All right.
Welcome to the last video in this section.
And the real report.
So this is a real report.
And I have obfuscated any client information out of this so you won't be able to see who the client
was.
But I think it's a good indication on how I write my reports and just allow you to see what a real report
actually looks like compared to what I kind of showed you as a baseline.
So this should all look a little bit familiar will cover if some steps a little bit quicker than the
arrest.
Again table of contents you could see it's more filled out because we have a lot more going on and confidentiality
statements the same as before.
We're gonna go ahead just skip over that skip over this.
We did an external penetration test here.
We did an internal penetration test and we did a web application penetration test.
So remember when I told you last time that we would cover the different assessment components how we
were doing them we listed external internal and web application in a brief overview of what those are.
Now we also have the finding severity ratings just like before we have the different risk factors talking
about how risk is measured.
So I added this in risk as measured by likelihood and impact.
Here's what likelihood is here's what impact is and then here's the scope.
So we had external scope internal scope and the web application scope.
We did not perform any denial of service or phishing and social engineering.
All the attacks not specified above or permitted.
And then they did provide us an allowance of internal network access for our laptop.
So coming through here.
Here is the executive summary right.
So this as we evaluated the external internal web application and this is a high level overview for
strengths and weaknesses.
So I'm not going to read this to you if you want to read through it.
It really just talks about here's what we did on the external OK.
It did not lead to any access.
We were able to identify some things like an account enumeration right.
And we noted that the external network was actually well patched.
There was a strong password policy and multi factor authentication was in place on log in.
So that kudos.
Right.
You want to give them kudos where you can.
Same thing with the internal what we talked about.
And then the web application.
And what we found there.
So this is a high level overview.
Somebody can come read this executive summary and know exactly what's going on and what happened in
their network.
Now here are the strengths and weaknesses.
So they were able to detect alerts on vulnerability scans.
They were able to they had multi factor authentication in their network and they had a strong password
policy.
This client was actually really really sound overall.
Their web application had section section fixation and potential denial of service.
OK.
And we'll talk about that in a second.
So I like to give a nice vulnerability Summary Report Card.
This is great for that executive level who just wants to take a look and you can see right away.
OK.
No critical findings no high a few moderates Lowe's informational here's what the moderates Lowe's and
informational were.
Here's what the recommendation was.
Here is your final grade right.
This is clear cut.
And this is what you want when you're reporting you want clear cut.
You want the executive to look at this.
Have a nice visual aspect to it.
So this makes a lot of sense right.
Same thing with the web application.
OK.
There was a couple of high findings the rest were low and final web upgrade was B plus.
So again very very good here.
So coming through.
Let's just talk about some of the findings and how it looks and my reporting.
So identified in their network that they were vulnerable to M.S. 17 0 1 0.
However there was a special situation here where the client was actually requiring or it was requiring
a authenticated log in which I never got.
So unless you had a valid log in you could not exploit this specific machine that was because there
was no named pipes which is how the Eternal Blue actually functions.
So to get that name Piper you had to have a log in.
Now I give the description here the risk and the system it came on what tools I use and what references
again and then I provide evidence.
Here it shows that it is not past it was Windows 8 machine.
And I say figure one not patched.
Here's the remediation.
Apply the patching.
Here's a specific link that they can find on which you know which update.
We'll do that for them.
So you give the full overview you have to give a description.
You talk about the risk OK.
The likelihood moderate and the impact is high because we will get system level access if we do get
into this machine so scrolling through you've seen this before L and ah I was able to capture the hashes
was not able to crack the hashes.
OK.
Because because of that this is just a moderate but still recommendations are to disable the multicast
name resolution B of the GPO.
Right.
So just like we talked about earlier this is something that's familiar to you.
And then we use responder to capture this kind of gives that technical level of you know here's how
we ran this type deal.
And you could have proof of concept here with your pictures.
So insufficient hardening S&P signing disabled I'm not going to walk through every single one of these
you know line by line.
But S&P signing disabled something you've seen before and just best practice right you want them to
have that enabled.
So we don't have the S&P relay attacks here they had S&P community string it was just a public string
on S&P we were able to enumerate that we're able to see a little bit of information on that.
You should basically have these off disable S&P if it's not required type deal.
So just the best practice they also had a TFT server which was susceptible to a relatively new exploit
the exploit was actually so new that there was not a proof of concept out there it was a Microsoft bulletin
that was out.
So because of that I put it as low finding.
Had it been one that had a proof of concept and I was able to attempt it or exploit it like the MF 17
010 then that becomes more of a moderate to high finding depending on if exploit happened or even a
critical.
There was machine access gain.
And then lastly or close to lastly there was I am app running that was on a a non encrypted port so
it is running on one forty three and you could get their webmaster email address and their password
in clear attack.
So I did that was able to log in their email as that password and that password worked across the network.
Lastly I like to talk about the undetected malicious activity.
So I go through and I say hey look I was attempting all these different things.
You know you didn't see me doing and map you didn't see me doing any kind of poisoning attacks or brute
force attacks or anything along those lines so you really need to work on fine tuning this and then
coming in here.
Also I like to give out historical accounts compromises so they were a relatively small company.
Only one user showed up and this is actually from we leak info and I know I just like to point out you
know this is informational to them.
I'll provide them an Excel doc of all the users if a if they like that and you know just have it in
there.
And again the same remediation as last video you know train users not to use their email address unless
they have to utilize strong passwords password rotation etc. onto the web application so here I said
way early in the course I would show you an example of session fixation.
So here is a finding on sessions fixation where you know we had this cookie.
The cookie was set prior to authentication and then guess what it was set after authentication and then
it was remaining the same after a logout.
And so we had the recommendations here on what they should do for session fixation.
We also have the references to that 4 0 loss we talk about the likelihood the impact etc..
So that's one example on the web app side.
Another one that they showed up for high was denial service.
So they had this you know forgot password feature where we went in and we said Hey like you know here's
our user name.
And it said that user name doesn't exist.
OK.
Well that's that's user enumeration right.
Well that's a low finding.
Not really that big of a deal.
Well when you combine that low finding with a account lockout feature where you cannot reset that password
yourself or there is no time to log out then that becomes denial of service because guess what.
We can enumerate every single user and we can lock out every single user.
We can deny service to the entire application and that's how that becomes a finding as well.
So scrolling through insufficient encryption we talked about this.
Right.
Remember we scan Tesla and it came back as all A's.
Well not always as a come back as all A's.
Here's an example we like to report on that just let them know hey you should stop using these deprecated
ciphers you should know disable any depreciated DNS encryption ciphers scrolling through again information
disclosure in headers.
We've talked about this as well.
Right.
So the server here was disclosing that I was I asked ten point zero.
It was disclosing ISP net and powered by ISP the net which is just telling us this is running on Microsoft.
So we want to get rid of all this if we can.
That way we don't know as an attacker.
You know what we're up against.
They were also doing a little bit of information disclosure through verbose error messages.
If you've ever seen.
I asked for four.
This is a very generic four four four I guess.
So we ding them there as well.
Lastly I think that we have here a autocomplete and this is a slow finding but you know this could get
a password stored on a user's browser.
And if we were able to hijack that browser we could log in as that user.
So we always recommend that autocomplete is disabled and then we've got actually these insecure response
headers.
So this is that security headers that I Io or security headers dot com that you can run but I always
like to look at them see what they're running and then I'll say hey like you're missing content security
policy strict transport security X cross-eyed scripting protection etc..
So this will come up when you're doing brb sweep.
But again you can run it on security headers dot com security headers the IO and that'll work as well
and I have that as a reference here to kind of tell you what you have what you should have as best practice.
And then again that undetected malicious activity so that they are aware of what we ran on the attacks
and you know that they weren't able to detect those attacks.
And then last page here additional scan reports and details I provided the external summary in an Excel
format a full PDA F and an executive o PD F and these are just NASA's polls.
All right here and then this here is from Barb sweet.
Burps she is able to run reports as well as I listed them and I'm authenticated report and authenticated
report.
So they have all this available to review so.
Lastly last page here.
So I went through that kind of quick.
I just wanted a overview I wanted you to see a report.
I wanted you to put things together right.
Like everything that you saw in that report was everything that we've covered in this class.
There wasn't one thing really out of place and that just hopefully will give you an idea of what report
looks like.
Give you a little bit of confidence that like yeah.
You know like these are things that he's talked about and now I know that they are findings and how
to kind of present those findings and if at any point you felt like it went too fast this video just
hit the pause button read through what was on that page and if you want to take it slower read through
it have fun with it.
That is that's it for this.
So we're we're in the homestretch just a couple of more videos left.
So now we're going to talk about career advice in the next section.
And then we're we're out of here man.
So let's do this.
Let's go ahead and cut over to the next section.
I will see over there.