In this document we describe anything that is not an offer, invoice or pentest.
-It is as generic as generic can be.
-You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).
-Only the company-related placeholders work!
-Mmmm no, that's it.
- -| This is a table |
|---|
| It contains bogus information. |
This is a list:
--
-
- item 1 - see https://www.radicallyopensecurity.com. -
- item 2 -
You get the idea
-Command:
-$ this is a pre (for command line entries)- -
Outcome:
-This is where +
In this document we describe anything that is not an offer, invoice or pentest.
+It is as generic as generic can be.
+You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).
+Only the company-related placeholders work!
+Mmmm no, that's it.
+ +| This is a table |
|---|
| It contains bogus information. |
This is a list:
+-
+
- + item 1 - see + https://www.radicallyopensecurity.com. + +
- item 2 +
You get the idea
+Command:
+$ this is a pre (for command line entries)+ +
Outcome:
+This is where you would write the output I guess.- - - -
Nope.
-+ Let's have a link pointing to + + at this point. +
+ + + + +Nope.
+Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a
+ Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a
Penetration Test of the FishInABarrel Web Application to Radically
Open Security BV (hereafter “ROS”). Sitting Duck has made this
request to better evaluate the security of the application and to
identify application level vulnerabilities in order to see whether
the FishInABarrel Web Application is ready, security-wise, for
production deployment. This report contains our findings as well as detailed explanations of
+ This report contains our findings as well as detailed explanations of
exactly how ROS performed the penetration test. The scope of the Sitting Duck penetration test was limited to the
+ The scope of the Sitting Duck penetration test was limited to the
following target: The penetration test was carried out from a black box perspective: no
+ The penetration test was carried out from a black box perspective: no
information regarding the system(s) tested was provided by Sitting
Duck or FishInABarrel, although FishInABarrel did provide ROS with
two test user accounts. The objective of the security assessment is to gain insight into the
+ The objective of the security assessment is to gain insight into the
security of the host and the FishInABarrel Web Application. The FishInABarrel Security Audit took place between January 14 and
+ The FishInABarrel Security Audit took place between January 14 and
January 16, 2015. During this pentest, we found quite a number of different security
+ During this pentest, we found quite a number of different security
problems – Cross-site Scripting (XSS) vulnerabilities, both stored
and reflected, Cross-site Request Forgery (CSRF) vulnerabilities,
information disclosures (multiple instances), and lack of brute
force protection.
Through automated scans we were able to gain the following information about the
+ Through automated scans we were able to gain the following information about the
software and infrastructure. Detailed scan output can be found in the
sections below. As part of our active reconnaissance we used the following automated
+ As part of our active reconnaissance we used the following automated
scans: Of these, only the output of nmap turned out to be useful; consequently
+ Of these, only the output of nmap turned out to be useful; consequently
only nmap and output will be discussed in this section. Command: Command: Outcome: Outcome: The scan revealed a very large number of open services on this machine,
- which greatly increases the attack surface; see for
- more information on the security risk.
+ The scan revealed a very large number of open services on this machine,
+ which greatly increases the attack surface; see
+
+ for
+ more information on the security risk.
+
-
+
-
- Fingerprinted Information
-
-
- Windows XP
-
Microsoft IIS 6.0
PHP 5.4.29
jQuery
- 1.7.2
Mailserver XYZ
FTPserver ABC
+
-
+
+ Fingerprinted Information
+
+
+
+ Windows XP
+
+ Microsoft IIS 6.0
+ PHP 5.4.29
+ jQuery
+ 1.7.2
+ Mailserver XYZ
+ FTPserver ABC
+
-
-
+
+ $ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
+
$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
fishinabarrel.sittingduck.com
- Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
+
Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
Initiating ARP Ping Scan against 10.10.10.1 [1 port] at 15:43
The ARP Ping Scan took 0.01s to scan 1 total hosts.
@@ -224,126 +259,154 @@ PORT STATE SERVICE
Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)
-
We have identified the following issues:
+We have identified the following issues:
-The phpinfo() function of the PHP language is readable, resulting
+ The phpinfo() function of the PHP language is readable, resulting
in a listing of all the runtime information of the
environment, thus disclosing potentially valuable
information to attackers. This is where the good stuff goes. We give a detailed technical
+
This is where the good stuff goes. We give a detailed technical description of the problem.
-Illustrative picture of an evil hacker pondering dark deeds:
-
- This is where we explain how the sh*t is hitting the fan, +
Illustrative picture of an evil hacker pondering dark deeds:
+
+
+ This is where we explain how the sh*t is hitting the fan, exactly.
-Here is where we write some tips to solve the problem.
-Here is where we write some tips to solve the problem.
+