Network Device Configuration Assessment



SysAdmin Audit Network Security (SANS) Router and Switch Security Policy
https://www.sans.org/security-resources/policies/network-security#router-and-switch-security-policy

1. No local user accounts are configured on the router. Routers and switches must use TACACS+ for all user authentication.

2. The enable password on the router or switch must be kept in a secure encrypted form. The router or switch must have the enable password set to the current production router/switch password from the device’s support organization

3. The following services or features must be disabled:
a. IP directed broadcasts
b. Incoming packets at the router/switch sourced with invalid addresses such as RFC1918 addresses
c. TCP small services
d. UDP small services
e. All source routing and switching
f. All web services running on router

7. Use corporate standardized SNMP community strings. Default strings, such as public or
private must be removed. SNMP must be configured to use the most secure version of
the protocol allowed for by the combination of the device and management systems.

9. Access control lists for transiting the device are to be added as business needs arise.

10. The router must be included in the corporate enterprise management system with a
designated point of contact.

11. Each router must have the following statement presented for all forms of login whether
remote or local:
"UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED. You musthave explicit permission to access or configure this device. All activities performed onthis device may be logged, and violations of this policy may result in disciplinary action,and may be reported to law enforcement. There is no right to privacy on this device. Useof this system shall constitute consent to monitoring." 

12. Telnet may never be used across any network to manage a router, unless there is a secure
tunnel protecting the entire communication path. SSH version 2 is the preferred
management protocol.




HP Comware Router

  • No Exec Administrative Line Timeout Configured
    • idle-timeout 10
  • User Account Names Contained "admin"
    • local-user
  • No Hypertext Transfer Protocol over SSL (HTTPS) Service Network Access Restrictions
  • Network Time Protocol (NTP) Control Queries Were Permitted
  • No Time Synchronization Configured
    • ntp-service authentication enable
    • ntp-service authentication-keyid key-id authentication-mode md5 key
    • ntp-service unicast-server address authentication-keyid key-id
  • Weak Password Age Policy Setting
    • password-control aging 10
  • No Network Filtering Rules Were Configured
  • No Post Logon Banner Message


Juniper NetScreen Firewall *
  • Filter Rules Allow Packets From Any Source To Any Destination And Any Port
  • Rules Allow Access To Administrative Services
  • Rules Allow Access To Clear-Text Protocol Services
    • set service "HTTP"
  • VPN Configured With Aggressive Mode Enabled
  • Clear Text Telnet Service Enabled
    • set telnet client enable
  • No Hypertext Transfer Protocol over SSL (HTTPS) Server Session Timeout
    • set service https timeout 10
  • Filter Rules Allow Packets From A Network Source To Any Destination And Any Port
  • Virtual Private Network (VPN) Configured With Weak Encryption
    • sec-level compatible
    • sec-level standard
  • Rules Allow Access To Potentially Unnecessary Services
  • Rules Allow Access To Potentially Sensitive Services
  • Filter Rules Allow Packets From A Network Source To A Network Destination And Any Port
  • Filter Rules Allow Packets To Any Destination And Any Port
  • User Account Names Contained "admin"
    • set admin name "admin"
  • AUX Port Not Disabled
    • set interface serial0/0 disable
  • Weak Secure Sockets Layer (SSL) Ciphers Supported
    • set ssl encrypt 3des sha-1
  • Internet Protocol (IP) Packet Fragmentation Attack Blocking Was Disabled
    • set zone <zone> screen block-frag
  • Filter Rules Allow Packets To A Network Destination And Any Port
  • Filter Rules Allow Packets From Any Source To A Network Destination
  • Block Hypertext Transfer Protocol (HTTP) Containing Active Content Was Disabled
    • set zone <zone> screen component-block
  • Weak Administrative Service Network Access Restrictions
    • set admin manager-ip <ip-address> <netmask>
  • Filter Rules That Allow Any Protocol Were Configured
  • Filter Rules Allow Packets From A Network Source To Any Port
  • Block HTTP Containing ActiveX Controls Was Disabled
    • set zone <zone> screen component-block activex
  • Block HTTP Containing Java Was Disabled
    • set zone <zone> screen component-block jar
  • Filter Rules Allow Packets From A Network Source To A Network Destination
  • Filter Rules Allow Packets From Any Source
  • Filter Rule Allows Packets To Any Port
  • Filter Rules Allow Packets To Any Destination
  • Weak VPN Authentication Hashing Algorithm Configured
  • Log Packets With IP Record Route Was Disabled
  • Filter Rules Allow Packets To A Network Destination
  • Filter Rule List Does Not End With Drop All And Log
  • Filter Rules Allow Packets From A Network Source
  • Log IP Security Option Packets Was Disabled
  • Log IP Stream Identifier (ID) Option Packets Was Disabled
  • Log IP Time Stamp Option Packets Was Disabled

Block HTTP Content containing potentially unsafe file types 
cat  | grep -oP '(?<=component-block).*' -u | sort --unique

Automating Configuration Audit 

Nessus - Offline Config Audit





  Nipper

 Drawback: Only for Cisco Router

 

nipper --input=switch.cfg --output=switch

Popular posts from this blog

Remote Desktop Protocol (RDP) Security

Image
Common Remote Desktop Protocol (RDP) Vulnerabilities Terminal Services Encryption Level is Medium or Low Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness Terminal Services Doesn't Use Network Level Authentication (NLA) Only Terminal Services Encryption Level is Medium or Low Vulnerability Assessment: Host Assessment: Remediation: Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security/Set client connection encryption level Set client connection encryption level to High Note: High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Se
Read more

Penetration Testing - Network

Image
Manual Vulnerability Assessment TCP/21: FTP Anonymous FTP Enabled anonymous guest TCP/22: SSH nmap -p 22 --script ssh2-enum-algos <ip_address> SSH Weak Algorithms Supported SSH Server CBC Mode Ciphers Enabled ssh -oCiphers=<ciphers> <ip_address> SSH Weak MAC Algorithms Enabled ssh -oMACs=<algorithm> <ip_address> SSH Protocol v1 Supported ssh -1 <ip_address> -v Hardening on SSH Ciphers aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com TCP/23: Telnet Unencrypted Telnet Server telnet <ip_address> 23 TCP/25: SMTP SMTP Service Cleartext Login Permitted telnet <ip_address> 25 EHLO <ip_address> AUTH LOGIN Mailserver answer to VRFY and EXPN requests * nc <ip_address> 25 EXPN root VRFY root TCP/53: DNS DNS Server Cache Snooping Remote Information Disclosure
Read more

Damn Vulnerable Web Services (DVWS) - Walkthrough

Image
Installation Damn Vulnerable Web Services  (DVWS) is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. https://github.com/snoopysecurity/dvws WSDL Enumeration Spider DVWS using Burp Suite and look for service.php Requests processed by SOAP service include  check_user_information ,  owasp_apitop10 ,  population  and  return_price XPATH Injection User Login: 1' or '1'='1 User Password: 1' or '1'='1 Command Injection Original Request parameter value of name is " find "   by default  Edited Request change the parameter value of  name  from "find" to " dir "   Cross Site Tracing (XST) Hint of " The NuSOAP Library service is vulnerable to a Cross-site scripting flaw " is given by DVWS. Exploit is published at exploit DB ( https://www.exploit-db.com/e
Read more

Offensive Security Testing Guide

Image
This cheat sheet is the compilation of commands we learnt to exploit the vulnerable machines. The commands below may not be enough for you to obtain your Offensive Security Certified Professional (OSCP). So... Try Harder! Information Gathering Operating System Windows Interesting Path "Documents and Settings"/Administrator/Desktop file:///C:/xampp/readme_en.txt file:///C:/xampp/passwords.txt file:///C:/xampp/webdav/webdav.txt file:///C:/xampp/apache/conf/extra/httpd-dav.conf file:///C:/xampp/apache/conf/extra/httpd-xampp.conf file:///C:/xampp/apache/logs/access.log file:///C:/xampp/apache/logs/error.log file:///C:/xampp/security/webdav.htpasswd file:///C:/xampp/htdocs/dashboard/phpinfo.php file:///C:/xampp/phpmyadmin/config.inc.php file:///C:/xampp/php/logs/php_error_log file:///C:/xampp/mysql/bin/my.ini C:\Users\<User>\AppData\Local\Temp #Email Address C:\Users\<User>\AppData\Local\Microsoft\Outlook Active Connection netstat -anob #R
Read more

Server Message Block (SMB) Security

Image
Common SMB related vulnerabilities Microsoft Windows SMBv1 Multiple Vulnerabilities SMB Signing Disabled Microsoft Windows SMB NULL Session Authentication Microsoft Windows SMB Shares Unprivileged Access Network Discovery: TCP port 5357 - Web Services on Devices API (WSDAPI) File and Printer Sharing: TCP port 135 - Remote Procedure Call (RPC) TCP port 139 - NETBIOS Session Service TCP port 445 - Server Message Block (SMB) By disable NetBIOS over TCP/IP (TCP Port 139), NETBIOS name discovery will be prevented Microsoft Windows SMBv1 Multiple Vulnerabilities Vulnerability Assessment: NSE script smb-protocols can be used to check if the server supported NT LM 0.12 (SMBv1) . Host Assessment: Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath} Remediation: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Read more

Host Configuration Assessment - Windows

Image
OS Information Gathering systeminfo wmic computersystem get domainrole 0 - Standalone workstation 1 - Member workstation 2 - Standalone server 3 - Member server 4 - Domain controller secedit /export /cfg cfg.ini > nul net user administrator > netuseradmin.txt auditpol.exe /get /category:* > auditpol.txt netsh advfirewall show allprofiles > firewall.txt net accounts > netaccount.txt gpresult /f /h evid/gporesult.html > nul accesschk /accepteula -q -a * > accesschk.txt *Simplify the process with Scgary ! User Right Assignment type cfg.ini | grep "^SeAuditPrivilege\|^SeCreatePagefilePrivilege\|^SeRemoteShutdownPrivilege\|^SeRemoteInteractiveLogonRight\|^SeEnableDelegationPrivilege\|^SeLockMemoryPrivilege\|^SeDenyNetworkLogonRight\|^SeChangeNotifyPrivilege\|^SeDebugPrivilege\|^SeDenyBatchLogonRight\|^SeCreateGlobalPrivilege\|^SeShutdownPrivilege\|^SeIncreaseQuotaPrivilege\|^SeTrustedCredManAccessPrivilege\|^SeDenyInteractiveLogonRight
Read more