Comprehensive penetration test and information collection

Testing penetration (penetration testing) safety evaluation method of computer systems or networks modeling means intruder attacks.

For some it’s a hobby, for someone it’s work, for someone it’s a lifestyle. On the pages of our site we will try to introduce you to the profession of a real hacker, with the tasks that are set before him, and their solutions.

Today we will focus on the analysis of the security of wireless networks. If you hear about this for the first time, then for starters you can look at Wikipedia and read the Wardriving article or find the relevant materials on our website. checking mail for hacking We will talk about wardraving as a service that is in demand among large companies.

An analysis of the security of wireless networks should identify weaknesses in the operation of access points and client Wi-Fi devices for the 2.4 and 5 GHz bands using 802.11a / b / g / n technologies, as well as weaknesses in the architecture and organization of wireless access.

The service comes down to collecting information and demonstrating that a potential attacker with some knowledge is able to gain access to the tested wireless network. Or not capable if there are no flaws in the implementation.

In most cases, such a service is in demand as part of comprehensive penetration testing. It implies an external, internal testing, as well as, perhaps, an assessment of employee awareness of information security issues.

In my practice, there was no case when a particular company asked to investigate only the security of wireless networks.

Today we will consider the composition of such works, their scope and some features.

Before starting work related to wireless networks, an ethical hacker needs to agree on the date and time of their conduct, and also tell what exactly will be done by verbally duplicating the lines from the TCH in order to avoid misunderstanding. In practice, usually the whole set of work that is implied by this service takes three business days for one object. The object is a relative concept, and by it I mean an office building in which the customer can occupy an arbitrary number of floors.

To analyze the security of wireless networks, you can not do without an external Wi-Fi adapter, which at least has more power than an integrated card. The choice of an external adapter is a simple question only at first glance and directly depends on the purposes for which it is planned to be used.

The topic was perfectly disclosed by Oleg Kupreev as part of his speech at the first meeting of Defcon Moscow. I highly recommend that you read the material in this presentation.

Personally, I use the Atheros AR9271 AWUS036NHA from Alfa Networks, but I think I will reconsider my choice for some of the cases.

After all the details and nuances are discussed, on the appointed day, the pentester appears in the customer’s office and conducts reconnaissance (reconnaissance) in relation to the wireless networks available in the territory. Recon means compiling a list of all available wireless networks, as well as collecting information about them and their customers.

In practice, such intelligence means launching airodump and taking a leisurely walk around the office.

I recommend giving friendly names to the files generated by airodump, for example, floor_1_openspace.

In the future, this habit can greatly simplify the search for the place where there was a signal from the access point of interest. Along the way, it is advisable to note which access points were in the immediate vicinity of your path. check server security If there are other tenants in the building, this will help determine if the point is in the customer’s office.

As a result, we have a list of wireless networks available in the territory of the desired office, as well as their characteristics (BSSID, CH, ENC, CIPHER, AUTH, ESSID, WPS).

Reconstruction in a large organization can take up to several hours.

After the recon, it is necessary to discuss with the customer’s technical specialist a list of access points that are legitimate for his IP. At this stage, using the information received, it is already possible to identify all access points that may have been unauthorized connected to the customer’s LAN.

In addition to the office territory, it is necessary to collect data from all publicly accessible places of the building in which the office is located, as well as in theory and, if possible, in practice, assess the chances that the signal will be accessible outside the building.

Based on the information obtained during the reconnection stage, an ethical hacker compiles a list of tasks for himself, each of which reflects the BSSID and ESSID of the access point, as well as attack vectors that can be implemented in relation to it.

For example, task1 / 00: 11: 22: 33: 44: 55 / corp_wifi / WPAPSK_handshake_pwn at the point uses WPA, the attack vector try to intercept the handshake and set the key value. Roughly speaking, a similar list of tasks in the future can be used as a support in preparing the description of the intruder model.

Once reconnaissance is complete, the current picture of wireless security is almost completely clear. The next task of the ethical hacker is to demonstrate the shortcomings that he identified at the previous stage.

The main purpose of the demonstration is gaining access to a wireless network. This means that not only a successful connection to the network can be opened for everyone at all (for example, hotel Wi-Fi with authentication after connection), namely getting the opportunity to fully work with the network on a par with legitimate users.

Everything from WPS brute force (a modern analogue of WEP in terms of simplicity of attack vector) to interception and brute force of handshakes and raising a fake access point is used.

At this stage, it is necessary to most fully demonstrate in practice and document the possibility (or impossibility) of carrying out various attacks.

Do not forget that a prerequisite for the performance of work is compliance with the principles of confidentiality, integrity and accessibility of information.

In this case, I especially want to note the principle of information accessibility: many neglect this at the stage of demonstrating attacks on wireless networks, for example ruthlessly sending tons of de-auth packets.

This process is easy to automate this will give a gain in time. At the end of the working day, all data that can be brute force offline (for example, WPA handshake) is sent to brute force if it has not been done before.

The second working day will begin with interaction with computing power, which were puzzled by brute force. If the desired values??are found well, if not, do not be upset: this means that they are not so simple.

After collecting all the information, it is necessary to meet with the customer and with the customer’s technical contact to discuss the current status and explain whether they managed to gain unauthorized access or not and why.

At the end of this meeting, the pentester requests data to connect to all of the listed wireless networks, as well as the configuration of access points (if possible) for further analysis. Here you can already understand what were the real chances for the success of brute force :). This data is necessary for the analysis of the security of infrastructure resources, as well as for the analysis of network security at the data link layer.

Wireless networks in organizations can be divided into two main types of guest and corporate. Guest networks are further explored for the ability to access the corporate network. pentest penetration testing Testing all wireless networks is a long business, so you won’t be able to relax.

I recommend to carry out similar work at once from several laptops to analyze several networks at the same time. Unfortunately, in most cases the task itself is trivial and tedious.

The preparation of the report will take from one to three business days, depending on the amount of information that needs to be reflected in it.

Based on the analysis of wireless network security, an ethical hacker provides a report to the customer. It should include at least the following information:

• a list of wireless access points that do not comply with information security standards (the use of security methods for which there are documented workarounds, lack of security mechanisms, and so on);

• a description of all (successful and unsuccessful) attempts of unauthorized access to the customer’s wireless networks;

• a description of the problems that allowed unauthorized access, as well as recommendations for resolving them;

• a description of the problems identified as a result of the analysis of the security of the infrastructure and the data link layer, and recommendations for their elimination;

• Description of errors in the configuration of devices of access points of wireless networks (if applicable);

• range of wireless networks (if applicable);

• a list of identified unauthorized wireless access points (if applicable).

In practice, most wireless networks are configured almost the same way, and, accordingly, the problems are similar, as well as the solutions. In addition, new attack methods with respect to wireless security mechanisms are very rare in current realities.

So most of the work that follows the reconstruction and collection of reporting materials comes down to the competent preparation of reports from ready-made templates.

Being engaged in practical information security, especially in the fresh air and with a laptop in your backpack, do not forget that such simple and wonderful things as a bicycle, rollers, scooter or longboard will help to combine business with pleasure and enjoy the good weather.

Above Article is associated with DICC offers cyber security course in delhi.. DICC is a well-known ethical hacking institute in Delhi.