search

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
https://owasp.org/www-project-nettacker/
Apache License 2.0
3.54k stars 765 forks source link

Implementing Service scanning in OWASP-Nettacker #128

Closed pradeepjairamani closed 6 years ago

pradeepjairamani commented 6 years ago

OWASP-Nettacker currently lacks the power of scanning a network for running services before doing vulnerability assessment and sending payloads; hence every attack can end up useless if the service is running at a different port. Let’s take an example, when doing network scanning if a Secure Socket Layer is running on a port or if the port is using an SSL tunnel in order to protect its users from MITM attack then we first scan that service for SSL vulnerabilities like CCS injection, Heartbleed, Logjam, Poodle, and many others in order to keep the tunnel secure and the user’s data protected, this will boost the discovery rate of vulnerabilities.

For services like SSH, SMTP, FTP and other common services we will be using normal banner grabbing techniques where Python sockets will be used. A typical FTP banner gives us information about the product and version being used on FTP service that is Bftpd 1.6.6 which could enumerate multiple vulnerabilities without sending any payloads to the server.

[+] 192.168.2.1:220 bftpd 1.6.6 at 192.168.2.1 ready.

For services like HTTP/HTTPS, we will be using Python-Requests module which will be helpful for detecting the server running by header information, a typical header looks like this which gives us information about the running services & version on the port which is Nginx/1.10.3 and the OS details which is Linux Ubuntu.

({'date': 'Thu, 08 Mar 2018 14:23:48 GMT', 'connection': 'keep-alive', 'content-encoding': 'gzip', 'x-powered-by': 'Express', 'content-type': 'text/html; charset=utf-8', 'vary': 'Accept-Encoding', 'cache-control': 'public, max-age=0', 'etag': 'W/"3b51-DSUPhtrEeYNRRot/gk1jUt+PAnc"', 'server': 'nginx/1.10.3 (Ubuntu)', 'transfer-encoding': 'chunked'})

Many DNS servers are pre-configured with version information in DNS TXT records for the version bind label in the CHAOS class.

dig @dns.name.server version.bind chaos txt

Typical answers might include

;; ANSWER SECTION: version.bind. 0 CH TXT "9.8.1-P1" OR ;; ANSWER SECTION: version.bind. 1476526080 IN TXT "Microsoft DNS 6.1.7600 (1DB04228)" OR ;; ANSWER SECTION: version.bind. 0 CH TXT "dnsmasq-2.47"

Same can be implemented using nslookup ​for Windows ​system.

All the previous modules will be shifted to Service based detection instead of port-based detection after this implementation for better results.

VictorSuraj commented 6 years ago

@pradeepjairamani Currently I am working on this. And my whole idea to get service information. If port is open then it may give easily banner grabbing. But when any port is filtered then we bypass it by fragmentation of IP-address.

pradeepjairamani commented 6 years ago

@VictorSuraj I don't understand the part fragmentation of Ip-address. I will be using normal socket connect for open port detection, please explain your idea.

Best Regards

VictorSuraj commented 6 years ago

fragmentation means as a spoofed ip-address for the server where we want to send our packets. socket well work in banner grabbing but sometimes it is failed. because of, if server self response about there service then we grab banner through socket. But If server is not configured to give any response then socket failed there.

Ali-Razmjoo commented 6 years ago

Hey @VictorSuraj,

Is this need to create a raw socket? can you share a few references for your idea, it seems cool!

Regards.

VictorSuraj commented 6 years ago

fragmentation means not a spoofed ip-address but firewall of server cant detect our IP-address. because our IP-address information goes in server as in fragments(8-bit or 16-bit at a time of total 32-bit.)

abiusx commented 6 years ago

@VictorSuraj Can you please point to a scenario in which a socket attempt is not useful by fragmentation is? Please describe a service that we can setup and test, so that we can work on the solution.

VictorSuraj commented 6 years ago

my code is not currently ready. But I have a simple example. Some times while scanning about in services by nmap a output comes out as " server block our ping probes". So here we use a switch -Pn . I see some working of switch -Pn used by nmap. And I found that it sends our IP-address in fragments.

VictorSuraj commented 6 years ago

switch "-Pn" used in nmap for bypass firewall so my idea to grab enough information about any port's services. I am using scapy for this task. Scapy covered many points at a time so that our code work much faster and determine more information.

abiusx commented 6 years ago

Yes, but ping uses ICMP protocol which is a lower level protocol compared to TCP, so it can not be done with sockets. However, all TCP services work with a socket.

Ali-Razmjoo commented 6 years ago

I am not sure about nmap structure, but in the help menu says -Pn: Treat all hosts as online -- skip host discovery, I though nmap use SYN/ACK to bypass some firewalls and grab information (such as OS and OS Version)

pradeepjairamani commented 6 years ago

@VictorSuraj switch -Pn is not a firewall evasion technique, It just doesn't checks if the server is offline or online and scans all the open ports.

VictorSuraj commented 6 years ago

@abiusx While connecting to a filtered port. socket can not work here. A timeout definitely comes out. So for this purpose we need fragmentation and I think nettacker used scapy. And we can do a lot with this. please If you give me some more about socket in fragmentation then send me. I read it and response soon.

pradeepjairamani commented 6 years ago

@VictorSuraj I haven't worked much with scapy, but can you demonstrate a code where we can see different closed ports and filtered ports?

Best Regards

Ali-Razmjoo commented 6 years ago

correct, we used scapy, but I will glad if we can find or create a replacement, we already have some license issues, if we can remove requirements it would us so much, so any contribution in this area are so welcomed.

Ali-Razmjoo commented 6 years ago

@pradeepjairamani thanks for mentioning this, I also looking forward to see a sample code to improve our libraries.

in any case if you need a test server to scan, we have a closed port 3389 on our server nettacker.z3r0d4y.com that you have permission to do all your tests. also, you are permitted to do test for the filtered ports on zdresearch.com.

# nettacker.z3r0d4y.com
PORT     STATE  SERVICE
21/tcp   open   ftp
22/tcp   open   ssh
25/tcp   open   smtp
80/tcp   open   http
443/tcp  open   https
587/tcp  open   submission
3389/tcp closed ms-wbt-server
5000/tcp open   upnp
8000/tcp open   http-alt
8083/tcp open   us-srv

# zdresearch.com
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   open     smtp
53/tcp   open     domain
80/tcp   open     http
110/tcp  open     pop3
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
143/tcp  open     imap
443/tcp  open     https
445/tcp  filtered microsoft-ds
465/tcp  open     smtps
587/tcp  open     submission
993/tcp  open     imaps
995/tcp  open     pop3s
2222/tcp open     EtherNetIP-1
3306/tcp open     mysql

Best Regards.

pradeepjairamani commented 6 years ago

I am going to add these top 100 ports for service scanning, after that we can add more to the service scanner.

Ali-Razmjoo commented 6 years ago

Hello,

We've done it in #148, so I'd mark it as done, and create a new issue to improve the signatures!

Regards.