Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security monitoring - with open source penetration testing tools

Security monitoring - with open source penetration testing tools

Talk given at Velocity Europe. This is an extended version of my previous security monitoring talk given at Monitorama. This talk contains even more examples and a new section on security monitoring as part of the development process.

Gareth Rushgrove

November 15, 2013
Tweet

More Decks by Gareth Rushgrove

Other Decks in Technology

Transcript

  1. How did it come to this, that the government has

    one of the most exciting start-ups in the UK?!
  2. Tuxtendo Rootkit [ Not found ] URK Rootkit [ Not

    found ] Vampire Rootkit [ Not found ] VcKit Rootkit [ Not found ] Volc Rootkit [ Found ] Xzibit Rootkit [ Not found ] X-Org SunOS Rootkit [ Not found ] zaRwT.KiT Rootkit [ Not found ] ZK Rootkit [ Not found ] Performing additional rootkit checks Suckit Rookit additional checks [ OK ] Checking for possible rootkit files and directories [ None found ] Checking for possible rootkit strings [ None found ] Gareth Rushgrove
  3. rkhunter \ --check \ --nocolors \ --no-mail-on-warning \ --skip-keypress \

    --no-summary | rkhunter-librato.py Gareth Rushgrove
  4. SecRulesEnabled; DeniedUrl "/RequestDenied"; CheckRule "$SQL >= 8" BLOCK; CheckRule "$RFI

    >= 8" BLOCK; CheckRule "$TRAVERSAL >= 4" BLOCK; CheckRule "$EVADE >= 4" BLOCK; CheckRule "$XSS >= 8" BLOCK; Gareth Rushgrove
  5. 2013/09/18 08:59:57 [error] 891#0: *6 NAXSI_FMT: ip=192.168.50.20&server=victim&uri=/pictures/ search.php&total_processed=14&total_blocked=7&zo ne0=ARGS&id0=1007&var_name0=query, client:

    192.168.50.20, server: localhost, request: "GET /pictures/search.php?query=--%3E+ %3Csome_dangerous_input_a1056fd2f0ffbb7f18fec9bd 33257e12ab5e0494b33011967bcbcbc5699408eb%2F%3E+ %3C%21-- HTTP/1.1", host: "victim" ! Gareth Rushgrove
  6. grok { type => "nginx_error" match => ["message", " ip=%{IP:client_ip}&

    server=%{IP:server_ip}& uri=%{PATH:uri}& total_processed=%{NUMBER:total_processed}& total_blocked=%{NUMBER:total_blocked}& zone0=%{WORD:zone}& id0=%{NUMBER:id}"] } Gareth Rushgrove
  7. [ssh] enabled = true port = ssh filter = sshd

    logpath = /var/log/auth.log maxretry = 3 [ssh-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 Gareth Rushgrove
  8. [nginx-naxsi] enabled = true port = http,https filter = nginx-naxsi

    logpath = /var/log/nginx/*error.log maxretry = 2 Gareth Rushgrove
  9. grok { type => "naxsi_fail2ban" match => ["message", " WARNING

    \[nginx-naxsi\] %{WORD:action} %{IP:ip}" ] } Gareth Rushgrove
  10. type=CWD msg=audit(1379493067.779:57): cwd="/tmp" type=PATH msg=audit(1379493067.779:57): item=0 name="vagrant-puppet" inode=20 dev=fc:00 mode=041777

    ouid=0 ogid=0 rdev=00:00 type=SYSCALL msg=audit(1379493067.779:58): arch=c000003e syscall=83 success=yes exit=0 a0=7fff172d0e5e a1=1ed a2=1ed a3=7fff172cf910 items=2 ppid=1239 pid=1241 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=21 comm="mkdir" exe="/bin/mkdir" key=(null) type=CWD msg=audit(1379493067.779:58): cwd="/tmp/ vagrant-puppet" Gareth Rushgrove
  11. > bundler-audit ! Name: actionpack Version: 3.2.10 Advisory: OSVDB-91452 Criticality:

    Medium URL: http://www.osvdb.org/show/osvdb/91452 Title: XSS vulnerability in sanitize_css in Action Pack Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Gareth Rushgrove
  12. rspec audit-rspec.rb -f d my application dependencies should have no

    vulnerable gems (FAILED - 1) should have a safe version of ruby on rails ! Finished in 0.03949 seconds 2 examples, 1 failure Gareth Rushgrove
  13. Skipfish, nikto, w3af, garmr, sslyze, owasp zap, arachni, sqlmap, sslscan,

    TLSSLed, slowhttptest, DIRB, SQLiBF Gareth Rushgrove
  14. Starting Nmap 5.21 ( http://nmap.org ) at 2013-09-18 15:09 BST

    Nmap scan report for monitorama.eu (141.101.116.49) Host is up (0.17s latency). Hostname monitorama.eu resolves to 2 IPs. Only scanned 141.101.116.49 Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 24.18 seconds Gareth Rushgrove
  15. 1) the monitorama.eu website should have one port open Failure/Error:

    @open_ports.should have(1).items expected 1 items, got 12 # ./nmap-rspec.rb:24:in `block (2 levels) in <top (required)>' ! Finished in 2.47 seconds 2 examples, 1 failure Gareth Rushgrove
  16. + +[+] 2 issues were detected. + +[+] [1] Trusted

    -- Cross-Site Scripting (XSS) +[~] ~~~~~~~~~~~~~~~~~~~~ +[~] ID Hash: +[~] Severity: High +[~] URL: http://victim/pictures/search.php +[~] Element: form +[~] Method: GET +[~] Tags: xss, regexp, injection, script +[~] Variable: query +[~] Description: +[~] Client-side code (like JavaScript) can be injected + into the web application which is then returned to + the user's browser. This can lead to a compromise + of the client's system or serve as a pivoting + point for other attacks. + Gareth Rushgrove
  17. http://victim/pictures/search.php +------+----------------------------------+ | Risk | Description | +------+----------------------------------+ | High

    | Cross Site Scripting (Reflected) | +------+----------------------------------+ http://victim/css/ +--------+--------------------+ | Risk | Description | +--------+--------------------+ | Medium | Directory browsing | +--------+--------------------+ http://victim/users/login.php +---------------+---------------------------------------+ | Risk | Description | +---------------+---------------------------------------+ | Informational | X-Frame-Options header not set | | Low | Cookie set without HttpOnly flag | | Low | Password Autocomplete in browser | | Low | X-Content-Type-Options header missing | | Medium | Application Error disclosure | +---------------+---------------------------------------+ Gareth Rushgrove