0

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the firewall?

Example scenario/cluster:

  • firewall
  • loadbalancer
  • webserver 1
  • webserver 2
  • database server
  • storageserver
  • log/monitoring server

Let's assume the website or web application is only accessible over port 80 (HTTP) and port 443 (HTTPS). All other ports are filtered by the firewall except one extra open port for a (management) VPN connection. All the traffic is going from firewall to loadbalancer, to webserver (using database- and storageserver). The log/monitoring server is stand-alone.

On one side I could argue that scanning behind a firewall (with IP whitelisting) is more desirable because you could possibly get insight in more vulnerabilities and mitigate those, even while it's unlikely they can be exploited.

On the other side, I could argue not to whitelist the scanner IP addresses because this scenario is more realistic (blackbox) and wouldn't give the advantage of scanning areas that are filtered from the world wide web in the first place.

Nobody can access the database server or monitoring server directly but if those machines are for example using "123456" as a root password or missing 100+ OS patches making them vulnerable to a load of CVE's. You'd like to get to know that I suppose.

What is the desirable solution/scope here and what is best to advice someone about this? Does the IP whitelisting introduce a higher responsibility for me as an ethical hacker? Since the customer is introducing a weak point in their security by whitelisting the scanner IP addresses.

Improve this question
1
  • When in doubt, do both? Do you need to make a choice? Also note that it is normally possible to spoof IP addresses.
    – Maarten Bodewes
    Jun 20, 2016 at 18:18

2 Answers 2

Reset to default
2

Nobody can access the database or monitoring server directly

... as of now.

My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available.

On top of that you may run into issues when scanning through a firewall (resources exhaustion). This is something which you can usually fine tune but there is a risk anyway. I once ran zmap by mistake against networks behind firewalls and it did not end well (this is an extreme case).

The same question arises when discussing whether to pentest with a WAF on or not. Again, I find that knowing there is an issue and relying on virtual patching / blocking is too risky.

Improve this answer
2
  • @WoJs Does the IP whitelisting introduce a higher responsibility for me as an ethical hacker?
    – Bob Ortiz
    Jun 23, 2016 at 22:42
  • I am not sure what you mean by "higher responsibility"?. If you mean "should I be more careful"? then probably yes, but not because you are whitelisted - rather because you assume that the system is weak on its own since if you have such a concern in the first place. At the end the bare system should be resistant enough to be secure without firewalling. There are cases where this is not possible (a large legacy system with legacy connections) but in that case this system must not be made directly available at all - there should be an intermediate. I will update my answer.
    – WoJ
    Jun 24, 2016 at 8:23
1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list - and the bomb will be successfully planted into a website directly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .