8

What are the limitations when performing a penetration test with a virtual machine instead of a physical one?

2
  • 6
    Are you performing pen testing from a virtual machine, or against a virtual machine?
    – Brian Duke
    Commented Sep 6, 2015 at 15:42
  • @user3623501 I think it was very clear from the OP's question itself. He meant from within the VM and not against any VM. Commented Sep 7, 2015 at 4:45

6 Answers 6

5

In my opinion performing a penetration test from a virtual machine is actually the preferred way of doing it from opsec perspective (i.e. to maintain separation between your clients' data).

Limitations may arise from the fact that you can't access the underlying hardware directly, in particular:

  • Wired network interfaces: some host operating systems (e.g. OSX) will continue using the wired network even if you explicitly disable it in host OS and bridge the virtual machine to it. From the network perspective that means two separate MAC addresses on the same port, which sometimes triggers the NAC.
  • Wireless interfaces: most hypervisors don't emulate wireless devices at all
  • GPU: if you want to use something like oclhashcat for password cracking, you need direct access to the GPU

That being said most of these problems can be solved by dedicating the necessary hardware to the VM (e.g. PCI or USB passthrough).

3
  • 1
    I think one can perform wireless security tests from within the VM - you would just need to install an alpha card to help you. Commented Sep 7, 2015 at 4:47
  • Yes, that part of my answer was a bit imprecise. It is definitely possible with a wireless interface dedicated to the VM.
    – eax
    Commented Sep 8, 2015 at 22:09
  • Don't most VMs lack the ability to put the physical adapter into promiscuous mode? That would cripple any packet sniffing vectors. Personally I always use physical hardware when sniffing because of this. Commented Sep 11, 2015 at 18:50
2

I use docker-machine and packer/vagrant with vmwarefusion as my provider. I can check the status of my machines with:

docker ps
vagrant global-status

Vagrant is used for Windows and OS X images while Docker is used for Linux and FreeBSD.

My Kali 2.0 Docker image, for example, started at around 550MB and is now around 1.8GB. I save a lot of disk space this way, and am capable of diffing my images easily to determine what changed and how it changed. I have images for Arch, CentOS, Debian, Fedora, FreeBSD, Kali, Qubes, REMnux, RHEL, Scientific, and Ubuntu.

Accessing my containers is very easy. I can have a brand new OS X or Windows image booted in 15 or so seconds. Docker is much faster -- fractions of a millisecond to attach to a freshly-created running container. I use CTRL+P CTRL+Q to detach, almost like screen or tmux.

In my opinion, it's the opposite effect: I feel limited in my penetration-testing capabilities without virtual machines. I especially feel empowered with containers and Docker-based workflows. Using a single, host-only OS is the real limitation. How else are you supposed to emulate environments, stage tools, or develop new ideas without a constantly-evolving lab?

1
  • Good one. Docker is a great solution for pen testing. Commented Sep 7, 2015 at 6:06
0

You may have some packet injection issues as the VM will see the virtual interface instead of the physical interface. This will only effect some wireless attacks.

Other than this I cannot think of any other issues.

0

In my personal experience, virtual machines don't really matter as long as you do not have programs running which sometimes need direct interaction with certain hardware.

For instance scenarios where you want to directly address the GPU (password cracking) or where you want to perform some low-level network operations it might give you issues.

Furthermore it also depends on the type of virtualization you use.

2
  • Out of curiosity, are rowhammer attacks different against VMs? It seems like they would be, given the interesting hardware/software dynamics at play...
    – KnightOfNi
    Commented Sep 6, 2015 at 20:16
  • I honestly have no idea, then again it all would depend on the type of virtualization as well Commented Sep 6, 2015 at 20:56
0

Theoretically, the only limitations you could face when using a virtual machine are inherent to hardware limitations themselves and this depends fully on the nature of the pentest you want to perform. In practice, you can say there are no limitations in (very) most and common cases.

0

In my experience with MSF (Metasploit Framework) the more horsepower you can throw at it the better - you will prefer a big powerful VM with a fast WAN connection over a dedicated i3 notebook with 4GB RAM.

2
  • @Danny Lieberman - I cannot endorse the idea in network pentesting (MSF) but in web applications, I don't think to rely on such automation and increasing memory for such task is completely beneficial at all. Commented Sep 7, 2015 at 4:49
  • I meant 4GB. My experience with MSF is the more resources the better. With ZAP web app vulnerability testing, the resource requirements seem to be much more modest but YMMV. Commented Sep 7, 2015 at 6:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .