During the last decade, technology environments based on cloud services have become key components within companies that increasingly migrate their services and/or systems to providers of this type of service.
The Cloud Environment Penetration Test covers the need for external security actions, considering the technological particularities, limitations, and considerations that must be taken into account when performed on cloud services, simulating the actions of an attacker attempting to compromise services, applications, or components, always using the tools and methodologies used by hackers, but in an ethical manner.
At Internet Security Auditors, we provide the most appropriate security solutions for all areas of Information Systems, with audit projects based on Ethical Hacking being one of them.
The best way to perform this security assessment is by conducting controlled attacks on the systems. These can be carried out remotely (from Internet Security Auditors’ facilities) or from the client’s facilities, depending on the objectives and scope of the audit.
During the execution of a Penetration Test, different phases must be carried out. Each of them requires multiple actions and considerations. The following sections cover each of these phases and describe the action guidelines.
A Penetration Test consists of the following phases:
PLANNING
Definition and identification of the systems to be audited.
AUDIT
Execution of the tests, which are carried out progressively until intrusion is achieved and, once achieved, escalation within the systems.
DOCUMENTATION
Drafting of all results obtained.
To carry out these attacks, both techniques and hacking tools will be used. The tools will be the same as those used in the underground world by hackers to perform attacks, as well as tools created by the technical team at Internet Security Auditors to perform Penetration Tests, developed based on guidelines defined in the OSSTMM, ISSAF, and PTES standards.
Identification of services, operating systems, and network components:
- Enumeration and identification of live hosts.
- Port scanning and identification of their state (open, closed, filtered).
- Identification of protocols.
- Identification of platform and version installed on the services running on each open port.
- Identification of platform and operating system version.
Update analysis:
- Identification of installed versions on different systems.
- Port scanning and identification of their state (open, closed, filtered).
- Search for vulnerabilities affecting detected versions.
- Manual exploitation of vulnerabilities.
Configuration analysis:
- Detection and identification of default parameters in configuration.
- Detection of enabled debugging options.
- Detection of poor configurations.
- Use of default access credentials.
- Manual exploitation of vulnerabilities.
Authentication system analysis:
- Identification of all services using any type of authentication.
- Validation of credential transmission over an encrypted channel.
- Validation of account lockout mechanisms.
- Identification of protections against automated attacks.
- Verification of absence of default or weak passwords.
Information gathering:
- Searching for information on the Internet.
- Platform identification.
- Search for robots.txt and humans.txt.
- Information leaks in the application.
- Identification of application entry points.
Authentication system analysis:
- Identification of all services using any type of authentication.
- Validation of credential transmission over an encrypted channel.
- Validation of account lockout mechanisms.
- Identification of protections against automated attacks.
- Validation of credential recovery process.
- Authentication system bypass.
- Verification of absence of default or weak passwords.
Infrastructure configuration analysis:
- Identification of administration tools.
- Verification of default credentials.
- Identification of example resources.
- Identification of backup and unreferenced files.
- Identification of supported HTTP methods.
- Identification of HSTS header (HTTP Strict Transport Security).
- Identification of anti-clickjacking protections.
Identity management analysis:
- Verification of access policy defined by the application for each existing role.
- Validation of user registration process.
- Verification of predictable user accounts.
- Validation of possibility of enumerating user accounts.
Authorization analysis:
- Identification of path traversal vulnerabilities.
- Identification of RFI (remote file inclusion) vulnerabilities.
- Validation of authorization scheme bypass.
- Validation of insecure direct object references.
Session management analysis:
- Identify cookies used by the application.
- Analyze session tokens.
- Verify cookie attributes.
- Validate existence of persistent cookies.
- Validate logout functionality.
- Validate session expiration after reasonable inactivity.
- Validate session fixation vulnerability.
- Validate exposure of session variables.
- Validate CSRF vulnerability.
Data validation analysis:
- Verify existence of centralized data validation mechanism.
- Confirm application correctly validates data before use.
- Verify absence of vulnerabilities such as SQL Injection or Cross-Site Scripting.
Error management analysis:
- Generate uncontrolled error scenarios.
- Analyze error messages for information leaks.
- Analyze stack traces.
Weak cryptography analysis:
- Validate that sensitive information is not transmitted in clear text.
- Validate that weak ciphers are not used.
- Validate that weak protocols are disabled.
- Validate that insecure SSL/TLS renegotiations are disabled.
- Validate that MD5 is not used (collision attacks).
- Validate that RC4 is not used (crypto-analytical attacks).
- Validate that the server is protected against the BEAST attack.
- Validate that the server is protected against the CRIME attack.
- Validate that the server is protected against the POODLE attack.
- Verify validity of the SSL certificate.
