Web Server Scanning

Intro to Web Server Scanning with Nikto - Module XV

• Introduction - Nikto - Features
  • Discuss Nikto Features
  • Pinpoint useful online resources
  • Identify key systems in topology
  • Explore possible scan targets
•  
• Nikto Installation
  • Download Nikto Web Scanner
  • Perform Installation
  • Explore run-time environment
  • Discuss Plugins - Signatures - DBs
  • Peruse configuration entries
  • Mention key CLI options
•  
• Staging Scan
  • Identify Staging targets
  • Scan Staging to ascertain server metadata
  • Perform comprehensive scans of targets
  • Watch web logs while scans are ongoing
  • Alter display of Web Scan Requests and Responses
  • Rule-out false-positives
  • Adjust security posture where applicable
  • Re-scan and compare and contrast
•  
• Production Scan
  • Identify PROD web instance
  • Discern useful metadata with reconnaissance
  • Drill deeper to determine more relevant attributes
  • Attempt to identify vulnerabilities on target
  • Peruse findings accordingly
  • Suggest methods of filtering false-positives
•  
• Reporting | Logging
  • Compare STDOUT to Report Data
  • Discuss Logging | Reporting options and formats
  • Enable Reports on various scans
  • Vary target reports for Cron mode
  • Tweak scans and redirect output accordingly
•  
• SSL Scans
  • Discuss applicabilitiy
  • Identify key options
  • Enable SSL scanning on targets
  • Compare Staging and Production output
  • Examine supported ciphers on targets
  • Search for cipher weaknesses
  • Evaluate results
•  
• Proxy Server Relay Scans
  • Discus pros and cons of Proxy Usage
  • Identify Squid Proxy Facility
  • Update Nikto configuration to support Proxy Usage
  • Perform Proxy Scans from multiple Web Scanners
  • Evaluate Proxy Requests | Responses in Real-Time
  • Compar and Contrast performance differentials
  • Evaluate results
•  
• Nikto Scan Tuning
  • Discuss features and benefits
  • Identify key Tuning Options
  • Filter scans to focus on targeted Plugins
  • Initiate multiple Tuned Scans
  • Evaluate Results
•  
• Web Application Attack Audit Framework (w3af)
  • Discuss features and benefits
  • Obtain sources
  • Fulfill dependencies
  • Launch and peruse interface
  • Execute common scans
  • Evaluate and discuss ongoing
•  
• 'apache-users'
  • Discuss features
  • Search target for UserDir support
  • Enable UserDir support
  • Enumerate confirmed system users
  • Search for non-system users
  • Alter search to handle different return values
  • Disable UserDir support
•  
• 'dirb'
  • Discuss features
  • Search web server for common content
  • Look for Apache vulnerabilities
  • Check for CGI-related issues
  • Check using multiple wordlists
  • Recurse to find additional directories
  • Discuss findings and possible remediations
•  
• Apache - Suppress Superfluous Bits n Bobs
  • Launch Burp Suite
  • Proxy Requests
  • Identify Superfluous items
  • Tweak Config
  • Mitigate data exposure
  • Re-Test
•  
• 'skipfish'
  • Discuss features
  • Scan Target
  • Peruse Report
  • Rectify XSS Concerns
  • Discuss various findings
  • Re-Scan
•  
• OWASP - ZAProxy
  • Discuss features
  • Quick Attack Target URL
  • Discuss findings
  • Tighten HTTP Headers
  • Re-Scan | Discuss findings
  • Explore default Spider Results
  • Expand results via SVN Spider
  • AJAX-Spider URL
  • Mitigate visible SVN Entries
  • Passively scan Web Application
  • Evaluate captured data
  • Active Scan - WebApp
  • Proxy valid user requests
  • Define WebApp user
  • Define Login/Logout indications
  • Perform Active Scan
  • Evaluate additional results
  • Process False-Positives
  • Handle XSS Positive
•  

SysLOG with rSysLogD

• Discuss Features
• Default Environment
• Kernel Firewall LOG
• Split LOGs by Priorities
• UDP | TCP Logging
• Dual L4 Logging
• Multiple Hosts
• Basic Queueing
• Reliable Event Logging Protocol (RELP)
• RELP - Remote Only
• RELP Only
• Traditional to RELP
• SysLOG Clear-Text - Confirm
• Property Filters
• Expression Filters
• Relay Chain

Netfilter Tables

• Features
• SSHGuard
• Ruleset Basics
• Persistence
• Sample Rules
• Inbound Filtering
• Dormant Table
• Manage Tables | Chains | Rules
• Counters
• Sets
• LOG Basics
• LOG with Sets
• Closed-Port LOGs
• LOG Options
• Re-Route LOGs
• Jump Targets
• Chain Jumping
• GoTo Chains
• Meta Selectors

Debian 12x Administration

• Features
• Download
• Graphical Install
• Text Install
• Post-Install Tweaks

• Explore usage of the following useful commands
• tty | /dev/pts | w | whoami | who
• set | env | export | unset
• cat | echo | touch | rm
• pwd | ls | cd | mkdir | alias | umask
• head | tail
• dd
• find
• history
• STDIN, STDOUT, STDERR, UNIX Pipes, Redirection, Command Chaining
• ps, df, free, top, dd
• stat, which, w, who
• tar | gzip | bzip2 | xz
• ZSH Setup

• Network Tools | IP Configuration
• Examine default IP configuration
• Extend IP configuration to facilitate additional addresses
• Static IP Config
• Dual: Dynamic | Static Config
• Multiple Interfaces
• Dual Network Services
• Confirm communications

PHP One-Liners

• General Usage
• Count Lines
• Word Count
• Count Chars
• Split Lines into ARRAY
• Count Instances of Fields
• Transform Delimiters
• Anonymize LOGs
• Extract Unique SRCs
• Lines by Error Code
• LOG By Code
• Summarize Error Codes
• Pre-Seed Error Codes
• Random Strings
• Varied Passwords
• Expose Undefined Passwords
• Outdated Passwords
• Hash | Un-Hash

Cloud Storage with GlusterFS

• Discuss Features:
• Default Volume Type
• Common Volume Types
• Transport Types
• File System Support
• Storage Model

• Features
• Provision Storage
• Allocate GlusterFS Brick
• Persistence
• Generate IO
• Multiple File Systems
• Various Sizes
• Stop | Remove Volume
• Reconstitute Volume
• Server Mount
• Evaluate

OpenPGP with GPG

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Signing | Verification

• Features
• General Usage
• Create Content
• Encrypt
• PassPhrase Protect
• Binary | Text Encryption
• Share
• Decrypt

SSL-TLS with OpenSSL

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Certificate Signing Requests (CSRs)
• Self-Signed Certificates
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Random String Generation
• Message Digests
• SSL-TLS Client

• Features
• General Usage
• Retrieve Site Certificates
• Determine OCSP Configuration
• Probe supported TLS Versions
• Extract Certificate for local usage
• Retrieve Certificate with NMap
• Retrieve Certificate Chain

• Discuss
• Generate Private Keys
• Generate Correlating CSRs
• Confirm Keys | CSRs
• Self-Signed Certificates

SSH Variables

• Discuss Features
• Bare VARs
• SSH Client
• Double Quotes
• Single Quotes
• SSH Environment

SHELL Variables

• Discuss Features
• Terminal (TTY)
• CLI Arguments
• Process ID
• Backgrounded
• SHELL Local
• Environment
• Persistence
• Aliases
• Command Substitution
• Increment | Decrement
• Dynamism

zsync

• Discuss Features
• Prep Content
• Compression
• File Names

‘7Zip’

• Features
• Archive Creation
• Inclusions | Exclusions
• FQ Paths
• Content Deletion | Extractions
• Content Exchange
• ‘tar’ with 7z
• Passwords
• Hashes
• Various Formats