Secure Analysis & Testing (Hacking Technique)
description
Transcript of Secure Analysis & Testing (Hacking Technique)
![Page 1: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/1.jpg)
Secure Analysis & Secure Analysis & Testing Testing (Hacking Technique)(Hacking Technique)
Universitas Langlangbuana Bandung Bandung, 25 Oktober 2008
Arif Wicaksono
![Page 2: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/2.jpg)
AgendaAgenda
Today’s HackersRisk ManagementTypes of Security TestTesting Methodology FootPrinting Port Scanning Penetrate, External Enumeration Discussion
![Page 3: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/3.jpg)
Today’s HackersToday’s Hackers
![Page 4: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/4.jpg)
Today’s HackersToday’s Hackers
![Page 5: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/5.jpg)
Today’s HackersToday’s Hackers
![Page 6: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/6.jpg)
Today’s HackersToday’s Hackers
![Page 7: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/7.jpg)
Risk Management (for Ethical Hacker)Risk Management (for Ethical Hacker)
Vulnerabilities
Threats
Risk Management (for Ethical Hacker)
![Page 8: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/8.jpg)
Type of Security TestType of Security Test
![Page 9: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/9.jpg)
Testing MethodologyTesting Methodology
![Page 10: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/10.jpg)
Testing MethodologyTesting Methodology
Footprinting
![Page 11: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/11.jpg)
Testing Methodology : FootPrintingTesting Methodology : FootPrinting
Informasi Domain Informasi Jaringan dan Server
![Page 12: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/12.jpg)
Testing Methodology : FootPrintingTesting Methodology : FootPrinting
![Page 13: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/13.jpg)
Testing Methodology : FootPrintingTesting Methodology : FootPrinting
![Page 14: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/14.jpg)
Testing Methodology : FootPrintingTesting Methodology : FootPrinting
![Page 15: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/15.jpg)
Testing Methodology : FootPrintingTesting Methodology : FootPrinting
![Page 16: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/16.jpg)
Testing MethodologyTesting Methodology
ScanningDiscovery of IPs,
ports, services, and
vulnerabilities.
* Direct connection
may be made to
target
![Page 17: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/17.jpg)
Port Scanning : Identifikasi OSPort Scanning : Identifikasi OS
Stack FingerPrint
NMAP -O
![Page 18: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/18.jpg)
Informasi Banner sebuah Service pada OS
Port Scanning : Identifikasi OSPort Scanning : Identifikasi OS
![Page 19: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/19.jpg)
Port aktif Windows : port 135 & 139 (NetBIOS), 445 (Ms-DS) Unix (Umum) : 22, 23, 79, 111
Ping
Port Scanning : Identifikasi OSPort Scanning : Identifikasi OS
![Page 20: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/20.jpg)
Port Scanning : Identifikasi OSPort Scanning : Identifikasi OS
![Page 21: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/21.jpg)
Testing MethodologyTesting Methodology
Penetrate,
External
![Page 22: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/22.jpg)
Penetrasi Jaringan PublikPenetrasi Jaringan Publik
![Page 23: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/23.jpg)
Testing MethodologyTesting Methodology
EnumerateObtain list of users,
Passwords, shares,
NetBIOS, names,
SMTP strings, etc.
![Page 24: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/24.jpg)
Mendapatkan informasi lanjutan dari sebuah Sistem Operasi
Daftar User Shares
Enumerasi DasarEnumerasi Dasar
![Page 25: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/25.jpg)
NBT NetBIOS over TCP / IP
Enumerasi DasarEnumerasi Dasar
![Page 26: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/26.jpg)
Legion
Tools EnumerasiTools Enumerasi
![Page 27: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/27.jpg)
GetAcct
Tools EnumerasiTools Enumerasi
![Page 28: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/28.jpg)
Enumerasi : SNMP VulnerabilityEnumerasi : SNMP Vulnerability
![Page 29: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/29.jpg)
Era tahun 2000 – 2002 Bug Unicode / DecodeEra tahun 2003 - 2007
RPC - DCOM Netapi PnP DNS RPC Vulnerability
Bug Terbaru dan cukup Berbahaya tahun 2008 8 April 2008
Windows Kernel Could Allow Elevation of Privilege
Bug yang Populer Pada WindowsBug yang Populer Pada Windows
![Page 30: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/30.jpg)
Bug pada System Windows
Bug yang Populer Pada WindowsBug yang Populer Pada Windows
![Page 31: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/31.jpg)
Bug aplikasi
Bug yang Populer Pada WindowsBug yang Populer Pada Windows
![Page 32: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/32.jpg)
Masalah pada system Hacking Serangan bersifat spesifik : OS, H/w, Services, dll.
Berbeda juga cara serangan dan eksploitasinya.
Perubahan yang cepat : OS, H/w, Services, dll.
Firewall
Latar Belakang Ancaman Latar Belakang Ancaman pada Web Serverpada Web Server
![Page 33: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/33.jpg)
Click KiddiesClick Kiddies
![Page 34: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/34.jpg)
Hasil dari Click KiddiesHasil dari Click Kiddies
![Page 35: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/35.jpg)
Click Kiddies Era baru Hacking, khusus pada serangan aplikasi web
Hanya diperlukan satu trick khusus yang ampuh untuk melakukan serangan
Senjata ampuhnya : cukup dengan BROWSER
Tools tambahan lainnya :
Port Scanner
Netcat
Vullnerability checker : Acunetix, Goolag, SandCat, Nikto, Black Widow, dll.
Milw0rm
Metasploit Framework
Dll.
Latar Belakang Ancaman Latar Belakang Ancaman pada Web Serverpada Web Server
![Page 36: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/36.jpg)
Desain Aplikasi WebDesain Aplikasi Web
![Page 37: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/37.jpg)
Informasi pada WebsiteLogo & AplikasiManipulasi URL
Directory traversal
Source Code
Informasi BerhargaInformasi Berharga
![Page 38: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/38.jpg)
Jenis-jenis Serangan Jenis-jenis Serangan Terhadap Aplikasi WebTerhadap Aplikasi Web
Buffer overflow, stack overflow, heap overflow Format string Parameter manipulation (command execution,
unicode/URL Decoding, file inclusion, path transversal, HTTP splitting)
Cross Site Scripting (XSS) SQL Injections Session/Cookie Hijacking & Manipulation
![Page 39: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/39.jpg)
Testing MethodologyTesting Methodology
Penetrate, Internal
![Page 40: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/40.jpg)
Testing MethodologyTesting Methodology
Escalate, protect
![Page 41: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/41.jpg)
Testing MethodologyTesting Methodology
Pillage
![Page 42: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/42.jpg)
Testing MethodologyTesting Methodology
Get Interactive
![Page 43: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/43.jpg)
Testing MethodologyTesting Methodology
Expand influence
![Page 44: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/44.jpg)
Testing MethodologyTesting Methodology
Cleanup / maintenance
![Page 45: Secure Analysis & Testing (Hacking Technique)](https://reader031.fdocuments.net/reader031/viewer/2022013101/56813d62550346895da73602/html5/thumbnails/45.jpg)
DISCUSSIONDISCUSSION