Information Gathering in Penetration Testing with Malek Mohammad

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Malik Mohammad all about his pluralsight costs on web application penetration testing, information gathering, and more. We'll probably touch on all other types of security testing topics around pen testing. If you don't know Malik, he's an information security consultant and penetration testing expert with a bunch of experience around software development. He works on making payment applications more secure through penetration testing and threat modeling. In addition, he's helped many software developers in designing their application with security in mind and not as an afterthought, which I think is really critical now as more and more companies shift left and try to get software out into the hands of their customers. We need to get developers more involved. I think we'll touch on this as well. You don't want to miss this episode. Check it out. It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components, and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security hey Malik, welcome to the Guild.

Thanks Joe. Thanks for having me here on this interesting podcast.

Awesome. Great to have you. Before we get into it though, is there anything I missed in your bio that you want the Guild to know more about?

No, it's. Yeah, it's complete.

Very cool. So you know, in your bio there was an interesting piece that you put in there saying that you're really interested in helping developers create applications with security in mind. I actually think this is something that's kind of lacking in the industry. So why do you feel so passionate about this? Is this even possible to get developers really to stop thinking about security as they're developing the code?

Yeah, well, I started my career as a software developer and back then, you know, it was in 2004, there weren't many knowledge about information security and the vulnerabilities, the hacking, it wasn't prevalent. So also There was a lack of information and awareness for software developers and engineers. They merely know anything about information security. So nowadays from I think, I think 10 years and forward, the cyber attacks are increasing with high numbers. Every system is subject to attack. So software developers, you know, they are concerned with getting the task done and keeping up with the deadlines. And maybe they are focused on the quality, on the, of the task, maybe on the performance issues. But I think, I think till now, software developers are lacking information security awareness and experience and secure coding practices that would make the overall product more secure.

Absolutely. And that's what I love about pluralsight. There's a lot of courses around security now and I think it's really helpful. So I guess the question is then, does a company know about this? Do companies know? Like, look, we could probably get better security if we can get the developers more involved. Is there still an education that you think is going on that security is important not only with the team dedicated to security, but actually having security as part of our software development life cycle?

Well, yeah, well, most of the companies are recognizing that right now with the, also the increasing attacks after COVID 19 took place, there was massive attacks and massive phishing attacks on humans themselves. So yeah, companies are, they are starting to recognize that software developers must have, you know, the sufficient information about information, information security and secure coding standards, you know, but some of them maybe do not know how to do it or to approach perfection or near to perfection of providing a secure coding environment or a secure development life cycle with the proper awareness for security for the software developers.

So you were a software developer. You're probably still a software developer at heart, just developing probably security solutions now. So how did you get into security? And like, I mean maybe that, that'd be a way that listening, they can think, oh, maybe I can get my developers more involved. Because of your experience?

Well, I worked as a software developer. You know, I worked on many development languages. I started on C, which I love very much. C and C. I worked on C Sharp, Java. So I started reading about information security and the attacks, the, you know, the rise of the hackers and the, you know, how they show them on maybe Hollywood movies. Like they are shadow and shadowy places and something like that. Well, in real life they are not in shadowy places. They are sitting on desks and, you know, they are focused on many screens. So I like the idea, the more I read on it, you know, it keeps pulling me towards it. So I got certified, I got my first information security. I think it's, yeah, it's the EEC Council CEH it was back at 2013. It has many information for the learner to know. It has diverse, you know, subjects. It's a very good certificate for beginners. Back then didn't have virtual machines, the virtual labs as a part of the test. But right now I think it's now it has the version 10. I think they have added the virtual machines and as a part of the exam. So it's a really good thing if you have, you know, if you discovered your passion for security, you have to read much because there are a ton of information to read. You have to get certified, then you could switch, you know, inside your company or you could go to another opening.

So that brings up a good point. It does take a lot of training, a lot of reading, a lot of self, self learning. So for companies, big enterprises, is there a way to make their development lifecycle more secure? Like how do you get developers then to learn? Do you usually have someone embedded on the team that is a security expert that shepherds them or their automated tools you have along the automation pipeline now at every stage that kind of tries to bake in security before it gets to. When you're just shipping it out to the customer?

Yeah, this is a great topic, Joe. You know there is a framework testing framework that could be customized to suit the organization needs towards security. It is the secure development lifecycle. Well, it should be implemented at each company, each development company, they should have a secure development lifecycle in place. So in pref. In brief it has many phases. So I will talk about briefly about each phase and answer your second question about the security expert. So the first phase of the secure development lifecycle is the information gathering or requirement gathering. It is the requirement gathering for the application you are building. So in this phase the, you know, the most important thing to make sure all the non functional security requirements are, you know, all of them are there and the embedded in the requirements also with the functional security requirements because sometimes the customer, if there is, you know, if this is the business model, so the customer asks for a specific security requirement. So this becomes a functional security requirements. But there are non functional security requirements like no input validation, vulnerability detection and also the access control list authentication. Those are the non functional requirements. So at this phase you can make sure all the requirements are there defined and are defined for the software developers to start designing their application using those requirements. After, after the requirements are done, the software development start designing their application. They start maybe drawing diagrams, starting eliciting you know, the data flow from the requirements itself. So what the security team could do in that regard is threat modeling. Threat modeling is that a expert will come to, you know, make meetings, sit in meetings with the software developers and see all the designs and diagrams. I think exactly the data flow diagrams and do a threat modeling where the security experts can anticipate security problems in the design itself. So the security problem in the design is called the weakness and in the implementation it is called vulnerability. So when they do the security, the threat. When they do the threat modeling, the security experts anticipates all the security weaknesses in the design and suggests correction and solutions to the design. Afterwards comes the software development. The development team start, you know, writing code. They start committing it to the source code repository so that the CI CD does a thing. So at this phase of the software development, you know, static analysis for source code tools called SAST tools, they are tools on the code repository itself that when a software developer commits their code, this tool analyzes the code and see if there are any, you know, security problems or hard coded keys, concatenating SQL statements and all, everything that is related to bad security practices. And it points out all the problems so that the software developers correct that and commit the changes again.

Awesome. Yeah, What I love about it is it sounds like a process that you could fit into any kind of organization.

Yeah.

So whether you're DevOps, Agile, whatever, it seems like it would fit right in easily. Plug and play for sure.

Yeah.

There are a ton of tools on the market. There are open source tools and it is integratable with the CI CD of the major companies like GitLab or GitHub. So yeah, going forward on the secure development lifecycle, there is the penetration testing cycle when there is a tangible installable application for penetration testers to start hacking. So this is where the penetration testers start searching for vulnerabilities and start to exploit them. And also after they exploit them, they could know the impact that these vulnerabilities have on the system itself and they report that back to the software development team with solutions and suggestions. And also on this stage, it is also integrated with ADAS tool, Dynamic application security testing. Where are, you know, after deployment, Configuration management could be tested by this tool, like testing for, you know, allowed HTTP methods, the security headers and the responses, all sorts of stuff related to this paradigm. These are, you know, in a brief, the secure development life cycle. Penetration testing is a defense in depth among all of these other, you know, phases. Yeah. So going back to your second question, whether the development team should Be shepherd by the security expert or it should be one of the software developers. So yeah, the software development team could have, you know, a champion. It's called a champion. They have all the necessary awareness for secure coding and vulnerabilities and the proper, you know, certification for that. So this champion, their job is reviewing the code for the rest of the team and they have to make sure all the source code reviewed in terms of security and there are no logical security problems in the source code that are not detected by the static application security testing tools.

Nice. So now I've never heard of a secure development lifecycle before. Is it the same as DevSecOps? Is it the same principles, completely different kind of framework?

No, it could be integrated. Secure development lifecycle could be integrated with DevSecOps. You know, the DevSecOps is the operational part of the CI CD which is regarded regarding to the security part of the CI CD and the secure development lifecycle. It is the testing framework that the company could customize to adapt to their security needs and it could be integrated and reflected on the DevSecOps.

Awesome. So now I'm going to dive in a little bit more into your course because as you said, education is really critical and I love how anyone could go to pluralsight. They definitely should. Check out your course on web application penetration testing information gathering. Now, as software engineers, I think we all like to geek out on tools, but what I found interesting about your course was it focuses in on something I usually don't hear about with penetration testing right away is information gathering. So why, why focus a whole course just on the information gathering piece of the penetration testing lifecycle?

Yeah, because as the saying says, how could you attack your enemy if you don't know them? If you want to attack a target, you should know each and every, you know, information and aspect of that target. Because if you miss anything from the information gathering phase, you know, a testing scenario or attack scenario could be missed when the actual penetration testing or, sorry, the actual hacking is done. So yeah, this is crucial to know everything about the target you are about to attack.

Great. So the cost goes into like three or four different areas. One of them is using fingerprinting to identify targets. So once again, this is a term I haven't heard before is fingerprinting. So what is fingerprinting?

Well, fingerprinting is trying to know, getting to know the architecture behind the web application, getting to know, you know, the web server, what type it is, what is the version number that server, getting to know, you know, the actual Platform, whether it's, you know, Linux, what type of Linux, what version, or whether it's Windows, Microsoft Windows. So yeah, you could fingerprint to know the application framework. So attacking Java is different from attacking. NET applications and Angular. So they, they all have different attack scenarios and payloads. So it's crucial to identify what is the web framework used so that you craft your attacks based on this information. So if you don't know what application framework you are attacking, then how could you craft your attacks? Because you know, if you want to attack using, you know, test for cross site scripting. So injecting JavaScript on Angular is different than injecting JavaScript on a Java based application. So yeah, it's crucial to know every detail about the environment, web server, web framework, the platform.

Nice. So sounds kind of complicated. So are there any tools you can help use you for the information gathering piece of it?

Yeah, there are great tools. The netcat, the open SSL could, you know, you could banner grab, make a connection with the server and see what that connection dumps. So you could read the version number of the service you are connected to. And also you could use NMAP because it has a magnificent service identification feature. Yeah, everybody uses it. It's a great feature. And it also navigates all the ports on the server, not only the ports that we know, the 440C and 80 ports. And there is the Wapalyzer. It's a cool plugin, it analyzes the application and when you visit any web application and you have the plugin installed in your browser and you click it, it shows all the client side components that is used to build that site.

That sounds cool. I've never heard of that either. So it's just a simple plugin in Chrome or something you could just add in and look on any application. Nice. Cool. So once you have the tools, I think you also go into things called enumerating hidden web apps and searching for info leakage. So once again, as I said at the beginning, I'm a newbie. So I'm not sure what is info.

Leakage and security information leakage where sometimes developers leave important information right there in the source code. It's either dumped in their GitLab or their source code repository or it could be in the lying around in the HTML client side code of the application. So in the meta that information you could find keys you can use to connect to backend service the application users, you can find, you know, information about the infrastructure that you could find information about the subnet of the infrastructure you know, you could find information about backend systems, the subnet, like the database server IP address, you know, the message queues. It could give easily important information for attackers to pursue their or take on their attack from that starting point.

Gotcha. So is it, I don't know if sometimes people release like secrets to GitHub by mistake. Is that what you mean by information leakage or metadata? Or can someone use comments that they don't know that it's actually providing an attacker information they can use to attack them?

Yeah, well it could be anything. It could be, you know, leakages and comments. It could be, you know, a JavaScript code that could have a client side key that could be used to connect to the backend service. You could have also comments that show IP addresses for the back end services. And also yeah, you could find information in the source code repositories. Most probably you could find username passwords for accounts that for a hacker, if a hacker found that source code and downloaded it and you know, extracted the username and password, they could exploit that service or connect to that service using that account and does their thing.

Awesome. And I highly recommend everyone check out this course because it's easier to actually see it in action. A lot of great examples. So definitely check out Web Application Penetration Testing Information Gathering at pluralsight. I'll have a link to it in the show notes. Okay, before we go, is there one piece of actionable advice you can give to someone to help them with their security testing efforts?

Yeah, the most important thing for security testers is to practice. There are a ton of attacks out there. There are many web application frameworks used. So the best thing is always to keep your skills sharpened and up to date with the most with the newer vulnerabilities that arise in the framework. So they could always find There are many sources for security and penetration testers, security experts and penetration testers to practice on. So the most important thing to keep up to date with the security of vulnerabilities and tools.

Absolutely. And the best way to find or contact you?

Well yeah, they could contact me on my LinkedIn profile.

Awesome. Thanks again for your security testing awesomeness. The links to everything of value we covered in this episode. Head on over to testguild.com S43 and while you're there, make sure to click on the Try Today link under the exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. And if the show has helped you in any way, why not rate and review it in itunes. Reviews really do matter in the rankings of the show and I read each and every one of them. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild.com for full show notes, amazing blog articles, and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.