Attack & Penetration Test Plan

By: Jeff Nielsen
David Campbell
Brad Schnur

Security Services Letter of Authority
THIS LETTER OF AUTHORITY is made the 12 day of January, 2000. between WHEREAS:
The Confident has requested xx to perform a specialised security service. During the service, consultants will be investigating commercially sensitive accesses and information. Due to the nature of these services xxx is required to obtain positive proof of identity from the customer, as well as proof of authority to proceed. This Letter of Authority is to cover the ongoing confidential protection of such information and authority to proceed with the security service.
It is understood that whilst every reasonable precaution is taken, due to the frailties of networks and their reaction to unknown variables, xxx cannot be held responsible for losses due to network variables such as server crashes. xxx will not commence any service unless a complete backup of the network is completed prior to any operation or testing is attempted to ensure immediate recovery in the event of losses, however unlikely. We further recommend that all patches be applied in the appropriate manner to the operating system.
The Confident proposes to give access to and disclose to xxxxx Confidential Information required to perform the security services. This Confidential Information may either be disclosed by the Confident or discovered by xxxx during the course of the security service. The Confidential Information may include, but is not limited to; certain trade secret information, data, network information, telephone system information, customer information and/or materials relating to their business. This Confidential Information is given to xxxx in confidence on the condition that the Confidential Information will not be disclosed or copied to any third person, firm or company unless authorised in writing by the confiding party (the Confident).
NOW THEREFORE, the parties hereto agree as follows:
1. xxxxx will retain the Confidential Information in the strictest confidence and will neither directly nor indirectly use it or disclose it to any person, firm or corporation without the written consent of the Confident.
2. xxxxx will exercise all due and diligent care and take all reasonable precautions to prevent any unauthorised disclosure or copying of the Confidential Information.
3. Each party will advise its employees who may, with the authority of the Confident, be given access to the Confidential Information, of the confidential nature and will ensure that to the best of their ability, those employees take reasonable care with the said Confidential Information in order to preserve the confidentiality of it, both during the subsistence of this Agreement and thereafter.
4. xxxxx will return to the other immediately upon demand all written or machine readable materials embodying such Confidential Information and all copies thereof, except such Confidential Information stored on valuable media, which shall be destroyed or erased and such destruction or erasure certified to the Confident within seven (7) days of the date thereof.
5. To notify the Confident if xxxxx is under any impression of any possible risk to the network and to fully explain why and what their concern is. This includes ceasing any testing as soon as anything of this nature becomes apparent.
6. That xxxxx will take all necessary steps to ensure that, as far as is possible, all services are trouble free and will not present any threat, cause damage, or harm the network in any way.
IN WITNESS WHEREOF the parties hereunto signed to indicate their acceptance of this Letter of Authority as here set out.
SIGNED for and on behalf of SIGNED for and on behalf of xxxx customer

(Signature) (Signature)
………………………………… …………………………………………
(Title) (Title)

Table of Contents

List of Questions for the Client 1. Who are its real users? Are they Internal or external users? If both, are they authenticated differently? 2. What should be considered ‘CONFIDENTIAL’ data/ assets in the system? 3. What is the purpose of the application? 4. What are the different environments in which the application is deployed? Is the code given for review in the same manner as the one deployed in production? 5. How important is this application to the enterprise? 6. Is the application integrated with other applications in the company? Is the data coming from somewhere and/or going somewhere? 7. What are the entry points and exit points in this application? 8. Are audit trails and logs pertaining to the application maintained somewhere? 9. Are there ay security Measures in place? 10. What is the architecture of the application? 11. What is the duration of the test?

Test Plan Scope

Goals and Objectives
Identify if a remote attacker could penetrate web-based application server defenses.
Determine the impact of a security breach on: o The integrity of the company’s order systems. o The confidentiality of the company’s customer information. o The internal infrastructure and availability of web-based application server information systems.
Test Plan Tasks
Fist thing that we did was try to gain fingerprint the system, by using netcat tool to look up information about the system. Also we are going to use social networking tools to gain even more information about the system.
Next we are going to scan the system to see what is out there. Scanning a network determines what's in there, scanning network gives you the feel of how your target's network is laid out, if there are multiple subnets, which hosts are alive, check ports, see if system is alive, discover available hosts & get info about the discovered hosts.
Next we can pass an injection attack. To do this we are going to attack the SQL database by trying to pass a fake username into the server like username’ or fake_column IS NULL. We will also look for a PHP vulnerability because PHP is the most popular web application framework. We can add the absolute URL equivalent into a script.
The next step we will try to use the cross site scripting tool. We are going to do this by crafting a post that calls on JavaScript from an outside server. Next if that works then we are going to try a cross site request forgery. This is done by trying to use a logged-in user’s credentials to entice other users to give up their credentials by sending them requests that if accessed sends all there information back to us and we can use their higher credentials to access deeper into the system.
The first thing is to do is run digg on their web site and see what the domain is and then run who is on the email address that you can find on their web site.
Then after you find the ip address then run a ping test to see if it is up. Then run a trace route to the ip address and see what hops it takes just to see where it is going then run who is on a few of the hops so you know what it is running threw and see if there is any potentially unwanted hops.
The next thing to do is scope out the building. This is done by either using a school id to get a tour of the building to for a project or see if the place is hiring and then put in an application then see if you can get a tour to get a feel for the company this is a way to physically get in to the building and preform a recon.
Look for easy access to a computer, look and see where the cameras are, how things are set up weather it is open or closed space, this will allow you get a feel for the situation and better familiarize yourself with your surroundings.
Next step ask where the bathroom is and once in go to a stall and then take our your phone and see if there are any open WIFI around before that root your phone to be able to run some fun apps to see if you can gain access to their system use extreme caution every phone have a unique mac address so run mac spoofed if possible to change you mac of your phone so that it cannot be traced.
If you have the opportunity try to plug a flash drive in to a system and have it auto run an application that will allow you to gain access to their network from the inside if that works then you own there system.
Then you drop a bug that hides itself well and then just sit back and gather information that you need to complete your assignment.
Which do you like better and or add some more to the paper

Test Plan Reporting
Need input here
Test Plan Schedule
We have been giving a range of time on the weekends between 2am and 6am to attack the system. In this time frame we will exploit as much as possible and take down as much as possible within the scope of we can and cannot attack.

http://amit-akv.blogspot.com/2009/12/how-to-hack-web-server.html