Penetration Test Report (PrimoConnect): SAMPLE+Security+Testing+Findings

PENETRATION TEST REPORT
Prepared by PrimoConnect
Prepared for: SAMPLECORP LTD
v1.0 September | 30 | 2018
SampleCorp LTD
PrimoConnect
Email: info@primoconnect.co.uk - Web: www.primoconnect.co.uk Phone: 0[PII_REDACTED]
SampleCorp – Penetration Test Report
PrimoConnect
0[PII_REDACTED]
www.primoconnect.co.uk
SAMPLECORP LTD
123 North Street
London, N1 2AB
01234 567 890
www.samplecorp.com
No warranties, express or implied are given by PrimoConnect with respect to accuracy, reliability,
quality, correctness, or freedom from error or omission of this work product, including any implied
warranties of merchantability, fitness for a specific purpose or non-infringement. This document is
delivered "as is", and PrimoConnect shall not be liable for any inaccuracy thereof. PrimoConnect does
not warrant that all errors in this work product shall be corrected. Except as expressly set forth in any
master services agreement or project assignment, PrimoConnect is not assuming any obligations or
liabilities including but not limited to direct, indirect, incidental or consequential, special or exemplary
damages resulting from the use of or reliance upon any information in this document. This document
does not imply an endorsement of any of the companies or products mentioned.
©2018 PrimoConnect. All rights reserved. No part of this document may be reproduced, copied or
modified without the express written consent of the authors. Unless written permission is expressly
granted for other purposes, this document shall be treated at all times as the confidential and proprietary
material of PrimoConnect and may not be distributed or published to any third-party.
PrimoConnect Commercial in confidence | i
SampleCorp – Penetration Test Report
TABLE OF CONTENTS
Document Control iv
Executive Summary 1
Test Scope 1
Results 1
Recommendations 2
Testing Approach 3
Overview 3
Discovery & Reconnaissance 4
Validation & Exploitation 4
Internal Network Findings 5
Scope 5
Network Penetration Testing Results 5
Services by Host and by Port 5
Vulnerability Summary Table 8
Details 9
Web Application Findings 20
Scope 20
Web Application Results 20
Web Application Detailed Findings 21
Vulnerability Summary Table 21
Details 21
Wireless Network Findings 27
Scope 27
Wireless Network Results 27
Access via Wi-Fi Penetration Testing Device 27
Wireless Network Reconnaissance 27
Wireless Network Penetration Testing 28
Mobile Applications Findings 30
Scope 30
Application Results 30
Application Detailed Findings 30
Vulnerability Summary Table 30
Details 31
Social Engineering Findings 37
Scope 37
Social Engineering Results 37
Social Engineering Detailed Findings 38
Email Exposure Report 38
Spear Phishing Report 1 38
PrimoConnect Commercial in confidence | ii
SampleCorp – Penetration Test Report
Voice Phishing Report 40
Malicious USB Payloads 48
Limitations & Risk Scoring 50
Limitations 50
Risk Rating Score Calculation 50
Risk Rating Scale 51
Appendix 52
PrimoConnect Commercial in confidence | iii
SampleCorp – Penetration Test Report
DOCUMENT CONTROL
Issue Control
Document Reference n/a Project Number n/a
Issue 1.0 Date 30 October 2017
Classification Confidential Author Name Of Author
Document Title SampleCorp Penetration Test
Approved by
Released by Name Of Tester
Owner Details
Name Name Of Owner
Office/Region
Contact Number 01234 567 890
E-mail Address name@primoconnect.co.uk
Revision History
Issue Date Author Comments
1.0 30 September Name Of Author
2018
PrimoConnect Commercial in confidence | iv
SampleCorp – Penetration Test Report
EXECUTIVE SUMMARY
PrimoConnect conducted a comprehensive security assessment of SampleCorp LTD in order to
determine existing vulnerabilities and establish the current level of security risk associated with the
environment and the technologies in use. This assessment harnessed penetration testing and social
engineering techniques to provide SampleCorp management with an understanding of the risks and
security posture of their corporate environment.
TEST SCOPE
The test scope for this engagement included three hosts on the company’s internal network, a business-
critical web application, as well as an internally-developed mobile application. In addition, SampleCorp
requested a wireless audit be performed against their Wi-Fi infrastructure, to discover any insecure
wireless protocols, unsecured networks, or related security issues. A social engineering assessment was
also requested, to judge the responsiveness of company staff when facing a phishing attack.
Testing was performed September 1 – September 21, 2018. Additional days were utilized to produce
the report.
Testing was performed using industry-standard penetration testing tools and frameworks, including
Nmap, Sniper, Fierce, OpenVAS, the Metasploit Framework, WPScan, Wireshark, Burp Suite, Tcpdump,
Aircrack-ng, Reaver, Asleap, and Arpspoof.
RESULTS
The table below includes the scope of the tests performed, as well as the overall results of penetration
testing these environments.
Environment Tested Testing Results
Internal Network CRITICAL
Wireless Network LOW
Web Application HIGH
Mobile Application HIGH
Social Engineering Exercises LOW
To test the security posture of the internal network, we began with a reconnaissance and host discovery
phase during which we used portscans, ARP scans, and OSINT tools to fingerprint the operating systems,
software, and services running on each target host. After fingerprinting the various targets and
determining open ports and services enabled on each host, we executed a vulnerability enumeration
phase, in which we listed all potential vulnerabilities affecting each host and developed a list of viable
attack vectors. Finally, in order to weed out false positives and validate any remaining vulnerabilities,
we attempted to exploit all vulnerabilities affecting the target hosts. After comprehensive testing, only
a few vulnerabilities were discovered to be present in the target hosts, and we were ultimately unable
to exploit these issues to compromise the confidentiality, integrity, or availability of any of the external
hosts in scope.
PrimoConnect Commercial in confidence | 1
SampleCorp – Penetration Test Report
Multiple Critical- and High- and Medium-severity issues were found affecting hosts on the SampleCorp
internal network, which require immediate remediation efforts in order to secure the company’s
environment against malicious attackers.
To test the security posture of the wireless networks in scope, we performed a number of different scans
and attempted a range of attacks. Through a rigorous analysis, we found no vulnerabilities affecting the
wireless network configuration. The wireless networks have been configured and secured to a high
standard.
To test the security of the company’s Android application, we attached a debugging and exploitation
framework to a phone with the app installed. Serious security issues were found to affect the app, and
we suggest halting use of the app until it is either re-engineered in a more secure manner, or a suitable
replacement is found.
To test the company’s preparedness and response to social engineering attacks, we began by utilizing
OSINT techniques to scrape the company’s website and social media accounts for target emails. Next,
we launched spear phishing campaigns using spoofed email addresses, voice phishing attacks, and
physical social engineering attacks using USB sticks loaded with malicious payloads. Although 35.7% of
the targeted employees did end up responding to the phishing emails, none of the malicious USBs were
plugged in, and no one responded to the voice phishing messages. All in all, SampleCorp appears
relatively prepared to defend against social engineering attacks.
RECOMMENDATIONS
The following recommendations provide direction on improving the overall security posture of
SampleCorp’s networks and business-critical applications:
1. Ensure that the credentials protecting the Glassfish instance on host 172.16.2.8 are of suitable
comp