Automated tools for penetration testing.

1. Automated Tools For
Penetration Testing
Date:17 Feb 2019

2. whoami
• Devansh Dubey
• Infosec Enthusiast

3. Why use Automated Tools
• Automated tools are predesigned tools in which we just have to run them.
• Automated penetration testing tools provide effective exploit libraries and processes to detect network, as
well as application vulnerabilities.
• Automated penetration testing tools have robust, high-quality exploits that are tested and proven; the tools
are also frequently augmented with additional exploits and ensure consistent results.
• One can focus on the process rather than having to experiment with exploits, thus saving time. Further, the
professional framework reduces the chances of testing false exploits over a particular application.
• Reports are automatically produced and are customizable.

4. VARIOUS AUTOMATED TOOLS

5. SHODAN FOR PENTESTERS
WHAT IS SHODAN?

6. SHODAN
• SHODAN (https://www.shodan.io/home) is a computer search engine designed by web developer John
Matherly
• Allows users to search for publicly connected internet devices that have been seen by Shodan
• Routers
• Servers
• Firewalls and other Security Devices
• SCADA or other Control Systems…
• This data can be searched for by IP/CIDR combo –
• Open ports seen by Shodan – Hostname, OS, Geo-Location, etc…
• Server Response

7. HOW SHODAN WORKS
• SHODAN interrogates ports and grabs the resulting banners, then indexes
the banners (rather than the web content) for searching
• Rather than to locate specific content on a particular search term,
SHODAN is designed to help the user find specific nodes (desktops,
servers, routers, switches, etc.) with specific content in their banners

8. BASIC OPERATIONS
• Search terms are entered into a text box (seen below)
• Basic Operations: Login
• Create and login using a SHODAN account; or
• Login using one of several other options (Google, Twitter, Yahoo, AOL,
Facebook, OpenID Login is not required, but country and net filters are
not available unless you login
• Export requires you to be logged in

9. SEARCH FILTERS
• Basic Operations: Filters
• country: filters results by two letter country code
• hostname: filters results by specified text in the hostname or domain
• net: filter results by a specific IP range or subnet
• os: search for specific operating systems
• port: narrow the search for specific services

10. Basic Operations: Country Filter
• Filtering by country can be
accomplished by clicking on the
country map (available from the
drop down menu)
• Mouse over a country for the
number of scanned hosts for a
particular country

11. Basic Operations VERSION:

12. Basic Operations: Net / OS Filters
• The net filter allows you to refine your searches by IP/CIDR notation
The OS filter allows you to refine searches by operating system
Find „iis-5.0‟ servers in the .edu domain

13. Basic Operations: Hostname Filter
• Search results can be filtered using any portion
of a hostname or domain name

14. OWASP ZAP FOR PENTESTERS
• WHAT IS OWASP ZAP?

15. INTRODUCTION
• An easy to use webapp pentest tool
• Completely free and open source
• OWASP Flagship project
• Ideal for beginners
• But also used by professionals
• Ideal for devs, esp. for automated security tests

16. OWASP ZAP
• The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular
free security tools and is actively maintained by hundreds of international
volunteers. It can help to automatically find security vulnerabilities in web
applications while developing and testing applications. Its also a great tool
for experienced pentesters to use for manual security testing.
• https://github.com/zaproxy/zaproxy

17. Some Statistics
• Released September 2010, fork of Paros
• V 2.3.1 released May 2014, > 40k downloads
• The most active OWASP Project
• Highest activity category on Open Hub
• 31 active developers
• Over 90 translators
• Being translated into over 20 languages
• Paros code ~ 20% ZAP code ~80%

18. ZAP Features
• Swing based UI for desktop mode
• Comprehensive REST(ish) API for daemon mode
• Plugin architecture (add-ons)
• Online ‘marketplace’ (all free:)
• Release, beta and alpha quality add-ons
• Traditional and ajax spiders
• Passive and active scanning
• Highly configurable, eg scan policies
• Highly scriptable

19. Quick Start Attack

20. Conclusion
• ZAP is changing rapidly
• Its the most active O/S web appsec security tool
• Its great for people new to appsec and also for security pros
• If you dont know its capabilities, how can you know you're using the most
appropriate tool?
• Its a community based tool –so get involved

21. THANK YOU