Re: Pen-Testing New Server - Where to start?

Unless you want to start reading source code (recommended) and hunting
for some 0-days I suggest thinking a little higher than the underlying
server infrastructure.

For example, you can enumerate services (name, version number, etc)
and search for some exploits that could work on those ports. Also try
some default usernames and passwords, etc. Common configuration errors
are always fun. Brute forcing is not going to teach you much so in my
opinion you could skip that all together.

In regards to "thinking higher" (most of the time this is how an
attacker gets access) you could smoke a joint (thinking higher, get
it, get it, ha-ha) and enumerate user-land applications (i.e. those
running on the HTTP port) and try to exploit them. Remember that
gaining access does not necessarily mean you are going to execute an
exploit and you're in. XSS and session hi-jacking could very well get
you an account, as well as phishing, etc. So look for all
vulnerabilities, not just those that you saw in Hackers (movie).

Great starting points in my opinion are:

Learn to program (strongly recommended if you don't know already).
C (at a minimum)
Java/C# (pick one, same shit)
Python/Perl/PHP (pick one, depending on what you want to do).

Read www.owasp.org (reference section).


Cheers,
Serg

On Nov 14, 2007 7:56 AM, Security <security@xxxxxxxxxxxxxxx> wrote:
Hi, I'm new to the InfoSec industry and would like to try my hand at
penetration-testing (and securing) a new server I've set up at home.

Seeing as I've set up the system, I know all the usernames/passwords
used on the box, as well as how everything is set up, but I'd like to
approach this as an outside user, pretending that I have none of this
information. I want to try to gather information, form an attack plan,
and attempt to crack the system from scratch, so that I can later on go
back and secure the system against those attacks.

Here's the information I can assume I'd know, from basic enumeration:

The server is running Ubuntu v6.06, with the following services:
ftp
http (apache)
smtp
pop3
irc (hybrid)
ssh

When setting up the system, I followed the following tutorial (almost to
a T... though I did a few things different):

http://www.howtoforge.com/perfect_setup_ubuntu_6.06

Since the system is on my local network, I know there's only one IP I've
got to worry about, and this is the only target machine.

Any ideas where I should start? What information might help?

Thanks.

~Xor


Relevant Pages

  • Re: Enumerate volumes on a server
    ... To enumreate volumes the server is offering or sharing via a NAS protocol, ... To enumerate volumes attached to the server, ... Use your favorite search web site and you should find plenty of WMI scripting examples. ...
    (microsoft.public.windows.file_system)
  • ASP.NET site hangs when schtasks /v switch is invoked
    ... will enumerate the scheduled tasks on a certain server. ... However, when I tack on a /v switch to the end of that, the site hangs ... fine from a command prompt against remote servers so it is something to ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Get SQL Server version of each instance installed
    ... There must be an SQL query (when you connect to the default ... The problem is that I don't know how many instances each server is ... ' Enumerate account balances. ...
    (microsoft.public.windows.server.scripting)
  • How To Use the WTSEnumerateServers Terminal Server Function from Visual Basic
    ... i have found on msdn an article how to enumerate all sessions on a terminal ... server, ... The idea is to have some code look for all the open clients TS connections ...
    (microsoft.public.windows.server.scripting)
  • RE: Is this as bad as it seems?
    ... The network being protected by the router or firewall is still vulnerable to ... > circumvented - the administrator has explicitly allowed HTTP traffic on ... this exploit has the effect of allowing the attacker to send *INBOUND* HTTP ... The HTTP server (located on the internal network or anywhere else that is ...
    (Security-Basics)