4

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm wondering if there's a framework that supports logging of all shell activities as well as all tools relevant to the assessment (e.g. traceroute, metasploit, hping3, etc.)

Does such a shell exist?

Improve this question
4
  • 1
    Perhaps this is not enough, but what about the Linux command 'history'?
    – Jeroen
    Commented Apr 11, 2016 at 1:51
  • 1
    Ahhh, a question that has been plaguing enterprise pentesters for years. I've been searching for such a tool as well. Faraday is one such tool, but it has cons, like relies on Qt3 and other outdated libraries, making installation and maintenance extremely difficult. I've been considering writing my own tools. You can log your bash/zsh history, which will capture your commands, but how to ship them off for centralized management?
    – h4ckNinja
    Commented Apr 11, 2016 at 1:55
  • @Jeroen-ITNerdbox no, not sufficient. We need timestamps to correlate to activities. it'd be easy enough to wrap busybox with some sort of wrapper, or re-write a variety of applications, but who's got time for that?
    – C.J. Steele
    Commented Apr 11, 2016 at 2:24
  • 1
    could you do some sort of screen sharing or streaming program and simply record the output?
    – coffeethulhu
    Commented Apr 13, 2016 at 13:44

3 Answers 3

Reset to default
1

Burp Suite lets you save/restore the state of your current pen test. For me this typically means a log of all HTTP requests made. In addition to this you can save all HTTP requests that you sent for further examination/exploitation.

It sounds like you want to track more than just the HTTP level of your attack, but I'm not sure that there is a single tool out there that will accomplish this - you may need to use several tool and then aggregate the data. If this is the case I think that Burp Suite would be an excellent choice for logging/tracking HTTP level attacks.

Improve this answer
1
1

You could write a script (in bash or python) to replay your commands and act as a local proxy for your commands execution. This way, you could split the results of the log into each commands.

This script should not be too long to write for the gain you will get. That would be my solution :)

Improve this answer
0

Well TBH I'd be inclined to question exactly what the customer is looking for if asked for that level of detail, it would seem excessive to need to know everything a pen tester did during a review (and surely a customer that paranoid would have excellent IDS in place and could derive it from that ;) )

That said if you do feel the need, as @abe-miessler says for web application testing, just run all your tests via burp and then provide a burp log. To add to that recommendation I'd suggest using a burp plugin like logger++ which records details of tests performed by the scanner/intruder etc.

If you really want to do this on a network test, then for packet capture I guess you could run tcpdump with a capture filter of only the target network and combine that with bash history to provide a list of commands.

If you want to get a bit fancy and DevOps style you could run all your commands from a Docker container, then provide the output of the docker logs command as evidence of what commands you've run.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .