1. Penetration Test Debrief
Ted Vera & Mark Trynor
September 2, 2010

2. Agenda Pen Test Review Recommendations Deliverables Overview
NOTE: All trademarks referenced in this presentation are property of their respective owners.

3. Pen Test Review: Day 1 Badging / Training Reviewed customer ROE
Installed pen test tools on attack laptop
Performed automated port and vulnerability scans against target systems
Identified listeners on ports 80 & 443
NOTE: All trademarks referenced in this presentation are property of their respective owners.

4. Pen Test Review: Day 2 Performed packet captures
Performed automated scans and attacks using Metasploit
Started comprehensive Nessus vulnerability scan
Attempted manual XSS / SQL injection attacks
NOTE: All trademarks referenced in this presentation are property of their respective owners.

5. Pen Test Review: Day 3
Validated false positives from automated scans (there were many)
XSSer – automated scans/attacks
Manual and custom automated XSS/SQL injection attacks
Performed malformed packet / HTTP header attacks
NOTE: All trademarks referenced in this presentation are property of their respective owners.

6. Pen Test Review: Day 4 Manually validated Nessus false positives
Nikto web application vulnerability scanner
Nikto false positives
BigIP & Oracle buffer overflow attempts
Caused ESX Server to migrate .116, and due to the config, the failover VM lacked network connectivity
NOTE: All trademarks referenced in this presentation are property of their respective owners.

7. Pen Test Review: Day 5 Customer disabled one BIGIP ASM
Two successful proof-of-concept exploits against known Oracle vulnerabilities (patched in July)
Validates effectiveness of ASM positive security model
NOTE: All trademarks referenced in this presentation are property of their respective owners.

8. Recommendations: General
Enforce strong user passwords
Ensure passwords at least 8 characters in length, use a combination of uppercase and lowercase letters (Aa–Zz), numbers (0–9), and symbols # $ % ^ & * ( ) _ + | ~ - = { } [ ] : ; < > ? , . /).
To prevent injection attacks, do not allow passwords to use symbols \ (back slash) or ' ” (quotes).
Patch Management
 Install operating system and application patches in a timely manner.
NOTE: All trademarks referenced in this presentation are property of their respective owners.

9. Recommendations: F5
Create a well defined list of white-listed characters for positive security model. Disallow use of symbols \ (backslash) or ‘ “ (quotes) when possible.
Utilize an automated web application test suite, such as Selenium ( to produce consistent white-listing when training the system and limit human input errors that could create XSS attack possibilities.
Ensure F5 administrative panels are only accessible from the internal network as they were susceptible to XSS attacks in previous patch levels.
NOTE: All trademarks referenced in this presentation are property of their respective owners.

10. Recommendations: Oracle
Remove access to the Oracle Diagnostics pages.
Remove the ability to input SQL syntax directly into forms and replace with radio buttons / check boxes for “like”, “and/or”, “between”, “%”, etc. to limit the possibility of SQL injection.
Verify all SQL queries, on code changes, have escape characters for all special SQL characters before executing queries to prevent injections or use parameterized statements

NOTE: All trademarks referenced in this presentation are property of their respective owners.

11. Deliverables Overview
Deliverable # / Title
Description
Deliverable 1: Review with Suggested Improvements
Review of vulnerabilities and suggested improvements (4pgs).
Deliverable 2: Red Team Review
Detailed description of Penetration Test activities, findings, and recommendations (15 pgs)
Deliverable 3: Final Report
Executive overview of Penetration Test, findings, and recommendations (5 pgs)
NOTE: All trademarks referenced in this presentation are property of their respective owners.