CYBER SECURITY
1
Outline:
# Overview of vulnerability
scanning. # Open port service
identification.
# Version
check #
Traffic probe
# Vulnerability probe
# Examples of vulnerability
2
•
OVERVIEW OF VULNERABILITY
SCANNING
WHAT IS A VULNERABILITY
SCANNER?
3
TYPES OF VULNERABILITY
SCANNER
1. Network-based scanners
1.
Port scanners
(Nmap : http://insecure.org/nmap)
2.
Network vulnerability scanners
(Nessus http://www.nessus.org/nessus/)
3.
Web server scanners
(Nikto : http://www.cirt.net/code/nikto.html)
4.
Web application vulnerability
scanners (Paros :http://parosproxy.org/index.html) (Acunetix :http://www.acunetix.com/Acunetix)
4
2. Host-based
scanners
1. Host vulnerability scanners
Microsoft Baseline Security Analyser (MBSA)
(http://www.microsoft.com/technet/security/tools/mbsahom
e)
Altiris SecurityExpressions (commercial) :
(http://www.altiris.com/Products/SecurityExpressions.a
spx)
3. Database scanners
Scuba by Imperva Database Vulnerability Scanner:
(http://www.imperva.com/application_defense_center/scuba/defaul
t.a
sp)
5
- Shadow Database Scanner
OPEN PORT SERVICE
IDENTIFICATION
For example
a scanner could connect to:
port 1 - to see if tcpmux is
running. port 7 - to see if echo
is running.
port 22 - to see if openssh is
available. port 25 - to see if smtp
is available.
• If you're interesting in identifying which services use a given port you
can look at the file /etc/services - this has a port number, and an
associated service name.
• nmap also allows you to do more than simply list open ports though.
• Where possible it will identify the version of each identified service
which is running.
• It can also be used to identify the operating system the remote host is
6
running, by examining the variations the way different network packets
VERSION
CHECK
1) -sV (Version detection)
2)-allports (Don't exclude any ports
from version detection)
3)-version-intensity <intensity> (Set
version scan intensity)
4) -version-all (Try every single probe)
5)- version-trace (Trace version scan
activity)
7
Percentage wise vulnerabilty
affection :-
8
TRAFFIC
PROBE
1) High-Speed Traffic
Processing
2) Network Traffic
Measurement
3) Network Intrusion
Detection
9
High-Speed Traffic
Processing
LAN and MAN have evolved over a considerable time span (the last
30 years) and encompass wired and wireless physical links and
speeds from 1 Mb/s to 100 Gb/s.
According to DAG project (Wakaito) :- The total amount of data
created or replicated on the planet in 2010 was over 1 zettabyte (1
102 bytes)
zettabyte
is - that’s 143 GBfor each of the 7 billion people on the
1
This planet.
volume of information requires high-speed links between server
farms, cloud storage, and end users to make sure that it can be
processed in a timely and reliable fashion.” It will not be possible to
analyse such huge traffic volumes in the coming 100 GbE network
installations with the current generation of network measurement
tools.
FPGA cards (intel 82599, Myri-10G Lanai Z8ES) are still used in
applications which perform in-depth analysis, patter matching, and
low- latency operations, and in 40/100 Gb/s networks.
10
Network Traffic
Measurement
1) Full packet traces.
2)Flow statistics provide information
from Internet Protocol (IP).
3)Volume statistics are provided by
most network appliances for
network management.
11
Network Intrusion
Detection
• The signature-based approach
inspects the evaluated content.
• Anomaly-based detection.
• Stateful protocol analysis.
12
•
VULNERABILTY
PROBE
Some security bugs can’t be identified without sending apayload
that exploits a suspected vulnerability.
• An easy-to-understand example of a vulnerability probe is an
HTML injection check for a web application. Imagine a web
app that has a search box for users to find text within its
pages.
HTML EXAMPLE :<div id="search"><span class="results">Results for
'<xss>'...</span>
13
EXAMPLE OF
VULNERABILTY
Minimalist
vulnerable program.
#include <string.h>
int main(int argc, char *argv[])
{
char
buffer[512]; if
(argc > 1)
strcpy(buffer,argv[1]) };
Compile the program with the following
command :
$ gcc -o vulnerable main.c
14
THANK
YOU
26