So here is a demo company security assessment findings report.
Now I will be providing this.
You can also find this on my github.
I'm going to provide links to a PDA.
I'll attach a PDA version of this and you can find the actual word doc on my get hub which I'll link
to that as well.
So here's the front page and I've got the zoomed in a little bit to where it doesn't cover the whole
page only so that you can see it.
So we're zoomed in just for visibility purposes but pretty standard front page.
We have a table of contents right.
And we're going to speed through this pretty quick but OK.
So first things first.
I have a confidentiality statement just says this document is for us and demo company and for nobody
else can be shared with except auditors etc..
Another thing that we need to say here too is that we have a disclaimer saying that this penetration
test is a snapshot in time.
We test usually for a week per segment.
So say we do an external for a week.
Guess what.
During that week is when we tested.
If a finding comes up a week later or maybe somebody opens up a port or sets up an application we're
not responsible for that.
And we are also under a time limited engagement meaning that we are targeting what we can't in that
period of time.
Some clients let's be real.
They're gonna be cheap about some things right.
They're going to want to pay for a week maybe when they shouldn't pay for two especially if they're
a big client.
You know they don't want as in-depth of review or research on a lot of their stuff.
And when we're limited on time we're not going to find everything.
So we have to point that out as a disclaimer other than that we have our contact information here.
So we'll have our demo company contacts and our contacts and then here I have the assessment overview.
So we go into a kind of a high level just saying hey look from this date to this date they engaged us
to evaluate the security posture of its infrastructure.
And we do testing based on a few different guidelines one is what is called nest that is related to
the US based but there's other guidelines and here that we reference and then how we kind of you know
attack we have the planning discovery attack reporting if we discover we go back attack we go back and
find an attack we go back and discover again and repeat we cover here.
Also what we're attacking or what components we have in this assessment.
So in this assessment here we only have an external penetration test.
So we talked about what we do in an external penetration test and it just kind of says hey it's the
role of an attacker trying to gain access to an internal network without internal resources or inside
knowledge.
It just gives you an overview.
So if we had multiple components then we would list multiple things here and talk through that.
Here we talk quickly about the findings severity because we're going to rate things based on their severity
so we might have a critical finding all the way down to something that's informational for the client
and you're going to see that here in just a minute.
And when we go in the next video we cover a real report that I've done in the past.
You're going to see that in a lot more clear form what these look like so from here we have our scope
we just say OK here's our scope we attacked two IP addresses and I listed internal IP addresses.
Even though we didn't external does just a demo dock so here's a couple of IP addresses.
And then if we had full scope information I report that in an Excel document and attach that.
So I just have this here just in case I need that.
So we also have scope exclusions.
You see here we did not perform any denial of service attacks during testing and then any client allowances.
So did the client have to assist us in any way in this instance.
They did not.
All right.
So we then break down our report and here's where we start getting into the meat.
We break down our report into an executive summary and we break down our report into a technical summary.
The executives are four executives think about the sea level the CISO or the CEO or whoever is going
to be reviewing this.
They might not come from a technical background.
So if you throw technical things at them they might get lost.
You have to have an explain like I'm five years old attitude when you write your executive summary and
then you have a technical summary where you can then share how you gained access in certain ways and
you know that can help somebody like a network engineer or somebody else repeat that that has a more
technical mindset.
So here again this talks about OK well we evaluated their external network from the 20th to the twenty
ninth.
And by leveraging a series of attacks we found critical vulnerabilities that allowed full internal access
to the network.
And then we just kind of have an attack summary and recommendations here for the client.
Right.
OK well we did breach account credentials and we looked through those we did credential stuffing and
we were unsuccessful but we had username enumeration through outlook which allowed us to further validate
usernames using that we were able to do a password spraying attack with some or 2018 exclamation.
And got in with that into the outlook web application here.
And then finally we leverage those credentials to log into the VPN.
Well on this side we have all the recommendations right.
Well for breach account data your employees shouldn't be using their work e-mails as log in credentials
to other services unless it's absolutely necessary.
When it comes to credentials stuffing and Outlook Web Access you should be you know Synchronizing your
valid invalid account messages.
There shouldn't be username enumeration outlook is a little bit special about that one.
It's a feature.
Believe it or not.
So there's not much clients can do about that one but there's other ways to enumerate information as
you've seen in this series.
So from here you know we're able to get into the outlook application and the VPN mainly because of poor
password policies and not utilizing multi factor authentication once we logged in we weren't prevented
we were given access to the network.
This is a very very real world scenario by the way this happens quite a bit.
So scrolling through again in the executive summary I like to point out the strengths and the weaknesses.
And this is a very empty document just because it's a demo you're going to see a little bit more in
the next video on how more complete this will look and how readable it does become.
So in this example we just give them kudos where they where they need it you know.
So let's say we were scanning and their SIM identified our scans and it alerted somebody in interior
on the internal side and allowed them to detect us and they could have blacklisted our IP address right
then and there.
So we give them kudos.
But you know we had that missing multi factor that's a security weakness the weak password policy and
we were able to brute force attempt the log in page as many times as we wanted.
So these are big security weaknesses right.
And we want to identify those at a high level so the client understands it so the executive understands
it scrolling through here we always like to put pretty charts in.
I'm only reporting one vulnerability here.
We could report many vulnerabilities and this would look a lot more full.
But for this instance you'll see one critical vulnerability.
We have a nice chart they can look at it and say Wow we did well while we didn't do we did we did bad
right.
So onto the technical findings.
So I like to give a proof of concept.
If there is a chain exploit of attacks and here's the insufficient lockout policy on Outlook Web App
and it kind of gives a description and says look you know unlimited logging attempts here.
This allowed us to brute force password guessing attacks in which we were able to gain access into the
network.
This impact is critical because we gained access.
Here is the system that it happened on.
And here are references.
So I like to provide nest references compliance references so they can go back and look at the compliance
regulations behind this.
And then they can go and patch this as well.
So here we look at the exploitation proof of concept we gathered breached account data through credential
dumps.
So here's that looks like you should be familiar with that.
We use that to spray the oh I log in.
So Outlook Web App.
This is kind of what it looks like.
And it'll say something like this failed log in but username is valid and you can see that I'm spraying
with user names and I've got this blurred out because these are real pictures.
But it says summer 2018 explanation we are trying that didn't work.
Okay.
But we did have some user name enumeration and then eventually we got all the valid user names down.
We tried summer 2018 exclamation against the valid user names and summer 2018 explanation did work but
this sets a log in.
And then finally allowed us to gain access to the VPN which we have a picture here.
Unfortunately I wasn't able to sanitize that picture.
So here on the remediation side we would say OK who should remediate this.
Well the I.T. team what's the vector.
Well it's remote.
They don't have to do this.
You know this can be done remote or we attacked remotely right.
And there's several items here from this one exploit.
Well there wasn't multi factor authentication we recommend that you do use multi factor unlimited logging
attempts.
We recommend that you restrict that.
OK.
They permitted successful log in the password spraying meaning there's a weak password policy.
Here's a recommendation on password policy with a permitted username enumeration.
Here's how to patch that.
And then we recommend you know you train your employees on how to create a proper password to check
your credentials against known breach passwords and to discourage employees from using their work emails
on Web sites and they need to do so.
And then lastly here we've got additional reports and scans.
I always like to provide all of the output so I will take the NSA data and convert it into Excel and
I will give them full findings of vulnerability scan report in a F and an Excel document.
That way they have everything because there's times where you have an assessment and the assessment
is going really bad for the client unfortunately.
And what you can attack is the high level or the low the low hanging fruit the high and critical vulnerabilities
right.
Well if you do that then reporting on the moderate and low just doesn't really make sense it's not worth
writing a really really long report at that point you're going to say hey look you need to go check
the scans make sure that you look through everything because we only reported on critical and high vulnerabilities
here.
So you want to note that and make sure that they're aware that there's more things going on the scans
a lot of the times.
And then here we have lastly the last page.
Now we went through that pretty quick.
I want you to just download this with the attached references and just kind of go through it make it
your own do whatever you want.
Meet me in the next video when we kind of cover a real assessment and you get to see kind of what it
looks like more in detail.
We'll talk through the client with a client as well what they did bad and you can see some of the vulnerabilities
pop up from how I would report it and you know how I did report it.
So I'll see you next video and we actually cover a real penthouse report.