Network Security VAPT Checklist

Hi Guys, there are very few technical network security assessment checklist. So I thought to share my own on this. Have a look and enjoy. Lets talk about the scope first. If you are given a 1000 machines to perform VAPT, then here is your scope. Single machine can have 65535 ports open. Any single port can deploy any service software from the world. For example FTP can be run on smartftp, pureftpd etc.. Any single FTP software version (for example pureftpd 1.0.22) can have number of vulnerabilities available. So if you multiply all of these, then it is impossible for any auditor to go ahead and probe all ports manually and find services manually. Even if he/she is able to do it, it is impossible to check all vulnerabilities that are pertaining to a single port of a single machine. Hence we have to rely on scanners such as nexpose, nessus, openvas, coreimpact etc. Here are some quick tools and test cases that one can perform on commonly found ports in the network pentest.

Android Application Backup Vulnerabiility Testing

You must be already knowing about android application backup process. Beauty of this vulnerability is it works on non-rooted devices too sometimes. The vulnerability lies within the AndroidManifest.xml file.

Today we are going to test DIVA (Damn Insecure Vulnerable Application) against this vulnerability. First I had diva-beta.apk file. I unzip that using below command:

Android Anti Java Hooking - Adding Layer to your SSL pinning and Root detection

In this article I am going to highlight the importance of why we must implement anti java hooking technique in our application. What are their advantages and disadvantages.

What is android hooking?

Hooking is a process of injecting malicious payload into existing running process. To illustrate that, assume we have root detection feature in our application. Using rootclock 3rd party application if root detection mechanism can be bypassed. Now mostly all these application which bypasses root detection, ssl pinning etc.. they hook into running application process. So how to be safe against these application? Here comes the android anti java hooking technique.

Blocking Adwares on Android - Protect against malwares and privacy

According to Mcafee, "A company from India has released an advertising software developer kit (SDK) called SilverPush that uses your phone’s microphone to listen for near-ultrasonic sounds placed in TV, radio and Web advertisements. Once SilverPush detects the signal, it collects data from your device and sends information about your device back to the advertiser. While this is not a piece of malware, it is a huge concern from a privacy perspective. It collects personal information from your device, including, but not limited to:

Dirty C0w Vulnerability Demo (CVE-2016-5195) - A privilege escalation vulnerability in the Linux Kernel

Mostly I want to present a demo of dirty cow so I am not going to fall in much theory part. Few basic things about dirty cow is mentioned as below.

Why is it called the Dirty COW bug?

"A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system."

Android Application Hardening Checklist For Developers

This checklist will help android developers to harden their application during the development phase. This checklist is essential for the developers to secure their application while in development phase only. Post development if security analyst/pentester find any loophole then it becomes tedious to dive into the existing code in order to implement the security control if there is no workaround for that loophole.

Xiaomi’s Analytics Application Security & Privacy Concern

You might have heard about the recent blogspot of Reverse Engineering Xiaomi’s Analytics app at  https://www.thijsbroenink.com/2016/09/xiaomis-analytics-app-reverse-engineered/

Summary - Basically there is an application called Analystics which is there by default on every MIUI user's phone. This application runs in background 24*7 and it also re appears without user interaction even if you delete it.

Android Application Security - Using hmacSHA256 Encryption For Tamper Proof Request & Response

It was all started from SSL pinning implementation. I implemented SSL pinning in our application using 3 different method as mentioned below.However I failed to implement using all 3 mechanism for obvious reasons that there are open source tools available to bypass SSL pinning.

For android there are Justtrustme, Android-SSL-TrustKiller. In iOS there is ios-SSL-Killswitch. I posted question over stackoverflow in order to find the concrete solution for the ssl pinning. However, I ended up getting nothing. Link for the stackoverflow is mentioned below.

http://security.stackexchange.com/questions/136017/is-it-possible-to-implement-secure-ssl-pinning-implementation-for-without-server

Below are the methods I tried to implement for ssl pinning.