Configuration Management Testing - SSL/TLS Testing

Configuration Management Testing is simply analyzing the infrastructure of the web application.  There are a various ways of doing this but we will start with SSL/TLS Testing. Anytime we pass sensitive information online, the https protocol is used. Our goal is to find and detect weak ciphers ,and use it as a means to exploit the web application. One way to do this is through using NMAP (a application discussed in a previous post). Using the -sV scan option, we can identify SSL services (commonly found on port 443). 

Example:

Running the following line: nmap -sV XYXYXY.com on nmap scans available ports on the XYXYXY.com server to see which ones are open and being used. 

The results could be similar to the one below: 

Nmap scan report for XYXYXY.com(XX.YY.XX.YY)Host is up (0.040s latency).rDNS record for XX.YY.XX.YY: pNot shown: 976 filtered portsPORT      STATE  SERVICE     VERSI21/tcp    open   tcpwrapped22/tcp    closed ssh25/tcp    closed smtp80/tcp    open   http?443/tcp   open   ssl/https?554/tcp   open   rtsp?587/tcp   closed submission7070/tcp  open   realserver?

As one can clearly see, port 443 is open and is being used.  Unfortunately, to further investigate this setup, we  need software such as Nessus Scanner.

That being said, how does SSL/TLS work? When we connect to a https website, a secure connection is established between the browser and the server. Both parties identify each other through digital certificates. For the connection to work, the validity of the certificate must be checked. The three ways the validity is checked are:

1. Browsers come bundled with a list of Certificate Authority. If the the server certificate is unknown to the browser, then we might have a problem. When this does happen, the user is greeted with a message asking them if they want to allow this secure connection to occur. 
2. Certificates have a life period. In other words, even if the certificate is trusted by the browser, it must NOT be expired. 
3. Lastly, if the name on the certificate on the client and browser do not match? This problem usually arises with virtual host setup, but can easily be fixed by giving each website a unique IP address to match the certificate. 

Penetration Testing #3

It's always good to know which applications are installed on a server before trying to exploit it.  Many applications already have existing vulnerabilities  and other applications are not updated by the company for various reasons.  Due to virtual web servers, many websites are hosted under one IP address. This means that to access a certain application, you would have to go through the DNS name rather than the numeric IP.  Finding all the web applications on a web server through whatever means is the definition of web application discovery.

Once we are given a target (a DNS name or IP address), there are three factors that influences finding  applications that are hosted on that target. First factor is a Different Base URL. The base URL is the target given to us (the DNS name). So if our target is http://google.com, the base URL is google.com, but what if the application is hosted on http://google.com/app1/?  Secondly, the use of non-standard ports. By default, people use port 80 for web servers , however what happens if people start using random ports? Lastly, we have the idea of virtual hosts.  That is, multiple domains pointing to one IP Address.  So, how do we find solutions for the above situations?

It's difficult to find applications if they are installed somewhere other than the base URL. The best way to find is through search engines (if application is on the internet) or through intelligent guessing (for example, a mail application could be installed in a directory called 'mail').  If an application is ran on a non-standard port, we can easily find it through running a port scanner like nmap. Lastly, the best way to combat the virtual host setup would be using a reverse IP tool such as the one provided by domaintools.com. The reverse IP tool works by just entering an IP address and it tries to list all the domains hosted on that IP address.