Security monitoring - Penetration testing meets monitoring

Security monitoring - Penetration testing meets monitoring

Presented at Monitorama EU 2013

How often do you have a full penetration test done on your application? How often do you deploy changes to your application? This talk is for everyone who worries about the difference between the answers to those two questions.

Penetration testing and other forms of security testing are often a mystery to developers and operations people alike, a specialist skill available only on the largest projects. With lots of good open source penetration testing tools available it doesn't have to be that way, especially if we can turn some of those tools into things we run constantly from our monitoring system.

This talk will:

* Identify security relevant metrics from a few tools available in a typical web stack
* Suggest a few more useful system tools which provide both protection and metrics
* Highlight a number of open source penetration testing tools, and show a few of them in use
* Find out which of those tools lend themselves to automation
* Bring it all together in a modern monitoring system

After the talk the audience will hopefully be:

* Scared of putting things on the internet
* Wanting to install a few simple tools that provide some protection
* Aware of a number of penetration testing tools they can use with their monitoring systems

98234c645fe8c935edc0fec0186d28b8?s=128

Gareth Rushgrove

September 20, 2013
Tweet

Transcript

  1. 5.
  2. 6.

    How did it come to this, that the government has

    one of the most exciting start-ups in the UK?!
  3. 7.
  4. 8.
  5. 10.
  6. 27.

    Tuxtendo Rootkit [ Not found ] URK Rootkit [ Not

    found ] Vampire Rootkit [ Not found ] VcKit Rootkit [ Not found ] Volc Rootkit [ Found ] Xzibit Rootkit [ Not found ] X-Org SunOS Rootkit [ Not found ] zaRwT.KiT Rootkit [ Not found ] ZK Rootkit [ Not found ] Performing additional rootkit checks Suckit Rookit additional checks [ OK ] Checking for possible rootkit files and directories [ None found ] Checking for possible rootkit strings [ None found ] Gareth Rushgrove
  7. 28.
  8. 30.

    rkhunter \ --check \ --nocolors \ --no-mail-on-warning \ --skip-keypress \

    --no-summary | rkhunter-librato.py Gareth Rushgrove
  9. 38.

    SecRulesEnabled; DeniedUrl "/RequestDenied"; CheckRule "$SQL >= 8" BLOCK; CheckRule "$RFI

    >= 8" BLOCK; CheckRule "$TRAVERSAL >= 4" BLOCK; CheckRule "$EVADE >= 4" BLOCK; CheckRule "$XSS >= 8" BLOCK; Gareth Rushgrove
  10. 39.

    2013/09/18 08:59:57 [error] 891#0: *6 NAXSI_FMT: ip=192.168.50.20&server=victim&uri=/pictures/ search.php&total_processed=14&total_blocked=7&zo ne0=ARGS&id0=1007&var_name0=query, client:

    192.168.50.20, server: localhost, request: "GET /pictures/search.php?query=--%3E+ %3Csome_dangerous_input_a1056fd2f0ffbb7f18fec9bd 33257e12ab5e0494b33011967bcbcbc5699408eb%2F%3E+ %3C%21-- HTTP/1.1", host: "victim" Gareth Rushgrove
  11. 43.

    grok { type => "nginx_error" match => ["message", " ip=%{IP:client_ip}&

    server=%{IP:server_ip}& uri=%{PATH:uri}& total_processed=%{NUMBER:total_processed}& total_blocked=%{NUMBER:total_blocked}& zone0=%{WORD:zone}& id0=%{NUMBER:id}"] } Gareth Rushgrove
  12. 47.

    [ssh] enabled = true port = ssh filter = sshd

    logpath = /var/log/auth.log maxretry = 3 [ssh-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 Gareth Rushgrove
  13. 49.

    [nginx-naxsi] enabled = true port = http,https filter = nginx-naxsi

    logpath = /var/log/nginx/*error.log maxretry = 2 Gareth Rushgrove
  14. 50.

    grok { type => "naxsi_fail2ban" match => ["message", " WARNING

    \[nginx-naxsi\] %{WORD:action} %{IP:ip}" ] } Gareth Rushgrove
  15. 54.

    type=CWD msg=audit(1379493067.779:57): cwd="/tmp" type=PATH msg=audit(1379493067.779:57): item=0 name="vagrant-puppet" inode=20 dev=fc:00 mode=041777

    ouid=0 ogid=0 rdev=00:00 type=SYSCALL msg=audit(1379493067.779:58): arch=c000003e syscall=83 success=yes exit=0 a0=7fff172d0e5e a1=1ed a2=1ed a3=7fff172cf910 items=2 ppid=1239 pid=1241 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21 comm="mkdir" exe="/bin/mkdir" key=(null) type=CWD msg=audit(1379493067.779:58): cwd="/tmp/ vagrant-puppet" Gareth Rushgrove
  16. 62.

    Skipfish, nikto, w3af, garmr, sslyze, owasp zap, arachni, sqlmap, sslscan,

    TLSSLed, slowhttptest, DIRB, SQLiBF Gareth Rushgrove
  17. 73.

    Starting Nmap 5.21 ( http://nmap.org ) at 2013-09-18 15:09 BST

    Nmap scan report for monitorama.eu (141.101.116.49) Host is up (0.17s latency). Hostname monitorama.eu resolves to 2 IPs. Only scanned 141.101.116.49 Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 24.18 seconds Gareth Rushgrove
  18. 77.

    1) the monitorama.eu website should have one port open Failure/Error:

    @host.open_ports.should have(1).items expected 1 items, got 2 Finished in 8.99 seconds 1 example, 1 failure Gareth Rushgrove
  19. 82.

    + +[+] 2 issues were detected. + +[+] [1] Trusted

    -- Cross-Site Scripting (XSS) +[~] ~~~~~~~~~~~~~~~~~~~~ +[~] ID Hash: +[~] Severity: High +[~] URL: http://victim/pictures/search.php +[~] Element: form +[~] Method: GET +[~] Tags: xss, regexp, injection, script +[~] Variable: query +[~] Description: +[~] Client-side code (like JavaScript) can be injected + into the web application which is then returned to + the user's browser. This can lead to a compromise + of the client's system or serve as a pivoting + point for other attacks. + Gareth Rushgrove