Skip to content

Latest commit

 

History

History
181 lines (119 loc) · 2.88 KB

README.md

File metadata and controls

181 lines (119 loc) · 2.88 KB

Security Testing

Summary

This document is a high level introduction to some security testing tools that are commonly available in the linux ecosystem.

Vagrant Environment

  1. Ansible (2.9.4)
  2. Vagrant (2.2.6)
  3. VirtualBox (6.0.16 r135674)

Running

  1. vagrant up
  2. vagrant ssh

Victim

Virtual Machine that can be addressed via hostname security-testing-victim.local.

Services

Attack Vectors

Network

Domain Name Discovery

dnsmap
dnsmap <domain.com> -d 1 -w <dictionary> -r dnsmap-$(date +%F).log
DNSRecon
dnsrecon -d example.com -D <dictionary> -t brt --xml $(pwd)/dnsrecon.xml

Authentication

ncrack -p <port> --user <username> -P <dictionary> <xxx.xxx.xxx.xxx>

Port Scan

TCP
nmap -Pn -p- <xxx.xxx.xxx.xxx>
UDP
sudo nmap -Pn -sU -F <xxx.xxx.xxx.xxx>

IP Enumeration

nmap -sP <xxx.xxx.xxx.xxx/24>

DOS

Slowloris

slowhttptest -c 65539 -H -g -o $(date +%F) -i 10 -r 200 -t GET -u http://some.domain.com/ -x 24 -p 3

Slow Read

slowhttptest -g -o $(date +%F) -c 65539 -X -r 1000 -w 10 -y 20 -n 5 -z 32 -u http://some.domain.com/ -p 5 -l 350

TCP SYN Flood

sudo hping3 --rand-source <xxx.xxx.xxx.xxx> --flood -S -L 0 -p <port>

TCP FIN Flood

sudo hping3 --flood --rand-source -F -p <port> <xxx.xxx.xxx.xxx>

UDP Flood

sudo hping3 --flood --rand-source --udp -p <port> <xxx.xxx.xxx.xxx>

Apache Bench

ab -c 1000 -n 10000 http://xxx.xxx.xxx.xxx/

DNS Flood

DIG
dig @<xxx.xxx.xxx.xxx> domain.com
mz
sudo /usr/sbin/mz -A rand -B <xxx.xxx.xxx.xxx> -t dns "q=<domain.com>" -c 10000000

Man In The Middle

mitmproxy -R https://some.domain.com:<port>/

Harvesting

theHarvester

theHarvester -d domain.com -b all -f $(date +%F).html

Security Reconnaissance

Arachni

sudo OPENSSL_CONF=/etc/ssl/ /usr/lib/arachni-2.0dev-1.0dev/bin/arachni "http://some.domain.com" --report-save-path ./$(date +%F).afr --plugin=metrics
Generate Report
sudo /usr/lib/arachni-2.0dev-1.0dev/bin/arachni_reporter --reporter=html:outfile=$(date +%F).html.zip ./$(date +%F).afr

Skipfish

skipfish -o $(date +%F).log http://some.domain.com

HTCAP

htcap crawl -v 'http://some.domain.com/' $(date +%F).db
Generate Report
htcap util report ./$(date +%F).db ./$(date +%F).html

Wapiti

wapiti 'http://some.domain.com/' --output $(date +%F)