penetration testing - the university of tennessee at...

31
3HQHWUDWLRQ7HVWLQJ Essay 11 Penetration Testing Clark Weissman 7KH7&%VKDOOEHIRXQGUHVLVWDQWWRSHQHWUDWLRQ ‡’HSDUWPHQWRI’HIHQVH·7UXVWHG&RPSXWHU6\VWHP(YDOXDWLRQ &ULWHULDµ’R’67’’HFHPEHU7KH2UDQJH%RRN 1HDUIODZOHVVSHQHWUDWLRQWHVWLQJLVDUHTXLUHPHQWIRUKLJKUDWHG VHFXUH V\VWHPV ‡ WKRVH UDWHG DERYH % EDVHG RQ WKH 7UXVWHG &RPSXWHU 6\VWHP (YDOXDWLRQ &ULWHULD 7&6(& DQG LWV 7UXVWHG 1HWZRUNDQG’DWDEDVH,QWHUSUHWDWLRQV71,DQG7’,8QOLNHVHFX ULW\IXQFWLRQDOWHVWLQJZKLFKGHPRQVWUDWHVFRUUHFWEHKDYLRURIWKH SURGXFW•V DGYHUWLVHG VHFXULW\ FRQWUROV SHQHWUDWLRQ WHVWLQJ LV D IRUPRIVWUHVVWHVWLQJZKLFKH[SRVHVZHDNQHVVHV‡WKDWLVIODZV ‡ LQ WKH WUXVWHG FRPSXWLQJ EDVH 7&% 7KLV HVVD\ GHVFULEHV WKH )ODZ +\SRWKHVLV 0HWKRGRORJ\ )+0 WKH HDUOLHVW FRPSUHKHQVLYH DQG ZLGHO\ XVHG PHWKRG IRU FRQGXFWLQJ SHQHWUDWLRQV WHVWLQJ ,W UHYLHZV PRWLYDWLRQ IRU SHQHWUDWLRQ WHVWLQJ DQG SHQHWUDWLRQ WHVW SODQQLQJ ZKLFK HVWDEOLVKHV WKH JRDOV JURXQG UXOHV DQG UH VRXUFHVDYDLODEOHIRUWHVWLQJ7KH7&6(&GHILQHV·IODZµDV·DQHU URURIFRPPLVVLRQRPLVVLRQRURYHUVLJKWLQDV\VWHPWKDWDOORZV SURWHFWLRQ PHFKDQLVPV WR EH E\SDVVHGµ 7KLV HVVD\ DPSOLILHV WKH GHILQLWLRQRIDIODZDVDGHPRQVWUDWHGXQVSHFLILHGFDSDELOLW\WKDW FDQ EH H[SORLWHG WR YLRODWH VHFXULW\ SROLF\ 7KH HVVD\ SURYLGHV DQ RYHUYLHZ RI )+0 DQG LWV DQDORJ\ WR D KHXULVWLFEDVHG VWUDWHJ\ JDPH 7KHPRVWSURGXFWLYHZD\VWRJHQHUDWHK\SRWKHWLFDOIODZVDUH GHVFULEHGDVSDUWRIWKHPHWKRGDVDUHZD\VWRFRQILUPWKHP$ UHYLHZ RI WKH UHVXOWV DQG UHSUHVHQWDWLYH JHQHULF IODZV GLVFRYHUHG RYHUWKHSDVW\HDUVLVSUHVHQWHG7KHHVVD\FRQFOXGHVZLWKWKH DVVHVVPHQW WKDW )+0 LV DSSOLFDEOH WR WKH (XURSHDQ ,76(& DQG ZLWK VSHFXODWLRQV DERXW IXWXUH PHWKRGV RI SHQHWUDWLRQ DQDO\VLV XVLQJ IRUPDO PHWKRGV WKDW LV PDWKHPDWLFDOO\ VSHFLILHG GHVLJQ

Upload: trandieu

Post on 01-Feb-2018

221 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

Essay 11

Penetration TestingClark Weissman

7KH�7&%�VKDOO�EH�IRXQG�UHVLVWDQW�WR�SHQHWUDWLRQ�

³�'HSDUWPHQW�RI�'HIHQVH��´7UXVWHG�&RPSXWHU�6\VWHP�(YDOXDWLRQ&ULWHULD�µ�'R'���������67'��'HFHPEHU�������7KH�2UDQJH�%RRN��

1HDU�IODZOHVV�SHQHWUDWLRQ�WHVWLQJ�LV�D�UHTXLUHPHQW�IRU�KLJK�UDWHGVHFXUH� V\VWHPV� ³� WKRVH� UDWHG� DERYH� %�� EDVHG� RQ� WKH� 7UXVWHG&RPSXWHU� 6\VWHP� (YDOXDWLRQ� &ULWHULD� �7&6(&�� DQG� LWV� 7UXVWHG1HWZRUN�DQG�'DWDEDVH�,QWHUSUHWDWLRQV��71,�DQG�7',���8QOLNH�VHFX�ULW\�IXQFWLRQDO�WHVWLQJ��ZKLFK�GHPRQVWUDWHV�FRUUHFW�EHKDYLRU�RI�WKHSURGXFW·V� DGYHUWLVHG� VHFXULW\� FRQWUROV�� SHQHWUDWLRQ� WHVWLQJ� LV� DIRUP�RI�VWUHVV�WHVWLQJ�ZKLFK�H[SRVHV�ZHDNQHVVHV�³�WKDW�LV��IODZV³�LQ� WKH� WUXVWHG� FRPSXWLQJ�EDVH� �7&%���7KLV�HVVD\�GHVFULEHV� WKH)ODZ�+\SRWKHVLV�0HWKRGRORJ\� �)+0��� WKH� HDUOLHVW� FRPSUHKHQVLYHDQG� ZLGHO\� XVHG� PHWKRG� IRU� FRQGXFWLQJ� SHQHWUDWLRQV� WHVWLQJ�� ,WUHYLHZV� PRWLYDWLRQ� IRU� SHQHWUDWLRQ� WHVWLQJ� DQG� SHQHWUDWLRQ� WHVWSODQQLQJ�� ZKLFK� HVWDEOLVKHV� WKH� JRDOV�� JURXQG� UXOHV�� DQG� UH�VRXUFHV�DYDLODEOH�IRU�WHVWLQJ��7KH�7&6(&�GHILQHV�´IODZµ�DV�´DQ�HU�URU�RI�FRPPLVVLRQ��RPLVVLRQ��RU�RYHUVLJKW�LQ�D�V\VWHP�WKDW�DOORZVSURWHFWLRQ�PHFKDQLVPV�WR�EH�E\SDVVHG�µ�7KLV�HVVD\�DPSOLILHV�WKHGHILQLWLRQ�RI�D�IODZ�DV�D�GHPRQVWUDWHG�XQVSHFLILHG�FDSDELOLW\�WKDWFDQ�EH�H[SORLWHG�WR�YLRODWH�VHFXULW\�SROLF\��7KH�HVVD\�SURYLGHV�DQRYHUYLHZ� RI� )+0� DQG� LWV� DQDORJ\� WR� D� KHXULVWLF�EDVHG� VWUDWHJ\JDPH�7KH����PRVW�SURGXFWLYH�ZD\V�WR�JHQHUDWH�K\SRWKHWLFDO�IODZV�DUH

GHVFULEHG�DV�SDUW�RI�WKH�PHWKRG��DV�DUH�ZD\V�WR�FRQILUP�WKHP��$UHYLHZ�RI� WKH� UHVXOWV�DQG�UHSUHVHQWDWLYH�JHQHULF� IODZV�GLVFRYHUHGRYHU�WKH�SDVW����\HDUV�LV�SUHVHQWHG��7KH�HVVD\�FRQFOXGHV�ZLWK�WKHDVVHVVPHQW� WKDW� )+0� LV� DSSOLFDEOH� WR� WKH� (XURSHDQ� ,76(&� DQGZLWK� VSHFXODWLRQV� DERXW� IXWXUH� PHWKRGV� RI� SHQHWUDWLRQ� DQDO\VLVXVLQJ� IRUPDO� PHWKRGV�� WKDW� LV�� PDWKHPDWLFDOO\� VSHFLILHG� GHVLJQ�

Page 2: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

WKHRUHPV�� DQG� SURRIV� RI� FRUUHFWQHVV� RI� WKH� GHVLJQ�� 2QH� SRVVLEOHGHYHORSPHQW� FRXOG� EH� D� ULJRURXV� H[WHQVLRQ� RI� )+0� WR� EH� LQWH�JUDWHG� LQWR� WKH�GHYHORSPHQW�SURFHVV��7KLV�DSSURDFK�KDV� WKH� SR�WHQWLDO� RI� XQFRYHULQJ� SUREOHPV� HDUO\� LQ� WKH� GHVLJQ�� HQDEOLQJLWHUDWLYH�UHGHVLJQ�

$� VHFXULW\� WKUHDW� H[LVWV� ZKHQ� WKHUH� DUH� WKH� RSSRUWXQLW\�� PRWLYDWLRQ�DQG�WHFKQLFDO�PHDQV�WR�DWWDFN��WKH�ZKHQ��ZK\��DQG�KRZ��)+0�GHDOV�RQO\ZLWK� WKH� ´KRZµ� GLPHQVLRQ� RI� WKUHDWV�� ,W� LV� D� UHTXLUHPHQW� IRU� KLJK�UDWHGVHFXUH�V\VWHPV� �IRU�H[DPSOH��7&6(&�UDWLQJV�DERYH�%��� WKDW�SHQHWUDWLRQWHVWLQJ�EH�FRPSOHWHG�ZLWKRXW�GLVFRYHU\�RI�VHFXULW\�IODZV�LQ�WKH�HYDOXDWHGSURGXFW�� DV� SDUW� RI� D� SURGXFW� RU� V\VWHP� HYDOXDWLRQ� >'2'����1&6&��E�1&6&��@��8QOLNH�VHFXULW\�IXQFWLRQDO�WHVWLQJ��ZKLFK�GHPRQVWUDWHV�FRUUHFWEHKDYLRU�RI�WKH�SURGXFW·V�DGYHUWLVHG�VHFXULW\�FRQWUROV��SHQHWUDWLRQ�WHVWLQJLV� D� IRUP� RI� VWUHVV� WHVWLQJ�� ZKLFK� H[SRVHV� ZHDNQHVVHV� RU� IODZV� LQ� WKHWUXVWHG� FRPSXWLQJ� EDVH� �7&%��� ,W� KDV� EHHQ� F\QLFDOO\� QRWHG� WKDW� VHFXULW\IXQFWLRQDO�WHVWLQJ�GHPRQVWUDWHV�WKH�VHFXULW\�FRQWUROV�IRU�WKH�´JRRG�JX\V�µZKLOH�SHQHWUDWLRQ�WHVWLQJ�GHPRQVWUDWHV�WKH�VHFXULW\�FRQWUROV�IRU�WKH�´EDGJX\V�µ� $OVR�� XQOLNH� VHFXULW\� IXQFWLRQDO� WHVWLQJ� E\� WKH� SURGXFW� YHQGRU�SHQHWUDWLRQ�WHVWLQJ� LV� WKH�UHVSRQVLELOLW\�RI� WKH�SURGXFW�HYDOXDWRUV��+RZ�HYHU��SURGXFW�YHQGRUV�ZRXOG�EH�LOO�DGYLVHG�WR�LJQRUH�WKHLU�RZQ�SHQHWUDWLRQWHVWLQJ�DV�SDUW�RI�WKH�GHVLJQ��WHVW��DQG�SUHSDUDWLRQ�IRU�D�KLJK�UDWHG�VHFX�ULW\�SURGXFW�HYDOXDWLRQ��IRU�VXFK�YHQGRUV�ZLOO�VXUHO\�EH�VXUSULVHG�E\�XQ�DQWLFLSDWHG�GHELOLWDWLQJ�YXOQHUDELOLWLHV�ORQJ�DIWHU�WKH�GHYHORSPHQW�SKDVH�ZKHQ�UHSDLUV�DUH�LPSUDFWLFDO�2I� DOO� WKH� VHFXULW\� DVVXUDQFH� PHWKRGV� ³� LQFOXGLQJ� OD\HUHG� GHVLJQ�

SURRI� RI� FRUUHFWQHVV�� DQG� VRIWZDUH� HQJLQHHULQJ� HQYLURQPHQWV� �6((�� ³RQO\�SHQHWUDWLRQ�WHVWLQJ�LV�KROLVWLF�LQ�LWV�IODZ�DVVHVVPHQW��,W�ILQGV�IODZV�LQDOO� WKH� 7&%� HYLGHQFH�� SROLF\�� VSHFLILFDWLRQ�� DUFKLWHFWXUH�� DVVXPSWLRQV�LQLWLDO� FRQGLWLRQV�� LPSOHPHQWDWLRQ�� VRIWZDUH�� KDUGZDUH�� KXPDQ� LQWHU�IDFHV�� FRQILJXUDWLRQ� FRQWURO�� RSHUDWLRQ�� SURGXFW� GLVWULEXWLRQ�� DQG� GRFX�PHQWDWLRQ��,W�LV�D�YDOXHG�DVVXUDQFH�DVVHVVPHQW�WRRO�7KLV� HVVD\� LV� LQ� ��� SDUWV� DQG� GHVFULEHV� D� FRPSUHKHQVLYH�PHWKRG� IRU

FRQGXFWLQJ�SHQHWUDWLRQ�DQDO\VLV��RI�ZKLFK�SHQHWUDWLRQ�WHVWLQJ�LV�EXW�RQHDVSHFW��7KH�SDUWV�LQFOXGH�EDFNJURXQG�PRWLYDWLRQ��WHVW�SODQQLQJ��WHVWLQJ�DQG� WKH� DQDO\VLV� RI� WKH� WHVW� UHVXOWV�� 7KH� HVVD\� LV� ODUJHO\� EDVHG� RQ� WKHDXWKRU·V� )ODZ� +\SRWKHVLV� 0HWKRGRORJ\� �)+0��� WKH� HDUOLHVW� DQG� PRVWZLGHO\�XVHG�DSSURDFK�>:(,6��@�7KH� ´%DFNJURXQGµ� VHFWLRQ� UHYLHZV� WKH� UHIHUHQFH� PRQLWRU� FRQFHSW� RI

SROLF\�� PHFKDQLVP�� DQG� DVVXUDQFH� WKDW� IRUPV� WKH� EDVLV� RI� WKH� 7&%�3HQHWUDWLRQ�WHVWLQJ��D�SVHXGR�HQHP\�DWWDFN��LV�RQH�PHWKRG�RI�HYDOXDWLQJWKH�VHFXULW\�VWUHQJWK�RI�WKH�UHIHUHQFH�PRQLWRU�7&%��7KH�VHFWLRQ�´'HYHORSD�SHQHWUDWLRQ�WHVW�SODQµ�HVWDEOLVKHV�WKH�JURXQG�UXOHV��OLPLWV��DQG�VFRSH�RIWKH�WHVWLQJ��7KH�WHVW�WHDP�LGHQWLILHV�ZKDW�LV�WKH�´REMHFWµ�EHLQJ�WHVWHG�DQGZKHQ� WKH� WHVWLQJ� LV� FRPSOHWH�� 7KH� VHFWLRQ� DGYDQFHV� WKH� LGHD� WKDW� WKH

Page 3: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

WHVWV� VHHN� WR� FRQILUP� VHFXULW\� FODLPV� RI� WKH� YHQGRU� DQG� WR� VXSSRUW� WKHHYDOXDWLRQ�FODVV�UDWLQJ��7HVWLQJ�LV�QRW�D�FKDOOHQJH�RU�LQYLWDWLRQ�WR�WKH�WHVWWHDP�WR�´FUDFNµ�WKH�V\VWHP�DQG�VWHDO�VRPHWKLQJ�RI�YDOXH�7KH�VHFWLRQ�´)ODZ�K\SRWKHVLV�PHWKRGRORJ\� �)+0��RYHUYLHZµ�SURYLGHV�D

WHFKQLFDO�IRXQGDWLRQ�IRU�SHQHWUDWLRQ�WHVWLQJ��,W�HVWDEOLVKHV�WKH�LGHD�WKDW�DVHFXULW\�IODZ�LV�DQ�XQVSHFLILHG�FDSDELOLW\�WKDW�FDQ�EH�H[SORLWHG�WR�YLRODWHVHFXULW\� SROLF\� ³� IRU� H[DPSOH�� WR� SHQHWUDWH� WKH� SURWHFWLRQ� FRQWUROV�)LQGLQJ�DQG�DVVHVVLQJ� IODZV� LV� D� IRXU�SKDVH�SURFHVV�RI� IODZ�JHQHUDWLRQ�IODZ� FRQILUPDWLRQ�� IODZ� JHQHUDOL]DWLRQ�� DQG� IODZ� HOLPLQDWLRQ�� 7KHVHSKDVHV� DUH� FRYHUHG� LQ� VHSDUDWH� VHFWLRQV�� 7KH� VHFWLRQ� ´)+0� H[SHULHQFHµSURYLGHV� H[DPSOHV� RI� UHVXOWV� RI� DSSOLFDWLRQ� RI� WKH�PHWKRG� WR� GR]HQV� RIV\VWHPV��6RPH�FRVWV�RI�SHQHWUDWLRQ�WHVWLQJ�DUH�DOVR�GLVFXVVHG��7KH�ILQDOVHFWLRQ�� ´3HQHWUDWLRQ�DQDO\VLV� IRU� WKH�����V�DQG�EH\RQG�µ� H[DPLQHV� WKH,76(&�DQG�ZKHUH�)+0�FDQ�EH�DSSOLHG��DQG�ZRUN�LQ�IRUPDO�PHWKRGV�DQGSURPLVLQJ�IXWXUH�DSSURDFKHV�WR�IODZ�GHWHFWLRQ�

%DFNJURXQG

3HU�WKH�7&6(&��D�7&%�LV�WKH�DPDOJDP�RI�KDUGZDUH��VRIWZDUH��IDFLOLWLHV�SURFHGXUHV��DQG�KXPDQ�DFWLRQV�WKDW�FROOHFWLYHO\�SURYLGH�WKH�VHFXULW\�HQ�IRUFHPHQW� PHFKDQLVP� RI� WKH� UHIHUHQFH� PRQLWRU� >$1'(��@�� $� UHIHUHQFHPRQLWRU�PHGLDWHV�HYHU\�DFFHVV� WR�VHQVLWLYH�SURJUDPV�DQG�GDWD� �VHFXULW\REMHFWV��E\�XVHUV�DQG�WKHLU�SURJUDPV��VHFXULW\�VXEMHFWV���,W�LV�WKH�VHFXULW\SROLF\�PHFKDQLVP�HTXLYDOHQW�RI�DEVWUDFW�GDWD�W\SH�PDQDJHUV� LQ�VWURQJO\W\SHG�SURJUDPPLQJ�ODQJXDJHV�VXFK�DV�$OJRO��0RGXOD��DQG�$GD��7KH�UHI�HUHQFH�PRQLWRU�VRIWZDUH�LV�SODFHG�LQ�LWV�RZQ�H[HFXWLRQ�GRPDLQ��WKH�SULYL�OHJHG� VXSHUYLVRU� VWDWH� RI� WKH�KDUGZDUH�� WR� SURYLGH� WDPSHU� UHVLVWDQFH� WRXQWUXVWHG�FRGH��7KH�UHIHUHQFH�PRQLWRU�VRIWZDUH��RIWHQ�FDOOHG�WKH�VHFXULW\NHUQHO�� LV�VPDOO�DQG�VLPSOH�HQRXJK�LQ� LWV�DUFKLWHFWXUH� WR�HQDEOH� LW� WR�EHHYDOXDWHG�IRU�FRUUHFWQHVV�ZLWK�DVVXUDQFH�WKDW�RQO\�WKH�DXWKRUL]HG�VHFX�ULW\�SROLF\� LV�HQIRUFHG�DQG�QHYHU�E\SDVVHG��7KH�VWUHQJWK�RI� WKLV� WULDG�RISROLF\��PHFKDQLVP��DQG�DVVXUDQFH�RI� WKH�UHIHUHQFH�PRQLWRU� LV� WKH�EDVLVIRU�WKH�HYDOXDWLRQ�RI�WKH�7&%��3HQHWUDWLRQ�WHVWLQJ�LV�EXW�RQH�PHWKRG�IRUDVVHVVLQJ�WKH�VWUHQJWK�RI�D�7&%�7UDGLWLRQDO�PHWKRGV�RI�WHVWLQJ�DQG�UHSDLU�DUH�SRRU�VWUDWHJLHV�IRU�VHFXU�

LQJ� 7&%V��6XFK� VWUDWHJLHV� OHDG� WR� JDPHV�ELDVHG� LQ� IDYRU� RI� WKH�KDFNHU�ZKR� SRVVHVVHV� PRGHUQ� SRZHU� WRROV� WR� DWWDFN� DJLQJ� FRPSXWHU� V\VWHPV�7KH� ´KDFN�DQG�SDWFKµ� DSSURDFK� WR� DVVXUH� VHFXUH� V\VWHPV� LV� D� ORVLQJPHWKRG�EHFDXVH�WKH�KDFNHU�QHHG�ILQG�RQO\�RQH�IODZ��ZKHUHDV�WKH�YHQGRUPXVW� ILQG�DQG� IL[�DOO� WKH� IODZV� >6&+(��@��)XUWKHUPRUH�� WKHUH�DUH�PDQ\IODZ�RSSRUWXQLWLHV�ZLWK� OLWWOH�ULVN�RI�GHWHFWLRQ�RU�SXQLVKPHQW� IRU� WKH� LQ�WHUORSHU��6R�ZK\�ERWKHU�ZLWK�SHQHWUDWLRQ�WHVWLQJ�E\�)+0"�%HFDXVH�)+0SHQHWUDWLRQ�WHVWLQJ�LV�QRW�KDFN�DQG�SDWFK��EXW�D�FRPSUHKHQVLYH��KROLVWLFPHWKRG� WR� WHVW� WKH� FRPSOHWH�� LQWHJUDWHG�� RSHUDWLRQDO� 7&%�³� KDUGZDUH�VRIWZDUH�� DQG� SHRSOH�� ,W� LV� DQ� HPSLULFDO� GHVLJQ� UHYLHZ� DQG� D� FUHGLEOH

Page 4: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

EULGJH�EHWZHHQ�DEVWUDFW�GHVLJQ��WKHRU\��DQG�FRQFUHWH�LPSOHPHQWDWLRQ�DQGRSHUDWLRQ��SUDFWLFH���,W�LV�D�SHHU�UHYLHZ�RI�DOO�WKH�7&%�DVVXUDQFH�HYLGHQFH�,W� LV� RQH� RI� PDQ\� PHWKRGV� IRU� VDWLVI\LQJ� DVVXUDQFH� UHTXLUHPHQWV�� ,WZRUNV�� ,W� ILQGV� IODZV�� %XW�ZH�PXVW� QRW� RYHUVWDWH� LWV� YDOXH�� 3HQHWUDWLRQWHVWLQJ�FDQQRW�SURYH�RU�HYHQ�GHPRQVWUDWH�WKDW�D�V\VWHP�LV�IODZOHVV��,W�FDQSODFH�D�UHDVRQDEOH�ERXQG�RQ�WKH�NQRZOHGJH�DQG�ZRUN�IDFWRU�UHTXLUHG�IRUD� SHQHWUDWRU� WR� VXFFHHG��:LWK� WKDW� LQIRUPDWLRQ�� WRJHWKHU� ZLWK� FRXQWHU�PHDVXUHV�� ZH� FDQ� UHVWULFW� WKH� SHQHWUDWRU·V� DFFHVV� IUHHGRP� EHORZ� WKLVERXQG��DQG�WKHUHIRUH�KDYH�D�GHJUHH�RI�DVVXUDQFH� WR�RSHUDWH� WKH�V\VWHPVHFXUHO\�LQ�D�VSHFLILF�WKUHDW�HQYLURQPHQW�>&6&��@�

'HYHORS�D�SHQHWUDWLRQ�WHVW�SODQ

(VWDEOLVKLQJ� WKH� WHVW� JURXQG� UXOHV� LV� D� SDUWLFXODUO\� LPSRUWDQW� SDUW� RISHQHWUDWLRQ�DQDO\VLV��7KH�UXOHV�DUH�FDSWXUHG�LQ�WKH�SHQHWUDWLRQ�WHVW�SODQ�ZKLFK�GHILQHV�WKH�WHVW�REMHFWLYH��WKH�SURGXFW�FRQILJXUDWLRQ��WKH�WHVW�HQYL�URQPHQW�� WHVW� UHVRXUFHV�� DQG�VFKHGXOH�� ,W� LV� LPSRUWDQW� WKDW� SHQHWUDWLRQWHVWLQJ�XVH�HWKLFDO�HYDOXDWRUV�ZKR�DUH�QRQDQWDJRQLVWLF�WRZDUG�WKH�YHQGRUWR�HQFRXUDJH�FRRSHUDWLRQ��WR�SURWHFW�SURSULHWDU\� LQIRUPDWLRQ�DQG�YHQGRULQYHVWPHQW�� DQG� XOWLPDWHO\� WR� \LHOG� DQ� LPSURYHG� VHFXULW\� SURGXFW�� 7HVWUHVXOWV� DQG� IODZV� GLVFRYHUHG� GXULQJ� SHQHWUDWLRQ� WHVWLQJ� PXVW� EH� NHSWVWULFWO\�SURSULHWDU\�DQG�QRW�EH�PDGH�SXEOLF�E\�WKH�WHVW�WHDP�

(VWDEOLVK�WHVWLQJ�JRDO��7KHUH�FDQ�EH�PDQ\�JRDOV� IRU�SHQHWUDWLRQ�WHVW�LQJ�� LQFOXGLQJ� VHFXULW\� DVVXUDQFH� >'2'��@�� V\VWHP� GHVLJQ� UHVHDUFK>.$5*��@�� DQG� V\VWHPV� WUDLQLQJ� >+(%%���� :,/.��@�� )RU� WKLV� HVVD\�SHQHWUDWLRQ�WHVWLQJ�ZLOO�IRFXV�RQO\�RQ�WKH�JRDO�RI�JHQHUDWLQJ�VXIILFLHQW�HYL�GHQFH�RI�IODZOHVVQHVV�WR�KHOS�REWDLQ�SURGXFW�FHUWLILFDWLRQ�WR�RSHUDWH�DW�D%���%���RU�$��VHFXULW\�DVVXUDQFH�OHYHO�7KH� JURXQG� UXOHV� IRU� WKH� DQDO\VLV� GHILQH� VXFFHVVIXO� FRPSOHWLRQ�� 7KH

DQDO\VLV�LV�VXFFHVVIXOO\�FRQFOXGHG�ZKHQ

�� D�GHILQHG�QXPEHU�RI�IODZV�DUH�IRXQG��� D�VHW�OHYHO�RI�SHQHWUDWLRQ�WLPH�KDV�WUDQVSLUHG��� D�GXPP\�WDUJHW�REMHFW�LV�DFFHVVHG�E\�XQDXWKRUL]HG�PHDQV��� WKH�VHFXULW\�SROLF\�LV�YLRODWHG�VXIILFLHQWO\�DQG�E\SDVVHG��RU�� WKH�PRQH\�DQG�UHVRXUFHV�DUH�H[KDXVWHG�

0RVW�RIWHQ�WKH� ODVW�FULWHULRQ�HQGV�WKH�SHQHWUDWLRQ�WHVW��DIWHU�D�GHILQHGOHYHO� RI� HIIRUW� LV� H[SHQGHG�� )RU� VRPH� V\VWHPV�� PXOWLSOH� LQGHSHQGHQWSHQHWUDWLRQ� WHDPV� DUH� XVHG� WR� SURYLGH� GLIIHUHQW� SHUVSHFWLYHV� DQG� LQ�FUHDVHG� FRQILGHQFH� LQ� WKH� IODZOHVVQHVV� RI� WKH� SURGXFW� LI� IHZ� IODZV� DUHIRXQG�� $V� D� KROLVWLF� DVVXUDQFH� WHFKQRORJ\�� SHQHWUDWLRQ� WHVWLQJ� LV� EHVWXVHG� WR� H[SORUH� WKH� EURDG� FDSDELOLWLHV� RI� WKH� REMHFW� V\VWHP� IRU� IODZVUDWKHU� WKDQ� WR� FUHDWH� D� JDPLQJ� VLWXDWLRQ� EHWZHHQ� WKH� YHQGRU� DQG� WKH

Page 5: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

SHQHWUDWLRQ� WHDP� RI� WU\LQJ� WR� DFTXLUH� DQ� LGHQWLILHG� SURWHFWHG� REMHFW� E\XQDXWKRUL]HG�PHDQV��'XPP\�WDUJHW�DFTXLVLWLRQ�SHQHWUDWLRQ�JRDOV�ZDVWHHIIRUW�E\� IRUFLQJ� WKH� WHVW� WHDP� WR� SUHSDUH� DQG�GHEXJ� D� EUHDN�LQ�� UDWKHUWKDQ�IRFXVLQJ�WKHLU�HQHUJ\�RQ�SURYHQ�PHWKRGV�RI�ILQGLQJ�IODZV�7KH� UHIHUHQFH� PRQLWRU� GHILQHV� D� �SHULPHWHUµ� EHWZHHQ� LWVHOI� DQG� XQ�

WUXVWHG� XVHU� DSSOLFDWLRQ� FRGH�� DQG� EHWZHHQ� GLIIHUHQW� XVHU� SURFHVVHV�)ODZV�ZLWKLQ�WKH�DSSOLFDWLRQ�FRGH�KDYH�QR�LPSDFW�RQ�WKH�7&%�DQG�DUH�RIOLWWOH�LQWHUHVW�WR�VHFXULW\�RU�SHQHWUDWLRQ�WHVWLQJ��)ODZV�LQWHUQDO�WR�WKH�VH�FXULW\�NHUQHO�DUH�RI�LQWHUHVW�WR�VHFXULW\��EXW�WKH\�FDQQRW�EH�H[SORLWHG�XQ�OHVV�WKH�VHFXULW\�SHULPHWHU�LV�EUHDFKHG��,Q�LQWHUQDWLRQDO�WUDYHO��LW�UHTXLUHVSDVVSRUWV�DQG�YLVDV�WR�FRQWURO�ERUGHU�FURVVLQJV��,Q�EDQNLQJ��WXUQLQJ�DF�FRXQW�EDODQFHV�LQWR�FDVK�LV�D�IRUP�RI�ERXQGDU\�FURVVLQJ�FDOOHG�´FRQYHU�VLRQ�µ�&RQWURO�LV�LPSRVHG�DW�WKH�LQWHUIDFH��7KHUHIRUH��PXFK�RI�SHQHWUDWLRQWHVWLQJ�IRFXVHV�RQ�WKH�GHVLJQ�� LPSOHPHQWDWLRQ��DQG�RSHUDWLRQDO� LQWHJULW\RI� WKH� VHFXULW\� SHULPHWHU�� WKH� FRQWURO� RI� WKH� ERXQGDU\� FURVVLQJV� RI� WKLVFULWLFDO�VHFXULW\�LQWHUIDFH�

'HILQH�WKH�REMHFW�V\VWHP�WR�EH�WHVWHG��)+0�FDQ�EH�DSSOLHG�WR�PRVWDQ\�V\VWHP�ZKRVH�GHYHORSHUV�DUH� LQWHUHVWHG� LQ�7&6(&�HYDOXDWLRQ��+RZ�HYHU��&���&���RU�%��FDQGLGDWH�V\VWHPV�DUH� LQWHQGHG� IRU�EHQLJQ�HQYLURQ�PHQWV��SURWHFWHG�E\�SK\VLFDO��SHUVRQQHO��SURFHGXUDO��DQG�IDFLOLW\�VHFXULW\�6\VWHPV� LQ� WKHVH� EHQLJQ� HYDOXDWLRQ� FODVVHV� DUH� QRW� GHVLJQHG� WR� UHVLVWKRVWLOH�DWWDFN�DQG�SHQHWUDWLRQ��6XFK�DWWDFNV�DUH�DOZD\V�OLNHO\�WR�XQFRYHUIODZV��7KH�7&6(&�ZLVHO\�GRHV�QRW�UHTXLUH�SHQHWUDWLRQ�DQDO\VLV� IRU�WKHVHV\VWHPV��)'0�LV�PRVW�YDOXDEOH�IRU�WHVWLQJ�VHFXULW\�UHVLVWDQFH�WR�DWWDFN�RIFDQGLGDWH�V\VWHPV�IRU�HYDOXDWLRQ�FODVVHV�%���%���RU�$���V\VWHPV�GHVLJQHGWR�RSHUDWH�LQ�KRVWLOH�HQYLURQPHQWV�$� V\VWHP� LQWHQGHG� IRU� 7&6(&� HYDOXDWLRQ� DW� %�� RU� KLJKHU� LV� GHOLYHUHG

ZLWK�D�FROOHFWLRQ�RI�PDWHULDO�DQG�GRFXPHQWDWLRQ�WKDW�VXSSRUWV�WKH�VHFX�ULW\�FODLP��LQFOXGLQJ�D�VHFXULW\�SROLF\�PRGHO��D�GHVFULSWLYH�WRS�OHYHO�VSHFL�ILFDWLRQ��'7/6���D�IRUPDO�WRS�OHYHO�VSHFLILFDWLRQ��)7/6��IRU�$��HYDOXDWLRQV�FRGH� FRUUHVSRQGHQFH�PDWULFHV� WR� WKH�'7/6�RU�)7/6��DQG�VHFXULW\� IXQF�WLRQDO� WHVW� UHVXOWV�� $OO� WKH� VRXUFH� DQG� REMHFW� FRGH�� WKH� GHVLJQ� DQG� WHVWGRFXPHQWDWLRQ�� DQG� WKH� VHFXULW\� HYLGHQFH�PXVW� EH� XQGHU� FRQILJXUDWLRQPDQDJHPHQW�FRQWURO�IRU�%���%���RU�$��HYDOXDWLRQ�FODVVHV��7KLV�FRQWUROOHGFROOHFWLRQ� RI� VHFXULW\� PDWHULDO� ZLOO� EH� UHIHUUHG� WR� DV� WKH� VHFXULW\� ´HYL�GHQFH�µ�DQG�GHILQHV�WKH�VHFXULW\�V\VWHP�WR�EH�SHQHWUDWLRQ�WHVWHG��1RW�DOOWKH�HYLGHQFH�ZLOO� EH� FRPSOHWH� LI� WKH�SHQHWUDWLRQ� WHVWLQJ� LV�SHUIRUPHG�E\WKH�YHQGRU�GXULQJ�WKH�GHYHORSPHQW�SKDVH��7KH�HYLGHQFH�PXVW�EH� IUR]HQDQG� UHPDLQ� XQPRGLILHG� GXULQJ� WKH� SHQHWUDWLRQ� WHVWLQJ� SHULRG� WR� DYRLGWHVWLQJ�D�PRYLQJ�WDUJHW�([SHULHQFH�KDV�VKRZQ�WKDW�SURELQJ�IRU�VHFXULW\�IODZV�PD\�UHTXLUH�V\V�

WHP�KDOWV�DQG�GXPSV�E\�WKH�SHQHWUDWLRQ�WHDP��:KHQ�WHVWV�VXFFHHG��WKH\\LHOG�XQSUHGLFWDEOH�UHVXOWV�³�IRU�H[DPSOH��XQFRQWUROOHG�ILOH�PRGLILFDWLRQRU�GHOHWLRQ�� RU� V\VWHP�FUDVK�³�ZKLFK�GLVUXSW�QRUPDO� RSHUDWLRQ�� 7KHUH�

Page 6: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

IRUH��SHQHWUDWLRQ� WHVWLQJ� VKRXOG�EH�SHUIRUPHG� LQ�D� FRQWUROOHG� ODERUDWRU\HQYLURQPHQW�RQ�D�VWDQG�DORQH�FRS\�RI� WKH� WDUJHW�V\VWHP�WR�DVVXUH�QRQ�LQWHUIHUHQFH�ZLWK�UHDO�XVHUV�RI�WKH�V\VWHP�:KHQ�WKH�REMHFW�V\VWHP�LV�D�QHWZRUN��WKH�7&%�LV�GLVWULEXWHG�LQ�YDULRXV

FRPSRQHQWV�� WKH� ZKROH� FROOHFWLRQ� RI� ZKLFK� LV� FDOOHG� WKH� QHWZRUN� 7&%�17&%���$V�QRWHG�LQ�WKH�71,��SHQHWUDWLRQ�WHVWLQJ�PXVW�EH�DSSOLHG�WR

�� WKH�FRPSRQHQWV�RI� WKH�17&%�� WKDW� LV�� WKH�SDUWLWLRQV�RI� WKH�17&%�DQG

�� WKH�ZKROH�LQWHJUDWHG�QHWZRUN�17&%�>1&6&��D@�

7KHUHIRUH��WKH�71,�0DQGDWRU\��0���$XGLW��$���,GHQWLILFDWLRQ��$XWKHQWLFD�WLRQ� �,��� DQG� 'LVFUHWLRQDU\� �'�� 0�$�,�'� QHWZRUN� FRPSRQHQWV� PXVW� EHSHQHWUDWLRQ�WHVWHG�LQGLYLGXDOO\�DQG�FROOHFWLYHO\�³�LQGLYLGXDOO\�GXULQJ�WKHFRPSRQHQW�HYDOXDWLRQ��DQG�FROOHFWLYHO\�GXULQJ�WKH�QHWZRUN�HYDOXDWLRQ�,Q�D�VLPLODU�PDQQHU��D�WUXVWHG�DSSOLFDWLRQ��IRU�H[DPSOH��D�'%06��PXVW

EH� SHQHWUDWLRQ� WHVWHG� LQGLYLGXDOO\� DV� D� FRPSRQHQW� DQG� FROOHFWLYHO\�ZLWKWKH�RSHUDWLQJ�V\VWHP�7&%�RQ�ZKLFK�LW�GHSHQGV��DFFRUGLQJ�WR�WKH�´HYDOXD�WLRQ�E\�SDUWVµ�FULWHULD�RI�WKH�7',�>1&6&��@�

3RVWXUH�WKH�SHQHWUDWRU��:KHQ�DQ�DFWXDO�WHVW�LV�UHTXLUHG�WR�FRQILUP�DIODZ��D�KRVW�RI�WHVW�FRQGLWLRQV�PXVW�EH�HVWDEOLVKHG��ZKLFK�GHULYH�GLUHFWO\IURP� WKH� WHVW� REMHFWLYHV� DQG� WKH� WHVW� HQYLURQPHQW� GHILQHG� LQ� WKH� SODQ�7KHVH� FRQGLWLRQV� GHULYH� IURP� WKH� VHFXULW\� WKUHDWV� RI� LQWHUHVW� DQG� WKHSRVWXUH�RI� WKH� ´VLPXODWHGµ�DQWDJRQLVW�DGRSWHG�E\� WKH� HYDOXDWRUV��:LOO� LWEH� DQ� ´LQVLGH� MREµ� RU� D� ´EUHDN�DQG�HQWU\µ� KDFNHU"� 7KHVH� DVVXPSWLRQVGHPDQG�GLIIHUHQW�FRQGLWLRQV�IRU�WKH�WHVW�WHDP��7KH�WHVW�FRQGLWLRQV�DUH�GH�VFULEHG�DV� ´RSHQ�ER[µ� RU� ´FORVHG�ER[µ� WHVWLQJ�� FRUUHVSRQGLQJ� WR�ZKHWKHUWKH�WHVW� WHDP�FDQ�SODFH�DUELWUDU\�FRGH� LQ� WKH�SURGXFW� �RSHQ�ER[��RU�QRW�FORVHG�ER[���,Q�WKH�ODWWHU�FDVH��WKH�WHDP�LV�UHVWULFWHG�WR�H[WHUQDOO\�VWLPX�ODWHG� IXQFWLRQDO� WHVWLQJ�� 2SHQ�ER[� SHQHWUDWLRQ� WHVWLQJ� LV� DQDORJRXV� WRFRPSXWHU�VRIWZDUH�XQLW� �&68��WHVWLQJ��ZKHUH� LQWHUQDO�FRGH�LV�DFFHVVLEOH�DQG� FORVHG�ER[� SHQHWUDWLRQ� WHVWLQJ� LV� DQDORJRXV� WR� FRPSXWHU� VRIWZDUHFRQILJXUDWLRQ�LWHP��&6&,��LQWHJUDWLRQ�WHVWLQJ��ZKHUH�FRGH�PRGXOHV�DUH�DQLQWHJUDWHG�FORVHG�ZKROH��7KH�71,�WHVWLQJ�JXLGHOLQH�FDOOV�WKHVH�´ZKLWH�ER[µ�LQWHUQDO��DQG�´EODFN�ER[µ��IXQFWLRQDO��WHVWLQJ��UHVSHFWLYHO\�>1&6&��E@�,Q�RSHQ�ER[�WHVWLQJ�ZH�DVVXPH�WKH�SHQHWUDWRU�FDQ�H[SORLW�LQWHUQDO�IODZV

ZLWKLQ�WKH�VHFXULW\�NHUQH�DQG�ZRUN�EDFNZDUG�WR�ILQG�IODZV�LQ�WKH�VHFXULW\SHULPHWHU� WKDW�PD\� DOORZ�DFFHVV� WR� WKH� LQWHUQDO� IODZV�� ,Q� WKH� FDVH� RI� DJHQHUDO�SXUSRVH�V\VWHP�VXFK�DV�8QL[��RSHQ�ER[� WHVWLQJ� LV� WKH�PRVW�DS�SURSULDWH� SRVWXUH�� )RU� VSHFLDO�SXUSRVH� V\VWHPV� VXFK� DV� QHWZRUN� 17&%FRPSRQHQWV�� ZKLFK� SURKLELW� XVHU� FRGH� �IRU� H[DPSOH�� ZKHUH� FRGH� LV� LQ520���FORVHG�ER[�SHQHWUDWLRQ�WHVWLQJ�E\�PHWKRGV�H[WHUQDO�WR�WKH�SURGXFWLV� DQDORJRXV� WR� HOHFWULFDO� HQJLQHHULQJ� ´EODFN�ER[µ� WHVWLQJ�� ,Q� FORVHG�ER[WHVWLQJ� WKH� SHQHWUDWRU� LV� FOHDUO\� VHHNLQJ� IODZV� LQ� WKH� VHFXULW\� SHULPHWHU

Page 7: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

DQG� H[SORLWLQJ� IODZV� LQ� WKH� LQWHUIDFH� FRQWURO� GRFXPHQW� VSHFLILFDWLRQV�,&'���2SHQ�ER[�WHVWLQJ�RI�WKH�17&%�LV�VWLOO�D�WHVW�UHTXLUHPHQW� WR�GHWHU�PLQH�WKH�YXOQHUDELOLW\�RI�WKH�QHWZRUN�WR�7URMDQ�KRUVH�RU�YLUDO�DWWDFNV�

)L[�SHQHWUDWLRQ�DQDO\VLV�UHVRXUFHV��,W�ZDV�EHOLHYHG�WKDW�ILQGLQJ�IODZVLQ� 26� 96��5�� ZRXOG� EH� GLIILFXOW� >0&3+��@�� +RZHYHU�� DQRWKHU� VWXG\FODLPHG�

7KH� DXWKRUV� ZHUH� DEOH�� XVLQJ� WKH� 6'&� )+0�� WR� GLVFRYHU� RYHUWZHQW\� VXFK� ´H[SRVXUHVµ� LQ� OHVV� WKDQ� ��� PDQ�KRXUV�� DQG� KDYHFRQWLQXHG� WR� JHQHUDWH� ´H[SRVXUHVµ� DW� WKH� UDWH� RI� RQH� FRQILUPHGIODZ�K\SRWKHVLV�SHU�KRXU�SHU�SHQHWUDWRU����2QO\�WKH�OLPLWDWLRQV�RIWLPH� DYDLODEOH� WR� WKH� VWXG\� JRYHUQHG� WKH� WRWDO� QXPEHU� RI� IODZVSUHVHQWHG�>*$/,��@�

3HQHWUDWLRQ� DQDO\VLV� LV� DQ� RSHQ�HQGHG�� ODERU�LQWHQVLYH� PHWKRGRORJ\VHHNLQJ�IODZV�ZLWKRXW�OLPLW��7KH�WHVWLQJ�PXVW�EH�ERXQG�LQ�VRPH�PDQQHU�XVXDOO\� E\� OLPLWLQJ� ODERU� KRXUV�� 6PDOO� WHDPV� RI� DERXW� IRXU� SHRSOH� DUHPRVW�SURGXFWLYH��,QWHUHVWLQJO\��SHQHWUDWLRQ�WHVWLQJ�LV�GHVWUXFWLYH�WHVWLQJ�,W�LV�LQWHQVH��GHWDLOHG�ZRUN�WKDW�EXUQV�RXW�WHDP�PHPEHUV�LI�IUHTXHQW�UR�WDWLRQ�RI� WKH� HYDOXDWRUV� LV�QRW�SUDFWLFHG��([SHULHQFH� VKRZV� WKH� SURGXF�WLYLW\� RI� WKH� WHVW� WHDP� IDOOV� RII� DIWHU� DERXW� VL[� PRQWKV�� 7KHUHIRUH�� DSHQHWUDWLRQ�WHVW�E\� IRXU�SHRSOH� IRU�QR�PRUH�WKDQ�VL[�PRQWKV�³����SHU�VRQ�PRQWKV�³�LV�RSWLPDO��7KH�WHVW�WHDP�PXVW�LQFOXGH�SHRSOH�NQRZOHGJH�DEOH�LQ�WKH�WDUJHW�V\VWHP��ZLWK�VHFXULW\�DQG�SHQHWUDWLRQ�WHVWLQJ�H[SHUWLVH�0XFK�WLPH�LV�VSHQW�SHUXVLQJ�WKH�VHFXULW\�HYLGHQFH��+RZHYHU��WKHUH�PXVWEH�OLEHUDO�DFFHVV�WR�WKH�WDUJHW�V\VWHP�WR�SUHSDUH�DQG�UXQ�OLYH�WHVWV��7KHWHDP� QHHGV� DFFHVV� WR� DOO� WKH� 7&%� FUHDWLRQ� WRROV� ³� FRPSLOHUV�� HGLWRUV�FRQILJXUDWLRQ�PDQDJHPHQW� V\VWHP�� ZRUG� SURFHVVRUV�³� DQG� D� GDWDEDVHPDQDJHPHQW�V\VWHP�WR�LQYHQWRU\�WKHLU�GDWDEDVH�RI�SRWHQWLDO�IODZV�DQG�WRVWRUH�WKHLU�DVVHVVPHQWV�RI�WKH�IODZV�

)ODZ�K\SRWKHVLV�PHWKRGRORJ\��)+0��RYHUYLHZ

&20386(&·V� �FRPSXWHU� VHFXULW\·V�� UDLVRQ�G·rWUH� LV� WR� DXWRPDWH�PDQ\RI� WKH� VHFXULW\� IXQFWLRQV� WUDGLWLRQDOO\� HQIRUFHG� E\� IDOOLEOH� KXPDQ� RYHU�VLJKW��,Q�WKHRU\��D�WUXVWHG�V\VWHP�VKRXOG�SHUIRUP�DV�LWV�VHFXULW\�VSHFLIL�FDWLRQV� GHILQH� DQG� GR� QRWKLQJ� PRUH�� ,Q� SUDFWLFH�� PRVW� V\VWHPV� IDLO� WRSHUIRUP�DV�VSHFLILHG�DQG�RU�GR�PRUH�WKDQ�LV�VSHFLILHG��3HQHWUDWLRQ�DQDO\�VLV�LV�RQH�PHWKRG�RI�GLVFRYHULQJ�WKHVH�GLVFUHSDQFLHV�

(YLGHQFH�LPSOLFDWLRQ�FKDLQ��)RU�KLJK�UDWHG�WUXVWHG�V\VWHPV��WKH�WUXVWHYLGHQFH�PXVW�VKRZ�WKDW�WKHRU\�DQG�SUDFWLFH�DJUHH�³�WKDW�WKH�´HYLGHQFHLPSOLFDWLRQ� FKDLQµ� LV� FRUUHFWO\� VDWLVILHG� DW� HDFK� VWHS�� 7KH� LPSOLFDWLRQFKDLQ�RI�HYLGHQFH�VKRZV�

Page 8: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

�� WKH�RSHUDWLRQ�RI�WKH�WDUJHW�V\VWHP�LV�FRPSOLDQW�ZLWK�KDUGZDUH�DQGVRIWZDUH�GHVLJQ��DQG�KXPDQ�EHKDYLRU�

�� WKRVH�HOHPHQWV�FRPSO\�ZLWK�WKH�´FRUUHFWµ�VSHFLILFDWLRQV��� WKH�VSHFLILFDWLRQV�VDWLVI\�WKH�VHFXULW\�SROLF\�H[FOXVLYHO\��DQG�� WKH�SROLF\�PHHWV�RSHUDWLRQDO�UHTXLUHPHQWV�

7KH�7&6(&�UHTXLUHV�HYLGHQFH�WKDW�HDFK�VWHS�LQ�WKH�LPSOLFDWLRQ�FKDLQ�LVFRUUHFWO\�VDWLVILHG�E\�YDULRXV�WHFKQLTXHV�� LQFOXGLQJ�KXPDQ�IDFLOLW\�PDQ�DJHPHQW� DQG� ORJLQ� SURFHGXUHV�� DXGLW� WUDLOV�� VHFXULW\� RIILFHU� RYHUVLJKW�DXWRPDWLF�PRQLWRULQJ�DQG�DODUPV��FRGH�WR�VSHFLILFDWLRQ�FRUUHVSRQGHQFHV�WHVW�UHVXOWV��SHHU�UHYLHZ��PDWKHPDWLFDO�SURRI��PRGHO�WR�UHDOLW\�FRUUHVSRQ�GHQFH��DQG�RWKHU�PHWKRGV��3HQHWUDWLRQ�DQDO\VLV� LV�D�GLVFLSOLQHG�PHWKRGRI�H[DPLQLQJ�ZHDNQHVVHV�RU�IDLOXUHV�LQ�WKH�LPSOLFDWLRQ�FKDLQ�(VVHQWLDOO\��WKH�PHWKRG�VHHNV�FRXQWHUDUJXPHQWV�WR�WKH�´WUXWKµ�DVVHUWHG

E\� WKH� HYLGHQFH�³� WKDW� LV�� LW� VHHNV� WR� HVWDEOLVK� WKH� HYLGHQFH� LV� IDOVH� RULQFRPSOHWH��$�IODZ�LV�VXFK�D�FRXQWHUDUJXPHQW��$�IODZ�LV�D�GHPRQVWUDWHGXQGRFXPHQWHG�FDSDELOLW\�WKDW�FDQ�EH�H[SORLWHG�WR�YLRODWH�VRPH�DVSHFW�RIWKH�VHFXULW\�SROLF\�7KH� HPSKDVLV� RI� )+0� LV� RQ� ILQGLQJ� WKHVH� IODZV�� ,W� LV� QRW� RQ� EXLOGLQJ

GHPRQVWUDWLRQV� RI� WKHLU� H[SORLWDWLRQ�� WKRXJK� VXFK� H[DPSOHV� PD\� KDYHPHULW� LQ�VRPH�FDVHV��([SORLWDWLRQ�GHPRQVWUDWLRQV�FRQVXPH�YDOXDEOH� UH�VRXUFHV�WKDW�FDQ�EHWWHU�EH�DSSOLHG�WR�IXUWKHU�IODZ�DVVHVVPHQW�RI�WKH�LP�SOLFDWLRQ�FKDLQ�

7KH�LQGXFWLRQ�K\SRWKHVLV��$W�WKH�KHDUW�RI�WKH�7&6(&�LV�PDWKHPDWLFDOLQGXFWLRQ��VRPHWLPHV�FDOOHG�WKH�LQGXFWLRQ�K\SRWKHVLV��,W�LV�WKH�WKHRUHWLFDOEDVLV�RI�7&6(&�VHFXULW\�DQG�DUJXHV�WKDW

�� LI�WKH�7&%�VWDUWV�RSHUDWLRQ�LQ�D�VHFXUH�VWDWH��DQG�� WKH�7&%�FKDQJHV�VWDWH�E\�H[HFXWLRQ�IURP�D�FORVHG�VHW�RI�WUDQVIRUPV

�WKDW�LV��IXQFWLRQV���DQG�� HDFK�WUDQVIRUP�SUHVHUYHV�GHILQHG�VHFXULW\�SURSHUWLHV��� WKHQ��E\�PDWKHPDWLFDO�LQGXFWLRQ��DOO�VWDWHV�RI�WKH�7&%�DUH�VHFXUH�

)LQGLQJ�IODZV�EHJLQV�ZLWK�ILQGLQJ�ZHDNQHVVHV�LQ�LPSOHPHQWDWLRQ�RI�WKLVSURWHFWLRQ� WKHRU\�³�SROLF\��PRGHO�� DUFKLWHFWXUH�� )7/6�'7/6�� FRGH�� DQGRSHUDWLRQ��7KH�HYLGHQFH� LPSOLFDWLRQ� FKDLQ�RI� WKH�SUHYLRXV� VHFWLRQ� IRUPVWKH�EDVLV�RI�WKH�IODZ�VHDUFK�IRU�YLRODWLRQV�RI�WKH�LQGXFWLRQ�K\SRWKHVLV��$VH[DPSOHV�� IDOVH� FOHDUDQFHV� DQG� SHUPLVVLRQV� YRLG� LQLWLDO� FRQGLWLRQV� �UXOH����ERJXV�FRGH� �IRU�H[DPSOH��D�7URMDQ�KRUVH�RU�YLUXV��YLRODWHV� WKH�FORVHGVHW��UXOH�����DQG�D�ODUJH�FRYHUW�FKDQQH�GRHV�QRW�SUHVHUYH�WKH�LQIRUPDWLRQFRQWDLQPHQW�VHFXULW\�SURSHUWLHV�RI�IXQFWLRQV��UXOH����

6WDJHV�RI�WKH�)ODZ�+\SRWKHVLV�0HWKRGRORJ\��)+0���)+0�FRQVLVWV�RIIRXU�VWDJHV�

Page 9: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

�� )ODZ�JHQHUDWLRQ�GHYHORSV�DQ�LQYHQWRU\�RI�VXVSHFWHG�IODZV��� )ODZ�FRQILUPDWLRQ�DVVHVVHV�HDFK� IODZ�K\SRWKHVLV�DV� WUXH�� IDOVH��RU

XQWHVWHG��� )ODZ�JHQHUDOL]DWLRQ�DQDO\]HV�WKH�JHQHUDOLW\�RI�WKH�XQGHUO\LQJ�VHFX�

ULW\�ZHDNQHVV�UHSUHVHQWHG�E\�HDFK�FRQILUPHG�IODZ��� )ODZ� HOLPLQDWLRQ� UHFRPPHQGV� IODZ� UHSDLU� RU� WKH� XVH� RI� H[WHUQDO

FRQWUROV�WR�PDQDJH�ULVNV�DVVRFLDWHG�ZLWK�UHVLGXDO�IODZV�

7KHVH�VWDJHV�DUH�VKRZQ�LQ�)LJXUH���

Figure 1. FHM stages.

)+0�FDQ�EH� OLNHQHG� WR� D� FRPSXWHU� VWUDWHJ\� JDPH�� ,Q� DUWLILFLDO� LQWHOOL�JHQFH��$,��JDPH�VRIWZDUH��WKHUH�LV�D�ERG\�RI�ORJLF�WKDW�JHQHUDWHV�´SODXVL�EOH�PRYHVµ�ZKLFK�REH\�WKH�OHJDO�FRQVWUDLQWV�RI�WKH�JDPH�³�IRU�H[DPSOH��LWHQVXUHV�D� FKHVV�SDZQ�QHYHU�PRYHV�EDFNZDUG�� ,Q� OLNH� IDVKLRQ�� SHQHWUD�WLRQ� WHVWLQJ�QHHGV� IRU� IODZ�JHQHUDWLRQ�D� ´SODXVLEOH� IODZ�JHQHUDWRU�µ�)ODZILQGLQJ�EHJLQV�ZLWK�WKH�HYLGHQFH�LPSOLFDWLRQ�FKDLQ��RXU�H[SHULHQFH�RI�VH�

Page 10: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

FXULW\�IDLOXUHV�LQ�WKH�UHDVRQLQJ�FKDLQ�LQ�RWKHU�V\VWHPV��DQG�WKHLU�SRWHQ�WLDO�IRU�H[LVWHQFH�LQ�WKH�WDUJHW�V\VWHP��7KH�VHFXULW\�HYLGHQFH�IRU�WKH�WDUJHWV\VWHP�LV�WKH�SULQFLSDO�VRXUFH�IRU�JHQHUDWLQJ�QHZ�IODZ�K\SRWKHVHV�&RQWLQXLQJ�RXU�$,�JDPH�DQDORJ\��WKHUH�LV�D�ERG\�RI�KHXULVWLF�UXOHV�WKH

JDPH�XVHV�WR�GLVWLQJXLVK�JRRG�SODXVLEOH�PRYHV�IURP�SRRU�RQHV��/LNHZLVH�LQ�SHQHWUDWLRQ� WHVWLQJ� IODZ� FRQILUPDWLRQ�� WKHUH� LV� KXPDQ� MXGJPHQW�³�D´FHUHEUDO�ILOWHUµ�³�WKDW�HYDOXDWHV�DQG�UDWHV�HDFK�SURVSHFWLYH�IODZ�LQ�WHUPVRI� LWV�H[LVWHQFH�DQG�KRZ�VLJQLILFDQWO\� LW� YLRODWHV� WKH� VHFXULW\�SROLF\��)LO�WHULQJ� IODZV� IRU� FRQILUPDWLRQ� LQYROYHV� GHVN� FKHFNLQJ� RI� FRGH�� VSHFLILFD�WLRQV��DQG�GRFXPHQWDWLRQ�HYLGHQFH��DV�ZHOO�DV�OLYH�WHVWLQJ�7KH�IODZ�JHQHUDOL]DWLRQ�VWDJH�RI�SHQHWUDWLRQ�WHVWLQJ�JLYHV�DQ�DVVHVVPHQW

RI� RXU� UHVXOWV� LQ� SURJUHVV�� WKH� JDPH� DQDORJ\� RI� ´ZLQQLQJµ� RU� LPSURYLQJJDPH� SRVLWLRQ�� )ODZ� JHQHUDOL]DWLRQ� DVVHVVHV� FRQILUPHG� IODZV�� VHHNLQJUHDVRQV� ZK\� WKH\� H[LVW�� )RU� H[DPSOH�� LQ� WKH� SHQHWUDWLRQ� WHVWLQJ� RI� 2696�� >/,1'��@��D�VLPSOH�FRGLQJ�HUURU�ZDV� WUDFHG� WR�D� OLEUDU\�PDFUR�DQGPXOWLSOH�LQVWDQWLDWLRQV�RI�WKH�IODZ�LQ�WKH�FRGH��,QGXFWLYH�UHDVRQLQJ�RQ�WKHFDXVH�RI�FRQILUPHG�IODZV�FDQ�OHDG�WR�QHZ�IODZV��JHQHUDWRUV�IRU�VWLOO�PRUHZHDNQHVVHV�7KH�IODZ�HOLPLQDWLRQ�VWDJH�FRQVLGHUV�UHVXOWV�RI�WKH�JHQHUDOL]DWLRQ�VWDJH

DQG�UHFRPPHQGV�ZD\V� WR� UHSDLU� IODZV�� ,PSOHPHQWDWLRQ� IODZV�DUH�JHQHU�DOO\�HDVLHU�WR�UHSDLU�WKDQ�GHVLJQ�IODZV��6RPH�IODZV�PD\�QRW�EH�SUDFWLFDO�WRUHSDLU�� VORZ� FRYHUW� WLPLQJ� FKDQQHO� IODZV�PD\�EH� WROHUDEOH�� IRU� H[DPSOH�7KHVH�IODZV�UHPDLQ�LQ�WKH�V\VWHP�DV�UHVLGXDO�IODZV�DQG�SODFH�WKH�RSHUD�WLRQDO� HQYLURQPHQW� DW� ULVN�� +RZHYHU�� H[WHUQDO� FRXQWHUPHDVXUHV� FDQ� EHUHFRPPHQGHG� WR� WKH� DSSURYLQJ� DXWKRULW\� IRU� PDQDJLQJ� WKHVH� ULVNV�� E\ORZHULQJ�WKH�7&6(&�5LVN�,QGH[�>&6&��@��IRU�H[DPSOH�

)ODZ�JHQHUDWLRQ

)ODZ�JHQHUDWLRQ�EHJLQV�ZLWK�D�SHULRG�RI�VWXG\�RI�WKH�HYLGHQFH�WR�SURYLGHD�EDVLV�IRU�FRPPRQ�XQGHUVWDQGLQJ�RI�WKH�REMHFW�V\VWHP��(DUO\�LQ�WKH�HI�IRUW� WKHUH� LV� DQ� LQWHQVLYH� ´DWWDFN�WKH�V\VWHPµ� VHVVLRQ� RI� WHDP� EUDLQ�VWRUPLQJ�� 7DUJHW� V\VWHP� H[SHUWLVH� PXVW� EH� UHSUHVHQWHG� LQ� WKH� DWWDFNVHVVLRQV��(DFK�DVSHFW�RI�WKH�V\VWHP�GHVLJQ�LV�UHYLHZHG�LQ�VXIILFLHQW�GHSWKGXULQJ�WKH�VHVVLRQ� IRU�D�UHDVRQDEOH�PRGHO�RI� WKH�V\VWHP�DQG�SURWHFWLRQPHFKDQLVPV� WR� EH� XQGHUVWRRG� DQG� FKDOOHQJHG�� 7KH� YHQGRU·V� HYDOXDWLRQHYLGHQFH� LV� DYDLODEOH� IRU� LQ�GHSWK� UHIHUHQFH� E\� WKH� WHDP�� )ODZV� DUH� K\�SRWKHVL]HG�GXULQJ� WKHVH� UHYLHZV�� &ULWLFDO� VHFXULW\� GHVLJQ� FRQVLGHUDWLRQVDUH� WKH� EDVLV� IRU� WKH� SHQHWUDWLRQ� WHDP·V� SURELQJ� RI� WKH� WDUJHW� V\VWHP·VGHIHQVHV��7KHVH�GHVLJQ� FRQVLGHUDWLRQV�EHFRPH� WKH� ´SODXVLEOH�PRYH� JHQ�HUDWRUVµ�RI�WKH�IODZ�JHQHUDWLRQ�SKDVH��7KH�PRVW�SURGXFWLYH�´WRS���µ�JHQ�HUDWRUV�DUH�WKH�IROORZLQJ�

���� 3DVW�H[SHULHQFH�ZLWK�IODZV�LQ�RWKHU�VLPLODU�V\VWHPV����� $PELJXRXV��XQFOHDU�DUFKLWHFWXUH�DQG�GHVLJQ�

Page 11: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

���� &LUFXPYHQWLRQ�E\SDVV�RI�´RPQLVFLHQWµ�VHFXULW\�FRQWUROV����� ,QFRPSOHWH�GHVLJQ�RI�LQWHUIDFHV�DQG�LPSOLFLW�VKDULQJ����� 'HYLDWLRQV�IURP�WKH�SURWHFWLRQ�SROLF\�DQG�PRGHO����� 'HYLDWLRQV�IURP�LQLWLDO�FRQGLWLRQV�DQG�DVVXPSWLRQV����� 6\VWHP�DQRPDOLHV�DQG�VSHFLDO�SUHFDXWLRQV����� 2SHUDWLRQDO�SUDFWLFHV��SURKLELWLRQV��DQG�VSRRIV����� 'HYHORSPHQW�HQYLURQPHQW��SUDFWLFHV��DQG�SURKLELWLRQV���� ,PSOHPHQWDWLRQ�HUURUV�

(DFK�FDQGLGDWH� IODZ� LV�GRFXPHQWHG�RQ�D� IODZ�K\SRWKHVLV�VKHHW� �)+6��ZKLFK�FRQWDLQV�D�GHVFULSWLRQ�RI�WKH�IODZ�VSHFXODWLRQ��7KH�WRWDO�VHW�RI�)+6EHFRPHV� WKH� IODZ�GDWDEDVH� WKDW� JXLGHV� DQG� GRFXPHQWV� WKH� SHQHWUDWLRQDQDO\VLV�

3DVW� H[SHULHQFH�� 7KH� OLWHUDWXUH� LV� ILOOHG� ZLWK� H[DPSOHV� RI� VXFFHVVIXOSHQHWUDWLRQ� DWWDFNV� RQ� FRPSXWHU� V\VWHPV� >$%%2���� $77$���� %(/$���%,6%����%,6+����*$/,����*$/,����*$5)����.$5*����0&3+����3$5.���6'&��@�� 7KHUH� LV� DOVR� D� ERG\� RI� SHQHWUDWLRQ� H[SHULHQFH� WKDW� LV� YHQGRUSURSULHWDU\� RU� FODVVLILHG� >%8//���� /,1'��D�� 3+,/���� 6'&��@�� $OWKRXJKJHQHUDO�DFFHVV�WR�WKLV�SDVW�H[SHULHQFH�LV�RIWHQ�UHVWULFWHG��VXFK�H[SHULHQFHLV�DPRQJ�WKH�EHVW�VWDUWLQJ�SRLQWV�IRU�IODZ�JHQHUDWLRQ�

8QFOHDU�GHVLJQ��7KH�GHVLJQ�PXVW�FOHDUO\�GHILQH�WKH�VHFXULW\�SHULPHWHURI�WKH�7&%��+RZ�DUH�ERXQGDU\�FURVVLQJV�PHGLDWHG"�:KHUH�DUH�WKH�VHFX�ULW\�DWWULEXWHV�³�SHUPLVVLRQV��FODVVLILFDWLRQV��,'V��ODEHOV��NH\V��DQG�VR�RQ³�REWDLQHG��VWRUHG��SURWHFWHG��DFFHVVHG��DQG�XSGDWHG"�:KDW�LV�WKH�GLYL�VLRQ� RI� ODERU� DPRQJ� KDUGZDUH�� VRIWZDUH�� DQG� KXPDQ� HOHPHQWV� RI� WKH7&%"�$QG�KRZ�DUH�DOO� WKH�P\ULDG� RWKHU� VHFXUH� GHVLJQ� LVVXHV� GHVFULEHG>*$66��@"� ,I� WKH� VHFXUH�GHVLJQ� FDQQRW�EH� FOHDUO\� GHVFULEHG�� LW� SUREDEO\KDV�KROHV��7KH�WHDP�ZLOO�UDSLGO\�DUULYH�DW�FRQVHQVXV�E\�WKHLU�SURELQJ�DQGXQFRYHU�QXPHURXV�IODZV�DQG�DUHDV�IRU�LQ�GHSWK�H[DPLQDWLRQ��SDUWLFXODUO\ZHDNQHVVHV�LQ�WKH�HYLGHQFH�LPSOLFDWLRQ�FKDLQ�

&LUFXPYHQW�FRQWURO��:KDW�FRPHV�WR�PLQG�LV�$WODV�GRZQ�RQ�RQH�NQHHKROGLQJ�XS�WKH�ZRUOG��7KH�DQWKURSRPRUSKLF�YLHZ�RI�7&%�GHVLJQ�JLYHV�WKHQXPHURXV�SURWHFWLRQ�FRQWURO�VWUXFWXUHV�RPQLVFLHQFH� LQ� WKHLU�FULWLFDO�$W�ODQWHDQ�UROH�RI�VXSSRUWLQJ�WKH�VHFXUH�GHVLJQ��,I�VXFK�FRQWURO�FDQ�EH�FLU�FXPYHQWHG�� WKH� VHFXULW\� FDQ� EH� EUHDFKHG�� 7KH� VHFXULW\� DUFKLWHFWXUHHYLGHQFH� PXVW� VKRZ� QRQFLUFXPYHQWLRQ� RU� E\SDVV� RI� VHFXULW\� FRQWUROV�7KH�DWWDFN�VHVVLRQV�ZLOO�UDSLGO\�LGHQWLI\�WKHVH�RPQLVFLHQW�REMHFWV��EH�WKH\SDVVZRUG� FKHFNHUV�� ODEHO� FKHFNHUV�� ,�2� GULYHUV�� RU� PHPRU\� PDSV�� $PHWKRG�RI�GHWHUPLQLQJ�WKHLU�YXOQHUDELOLW\�WR�DWWDFN�LV�WR�EXLOG�D�´GHSHQG�HQF\�JUDSKµ�RI�VXERUGLQDWH�FRQWURO�REMHFWV�RQ�ZKLFK�WKH�RPQLVFLHQW�RQHVGHSHQG��(DFK�QRGH�LQ�WKH�JUDSK�LV�H[DPLQHG�WR�XQGHUVWDQG�LWV�SURWHFWLRQVWUXFWXUH�DQG�YXOQHUDELOLW\�WR�EHLQJ�FLUFXPYHQWHG��VSRRIHG��GLVDEOHG��OLHG

Page 12: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

WR��RU�PRGLILHG�� ,I� WKH�VHFXULW\�GHVLJQ� LV�ZHDN�RU� IODZHG�� FRQWURO� FDQ�EHE\SDVVHG��7KH�SHQHWUDWLRQ�WHVWLQJ�RI�26�96��5��>6'&��@�JLYHV�D�GHWDLOHGH[DPSOH�RI�WKH�XVH�RI�GHSHQGHQF\�JUDSKV�WR�GHWHUPLQH�WKH�YXOQHUDELOLW\RI� 96�� WR� XQDXWKRUL]HG� DFFHVV� WR� MRE� GDWD� VHWV�� YLUWXDO� PHPRU\�� DQGSDVVZRUG�SURWHFWLRQ�FRQWURO�REMHFWV�

,QFRPSOHWH� LQWHUIDFH� GHVLJQ�� ,QWHUIDFHV� DUH� ULIH� ZLWK� IODZ� SRWHQWLDO�:KHUH�WZR�GLIIHUHQW�HOHPHQWV�RI�WKH�DUFKLWHFWXUH�LQWHUIDFH��WKHUH�LV�D�SR�WHQWLDO�IRU�LQFRPSOHWH�GHVLJQ��7KLV�LV�RIWHQ�WKH�FDVH�EHFDXVH�KXPDQ�ZRUNDVVLJQPHQWV� VHOGRP� JLYH� DQ\RQH� UHVSRQVLELOLW\� IRU� GHVLJQLQJ� WKH� LQWHU�IDFH��$OWKRXJK�PRGHUQ�PHWKRGRORJLHV� IRU�V\VWHP�GHVLJQ�VWUHVV� LQWHUIDFHFRQWURO�GRFXPHQWV� �,&'���WKHVH�WHQG�WR�EH� IRU� LQWHUIDFHV�DPRQJ� OLNH�HOH�PHQWV� ³� IRU� H[DPSOH�� KDUGZDUH�KDUGZDUH� LQWHUIDFHV� DQG� VRIWZDUH�VRIWZDUH�SURWRFROV��7KH�GLVFLSOLQH� IRU�VSHFLI\LQJ� LQWHUIDFHV�DPRQJ�XQOLNHHOHPHQWV� LV� OHVV� ZHOO� HVWDEOLVKHG�� +DUGZDUH�VRIWZDUH�� VRIWZDUH�KXPDQ�KXPDQ�KDUGZDUH�� KDUGZDUH�SHULSKHUDO�� DQG� RSHUDWLQJ� V\VWHP�DSSOLFDWLRQ� LQWHUIDFHV� FDQ� KDYH� LQFRPSOHWH� FDVH� DQDO\VHV�� )RU� H[DPSOH�WKH�XVHU�RSHUDWRU� LQWHUIDFH� WR� WKH�7&%�PXVW�GHDO�ZLWK�DOO� WKH� FRPELQD�WLRQV�RI�KXPDQ�FRPPDQGV�DQG�GDWD�YDOXHV�WR�DYRLG�RSHUDWRU�VSRRILQJ�E\DQ� XQDXWKRUL]HG� XVHU� UHTXHVW�� 2SHUDWLQJ� SURFHGXUHV�PD\� EH� KDUGZDUHFRQILJXUDWLRQ�GHSHQGHQW��)RU�H[DPSOH��ERRWLQJ�WKH�V\VWHP�IURP�WKH�VWDQ�GDUG� GULYH� PD\� FKDQJH� LI� WKH� FRQILJXUDWLRQ� RI� WKH� VWDQGDUG� GULYH� LVFKDQJHG�� $OO� WKH� YDULRXV� HUURU� VWDWHV� RI� WKHVH� LQWHUIDFHV� PD\� QRW� KDYHEHHQ�FRQVLGHUHG�,PSOLFLW� VKDULQJ� LV� QRZ�D� FODVVLFDO� VRXUFH� RI� LQFRPSOHWH� GHVLJQ� IODZV�

6KDULQJ�IODZV�XVXDOO\�PDQLIHVW�WKHPVHOYHV�DV�IODZV�LQ�VKDUHG�PHPRU\�RUVKDUHG� YDULDEOHV� EHWZHHQ� WKH� 7&%� DQG� WKH� XVHU� SURFHVVHV� GXULQJ� SD�UDPHWHU�SDVVLQJ��VWDWH�YDULDEOHV�FRQWH[W�VWRUDJH��VHWWLQJ�VWDWXV�YDULDEOHV�UHDGLQJ�DQG�ZULWLQJ�VHPDSKRUHV��DFFHVVLQJ�EXIIHUV��FRQWUROOLQJ�SHULSKHUDOGHYLFHV��DQG�JOREDO�V\VWHP�GDWD�DFFHVV�³� IRU�H[DPSOH��FORFN��GDWH��DQGSXEOLF�DQQRXQFHPHQWV��&DUHIXO�GHVLJQ�RI� WKHVH� LQWHUIDFHV� LV� UHTXLUHG� WRUHPRYH�V\VWHP�GDWD�IURP�XVHU�PHPRU\�

3ROLF\�DQG�PRGHO�GHYLDWLRQV�� )RU�%�� DQG� KLJKHU� HYDOXDWLRQ� FODVVHV�WKH� VHFXULW\� HYLGHQFH� LQFOXGHV� D� IRUPDO� VHFXULW\� SROLF\� DQG� D�PRGHO� RIKRZ�WKH�WDUJHW�V\VWHP�PHHWV�WKH�SROLF\��6XEMHFWV�DQG�REMHFWV�DUH�GHILQHG�7KH�UXOHV�RI�DFFHVV�DUH�VSHFLILHG��)RU�ORZHU�HYDOXDWLRQ�FODVVHV��WKH�SROLF\DQG� PRGHO� DUH� OHVV� ZHOO� VWDWHG� DQG�� LQ� WKH� HDUO\� \HDUV� RI� SHQHWUDWLRQWHVWLQJ�� UHTXLUHG� WKH� SHQHWUDWLRQ� WHDP� WR� FRQVWUXFW� RU� GHILQH� WKH� SROLF\DQG�PRGHO� GXULQJ� WKH� DWWDFN� VHVVLRQV�� +RZHYHU�� SHQHWUDWLRQ� WHVWLQJ� LVQRW�UHTXLUHG�IRU�WKHVH�FODVVHV�WRGD\�&RQVLGHU� WKH�DGHTXDF\�RI� WKH�SROLF\�DQG�WKH�PRGHO� IRU� WKH� WDUJHW�V\V�

WHP�� ,V� WKH�PRGHO�FRPSOHWH"� ,V� WKH�SROLF\�FRUUHFW"�$UH� WKHUH�SROLFLHV� IRUPDQGDWRU\�DQG�GLVFUHWLRQDU\�DFFHVV� FRQWURO� �0$&�DQG�'$&��� LGHQWLILFD�WLRQ�DQG�DXWKHQWLFDWLRQ��,$���DXGLW�� WUXVWHG�SDWK��DQG�FRPPXQLFDWLRQV

Page 13: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

VHFXULW\"�([DPLQH�WKH�VHFXULW\�DUFKLWHFWXUH�DQG�WKH�7&%�GHVLJQ�WR�VHH�LIWKHUH� DUH� GHYLDWLRQV� IURP� WKH� VWDWHG� SROLF\� RU�PRGHO�� )RU� H[DPSOH�� DUHWKHUH�XVHU�YLVLEOH�REMHFWV�WKDW�DUH�QRW�GHILQHG�LQ�WKH�PRGHO��VXFK�DV�EXII�HUV�DQG�TXHXHV"�2PQLVFLHQW�FRQWURO�REMHFWV��DV�GHVFULEHG� LQ� WKH� HDUOLHUVHFWLRQ�´&LUFXPYHQW�FRQWURO�µ�VKRXOG�FHUWDLQO\�EH�UHSUHVHQWHG��$UH�WKHUHGHYLDWLRQV� LQ� WKH� LPSOHPHQWDWLRQ�RI� WKH�SROLF\�DQG�PRGHO"� 7KLV� FRQVLG�HUDWLRQ� UHFHLYHV� JUHDWHU� HPSKDVLV� GXULQJ� IODZ� FRQILUPDWLRQ�� KRZHYHU�WKHUH�PD\�EH�UHDVRQV�WR�JHQHUDWH�LPSOHPHQWDWLRQ�IODZV�DW�WKLV�WLPH�

,QLWLDO�FRQGLWLRQV��$VVXPSWLRQV�DERXQG� LQ� VHFXUH� V\VWHP�GHVLJQ�EXWDUH� QRW� GRFXPHQWHG� ZHOO�� H[FHSW� LQ� HYDOXDWLRQ� FODVV� $��� ZKHUH� IRUPDOVSHFLILFDWLRQV� UHTXLUH� HQWU\� DQG� H[LW� DVVHUWLRQV� WR� FRQGLWLRQ� WKH� VWDWH�PDFKLQH� WUDQVIRUPV�� )RU� DOO� RWKHU� HYDOXDWLRQ� FODVVHV� WKH� DVVXPSWLRQVDQG�LQLWLDO�FRQGLWLRQV�DUH�RIWHQ�EXULHG�LQ�WKLFN�GHVLJQ�GRFXPHQWDWLRQ�� LIWKH\�DUH�GRFXPHQWHG�DW�DOO��,I�WKHVH�DVVXPSWLRQV�FDQ�EH�PDGH�LQYDOLG�E\WKH�XVHU��RU�LI�LQ�WKH�LPSOHPHQWDWLRQ�UHDOLW\�WKH�LQLWLDO�FRQGLWLRQV�DUH�GLI�IHUHQW�IURP�WKH�GHVLJQ�DVVXPSWLRQV��WKH�SROLF\�DQG�PRGHO�PD\�EH�LQYDOLGDQG�GHVLJQ�IODZV�VKRXOG�H[LVW��7KH�LQGXFWLRQ�K\SRWKHVLV�SUHVHQWHG�HDUOLHUEHJLQV�ZLWK�´VWDUWV�RSHUDWLRQ�LQ�D�VHFXUH�VWDWH�µ� ,QLWLDO�FRQGLWLRQV�GHWHU�PLQH� WKH�VWDUWLQJ� VHFXUH� VWDWH�� ,I� WKH�DFWXDO� LQLWLDO� FRQGLWLRQV�DUH� RWKHUWKDQ�DV�DVVXPHG�LQ�WKH�GHVLJQ��DWWDFNV�ZLOO�VXFFHHG�7KH�ZKROH�UDQJH�RI�VHFXULW\�SURILOHV�DQG�DGPLQLVWUDWLYH�VHFXULW\�GDWD�RQ

XVHU� ,'V�� FOHDUDQFHV�� SDVVZRUGV�� DQG� SHUPLVVLRQV� �0$&� DQG� '$&�� GH�ILQHV�WKH�´FXUUHQW�DFFHVVµ�DQG�´DFFHVV�PDWUL[µ�RI�WKH�%HOO�/D3DGXOD�SROLF\PRGHO� >%(//��@��7KHVH�GDWD�DUH� LQLWLDO� FRQGLWLRQV��7KHLU� FRUUHFW� LQLWLDOL�]DWLRQ�LV�D�WHVWDEOH�K\SRWKHVLV��2WKHU�DVVXPSWLRQV�DQG�LQLWLDO�FRQGLWLRQVQHHG�WR�EH�HVWDEOLVKHG�DQG�WHVWHG�E\�SHQHWUDWLRQ�DQDO\VLV��LQFOXGLQJ�WKHFRPSXWHU� KDUGZDUH� FRQILJXUDWLRQ�� VRIWZDUH� FRQILJXUDWLRQ�� IDFLOLW\� RSHU�DWLQJ�PRGH��SHULRGV�SURFHVVLQJ��FRPSDUWPHQWHG��V\VWHP�KLJK��0/6���RS�HUDWRU� UROHV�� XVHU� ,$� SDUDPHWHUV�� VXEMHFW�REMHFW� VHQVLWLYLW\� ODEHOV�V\VWHP�VHFXULW\�UDQJH��'$&�SHUPLVVLRQV��DXGLW�IRUPDWV��V\VWHP�UHDGLQHVVVWDWXV��DQG�PRUH�

6\VWHP� DQRPDOLHV�� (YHU\� V\VWHP� LV� GLIIHUHQW�� 'LIIHUHQFHV� WKDW� PD\KDYH� VHFXULW\� UDPLILFDWLRQV�DUH� RI� SDUWLFXODU� LQWHUHVW�� 7KH� ,%0�3URJUDP6WDWXV�:RUG� �36:�� LPSOHPHQWV� VWDWXV� FRGHV� IRU� WHVWLQJ� E\� FRQGLWLRQDOLQVWUXFWLRQV�� XQOLNH� WKH� 8QLYDF� ������ ZKLFK� KDV� GLUHFW� FRQGLWLRQDOEUDQFKLQJ� LQVWUXFWLRQV�� 7KH� ,%0� DSSURDFK� DOORZV� FRQGLWLRQDO� LQVWUXF�WLRQV�WR�EHKDYH�DV�QRQFRQGLWLRQDO�LQVWUXFWLRQV�LI�WKH�SURJUDPPHU�DYRLGVFKHFNLQJ�WKH�36:�>6'&��@��7KDW�LV�DQ�DQRPDO\��7KH�%XUURXJKV�%����������FRPSXWHU�VHULHV�FRPSLOHU�VRIWZDUH�KDV�SULYLOHJH�WR�VHW�KDUGZDUH�WDJELWV�WKDW�GHILQH�´FDSDELOLWLHV�µ�PDQ\�RI�ZKLFK�DUH�VHFXULW\�VHQVLWLYH��VXFKDV�ZULWH�SHUPLVVLRQ��7KH�0DVWHU�&RQWURO�3URJUDP� �0&3�� FKHFNV� WKH� WDJELW� IRU�SHUPLVVLRQ�YDOLGLW\��8VHU�FRGH�GRHV�QRW�KDYH� WKLV�SULYLOHJH��&RGHLPSRUWV�FDQ�FLUFXPYHQW�VXFK�FKHFNV�>:,/.��@��7KDW�LV�DQ�DQRPDO\��7KH

Page 14: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

,%0�����,�2�FKDQQHO�SURJUDPV�DUH�XVHU�SURJUDPV�WKDW�FDQ�DFFHVV�UHDOPHPRU\�YLD� WKH� ´9LUWXDO� �5HDOµ�FRPPDQG�ZLWKRXW�D�KDUGZDUH�PHPRU\SURWHFW�IDXOW�>%(/$��@��7KDW·V�DQ�DQRPDO\��1HDUO\�HYHU\�VRIWZDUH�SURGXFWKDV�FOHDUO\�VWDWHG�OLPLWV�DQG�SURKLELWLRQV�RQ�XVH�RI�LWV�IHDWXUHV��EXW�IHZGHILQH�ZKDW� RFFXUV� LI� D� SURKLELWLRQ� LV� LJQRUHG��:KDW� KDSSHQV�ZKHQ� DQLGHQWLILHU� JUHDWHU� WKDQ� HLJKW� FKDUDFWHUV� LV� XVHG"� ,V� WKH� LGHQWLILHU� WUXQ�FDWHG�IURP�WKH�OHIW��ULJKW��RU�PLGGOH��RU�LV�LW�MXVW�LJQRUHG"�$QRPDORXV�EH�KDYLRU� PD\� QRW� EH� VHFXULW\�SUHVHUYLQJ� IXQFWLRQDOLW\� SHU� WKH� LQGXFWLRQK\SRWKHVLV�WKHRU\��7KLV�EHKDYLRU�FDQ�EH�H[SORLWHG�

2SHUDWLRQDO� SUDFWLFHV�� 7KH� FRPSOHWH� V\VWHP� FRPHV� WRJHWKHU� GXULQJRSHUDWLRQ��ZKHQ�PDQ\�IODZV�UHYHDO�WKHPVHOYHV��2I�SDUWLFXODU�LQWHUHVW�DUHWKH�PDQ�PDFKLQH�UHODWLRQVKLS��WKH�FRQILJXUDWLRQ�DVVXPSWLRQV��DQG�HUURUUHFRYHU\��$�ZHOO�GHVLJQHG�7&%�ZLOO�KDYH�WKH�V\VWHP�ERRW�SURFHVV�SURJUHVVLQ�VWDJHV�RI�LQFUHDVLQJ�RSHUDWLQJ�V\VWHP�FDSDELOLW\��(DFK�VWDJH�ZLOO�FKHFNLWVHOI�WR�HQVXUH�LW�EHJLQV�DQG�HQGV�LQ�D�VHFXUH�VWDWH�� ,I� WKHUH� LV�QHHG�IRUKXPDQ� LQWHUYHQWLRQ� WR� ORDG� VHFXULW\� SDUDPHWHUV�� WKH� KXPDQ� PXVW� EHLGHQWLILHG�� DXWKHQWLFDWHG�� DQG� DXWKRUL]HG� IRU� NQRZQ� DFWLRQV�� 7KH� SHQH�WUDWRU� PXVW� VHH� LI� WKH� ERRW� SURFHVV� SURJUHVVHV� FRUUHFWO\�� )RU� H[DPSOH�KRZ�LV�WKH�VHFXULW\�RIILFHU�DGPLQLVWUDWRU�DXWKHQWLFDWHG"�,I�YLD�SDVVZRUGV�KRZ�GLG�WKH\�JHW�ORDGHG�RU�EXLOW�LQWR�WKH�LQLWLDO�ERRW�ORDG"�:KHUH�GRHV�WKHRSHUDWRU�REWDLQ�WKH�PDVWHU�ERRW�ORDG"�)URP�D�WDSH�RU�GLVN�OLEUDU\"�,V�WKHSK\VLFDO� PHGLD� SURWHFWHG� IURP� XQDXWKRUL]HG� DFFHVV�� SURGXFW� VXEVWLWX�WLRQ�� RU� ODEHO� VZLWFKLQJ"� ,I� WKH� VHFXULW\� RIILFHU� ORDGV� RU� HQWHUV� RQ�OLQHSHUPLVVLRQV�WR�LQLWLDOL]H�WKH�VHFXULW\�SDUDPHWHUV�RI�WKH�V\VWHP��KRZ�GRHVWKH�VHFXULW\�RIILFHU�DXWKHQWLFDWH�WKH�GDWD"�,I�XVHUV�VHQG�RSHUDWRU�UHTXHVWVWR�PRXQW�WDSHV�RU�GLVNV��SULQW�ILOHV��RU�H[HFXWH�D�P\ULDG�RI�RWKHU�VHFXULW\�VHQVLWLYH�DFWLRQV��KRZ�GRHV�WKH�7&%�SURWHFW�WKH�RSHUDWRU� IURP�VSRRIV� WRWDNH�XQDXWKRUL]HG�DFWLRQ"�,I�WKH�V\VWHP�FUDVKHV��GRHV�WKH�V\VWHP�UHERRWIROORZ�D�SURFHVV�VLPLODU�WR�WKH�LQLWLDO�´FROGµ�ERRW"�,I�WKHUH�LV�D�´ZDUPµ�ERRWPRGH�³�D� VKRUWFXW�ERRW� WKDW� VDOYDJHV�SDUW� RI� WKH� V\VWHP�VWDWH�³�GRHVWKH�VHFXULW\�RIILFHU�KDYH�D�UROH�LQ�WKH�ERRW�WR�HQVXUH�WKH�V\VWHP�EHJLQV�LQD�VHFXUH�VWDWH"�+RZ�LV�WKH�DVVXUDQFH�GHWHUPLQHG"$�FRPPRQ� LQLWLDOL]DWLRQ� IODZ�RFFXUV�ZKHQ� WKH�V\VWHP� LV�VKLSSHG� IURP

WKH�YHQGRU�ZLWK�WKH�´WUDLQLQJ�ZKHHOVµ�VWLOO�RQ�>672/��@��7KLV�FODVV�RI�IODZKDV� EHHQ� NQRZQ� WR� LQFOXGH� WUDLQLQJ� ILOHV� WKDW� SURYLGH� ,'�SDVVZRUGDXWKRUL]DWLRQV� WR� XVHUV� VR� WKH\�PD\� WUDLQ� IRU� MREV� DV� VHFXULW\� RIILFHUV�V\VWHP� DGPLQLVWUDWRUV�� GDWDEDVH� FRQWUROOHUV�� DQG� V\VWHP� RSHUDWRUV�7KHVH�ILOHV�ZHUH�QRW�UHPRYHG�E\�JRRG�V\VWHP�RSHUDWLRQDO�SUDFWLFH�SHU�WKH7UXVWHG�)DFLOLW\�0DQXDO��7)0��DQG�FDQ�EH�XVHG�E\�XQDXWKRUL]HG�SDUWLHVWR�FLUFXPYHQW�VHFXULW\�FRQWUROV�

7KH� GHYHORSPHQW� HQYLURQPHQW�� )ODZV� PD\� EH� LQWURGXFHG� E\� EDGSUDFWLFHV�LQ�WKH�VHFXULW\�NHUQHO�7&%�GHYHORSPHQW�HQYLURQPHQW��$�VLPSOHH[DPSOH�LV�WKH�FRQGLWLRQDO�FRPSLODWLRQ��ZKLFK�JHQHUDWHV�VSHFLDO�FRGH�IRU

Page 15: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

GHEXJJLQJ��,I�WKH�UHOHDVHG�FRGH�LV�QRW�UHFRPSLOHG�WR�UHPRYH�WKH�GHEXJJLQJ´KRRNV�µ�WKH�RSHUDWLRQDO�V\VWHP�FRGH�YLRODWHV�WKH�FORVHG�VHW� �UXOH����DQGWKH� VHFXUH� WUDQVIRUP� �UXOH� ��� RI� WKH� LQGXFWLRQ� K\SRWKHVLV�� VLPLODU� WR� DWUDS�GRRU�E\SDVV�RI�VHFXULW\�FRQWUROV�/DUJH� XQWUXVWHG� UHXVH� DQG� UXQWLPH� OLEUDULHV� DUH� SURSHUWLHV� RI� PDQ\

SURJUDPPLQJ�HQYLURQPHQWV��7KH�7&%�PD\�EH�EXLOW�XVLQJ�FRGH� IURP�WKHOLEUDU\�� ZKLFK� ILQGV� LWV� ZD\� LQWR� RSHUDWLRQDO� XVH�� $OO� NLQGV� RI� VHFXULW\IODZV�PD\�REWDLQ�IURP�VXFK�HQYLURQPHQWV�� ,I� WKH� OLEUDULHV�DUH�QRW�VHFX�ULW\�VHQVLWLYH�� WKH\�FDQ�EH�VHDUFKHG� IRU� IODZV�WKDW�DUH�H[SORLWDEOH� LQ� WKHRSHUDWLRQDO�7&%��,I� WKH�SHQHWUDWLRQ�WHDP�FDQ�VXEVWLWXWH� LWV�RZQ�FRGH� LQWKH� OLEUDULHV�� HYHQ� PRUH� VRSKLVWLFDWHG� IODZV� FDQ� EH� FUHDWHG�� 5XQWLPHOLQNHUV� DQG� ORDGHUV� KDYH� VLPLODU� SURSHUWLHV� RI� DSSHQGLQJ� XQHYDOXDWHGFRGH� WR� WKH� WUXVWHG� REMHFW� FRGH� EHLQJ� ORDGHG� WR� HQDEOH� FRGH�RSHUDWLQJV\VWHP� FRPPXQLFDWLRQ�� ,I� DFFHVV� WR� VXFK� WRROV� LV� XQSURWHFWHG�� VLPLODUFRGH�VXEVWLWXWLRQ�DWWDFNV�DUH�SRVVLEOH�$�FODVVLF�ZD\�WR�DWWDFN�DQ�RSHUDWLRQDO�V\VWHP�LV�WR�DWWDFN�LWV�GHYHORS�

PHQW�HQYLURQPHQW��SODQW�ERJXV�FRGH�LQ�WKH�VRXUFH�ILOHV��DQG�ZDLW�IRU�WKHQRUPDO� VRIWZDUH� XSGDWH� PDLQWHQDQFH� SURFHGXUHV� WR� LQVWDOO� \RXU� XQDX�WKRUL]HG�FRGH�LQWR�WKH�RSHUDWLRQDO�V\VWHP�REMHFW�FRGH��,I�WKH�GHYHORSPHQWDQG� RSHUDWLRQDO� V\VWHP� DUH� WKH� VDPH�� WKHQ� WKH� SHQHWUDWLRQ� WHDP�PXVWPRXQW�DQ�DWWDFN�RQ�WKH�GHYHORSPHQW�HQYLURQPHQW� ILUVW��SDUWLFXODUO\� WKHV\VWHP�FRQILJXUDWLRQ�ILOHV��)ODZV�IRXQG�WKHUH�UHODWH�GLUHFWO\�WR�WKH�RSHUD�WLRQDO�V\VWHP�� WKH�VRXUFH� ILOHV�RI�ZKLFK�DUH� WKHQ�DFFHVVLEOH�DQG�PRGLIL�DEOH� E\� WKH� SHQHWUDWRU� ZLWKRXW� DXWKRUL]DWLRQ�� 6XEVWLWXWH� FRQILJXUDWLRQILOHV�JLYH�WKH�SHQHWUDWRU�D�KLJK�SUREDELOLW\�DWWDFN�DQG�HVVHQWLDO�FRQWURO�RIWKH�7&%�

,PSOHPHQWDWLRQ�HUURUV��,Q�DQ\�V\VWHP�EXLOW�E\�KXPDQV��WKHUH�ZLOO�EHHUURUV�RI�RPLVVLRQ�DQG�FRPPLVVLRQ��7KLV�LV�QRW�D�SURPLVLQJ�FODVV�RI�IODZVWR�H[SORUH��DV�WKHUH�LV�QR�ORJLF�WR�WKHP��0DQ\�DUH�MXVW�W\SRV��,PSOHPHQ�WDWLRQ�HUURUV�WKDW�FDQ�EH�DQDO\]HG�DUH�WKRVH�RI�WKH�,)�7+(1�(/6(�FRQGL�WLRQDO� IRUP�� 2IWHQ� D� SURJUDPPHU� IDLOV� WR� GHVLJQ� RU� LPSOHPHQW� DOO� WKHFRQGLWLRQDO� FDVHV�� ,QFRPSOHWH� FDVH� DQDO\VLV�PD\� RFFXU� LI� WKH� FRGH� ORJLFDVVXPHV� VRPH� RI� WKH� SUHGLFDWHV� DUH� SHUIRUPHG� HDUOLHU�� 0RVW� RIWHQ�� LP�SOHPHQWDWLRQ�IODZV�DUH�MXVW�FRGLQJ�HUURUV�2WKHU�DUHDV�IRU� LQYHVWLJDWLRQ�DUH�PDFURV�DQG�RWKHU�FRGH�JHQHUDWRUV�� ,I

WKH�RULJLQDO�PDFUR�LV�FRGHG�LQFRUUHFWO\��WKH�HUURU�FRGH�ZLOO�EH�SURSDJDWHGLQ�PDQ\�GLIIHUHQW�SDUWV�RI�WKH�V\VWHP��6LPLODUO\��LI�GDWD�GHFODUDWLRQV�DUHLQFRUUHFW�� WKH\�ZLOO� DIIHFW� GLIIHUHQW� SDUWV� RI� WKH� FRGH�� ,QFRUUHFW� FRGH� VH�TXHQFHV� VKRXOG� EH� WUDFHG� EDFN� WR� DXWRPDWLF� VRXUFH� FRGH� JHQHUDWRUV� WRVHH�LI�WKH�FRGH�HUURU�DSSHDUV�LQ�PXOWLSOH�SDUWV�RI�WKH�7&%�6RPHWLPHV�WKHUH�DUH�HUURUV�LQ�WKH�GHYHORSPHQW�WRROV�WKDW�JHQHUDWH�EDG

FRGH��)HZ�FRQILJXUDWLRQ�PDQDJHPHQW� WRROV�SURYLGH�D� WUXVWHG� FRGH�SHGL�JUHH�RU�KLVWRU\�RI�DOO�WKH�HGLWRU��FRPSLOHU��DQG�OLQNHU�WRROV�WKDW�WRXFK�WKHFRGH��7KHUHIRUH��DQ�HUURU�LQ�WKHVH�WRROV��ZKLFK�EHFRPHV�NQRZQ�ODWH�LQ�WKH

Page 16: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

GHYHORSPHQW� F\FOH� DQG� LV� IL[HG�� PD\� SHUVLVW� LQ� VRPH� HDUOLHU� JHQHUDWHGPRGXOHV� WKDW� DUH� QRW� UHJHQHUDWHG�� 7KH� SHQHWUDWLRQ� WHDP� PD\� ILQG� LWIUXLWIXO�WR�LQWHUYLHZ�WKH�GHYHORSPHQW�WHDP�IRU�VXFK�FDVHV�

)ODZ�K\SRWKHVLV�VKHHWV��)+0�FDQGLGDWH�IODZV�DUH�GRFXPHQWHG�RQ�IODZK\SRWKHVLV�VKHHWV��)+6���RQH�SDJH��UHFRUG��SHU�IODZ��$Q�)+6�LV�LQWHQGHGWR� EH� FRQFLVH� DQG� HDV\� WR� XVH� WKURXJKRXW� WKH� SHQHWUDWLRQ� WHVWLQJ�� 7KH)+6�FRQWDLQV�VHYHQ�ILHOGV�

�� D�IODZ�QDPH�IRU�LGHQWLILFDWLRQ��� D�EULHI�GHVFULSWLRQ�RI�WKH�IODZ�YXOQHUDELOLW\�VSHFXODWLRQ��� D�ORFDOL]DWLRQ�UHIHUHQFH�RI�WKH�IODZ�WR�D�SDUW�RI�WKH�V\VWHP�RU�PRG�

XOH��� DQ�DVVHVVPHQW�RI�WKH�SUREDELOLW\�RI�WKH�IODZ�EHLQJ�FRQILUPHG��� DQ�HVWLPDWH�RI�WKH�GDPDJH�LPSDFW�RI�WKH�IODZ�RQ�WKH�SURWHFWLRQ�RI

WKH�V\VWHP�LI�FRQILUPHG��� DQ�HVWLPDWH�RI�WKH�HIIRUW�ZRUN�IDFWRU�QHHGHG�WR�FRQILUP�D�IODZ��DQG�� D�GHVFULSWLRQ�RI�WKH�DWWDFN�DQG�UHVXOW�

3UREDELOLWLHV�IRU�ILHOGV�������DQG���DUH�PHDVXUHG�RQ�D�VFDOH�RI�KLJK��+��PHGLXP��0���RU� ORZ� �/���7KH�FRPELQHG�DVVHVVPHQW�RI�++��+0��+/��0+������ //� \LHOGV� DQ� RYHUDOO� VFDOH� RI� QLQH� IRU� UDQNLQJ� )+6�� 7KH� UDQNLQJ� LVYDOXDEOH� LQ� DOORFDWLQJ� UHVRXUFHV� GXULQJ� WKH� IODZ� FRQILUPDWLRQ� SKDVH� RISHQHWUDWLRQ� DQDO\VLV�� 7KH� )+6� GRFXPHQWV� DQ� HVWLPDWH� RI� WKH� ZRUN� UH�TXLUHG� WR� GHPRQVWUDWH� D� IODZ�� +LJK� ZRUN�IDFWRU� IODZV� ³� IRU� H[DPSOH�FUDFNLQJ�HQFU\SWLRQ�FRGHV�³�DUH�JLYHQ�ORZHU�SULRULW\��HYHQ�LI� WKH�IODZ�LVUDQNHG� ++�� $Q� )+6� KDV� D� VHFWLRQ� IRU� GHVFULELQJ� WKH� UHVXOWV� REWDLQHGIURP�WKH�IODZ�FRQILUPDWLRQ�SKDVH��7KH�WRWDO�VHW�RI�)+6�EHFRPHV�WKH�IODZGDWDEDVH�WKDW�JXLGHV�DQG�GRFXPHQWV�WKH�SHQHWUDWLRQ�DQDO\VLV��7KH�)+6FDQ�EH�PHFKDQL]HG�ZLWK�WRRO�VXSSRUW�³�IRU�H[DPSOH��D�ZRUG�SURFHVVRU�RUD�'%06�³�WR�SHUPLW�IOH[LEOH�VRUWV�DQG�VHDUFKHV�EDVHG�RQ�NH\�ILHOGV�RI�DQ)+6�GDWDEDVH�RI�KXQGUHGV�RI�UHFRUGV�

)ODZ�FRQILUPDWLRQ

&RQGXFWLQJ�WKH�DFWXDO�SHQHWUDWLRQ�WHVW�LV�SDUW�RI�WKH�WHVWLQJ�SURFHGXUHGHYHORSHG�LQ�WKH�SODQ��7KH�EXON�RI�WKH�WHVWLQJ�VKRXOG�EH�E\�´*HGDQNHQµH[SHULPHQWV�� WKRXJKW� H[SHULPHQWV�� WKDW� FRQILUP� K\SRWKHVL]HG� IODZV� LQWKH� SURGXFW� E\� H[DPLQDWLRQ� RI� WKH� SURGXFW·V� GRFXPHQWDWLRQ� DQG� FRGH�WKDW�LV��WKH�VHFXULW\�HYLGHQFH��7KHUH�DUH�WKUHH�VWHSV�WR�WKH�IODZ�FRQILUPD�WLRQ� VWDJH�� IODZ� SULRULWL]DWLRQ� DQG� DVVLJQPHQW�� GHVN� FKHFNLQJ�� DQG� OLYHWHVWLQJ�

)ODZ�SULRULWL]DWLRQ�DQG�DVVLJQPHQW��7KH� IODZ�K\SRWKHVLV�VKHHWV�UHS�UHVHQW�D�FRPSUHKHQVLYH�LQYHQWRU\�RI�SRWHQWLDO�IODZV��6RUWHG�E\�WKH�SURE�

Page 17: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

DELOLW\�RI�H[LVWHQFH��SD\RII� �GDPDJH� LPSDFW�� LI�FRQILUPHG���ZRUN� IDFWRU� WRFRQILUP��DQG�DUHD�RI�WKH�V\VWHP�GHVLJQ��WKH\�SURYLGH�D�UDQNLQJ�RI�SRWHQ�WLDO�IODZV�IRU�HDFK�GHVLJQ�DUHD�IURP�KLJK�SUREDELOLW\�KLJK�SD\RII� �++��WRORZ�SUREDELOLW\�ORZ�SD\RII��//���8VXDOO\��RQO\�KLJK�DQG�PHGLXP�UDQNV�DUHVWXGLHG��7HDP�PHPEHUV�GLYLGH�WKH�UDQN�OLVWV�DPRQJ�WKHPVHOYHV�EDVHG�RQH[SHUWLVH� LQ� WKH� GLIIHUHQW� V\VWHP� GHVLJQ� DUHDV�� 7KH\�PRYH� RXW� DV� LQGL�YLGXDOV�RQ� WKHLU� OLVWV��$W�GDLO\� WHDP�PHHWLQJV�� WKH\� VKDUH�RQH�DQRWKHU·VSURJUHVV�DQG�ILQGLQJV��0DQDJHPHQW�PD\�UHDOORFDWH�VWDII�DQG�)+6�WR�EDO�DQFH�WKH�ZRUN�ORDG��2IWHQ�FRQILUPHG�IODZV�UDLVH�WKH�SULRULW\�RI�RWKHU�)+6RU�SURYLGH�WKH�DQDO\VWV�ZLWK�LQVLJKW�WR�JHQHUDWH�QHZ�)+6�

'HVN�FKHFNLQJ��7KH�SHQHWUDWRU�DQDO\VW�VWXGLHV� WKH�)+6�DQG� WKH�7&%HYLGHQFH�� &RGH�� PRGHOV�� FRGH� FRUUHVSRQGHQFH� PDSV�� RU� GHSHQGHQF\JUDSKV�DUH�H[DPLQHG�WR�VHH�LI�WKH�IODZ�H[LVWV��7KH�DQDO\VW�PXVW�EH�IOH[LEOHLQ�FRQVLGHULQJ�DOWHUQDWLYHV��EXW�FRQFHQWUDWH�RQ�ZKDW�H[LVWV�LQ�WKH�DFWXDOFRGH�DQG�RWKHU�HYLGHQFH��$QDO\VWV�XVH�FRGH�ZDON�WKURXJKV��SULRU�WHVW�UH�VXOWV��WKHLU�RZQ�LQVLJKWV��DQG�FRQYHUVDWLRQV�ZLWK�RWKHU�WHDP�PHPEHUV�WRUHDFK�FRQFOXVLRQV�DERXW�WKH�OLNHOLKRRG�RI�WKH�IODZ·V�H[LVWHQFH�5HVXOWV�DUH�GRFXPHQWHG�RQ�WKH�)+6��&RQILUPHG�IODZV�DUH�IODJJHG�LQ�WKH

GDWDEDVH� IRU� ODWHU�H[DPLQDWLRQ��$Q�DQDO\VW�VSHQGV�D� IHZ�GD\V��DW�PRVW�RQ�HDFK�IODZ��7KH�GHVN�FKHFNLQJ�FRQWLQXHV�IRU�ZHHNV��DQG�SRVVLEO\�D�IHZPRQWKV��\LHOGLQJ�DQ�)+6�SURGXFWLYLW\� UDWH�RI���� WR����)+6�SHU�SHUVRQ�PRQWK�� 7KH� ZRUN� LV� WHGLRXV� DQG� GHWDLOHG�� DQG� UHTXLUHV� GHVWUXFWLYHWKLQNLQJ��2FFDVLRQDOO\�DQ�)+6�LV�RI�VXIILFLHQW�FRPSOH[LW\�DQG�LQWHUHVW�WRZDUUDQW�D� OLYH� WHVW��EXW� WKH� LQYHVWPHQW� LQ� WKH� WHVWLQJ�SURFHVV�ZLOO� ORZHUSURGXFWLYLW\�

/LYH�WHVWLQJ��7HVW�FDVH�GHVLJQ��FRGLQJ��DQG�H[HFXWLRQ�DUH�H[SHQVLYH��VROLYH�WHVWLQJ�LV�QRW�WKH�SUHIHUUHG�)+6�HYDOXDWLRQ�PHWKRG��+RZHYHU��WHVWLQJLV�RIWHQ�WKH� IDVWHVW�ZD\� WR�FRQILUP�FRPSOH[�RU� WLPH�GHSHQGHQW� IODZV�� ,QSHQHWUDWLRQ�WHVWLQJ��OLYH�WHVWV�DUH�VLPLODU�WR�FRPSXWHU�VRIWZDUH�FRQILJXUD�WLRQ� LWHP� �&6&,�� IXQFWLRQDO� WHVWV� ZLWK� WKH� )+6� DFWLQJ� DV� WKH�GLV�IXQFWLRQDO�VSHFLILFDWLRQ�IRU�WKH�WHVW��7KHUH�LV�OLWWOH�XQLTXH�DERXW�WKHVHWHVWV��H[FHSW�WKH\�PD\�EH�GHVWUXFWLYH�RI�WKH�V\VWHP��$YRLG�UXQQLQJ�WKHPRQ� WKH� RSHUDWLRQDO� V\VWHP� VLQFH� WKH\� FDQ� KDYH� XQSUHGLFWDEOH� UHVXOWV�$OVR��WKH�WHVWLQJ�LV�WR�FRQILUP�WKH�IODZ��QRW�WR�H[SORLW�LW��7HVW�FRGH�VKRXOGEH�D�QDUURZO\�IRFXVHG��E\�WKH�)+6��TXLFN�RQH�VKRW�URXWLQH��7KLV�ZLOO�EHHDVLHU�WR�ZULWH�LI�WKHUH�LV�D�ULFK�OLEUDU\�RI�GHEXJ�DQG�GLDJQRVWLF�URXWLQHV�

)ODZ�JHQHUDOL]DWLRQ

:KHQ�WKH�WHDP�DVVHPEOHV�IRU�WKH�GDLO\�PHHWLQJ��WKH�FRQILUPHG�IODZV�RIWKH�GD\�DUH�EULHIHG�DQG�H[DPLQHG��(DFK�WHDP�PHPEHU�FRQVLGHUV�WKH�SRV�VLELOLW\�WKDW�WKH�IODZ�PLJKW�H[LVW� LQ�KLV�DUHD��DQG�ZKHWKHU�WKH�WHVW�WHFK�QLTXH�DQG�FRGH�FDQ�EH�XVHG�RQ�KLV�)+6��2IWHQ�D�FRQILUPHG�IODZ�KDV�RQO\

Page 18: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

PHGLXP�SD\RII�YDOXH�EXW�FDQ�EH�XVHG�ZLWK�RWKHU�FRQILUPHG�IODZV�WR�\LHOGD�KLJK�SD\RII��7KLV�VWULQJLQJ�RI�IODZV�WRJHWKHU�LV�FDOOHG�´EHDGLQJµ�DQG�KDVOHG�WR�PDQ\�XQXVXDO�KLJK�SD\RII�SHQHWUDWLRQV�'HGXFWLYH�WKLQNLQJ�FRQILUPV�D�IODZ��,QGXFWLYH�WKLQNLQJ�WDNHV�D�VSHFLILF

IODZ�WR�D�PRUH�JHQHUDO�FODVV�RI�IODZV��7KH�WHDP�H[DPLQHV�WKH�EDVLF�WHFK�QRORJ\�XSRQ�ZKLFK�HDFK�FRQILUPHG� IODZ� LV� EDVHG� WR� VHH� LI� WKH� IODZ� LV� DPHPEHU�RI�D�ODUJHU�FODVV�RI�IODZV��%\�WKLV�JHQHUDOL]DWLRQ�RI�WKH�IODZ��RQHPD\� ILQG�RWKHU� LQVWDQFHV�RI� WKH�ZHDNQHVV�RU�JDLQ�QHZ� LQVLJKW�RQ�FRXQ�WHUPHDVXUHV��,QGXFWLYH�WKLQNLQJ�SURFHHGV�VLPXOWDQHRXVO\�ZLWK�GHGXFWLYHWKLQNLQJ� RI� QHZ� LQVWDQFHV� RI� WKH� IODZ�� VR� WKDW� WKH� IODZ� EHFRPHV� D� QHZIODZ� K\SRWKHVLV� JHQHUDWRU�� 6RPH� FODVVLF� IODZV� ZHUH� GLVFRYHUHG� E\� WKLVLQGXFWLRQ� ³� IRU� H[DPSOH�� SDUDPHWHU� SDVVLQJ� E\� UHIHUHQFH� >/,1'���6'&��@�� SLHFHZLVH� GHFRPSRVLWLRQ� RI� SDVVZRUGV� >7$1(��@�� SXQV� LQ� ,�2FKDQQHO� SURJUDPV� >$77$���� 3+,/��@�� DQG� WLPH�RI�FKHFN�WR�WLPH�RI�XVH�72&7728��ZLQGRZV�>/,1'��@��7KHVH�DUH�GHVFULEHG�LQ�WKH�XSFRPLQJ�VHF�WLRQ�´)+0�H[SHULHQFH�µ

)ODZ�HOLPLQDWLRQ

([SHUWV�KDYH�DUJXHG�WKH�IXWLOLW\�RI�SHQHWUDWH�DQG�SDWFK�DQG�KDFN�DQG�SDWFK�PHWKRGV�RI� LPSURYLQJ� WKH� WUXVW� RI� D� 7&%� IRU� VXEVWDQWLDO� UHDVRQVWKDW� UHGXFH� WR� WKH� WUDGLWLRQDO� SRVLWLRQ� WKDW� \RX� PXVW� GHVLJQ� VHFXULW\�TXDOLW\�� SHUIRUPDQFH�� DQG� VR� RQ�� LQWR� WKH� V\VWHP� DQG� QRW� DGG� LW� RQ>6&+(��@��+RZHYHU��PRVW� KXPDQ� SURJUHVV� LV�PDGH� LQ� LQFUHPHQWDO� IRU�ZDUG� VWHSV��3URGXFWV� LPSURYH�ZLWK�QHZ� UHOHDVHV�DQG�QHZ� YHUVLRQV� WKDWIL[�IODZV�E\�SDWFKLQJ��ZRUNDURXQGV��DQG�UHGHVLJQ�7KH�7&6(&�UHTXLUHV� WKDW�DOO�NQRZQ� IODZV�EH� UHSDLUHG��7KH� HYDOXDWRUV

FDQ� VXJJHVW� WR� WKH� YHQGRU� UHSDLU� RI� VLPSOH� LPSOHPHQWDWLRQ� DQG� FRGLQJHUURUV��RU�UHFRPPHQG�NQRZQ�JHQHULF�GHVLJQ�IODZ�FRXQWHUPHDVXUHV��$IWHUUHSDLU�� WKH� V\VWHP�PXVW� EH� UHHYDOXDWHG� WR� FRQILUP� WKH� IODZV�ZHUH� IL[HGDQG�WR�HQVXUH�QR�QHZ�IODZV�ZHUH�LQWURGXFHG��5HHYDOXDWLRQ�LV�D�FRPSOHWHUHSHWLWLRQ�RI�WKH�SHQHWUDWLRQ�WHVWLQJ�SURFHVV��+RZHYHU��DSSOLFDWLRQ�RI�WKH5DWLQJV� DQG�0DLQWHQDQFH� 3URFHVV� �5$03�� >1&6&��D@� WR� %�� DQG� EHWWHUHYDOXDWLRQV� PD\� EH� D� SRVVLEOH� PHWKRG� WR� DYRLG� WRWDO� UHSHWLWLRQ�� 7KLVVSHFXODWLRQ�KDV�EHHQ�WULHG�RQ�WKH�%��HYDOXDWLRQ�RI�WUXVWHG�;HQL[�SRUWHGWR�QHZ�KDUGZDUH�SODWIRUPV�>0&$8��@��,W�LV�LPSUDFWLFDO�IRU�WKH�YHQGRU�WRIL[� VRPH� IODZV�� 7KHVH� UHVLGXDO� IODZV�ZLOO� UHVXOW� LQ� D� ORZHU� FODVV� UDWLQJ�+RZHYHU�� WKH� XVLQJ� DJHQF\� FDQ� SUHSDUH� D� ULVN� DQDO\VLV� WKDW� VKRZV� WKH'$$� �'HVLJQDWHG� $SSURYLQJ� $XWKRULW\�� DOWHUQDWLYH� VHFXULW\�PHDVXUHV� WRFRXQWHU�WKH�UHVLGXDO�IODZV�

)+0�H[SHULHQFH

)+0�KDV�EHHQ�D�FRVW�HIIHFWLYH�PHWKRG�RI�VHFXULW\�V\VWHP�DVVXUDQFH�DV�VHVVPHQW�IRU�RYHU�WZHQW\�\HDUV��8QOLNH�RWKHU�DVVXUDQFH�PHWKRGV��ZKLFK

Page 19: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

IRFXV� RQ� QDUURZHU� REMHFWLYHV� �IRU� H[DPSOH�� IRUPDO� FRUUHFWQHVV� SURRIV� RIGHVLJQ�RU�ULVN�DVVHVVPHQW�FRVWV�RI�IDLOXUHV���)+0�VHHNV�VHFXULW\�IODZV�LQWKH�RYHUDOO�RSHUDWLRQ�RI�D�V\VWHP�GXH�WR�SROLF\��VSHFLILFDWLRQ��GHVLJQ��LP�SOHPHQWDWLRQ��DQG�RU�RSHUDWLRQDO�HUURUV��,W�LV�D�FRPSOHWH�V\VWHPV�DQDO\�VLV�PHWKRG�WKDW�XQFRYHUV�IODZV�LQWURGXFHG�LQWR�WKH�V\VWHP�DW�DQ\�VWDJHRI�WKH�SURGXFW�OLIH�F\FOH�

)+0�PDQDJHPHQW�H[SHULHQFH��0DQDJHPHQW�PRGHOV�DQG�ZRUN�EUHDN�GRZQ�VWUXFWXUHV��:%6��RI�WDVNV��VFKHGXOHV��DQG�ODERU�ORDGLQJV�WR�SHUIRUPW\SLFDO� SHQHWUDWLRQ� WHVWLQJ� DUH� DYDLODEOH� LQ� WKH� OLWHUDWXUH� >58%���:(,6��D@��)RU�ZHDN�V\VWHPV�LQ�WKH�7&6(&�&��WR�%��FODVVHV��H[SHULHQFHSUHGLFWV� D� W\SLFDO� SHQHWUDWLRQ� WHDP� RI� IRXU� SHRSOH� RSHUDWLQJ� IRU� VL[PRQWKV�ZLOO�JHQHUDWH�DERXW�������)+6�DQG�DVVHVV�DERXW�����RI�WKH�KLJK�HVW�SULRULW\��6RPH����WR�����RI�WKHVH�ZLOO�EH�FRQILUPHG�IODZV��7KDW�\LHOGVD�SURGXFWLYLW\�UDWH�RI�RQH�IODZ�IRU�HYHU\�RQH�WR�WZR�SHUVRQ�ZHHNV�RI�HIIRUW�6WURQJHU�V\VWHPV�LQ�WKH�7&6(&�%��WR�$��FODVVHV��E\�GHILQLWLRQ��PXVW�EHIODZOHVV��+RZHYHU��HYHQ�WKHVH�V\VWHPV�KDYH�IODZV�³�IDU�IHZHU��RI�FRXUVH�EHFDXVH� RI� WKH� JUHDWHU� DWWHQWLRQ� WR� VHFXUH� V\VWHP� GHYHORSPHQW�� 6XFKIODZV�DUH�UHSDLUHG��DXGLWHG��RU�FRQVLGHUHG�DQ�DFFHSWDEOH�ULVN��+LJKHU�IODZUDWHV�PD\�VLJQDO�D� OHVVHU�HYDOXDWLRQ�FODVV� WKDQ�%�� LV�ZDUUDQWHG� IRU� WKHWDUJHW�V\VWHP�

9XOQHUDELOLW\�FODVVHV�RI�IODZV��&RQILUPHG�IODZV�DUH�VRUWHG�LQWR�YXOQHU�DELOLW\�FODVVHV�

�� IODZ�JLYHV�WRWDO�FRQWURO�RI�WKH�7&%�V\VWHP��7&���� VHFXULW\�SROLF\�YLRODWLRQ��39���� GHQLDO�RI�VHUYLFH��'6���� LQVWDOODWLRQ�GHSHQGHQW��,1���DQG�� KDUPOHVV��+��

7KHVH�YXOQHUDELOLW\�FODVVHV�DUH�EDVHG�RQ�WKH�GHJUHH�RI�XQDXWKRUL]HG�FRQ�WURO�RI� WKH� V\VWHP�SHUPLWWHG�E\� WKH� IODZ�³� WKDW� LV�� GDPDJH� H[WHQW��7KHJUHDWHVW�YXOQHUDELOLW\�LV�7&%�FDSWXUH��WKH�PDFKLQH�LV�XQGHU�WRWDO�FRQWURORI� WKH� LQWHUORSHU� �7&�³� WRWDO� FRQWURO�³� IODZV��� )ODZV� WKDW� SHUPLW� OHVVHUFRQWURO� DUH� XQLQWHQWLRQDO�� XQGRFXPHQWHG� FDSDELOLWLHV� WKDW� YLRODWH� WKHSROLF\� PRGHO�� EXW� GR� QRW� DOORZ� WRWDO� FRQWURO� �39� ³� SROLF\� YLRODWLRQ� ³IODZV���'HQLDO�RI�VHUYLFH�IODZV�SHUPLW�WKH�SHQHWUDWRU�WR�GHJUDGH�LQGLYLGXDODQG� V\VWHP�SHUIRUPDQFH�� EXW� GR�QRW� YLRODWH� WKH� FRQILGHQWLDOLW\� VHFXULW\SROLF\��'6�³�GHQLDO�RI�VHUYLFH�³�IODZV���,QVWDOODWLRQ�GHSHQGHQW�IODZV�DUHZHDNQHVVHV�LQ�WKH�7&%�WKDW�REWDLQ�IURP�ORFDO�LQLWLDOL]DWLRQ�RI�WKH�V\VWHP�VXFK� DV� D� SRRU� SDVVZRUG� DOJRULWKP� �,1� ³� LQVWDOODWLRQ�GHSHQGHQW� ³IODZV���/DVW��WKHUH�DUH�IODZV�WKDW�DUH�KDUPOHVV�LQ�WKH�VHQVH�WKDW�WKH\�YLR�ODWH�SROLF\�LQ�D�PLQRU�ZD\��RU�DUH�LPSOHPHQWDWLRQ�EXJV�WKDW�FDXVH�QR�RE�

Page 20: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

YLRXV�GDPDJH��+�³�KDUPOHVV�³�IODZV���7KHVH�FRGHV�ZLOO�FDWHJRUL]H�IODZVSUHVHQWHG�LQ�VXEVHTXHQW�VHFWLRQV�

3HQHWUDWLRQ�UHVXOWV��([DPSOH�JHQHULF�DWWDFN�PHWKRGV�� 7KLV� VHFWLRQSUHVHQWV�D�UHSUHVHQWDWLYH�FROOHFWLRQ�RI�DWWDFN�PHWKRGV� IRXQG�HIIHFWLYH� LQILQGLQJ�IODZV�E\�WKH�LQQRYDWLYH�DQG�VNLOOHG�SHQHWUDWLRQ�WHDPV�XVLQJ�)+0�$Q�H[WHQVLYH�WD[RQRP\�RI�IODZV�LV�LQ�SUHSDUDWLRQ�E\�15/��1DYDO�5HVHDUFK/DERUDWRU\��>%8//��@�

:HDN�LGHQWLILFDWLRQ�DXWKHQWLFDWLRQ��3DVVZRUGV�DUH�WKH�FKHDSHVW� IRUP�RIDXWKHQWLFDWLRQ��:HDN�SDVVZRUGV��KRZHYHU��DUH�TXLWH�H[SHQVLYH��DOORZLQJWKH� SHQHWUDWRU� WR� LPSHUVRQDWH� NH\� VHFXULW\� DGPLQLVWUDWRUV� WR� JDLQ� WRWDOFRQWURO�RI�WKH�7&%��7&�IODZ��� ,Q�RQH�V\VWHP��D�ZHDN�SDVVZRUG�SURWHFWHGWKH�SDVVZRUG�ILOH�LWVHOI��7KH�SDVVZRUG�ZDV�D�VKRUW�(QJOLVK�ZRUG�WKDW�WRRNEXW�D�IHZ�KRXUV�RI�WULDO�DQG�HUURU�WR�FUDFN��$�PRGHUQ�IRUP�RI�WKLV�DWWDFNRQ�WKH�8QL[�SDVVZRUG�ILOH�LV�HPERGLHG�LQ�D�SURJUDP�FDOOHG�&UDFN��ZKLFKUXQV�IRU�GD\V�DV�D�EDFNJURXQG�WDVN�JHQHUDWLQJ�SRSXODU�FDQGLGDWH�SDVV�ZRUGV�DQG�WU\LQJ�WKHP�IRU�FRQILUPDWLRQ�>08))�D@��6LQFH�PRVW�SDVVZRUGVDUH�LQLWLDOL]HG�E\�V\VWHP�DGPLQLVWUDWLRQ��WKLV�LV�DQ�H[DPSOH�RI�DQ�RSHUD�WLRQDO�IODZ�DQG�DQ�LQLWLDO�FRQGLWLRQ��,1��IODZ�2Q�WKH�'(&�3'3����DQG�PDQ\�FRQWHPSRUDU\�PDFKLQHV��WKHUH�DUH�SRZ�

HUIXO�VWULQJ�FRPSDUH�LQVWUXFWLRQV�XVHG�WR�FRPSDUH�VWRUHG�YHUVXV�HQWHUHGSDVVZRUGV��7KHVH�DUUD\�LQVWUXFWLRQV�ZRUN�OLNH�'2�:+,/(�ORRSV�XQWLO�WKHFKDUDFWHU�E\�FKDUDFWHU�FRPSDUH�IDLOV�RU�WKH�SDVVZRUG�VWULQJ�HQGV��,W�ZDVGLVFRYHUHG�LQ�WKH�7HQH[�RSHUDWLQJ�V\VWHP�WKDW�WKH�LQVWUXFWLRQ�DOVR�IDLOHGZKHQ�D�SDJH� IDXOW�RFFXUUHG��7KLV� WXUQHG�D�QHDW�ELQDU\�SDVVZRUG�SUHGL�FDWH�³�\HV�QR�³� LQWR�D� WULQDU\�GHFLVLRQ� FRQGLWLRQ�³�\HV�QR�PD\EH�³WKDW�HQDEOHG�SLHFHZLVH�FRQVWUXFWLRQ�RI�DQ\�SDVVZRUG�LQ�D�PDWWHU�RI�VHF�RQGV�� ,Q� WKLV�FDVH�WKH� IODZ�ZDV�D�ZHDN�SDVVZRUG�FKHFNLQJ� URXWLQH� WKDWSHUPLWWHG� WKH� XVHU� WR� SRVLWLRQ� WKH� FDQGLGDWH� SDVVZRUG� DFURVV� SDJHERXQGDULHV�>7$1(��@��7KLV�LV�DQ�H[DPSOH�RI�D�KDUGZDUH�DQRPDO\�DQG�DQLPSOLFLW�PHPRU\�VKDULQJ��7&��IODZ�2Q�WKH�,%0�26�96��5��DQG�VLPLODU�YLQWDJH�RSHUDWLQJ�V\VWHPV��ILOHV�RU

GDWD� VHWV� DUH� SURWHFWHG� E\� SDVVZRUG�� :KHQ� WKH� XVHU� LV� DEVHQW� GXULQJEDWFK� SURFHVVLQJ�� VXUUHQGHUHG� SDVVZRUGV� IRU� WKH� ILOH� DUH� SODFHG� LQ� WKH-RE�&RQWURO�/DQJXDJH��-&/��ORDG�GHFN�DQG�TXHXH�ILOH�IRU�FRPPDQG�WR�WKHEDWFK� SURFHVV�� 7KH� -&/� TXHXH� LV� DQ� XQSURWHFWHG� GDWDEDVH�� ZKLFK� LVUHDGDEOH�E\�DQ\�XVHU�SURFHVV��WKXV�SHUPLWWLQJ�WKHIW�RI�SDVVZRUGV��7KLV�LVDQ�H[DPSOH�RI�D�EDGO\�GHVLJQHG�XVHU�V\VWHP�LQWHUIDFH��ZKHUH�V\VWHP�GDWDLV�SODFHG�LQ�WKH�XVHU·V�DGGUHVV�VSDFH�>0&3+����6'&����6'&��@��,W�LV�DOVRDQ�H[DPSOH�RI�EDG�VHFXULW\�SROLF\��D�SROLF\�YLRODWLRQ��39��IODZ�,Q�PRVW�V\VWHPV�WKH�XVHU�ORJV�LQWR�D�ZHOO�GHVLJQHG�SDVVZRUG�DXWKHQWL�

FDWLRQ�PHFKDQLVP��+RZHYHU��WKH�V\VWHP�QHYHU�DXWKHQWLFDWHV�LWVHOI�WR�WKHXVHU��7KLV�ODFN�RI�PXWXDO�DXWKHQWLFDWLRQ�SHUPLWV�XVHUV�WR�EH�VSRRIHG�LQWRVXUUHQGHULQJ� WKHLU� SDVVZRUGV� WR� D� ERJXV� ORJLQ� VLPXODWLRQ� SURJUDP� OHIW

Page 21: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

UXQQLQJ�RQ�D�YDFDQW�SXEOLF�WHUPLQDO��7KLV�VSRRI�KDV�EHHQ�DURXQG�IRUHYHUDQG�LV�VWLOO�HIIHFWLYH��,W�LV�DQ�H[DPSOH�RI�D�SRRU�XVHU�V\VWHP�LQWHUIDFH�WKDW\LHOGV�D�SROLF\�YLRODWLRQ��39��IODZ��0XWXDO�DXWKHQWLFDWLRQ�LV�D�QHFHVVLW\�LQWKH� PRGHUQ� ZRUOG� RI� GLVWULEXWHG� FRPSXWLQJ�� ZKHUH� QXPHURXV� QHWZRUNVHUYHUV� KDQGOH� ILOHV�� PDLO�� SULQWLQJ�� PDQDJHPHQW�� URXWLQJ�� JDWHZD\V� WRRWKHU�QHWZRUNV��DQG�VSHFLDOL]HG�VHUYLFHV�IRU�XVHUV�RQ�WKH�QHW��:LWKRXW�LW�VXFK� VHUYLFHV� ZLOO� VXUHO\� EH� VSRRIHG�� PRGLILHG�� DQG�RU� IDOVLILHG�� 1HZVPDUW�FDUG�,$�V\VWHPV�SURYLGH�PXWXDO�DXWKHQWLFDWLRQ�E\�XVH�RI�SXEOLFNH\�FU\SWRJUDSK\�>.5$-��@�

6HFXULW\� SHULPHWHU� LQILOWUDWLRQ�� 8QWUXVWHG� FRGH� PXVW� EH� FRQILQHG� DQGSHUPLWWHG�WR�FDOO�WKH�7&%�RQO\�LQ�D�SUHVFULEHG�PDQQHU�IRU�VHFXUH�DFFHVVWR� QHHGHG� V\VWHP� VHUYLFHV� >/$03��@�� 7KHVH� ERXQGDU\� FURVVLQJV� RI� WKHVHFXULW\� SHULPHWHU� DUH� RIWHQ� SRRUO\� GHVLJQHG� DQG� UHVXOW� LQ� ´LQILOWUDWLRQµIODZV��$�FODVVLF�H[DPSOH�RI� WKLV� LV� WKH�XQFRQWUROOHG� FKDQQHO�SURJUDP�RIWKH�,%0������6LQFH�FKDQQHO�SURJUDPV�DUH�DOORZHG�WR�EH�VHOI�PRGLI\LQJ�WRSHUPLW�VFDWWHU�UHDGV�DQG�ZULWHV�DQG�WKH�XVHU�FDQ�WXUQ�RII�PHPRU\�PDS�SLQJ� �IRU� H[DPSOH�� 9LUWXDO� � 5HDO��� LW� LV� SRVVLEOH� WR� ZULWH� LQWR� SURWHFWHGV\VWHP�PHPRU\�DQG�PRGLI\�FRGH�DQG�RU�SURFHVV�PDQDJHPHQW�GDWD��$W�WHPSWV�WR�HOLPLQDWH�WKHVH�SUREOHPV�E\�VWDWLF�DQDO\VLV�RI�WKH�FKDQQHO�SUR�JUDPV� LQ� 90����� IDLOHG� WR� SUHYHQW� FOHYHU� ´SXQVµ� LQ� WKH� FRGH� IURPFRQWLQXHG�H[SORLWDWLRQ�>$77$����%(/$����3+,/��@�$QRWKHU�H[DPSOH�RI�SRRU�FRQILQHPHQW�LV�WKH�+RQH\ZHOO�+,6������*&26

VXVSHQG� IHDWXUH�� ,W� DOORZV� D� XVHU� WR� IUHH]H� DQ� LQWHUDFWLYH� VHVVLRQ� IRU� DOXQFK�EUHDN�RU�ORQJHU�VXVSHQVLRQ��DQG�UHVXPH�ODWHU�E\�WKDZLQJ�WKH�SUR�JUDP��7KH�GHVLJQ�IODZ�VWRUHV�WKH�IUR]HQ�LPDJH�LQ�WKH�XVHU·V�ILOH�VSDFH��LQ�FOXGLQJ�DOO�WKH�VHQVLWLYH�V\VWHP�FRQWH[W�QHHGHG�WR�UHVWDUW�WKH�FRGH��,W�LV�DVLPSOH� SURFHVV� IRU� D� XVHU� WR� HGLW� WKH� IUR]HQ� LPDJH� ILOH� DQG�PRGLI\� WKHFRQWH[W�GDWD�VXFK�WKDW�WKH�UHVWDUWHG�SURJUDP�UXQV�LQ�V\VWHP�VWDWH�ZLWKWRWDO�FRQWURO�RI�WKH�7&%��7&�IODZ���7KLV�LV�\HW�DQRWKHU�H[DPSOH�RI�DQ�LP�SOLHG�PHPRU\�VKDULQJ�IODZ�$PRQJ�WKH�PRVW�VRSKLVWLFDWHG�SHQHWUDWLRQV�LV�WKH�OHJHQGDU\�EUHDNSRLQW

DWWDFN�RI�/LQGH�DQG�3KLOOLSV�>$77$����3+,/��@��,W�LV�DQ�H[FHOOHQW�H[DPSOHRI�D�EHDGLQJ�DWWDFN��:KHQ�D�XVHU�SODQWV�D�EUHDNSRLQW� LQ�KLV�XVHU�FRGH�WKH� V\VWHP� UHSODFHV� WKH�XVHU� FRGH� DW� WKH� EUHDNSRLQW�ZLWK� D� EUDQFK� LQ�VWUXFWLRQ�WR�WKH�V\VWHP��7KH�V\VWHP·V�EUHDNSRLQW�URXWLQH�VDYHV�WKH�XVHUFRGH�LQ�D�V\VWHP�VDYH�DUHD��/DWHU��ZKHQ�WKH�EUHDNSRLQW� LV�UHPRYHG�� WKHXVHU�FRGH�LV�UHVWRUHG��7KH�EUHDNSRLQW� IHDWXUH�KHOSV�WKH�SHQHWUDWRU�SODQWFRGH�LQ�WKH�V\VWHP�LWVHOI�³�WKDW�LV��WKH�UHSODFHG�XVHU�FRGH�³�DQ�H[DPSOHRI� D� KDUPOHVV� �+�� IODZ�� ,W�ZDV� REVHUYHG� WKDW� DQRWKHU� H[LVWLQJ� KDUPOHVVIODZ�� D� PRYH� VWULQJ� HUURU� H[LW�� OHIW� WKH� DGGUHVV� RI� WKH� V\VWHP� PHPRU\PDS�� UDWKHU� WKDQ� WKH� DGGUHVV� RI� WKH� VWULQJ�� XSRQ� HUURU� UHWXUQ�� ,W� ZDVSRVVLEOH�WR�LQGXFH�WKH�VWULQJ�IODZ�E\�UHIHUHQFH�WR�DQ�XQDYDLODEOH�PHPRU\SDJH�³�WKDW�LV��D�SDJH�IDXOW��$�WKLUG�KDUPOHVV�IODZ�DOORZHG�FRQWURO�WR�UH�

Page 22: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

WXUQ�WR�WKH�FDOOHU�ZKLOH�WKH�VWULQJ�PRYH�ZDV�LQ�SURJUHVV�LQ�WKH�FDOOHG�SUR�JUDP�7KH�SHQHWUDWRUV�VHW�XS� WKH�EHDG�DWWDFN�E\�SODQWLQJ�D�EUHDNSRLQW�DW� D

FDUHIXOO\�SUHSDUHG� LQVWUXFWLRQ�RQ� WKH�VDPH�SDJH�DV�D� VWULQJ�PRYH� FRP�PDQG�� 7KH\� FDUHIXOO\� VHOHFWHG� D� VWULQJ� WKDW� FURVVHG� D� SDJH� ERXQGDU\�7KH\�H[HFXWHG�WKH�VWULQJ�PRYH��DQG�XSRQ�UHJDLQLQJ�FRQWURO��UHOHDVHG�WKHSDJH�FRQWDLQLQJ�WKH�HQG�RI�WKH�ORQJ�VWULQJ��7KDW�FDXVHG�D�SDJH�IDXOW�ZKHQWKH�VWULQJ�PRYH�FURVVHG�WKH�SDJH�ERXQGDU\��DW�ZKLFK�WLPH�WKH�EUHDNSRLQWZDV� UHPRYHG�� ,Q� UHVWRULQJ� WKH� SUHEUHDNSRLQW� XVHU� FRGH�� WKH� V\VWHP� UH�WULHYHG� WKH� VDYHG� XVHU� FRGH� EXW� HUURQHRXVO\� ZURWH� WKH� XVHU� FRGH� LQWRSURWHFWHG� V\VWHP�PHPRU\�� VSHFLILFDOO\�� WKH� V\VWHP� SDJH�PDS�� 7KLV� XQ�DXWKRUL]HG�V\VWHP�PRGLILFDWLRQ�ZDV�SRVVLEOH�EHFDXVH�D�KDUGZDUH�GHVLJQIODZ� LQ� WKH� SDJH� IDXOW� HUURU� UHWXUQ� OHIW� WKH� SDJH� DGGUHVV� RI� WKH� V\VWHPPHPRU\�PDS��QRW�WKH�SDJH�DGGUHVV�RI�WKH�RULJLQDO�XVHU·V�VWULQJ��7KH�DW�WDFN�KDG�VXFFHVVIXOO\�PRGLILHG�WKH�V\VWHP�PDS��SODFLQJ�XVHU�GDWD�LQ�WKHV\VWHP� LQWHUUXSW� YHFWRU� WDEOH�� 7KH� DWWDFN� JDYH� DUELWUDU\� FRQWURO� RI� WKH7&%�³�DQRWKHU�VXEWOH�IODZ�LQ�LPSOLFLW�PHPRU\�VKDULQJ��D�7&�IODZ��

,QFRPSOHWH� FKHFNLQJ�� ,PSRUWV� DQG� H[SRUWV� WKDW� FURVV� WKH� VHFXULW\� SH�ULPHWHU�SHU�WKH�7&6(&�DUH�HLWKHU�ODEHO�FKHFNHG�RU�XVH�LPSOLFLW�ODEHOV�IRUWKH�,�2�FKDQQHO�XVHG��/RWV�RI�IODZV�RFFXU�ZKHQ�ODEHOV�DUH�QRW�XVHG�RU�DUHXVHG� LQFRQVLVWHQWO\�� $QRWKHU� DWWDFN� H[SORLWV� LQWHURSHUDELOLW\� EHWZHHQV\VWHPV� WKDW� XVH� GLIIHUHQW� ODEHO� VHPDQWLFV�� 7KH� 'HIHQVH� 'DWD� 1HWZRUN�''1��HPSOR\V�WKH�VWDQGDUG�,3�GDWDJUDP�5HYLVHG�,QWHUQHW�3URWRFRO�6HFX�ULW\� 2SWLRQ� �5,362�� VHFXULW\� VHQVLWLYLW\� ODEHO� >5)&����@�� ,W� GLIIHUV� IURPHPHUJLQJ�FRPPHUFLDO�VWDQGDUGV��+HUH�LV�D�VLWXDWLRQ�ULSH�IRU�D�IXWXUH�VH�FXULW\��,1��IODZ�$UUD\�ERXQGV�RYHUIORZ�LV�D�SDUWLFXODUO\�QDVW\�IODZ�DQG�TXLWH�SHUYDVLYH

DQG�GLIILFXOW�WR�FRXQWHU��7KH�IODZ�PDQLIHVWV�LWVHOI�LQ�V\VWHP�RSHUDWLRQ��EXWLWV�FDXVH�LV�XVXDOO\�WUDFHG�WR�WKH�GHYHORSPHQW�FRPSLOHU·V�IDLOXUH�WR�JHQHU�DWH� FRGH� IRU�G\QDPLF� DUUD\�ERXQGV� FKHFNLQJ��:KHQ� WKH� DUUD\� ERXQG� LVH[FHHGHG�� WKH� FRGH� RU� GDWD� SDUDPHWHUV� DGMDFHQW� WR� WKH� DUUD\� DUH� RYHU�ZULWWHQ�DQG�PRGLILHG��,Q�RQH�FDVH�WKH�XVHU�HQWHUHG�SDVVZRUG�ZDV�VWRUHGDGMDFHQW�WR�WKH�V\VWHP�VWRUHG�SDVVZRUG��VR�WKH�WZR�VWULQJV��DUUD\V��FRXOGEH�UDSLGO\�FRPSDUHG��+RZHYHU��WKHUH�ZDV�QR�ERXQGV�FKHFNLQJ��7KH�XVHUVLPSO\�HQWHUHG�D�PD[LPXP�VL]H�SDVVZRUG�WZLFH�VR�WKDW�LW�RYHUIORZHG�WKHXVHU�DUUD\�LQWR�WKH�V\VWHP�DUUD\��FUHDWLQJ�D�SDVVZRUG�PDWFK�>%,6+��@��DFHUWDLQ�7&�IODZ�,QFRPSOHWH�FDVH�DQDO\VLV�OHDGV�WR�IODZV��(LWKHU�WKH�GHVLJQ�VSHFLILFDWLRQ

KDV�QRW�FRQVLGHUHG�DOO� WKH�FRQGLWLRQV�RI�DQ� ,)�7+(1�(/6(� IRUP��RU� WKHSURJUDPPHU� JRRIHG�� ,Q� HLWKHU� HYHQW�� WKH� SHQHWUDWRU� FUHDWHV� WKH�PLVVLQJFRQGLWLRQ�DQG�IRUFHV�WKH�FRGH�WR�LJQRUH�WKH�FRQVHTXHQFHV��RIWHQ�FUHDWLQJDQ�H[SORLWDEOH�VWDWH��D�39�IODZ��7KH�,%0�36:�IODZ�PHQWLRQHG�LQ�WKH�HDU�OLHU�VHFWLRQ�´6\VWHP�DQRPDOLHVµ�LV�DQ�H[DPSOH�

Page 23: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

7KH� ,%0����� LQWURGXFHG� WKH�3URJUDP�6WDWXV�:RUG� �36:���ZKLFK�FRQ�WDLQHG� D� VWDWXV� FRQGLWLRQ� FRGH� IRU� WKH� PDFKLQH� LQVWUXFWLRQV� WKDW� KDYHFRQGLWLRQDO�H[HFXWLRQ�PRGHV��0DQ\�SURJUDPPHUV�LJQRUH�WKH�36:�VWDWXVFRGH� DQG� DVVXPH� WKH� H[HFXWLRQ� UHVXOW� RI� WKH� LQVWUXFWLRQ�� 7KLV� LV� SRRUFRGLQJ�SUDFWLFH� EXW� D� VXUSULVLQJO\� IUHTXHQW� RFFXUUHQFH� >%8//��@��2IWHQWKH�SURJUDPPHU�EHOLHYHV�WKDW�SULRU�FKHFNV�ILOWHU�WKH�FRQGLWLRQV�EHIRUH�WKHLQVWUXFWLRQ�H[HFXWLRQ�DQG�WKDW�WKH�GDWD�FDQQRW�FDXVH�WKH�XQDQWLFLSDWHGFRQGLWLRQ��WKXV�LJQRULQJ�WKH�FRQGLWLRQ�FRGH��7KH�SHQHWUDWRU�PXVW�ILQG�DQRSSRUWXQLW\�WR�UHVHW�WKH�SDUDPHWHUV�DIWHU�WKH�ILOWHU�FKHFNV��EXW�EHIRUH�WKHFRQGLWLRQDO� FRGH� H[HFXWLRQ�� WLPH�RI�FKHFN�WR�WLPH�RI�XVH� �72&7728�� DW�WDFNV�DUH�H[DFWO\�ZKDW·V�QHHGHG�IRU�SHQHWUDWLRQ�$�72&7728�IODZ�LV�OLNH�D�GDQJOLQJ�SDUWLFLSOH�JUDPPDWLFDO�IODZ�LQ�(QJ�

OLVK��7KH�FKHFN�FRGH�LV�GLVWDQW�IURP�WKH�XVLQJ�FRGH��HQDEOLQJ�LQWHUYHQLQJFRGH�WR�FKDQJH�WKH�WHVWHG�SDUDPHWHUV�DQG�FDXVH�WKH�XVH�FRGH�WR�WDNH�LQ�FRUUHFW��SROLF\�YLRODWLQJ�DFWLRQV��D�39�IODZ���7KH�DWWDFN�LV�D�IRUP�RI�VOHLJKWRI�KDQG��7KH�SHQHWUDWRU�VHWV�XS�D�SHUIHFWO\�LQQRFHQW�DQG�FRUUHFW�SURJUDP�SRVVLEO\� DQ� H[LVWLQJ� DSSOLFDWLRQ� SURJUDP�� DQG� WKURXJK� PXOWLWDVNLQJ� RUPXOWLSURFHVVLQJ��KDV�DQRWKHU�SURJUDP�PRGLI\�WKH�SDUDPHWHUV�GXULQJ�WKHLQWHUYDO�EHWZHHQ�FKHFN�DQG�XVH��7KH�LQWHUYDO�PD\�EH�VPDOO��QHFHVVLWDWLQJFDUHIXO�WLPLQJ�RI�WKH�DWWDFN��7KH�IODZ�LV�ERWK�DQ�LPSOLFLW�PHPRU\�VKDULQJHUURU�DQG�D�SURFHVV�V\QFKURQL]DWLRQ�SUREOHP��7KH�VROXWLRQ�LV�QRW�WR�SODFHV\VWHP� SDUDPHWHUV� LQ� XVHU� PHPRU\� DQG�RU� SURKLELW� LQWHUUXSWLELOLW\� RI´FULWLFDO�UHJLRQµ�FRGH�>/,1'����0&3+����3+,/��@�5HDG�EHIRUH�ZULWH� IODZV� DUH� UHVLGXH� FRQWURO� IODZV�� %HJLQQLQJ� ZLWK

7&6(&�&��FODVV�V\VWHPV��DOO� UHXVHG�REMHFWV�PXVW�EH�FOHDQHG�EHIRUH� UH�XVH�� 7KLV� LV� UHTXLUHG� DV� D� FRXQWHUPHDVXUH� WR� WKH� LQDGHTXDWH� UHVLGXHFRQWURO� LQ� HDUOLHU� V\VWHPV��+RZHYHU�� WKH� IODZ� SHUVLVWV� LQ�PRGHUQ� GUHVV�:KHQ�GLVN� ILOHV�DUH�GHOHWHG��RQO\� WKH�QDPH� LQ� WKH� ILOH�FDWDORJ� LV�HUDVHG�7KH�GDWD�UHFRUGV�DUH�DGGHG�WR�IUHH�VWRUDJH�IRU�ODWHU�DOORFDWLRQ��7R�LQFUHDVHSHUIRUPDQFH��WKHVH�XVHG�UHFRUGV�DUH�FOHDUHG�RQ�UHDOORFDWLRQ��LI�DW�DOO���QRWRQ�GHDOORFDWLRQ��7KDW�PHDQV�WKH�GDWD�UHFRUGV�FRQWDLQ�UHVLGXH�RI�SRVVLEO\VHQVLWLYH�PDWHULDO��,I�WKH�ILOH�PHPRU\�LV�DOORFDWHG�DQG�UHDG�EHIRUH�GDWD�LVZULWWHQ�� WKH� UHVLGXH� LV�DFFHVVLEOH��$�SROLF\�RI�ZULWH�EHIRUH�UHDG�FRXQWHUVWKLV�IODZ��EXW�VXFK�D�SROLF\�PD\�QRW�H[LVW�RU�PD\�EH�SRRUO\�LPSOHPHQWHG�7KLV�IODZ�DOVR�DSSHDUV�ZLWK�PDLQ�PHPRU\�DOORFDWLRQ�DQG�JDUEDJH�FROOHF�WLRQ�VFKHPHV��,Q�RQH�H[DPSOH��WKH�UHOHYDQW�DOSKDEHWLFDO�SDVVZRUG�UHFRUGVZHUH�UHDG�LQWR�PHPRU\�IURP�GLVN� IRU� WKH� ORJLQ�SDVVZRUG�FRPSDUH��$IWHUWKH�FRPSDUH��WKH�PHPRU\�ZDV�OHIW�XQFKDQJHG��8VLQJ�RWKHU�DWWDFNV��VXFKDV� WKH� DUUD\�ERXQGV� RYHUIORZ� GHVFULEHG� DERYH�� WKDW� UHVLGXH� PHPRU\FRXOG�EH� UHDG�DQG�SDVVZRUGV� VFDYHQJHG��%\� FDUHIXOO\� VWHSSLQJ� WKURXJKWKH�DOSKDEHW�� WKH� FRPSOHWH�SDVVZRUG� ILOH� FRXOG�EH� UHFUHDWHG� �D�7&� IODZ�>/,1'��D@�

3ODQWLQJ�ERJXV�FRGH��7KH�PRVW�YLUXOHQW� IODZV�DUH�FUHDWHG�E\� WKH�SHQH�WUDWRU�LQVHUWLQJ�ERJXV�FRGH�LQWR�WKH�7&%��D�7&�IODZ���%RJXV�FRGH�LQFOXGHV

Page 24: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

DOO� IRUPV� RI� XQDXWKRUL]HG� VRIWZDUH�� 7URMDQ� KRUVHV�� WUDS� GRRUV�� YLUXVHV�ERPEV�� DQG� ZRUPV�� )XQGDPHQWDOO\�� IODZV� WKDW� DGPLW� ERJXV� FRGH� DUHIODZV� LQ� WKH� FRQILJXUDWLRQ� FRQWURO� RI� WKH� 7&%�� 7KH� IODZ�PD\� RFFXU� DQ\WLPH� WKURXJKRXW� WKH� OLIH� F\FOH� RI� WKH� 7&%��:KHQ� GHYHORSPHQW� WRROV� DUHXQFRQWUROOHG��ERJXV�FRGH�FDQ�EH�LPEHGGHG�LQ�WKH�WRROV�DQG�WKHQ�LQWR�WKH7&%�� .HQ� 7KRPSVRQ·V� $&0� 7XULQJ� /HFWXUH� DSWO\� GRFXPHQWHG� VXFK� DQDWWDFN�>7+20��@��%XW�WKHUH�DUH�HDVLHU�PHWKRGV�³�IRU�H[DPSOH��SODQWLQJERJXV�FRGH�LQ�WKH�UXQWLPH�SDFNDJH�RI�WKH�PRVW�SRSXODU�FRPSLOHU�DQG�RUHGLWRU��5HFHQW�DWWDFNV�RQ�WKH�,QWHUQHW�ZHUH�H[SORLWDWLRQV�RI�SRRU�FRQILJX�UDWLRQ�FRQWURO��.QRZQ�IODZV�LQ�8QL[�ZHUH�QRW� IL[HG�ZLWK�WKH� IUHH�YHQGRUSDWFKHV�� 7KH� KDFNHU� XVHG� WKH� IODZV� WR� REWDLQ� XQDXWKRUL]HG� DFFHVV>63$)��D@�$PRQJ� WKH�PRUH� FRORUIXO� DWWDFNV� DJDLQVW� KXPDQ� IUDLOW\� LQ� FRQWUROOLQJ

ERJXV�FRGH� LV� WKH�6DQWD�&ODXV�DWWDFN�� ,W� LV�D�FODVVLF�H[DPSOH�RI�DQ�XQ�DXWKRUL]HG� FRGH� LPSRUW�� DFKLHYHG� E\� VSRRILQJ� WKH� KXPDQ� RSHUDWRU� RI� DVHFXUH�V\VWHP��$�SHQHWUDWRU�SUHSDUHG�DQ�DWWUDFWLYH�SURJUDP�IRU�WKH�FRP�SXWHU� RSHUDWRU�� ZKR� DOZD\V� UDQ� ZLWK� V\VWHP� SULYLOHJHV�� 7KH� SURJUDPSULQWHG�D�SLFWXUH�RQ�WKH�KLJK�VSHHG�SULQWHU�RI�6DQWD�DQG�KLV�UHLQGHHU�³WKH�NLQG�\RX�DOZD\V�VHH�SRVWHG�DW�&KULVWPDV�LQ�DQG�DERXW�WKH�FRPSXWHUIDFLOLW\�� +RZHYHU�� WKHUH� ZDV� D� 7URMDQ� KRUVH� PL[HG� LQ� ZLWK� 'DQFHU�3UDQFHU�� DQG� IULHQGV� WKDW�PRGLILHG� WKH�RSHUDWLQJ� V\VWHP� WR�DOORZ�XQGH�WHFWHG�DFFHVV� IRU� WKH� LQWHUORSHU��%HIRUH�\RX�EHOLWWOH� WKH�FRPSXWHU�RSHUD�WRU·V� IROO\�� FRQVLGHU� \RXU� RZQ� XVH� RI� ´IUHHZDUHµ� SURJUDPV� GRZQORDGHGIURP�\RXU� IDYRULWH�EXOOHWLQ�ERDUG��7KHUH�DUH�DV�PDQ\�XVHU�DQG�RSHUDWRUVSRRIV�DV�WKHUH�DUH�JXOOLEOH�SHRSOH�ORRNLQJ�IRU�´JDLQ�ZLWKRXW�SDLQ�µ�(WHUQDOYLJLODQFH�LV�WKH�SULFH�RI�IUHHGRP�IURP�VSRRI�DWWDFNV��$OVR��LPSURYHG�UROH�DXWKRUL]DWLRQ� FRQWUROV� FDQ� OLPLW� WKH� GDPDJH� SURSDJDWLRQ� RI� VXFK� IODZVIURP�KXPDQ�IRLEOHV�

3HQHWUDWLRQ�DQDO\VLV�IRU�WKH�����V�DQG�EH\RQG

7KLV�HVVD\�FRQFOXGHV�ZLWK�VSHFXODWLRQV�RQ�IXWXUH�GLUHFWLRQV�RI�SHQHWUD�WLRQ�DQDO\VLV��7KH�DVVXPSWLRQ�LV�WKDW�WKH�EDWWOH�EHWZHHQ�WKH�7&%�GHYHO�RSHU� RU� RSHUDWRU� DQG� WKH� KDFNHU� ZLOO� FRQWLQXH� XQDEDWHG�� %HWWHU� OHJDOSURWHFWLRQ�IRU�XVHUV�ZLOO�DOZD\V�WUDLO� WHFKQRORJ\��DQG�WKH�WHFKQRORJ\�ZLOOLPSURYH� IRU� ERWK� DQWDJRQLVWV�� ,W� ZLOO� EH� FRQWLQXRXV� GLJLWDO� HOHFWURQLFZDUIDUH� DPRQJ� VHFXULW\� PHDVXUHV�� KDFNHU� DWWDFNV�� XVHU� FRXQWHUPHD�VXUHV��DQG�VHFXULW\� FRXQWHU�FRXQWHUPHDVXUHV��SHUSHWXDO� RIIHQVH�DJDLQVWGHIHQVH�7KH�GHIHQVH��GHYHORSHUV�RI�7&%V��DUH�XVLQJ�EHWWHU�PHWKRGV�RI�GHVLJQLQJ

DQG�LPSOHPHQWLQJ�WUXVWHG�V\VWHPV��/HVVRQV�DUH�EHLQJ�OHDUQHG�IURP�SDVWSHQHWUDWLRQV��ERWK�WHVWV�DQG�UHDO�DWWDFNV��7KH�JHQHULF�IODZV�DUH�OHDGLQJ�WREHWWHU�XQGHUVWDQGLQJ�RI�VHFXULW\�SROLF\� IRU�FRQILGHQWLDOLW\�� LQWHJULW\��DQGVHUYLFH�DYDLODELOLW\��DQG�RI�WKH�FRQILQHPHQW�RI�RYHUW�DQG�FRYHUW�FKDQQHOVZKHQ� VKDULQJ� FRPPRQ� PHFKDQLVPV� LQ� WUXVWHG� V\VWHPV�� 7KLV� XQGHU�

Page 25: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

VWDQGLQJ�LV�EHLQJ�FDSWXUHG�LQ�LPSURYHG�PDFKLQH�DUFKLWHFWXUHV�ZLWK�VHJ�UHJDWHG� SULYLOHJH� GRPDLQV� RU� SURWHFWLRQ� ULQJV� WR� UHLQIRUFH� VHFXULW\� SH�ULPHWHUV�DQG�ERXQGDU\�FURVVLQJV��,PSURYHG�KDUGZDUH�VXSSRUWV�VDIH�DQGUDSLG�FRQWH[W�VZLWFKLQJ�DQG�REMHFW�YLUWXDOL]DWLRQ��&U\SWRJUDSK\�LV�SOD\LQJD� ODUJHU� UROH� LQ� FRQILGHQWLDOLW\�� LQWHJULW\�� DQG� DXWKHQWLFDWLRQ� FRQWUROV�&RPSXWHUV�DUH� JHWWLQJ� IDVWHU�DQG�FKHDSHU� VR� WKDW� VHFXULW\�PHFKDQLVPVZLOO� EH� KDUGZDUH�ULFK� DQG� QRW� OLPLW� SHUIRUPDQFH� LQ� VHFXUH� VROXWLRQV�6RIWZDUH� LV� LPSURYLQJ�LQ�TXDOLW\��WRROV��GHYHORSPHQW�HQYLURQPHQWV�� WHVW�LQJ�VWDQGDUGV��DQG�IRUPDOLVP�

$SSOLFDELOLW\�RI�)+0�WR�,76(&��,W�KDV�EHHQ�TXHVWLRQHG�ZKHWKHU�SHQH�WUDWLRQ�WHVWLQJ�KDV�PHDQLQJ�IRU�D�7DUJHW�RI�(YDOXDWLRQ��72(��RI�WKH�(XUR�SHDQ�,QIRUPDWLRQ�7HFKQRORJ\�6HFXULW\�(YDOXDWLRQ�&ULWHULD��,76(&���VLQFH´SHQHWUDWLRQ� WHVWLQJµ� RU� LWV� HTXLYDOHQW� QHYHU� DSSHDU� LQ� WKH� FULWHULD>,76(��@��)RU�PRVW�RI� WKH�UHDVRQV�H[SUHVVHG�HDUOLHU� LQ� WKLV�HVVD\��SHQH�WUDWLRQ� WHVWLQJ� ZLOO� EH� UHTXLUHG� IRU� ,76(&� KLJK�DVVXUDQFH� HYDOXDWLRQV�+RZHYHU�� WKH� ,76(&� LV�GLIIHUHQW� IURP� WKH�7&6(&�DQG� WKH� 7&6(&� LQWHU�SUHWDWLRQV��7KH�DSSOLFDELOLW\�RI�)+0�WR�,76(&�IRU�WKH�����V�LV�GLVFXVVHGKHUH�$�72(�LV�HLWKHU�D�VHFXULW\�SURGXFW�RU�D�V\VWHP�WR�EH�HYDOXDWHG��3HQH�

WUDWLRQ�WHVWLQJ�RI�D�72(�LV�FRPSDUDEOH�LQ�VFRSH�WR�SHQHWUDWLRQ�WHVWLQJ�LQDFFRUGDQFH�ZLWK�WKH�7&6(&��+RZHYHU��D�72(·V�HYDOXDWLRQ�FULWHULD�FRQVLVWRI�WZR�WXSOHV��)L��(M���)L�LV�RQH�RI����VHFXULW\�IXQFWLRQDOLW\�FODVVHV��DQG�(MLV� RQH� RI� VHYHQ� LQGHSHQGHQW� HYDOXDWLRQ� OHYHOV�� 7R� PDWFK� WKH� 7&6(&FODVVHV�RI�)+0� LQWHUHVW��ZH�KDYH� WKH� WZR�WXSOHV� �)���(���� �)���(���� DQG�)���(����ZKLFK�FRUUHVSRQG�WR�%���%���DQG�$���UHVSHFWLYHO\��7KH�ILUVW�ILYHIXQFWLRQDO�FODVVHV�RI�WKH�,76(&��)��WKURXJK�)���PDWFK�WKH�VL[�IXQFWLRQDOFODVVHV�RI�WKH�7&6(&��&��WKURXJK�$���ZLWK�)��IXQFWLRQDOLW\�WKH�VDPH�IRU%��DQG�$��7KH� VHYHQ� ,76(&� HYDOXDWLRQ� FODVVHV� DUH� DSSOLHG� WR� WKH� 72(�'HYHORS�

PHQW�3URFHVV��'3���'HYHORSPHQW�(QYLURQPHQW��'(���DQG�2SHUDWLRQDO�(Q�YLURQPHQW��2(���HDFK�RI�ZKLFK�LV�IXUWKHU�GLYLGHG�DV�IROORZV�

� '3�� 5HTXLUHPHQWV�� DUFKLWHFWXUDO� GHVLJQ�� GHWDLOHG� GHVLJQ�� LPSOH�PHQWDWLRQ�

� '(��&RQILJXUDWLRQ�FRQWURO��SURJUDPPLQJ�ODQJXDJHV�DQG�FRPSLOHUV�GHYHORSHU�VHFXULW\�

� 2(��'HOLYHU\�DQG�FRQILJXUDWLRQ��VHWXS�DQG�RSHUDWLRQ�

7KH� ,76(&� LV�VR�QHZ� WKHUH� LV�QR�SUDFWLFDO� H[SHULHQFH� WR�GUDZ� IURP� LQORRNLQJ�DW�WKH�DSSOLFDELOLW\�RI�)+0��VR�ZH� ORRN�PRUH�FORVHO\�DW� WKH�WH[W�$OWKRXJK� SHQHWUDWLRQ� WHVWLQJ� LV� QRW� PHQWLRQHG�� WHVWLQJ� LV� ZLGHO\� UHIHU�HQFHG��SDUWLFXODUO\� IRU� WKH�HYDOXDWRU� WR�SHUIRUP�´KLV� RZQ� WHVWV� WR� FKHFNWKH�FRPSUHKHQVLYHQHVV�DQG�DFFXUDF\�RI�WKH�VSRQVRU�WHVWLQJ��DQG�DOVR�WRDGGUHVV� DQ\� SRLQWV� RI� DSSDUHQW� LQFRQVLVWHQF\� RU� HUURU� IRXQG� LQ� WKH� UH�

Page 26: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

VXOWV� RI� WKH� VSRQVRU·V� WHVWLQJµ� >,76(��@�� 7HVWLQJ� IRU� HUURUV� DQG� YXOQHU�DELOLWLHV� LV� UHTXLUHG� HYHQ� DW� HYDOXDWLRQ� FODVV� (��� UHWHVWLQJ� RI� FRUUHFWHGIODZV� LV� UHTXLUHG�DW�(��� LQGHSHQGHQW� YXOQHUDELOLW\� DQDO\VLV� LV�QHHGHG�DW(��� DQG� DOO� WKHVH� UHTXLUHPHQWV� DUH� FXPXODWLYH� ZLWK� KLJKHU� HYDOXDWLRQFODVVHV��7KHVH�WHVW�UHTXLUHPHQWV�DUH�TXLWH�VLPLODU�WR�WKRVH�DGGUHVVHG�E\WKH�)+0�GHVFULEHG�LQ�WKLV�HVVD\�$VVXUDQFH�RI� D�72(� LV�GLYLGHG� LQ� WKH� ,76(&�EHWZHHQ�FRUUHFWQHVV�DQG

HIIHFWLYHQHVV��&RUUHFWQHVV�LV�EDVHG�RQ�WKH�VHYHQ�HYDOXDWLRQ�FODVVHV�(��WR(���(IIHFWLYHQHVV�RI�D�72(�LQYROYHV�D�QXPEHU�RI�FRQVLGHUDWLRQV��WKH�VXLW�DELOLW\�RI�WKH�VHFXULW\�IXQFWLRQDOLW\�IRU�WKH�SURSRVHG�HQYLURQPHQW��DQDOR�JRXV� WR� WKH� 7&6(&� HQYLURQPHQW� JXLGHOLQHV� >&6&��@�� ZKHWKHU� WKHIXQFWLRQDOLW\�\LHOGV�D�VRXQG�VHFXULW\�DUFKLWHFWXUH��HDVH�RI�XVH�RI�VHFXULW\IXQFWLRQV��DVVHVVPHQW�RI�WKH�VHFXULW\�YXOQHUDELOLWLHV�GXULQJ�GHYHORSPHQWDQG�RSHUDWLRQ��DQG�WKH�VWUHQJWK�RI�WKH�VHFXULW\�PHFKDQLVPV�WR�UHVLVW�DW�WDFN�� $OO� WKHVH� LWHPV� DUH� ´JHQHUDWRUVµ� LQ� )+0� �VHH� WKH� HDUOLHU� VHFWLRQ´)ODZ�JHQHUDWLRQµ��7KH� )+0�GHSHQGV� RQ� GLVFRYHULQJ� IDLOXUHV� LQ� WKH� HYLGHQFH� LPSOLFDWLRQ

FKDLQ�� VWDUWLQJ�ZLWK� D� VHFXULW\� SROLF\� �VHH� WKH� HDUOLHU� VHFWLRQ� ´(YLGHQFHLPSOLFDWLRQ� FKDLQµ��� 7KH� DSSOLFDWLRQ� RI� )+0� WR� D� 72(� ZRXOG� UHTXLUH� DVLPLODU�SURFHGXUH��$�72(�KDV�D�KLHUDUFK\�RI�VHFXULW\�SROLFLHV��D�6\VWHP6HFXULW\� 3ROLF\� �663��� D� 6\VWHP� (OHFWURQLF� ,QIRUPDWLRQ� 6HFXULW\� 3ROLF\�6(,63��� DQG� D� 6HFXULW\� 3ROLF\� 0RGHO� �630��� FRUUHVSRQGLQJ� WR� VHFXULW\REMHFWLYHV��GHWDLOHG�VHFXULW\�HQIRUFHPHQW�PHFKDQLVPV��DQG�D�VHPLIRUPDOSROLF\�PRGHO��UHVSHFWLYHO\��7KHVH�SROLFLHV�DUH�WLHG�WR�WKH�IXQFWLRQDO�FODVVHVDQG�IRUP�WKH�EDVLV�IRU�WKH�FRUUHFWQHVV�FULWHULD�IRU�WHVWLQJ��7RJHWKHU�ZLWKWKH�HYDOXDWLRQ�FODVVHV��DQ�HYLGHQFH�LPSOLFDWLRQ�FKDLQ�LV�IRUPHG�IRU�D�VSH�FLILF�72(��DQG�)+0�FDQ�EH�VXFFHVVIXOO\�DSSOLHG�,Q� FRQFOXVLRQ�� )+0� VKRXOG� EH� HTXDOO\� DV� DSSOLFDEOH� WR� ,76(&� DV� WR

7&6(&�71,�7',� HYDOXDWLRQV��8QGHU� ERWK� VHWV� RI� FULWHULD�� WKH�PRVW� VLJ�QLILFDQW�RSHQ�TXHVWLRQ� LV��+RZ�DUH�HYDOXDWRUV� WR� MXGJH� WKH�VHFXULW\�RI�DV\VWHP� FRPSRVHG� RI� LQGLYLGXDOO\� HYDOXDWHG� FRPSRQHQWV"� 7KH� FRPSRV�DELOLW\� FRQWURYHUV\� LV� EH\RQG� WKH� VFRSH� RI� WKLV� HVVD\��+RZHYHU�� )+0� LVDSSOLFDEOH� WR� VXFK� FRPSRVHG� V\VWHPV� DQG� PD\� EH� SDUW� RI� WKH� FRQWUR�YHUV\·V�UHVROXWLRQ�

)RUPDO�PHWKRGV�RI�SHQHWUDWLRQ�WHVWLQJ��)RUPDO�PHWKRGV�XVH�ULJRURXVPDWKHPDWLFDO� VSHFLILFDWLRQV�RI� WKH� 7&%�GHVLJQ� �WKDW� LV�� )7/6��� DVVXPS�WLRQV��LQLWLDO�FRQGLWLRQV��DQG�FRUUHFWQHVV�FULWHULD��)RUPDO�WRROV�WDNH�WKHVHVSHFLILFDWLRQV�DQG�JHQHUDWH�FRUUHFWQHVV�WKHRUHPV�DQG�SURRIV�RI�WKH�WKHR�UHPV�DQG�WKH�GHVLJQ�WKH\�SRUWUD\��,W�LV�KRSHG�WKDW�WKHVH�IRUPDO�PHWKRGVFDQ� DFKLHYH� VLPLODU� VXFFHVV� DW� WKH� OHYHO� RI� FRGH� SURRIV�� $� QHZ� IRUP� RISHQHWUDWLRQ� DQDO\VLV� LV� LQ� SURJUHVV� ZLWK� QHZ� 7&%� GHVLJQV� ³� ULJRURXVIRUPDO�PRGHOV� RI� WKH� 7&%�� 7KHVH�PRGHOV� GHVFULEH� WKH� 7&%� EHKDYLRU� DVVWDWH�PDFKLQHV�� VWDWH�WUDQVLWLRQ� UXOHV�� VHFXULW\� LQYDULDQWV�� LQLWLDO� FRQGL�WLRQV��DQG�WKHRUHPV�WKDW�PXVW�EH�SURYHQ��3HQHWUDWLRQ�DQDO\VLV�LV�DOPRVW

Page 27: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

LQVHSDUDEOH� IURP� WKH� IRUPDO� GHVLJQ� SURFHVV�� SURGXFLQJ� FRQMHFWXUHV� RIIODZV�ZLWK�WKH�PRGHO�DQG�WU\LQJ�WR�SURYH�WKHP�DV�WKHRUHPV��7KLV�LV�D�ULJ�RURXV�H[WHQVLRQ�RI�)+0��,I�VXFFHVVIXO��WKH�FRUUHFWQHVV�SURRI�YHUVXV�IODZFRQMHFWXUH�SURRI�EHFRPHV�SDUW�RI�WKH�GHVLJQ�SURFHVV�DQG�XQFRYHUV�SURE�OHPV� HDUO\� LQ� WKH� GHVLJQ�� HQDEOLQJ� LWHUDWLYH� UHGHVLJQ� ³� XQOLNH� )+0�ZKLFK�RIWHQ�FRPHV�WRR�ODWH�LQ�WKH�GHYHORSPHQW�F\FOH�WR�SHUPLW�PRUH�WKDQKDFN�DQG�SDWFK�5HFHQW� ZRUN� E\� *XSWD� DQG� *OLJRU� VXJJHVWV� D� WKHRU\� RI� SHQHWUDWLRQ�

UHVLVWDQW�V\VWHPV��7KH\�FODLP�WKHLU�PHWKRG�LV�´D�V\VWHPDWLF�DSSURDFK�WRSHQHWUDWLRQ� DQDO\VLVµ� WKDW� ´HQDEOHV� WKH� YHULILFDWLRQ� RI� SHQHWUDWLRQ�UHVLVWDQFH� SURSHUWLHV�� DQG� LV� DPHQDEOH� WR� DXWRPDWLRQµ� >*837$���*837$��@��7KH\�VSHFLI\�D�IRUPDO�VHW�RI�GHVLJQ�SURSHUWLHV�WKDW�FKDUDFWHU�L]H�UHVLVWDQFH�WR�SHQHWUDWLRQ�LQ�WKH�VDPH� IUDPHZRUN�XVHG�WR�VSHFLI\� WKHVHFXULW\�SROLF\�HQIRUFHPHQW�PRGHO�³�D�VHW�RI�GHVLJQ�SURSHUWLHV��D�VHW�RIPDFKLQH�VWDWHV��VWDWH�LQYDULDQWV��DQG�D�VHW�RI�UXOHV�IRU�DQDO\VLV�RI�SHQH�WUDWLRQ� YXOQHUDELOLW\�� )LYH� SHQHWUDWLRQ�UHVLVWDQFH� SURSHUWLHV� DUH� GH�VFULEHG�

�� V\VWHP�LVRODWLRQ��WDPSHUSURRIQHVV���� V\VWHP�QRQFLUFXPYHQWDELOLW\��QR�E\SDVV���� FRQVLVWHQF\�RI�V\VWHP�JOREDO�YDULDEOHV�DQG�REMHFWV��� WLPLQJ�FRQVLVWHQF\�RI�FRQGLWLRQ��YDOLGDWLRQ��FKHFNV��DQG�� HOLPLQDWLRQ�RI�XQGHVLUDEOH�V\VWHP�XVHU�GHSHQGHQFLHV�

*XSWD� DQG�*OLJRU� FRQWHQG� V\VWHP� IODZV� ´DUH� FDXVHG� E\� LQFRUUHFW� LP�SOHPHQWDWLRQ�RI�WKH�SHQHWUDWLRQ�UHVLVWDQFH�SURSHUWLHV�>WKDW@�FDQ�EH�LGHQ�WLILHG� LQ� V\VWHP� �H�J��� 7&%�� VRXUFH� FRGH� DV� SDWWHUQV� RI� LQFRUUHFW�DEVHQWYDOLGDWLRQ�FKHFN�VWDWHPHQWV�RU�LQWHJUDWHG�IORZV�WKDW�YLRODWH�WKH�LQWHQGHGGHVLJQ�RU�FRGH�VSHFLILFDWLRQV�µ�7KH\�IXUWKHU�LOOXVWUDWH�KRZ�WKH�PRGHO�FDQEH�XVHG�WR�LPSOHPHQW�DXWRPDWHG�WRROV�IRU�SHQHWUDWLRQ�DQDO\VLV��7KH\�GH�VFULEH� DQ� $XWRPDWHG� 3HQHWUDWLRQ� $QDO\VLV� �$3$�� WRRO� DQG� WKHLU� H[SHUL�PHQWV�ZLWK�LW�RQ�6HFXUH�;HQL[�VRXUFH�FRGH��(DUO\�UHVXOWV�IURP�WKLV�ZRUNLQGLFDWH�WKDW�SHQHWUDWLRQ�UHVLVWDQFH�GHSHQGV�RQ�PDQ\�SURSHUWLHV�EH\RQGWKH�UHIHUHQFH�PRQLWRU��LQFOXGLQJ�WKH�GHYHORSPHQW�DQG�SURJUDPPLQJ�HQYL�URQPHQW��ZKLFK�LV�FKDUDFWHUL]HG�DV�WKH�HYLGHQFH�LPSOLFDWLRQ�FKDLQ�HDUOLHULQ�WKLV�HVVD\��$OWKRXJK�OLPLWHG�RQO\�WR�VRIWZDUH�DQDO\VLV�RI�DWWDFNV�RQ�WKH7&%�IURP�XQWUXVWHG�XVHU�FRGH�DQG�OHDYLQJ�VLJQLILFDQW�RWKHU�V\VWHP�DYH�QXHV� IRU� DWWDFN�� WKH� ZRUN� PD\� SDYH� WKH� ZD\� IRU� QHZ� DSSURDFKHV� WREXLOGLQJ�DQG�WHVWLQJ�WUXVWHG�V\VWHPV�DQG�WLS�WKH�EDODQFH�LQ�IDYRU�RI�WKH´JRRG�JX\V�µ

$XWRPDWHG�DLGV��(DUOLHU�� LQ� WKH� LQIDQF\�RI�SHQHWUDWLRQ� WHVWLQJ�� LW�ZDVEHOLHYHG�WKDW�IODZV�ZRXOG�IDOO�LQWR�UHFRJQL]DEOH�SDWWHUQV��DQG�WRROV�FRXOGEH� EXLOW� WR� VHHN� RXW� WKHVH� JHQHULF� SDWWHUQV� GXULQJ� SHQHWUDWLRQ� WHVWLQJ>$%%2����&$5/����+2//����75$7��@��8QIRUWXQDWHO\�� WKH� ODUJH�QXPEHU

Page 28: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

��� ,QIRUPDWLRQ�6HFXULW\

RI� GLIIHUHQW� SURFHVVRUV�� RSHUDWLQJ� V\VWHPV�� DQG� SURJUDPPLQJ� ODQJXDJHVXVHG� WR�EXLOG�7&%V��ZLWK� WKHLU�GLIIHUHQW� V\QWD[�DQG� VHPDQWLFV��PDGH� LWGLIILFXOW� DQG� LPSUDFWLFDO� WR� DSSO\� VXFK� SDWWHUQ�PDWFKLQJ� WRROV� WR� SHQH�WUDWLRQ�WHVWLQJ��,W�LV�FRVWO\�WR�SRUW�RU�UHLPSOHPHQW�WKH�WRROV�IRU�HDFK�QHZHQYLURQPHQW�DQG�GLIIHUHQW�SURJUDPPLQJ�ODQJXDJH��$OVR��WKH�IODZ�SDWWHUQVWHQGHG�WR�EH�V\VWHP�VSHFLILF�$V�PRGHUQ�VHFXUH�V\VWHPV�IRFXV�RQ�D�IHZ�RSHUDWLQJ�V\VWHP�VWDQGDUGV

�IRU�H[DPSOH��8QL[�DQG�06�'26��DQG�IHZHU�SURJUDPPLQJ�ODQJXDJHV��$GDDQG�&���DQG�PRUH�PDWXUH�H[SHUW�V\VWHPV�EHFRPH�DYDLODEOH��IXWXUH�SHQH�WUDWLRQ�WHVWLQJ�WRRO�LQLWLDWLYHV�WR�FDSWXUH�IODZ�SDWWHUQV�PD\�EH�PRUH�VXF�FHVVIXO�� $� IHZ� VSHFLILF� H[DPSOHV� RI� WKLV� WUHQG� DUH� EHJLQQLQJ� WR� DSSHDU�DQWLYLUXV�WRROV� IRU�WKH�SRSXODU�ZRUNVWDWLRQV�DQG�3&V��8QL[�VHFXULW\� WHVWWRROV� >)$50��D�� 08))�D@�� LQWUXVLRQ� GHWHFWLRQ� PRQLWRUV� >'(11���60$+����%$8(����',$6����/817����:,1.��@��DQG�IRUPDO�VSHFLILFDWLRQSURRI�WRROV�>.(00��@��IORZ�DQDO\]HUV�>(&.0����.5$0��@��DQG�V\PEROLFH[HFXWLRQ�WRROV�>(&.0����:+((��@�

Page 29: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���

Page 30: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman
Page 31: Penetration Testing - The University of Tennessee at ...web2.utc.edu/~djy471/CPSC4670/11-penetration-testing.pdf · 3HQHWUDWLRQ7HVWLQJ ˇ˝ Essay 11 Penetration Testing Clark Weissman

3HQHWUDWLRQ�7HVWLQJ ���