Open-source penetration-test automation

Question

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?

Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or headless web application security scanner?

Any other ways (or even ideas) to speed up penetration-tests that you would be willing to share? Do you use the Dradis Framework with other team members, or to organize your penetration-test results (or to produce reports)?

Are there open-source projects to do this (besides Metasploit RC files or the `save' command under the MSF console)?

Answer 1

Try SET from Social-Engineer.org. Whole site is a great resource.

Answer 2

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above.

Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills.

Port scanning:

Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and friends) is awesome for watching the packet counters on iptraf go blurry, but you can be assured accuracy will suffer.

My typical hedge on going fast is to run multiple rounds of nmap scans: Preferably on different days and at different times. This helps to minimize accuracy-killing hazards like scheduled backups that saturate bandwidth.

For really big scans try unicornscan. It has been awhile, but I took notes that last time I did a respectably large Internet based port scan:

To recap: We performed a sweep of 400,000+ public IPs across multiple continents by configuring the scans to do a full TCP port scan of each IP, sustained ~55 Mbits/s using between 3 and 5 systems, and completed it in a matter of days.

This is pretty good considering by sending two SYN probes per port it meant sending ~52.5 billion packets and producing some 3 Terabytes of data.

Vulnerability scanning:

This may not be true so much today, but a few years back popular commercial vuln. scanners would optimize their scans out of the box for speed. Marketing and sales pushed for it because customers tie quality to how fast they get scan results.

So as a vendor (disclosure: I used to work for one) the game was to reduce the number of checks in favor of speed. Full TCP or UDP scans? No way. Individual vulnerability checks that take time? Bury them.

You can see where this is going - if you want accuracy then spend a few minutes and customize your preferred vulnerability scanner(s) for accuracy (and coverage). If you want speed then know you are sacrificing those properties.

Combining the above:

I’m bored with how often port scan results differ from tool to tool on the same engagements. I hate it when I pay for a per IP vulnerability scan (e.g. Qualys) and the tool repeatedly misses open ports that I verified to be open. I like to take the results from my port scans (see above) and customize every vulnerability scan tool I’m using to only hit those ports my custom scans discovered to be open. This can save TONs of time.

Cloud boosting:

For Internet based scans I now almost exclusively use cloud VMs. My favorite is linode.com. Linode’s AUP so far doesn’t forbid port scanning (Amazon’s does). Spinning up 30 VMs to distribute scanning efforts across non-regional data centers can put the fun back into port scanning. It’s easier to get aggressive with tuning as well given the favorable latency and bandwidth conditions. My point here is cloud VMs are awesome for boosting scanning capacity.

Answer 3

Some thoughts I had while reading this question...

Penetration Testing is very dependent on the circumstances. Yes, there are automated tools, but even if they help, they cannot do everything. From my experience, automation gets in the way unless applied to a specific step in the pen-testing/auditing process.

I actually just got interested in OpenVAS. It's not technically a penetration-testing tool, but it's very helpful with reconnaissance. And if you look it up, keep in mind that a new version (3.2.3) released this morning.

This isn't open source, but another tool to investigate is CoreInsight. I'm in the process of getting a chance to play with it and, though i understand that it won't have the maneuverability of Core Impact, it should be a very interesting and helpful tool.

Though i have my doubts about automation in pen-test, i'm interested in what others have to say.... (+1 to you, sir)

Answer 4

If you need to bruteforce a website and act like a real browser with javascript you could write a couple of lines in http://zombie.labnotes.org/. I used it for user-enumeration, wordlist-generation out of userinfos and bruteforcing at the same time.

var zombie = require("zombie"); var assert = require("assert");

// Load the page from localhost zombie.visit("http://localhost:3000/", function (err, browser, status) {

  // Fill email, password and submit form   browser.
    fill("email", "zombie@underworld.dead").
    fill("password", "eat-the-living").
    pressButton("Sign Me Up!", function(err, browser, status) {

      // Form submitted, new page loaded.
      assert.equal(browser.text("title"), "Welcome To Brains Depot");

    })

});

Without the Javascript-feature i use ruby - mechanize.