1 / 46

Secure Analysis & Testing (Hacking Technique)

Secure Analysis & Testing (Hacking Technique). Arif Wicaksono. Universitas Langlangbuana Bandung Bandung , 25 Oktober 2008. Agenda. Today’s Hackers Risk Management Types of Security Test Testing Methodology FootPrinting Port Scanning Penetrate, External Enumeration Discussion.

nanji
Télécharger la présentation

Secure Analysis & Testing (Hacking Technique)

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Secure Analysis & Testing (Hacking Technique) ArifWicaksono UniversitasLanglangbuana Bandung Bandung, 25 Oktober 2008

  2. Agenda • Today’s Hackers • Risk Management • Types of Security Test • Testing Methodology • FootPrinting • Port Scanning • Penetrate, External • Enumeration • Discussion

  3. Today’s Hackers

  4. Today’s Hackers

  5. Today’s Hackers

  6. Today’s Hackers

  7. Risk Management (for Ethical Hacker) Vulnerabilities Threats Risk Management (for Ethical Hacker)

  8. Type of Security Test

  9. Testing Methodology

  10. Testing Methodology Footprinting

  11. Testing Methodology : FootPrinting • Informasi Domain • Informasi Jaringan dan Server

  12. Testing Methodology : FootPrinting

  13. Testing Methodology : FootPrinting

  14. Testing Methodology : FootPrinting

  15. Testing Methodology : FootPrinting

  16. Testing Methodology Scanning Discovery of IPs, ports, services, and vulnerabilities. * Direct connection may be made to target

  17. Port Scanning : Identifikasi OS • Stack FingerPrint • NMAP -O

  18. Port Scanning : Identifikasi OS • Informasi Banner sebuah Service pada OS

  19. Port Scanning : Identifikasi OS • Port aktif • Windows : port 135 & 139 (NetBIOS), 445 (Ms-DS) • Unix (Umum) : 22, 23, 79, 111 • Ping

  20. Port Scanning : Identifikasi OS

  21. Testing Methodology Penetrate, External

  22. PenetrasiJaringanPublik

  23. Testing Methodology Enumerate Obtain list of users, Passwords, shares, NetBIOS, names, SMTP strings, etc.

  24. EnumerasiDasar • Mendapatkan informasi lanjutan dari sebuah Sistem Operasi • Daftar User • Shares

  25. EnumerasiDasar • NBT  NetBIOS over TCP / IP

  26. Tools Enumerasi • Legion

  27. Tools Enumerasi • GetAcct

  28. Enumerasi : SNMP Vulnerability

  29. Bug yang PopulerPada Windows • Era tahun 2000 – 2002  Bug Unicode / Decode • Era tahun 2003 - 2007 • RPC - DCOM • Netapi • PnP • DNS RPC Vulnerability • Bug Terbaru dan cukup Berbahaya tahun 2008 • 8 April 2008 • Windows Kernel Could Allow Elevation of Privilege

  30. Bug yang PopulerPada Windows • Bug pada System Windows

  31. Bug yang PopulerPada Windows • Bug aplikasi

  32. LatarBelakangAncaman pada Web Server • Masalah pada system Hacking • Serangan bersifat spesifik : OS, H/w, Services, dll. • Berbeda juga cara serangan dan eksploitasinya. • Perubahan yang cepat : OS, H/w, Services, dll. • Firewall

  33. Click Kiddies

  34. Hasildari Click Kiddies

  35. LatarBelakangAncaman pada Web Server • Click Kiddies • Era baru Hacking, khusus pada serangan aplikasi web • Hanya diperlukan satu trick khusus yang ampuh untuk melakukan serangan • Senjata ampuhnya : cukup dengan BROWSER • Tools tambahan lainnya : • Port Scanner • Netcat • Vullnerability checker : Acunetix, Goolag, SandCat, Nikto, Black Widow, dll. • Milw0rm • Metasploit Framework • Dll.

  36. DesainAplikasi Web

  37. InformasiBerharga • Informasi pada Website • Logo & Aplikasi • Manipulasi URL • Directory traversal • Source Code

  38. Jenis-jenisSerangan TerhadapAplikasi Web • Buffer overflow, stack overflow, heap overflow • Format string • Parameter manipulation (command execution, unicode/URL Decoding, file inclusion, path transversal, HTTP splitting) • Cross Site Scripting (XSS) • SQL Injections • Session/Cookie Hijacking & Manipulation

  39. Testing Methodology Penetrate, Internal

  40. Testing Methodology Escalate, protect

  41. Testing Methodology Pillage

  42. Testing Methodology Get Interactive

  43. Testing Methodology Expand influence

  44. Testing Methodology Cleanup / maintenance

  45. DISCUSSION

  46. TerimaKasih arifwsn@gmail.com

More Related