System7 » pentest http://www.system7.org Spread the word, information is free. Thu, 29 Jul 2010 14:56:15 +0000 en hourly 1 http://wordpress.org/?v=3.0 win32 memory capture & analysis cheat sheet http://www.system7.org/2010/06/14/win32-memory-capture-analysis-cheat-sheet/ http://www.system7.org/2010/06/14/win32-memory-capture-analysis-cheat-sheet/#comments Mon, 14 Jun 2010 12:33:25 +0000 The Gunslinger http://www.system7.org/?p=518 A high level overview to perform live memory captures and analysis:

  1. capture memory via moonsol’s win32dd
  2. parse memory snapshot with mandiant’s memoryze
  3. analyze results via audit viewer
  4. or analyze using the volatility framework — neatly packaged in SAN’S Sift Workstation
]]> http://www.system7.org/2010/06/14/win32-memory-capture-analysis-cheat-sheet/feed/ 0 One more vulnerable web project…. http://www.system7.org/2010/04/02/one-more-vulnerable-web-project/ http://www.system7.org/2010/04/02/one-more-vulnerable-web-project/#comments Fri, 02 Apr 2010 15:24:20 +0000 The Gunslinger http://www.system7.org/?p=498 Back in November I posted a list of intentionally vulnerable web applications for educational purposes.   You can find that list here: http://www.system7.org/2009/11/05/test-your-web-pentest-skillz/

A new one to add to the list is OWASP’s Broken Web Application Project.  There was a great talk at Shmoocon about the project.  This project might end up taking the gold medal in vulnerable web application projects. They plan to include versions of actual applications you see in the wild (Yazd, WordPress, phpBB) and all of the other web app testing projects (Damn Vulnerable Web App, Mutillidae, WebGoat).

]]> http://www.system7.org/2010/04/02/one-more-vulnerable-web-project/feed/ 0 Quickly assess your PHP infrastructure security: PHPSecInfo http://www.system7.org/2010/01/25/quickly-assess-your-php-infrastructure-security-phpsecinfo/ http://www.system7.org/2010/01/25/quickly-assess-your-php-infrastructure-security-phpsecinfo/#comments Tue, 26 Jan 2010 02:57:54 +0000 The Gunslinger http://www.system7.org/?p=454 From their homepage: PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement. It is not a replacement for secure development techniques, and does not do any kind of code or app auditing, but can be a useful tool in a multilayered security approach.

Combine this tool with my  ‘Assault on PHP Applications’ blog entry and this recent ‘Web Security‘ article and you’ll be a fairly competent web pen-tester.

]]> http://www.system7.org/2010/01/25/quickly-assess-your-php-infrastructure-security-phpsecinfo/feed/ 0 Pen Testing 101 Presentation http://www.system7.org/2009/12/09/pen-testing-101-presentation/ http://www.system7.org/2009/12/09/pen-testing-101-presentation/#comments Wed, 09 Dec 2009 11:19:40 +0000 The Gunslinger http://www.system7.org/?p=407 PaulDotCom has an excellent penetration testing presentation covering your primary 6 tools: nmap, nessus, hydra, pass-the-hash, metasploit, and cain & abel.  Check it out here: http://pauldotcom.com/TriplePlay-NetworkPenTestingTools.pdf

]]> http://www.system7.org/2009/12/09/pen-testing-101-presentation/feed/ 0 Successfully running De-Ice on a virtual machine…. http://www.system7.org/2009/11/21/successfully-running-de-ice-on-a-virtual-machine/ http://www.system7.org/2009/11/21/successfully-running-de-ice-on-a-virtual-machine/#comments Sat, 21 Nov 2009 12:25:22 +0000 The Gunslinger http://www.system7.org/?p=336 I’ve seen several folks wondering how to setup the De-Ice pentest environments in a virtual machine.  It’s actually a fairly simple setup and I’ve included the steps needed below….

Here’s the config I used to get level 1(1.100) working:

  1. Configure the De-Ice VM Guest for Host Only networking
  2. Modify routing on host VM: “ifconfig 192.168.1.X vboxnet0” — X can be anything that’s not in use; vboxnet0 would be the name of the virtual interface – in this case I’m using Virtual Box.
  3. Modify host routing table: route -add host 192.168.1.100 vboxnet0 — – this is biggest problem for people; make sure your host is using the correct interface to find De-Ice

Here’s the config I used to get level 2 (2.100) working:

  1. Configure the De-Ice VM Guest for Host Only networking
  2. Modify routing on host VM: ifconfig 192.168.2.X vboxnet0
  3. Modify host routing table: route -add host 192.168.2.100 vboxnet0
]]> http://www.system7.org/2009/11/21/successfully-running-de-ice-on-a-virtual-machine/feed/ 0 Penentration Test Scenario’s http://www.system7.org/2009/01/13/penentration-test-scenarios/ http://www.system7.org/2009/01/13/penentration-test-scenarios/#comments Tue, 13 Jan 2009 06:52:06 +0000 The Gunslinger http://www.system7.org/?p=10 I’ve recently been trying to teach my young cousin the basics of computer security.  I started by having him get the Backtrack live-cd which is geared for penetration testing.

Once you have Backtrack running you need a dummy machine to test against.  People have packaged live-cd’s and virtual machines that are running some combination of the following:

  • Unpatched operating systems (Win XP SP1)
  • Unpatched applications (httpd, ftpd, etc)

You can find these ready to be exploited packages here:

Old softwares with bugs:
https://www.securinfos.info/old_softwares_vulnerable.php

Do you have an old disc of Windows 9x or Redhat 6.2 lying around?

  1. Install VirtualBox
  2. Create your own virtual machine with those old OS discs that are now collecting dust

Have fun & remember to keep this limited to dummy machines :-)

]]> http://www.system7.org/2009/01/13/penentration-test-scenarios/feed/ 3