Penetration Test Report (Cynergi_Solutions): eClipse Bank PLC Security Assessment OSSTMM OWASP

VVuullnneerraabbiilliittyy AAsssseessssmmeenntt &&
PPeenneettrraattiioonn TTeesstt RReeppoorrtt
FFoorr
bbyy
CCyynneerrggii SSoolluuttiioonnss IInncc..
hhttttpp::////wwwwww..ccyynneerrggiissoolluuttiioonnss..ccxxmm
Legal Notice
©© CCyynneerrggii LLiimmiitteedd
AAllll rriigghhttss rreesseerrvveedd 2200XXXX
TThhiiss ddooccuummeenntt ccoonnttaaiinnss ccoonnffiiddeennttiiaall aanndd pprroopprriieettaarryy iinnffoorrmmaattiioonn..
IItt iiss iinntteennddeedd ffoorr tthhee eexxcclluussiivvee uussee ooff eeCClliippssee BBaannkk ..
UUnnaauutthhoorriizzeedd uussee oorr rreepprroodduuccttiioonn ooff tthhiiss ddooccuummeenntt iiss pprroohhiibbiitteedd
CCuurrrreenntt TTeesstt hhaass bbeeeenn ccoonndduucctteedd bbyy CCyynneerrggii''ss sseeccuurriittyy eexxppeerrttss..
CCyynneerrggii aassssuurreess tthhaatt ffiinnddiinnggss iinn tthhiiss rreeppoorrtt aarree ttrruuee ttoo tthhee eexxtteenntt
tthhaatt ccaann bbee vveerriiffiieedd vviiaa tthhee IInntteerrnneett..
TThhiiss VVuullnneerraabbiilliittyy AAsssseessssmmeenntt && PPeenneettrraattiioonn TTeesstt rreevveeaallss aallll
rreelleevvaanntt vvuullnneerraabbiilliittiieess kknnoowwnn uupp ttoo tthhee ddaattee ooff tthhiiss rreeppoorrtt.. AAss
nneeww vvuullnneerraabbiilliittiieess ccoonnttiinnuuee ttoo bbee ffoouunndd aanndd tthhee iinnttrroodduuccttiioonn ooff
nneeww sseeccuurriittyy tthhrreeaattss,, iitt iiss ssuuggggeesstteedd tthhaatt sseeccuurriittyy aasssseessssmmeennttss
bbee ccoonndduucctteedd aafftteerr eevveerryy mmaajjoorr cchhaannggee iinn tthhee IInnffoorrmmaattiioonn
SSyysstteemm aanndd ppeerriiooddiiccaallllyy iinn 33 ttoo 66 mmoonntthh iinntteerrvvaallss..
Document Details
DDooccuummeenntt TTyyppee Security Assessment Report
CClliieenntt eClipse Bank PLC
CCoonnssuullttaanntt Cynergi Solutions Inc.
DDooccuummeenntt VVeerrssiioonn 0.5
CCrreeaattiioonn DDaattee 23/07/20XX
SSeeccuurriittyy AAsssseessssmmeenntt RReeppoorrtt ffoorr eeCClliippssee BBaannkk PPLLCC PPrriivvaattee && CCoonnffiiddeennttiiaall 22
Revision History
VVeerrssiioonn DDaattee AAuutthhoorr CChhaannggee DDeessccrriippttiioonn
0.5 23/07/20XX Cynergi Solutions Inc. Document Created
Acknowledgment
NNaammee CCoommppaannyy FFuunnccttiioonn LLooccaattiioonn EEmmaaiill
Contact
For more information about this Document and its contents please contact Cynergi Professional
Services
NNaammee F.X One
AAddddrreessss Cynergi Solutions Inc
234 Cynergi Avenue, South Island, Atlantic City.
PPhhoonnee +123[PII_REDACTED]
EE--MMaaiill fx.one@cynergisolutions.cxm
SSeeccuurriittyy AAsssseessssmmeenntt RReeppoorrtt ffoorr eeCClliippssee BBaannkk PPLLCC PPrriivvaattee && CCoonnffiiddeennttiiaall 33
CCOONNTTEENNTT
1.0 Limitations on Disclosure and Use of this report 6
2.0 Executive Summary 7
3.0 Introduction 8
4.0 Network Flow Diagram 15
5.0 Summary of Results 17
6.0 Findings 23
7.0 Conclusion 38
8.0 Appendix 39
SSeeccuurriittyy AAsssseessssmmeenntt RReeppoorrtt ffoorr eeCClliippssee BBaannkk PPLLCC PPrriivvaattee && CCoonnffiiddeennttiiaall 44
11..00 LLIIMMIITTAATTIIOONNSS OONN DDIISSCCLLOOSSUURREE && UUSSEE OOFF TTHHIISS RREEPPOORRTT
This report contains information concerning potential vulnerabilities of eClipse Bank's network and
systems and methods of exploiting them. Cynergi recommends that special precautions be taken to
protect the confidentiality of both this document and the information contained herein. Cynergi has
retained and secured a copy of the report for customer reference. All other copies of the report
have been delivered to eClipse Bank. Security assessment is an uncertain process, based upon
past experiences, currently available information, and known threats. It should be understood that
all information systems, which by their nature are dependent on human beings, are vulnerable to
some degree.
Therefore, while Cynergi considers the major security vulnerabilities of the analyzed systems to
have been identified, there can be no assurance that any exercise of this nature will identify all
possible vulnerabilities or propose exhaustive and operationally viable recommendations to
mitigate those exposures. In addition, the analysis set forth herein is based on the technologies
and known threats as of the date of this report. As technologies and risks change over time, the
vulnerabilities associated with the operation of eClipse Bank's systems described in this report, as
well as the actions necessary to reduce the exposure to such vulnerabilities, will also change.
Cynergi makes no undertaking to supplement or update this report on the basis of changed
circumstances or facts of which Cynergi becomes aware after the date hereof, absent a specific
written agreement to perform supplemental or updated analysis.
This report may recommend that eClipse Bank use certain software or hardware products
manufactured or maintained by other vendors. Cynergi bases these recommendations upon its
prior experience with the capabilities of those products. Nonetheless, Cynergi does not and cannot
warrant that a particular product will work as advertised by the vendor, nor that it will operate in the
manner intended. This report was prepared by Cynergi for the exclusive use and benefit of eClipse
Bank and is deemed proprietary information. The Professional Service Level Agreement (SLA) in
effect between Cynergi and eClipse Bank governs the disclosure of this report to all other parties.
SSeeccuurriittyy AAsssseessssmmeenntt RReeppoorrtt ffoorr eeCClliippssee BBaannkk PPLLCC PPrriivvaattee && CCoonnffiiddeennttiiaall 55
22..00 EEXXEECCUUTTIIVVEE SSUUMMMMAARRYY
This report presents the results of the vulnerability assessment and penetration
test of eClipse Bank's Internet banking web application and underlying Internet
and network infrastructure. The Internet banking online application is a web-
based access point for customers both corporate and individuals to conduct
ebusiness. This assessment was performed under the auspices of Cynergi's
CTO F.X One a certified and licensed penetration tester. The purpose of this
assessment is to identify application and network-level security issues that could
affect eClipse Bank's Internet banking application and network infrastructure.
The scope of this exercise includes the testing of the Internet banking application and all of its
functionality. To evaluate the security of the network and application, Cynergi attempted to perform
unauthorized transactions, obtain confidential information, and determine the overall security of the
application by performing a wide variety of vulnerability checks. The testing also included the servers,
operating systems and network devices associated with the bank.
This result is intended to be an overall assessment of the eClipse Bank's network, including that of
applications that fall within the scope of this project. Furthermore, the findings in this report reflect the
conditions found during the testing, and do not necessarily reflect current conditions.
SSeeccuurriittyy AAsssseessssmmeenntt RReeppoorrtt ffoorr eeCClliippssee BBaannkk PPLLCC PPrriivvaattee && CCoonnffiiddeennttiiaall 66
33..00 IINNTTRROODDUUCCTTIIOONN
At the request of eClipse Bank PLC, Cynergi Solutions Inc performed the
security assessment of the web application and underlying network
infrastructure. The purpose of this assessment is to identify network and
application-level security issues as well as vulnerabilities affecting the
servers and network devices providing access to the organization.
The objective of the analysis is to simulate an attack to assess eClipse Bank's immunity level, discover
weak links and provide recommendations and guidelines to vulnerable entities discovered. This report
is a report which contains sub-sections. Each Sub-section discusses in detail all relevant issues and
avenues that can be used by attackers to compromise and gain unauthorized access to sensitive
information. Every issue includes an overview, issues found and security guidelines, which, if followed
correctly, will ensure the confident