• Security auditing
• Vulnerability scanning
• System hardening

• Security auditing
• Vulnerability scanning
• System hardening

• Security auditing
• Vulnerability scanning
• System hardening

System Auditing

Auditing made easy

With IT departments already under pressure, the demand for securing systems is only getting higher. This is why regular system auditing is required.

Unfortunately, manual checking is too much work and most solutions only present the issues. With Lynis Enterprise auditing is quick, easy and affordable.

Extensive

Audits performed by Lynis are extensive. From the bootloader up to the last piece of software, it all gets checked. Any vulnerable package, weak configuration value or unneeded daemon will show up sooner or later.

System Hardening

Limiting the weak spots

To increase the defenses of a system, additional security measures have to be implemented. This process of fortification is named system hardening. It consists of removing unnecessary parts, limit default access and tighten up the permissions of processes and users. While Unix based systems are fairly secure by default, the need of system hardening will always exist.

Hardening systems without the right tools, can take a lot of time. Besides investigating, the changes have to be planned, implemented and tested at several stages.

Auditing and Hardening

Our solution performs an in-depth audit, to determine the applicable hardening controls. Together with these controls the right suggestions are selected for your environment. A customized plan will be part of your system hardening efforts. To simplify the process of system hardening, hardening snippets are provided. Almost as simple as a copy-paste, you can harden the system of your workstations and servers.

Technical details

The hardening snippets used are depending on the related control. Usually there is a piece of shell script available to test for a specific control, or to implement the related control. Where possible and applicable, also snippets are provided for configuration management tools like cfengine, Chef and Puppet.

Vulnerability Scanning

Weaknesses

Discovering weaknesses in IT security is named vulnerability scanning. It is the art of finding weaknesses, before malicious people do. These vulnerabilities may exist in essential parts of the operating system, software, or even configuration files.

Best of all worlds

Our solution focuses on host based scanning, combined with scanning via the network. This way more ground is covered and better insights can be provided. Solutions only using network scanning are nowadays not extensive enough.

Most of the vulnerability tests are already built-in. With the help of plugins, additional tests are performed to discover vulnerabilities. Also information is collected, which can be used to determine weaknesses in unexpected areas.

Intro

• Data grabbing:
  • URL's (geturl/massurl) -> (scan)
  • Configs, Databases, SQLi's (dork)
  • Full Path Disclosures / Users (fpds) -> (brutefpds)
  • Top websites info (top)
• Massive scanning
  • XSS, SQLi, LFI, RFI (scan)
  • FTP, SSH, DB's, IMAP (multibruter)
  • Accurate SSH bruteforce (brutefpds)

Plan

• Web Apps
  • Grab url's via 'geturl' or 'massurl' (massurl requires list of tags as file)
  • Scan url's parameters for vulns with 'scan'
• Servers
  • Pick target, get ip range
  • Scan for services on each IP and bruteforce with 'multibruter'
  • Grab full path disclosures, and so linux usernames
  • Perform SSH bruteforce for specific user with 'brutefpds'
• Info grabbing
  • Use 'dork' for automatic dorking
  • Use 'fpds' for full path disclosure grabbing
  • Use 'search' for searching someone in ur databases
  • Use 'top' for scanning all top websites of specific nation
• Others
  • 'Stat' shows actual statistics and informations
  • 'Show' display specific file
  • 'Clear' and 'filter' - remove duplicates, remove blacklisted url's

Others

• php5-mysql - for mysql connections
• php5-pgsql - for postgresql connections
• libssh2-php - for ssh connections
• php5-sybase - for mssql connections
• php5-imap - for imap connections

Operation

-h, --help: Show this help message and exit

-wp, --wordpress: Scan WordPress site

-mo, --moodle: Scan Moodle site

-H HOST, --host HOST: Website to be scanned

-w WORDLIST, --wordlist WORDLIST: Path to the wordlist to use

-t TIMEOUT, --timeout TIMEOUT: Connection timeout

-r RETRIES, --retries RETRIES: Connection retries

-p PROCESS, --process PROCESS: Number of process to use

-T THREADS, --threads THREADS: Number of threads (per process) to use

Versions

[+] Search Wordpress Plugins

[+] Search Moodle Extensions

[+] http user-agent hijacking

[+] http referer hijacking

[+] Search Wordpress Version

[+] Search Wordpress Latest Version

[+] Search Version of Wordpress Plugins

[+] Search Latest Version of Wordpress Plugins

[+] Search Path Disclosure Vulnerabilities

[+] Search Wordpress Authors  

Wapiti allows you to audit the security of your web applications.

• File disclosure (Local and remote include/require, fopen, readfile...)
• Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
• XSS (Cross Site Scripting) injection (reflected and permanent)
• Command Execution detection (eval(), system(), passtru()...)
• CRLF Injection (HTTP Response Splitting, session fixation...)
• XXE (XmleXternal Entity) injection
• Use of know potentially dangerous files (thanks to the Nikto database)
• Weak .htaccess configurations that can be bypassed
• Presence of backup files giving sensitive information (source code disclosure)

• Generates vulnerability reports in various formats (HTML, XML, JSON, TXT...)
• Can suspend and resume a scan or an attack
• Can give you colors in the terminal to highlight vulnerabilities
• Different levels of verbosity
• Fast and easy way to activate/deactivate attack modules
• Adding a payload can be as easy as adding a line to a text file

Support HTTP and HTTPS proxies

Authentication via several methods : Basic, Digest, Kerberos or NTLM

Ability to restrain the scope of the scan (domain, folder, webpage)

Automatic removal of a parameter in URLs

Safeguards against scan endless-loops (max number of values for a parameter)

Possibility to set the first URLs to explore (even if not in scope)

Can exclude some URLs of the scan and attacks (eg: logout URL)

Import of cookies (get them with the wapiti-cookie and wapiti-getcookie tools)

Can activate / deactivate SSL certificates verification

Extract URLs from Flash SWF files

Try to extract URLs from javascript (very basic JS interpreter)

HTML5 aware (understand recent HTML tags)

Vulscan is a module which enhances nmap to a vulnerability scanner. The nmap option -sV enables version detection per service which is used to determine potential flaws according to the identified product. The data is looked up in an offline version scip VulDB.


Installation

Please install the files into the following folder of your Nmap installation:

Nmap\scripts\vulscan\*

Usage

You have to run the following minimal command to initiate a simple vulnerability scan:

nmap -sV --script=vulscan/vulscan.nse www.example.com

Vulnerability Database

There are the following pre-installed databases available at the moment:

* scipvuldb.csv | http://www.scip.ch/en/?vuldb
* cve.csv | http://cve.mitre.org
* osvdb.csv | http://www.osvdb.org
* securityfocus.csv | http://www.securityfocus.com/bid/
* securitytracker.csv | http://www.securitytracker.com
* xforce.csv | http://xforce.iss.net
* expliotdb.csv | http://www.exploit-db.com
* openvas.csv | http://www.openvas.org

Single Database Mode

You may execute vulscan with the following argument to use a single database:

--script-args vulscandb=your_own_database

It is also possible to create and reference your own databases. This requires to create a database file, which has the following structure:

;