Penetration Test Report (UnderDefense): Anonymised Infrastructure Penetration Testing Report 2019

Penetration Testing Report
for
[CLIENT]
Executive summary
This report presents the results of the “Grey Box” penetration testing for [CLIENT]
Infrastructure. The recommendations provided in this report structured to facilitate remediation
of the identified security risks. This document serves as a formal letter of attestation for the
recent [CLIENT] Infrastructure Penetration Testing.
Evaluation ratings compare information gathered during the course of the engagement to “best
in class” criteria for security standards. We believe that the statements made in this document
provide an accurate assessment of [CLIENT] Infrastructure.
We highly recommend to review section of Summary of business risks and High-Level
Recommendations for better understanding of risks and discovered security issues.
Scope Security Grade
level
Infrastructure perimeter C Fair
UnderDefense Grading Criteria:
Grade Security Criteria Description
A Excellent The security exceeds “Industry Best Practice” standards. The overall
posture was found to be excellent with only a few low-risk findings
identified.
B Good The security meets with accepted standards for “Industry Best
Practice.” The overall posture was found to be strong with only a
handful of medium- and low- risk shortcomings identified.
C Fair Current solutions protect some areas of the enterprise from security
issues. Moderate changes are required to elevate the discussed areas
to “Industry Best Practice” standards
D Poor Significant security deficiencies exist. Immediate attention should be
given to the discussed issues to address exposures identified. Major
changes are required to elevate to “Industry Best Practice” standards.
Confidential 1
Grey-box Infrastructure Penetration Testing Report for [CLIENT] Revised 31.10.2018
F Inadequate Serious security deficiencies exist. Shortcomings were identified
throughout most or even all of the security controls examined.
Improving security will require a major allocation of resources.
Assumptions & Constraints
As the environment changes, and new vulnerabilities and risks are discovered and made
public, an organization’s overall security posture will change. Such changes may affect the
validity of this letter. Therefore, the conclusion reached from our analysis only represents a
“snapshot” in time.
Objectives & Scope
Organization
[CLIENT]
Audit type Grey-Box Manual and Automated Infrastructure Penetration
Testing
Asset URL APPENDIX A - Scope
Audit period Oct. 10 - Oct. 31
Consultants performed discovery process to gather information about the target and searched
for information disclosure vulnerabilities. With this data in hand, we conducted the bulk of the
testing manually, which consisted of input validation tests, impersonation (authentication and
authorization) tests, and session state management tests. The purpose of this penetration
testing is to illuminate security risks by leveraging weaknesses within the environment that lead
to the obtainment of unauthorized access and/or the retrieval of sensitive information. The
shortcomings identified during the assessment were used to formulate recommendations and
mitigation strategies for improving the overall security posture.
Results Overview
The test uncovered a few vulnerabilities that may cause users session hijacking, sensitive data
leakage, broken confidentiality and integrity and availability of the resource. Security testing
activities showed that there are a lot of components with known vulnerabilities.
Identified vulnerabilities are not directly exploitable but the risk posed by these vulnerabilities
can cause significant damage to the company.
Confidential 2
Grey-box Infrastructure Penetration Testing Report for [CLIENT] Revised 31.10.2018
Security experts performed manual security testing, which demonstrate the following results.
Severity Critical High Medium Low Informational
​
# of issues 0 1 5 16 1
Severity scoring:
● Critical - Immediate threat to key business processes.
​ ​
● High – Direct threat to key business processes.
​
● Medium – Indirect threat to key business processes or partial threat to business
processes.
● Low – No direct threat exists. Vulnerability may be exploited using other vulnerabilities.
​
● Informational – This finding does not indicate vulnerability, but states a comment that
notifies about design flaws and improper implementation that might cause a problem in
the long run.
Confidential 3
Grey-box Infrastructure Penetration Testing Report for [CLIENT] Revised 31.10.2018
Summary of business risks
High severity issues make direct threat to the business as they can be used to:
● Using XSS attack it is possible to steal user session and get full access to user’s account.
It will lead to client data leakage as this vulnerability is present on application whis is
used by company clients. Successful exploitation of this vulnerability will create big
reputational and financial damage for company.
Medium and low severity issues can lead to:
● Attacks on communication channels and as a result on sensitive data leakage and
possible modification, in other words it affects integrity and confidentiality of data
transferred.
● Information leakage about system components which may be used by attackers for
further malicious actions.
● Attacks on old and not patched system components with bunch of publicly known
vulnerabilities.
● Enumerating existing users emails/usernames and brute forcing their passwords. Easy
access to their session after exploitation of high level risks, as session token is the same
for each login.
● Social engineering, intimidation or blackmail is possible via sending emails from open
SMTP server, which can interrupt working process, cause credentials stealing or can be
used with combination with other attacks.
● Combination of few issues can be used for successful realisation of attacks.
Informational severity issues do not carry direct threat but they can be used to gather useful
information for an attacker.
High-Level Recommendations
Taking into consideration all issues that have been discovered, we highly recommend to:
● Conduct current vs. future IT/Security program review;
● Establish Secure SDLC best practices, assign Security Engineer to a project to monthly
review code, conduct SAST & DAST security testing;
● Review Architecture of application;
● Deploy Web Application Firewall solution to detect any malicious manipulations;
● Continuously monitor logs for anomalies to detect abnormal behaviour and fraud
transactions. Dedicate security operations engineer to this task;
● Implement Patch Management procedures for whole IT infrastructure and endpoints of
employees and developers;
● Continuously Patch production and development environments and systems on regular
bases with latest releases and security updates;
● Conduct annual Penetration test and quarterly Vulnerability Scanning against internal
and external environment;
● Conduct security coding training for Developers;
● Develop and Conduct Security Awareness training for employees and developers;
Confidential 4
Grey-box Infrastructure Penetration Testing Report for [CLIENT] Revised 31.10.2018
● Develop Incident Response Plan in case of Data breach or security
incidents;
● Analyse risks for key assets and resources;
● Update codebase to conduct verification and sanitization of user input on both, client
and server side;
● Use only encrypted channels for communications;
● Improve server and application configuration to meet security best practises;
● Also we recommend to conduct remediation testing of both infrastructure and web
applications.
Performed tests
● All set of applicable OWASP Top 10 Security Threats
● All set of applicable SANS 25 Security Threats
Criteria Label Status
Meets criteria
A1:2017-Injection
Fails criteria
A2:2017-Broken Authentication
Fails criteria
A3:2017-Sensitive Data Exposure
Meets criteria
A4:2017-XML External Entities (XXE)
Meets criteria
A5:2017-Broken Access Control
Fails criteria
A6:2017-Security