0DQXDODQG$XWRPDWHG3HQHWUDWLRQ7HVWLQJ
%HQHILWVDQG'UDZEDFNV0RGHUQ7HQGHQF\
<DURVODY6WHILQNR$QGULDQ3LVNR]XE5RPDQ%DQDNK
Abstract  ,QWKLVSDSHUZHGHVFULEHSHQHWUDWLRQWHVWLQJ FRQVLGHUHGFRQILGHQWLDODQGVKDOOQRWEHGLVFORVHGXQWLO
DV D PHWKRGRORJ\ IRU LQIRUPDWLRQ VHFXULW\ 3HQWHVWLQJ LV FRPSOHWHUHVROXWLRQRIGHIHFWV>@
XVHG IRU SURDFWLYH GHIHQFH DQG LQIRUPDWLRQ V\VWHPV 3HQHWUDWLRQ WHVWHUV DWWDFN V\VWHPV WR HYDOXDWH WKHLU
SURWHFWLRQ 6SHFLDO RSHUDWLRQDO V\VWHPV RQ 81,; FRUH VHFXULW\ LQ WKH IDFH RI UHDOLVWLF WKUHDWV 7KHVH DWWDFNV
GHYHORSHG VFULSWV XWLOLWLHV DQG DSSOLFDWLRQV DUH VXJJHVWHG
WDNHWKHIRUPRIDXWKRULVHGSHQHWUDWLRQWHVWVWKDWSUREHD
0RVWSURV DQGFRQVRIPDQXDODQGDXWRPDWHGSHQWHVWDUH
JLYHQ V\VWHP
V GHIHQFHV WKHVH GHIHQFHV DUH WKHQ EUHDFKHG WR
Keywords 3HQHWUDWLRQ 7HVWLQJ ,QIRUPDWLRQ 6HFXULW\ HYDOXDWH WKH LPSDFW RI DQ\ ZHDNQHVVHV WKH UHVXOWV RI
3URDFWLYH'HIHQFH(WKLFDO+DFNHU([SORLWDWLRQ+DFNLQJ WKHVH WHVWV DUH XVHG WR LPSURYH D V\VWHP
V VHFXULW\
'DWD%UHDFK&\EHU$WWDFN0HWDVSORLW3\WKRQ PDNLQJWKHPUHVLOLHQWWRIXUWKHUDWWDFNV

, ,1752'8&7,21
&\EHUDWWDFNVKDYHEHFRPHRQHRIWKHJUHDWHVWWKUHDWV
WR WKH ZRUOG RI EXVLQHVV DQG HFRQRPLFV $PRXQW RI
GDPDJH KDV EHHQ JURZLQJ HYHU\ GD\ DQG PRUH
FRPSDQLHV RU LQVWLWXWLRQV KDYH EHFRPH YLFWLPV RI
DWWDFNVRUGDWDEUHDFKSHUIRUPHGE\EODFNKDWV+HQFH
FRPSDQLHV DUH ORRNLQJ IRU EHVW ZD\ WR SURWHFW WKHLU
V\VWHPVDQGHVVHQWLDOLQIRUPDWLRQ0RVWSRSXODUZD\LV
WRSUREHWKHLUV\VWHPVYLDSHQHWUDWLRQWHVWVE\FHUWLILHG
HWKLFDO WHDPV ZKLFK FDQ SURDFWLYHO\ GHIHQG FRPSXWHU
V\VWHPV
3HQHWUDWLRQ WHVW LV D VHFXULW\ HYDOXDWLRQ SURFHVV IRU )LJ$PRXQWRIPRQHWDU\GDPDJHFDXVHGE\UHSRUWHG
QHWZRUN RU FRPSXWHU V\VWHPV WKDW VLPXODWHV DQ DWWDFN F\EHUFULPHWRWKH)%,,&6IURPWRPOQ86
E\ DQ HWKLFDO KDFNHU SHQWHVWHU 7KH WHVWLQJ SURFHVV GROODUV6RXUFH VWDWLVWDFRP
XVXDOO\LQYROYHVVLPXODWLQJGLIIHUHQWW\SHVRIDWWDFNVRQ 7KHLPSDFWRIWKHVHDWWDFNVFDQDIIHFWWKHFRPSDQ\LQ
WKH WDUJHW V\VWHP 7KLV W\SH RI WHVWLQJ SURYLGHV DQ PDQ\ZD\VVXFKDVGDWDORVVGHQLDORIVHUYLFHOLDELOLW\
RUJDQL]HG DQG FRQWUROOHG ZD\ WR LGHQWLI\ VHFXULW\ FODLPV DQG ORVV RI SURGXFWLYLW\ 7KH VHULRXV QDWXUH RI
VKRUWFRPLQJV 7KH UHVRXUFHV DQG WLPH UHTXLUHG IRU WKH LPSDFWV KDV UHVXOWHG LQ WKH JURZWK RI DQ HQWLUH
FRPSUHKHQVLYHWHVWLQJFDQPDNHSHQHWUDWLRQWHVWLQJFRVW LQGXVWU\ ZKLFK DGGUHVVHV WKHVH VHFXULW\ LVVXHV >@
LQWHQVLYH &RQVHTXHQWO\ VXFK WHVWV DUH XVXDOO\ RQO\ 1HWZRUN ILUHZDOOV DQG YXOQHUDELOLW\ VFDQQHUV DUH WZR
SHUIRUPHGGXULQJLPSRUWDQWPLOHVWRQHV W\SHV RI FRPPRQ VHFXULW\ VROXWLRQV DYDLODEOH WRGD\
7KH PRVW LPSRUWDQW GLVWLQFWLRQ EHWZHHQ  D  KDFNHU 7KHVH VROXWLRQV DGGUHVV VSHFLILF FRQFHUQV  D ILUHZDOO
VHWXS ZLOO SUHYHQW DQ XQDXWKRUL]HG DFFHVV LQWR WKH
DQG  D  SHQHWUDWLRQ  WHVWHU  LV  WKDWSHQHWUDWLRQ  WHVW  LV
GRQHZLWKDOLFHQVHDQGDVLJQHGFRQWUDFWZLWKDQ V\VWHP ZKHUHDV YXOQHUDELOLW\ VFDQQHUV ZLOO VSRW WKH
RUJDQL]DWLRQRUFRPSDQ\DQGWKHRXWSXWLVSURYLGHG SRWHQWLDO YXOQHUDELOLWLHV LQ WKH V\VWHP +RZHYHU WKHVH
DV D UHSRUW 6XFK WHVWV PD\ EH OHJDO LI WKH H[ILOWUDWHGWRROVFDQQRWHQVXUHWKHLGHQWLILFDWLRQRIDOOWKHGLIIHUHQW
GDWD ZDV QRW SHUVRQDO EXW WKLV OHJDOLW\ PD\ EH PRGHV RI DWWDFNV 3HQHWUDWLRQ WHVWLQJ LV DQ LPSRUWDQW
TXHVWLRQDEOH GHSHQGLQJ RQ WKH OHJDO MXULVGLFWLRQ ZKHUH DGGLWLRQDO WRRO IRU DGGUHVVLQJ WKH FRPPRQ VHFXULW\
WKH WHVW WDNHV SODFH 6RPH ZRUGV DERXW HWKLFV ZH ZLOO LVVXHV$SHQHWUDWLRQWHVWQRWRQO\LGHQWLILHVWKHH[LVWLQJ
GLVFXVVDVZHOOLQQH[WVHFWLRQV YXOQHUDELOLWLHV EXW DOVR H[SORLWV WKHP 7KH JRDO RI
SHQHWUDWLRQWHVWLQJLVWRLPSURYHRUDXJPHQWWKHVHFXULW\
,, 3(17(67,1*%$&.*5281' SRVWXUHRIDQHWZRUNRUDV\VWHP>@+DFNLQJDV\VWHP
3HQWHVWLQJ LV XVHG WR VHDUFK IRU YXOQHUDELOLWLHV WKDW UHTXLUHVWHFKQLFDOSURZHVVFUHDWLYLW\DQGLQJHQXLW\
PLJKWH[LVWLQ D V\VWHP 7KHJRDORISHQHWUDWLRQWHVWLV WR  ILQG XQH[SHFWHG ZD\V RI DSSURSULDWLQJ LW >@
WR LQFUHDVH GDWD VHFXULW\ 6HFXULW\ LQIRUPDWLRQ DQG 3HQHWUDWLRQ WHVWLQJ UHTXLUHV  DOO  RI  WKLV  ZLWK  WKH
ZHDNQHVVHV WKDW DUH VSHFLILHG LQ SHQHWUDWLRQ WHVW DUH DGGHG  FRQVWUDLQW  WKDW  ILQGLQJ  DQG  H[SORLWLQJ
<DURVODY6WHILQNR$QGULDQ3LVNR]XE5RPDQ%DQDNK
YXOQHUDELOLWLHV VKRXOG QHLWKHU KDUP WKH V\VWHP QRU
/YLY 3RO\WHFKQLF 1DWLRQDO 8QLYHUVLW\ 6%DQGHU\ 6WU  HQFURDFKRQWKHGLJQLW\RIWKRVHDIIHFWHGE\LW
/YLY  8.5$,1( (PDLO MDULNELW#JPDLOFRP 3HQHWUDWLRQWHVWLQJLVSHUIRUPHGE\FRPSURPLVLQJWKH
SLVNR]XE#SRO\QHWOYLYXD EDQDNKUL#JPDLOFRP VHUYHUVZLUHOHVVQHWZRUNVZHEDSSOLFDWLRQVDQGRWKHU

7&6(7
)HEUXDU\/YLY6ODYVNH8NUDLQH
 

SRWHQWLDO SRLQWV RI H[SRVXUH WR LGHQWLI\ DQG DQDO\VH UHSUHVHQWDWLYH EHIRUH WKH SHQHWUDWLRQ WHVW LV VWDUWHG
VHFXULW\ LVVXHV >@ 7KLV HQDEOHV IRRO SURRILQJ DJDLQVW )ROORZLQJDUHLPSRUWDQWUHTXLUHPHQWVWKDWDUHSUHVHQWLQ
WKHVHLVVXHVWRSUHYHQWIXWXUHDWWDFNV3HQHWUDWLRQWHVWLQJ DOPRVWHYHU\52(
FDQ EH FRQGXFWHG HLWKHU PDQXDOO\ RU WKURXJK DQ  $ SURSHU SHUPLVVLRQ WR KDFN 52( DQG D
DXWRPDWHGSURJUDP
7KHUH DUH QXPHURXV EHQHILWV RI SHQHWUDWLRQ WHVWLQJ
IURP WKH EXVLQHVV DV ZHOO DV WHFKQLFDO SHUVSHFWLYH
6RPH RI WKH SULQFLSDO UHDVRQV IRU DGRSWLQJ SHQHWUDWLRQ
WHVWLQJDUHSUHVHQWHGEHORZ  7KHSURMHFWGXUDWLRQLQFOXGLQJERWKWKHVWDUWDQGWKH
6HFXULW\,VVXHV
6HFXULW\ LVVXHV VXFK DV PDOZDUH DWWDFNV QHWZRUN
LQWUXVLRQ DQG GDWD WKHIW FDQ UHVXOW LQ VHUYLFH
LQWHUUXSWLRQDQGXQUHOLDEOHV\VWHPSURFHVVHV7KLVFRXOG
OHDGWRSRWHQWLDOORVVRIFXVWRPHUOR\DOW\DQGDIIHFWWKH
FRPSDQ\V PDUNHW YDOXH 3HQHWUDWLRQ WHVWLQJ FDQ ZRUN
WRDYRLGVXFKRFFXUUHQFHVE\ZHHGLQJRXWSHUVLVWHQWDV
ZHOODVXQH[SHFWHGWKUHDWV
3URWHFW,QIRUPDWLRQ
&RPSDQLHV XVH GLIIHUHQW VHFXULW\ PHFKDQLVPV WR
VDIHJXDUG LQIRUPDWLRQ OLNH DFFHVV FRQWURO PHWKRGV
ILUHZDOOV FU\SWRJUDSK\ LQWUXVLRQ GHWHFWLRQ V\VWHPV
HWF >@ +RZHYHU ZLWK QHZ DWWDFNV EHLQJ GLVFRYHUHG
HYHU\GD\ LW LV GLIILFXOW WR SURWHFW XVHUV\VWHP
LQIRUPDWLRQ FRQVWDQWO\ 3HQHWUDWLRQ WHVWLQJ FRXOG
DGGUHVV WKHVH FRQFHUQV E\ VLPXODWLQJ D YDULHW\ RI
DWWDFNVVLPXOWDQHRXVO\
3ULRULWL]HVHFXULW\ULVNV
QRQGLVFORVXUH1'$DJUHHPHQWVKRXOGEHVLJQHG
E\ERWKWKHSDUWLHV
 7KH VFRSH RI WKH HQJDJHPHQW DQG ZKDW SDUW RI WKH
RUJDQL]DWLRQPXVWEHWHVWHG
HQGGDWH
 7KH PHWKRGRORJ\ WR EH XVHG IRU FRQGXFWLQJ D
SHQHWUDWLRQWHVW
 7KHJRDOVRIDSHQHWUDWLRQWHVW
 7KH DOORZHG DQG GLVDOORZHG WHFKQLTXHV ZKHWKHU
GHQLDORIVHUYLFHWHVWLQJVKRXOGEHSHUIRUPHGRUQRW
 7KH OLDELOLWLHV DQG UHVSRQVLELOLWLHV ZKLFK DUH
GHFLGHG DKHDG RI WLPH $V D SHQHWUDWLRQ WHVWHU \RX
PLJKW EUHDN LQWR VRPHWKLQJ WKDW VKRXOG QRW EH
DFFHVVLEOH FDXVLQJ D GHQLDO RI VHUYLFH DOVR \RX
PLJKW DFFHVV VHQVLWLYH LQIRUPDWLRQ VXFK DV FUHGLW
FDUGV 7KHUHIRUH WKH OLDELOLWLHV VKRXOG EH GHILQHG
SULRUWRWKHHQJDJHPHQW
,I\RXQHHGDPRUHWKRURXJKGRFXPHQWDWLRQUHIHUWR
WKH37(63UHHQJDJHPHQWZKLWHSDSHU>@
0RVW ILQDQFLDO RUJDQL]DWLRQV ZRXOG OLNH WR EH
FRPSOLDQW WR ZRUOG LQIRUPDWLRQ VHFXULW\ UHTXLUHPHQWV
ZKLFKDUHGHVFULEHGLQ7KH3D\PHQW&DUG,QGXVWU\'DWD
7KH XVH RI SHQHWUDWLRQ WHVWLQJ DV D VWDQGDUG VHFXULW\ 6HFXULW\ 6WDQGDUGQ3&, '66 DQG 7KH 8QLILHG
SUDFWLFH QRW RQO\ KHOSV XQGHUVWDQG WKH VHFXULW\ LVVXHV &RPSOLDQFH IUDPHZRUN 8)& VWDQGDUGV  8)&
EXW LW FDQ DOVR KHOS SULRULWL]H WKHVH LVVXHV 7KH LVVXHV FRQWDLQV WKH IROORZLQJ JHQHUDO UHIHUHQFH WR SHQHWUDWLRQ
LGHQWLILHG GXULQJ WKH WHVWLQJ FDQ EH SULRULWL]HG RQ WKH
EDVLVRIVHYHULW\$OVRWKHVHHIIRUWVFDQOHDGWRHIILFLHQW
EXGJHWDOORFDWLRQIRULQIRUPDWLRQVHFXULW\LVVXHV
)LQDQFLDO/RVV
3HQHWUDWLRQ WHVWLQJ KHOSV WR PLWLJDWH WKH ORVV RI
UHYHQXHVFDSLWDO GXH WR VHUYLFH GRZQWLPH DULVLQJ IURP
PDOLFLRXV DWWDFNV ,W FDQ DOVR SUHYHQW RU UHGXFH
ILQHVODZVXLWVUHVXOWLQJIURPVHFXULW\PDOSUDFWLFHV
7UDGLWLRQDOO\ SHQWHVWLQJ VKRXOG EH LQFOXGHG DV D
VWDQGDUG SURFHVV ZLWKLQ WKH VHFXULW\ WHVWLQJ URDGPDS
2UJDQL]DWLRQV SUHIHU WR SHUIRUP SHQHWUDWLRQ WHVWLQJ
SULRUWRDSURGXFWUHOHDVHRUDPDMRUXSJUDGH+RZHYHU
LW LV DOVR DGYLVDEOH WR FRQGXFW WKLV WHVWLQJ LQ WKH
WHVWLQJ 8QLILHG &RPSOLDQFH  7KH RUJDQL]DWLRQ
ZLOO SHUIRUP SHQHWUDWLRQ WHVWLQJ RQ DOO GHILQHG PDMRU
JHQHUDO VXSSRUW DQG NH\ PLQRU DSSOLFDWLRQ V\VWHPV DW
OHDVW\HDUO\RUDIWHUDQ\PDWHULDOFKDQJHV
7KHUHLVDOVRVSHFLILFLQGXVWU\JXLGDQFH)RUH[DPSOH
WKH 3D\PHQW &DUG ,QGXVWU\ 'DWD 6HFXULW\ 6WDQGDUG
FRQWDLQV WKH IROORZLQJ UHIHUHQFH WR SHQHWUDWLRQ WHVWLQJ
>@ 2QFH WKH WKUHDWV DQG YXOQHUDELOLWLHV KDYH EHHQ
HYDOXDWHG GHVLJQ WKH WHVWLQJ WR DGGUHVV WKH ULVNV
LGHQWLILHG WKURXJKRXW WKH HQYLURQPHQW 7KH SHQHWUDWLRQ
WHVWVKRXOGEHDSSURSULDWHIRUWKHFRPSOH[LW\DQGVL]HRI
DQ RUJDQL]DWLRQ $QRWKHU VHFWLRQ RI 3&, VWDQGDUG
UHIHUHQFHVWKDWWKHJRDORIWKHSHQHWUDWLRQWHVWLVWRJDLQ
IROORZLQJVLWXDWLRQV DFFHVV 3&,  7KH JRDO RI SHQHWUDWLRQ WHVWLQJ LV
 1HZLQIUDVWUXFWXUHLVDGGHG WRGHWHUPLQHLIXQDXWKRUL]HGDFFHVVWRNH\V\VWHPVDQG
 6RIWZDUHLVLQVWDOOHG ILOHVFDQEHDFKLHYHG>@
 6\VWHPXSGDWHVDUHDSSOLHG )URP WKH PHWKRGRORJ\ VLGH WKHUH DUH SXEOLF WHVWLQJ
 6HFXULW\SDWFKHVDUHDSSOLHG PHWKRGRORJLHVWKDWDUHDYDLODEOH9DULRXVRUJDQL]DWLRQV
 8VHUSROLFLHVDUHPRGLILHG KDYH SXEOLVKHG IUHH IUDPHZRUNV WKDW ZLOO IDFLOLWDWH
5XOHVRI(QJDJHPHQW VXFFHVVIXOLQKRXVHSHQHWUDWLRQWHVWLQJ
(YHU\ SHQHWUDWLRQ WHVW \RX GR ZRXOG FRPSULVH RI D  7KH 2SHQ 6RXUFH 6HFXULW\ 7HVWLQJ 0HWKRGRORJ\
UXOHV RI HQJDJHPHQW ZKLFK EDVLFDOO\ GHILQHV KRZ D 0DQXDO 266700 FXUUHQWO\ YHUVLRQ  DQG YHUVLRQ
SHQHWUDWLRQ WHVW ZRXOG EH ODLG RXW ZKDW PHWKRGRORJ\ /LWHDUHIUHH
ZRXOG EH XVHG WKH VWDUW DQG HQG GDWHV WKH PLOHVWRQHV  2SHQ :HE $SSOLFDWLRQ 6HFXULW\ 3URMHFW 2:$63
WKH JRDOV RI WKH SHQHWUDWLRQ WHVW WKH OLDELOLWLHV DQG 7HVWLQJ*XLGH
UHVSRQVLELOLWLHV HWF $OO RI WKHP KDYH WR EH PXWXDOO\  1,67 6SHFLDO 3XEOLFDWLRQ  *XLGHOLQH WR
DJUHHG XSRQ E\ ERWK WKH FXVWRPHU DQG WKH 1HWZRUN6HFXULW\7HVWLQJ

7&6(7
)HEUXDU\/YLY6ODYVNH8NUDLQH
 

 37(6 7KH3HQHWUDWLRQ7HVWLQJ([HFXWLRQ6WDQGDUG WDVNV &RPSUHKHQVLYH PDQXDO SHQHWUDWLRQ WHVWLQJ

 ,QIRUPDWLRQ 6\VWHPV 6HFXULW\ $VVHVVPHQW XVXDOO\ UHTXLUHV DQ H[WHQVLYH WHDP RI SURIHVVLRQDOV
)UDPHZRUN,66$) SRVVHVVLQJ GLYHUVH VNLOO VHWV ZKLFK PRVW RUJDQL]DWLRQV
,Q  WKH  1,67  SHQHWUDWLRQ  WHVW  PHWKRGRORJ\  WKH
SHQHWUDWLRQ  WHVW  FRQVLVWV  RI  IRXU  SKDVHV  planning,
discovery, attack, reporting'HVSLWHWKLVZHFDQDOVR
XVH %DFN7UDFN SHQWHVWLQJ PHWKRGRORJ\ ,W LV
SUHGHFHVVRU DQG IRXQGHU RI .DOL /LQX[ PRGHUQ
SHQHWUDWLRQ WHVWLQJ RSHUDWLRQDO V\VWHP IRU HWKLFDO
KDFNLQJ
7KH %DFN7UDFN WHVWLQJ PHWKRGRORJ\ SUHVHQWHG LQ
WKLV VHFWLRQ FRPSULVHV ERWK WKH EODFNER[ DQG ZKLWH
ER[ DSSURDFKHV (LWKHU RI WKHVH DSSURDFKHV FDQ EH
DGMXVWHG DFFRUGLQJ WR WKH JLYHQ WDUJHW RI DVVHVVPHQW
7KH PHWKRGRORJ\ LV FRQWDLQV VWDJHV WKDW VKRXOG EH
IROORZHG LQ RUGHU WR DFFRPSOLVK D VXFFHVVIXO
DVVHVVPHQW7KHVHLQFOXGHTarget Scoping, Information
Gathering, Target Discovery, Enumerating Target,
Vulnerability Mapping, Social Engineering, Target
Exploitation, Privilege Escalation, Maintaining Access,
and Documentation and Reporting
FDQQRW DIIRUG WR PDLQWDLQ LQKRXVH RU FRQWUDFW RQ D
IUHTXHQWEDVLV
8VXDOO\ IRU PDQXDO SHQWHVW HWKLFDO KDFNHUV XVH
0HWDVSORLW )UDPHZRUN FRPPDQG OLQH XWLOLW\  PVI
ZLWK DGGLQJ VRPH RSWLRQV RU VXLWDEOH H[SORLWV IURP
0HWDVSORLWFRPPXQLW\GDWDEDVH
7KH DOOLQFOXVLYH QDWXUH RI WHVWLQJ HPSOR\HG LQ
SHQHWUDWLRQ WHVWLQJ PDNHV LW D YHU\ FRPSOH[ SURFHVV
0DQXDO  SHQHWUDWLRQ  WHVW XVXDOO\ LV  QRW  HIIHFWLYH  LQ
WHUPVRIWLPHDQGPRQH\VRLWVDXWRPDWLFYHUVLRQLV
FRQVLGHUHG %XW PDQXDO SHQWHVW KDYH EHQHILWV LQ ORQJ
WHUPHIILFLHQF\EHFDXVHRIXQLYHUVDOLW\:HEVFDQQHUV
DUH  XVHG IRU  SHUIRUPLQJ  WKH  DXWRPDWLF  ZHE
SHQHWUDWLRQWHVW)RUH[DPSOH1HVVXVILUVWO\FUDZOWKH
WDUJHW  WKHQ  DWWDFN  WR  WKH  UHVXOWV  RI  WKH SUHYLRXV
SKDVHDQGILQDOO\UHSRUWYXOQHUDELOLWLHVLQWKHWDUJHW
$ FRPPHUFLDOJUDGH automated SHQHWUDWLRQ WHVWLQJ
VROXWLRQLVW\SLFDOO\SURGXFHGE\DWHDPRIH[SHULHQFHG
:KHWKHU DSSO\LQJ DQ\ FRPELQDWLRQ RI WKHVH VWHSV
ZLWKEODFNER[RUZKLWHER[DSSURDFKHVLWLVDOOOHIWXS
WR WKH SHQHWUDWLRQ WHVWHU WR GHFLGH DQG FKRRVH WKH PRVW
VWUDWHJLFSDWKDFFRUGLQJWRWKHJLYHQWDUJHWHQYLURQPHQW
DQGLWVSULRUNQRZOHGJHEHIRUHWKHWHVWEHJLQV:HZLOO
H[SODLQ HDFK VWDJH RI WHVWLQJ ZLWK D EULHI GHVFULSWLRQ
GHILQLWLRQDQGLWVSRVVLEOHDSSOLFDWLRQV>@
VHFXULW\ H[SHUWVWLJHUWHDP DQG GHYHORSHUV ZKR
FRPSOHWH VRSKLVWLFDWHG YXOQHUDELOLW\ UHVHDUFK EXLOG
VDIH FXWWLQJHGJHH[SORLWVDQGWKHQFRPELQHWKHPLQWR
D VLPSOH HDV\WRXVH SDFNDJH %\ WKRURXJKO\ WHVWLQJ
DFURVVQHWZRUNVHQGSRLQWVZHEDSSOLFDWLRQVDQGHPDLO
XVHUV DQ DXWRPDWHG SHQHWUDWLRQ WHVWLQJ VROXWLRQ FDQ
SURYLGH D FOHDU FRPSUHKHQVLYH YLHZ RI DQ
7KH LOOXVWUDWLRQ IRU WKH %DFN7UDFN .DOL /LQX[ WHVWLQJ RUJDQL]DWLRQVVHFXULW\SRVWXUH
SURFHVVLVDOVRJLYHQEHORZ )RUH[DPSOHRQHRIWKHPRVWXVHIXODQGXVHUIULHQGO\
FRPPDQGOLQHWRROIRUH[SORLWDWLRQLQ.DOL/LQX[LV
)LJ3HQHWUDWLRQWHVWSURFHVVIURP%DFNWUDFNFRPPXQLW\
,,, &203$5,6212)0$18$/$1'
$8720$7('3(1(75$7,217(67,1*
8QWLO UHFHQWO\ SHQHWUDWLRQ WHVWLQJ KDV EHHQ D YHU\
FRPSOH[ manual SURFHVV WKDW FRXOG EH SHUIRUPHG E\
RQO\ DGYDQFHG VHFXULW\ VSHFLDOLVWV ZLWK PDQ\ \HDUV RI
UHOHYDQW H[SHULHQFH 7HVWHUV W\SLFDOO\ ZULWH WKHLU RZQ
H[SORLWV OHDUQ WR PDVWHU WRROV DYDLODEOH LQ WKH SXEOLF
GRPDLQ DQG SHUIRUP PDQ\ WHGLRXV WLPHFRQVXPLQJ
7&6(7
)HEUXDU\/YLY6ODYVNH8NUDLQH
6RFLDO HQJLQHHULQJ WRRONLW6(7 LV D PHQX GULYHQ WRRO
LQXVHGWREXLOGGLIIHUHQWFOLHQWVLGH WULFNV
,W LQFOXGHV YDULRXV VRFLDO HQJLQHHULQJ DWWDFN RSWLRQV
WKDW FDQ EH GHSOR\HG IURP WKH VDPH LQWHUIDFH ,W LV
ZULWWHQ LQ 3\WKRQ DQG WKH PHQXGULYHQ IXQFWLRQDOLW\
PDNHV LW HDVLHU WR EXLOG WKH DWWDFN 7KH VRFLDO
HQJLQHHULQJWRRONLWKHOSVH[HFXWHDFRPSOH[DWWDFNZLWK
OHVV HIIRUWV DQG WLPH DQG DOVR DOORZV XV WR WHVW YDULRXV
VRFLDO HQJLQHHULQJ VFHQDULRV LQ D SUDFWLFDO ZD\ ,W ZDV
SUHYLRXVO\ LPSRVVLEOH WR H[HFXWH WKHVH LQ D WLPHO\
PDQQHU7KHVRFLDOHQJLQHHULQJWRRONLWFDQEHIRXQGLQ
.DOL /LQX[  DW $SSOLFDWLRQV _ ([SORLWDWLRQ WRROV
2QFHWKHWHUPLQDOZLQGRZLVXS\RXZLOOEHSUHVHQWHG
ZLWK WKH PHQX VKRZQ LQ WKH IROORZLQJ VFUHHQVKRW 7KH
SURPSWDWWKHWHUPLQDOGLVSOD\VVHWDQGLWZDLWVIRU\RXU
LQSXW
$XWRPDWHG WHVWLQJ LV D VDIH DQG VLPSOH ZD\ WR
SHUIRUPDOOWKHWDVNVUHODWHGWRSHQHWUDWLRQWHVWLQJ$OVR
VLQFH PRVW RI WKH WDVNV DUH DXWRPDWHG WKH WHVWV FDQ EH
OHVV WLPHFRQVXPLQJ WKDQ PDQXDO WHVWLQJ 7KH HDVH RI
UHSURGXFLELOLW\ RI WKH WHVWV LV DOVR D ELJ EHQHILW
FRPSDUHGWRWKHFXVWRPL]HGDSSURDFKLQPDQXDOWHVWLQJ
 

&OHDQXS 7KHWHVWHUKDVWR $XWRPDWHG

PDQXDOO\XQGRWKH WHVWLQJSURGXFWV
FKDQJHVWRWKHV\VWHP RIIHUFOHDQXS
HYHU\WLPH VROXWLRQV
YXOQHUDELOLWLHVIRXQG
7UDLQLQJ 7HVWHUVQHHGWROHDUQ 7UDLQLQJIRU
QRQVWDQGDUGZD\VRI DXWRPDWHGWRROV
WHVWLQJ LVHDVLHUWKDQ
7UDLQLQJFDQEH PDQXDOWHVWLQJ
FXVWRPL]HGDQGLVWLPH
)LJ6RFLDOHQJLQHHULQJWRRONLWIRUDXWRPDWHGH[SORLWDWLRQ FRQVXPLQJ
6FULSWLQJODQJXDJHVOLNH3\WKRQ3HUO5XE\DQGHYHQ
$QLQKRXVHSHQHWUDWLRQWHVWLQJVROXWLRQHQDEOHVXVWR
EDVKDUHEHFRPLQJPRUHSRSXODUIRUSHQHWUDWLRQWHVWLQJ
HQVXUH PRUH FRQVLVWHQWO\ KLJK OHYHOV RI VHFXULW\ E\
DQGFDQEHHDVLO\FRPSDWLEOHZLWK0HWDVSORLWRUGLUHFWO\
UHJXODUO\ PRQLWRULQJ RXU QHWZRUNV HQGSRLQWV DQG ZHE
IURP/LQX[VKHOOIRUH[DPSOHSHQWHVWHUFDQXVH3\WKRQ
DSSOLFDWLRQVEHWZHHQFRQVXOWLQJHQJDJHPHQWV
VFULSWIRUEUXWHIRUFLQJFUHGHQWLDOVIRUVVKFRQQHFWLRQ
attacker# python sshBrute.py -H 10.10.1.36 -u root -F ,9 &21&/86,21
pass.txt
[-] Testing: 123456 3HQHWUDWLRQ WHVWLQJ DOORZV RUJDQL]DWLRQV WR DVVHVV
[-] Testing: 12345 YXOQHUDELOLWLHV SURDFWLYHO\ XVLQJ UHDOZRUOG H[SORLWV
[-] Testing: 123456789 DOORZLQJWKHPWRHYDOXDWHWKHSRWHQWLDOIRUWKHLUV\VWHPV
[-] Testing: password WR EH VXEYHUWHG WKURXJKKDFNLQJDQGPDOZDUHVFKHPHV
[+] Password Found: alpine LQ WKH VDPH PDQQHU WKDW DWWDFNHUV HPSOR\ 0DQXDO
)RU H[DPSOH ZH FDQ HDVLO\ FUHDWH PDOLFLRXV VHUYHU SHQHWUDWLRQ WHVWV DUH VWLOO PRUH SRSXODU DQG XVHIXO GXH
:HZLOOXVHWKH0HWDVSORLWIUDPHZRUNLQRUGHUWR WRPXFKGLIIHUHQWYXOQHUDELOLWLHVLQVHFXULW\VHFWLRQVIRU
TXLFNO\  FUHDWH  LQIHFWHG VHUYHU DQG SDJH KRVWHG DW H[DPSOH LQ KXPDQ IDFWRU ([SHULHQFHG HWKLFDO KDFNHUV
KWWSH[SORLW )RU WKLV H[DPSOH ZH DUHXVHGWRZULWLQJRZQVFULSWVRUHYHQDXWRPDWHRQHRI
FKRVH WKH H[SORLW PVBBDXURUD WKH YHU\ VDPH WKH VWDJHV LQ RUGHU WR SURFHHG TXLFNO\ DQG ILQG PRUH
H[SORLWXVHGGXULQJ2SHUDWLRQ$XURUDDJDLQVW*RRJOH VHFXULW\ OHDNV LQ WDUJHW V\VWHPV 7KLV DXWRPDWLRQ
attacker#msfcli SURFHVVFDQEHLPSURYHGE\XVLQJVFULSWLQJODQJXDJHV
exploit/windows/browser/ms10_002_aurora 5()(5(1&(6
LHOST=10.10.10.112 SRVHOST=10.10.10.112
URIPATH=/exploit >@ $=3LVNR]XE8VLQJSHQHWUDWLRQWHVWLQJLQFRPSXWHU
PAYLOAD=windows/shell/reverse_tcp QHWZRUNV DQG V\VWHPV IRU LQFUHDVLQJ OHYHO RI
LHOST=10.10.10.112 LPORT=443 SURWHFWLRQ  Materials of the third international
$IWHUSURIHVVLRQDOFRPELQDWLRQVZLWKS\WKRQVFULSWV scientific and practical conference FOSS /YLY
DQGPVIFRQVROHZHFDQPDQXDOO\FUHDWHRZQH[SORLWV  /YLY
IRUIXWXUHXVLQJLQSHQWHVWV%HORZLVDVXPPDU\RIWKH >@ <<6WHILQNR $=3LVNR]XE8VLQJ IUHH DQG RSHQ
NH\SRLQWVRIGLIIHUHQWLDWLRQVEHWZHHQWKHWZRW\SHV VRXUFHRSHUDWLRQDOV\VWHPVIRUSHQHWUDWLRQWHVWLQJLQ
7$%/( HGXFDWLRQDO SXUSRVHV  Journal of The National
University "Lviv Polytechnic", "Computer systems
&203$5,6212)0$18$/96 $8720$7('7(67,1*
and networks   S
0DQXDO $XWRPDWHG >@ <<6WHILQNR $=3LVNR]XE 5,%DQDNK
7HVWLQJ 0DQXDOQRQVWDQGDUG )DVWVWDQGDUG 3HQHWUDWLRQ WHVWLQJ ZLWK 0HWDVSORLW DQG VFULSWV
3URFHVV SURFHVV SURFHVV Materials of the IV-th International Scientific
/DERUDQGFDSLWDO (DVLO\ Conference "Information protection and security of
LQWHQVLYH UHSHDWDEOHWHVWV information systems"  S
+LJKFRVWRI
>@ '.HQQHG\ -2*RUPDQ 0HWDVSORLW7KH
FXVWRPL]DWLRQ
SHQHWUDWLRQ WHVWHUV JXLGH  No starch press, San
9XOQHUDELOLW 0DLQWHQDQFHRI $WWDFNGDWDEDVH
\$WWDFN GDWDEDVHLVPDQXDO LVPDLQWDLQHG FranciscoS
'DWDEDVH 1HHGWRUHO\RQSXEOLF DQGXSGDWHG >@ -DVRQ $QGUHVV 5\DQ /LQQ &RGLQJ IRU 3HQHWUDWLRQ
0DQDJH GDWDEDVH $WWDFNFRGHV 7HVWHUVElsiever - LondonS
PHQW 1HHGUHZULWHDWWDFN DUHZULWWHQIRUD >@KWWSZZZSHQWHVWVWDQGDUGRUJLQGH[SKS3UH
FRGHIRUIXQFWLRQLQJ YDULHW\RI HQJDJHPHQW
DFURVVGLIIHUHQW SODWIRUPV >@KWWSVZZZSFLVHFXULW\VWDQGDUGVRUJ
SODWIRUPV >@ %LVKRS 0 $ERXW 3HQHWUDWLRQ 7HVWLQJ  IEEE
5HSRUWLQJ 5HTXLUHVFROOHFWLQJWKH 5HSRUWVDUH Security & Privacy 'HFHPEHU  S
GDWDPDQXDOO\ DXWRPDWHGDQG
FXVWRPL]HG

7&6(7
)HEUXDU\/YLY6ODYVNH8NUDLQH