Blog Hiatus

Taking a Hiatus to write a more professional publication. Expect an update in late Q1 2019 or early Q2 2019. Signing out for now.

SANS DEV522 September 2018 - New York, NY

New York! SANS DEV522 - Defending Web Applications Security Essentials is coming soon...

Class begins on September 17, 2018 (Monday through Saturday) when we will learn all about defending web applications while preparing for the GIAC GWEB (Certified Web Application DEFENDER) certification.

This is a six day Community SANS event, complete with an attack/lab virtual machine, books, all class materials and immersive, hands-on training every day.

One of my favorite things about this class is the amount of material - its quite in-depth. You keep the tools, you keep the custom VM, you keep the labs and you gain great experience... more details are below.

DEVELOPMENT 522: Web App Penetration Testing and Ethical Hacking: www.sans.org

The topics that will be covered include:

• Infrastructure security

• Server configuration

• Authentication mechanisms

• Application language configuration

• Application coding errors like SQL injection and cross-site scripting

• Cross-site request forging

• Authentication bypass

• Web services and related flaws

• Web 2.0 and its use of web services

• XPATH and XQUERY languages and injection

• Business logic flaws

• Protective HTTP headers

Vulnerability Scanners - Nessus

This is part one of a three part series aimed at discussing vulnerability scanners; I plan to write a post for Nessus, Nexpose/Rapid7 and OpenVAS. The aim is to highlight the pros and cons of each, talk about how typical setup works, expectations of scan results and using the tools. Ultimately, the goal is to compare and contrast the products and provide some insight into why you might want to choose one over the other. The target audience for this is enterprise users with the need for a mature threat and vulnerability remediation program. While much of the information shared will be applicable to anyone in charge of running the scanning tools, the tone will be from an enterprise perspective.

Today's post will be on the Nessus product offering. Nessus is a proprietary vulnerability scanner developed by Tenable Network Security - Tenable just had (July 27th 2018) their IPO and is now a publicly traded company (for whatever that's worth which happens to be about $30 at the time of writing).

All vulnerability scanners that I am familiar with work essentially the same way which is by relying on a series of vulnerability checks or "plugins" or otherwise a database with known strings, characteristics, files, versions, etc to search for and a library of detailed information about the vulnerability check including remediation options and impacted software. For instance, a vulnerability check for MS15-034 will consist of a vetted way of stimulating a target system (sending network traffic) to induce a response which is then parsed (inspected) and determined to either match a known vulnerable response or not. An example of a simple check can be submitting a HTTP GET request and reading the response to pull out the headers and noting the version of PHP; then matching that version with a database of version numbers to produce output showing the known vulnerabilities for that given software number.

Generally what sets apart scanners is the amount of vulnerability checks they have (and their associated quality, and frequency of updates) and the ability to run the scanner in such a fashion where you as the administrator get accurate scan results in a convenient consistent way. These two points are exceedingly important - you must have accuracy of data and you need to have up-to-date vulnerability checks to helps with the former. Also of importance, is the ability to automate scanning and produce useful reports as well as configure or tune the scan engine to meet the needs of your organization.

Accuracy of data matters because as a security practitioner responsible for enterprise security you need to understand the risk associated with a given asset/network to be able to adequately prioritize remediation. Additionally, accuracy matters because in the case of a false negative you may end up with a breech and in the case of false positives you may end up eroding the trust in you and your team's ability to produce quality/actionable information. I've been in situations where false positives on a report resulted in the entire vulnerability remediation program being called into question across the enterprise and outsourcing of ones' job to a MSSP is discussed.

So Nessus...

Background:
Note that Tenable has several product offerings, their professional network vulnerability scanning tool is called Nessus Professional, the base price for which is $2,190 per year. I went through a VAR and bought mine for just under $2,000 for an annual fee. Nessus has been around for about two decades and has improved their product substantially over the years especially in the last 2-4 in terms of UI and ease of use. Once purchased you will have access to the Tenable portal which is not very user friendly, does not seem to support significantly long and complex passwords and is a bit clunky in my opinion. But this is where you can see your license number and reset it when need be as well as open tickets potentially.

Of important note is that you will have access to unlimited scans and target IPs (I believe and has so far seemed to be true) so you can scan whatever and whenever you want. The caveat if using the tool in a consulting role will be that once you register the scanner it talks back to Tenable to complete the process and notes your IP address; you can only register the product from one IP at a time for a period of one week. This means that if you need to install multiple scanners from multiple locations you have to wait one week before re-registering and using your product. This becomes a hassle of logging into the portal, resetting your license and spending at times significant amounts of effort to get the tool to properly register, download plugins and work as expected. If you only need to install the tool in one location essentially one time then this is not an issue.

Setup:
Setting up Nessus is a breeze when you do it all the time and know the quirks. The first thing you need to do after purchase is note your license number. Next dedicate a machine to being the scanner - i.e. install Nessus on a machine that will only be used for scanning purposes. Nessus supports Windows and Linux - I almost exclusively use CentOS7 as the base OS and install the Nessus RPM:

And when it works (dependencies are good to go, and you chose the right RPM from the Tenable website) it's that simple. Next simply do what the output says and start Nessus then browse to the web GUI to complete the setup.

Once this process complete you are greeted with the stating screen and its time to proceed to setup a scan.

I mentioned accuracy of results being very important, the way you ensure accuracy is essentially by making sure the scanner can "talk" to every host that you intend to scan (e.g. make sure firewall rules are in place to allow the scanner traffic and that host-based firewalls are not stopping traffic likewise a WAF/IPS is not obstructing scanning). Also use credentials! This is called "authenticated scanning" because when you provide your scanner with SSH or domain credentials for example, now the scanner can actually login to each properly configured endpoint and produce MUCH more accurate scan results. Think of it this way... if you don't use credentials and you scan a system you may find ports 135, 139, 445, and 3389 open on a windows machine. The scanner will check for version information, try various SSL/TLS handshakes and launch hundreds of other vulnerability checks at the system and only find a few medium risk findings perhaps. When you provide credentials for the scanner to login to the remote systems, now the scanner can check the patch level of the given target(s) and provide accurate information in terms of what patches are missing and what flaws are present. It's the difference between a few medium risk issues and dozens of high risk vulnerabilities. Note that this example is for internal network scanning; when I scan externally I don't typically provide credentials or expect the most accurate results. But for internal scanning as part of a robust threat and vulnerability remediation program - always use valid credentials such as a specific service account dedicated just to scanning that is active on all windows hosts in the environment. Consider the same for SSH with Linux hosts and understand that not all hosts (printers, badge readers, network devices, etc) will support authenticated scans. Also understand that scanning with credentials, while more accurate, also can increase risk such as when web applications scanned with credentials or the credentials are not stored properly and the like. The way we could set up this type of scan using Nessus would be via a "Credentialed Patch Audit" which is a scanning template we can easily choose to use.

There are no shortage of credential options to choose from in Nessus. Once again make sure you have a dedicated account (or multiple) for scanning and test out your setup (tail the secure log on the Linux hosts you scan to see authentication working properly and/or watch the windows event logs or do this all from a single pane of glass to essentially confirm the authentication is working - sometimes its not always obvious from the results of the scan if authentication worked as you expected).

The amount of templates and icons looks nice but know that all that is being done behind the scenes is simply modifying which plugins (vulnerability checks) will be executed. For example the "DROWN Detection" simply checks for the existence of CVE-2016-0800. It's convenient but not ideal for what we typically want to accomplish (although great for when its exactly what we need to do). Use the "Advanced Scan" and tune it to meet your needs. There are literally tens of thousands of vulnerability checks included with the scanner (and updated regulatory). Based on your environment you can disable ones that may be irrelevant (like if you don't have any CISCO appliances in your environment you may choose to not use any plugins from that "Plugin Family" (grouping of vulnerability checks for a given product/software class)).

In addition to credentials and plugins, further tuning of the scan template may be required for your environment and similar to a nmap scanning there are some basic discovery options you can modify as well as port scanning choices. I have found that the defaults work fine in most cases and the only other important thing to pay attention to prior to scanning is the "Enable safe checks" in the advanced section. Check this (it is by default) unless causing harm to the target environment is acceptable (while not guaranteed it will actually happen).

While there certainly are some other tweaks you can make to better tune the scan or modify your template there is not MUCH more to the scanning tool that comes into play for typically scanning other than creating a custom template (Policy) that works best for your environment(s). What you do want to look into is the "Settings" section accessed via your profile/account link. Setup SMTP to automatically email scan results if desired, configure other tools to use the REST API, setup a custom CA/certificate and modify the authentication/password policy.

Next kickoff your scan!

You can see the results of scanning as the scan runs and vulnerabilities are color coordinated to denote risk.

You can also drill into each vulnerability/host to get more information about what was found including a description of the flaw and suggested remediation (usually patch).

The GUI is useful for reviewing the results and getting specifics but what we need to do is produce a report to share with other teams in a given organization. The report should include results of the scan(s), the CVSS score for each vulnerability and enough details for the confirmation and remediation to take place. Nessus supports several report export file types, HTML, PDF, CSV and two Nessus specific ones.

The reports are not very customizable but provide basic information needed to help with fixing the flaws.

The Verdict:
Nessus is an industry standard and definitely one of the most popular tools on the market for vulnerability scanning. It's simple and gets the job done most of the time.

Pros

• Affordable
• Easy to setup and use
• Fast implementation time (setup, scanning and results)
• Licensing is great in terms of unlimited scanning

Cons

• Too basic - not enough customizable features for niche settings
• Following industry trend of charging extra for web application scanning, mobile scanning, enterprise integration and no more free version
• Reporting is weak
• Does not always find as many vulnerabilities as competitors (discussed later in series)

SpyderSec Apprenticeship Program

SpyderSec is exploring offering an apprenticeship program. More details to come...

Upcoming Security Events

It's (always) a busy time in my world, here are some upcoming events to be on the lookout for - all of which I speaking at or teaching:

• Community SANS DEV522 - New York, NY | Mon Apr 23 - Sat Apr 28, 2018

• SANS Webcast -  Tuesday, May 1st, 2018 at 1:00 PM EDT (BreakingPoint: A Multi-Function Tool for Application and Security Testing)

• HACK NYC 2018 - New York , NY | Tue May 08 -  Thu 10, 2018 (SPEAR PHISHING: A BEHIND THE SCENES LOOK May 8th 01:15 PM - 01:45 PM)

• RMISC - Denver, CO | Tue May 08 -  Thu 10, 2018 (G1. Rock Your Next Web Application Penetration Test May 10th 2:00 PM - 3:00 PM )

• SANS Rocky Mountain - Denver, CO | Mon, Jun 4 - Sat, Jun 9, 2018 (Getting the Most Out of Burp Suite Pro Thursday, June 7th, 7:15pm - 8:15pm)

• Community SANS SEC542 - Columbia, MD | Mon Jun 11 - Sat Jun 16, 2018

SnowFROC - All questions answered!

We are only a couple of weeks away from SnowFROC 2018 so I thought I would take a moment to talk about it.

What is SnowFROC?
Simply put, SnowFROC is Denver’s premier Application Security Conference. This is not a typical conference however; to be blunt it is more intimate and has better food (seriously) than other events you may visit. The venue holds no more than about 500 people and being a one day only event means you get the best we have to offer in an 8 hour day.

Who is this for and who will be there?
Presentations and training are not solely focused on application security. SnowFROC is primarily geared towards three types of individuals:

• Information Security Leadership; which is a prominent track with several interesting presentations to choose from

• Security Engineers and Developers; with 9 scheduled presentations on topics ranging from Threat Modeling IoT Systems to attacking mobile apps and automation with DevOps

• Learners seeking to train hands-on; Three labs are included with the purchase of a training ticket and include: Crypto, Attacking WIFI and a lab based on the Equifax breach

John Strand is delivering the Keynote, world-class speakers are flying in to give their presentations and the panel at the end of the day is comprised of leaders in the industry. 

Where is SnowFROC located?
Being the "Front Range OWASP Conference", SnowFROC is based in Denver Colorado. The location of this event is The Cable Center on the University of Denver campus near I-25 and University.

When does this event take place?
This is a one day only event and takes place from 8AM to 5:30PM on Thursday March 8th 2018.

How much does it cost?
General Admission is $70.00 per person. If you want to attend the hands-on training (on going all day) you will need to purchase an additional ticket at $25.00 (for a total of $95.00).

Why would I want to attend?
Because the scheduled presentations are exciting
Because the speakers are excellent
Because you know a great deal when you see one
Because taking a day off of work to be educated, fed well and learn a lot is a great idea
Because $95 for a day of hands-on training is a spectacular value
To network and get to know Denver's security community better
Because you are coming from out of town and it's Denver...

Registration, schedule of events and additional information is at https://snowfroc.com

What else should I know?
Training is limited to the first 100 people to register. Parking, breakfast, lunch, happy hour, access to all talks (though they run concurrently) and panel discussions is all included with general admission pricing. Tickets are expected to sell out, get yours now!

SANS SEC542 March 2018 - Portland

Portland Oregon! SANS SEC542 - Web Application Penetration Testing and Ethical Hacking is coming soon...

Class begins on March 5, 2018 when we will learn all about web app pen testing while preparing for the GIAC GWAPT (Web Application Penetration Tester) certification.

This is a six day Community SANS event, complete with an attack/lab virtual machine, books, all class materials and a full day of Capture the Flag (CTF) on day six to drive home all of the concepts and tools.

This is certainly one of my favorite classes and I think one of the best parts about this class is the quality and quantity of the hands-on labs; we cover everything from Burp Suite and Command Injection to XSRF and Zap! You keep the tools, you keep the custom VM, you keep the labs and you gain great experience... more details are below.

SECURITY 542: Web App Penetration Testing and Ethical Hacking: www.sans.org

We will be covering all of these topics and more:

• Interception Proxies
• ZAP (Zed Attack Proxy)
• Burp Suite
• SQL Injection
• Logic Attacks
• Metasploit
• Reflected Cross-Site Scripting (XSS)
• Stored Cross-Site Scripting (XSS)
• Local File Inclusion (LFI)
• Command Injection
• Remote File Inclusion (RFI)
• Cross-Site Request Forgery (XSRF)
• Automated web app vulnerability scanning tools
• Manual scanning techniques

If your job description falls under one of these categories and you have an affinity towards information security or a desire to learn how attackers are able to compromise web applications, then this class is for you:

• General security practitioners
• Penetration testers
• Ethical hackers
• Web application developers
• Website designers and architects