Footprinting for security auditors Jose Manuel Ortega @jmortegac - - PowerPoint PPT Presentation

▶
footprinting for security auditors
SMART_READER_LITE
LIVE PREVIEW

Footprinting for security auditors Jose Manuel Ortega @jmortegac - - PowerPoint PPT Presentation

Dec 07, 2022 253 likes •881 views

Security track Footprinting for security auditors Jose Manuel Ortega @jmortegac Footprinting for securty auditors Agenda Information gathering Footprinting tools Port scanning with nmap Nmap scripts Footprinting for securty

slide-1
SLIDE 1

Footprinting for securty auditors

Security track

Footprinting for security auditors

Jose Manuel Ortega @jmortegac

slide-2
SLIDE 2

Footprinting for securty auditors

Agenda

  • Information gathering
  • Footprinting tools
  • Port scanning with nmap
  • Nmap scripts
slide-3
SLIDE 3

Footprinting for securty auditors

Security auditing phases

Analyze publicly available

  • information. Set

scope of attack and identify key targets. Check for vulnerabilities

  • n each target

resource Attack targets using library of tools and techniques

Footprint Analysis

Who is DNS Lookup Search Engines Enumeration

Exploitation

Buffer Overflows Spoofing Password Rootkit

Scanning

Machines Ports Applications

Damage

“Owning” IP Theft, Blackmail, Defacing, Espionage, Destruction, DoS

slide-4
SLIDE 4

Footprinting for securty auditors

Security Track

Information Gathering

slide-5
SLIDE 5

Footprinting for securty auditors

Footprinting (gather target information)

➔ names, addresses, system types, ...

Scanning (detect systems and services)

➔ response from network stack, applications, ...

Fingerprinting (identify topologies & systems)

➔ network layout, operating systems, services passive passive

  • r

active active

Enumeration (collect access information)

➔ list of user accounts, share names, …

Sniffing (collect network traffic)

➔ addresses, names, information (passwords, ...)

Information gathering

slide-6
SLIDE 6

Footprinting for securty auditors

Footprinting

  • Identify locations, domain names, IP address

ranges, e-mail addresses, dial-in phone numbers, systems used, administrator names, network topology.

  • Using public information.
  • Without network /physical connection to the

target.

slide-7
SLIDE 7

Footprinting for securty auditors

Security Track

Tools

slide-8
SLIDE 8

Footprinting for securty auditors

Kali Linux

slide-9
SLIDE 9

Footprinting for securty auditors

Whois Online Tools

  • Get information about domains, IP address, DNS
  • Identify the domain names and associated networks related to a

particular organization

  • https://www.whois.net/
  • https://tools.whois.net/
  • http://www.whois.com/whois
  • http://who.is
  • http://toolbar.netcraft.com/site_report
  • http://whois.domaintools.com/
slide-10
SLIDE 10

Footprinting for securty auditors

Netcraft

  • http://toolbar.netcraft.com/site_report/?url=fosdem.org
slide-11
SLIDE 11

Footprinting for securty auditors

Whois

slide-12
SLIDE 12

Footprinting for securty auditors

Whois command

slide-13
SLIDE 13

Footprinting for securty auditors

Host command

  • Ge IPv4,v6,mail server
slide-14
SLIDE 14

Footprinting for securty auditors

Network tools

  • http://network-tools.com/
slide-15
SLIDE 15

Footprinting for securty auditors

NETWORK Tools

  • https://www.dnssniffer.com/networktools
slide-16
SLIDE 16

Footprinting for securty auditors

slide-17
SLIDE 17

Footprinting for securty auditors

Robtex

  • Provides graphical information from DNS and Whois
  • https://www.robtex.com/dns-lookup/fosdem.org
slide-18
SLIDE 18

Footprinting for securty auditors

Robtex

slide-19
SLIDE 19

Footprinting for securty auditors

Nslookup

  • Query DNS server in order to extract valuable information about the

host machine.

  • Find names of machines through a domain/zone transfer
  • Nslookup -d→ list all associated records for the domain
slide-20
SLIDE 20

Footprinting for securty auditors

Dig /DNS Resolver

slide-21
SLIDE 21

Footprinting for securty auditors

Dnsmap

slide-22
SLIDE 22

Footprinting for securty auditors

Dnsenum

slide-23
SLIDE 23

Footprinting for securty auditors

DnsRecon

slide-24
SLIDE 24

Footprinting for securty auditors

Zone Transfer

  • How does one provide security against DNS Interrogation?
  • Restrict zone transfers to authorized servers.
  • Set your firewall or router to deny all unauthorized inbound

connections to TCP port 53

  • Best practice to restrict Zone transfers is review file

configuration /etc/bind/named.conf.local

slide-25
SLIDE 25

Footprinting for securty auditors

Subdomains

  • https://api.hackertarget.com/hostsearch/?q=fosdem.org
slide-26
SLIDE 26

Footprinting for securty auditors

The harvester

  • Catalogue email address and subdomains from a specific domain.
  • It works with all the major search engines including Bing and Google.
  • The objective is to gather emails, subdomains, hosts, employee

names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database.

slide-27
SLIDE 27

Footprinting for securty auditors

The harvester

slide-28
SLIDE 28

Footprinting for securty auditors

The harvester

slide-29
SLIDE 29

Footprinting for securty auditors

Maltego

slide-30
SLIDE 30

Footprinting for securty auditors

Maltego

∙ Company Stalker (this gathers email information) ∙ Footprint L1 (basic information gathering) ∙ Footprint L2 (moderate amount of information

gathering)

∙ Footprint L3 (intense and the most complete

information gathering)

slide-31
SLIDE 31

Footprinting for securty auditors

Maltego

slide-32
SLIDE 32

Footprinting for securty auditors

Shodan

slide-33
SLIDE 33

Footprinting for securty auditors

Censys.io

slide-34
SLIDE 34

Footprinting for securty auditors

Mr looquer

slide-35
SLIDE 35

Footprinting for securty auditors

Web robots

  • https://wordpress.com/robots.txt
  • https://wordpress.com/sitemap.xml
slide-36
SLIDE 36

Footprinting for securty auditors

Web Archive

slide-37
SLIDE 37

Footprinting for securty auditors

Spider foot

slide-38
SLIDE 38

Footprinting for securty auditors

Spider foot

slide-39
SLIDE 39

Footprinting for securty auditors

Scanning tools

  • Active footprinting
  • Number and type of opened ports
  • Type of services running in the servers
  • Vulnerabilities of the services and software
  • Nmap is a great tool for discovering Open ports, protocol

numbers, OS details, firewall details, etc.

slide-40
SLIDE 40

Footprinting for securty auditors

Security Track

NMAP

slide-41
SLIDE 41

Footprinting for securty auditors

Nmap Port Scanner

  • Unix-based port scanner
  • Support for different

scanning techniques

  • Detects operating system
  • f remote hosts
  • Many configuration options
  • timing
  • scanned port range
  • scan method
  • Various front ends

for easier handling

slide-42
SLIDE 42

Footprinting for securty auditors

Zenmap Port Scanner

slide-43
SLIDE 43

Footprinting for securty auditors

Zenmap Port Scanner

slide-44
SLIDE 44

Footprinting for securty auditors

Sparta

slide-45
SLIDE 45

Footprinting for securty auditors

Nmap whois

slide-46
SLIDE 46

Footprinting for securty auditors

Guessing the Operating System

  • We can use the --osscan-guess option to force Nmap

into discovering the OS.

slide-47
SLIDE 47

Footprinting for securty auditors

Banner Grabbing nmap -p80 -sV -sT fosdem.org

slide-48
SLIDE 48

Footprinting for securty auditors

Nmap Script Engine

  • Simple scripts to automate a wide variety of networking

tasks

  • Are written in Lua programming language.
  • Network discovery
  • Vulnerability detection
  • Backdoor detection
  • Vulnerability exploitation
slide-49
SLIDE 49

Footprinting for securty auditors

Nmap Script Engine usr/local/share/nmap/scripts

slide-50
SLIDE 50

Footprinting for securty auditors

Nmap Script Engine

  • https://github.com/cldrn/nmap-nse-scripts/tree/master/

scripts

slide-51
SLIDE 51

Footprinting for securty auditors

Banner grabbing with nmap script nmap --script banner fosdem.org

slide-52
SLIDE 52

Footprinting for securty auditors

http-enum script nmap -v --script http-enum.nse fosdem.org

slide-53
SLIDE 53

Footprinting for securty auditors

↘mysql-databases

nmap -v -d -p3306 --script mysql-databases.nse

  • -script-args='mysqluser=root' 192.168.100.8
slide-54
SLIDE 54

Footprinting for securty auditors

↘mysql-databases

slide-55
SLIDE 55

Footprinting for securty auditors

Find vulnerabilities with nmap

  • XSS / SQL Injection

↘nmap -p80 –script http-unsafe-output-escaping <target> ↘http://svn.dd-wrt.com/browser/src/router/nmap/scripts/http-un

safe-output-escaping.nse?rev=28293

↘https://nmap.org/nsedoc/scripts/http-unsafe-output-escaping.ht

ml

slide-56
SLIDE 56

Footprinting for securty auditors

Security Track

Vulnerability Scanner

slide-57
SLIDE 57

Footprinting for securty auditors

Nessus Vulnerability Scanner

slide-58
SLIDE 58

Footprinting for securty auditors

Arachni Vulnerability Scanner

slide-59
SLIDE 59

Footprinting for securty auditors

Links & References

  • http://www.0daysecurity.com/penetration-testing/net

work-footprinting.html

  • http://nmap.org/nsedoc/
  • https://secwiki.org/w/Nmap/External_Script_Library
  • https://nmap.org/book/man-os-detection.html
  • https://hackertarget.com/7-nmap-nse-scripts-recon/
slide-60
SLIDE 60

Footprinting for securty auditors

Books

slide-61
SLIDE 61

Footprinting for securty auditors

Security track

Thank you!

Jose Manuel Ortega @jmortegac