Penetration Test Report (TrustFoundry): TrustFoundry   Sample   Application Penetration Test   v1.0

EASYTRANSFER
APPLICATION PENETRATION TEST
V1.0
January 16, 2020
BREAKING IT BETTER
TABLE OF CONTENTS
SUMMARY OF WORK PERFORMED 1
Methodology 2
Executive Summary 4
SUMMARY OF FINDINGS 6
Application Penetration Test 7
1. Command Injection 7
2. XML External Entity Expansion 10
3. Improper Cryptography 16
4. Out-of-Date Service 18
5. Self-Signed Certificate 19
6. SSLv3 Enabled 21
7. RC4 Cipher Suites Supported 22
8. Platform Information Disclosed in HTTP Response 23
9. Improper Caching Directives 24
10. Site Lacks Strict Transport Security Policy 27
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 0
BREAKING IT BETTER
SUMMARY OF WORK PERFORMED
An application penetration test was performed on the ABC Financial Amazon EasyTransfer
application. This application consists of a web portal that provides access to account
information and the ability to manage ACH transfers. The following IP address range was
provided by ABC Financial for testing:
● 107.170.68.146
The assessment was completed during the following dates:
Date Task
July 1, 2019 Kickoff Call
July 8, 2019 Testing Started
July 15, 2019 Testing Completed
July 18, 2019 Report Delivered
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 1
BREAKING IT BETTER
Methodology
An Application Penetration Test is designed to identify vulnerabilities in an application
which could negatively impact the organization if exploited by an attacker. Manual and
automated assessment will be conducted using a testing methodology based on expert
knowledge, in combination with information provided by ABC Financial. Application
testing is conducted in accordance with OWASP Top 10, application security best practices,
and internal checklists developed to ensure thorough coverage. TrustFoundry Application
Penetration Testing consists of the following phases:
● Pre-Assessment – TrustFoundry will request access to the systems in advance of
the test and guide the customer through the testing process on a pre-assessment
call.
● Enumeration – Using resources such as DNS, Google, and Bing, TrustFoundry will
look for information that is available that may be helpful to an attacker.
● Unauthenticated Testing – TrustFoundry will evaluate the application from the
perspective of an attacker who does not have authenticated access to the
application.
● Authentication Testing – A large number of vulnerabilities result from weaknesses
in the authentication process. This phase examines the various authentication
mechanisms in place.
● Authenticated Testing – This phase simulates an attacker who has access, or
maliciously obtains access, to credentials to log in to the application.
● Reporting – A report outlining all identified issues will be prepared which focuses
on presenting identified vulnerabilities in a manner which makes them effective to
remediate.
In addition to a variety of open source tools, exploits, and utilities used on an as-needed
basis, the following tools may be used when conducting an Application Penetration Test:
● BeEF Framework ● Reverse Engineering Tools
● Burp Suite Professional o IDA
including various Burp o ILSpy
extensions
o JAD
● dirbuster/gobuster
o JD-GUI
● Google or other search engines
o Hopper
● Mozilla Firefox o Radare2
● Nessus Network Vulnerability o OllyDGB
Scanner
o Windbg
● Nikto
● SSLyze
● nmap
● SQLMap
● padbuster
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 2
BREAKING IT BETTER
● Various payload and fuzzing
lists, such as SecLists and
PayloadAllTheThings
● WPScan
● ysoserial
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 3
BREAKING IT BETTER
Executive Summary
During the application penetration test, ten vulnerabilities were discovered, the most
critical of which is a command injection vulnerability that allows authenticated users to
execute commands on the server’s operating system. Any user of this system who exploits
this vulnerability could compromise sensitive data, and likely compromise the affected
system. The second high-severity finding allows an attacker to read arbitrary files on the
filesystem as a result of an XML processing weakness. The third high-severity finding is a
cryptographic weakness that allows an attacker to bypass the reset password process,
which allows an attacker to compromise any other user’s account. The last high-severity
finding is that the version of Apache is out of date, and could be exploitable in unique
circumstances, although exploitation was not successful in testing.
Many of the remaining vulnerabilities relate to insecure SSL configuration on various
systems. By using self-signed certificates, users of the system cannot verify that they are
communicating with the payment server, allowing an attacker on the same network to
intercept sensitive communications. The second SSL weakness is that the SSLv3 protocol
is enabled, which has known weaknesses that allow attackers to bypass the protections
that SSL provides. The final SSL configuration weakness is that RC4 ciphers are supported,
allowing sophisticated attackers to break sensitive communications.
A number of positive practices were identified within the environment. No weaknesses
were found that relate to authorization. Additionally, user-supplied input was properly
encoded in many instances, which did not allow for any cross-site scripting vulnerabilities
to be identified. A request token was used consistently, eliminating cross-site request
forgery vulnerabilities.
The table below lists all listening ports and services enumerated by TrustFoundry during
the engagement:
IP Port Protocol Service Type Identified Service Identified Version
1.2.3.4 80 tcp http Apache Tomcat 7.0.21
1.2.3.4 443 tcp https Apache Tomcat 7.0.21
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 4
BREAKING IT BETTER
The following graph shows the distribution of ports and services that were listening across
all hosts:
Listening Services
8002 - TCP
8001 - TCP
8000 - TCP
443 - TCP
80 - TCP
0 1 2 3 4 5
Listening Services
The following chart shows the distribution of findings across all severity levels:
Count of
Severity Findings by Severity
Findings
Critical 1 3
High 3
2
Medium 3
Low 2 1
Informational 1
0
Critical High Medium Low Informational
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 5
BREAKING IT BETTER
SUMMARY OF FINDINGS
Findings information in this report is presenting in order of severity. Severity ratings
within this report are presented without the knowledge of the business risk that the
vulnerabilities present to ABC Financial or its customers.
The following vulnerabilities were discovered during the Application Penetration Test:
# Finding Severity
1 Command Injection Critical
2 XML External Entity Expansion High
3 Improper Cryptography High
4 Out-of-Date Service High
5 Self-Signed Certificate Medium
6 SSLv3 Enabled Medium
7 RC4 Cipher Suites Supported Medium
8 Platform Information Disclosed in HTTP Response Low
9 Improper Caching Directives Low
10 Site Lacks Strict Transport Security Policy Informational
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 6
BREAKING IT BETTER
Application Penetration Test
1. Command Injection
◼ SEVERITY: CRITICAL
Finding Information
Command injection attacks are possible when an application passes unsafe user-
supplied data to a system shell. The user-supplied parameters are used within operating
system commands and are executed with the privileges of the vulnerable application.
Evidence
The following proof-of-concept URL was used to validate the existence of command
injection:
http://107.170.68.146/tools_vct.htm?page=tools_vct&hping=0&ping_ipaddr=1.1.1.1`uname
%20-a`&ping6_ipaddr=
When the above URL is executed, the command is run and the results of the command are
returned in the response.
ABC Financial, Inc. - EasyTransfer - Application Penetration Test - v1.0 7
BREAKING IT BETTER
Figure 1: the “uname” command returns the op