301 (2017)
S1 – Teknik Informatika (2005 – 2009)S2 – Manajemen Sistem Informasi (2011-2013)
Wushu Athletes at The PORDA II Banten (2006)Leader of Wushu Gunadarma (2007-2008)
Favorite Operating Systems of Hackers(2017 Lists)
4
Kali Linux
https://techlog360.com/top-15-favourite-operating-systems-of-hackers/
It was developed by Mati Aharoni and
Devon Kearns of Offensive Security
through the rewrite of BackTrack, their
previous forensics Linux distribution
based on Ubuntu.
Backbox Linux Parrot Security OSBackBox is an Ubuntu-based Linux
distribution penetration test and security
assessment oriented providing a network
and informatic systems analysis toolkit.
BackBox desktop environment includes
a complete set of tools required for
ethical hacking and security testing.
Parrot Security OS (or ParrotSec) is a
GNU/LINUX distribution based on
Debian. It has been developed by
Frozenbox’s Team.
rungga_reksya
Favorite Operating Systems of Hackers(2017 Lists)
5
Live Hacking OSLive Hacking OS is a Linux distribution
packed with tools and utilities for ethical
hacking, penetration testing and
countermeasure verification. It includes
the graphical user interface GNOME
inbuilt.
Bugtraq Dracos LinuxBugtraq is an electronic mailing list
dedicated to issues about computer
security. Bugtraq team is experienced
freaks and developers, It is available in
Debian, Ubuntu and OpenSuSe in 32 and
64 bit architectures.
Dracos Linux is an open source
operating system provides to penetration
testing. Packed with a ton of pentest
tools including information gathering,
forensics, malware analysis, maintaining
access, and reverse engineering.
rungga_reksya
Incident Classification Patterns(2015 Data Breach Investigations Report)
7
Percentage (blue bar), and count of breaches per pattern. The gray line represents the percentage of breaches from the 2015 DBIR. (n=2,260)
40% Web App Attacks
23% POS Intrusions
831Hacking - Use of stolen credential
817Social - Phishing
817Hacking - Use of backdoor or C2
812Malware – Spyware / Key logger
Top 10 Threat action varieties within Web App Attack breaches, (n=879)
rungga_reksya
PERSON
Birth and Rebirth of a Data Breach. Having an understanding of how patterns complement each other can help direct your efforts as to what to prioritize your limited resources against.
8
Email Attachment
Alter Behavior à User Desktop à Malware InstallationPhishing Email Link
rungga_reksya
Birth and Rebirth of a Data Breach. 9
Payment
POS Terminal
rungga_reksya
Steal Credential
Use of Stolen Credential
Direct Install Malware à
Backdoor, Export Data
Having an understanding of how patterns complement each other can help direct your efforts as to what to prioritize your limited resources against.
10
Three Critical Components for an Information Security
Integrity I A
C
Availability
Confidentiality
rungga_reksya
Information Security Look Like Football 11
Formation = Framework- ISO/IEC 27001- NIST SP 800
(Computer Security)- PCI DSS- HIPAA- ISMF
GK-DEFENDER
MIDFIELDER
STRIKER
COACHSysadmin, Network, Firewall,
SIEM, etc.
InfoSec Officer, Risk Management Internal,
Compliance, etc.
InfoSec Consultant, Pentester, etc.
Top Management, CISO
rungga_reksya
Supporter Soccer
Stakeholder
CRITICAL COMPONENTS of ITSM12
PEOPLE
Four ITSM Components That Need to be Integrated with ISMS
Technical Vulnerability Management
(Annex 12.6), etc.
Supplier Relationships(Annex 15), etc.
Information Security Policies (Annex 5);
Segregation of Duties(Annex 6.1.2), etc.
Information Security Awareness
(Annex 7.2.2), etc.
PRODUCT SUPPLIER PROCESS
rungga_reksya
Intelligence Gathering
Threat Modeling and Vulnerability Analysis
Exploitation
Reporting
SUCCESSFUL RESULT
13
Penetration Testing Methodologies and Standards
http://resources.infosecinstitute.com/penetration-testing-methodologies-and-standards/
Pre-engagement Interactions
rungga_reksya
Penetration Testing Methodologies and Standards14
PENETRATIONTESTINGBLACKBOX WHITE BOX
GRAYBOX
rungga_reksya
FrameworkPenetration Testing
15
Web Application Security Consortium
Threat Classification
Open Source Security Testing
Methodology Manual
WASCOpen Web Application Security
Project Testing Guide
OSSTMM OWASP
rungga_reksya
The Open Web Application Security Project16
rungga_reksya
OWASP Top 10 – 2010 (old) OWASP Top 10 – 2013 (New)2010-A1 – Injection 2013-A1 – Injection
2010-A2 – Cross Site Scripting (XSS) 2013-A2 – Broken Authentication and Session Management
2010-A3 – Broken Authentication and Session Management 2013-A3 – Cross Site Scripting (XSS)
2010-A4 – Insecure Direct Object References 2013-A4 – Insecure Direct Object References
2010-A5 – Cross Site Request Forgery (CSRF) 2013-A5 – Security Misconfiguration
2010-A6 – Security Misconfiguration 2013-A6 – Sensitive Data Exposure
2010-A7 – Insecure Cryptographic Storage 2013-A7 – Missing Function Level Access Control
2010-A8 – Failure to Restrict URL Access 2013-A8 – Cross-Site Request Forgery (CSRF)
2010-A9 – Insufficient Transport Layer Protection 2013-A9 – Using Known Vulnerable Components (NEW)
2010-A10 – Unvalidated Redirects and Forwards (NEW) 2013-A10 – Unvalidated Redirects and Forwards
3 Primary Changes: § Merged: 2010-A7 and 2010-A9 -> 2013-A6
§ Added New 2013-A9: Using Known Vulnerable Components § 2010-A8 broadened to 2013-A7
Exploit Database36845 Exploit Archieved, 82454 CVE ID, 3000 Modules on Metasploit, etc.
https://www.exploit-db.com https://packetstormsecurity.com https://cve.mitre.org https://www.rapid7.com/db/modules
Exploit DB Packet Storm Common Vulnerabilities & Exposures
Rapid 7
rungga_reksya
17
41 2 3
Bug Bounty Programs18
https://bugcrowd.com
Bug Crowd
http://bugsheet.com
Bug Sheet
https://hackerone.com
Hacker One
https://firebounty.com
Fire Bounty
https://bountyfactory.io
Bounty Factory
https://www.openbugbounty.org
Open Bug Bounty
rungga_reksya
rungga_reksya
Information Gathering The Object of Penetration Testing
19
Information Gathering
Target Discovery
EnumeratingTarget
VulnerabilityMapping
rungga_reksya
Information Gathering The Object of Penetration Testing
20
Information Gathering
Target Discovery
EnumeratingTarget
VulnerabilityMapping
21
Concept of Takeover System
PWNSVR
SQL InjectionMake Form
Upload
Phishing
XSS
Login toMYSQL
SHELL
Login toAPP
UploadFile
rungga_reksya
22
PORTSTATES
1Open: This indicates that an application is listening for connections on this port.
3Filtered: This indicates that the probes were not received and the state could not be established. It also indicates that the probes are being dropped by somekind of filtering. 5
Open/Filtered:This indicates that the port was filtered or open but Nmap couldn't establish the state.
2Closed: This indicates that the probes were received but there is no application listening on this port.
4Unfiltered: This indicates that the probes were received but a state could not be established.
6Closed/Filtered: This indicates that the port was filtered or closed but Nmap couldn't establish the state. rungga_reksya
NMAP Features
NMAP Features23
ü Host Discovery
ü Service/Version Detection
ü Operating System Detection
ü Network Tracerouter
ü Nmap Script Engine
Fingerprinting services of a remote host T
P
Target (192.168.1.0/24)
IP Pentester(10.0.0.10)
rungga_reksya
How it Works24
Service detection is one of the most loved features of Nmap, as it's very useful in many situations such as identifying security vulnerabilities or making sure a service is running on a given port. # nmap -sV –-version-intensity 9
Service Detection
Aggressive Detection
Finding Live Hosts
NSE Scripts
Nmap has a special ag to activate aggressive detection, namely -A. Aggressive mode enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute). # nmap -A <target> # nmap -sC -sV -O <target>
Finding live hosts in a network is often used by penetration testers to enumerate active targets, and by system administrators to count or monitor the number of active hosts. # nmap -sP 192.168.1.1/24
Ping scanning does not perform port scanning or service detection, but the Nmap Scripting Engine can be enabled for scripts depending on host rules, such as the cases of sniffer-detect and dns-brute. # nmap -sP --script discovery 192.168.1.1/24
rungga_reksya
Port States Service25
Common
1433mssql
23telnet
21ftp
3306mysql
3389remote
22ssh
80http 53
domain
25smtp
445smb
8080tomcat
5432postgresql
8009ajp13
rungga_reksya
Cheat Sheet28
# nikto – h [url]NIKTO NMAP SEARCH SPLOIT
# nmap – sV ip_target # searchsploit target_name
# log# privilege::debug# sekurlsa::logonpasswords
# net user hacker P@ssw0rd /add# net localgroups administrators hacker /add
# echo pastecodebase64 | base64 -dBASE 64 DECODE CREATE USER MIMIKATZ
rungga_reksya
Case StudyTurn on Your VM:- Target: 192.168.1.2 - Kali Linux: 192.168.1.3 (root::toor)
29
NIKTO
SEARCHPLOIT
PHPMYADMIN
SHELL
NETUSER
DUMP
rungga_reksya
So You Want to be a Penetration Tester
Feeling
Untiring
Out of The Box
Experience
Lucky
rungga_reksya