The Vulnerability Assessment and Penetration Testing of Two Networks
Total Page:16
File Type:pdf, Size:1020Kb
Regis University ePublications at Regis University All Regis University Theses Fall 2011 The ulneV rability Assessment and Penetration Testing of Two Networks Steven L. Simpson Regis University Follow this and additional works at: https://epublications.regis.edu/theses Part of the Computer Sciences Commons Recommended Citation Simpson, Steven L., "The ulneV rability Assessment and Penetration Testing of Two Networks" (2011). All Regis University Theses. 633. https://epublications.regis.edu/theses/633 This Thesis - Open Access is brought to you for free and open access by ePublications at Regis University. It has been accepted for inclusion in All Regis University Theses by an authorized administrator of ePublications at Regis University. For more information, please contact [email protected]. Regis University College for Professional Studies Graduate Programs Final Project/Thesis Disclaimer Use of the materials available in the Regis University Thesis Collection (“Collection”) is limited and restricted to those users who agree to comply with the following terms of use. Regis University reserves the right to deny access to the Collection to any person who violates these terms of use or who seeks to or does alter, avoid or supersede the functional conditions, restrictions and limitations of the Collection. The site may be used only for lawful purposes. The user is solely responsible for knowing and adhering to any and all applicable laws, rules, and regulations relating or pertaining to use of the Collection. All content in this Collection is owned by and subject to the exclusive control of Regis University and the authors of the materials. It is available only for research purposes and may not be used in violation of copyright laws or for unlawful purposes. The materials may not be downloaded in whole or in part without permission of the copyright holder or as otherwise authorized in the “fair use” standards of the U.S. copyright laws and regulations. THE VULNERABILITY ASSESSMENT AND PENETRATION TESTING OF TWO NETWORKS A PROJECT SUBMITTED ON THE 16th OF DECEMBER, 2011 TO THE DEPARTMENT OF INFORMATION SYSTEMS OF THE SCHOOL OF COMPUTER & INFORMATION SCIENCES OF REGIS UNIVERSITY IN PARTIAL FULFILLMENT OF THE REQUIREMENTS OF MASTER OF SCIENCE IN SYSTEMS ENGINEERING BY Steven L. Simpson APPROVALS Dan Likarish, Project Advisor Robert T. Mason, Ph.D. Nancy Birkenheuer ii Abstract Vulnerability assessments and penetration testing are two approaches available for use by internet security practitioners to determine the security posture of information networks. By assessing network vulnerabilities and attempting to exploit found vulnerabilities through penetration testing security professionals are able to evaluate the effectiveness of their network defenses by identifying defense weaknesses, affirming the defense mechanisms in place, or some combination of the two. This project is a discussion of the methods and tools used during the vulnerability assessment and penetration testing, and the respective test results of two varied and unique networks. The assessment and testing of the first network occurred from an internal perspective, while the assessment and testing of the second occurred from an external perspective. While the tools and methodologies used across both networks were consistent, the test results differed significantly. The paper concludes with a series of recommendations regarding practical methods and tools that may prove useful to anyone interested in network security, and vulnerability assessments and penetration testing in particular. iii Acknowledgements I would like to thank the following people for their support and help during the pursuit of my graduate education and during the completion of this project. Specifically I would like to thank my wife, Renee Simpson for her continued belief in my abilities for all the projects I have undertaken. I would also like to thank Angus Anderson, Stuart Gentry, Brian Haynie, Ed Richards, Corbit Magby, and Justin McCallister for taking to the time to review my writings and for the edits and suggestions, which made this paper more readable and easier to understand. I would also like to thank the following people for their continued support during the pursuit of my studies and for always taking the time to ask me how my studies were progressing: Denise Haynie, Jane Richards, Stan and Jeannie Cook, Mark Williams, Davie Costales, Brian and JoAnn Morford, Anita Magby, and Doyle and Judy Warnock. Finally, I would like to thank my son, Matthew Scott Simpson for inspiring me to complete all the work required to finish my Master’s education. Running Head: SECURITY ASSESSMENTS OF TWO NETWORKS 4 Table of Contents ABSTRACT ................................................................................................................................................................II ACKNOWLEDGEMENTS ..................................................................................................................................... III TABLE OF CONTENTS ............................................................................................................................................ 4 LIST OF TABLES ...................................................................................................................................................... 6 CHAPTER 1 – INTRODUCTION ............................................................................................................................. 7 CHAPTER 2 - CANVAS ASSESSMENT AND TESTING ................................................................................... 11 CANVAS PROJECT PURPOSE, REQUIREMENTS, AND DELIVERABLES ..................................................................... 11 CANVAS PROJECT TOOLS AND RESOURCES .......................................................................................................... 12 BackTrack 4. ...................................................................................................................................................... 12 Nmap. ................................................................................................................................................................. 12 Metasploit. ......................................................................................................................................................... 14 CANVAS NETWORK TEST METHODOLOGY............................................................................................................ 15 CANVAS network host discovery. ...................................................................................................................... 15 CANVAS network port analysis.......................................................................................................................... 17 CANVAS network automated penetration testing............................................................................................... 18 CANVAS PROJECT SUMMARY ............................................................................................................................... 24 CHAPTER 3 - ITS NETWORK VULNERABILITY ASSESSMENT AND PENETRATION TESTING ....... 26 ITS PROJECT REQUIREMENTS, PROJECT RESTRICTIONS, AND PROJECT DELIVERABLES .......................................... 26 Project Requirements. ........................................................................................................................................ 26 Project Restrictions. ........................................................................................................................................... 27 Project Deliverables. ......................................................................................................................................... 27 PROJECT TEST PLAN ................................................................................................................................................ 28 Test Notification Process. .................................................................................................................................. 30 Project Tools and Resources .............................................................................................................................. 32 ITS network assessment and penetration test methodology ............................................................................... 33 Running Head: SECURITY ASSESSMENTS OF TWO NETWORKS 5 ITS NETWORK ASSESSMENT AND PENETRATION TEST RESULTS SUMMARY ........................................................... 44 CHAPTER 4 - SUMMARY AND RECOMMENDATIONS ................................................................................. 49 SUMMARY ............................................................................................................................................................... 49 RECOMMENDATIONS ............................................................................................................................................... 51 Recommendation 1. ............................................................................................................................................ 51 Recommendation 2. ............................................................................................................................................ 52 Recommendation 3. ...........................................................................................................................................