International Journal of Network Security, Vol.18, No.3, PP.

501-513, May 2016 501

Penetration Testing and Mitigation of

Vulnerabilities Windows Server
Deris Stiawan1 , Mohd Yazid Idris2 , Abdul Hanan Abdullah2 , Mohammed AlQurashi3 ,
Rahmat Budiarto3
(Corresponding author: Deris Stiawan)

Department of Computer Science, Universitas Sriwijaya, Indonesia1

Department of Computing, Universiti Teknologi Malaysia, Johor Bahru, Malaysia2
College of Computer Science and Information Technology, Al Baha University, Kingdom of Saudi Arabia3
(Email: [email protected])
(Received Jan. 15, 2015; revised and accepted Apr. 11 & Aug. 24, 2015)

Abstract ous work [14] which compares attack sophistication with

attacker skill knowledge.
Cyber attack has become a major concern over the past Meanwhile, analysis by [6, 12, 18] highlights an explo-
few years. While the technical capability to attack has sion of security threats in recent years such as Trojans,
declined, hacking tools - both simple and comprehensive viruses, worms, adware, spyware and DoS which are con-
- are themselves evolving rapidly. Certain approaches are tinuing to grow, multiply and evolve. According to [14]
necessary to protect a system from cyber threats. This indicate the technical capability to attack tended to de-
work engages with comprehensive penetration testing in crease. On the other hand, hacking tools are getting more
order to find vulnerabilities in the Windows Server and effective and also increasingly available and accessible to
exploit them. Some forms of method penetration test- the public. Moreover, attackers are able to detect vulner-
ing have been used in this experiment, including recon- abilities faster than security experts or vendors and can
naissance probes, brute force attacks based on password cause time delays by patching in vulnerabilities.
guessing, implanting malware to create a backdoor for
escalating privileges, and flooding the target. This exper- Research conducted by [26, 27] found that Windows
iment was focused on gaining access in order to ascertain Server has more serious vulnerabilities, as several of its
the identities of hackers and thus better understand their services and daemons are unsecured and open to ac-
methods and performed penetration testing to evaluate cess. This lays open the possibility of exploitation. Ad-
security flaws in the Windows Server, which is a famous ditionally [32] located vulnerabilities in the Apache and
OS for web applications. It is expected that this work will IIS HTTP server on the Windows Server operating sys-
serve as a guideline for practitioners who want to prepare tem. [28] conducted an attack scenario on the Windows
and protect their systems before putting them online. Server.
Keywords: Mitigation, penetration testing, vulnerabilities, In order to understand how to protect against and pre-
windows server vent attacks, it is useful to understand from the attacker’s
perspective what methods they will use, what goals they
have and how they launch their attacks. This experi-
1 Introduction ment takes improvised actions to highlight several types
of attacks carried out such as: probes to obtain detailed
A definition of hacking is presented by [9, 25]. These information, brute force for guessing passwords, gaining
sources also identify security violation trends in internet- privileges access and flooding the target to reduce the
working and their effects. More illegal activities such as availability of services.
hacktivism, hacking and exploiting weaknesses have been The remainder of this paper is organized as follows.
described by [12, 16, 29] offer a different perspective by Section 2 presents the related works. Section 3 presents
highlighting the potential economic threats and impacts the taxonomy of the attack this experiment is concerned.
of cyber attacks. A growing problem, hacking activities Section 4 describes experimental experiments. This sec-
combine easy to learn pentest with a variety of tools such tion deals with data collecting and an attack scenario in-
as those offered by C.E.H [11]. Moreover, they use both cluding scanning and exploitation for mitigating vulner-
simple and comprehensive tools (defined as ’Metasploit’), ability. Finally, Section 5 offers a conclusion and sugges-
as defined by [5, 21]. This reinforces the findings of previ- tions for future work.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 502

2 Related Works of attack: Probes, Remote to Local (R2L), User to Root

(U2R) and DoS as widely used in the field of intrusion
Penetration testing has been described in different ways detection/prevention system, with reference to [3, 4, 8,
since 1989 by [24]. New methods and approaches are con- 31].
tinuously being expanded from year to year. In 2001, [7]
described certain steps needed to prevent threats and con-
vey the importance of understanding the mindset of an 3 Experiments
attacker, as well as their methods and goals. In line with
that, [2] has suggested a methodology to ensure that the The dataset employed in this study was Intrusion Threat
penetration testing exercise is reliable, repeatable and re- Detection Universiti Teknologi Malaysia (ITD UTM), as
portable. shown in Figure 1, available in [30]. All attacks were
executed and infiltrated on ITD UTM. The network envi-
Analyses and predictions by [12, 18] indicate that
ronment is set up for exploitation using Windows Server
there has been an explosion of security threats in recent
and two terminal clients running as attackers. They are
years. This has been corroborated and previously pre-
connected to 3COM Superstack II 100 Mb/s, as shown in
dicted by [17, 19], which describe a future war based on
Figure 1.
cyber attacks. More recently, [23] has predicted and anal-
ysed cyber attacks in the context of further security vio-
lation trends. Meanwhile, [10] has referred to Microsoft 3.1 Data Collecting and Procedures
warning users about the strengths of character passwords Several steps must be taken to conduct these experiments.
such as: a combination of case sensitive letters and digits, This work is an improvement on some of the advice of-
maximum-minimum password age, and minimum pass- fered by [22] and this research agrees with the argument
word length. expressed by [1], particularly on these problems: (i) re-
Furthermore, it seems that every bug can cause vul- cent trends and new methods of attack have been in-
nerabilities which are existent and undocumented, of- volved, (ii) control and guideline steps for penetration,
ten never being revealed, discovered or exploited. From and (iii) various methods of attack for penetration and
the attacker’s perspective, vulnerability is an opportu- mitigation become comprehensive. In this experiment,
nity that can be exploited. A vulnerability database is a three weeks were spent collecting data and finding vul-
collection of records containing technical descriptions of nerability within CVE and security communities. More-
vulnerabilities in computer systems. Common Vulnera- over, five weeks was spent attempting penetration testing
bilities and Exposures (CVE) began in 1999 as a result of on the victim. There are some differences in the results
the adoption of a common naming practice for describing obtained in the first and second data collection. The first
software vulnerabilities and including security tools and data were collected directly from the server, regardless of
services as well as on the fixed sites of commercial and the network broadcast. Conversely, the second data were
open source software package providers. We argue that collected using the hub terminal which also captured the
dependencies exist between scanning phases and informa- broadcast network. Furthermore, this procedure was fol-
tion holes from CVE vulnerability databases. This has lowed in this section:
consequences for access.
Additionally, work by [13, 15, 20] describes the benefits 1) To distinguish between normal traffic and attack, the
of CVE compatibility, integrating vulnerability services attack was separated and divided into several stages
and tools allowing more complete security provision and based on time, machine target and method of attack.
more alert advisory services. Every month CVE MITRE 2) Machine 10.10.10.1 is a NAT Firewall server that
receives between 150 and 300 new announcement alert both allows and denies private traffic to and from
and advisory submissions from ISS, Security Focus, Neo- the internet.
hapsis, and the National Infrastructure Protection Cen-
tre. Currently CVE identifies compatible enablement 3) TCPdump is used to sniff real traffic. It uses the lib-
data exchange between security products and provides cap library to capture packets and has the ability to
a baseline for evaluating coverage of tools and services. consider the properties of an ideal as a packet snif-
There are thousands of information vulnerabilities within fer. TCPdump produced raw data (pcap files) during
the CVE database. Unfortunately, time is required to experiments conducted via 10.10.10.30.
make a patch release after exploitation has been found.
4) Machine 10.10.10.40 running on Snort IDS 2.8.5.2
Consequently, there is usually a a time delay between an
(Build 121), PCRE ver 8.12. This is used to iden-
exploitation identification and a patch and signature re-
tify the threat as well as to compare attacks carried
lease. It can be argued that there are dependencies in the
out which can be recognised by snort signature.
results between the scanning stages [15] and information
vulnerabilities in the CVE database. This means that 5) Two machine attackers, 10.10.10.15 (called Hacker
the vulnerability could be a security flaw exploitable by XP) running on Windows XP SP3 and 10.10.10.20
attackers. based on Backtrack 4 (called Hacker BT) to pene-
In this experiment followed four dominant categories trate Windows Server SP3 in 10.10.10.25.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 503

Figure 1: Topology of test bed environment

Meanwhile, in this experiment all attacks were exe- • Attackers try to escalate privilege to adminis-
cuted on ITD UTM. The attack scenario for penetration trator level;
is further illustrated below. • Attackers attempt web attack via HTTP
Step 1. Scanning and launch ”/.... access”, ”/ root access”,
”/etc/passwd”, ”/usr/bin/id”, ”/etc/shadow
• Attackers probe the network 10.10.10.25 via access” via HTTP port 80;
GFI Scanning, Nessus, N-Stealth and Nmap;
• Attackers attempts XSS attack - Attackers sniff
• Attackers port reconnaissance of HTTP services the network via Cain Abel by utilising of ARP;
via Nikto;
• Attackers launch man in the middle attack and
• Attackers find open port to potential penetra- SMB Unicode;
tion, 21 (FTP), 23 (Telnet), 80 (HTTP), 445
(SMB), 1433 (Microsoft SQL Server), 1026 (Re- • Attackers add user ”puma” password :
mote Server). 12345678 via console;
• Attackers add user ”mike” password : 12345678
Step 2. Brute Force via console;
• Attackers attempt password of FTP & Telnet • Attackers add user ”john” password : 12345678
via brute-force tools; via console;
• Attackers attempts to host 10.10.10.25 for • Attackers create directory /mkdir ”tools” in
guessing password remote access via TSgrinder; 10.10.10.25 via console;
• Attackers attempt SQL Ping and Brute force • Attackers crack root level hashing password via
SQL Login; localhost;
• Attackers successfully find user authenticated of • Attackers upload some files including Trojan to
FTP; the victim via FTP;
• Nessus confirms user access ”anonymous” en-
• Attackers successfully implant the netbus to cre-
able and allowed in FTP;
ate backdoor via FTP;
• Attackers log in to the host via FTP Client.
• Attackers execute and enable netbus via remote
Step 3. Gaining privileges desktop, then implant keylogger.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 504

Figure 2: Attack scenario diagram

Step 4. DoS can provide all the detailed information. They have lim-
itations particularly in translating the feedback packet
• Hacker XP and Hacker BT send a large from the target host. Some tools identify the open port
number of ICMP packets repeatedly to flood and the rest are closed.
10.10.10.25; As mentioned in Section 3.1’s attack scenario, some
• Attackers launch attack LAND via sending TCP open ports were found and used to scan data coming
SYN; from such ports. The success of this process depends on
the operating system and the application that is run on
• Attacker flood packets using forged source; the server. Some tools are used in Hacker BT running
• Attackers flood traffic host victim via UDP to Zenmap, Xprobe2, Nikto, HTTPrint, and Hping2. Mean-
slow down the response of the target. while, the Hacker XP machine runs these tools: GFiLAN,
Legion, Nessus, N-Stealth, X-Scan, and LanSpy, which
is a comprehensive target and a slow mode of scanning.
3.2 Scanning This stage of attack depicted in Figure 2 produces visu-
alisation, as shown in Figure 3(a) and (b) below.
An attacker’s first steps need to obtain information about
the victim and its environment. They map the network
to determine the target, followed by scanning in order to 3.3 Vulnerability
interrogate and reconnoitre the victim. The attacker tries This section presents vulnerabilities that arose during the
to map out the IP Address/subnet mask information and scanning stages. From a hacker’s perspective, searching
operating system that is in use, what services daemons are for any kind information that can be exploited from the
actively run and the kernel/services pack used. In other CVE database may identify vulnerabilities. It can be ar-
words, the attacker tries to map out the infrastructure gued that there are dependencies between scanning and
and resources of the network. information holes within a CVE vulnerability database
In this stage, several tools and scenarios are used to with respect to gaining access. The critical and medium
gather information, and findings known as vulnerabilities risk vulnerabilities are as follows:
are mixed and combined to achieve the expected results.
Some of the measures are adopted to enable these tools 1) CVE-2011-1267, CVE-2011-1268, CVE-2011-0476
to complement each other. Moreover, none of these tools confirm SMB Server-Client to allow remote code ex-
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 505

Figure 3: (a) Overall scanning traffic, (b) overall traffic of penetration stages. (c) refers to handshaking traffic
attackers with victim in scanning stages and (d) shows penetration.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 506

ecution if an attacker sends a specially crafted SMB presented in Section 3.1 and Figure 2 above, attackers dis-
response to a client-initiated SMB request. covered multiple vulnerabilities. They successfully found
the legitimate users then created a new user, and success-
2) CVE-2008-4250, RPC vulnerabilities allow remote fully used a brute force FTP log-in resulting in the mal-
code execution. An attacker could exploit this vul- ware to successfully create a backdoor. Figure 2 shows
nerability without authentication to find arbitrary illustrated penetration of Windows, as follows:
code & worm exploitations.
1) Hacker BT and Hacker XP attempted to conduct
3) CVE-2006-5583 is vulnerable and can be exploited surveillance whereby the attacker tries to map out
with regard to buffer overflow SNMP, allowing a re- of IP Address/subnet mask information, operating
mote attacker to execute arbitrary codes via a crafted system being used, and which services are running
SNMP packet via exec code overflow. in 10.10.10.25. In other words, these stages are
4) CVE-2006-3439 confirms vulnerability from buffer called probes or scanning to map out and recon-
overflows. This attack allows remote attackers, in- noitre the victim’s network infrastructure. Nessus,
cluding anonymous users to execute an arbitrary Nmap, Nstealth, Legion and GFILanGuard are used
code via a crafted RPC message. to communicate with the data base server several
times to check available updates of existing vulner-
5) CVE-2006-0026 and CVE-2000-0071 is vulnerable to abilities. There are some potential vulnerabilities to
IIS. This attack can allow local and possibly remote be exploited which are as follows:
attackers to execute arbitrary codes via crafted Ac-
tive Server Pages (ASP) and allows a remote attacker PORT STATE SERVICE
to obtain the real pathname of a document. 21/tcp open ftp
23/tcp open telnet
6) CVE-2003-0352, CVE-2003-0003, Buffer overflow 80/tcp open http
in a certain DCOM interface for RPC allows 111/tcp open rpcbind
remote attackers to execute arbitrary codes 161/udp open snmp
via a malformed message, as exploited by the 445/tcp open microsoft-ds
Blaster/MSblast/LovSAN and Nachi/Welchia 1027/tcp open IIS
worms. 1433/tcp open ms-sql-s
7) CVE-2011-1247, Path vulnerability from Microsoft
active accessibility enables local users to gain privi- 2) Specific techniques are used to escalate privilege, at-
leges via a Trojan horse DLL in the current working tempt password one by one via guessing, theft, sniff-
directory. ing and cracking the password direct to target. From
the attacker’s perspective, the challenge is to find
8) CVE-2011-0654, Buffer overflow in Active Directory the legitimate user and implant the Trojan to cre-
services. This attack allows remote attackers to exe- ate a backdoor. The attackers must prepare a dictio-
cute arbitrary codes or cause a denial of service via nary/word list, accuracy in selecting the dictionary is
a malformed BROWSER ELECTION message. a must and cracking the password in time depends on
the length of the password’s characters. Otherwise, a
3.4 Penetration Testing brute force password via user ”administrator” can be
successfully performed of FTP by Hydra and failed
The stages identified certain holes to be exploited from attempt Telnet.
previous stages and launched the attack, a so-called User-
root@bt:∼# hydra -l administrator -P
to-Root (U2R) attack. This extends the user’s privilege
passdict.txt 10.10.10.25 ftp
to administrator/root to obtain full authorization access.
[DATA] 16 tasks, 1 servers, 26870 login tries
The attacker can create the new user, implant the mal-
(l:1/p:26870), ∼1679 tries per task
ware, create the backdoor and clean their track from the
[DATA] attacking service ftp on port 21
log server. Normally, the attacker starts with accessing a
[21][ftp] host: 10.10.10.25 login:
normal local user account then later exploits vulnerabil-
administrator password: intrusion
ity to privileges. Moreover, the attackers also launched
brute force for guessing the password, cracking the pass-
word, web injection and man in the middle attack. Moreover, the attacker launched TSgrinder to guess
This step is called the Remote-to-Local (R2L) attack. the password of the remote desktop. This failed and
Request packets were sent to a machine over a network the dsniff was launched to the sniff user and pass-
which then exploits machine’s vulnerability to illegally word in broadcast network. HTTP brute force was
gain local access as a user without privileges. In this used to guess the web directory. Meanwhile, the traf-
stage, the attacker focused on brute force in order to gain fic attempt of brute force is dominant, as shown in
access and escalate privileges. According to the scenario Figure 3(a).
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 507

3) The attacker launched powerful tools such as Metas- to be state and number of ports accessed by a single
ploit, Cain and Abel and Netcat to find the com- source, (iii) TCP flags are used randomly during the
mand prompt. They attempted to obtain privileges attack, (iv) packet size and packet length are changed
and attack launches via the command prompt, which frequently.
freely creates a new user account and removes the
traces. In this step, after obtaining a valid user, the 2) Netbus have these characteristics: (i) computer vic-
attackers attempted to implant a Trojan to create tims or servers typically listen on specific ports wait-
the backdoor. They successfully implanted the Net- ing for instructions from attackers, (ii) they use TCP
bus Trojan and executed the ”Abel” in an ARP poi- protocol and port address 12345 to communicate
son attack. New users ”puma”, ”mike” and ”john” and each message has a fixed-length header, (iii) the
were created before the attackers attempted to crack variable-sized data section follows the header and its
the administrator password via John the Ripper and size is specified in the message-size field of the header,
Rainbow.The attacker attempted an IIS attack via (iv) the flag is fixed to the computer victim during
buffer overflow and SQL injection to break into a sys- the communication process.
tem. During that time, they tried to find the weak- 3) Brute force of FTP: (i) this attack generates repeti-
nesses and structure of the website via SQL injection tion response, particularly content of flags and pro-
in order to ascertain certain information and the er- tocol length, (ii) anonymous user login attempts will
ror page from HTTP server. occur, (iii) the port address and flags are fixed dur-
4) Finally, to reduce availability the attackers contin- ing attack, (iii) data connection uses the well-know
uously launched DoS attacks by flooding the ICMP port 20 at the server side and control connection is
and UDP. They were successful; the system could not established on port 21.
respond and crashed after a few minutes. Repeated 4) Scenario of NetBIOS NULL session attack tries to
requests meant that the target was unable to handle attack enumeration user and getting administrator
the service and reduce the availability. The results of level, it have characteristic: (i) Packet size, total
this scenario are shown in Figure 3(b) below. length and flags fixed with randomly generated on
Port 139 (NetBIOS Session Service) and Port 445
4 Experiment Results and Discus- (Common Internet File System), (ii) The flag value
is fixed and dominate by NetBIOS protocol session,
sion (iii) Vulnerability in Port 445 is possible to launched
SMB or Common Internet File System (CIFS) at-
Snort is used to identify and recognize threats from tack, (iv) The TCP protocol are fixed during attack
data traffic. It produces lots of logs contained in ma- attempt, NetBios Session Services (NBSS) port 135,
chine 10.10.10.30 ”var/log/snort” directory. The scan- Remote Procedure Call (RPC) port 137, NetBIOS
ning stages produces 677,914 packets and snort identi- Name Service port 138 and NetBIOS Datagram Ser-
fied 45,139 alerts among them as threats. Meanwhile, vice port 139.
in the penetration stage there were 33,865,687 packets
and 265,200 were identified by the existing signature as a 5) The characteristics of man in the middle attacks are:
threat. (i) the ARP packet lack flag and protocol length
value, (ii) the ARP broadcasts from the attacker to
4.1 Attack Pattern all IP addresses in one subnetmask and without infor-
mation of port source and destination, (iii) NetBIOS
This section presented some sample attack patterns datagram fixed used port 138 and NetBIOS Name
(Probe, U2R, R2L and DoS) from the experiment. Ev- Service port 137.
ery alert was compiled via snort and pcap files. In this
case, the pcap file was extracted and revealed some fea- Meanwhile, the number of rows that were gener-
tures such as: time stamp, source IP Address, destination ated by snort due to repetition of the same informa-
IP Address, Protocol, size of protocol, Flag of Protocol, tion were observed. This can be simplified by initialis-
Total Length of packet and content of packet. ing the signature-id and priority. Each alert comprises of
From observations that were made, specific character- signature-id, priority, source of IP Address, source port,
istics of line to line attacks from can be recognised from destination of IP Address, destination of port address,
the header and payload of packets. They have a unique timestamp, Time To Live, Type of Service, IP Length
pattern which tends to iterate in a particular line. Some and Datagram length.
characteristics of pattern are as follows:
4.2 Identify of Probe
1) Web scanning, especially HTTP and HTTPS recon-
naissance, has the following characteristics: (i) each In this phase, snort confirms that there are 4078 lines
packet has a source and destination IP address and identified as ”SCAN FIN” as shown in Figure 4 below
port numbers are spoofed, (ii) connections are said and Table 1 shows the total attempts at probe attacks.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 508

Figure 4: Probe stages

Figure 5: Root to Local (R2L)

International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 509

Table 1: The Number of Alert from Scanning stages

No Detected Alert Priority Total

1 SCAN FIN 2 4078
2 NETBIOS SMB repeated logon failure 1 453
3 WEBROOT DIRECTORY TRAVERSAL 3 433
4 WEB-MISC http directory traversal 2 142
5 NETBIOS SMB repeated logon failure 1 101
6 NETBIOS SMB-DS repeated logon failure 1 74
7 (portscan) TCP Portscan 2 49
8 ICMP Timestamp Reply 1 31
9 SQL ping attempt 3 17
10 ICMP Information Request 3 15
11 SCAN nmap XMAS 2 10
12 ICMP webtrends scanner 2 9
13 RPC portmap listing TCP 111 2 6
14 SCAN Amanda client version request 2 4
15 ICMP superscan echo 2 4
16 NETBIOS SMB-DS ADMIN$ unicode share access 3 4
17 NETBIOS SMB-DS D$ unicode share access 3 2
18 (portscan) TCP Portsweep 3 2
19 NETBIOS SMB-DS C$ share access 3 1
20 NETBIOS SMB-DS ADMIN$ share access 3 1

4.3 Identify R2L failures and crashes shows in Figure 7. Table 4 shows the
number of alerts from this attack.
Figure 5 shows one of the attacks as described in the 2nd
scenario above. This attack focuses on obtaining privi-
leges for the system. The attacker launched several meth- 4.6 Network Traffic Visualisation
ods to attempt to find the passwords for FTP and Tel- This section presented the overall network traffic from
net. Moreover, Figure 3(b) demonstrates that traffic of scanning and penetration stages shown in Figure 3 be-
brute force becomes very dominant. Meanwhile, Table 2 low. Item (a) depicts the overall traffic of HTTP from
shows the number of alerts from this attack. The attack- scanning stages and item (b) shows the dominant traf-
ers tried repeatedly to guess the password by using the fic from brute force attacks. Pecentage of SSH/Telnet is
default user. allocated 84.96% and ICMP allocated 6.41% from total
overall traffic.
This attack focused on achieving access and escalat-
4.4 Identify U2R
ing privileges, especially penetration via brute force to
The attackers just focused on how to gain escalating priv- FTP and Telnet. Point (c) in Figure 3 shows some scan-
ileges via level ”administrator/root”. They succeeded in ning tools from attackers to victim and some of the tools
creating some new users with administrator level, im- with open connections to the internet. We also see here
planting the malware and finding the backdoor. Figure 6 whether there are any updates of existing vulnerabilities
shows a sample from this attack and how the attackers in their database. Meanwhile, item (d) is handshaking
got into the system via an ”anonymous” user, then at- traffic attackers and victims in penetration stages; the
tempts privileges infiltration via change working directory mark indicates that the attacker launched a comprehen-
(CWD) of FTP. Table 3 shows the number of alerts from sive attack. Items (c) and (d) highlight greater traffic
this attack. flows from 10.10.10.20 and 10.10.10.15 to victim.

4.5 Identify DoS 5 Conclusions and Future Works

Flooding to Denial of Services (DoS) is the final scenario. We believe that penetration testing is vital in the search
Within hours the attackers attempted to disrupt the nor- for all kinds of vulnerabilities and for evaluating overall
mal functioning to affect the availability of the target and systems. However, the small amount of vulnerability in-
succeeded. The system response delay value rose slightly formation obtained should be of particular concern. This
as compared to before the attack. The result was system paper presents the vulnerabilities of Windows Server.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 510

Table 2: The Number of Alert from R2L stages

No Detected Alert Priority Total

1 INFO FTP Bad login 2 67625
2 WEB-PHP remote include path 1 2709
3 WEB-MISC cross site scripting attempt 1 1380
4 COMMUNITY WEB-PHP XSS attempt 1 596
5 COMMUNITY WEB-PHP XSS attempt 1 510
6 NETBIOS SMB repeated logon failure 1 453
7 NETBIOS SMB-DS repeated logon failure 1 106
8 WEB-MISC Tomcat servlet mapping cross site scripting attempt 1 19
9 (ftp telnet) Invalid FTP Command 3 18
10 WEB-CGI perl command attempt 2 13
11 FTP CWD ãttempt 2 2

Table 3: The Number of Alert from U2R stages

No Detected Alert Priority Total

1 WEB-MISC /etc/passwd 2 1876
2 NETBIOS SMB repeated logon failure 1 1161
3 ATTACK-RESPONSES Invalid URL 2 150
4 BACKDOOR netbus active 1 36
5 WEB-IIS CodeRed v2 root.exe access 1 19
6 BACKDOOR sensepost.exe command shell attempt 2 16
7 DOUBLE DECODING ATTACK 1 14
8 WEB-ATTACKS /etc/shadow access 2 12
9 BACKDOOR c99shell.php command request 1 4
10 WEB-MISC bad HTTP/1.1 request, Potentially worm attack 2 3
11 BACKDOOR netbus getinfo 1 1
12 FTP CWD ... 1 1
13 FTP CWD Root directory transversal attempt 3 1

Table 4: The Number of Alert from DoS stages

No Detected Alert Priority Total

1 BAD-TRAFFIC tcp port 0 traffic 3 12548
2 ICMP PING Windows 3 8334
3 ICMP PING 3 6300
4 ICMP Echo Reply 3 2125
5 ICMP Destination Unreachable Port Unreachable 3 2082
6 (snort decoder) Bad Traffic Loopback IP 3 1332
7 (snort decoder) Bad Traffic Same Src/Dst IP 3 678
8 ATTACK-RESPONSES Invalid URL 2 150
9 SNMP trap udp 2 30
10 NETBIOS SMB Trans Max Param/Count DOS attempt 3 12
11 DDOS Stacheldraht client check gag 2 7
12 COMMUNITY WEB-MISC Hasbani-WindWeb GET DoS attempt 2 4
13 DDOS mstream client to handler 2 2
14 NETBIOS SMB-DS Trans unicode Max Param DOS attempt 3 1
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 511

Figure 6: User to Root (U2R)

Figure 7: Denial of services (DoS)

International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 512

This server presents many open invitations for attack- [10] E. Conrad, S. Misenar, and J. Feldman, Domain 2:
ers to exploit as can be gathered from all the experiments Access Control (Chap. 3), CISSP Study Guide, pp.
conducted: implanting malware, password guessing, root- 37–89, 2010.
ing, web injection, creating a backdoor and DoS. It can be [11] J. Conrad, “Seeking help: The important role of eth-
concluded that the OS is vulnerable and open to exploita- ical hackers,” Network Security, vol. 2012, pp. 5–8,
tion, and thus requires more effort to be secured. Our 2012.
conclusions are as follows: (i) there are relationships re- [12] S. David, “The state of network security,” Network
sulting from the scanning and information from the CVE Security, vol. 2012, pp. 14–20, 2012.
vulnerability database, (ii) update policy and manage- [13] H. Gascon, A. Orfila, and J. Blasco, “Analysis of
ment of authentication for user, (iii) it is important that update delays in signature-based network intrusion
security operators assume that they will be hacked and detection systems,” Computers & Security, vol. 30,
should better secure themselves for that reason. no. 8, pp. 613-624, 2011.
Meanwhile, what this experiment indicates is that [14] S. Hansman and R. Hunt, “A taxonomy of network
there a large number of new attacks that could remain and computer attacks,” Computers & Security, vol.
hidden in the data and would not be identified using ex- 24, pp. 31–43, 2005.
isting Snort signature. Snort cannot be used as a se- [15] H. Holm, “Performance of automated network vul-
curity platform to protect against threats; it cannot be nerability scanning at remediating security issues,”
expected to detect all threats and trigger the necessary Computers & Security, vol. 31, no. 2, pp. 164–175,
response. However, Snort is adept at protocol analysis, 2012.
content matching, and packet logging. Therefore, some [16] J. Hua and S. Bapna, “The economic impact of cy-
future work must be conducted such as: (i) how to ex- ber terrorism,” The Journal of Strategic Information
tract the data to analysed, (ii) how to classify the threat Systems, vol. 22, no. 3, pp. 175–186, 2013.
and normal access, and (iii) how to visualise alert to show [17] G. Kenneth, “Cyber Weapons Convention,” Com-
details of taxonomy information from Snort. puter Law & Security Review, vol. 26, pp. 547–551,
2010.
[18] S. Mansfield-Devine, “DDoS: Threats and mitiga-
References tion,” Network Security, vol. 2011, pp. 5–12, 2011.
[19] N. Martin and J. Rice, “Cybercrime: Understanding
[1] N. Athanasiades, R. Abler, J. Levine, H. Owen, and addressing the concerns of stakeholders,” Com-
and G. Riley, “Intrusion detection testing and puters & Security, vol. 30, pp. 803–814, 2011.
benchmarking methodologies,” in First IEEE In- [20] R. A. Martin, “Managing vulnerabilities in net-
ternational Workshop on Information Assurance worked systems,” IEEE Computer, vol. 34, no. 11,
(IWIA’03), pp. 63–72, 2003. pp. 32–38, 2001.
[2] N. Barrett, “Penetration testing and social engineer- [21] K. K. M. D. Maynor, Metasploit Toolkit for Penetra-
ing: Hacking the weakest link,” Information Security tion Testing, Exploit Development, and Vulnerability
Technical Report, vol. 8, pp. 56–64, 2003. Research, Elsevier Inc, pp. 1-64, 2007.
[22] P. Mell, V. Hu, R. Lippmann, J. Haines, and M.
[3] R. Beghdad, “Critical study of neural networks in
Zissman, An Overview of Issues in Testing Intrusion
detecting intrusions,” Computers & Security, vol. 27,
Detection Systems, Technical Report NISTIR 7007,
pp. 168–175, 2008.
July 11, 2003.
[4] R. Beghdad, “Efficient deterministic method for de-
[23] D. E. Neghina and E. Scarlat, “Managing informa-
tecting new U2R attacks,” Computer Communica-
tion technology security in the context of cyber crime
tions, vol. 32, pp. 1104–1110, 2009.
trends,” International Journal of Computers Com-
[5] D. Bradbury, “Hands-on with metasploit express,” munications & Control, vol. 8, pp. 97–104, 2013.
Network Security, vol. 2010, pp. 7–11, 2010. [24] C. P. Pfleeger, S. L. Pfleeger, and M. F. Theofanos,
[6] V. Broucek and P. Turner, “Technical, legal and eth- “A methodology for penetration testing,” Computers
ical dilemmas: Distinguishing risks arising from mal- & Security, vol. 8, pp. 613–620, 1989.
ware and cyber-attack tools in the ’cloud’-a forensic [25] R. J. Potts, “Hacking: The threats,” Computer Audit
computing perspective,” Journal of Computer Virol- Update, vol. 1990, no. 1, pp. 14–15, 1989.
ogy and Hacking Techniques, vol. 9, pp. 27–33, 2013. [26] E. Schultz, “RPC in Windows systems: What you
[7] R. Bruen, “Intrusion detection systems: Problems don’t know could hurt you,” Network Security, vol.
and opportunities,” Software Focus, vol. 2, pp. 151– 2004, pp. 5–8, 2004.
156, 2001. [27] E. Schultz, “Windows 2000 security A postmortem
[8] S. Chebrolu, A. Abraham, and J. P. Thomas, “Fea- analysis,” Network Security, vol. 2004, pp. 6–9, 2004.
ture deduction and ensemble design of intrusion de- [28] A. Shiravi, H. Shiravi, M. Tavallaee, and A. A. Ghor-
tection systems,” Computers & Security, vol. 24, pp. bani, “Toward developing a systematic approach to
295–307, 2005. generate benchmark datasets for intrusion detec-
[9] B. Clive, “Hacking: An abuse of privilege,” Com- tion,” Computers & Security, vol. 31, pp. 357–374,
puter Audit Update, vol. 1990, no. 1, pp. 21–24, 1989. 2012.
International Journal of Network Security, Vol.18, No.3, PP.501-513, May 2016 513

[29] M. D. Steve, “Hacktivism: Assessing the damage,” Abdul Hanan Abdullah (SCOPUS ID: 11338934800),
Network Security, vol. 2011, pp. 5–13, 2011. received his B.Sc. and M.Sc from University of San
[30] D. Stiawan, M. Y. Idris, and A. H. Abdullah, “Pene- Francisco, California, and Ph.D from Aston University,
tration testing and network auditing: Linux ” Jour- Birmingham, United Kingdom. He is a Senior Professor
nal of Information Processing Systems, vol. 11, pp. at Faculty of Computing, Universiti Teknologi Malaysia
104–115, 2015. (UTM). Currently, he is the Head of Pervasive Comput-
[31] G. C. Tjhai, M. Papadaki, S. M. Furnell, and N. ing Research Group. His research areas of interest include
L. Clarke, “The problem of false alarms: Evaluation Pervasive Computing, Network Security, Cloud and Grid
with snort and DARPA 1999 dataset,” in Trust, Pri- Computing.
vacy and Security in Digital Business, LNCS 5185,
Mohammed AlQurashi received B.Sc. in Computer
pp. 139-150, Springer, 2008.
from King Abdul Aziz University, Saudi Arabia in 2009,
[32] S. W. Woo, H. Joh, O. H. Alhazmi, and Y. K.
and M.Sc. in Computer Science from University of Texas
Malaiya, “Modeling vulnerability discovery process
at San Antonio, USA, in 2013. Currently, he is a lec-
in Apache and IIS HTTP servers,” Computers & Se-
turer and researcher at Smart Network Research Group,
curity, vol. 30, pp. 50–62, 2011.
at College of Computer Science and IT, Albaha Univer-
Deris Stiawan (SCOPUS ID: 36449642900), received sity, Saudi Arabia. His research interests include, Infor-
his Ph.D degree in Computer Science from Universiti mation Security, Cloud computing, and Network Security.
Teknologi Malaysia in 2013. Currently he is an senior
lecturer in Faculty of Computer Science, University Rahmat Budiarto (SCOPUS ID: 6603477220) received
of Sriwijaya, Indonesia. In 2011, He holds Certified B.Sc. degree from Bandung Institute of Technology in
Ethical Hacker (C—EH) & Certified Hacker Forensic 1986, M.Eng, and Dr.Eng in Computer Science from
Investigator (C—HFI) licensed from EC-Council. His Nagoya Institute of Technology in 1995 and 1998, respec-
research interests concern network & information se- tively. He is currently a professor and the head of Smart
curity fields, focused on network attack and intrusion Networked Research Group at College of Computer Sci-
prevention/detection system. ence and IT, Albaha University, Saudi Arabia. His re-
Mohd Yazid Idris (SCOPUS ID: 36448800600), is a search interests include IPv6, network security, Wireless
senior lecturer at of Computing, Universiti Teknologi sensor networks and MANETs.
Malaysia. He obtained his M.Sc and Ph.D in the area
of Software Engineering, and Information Technology
(IT) Security in 1998 and 2008 respectively. In software
engineering, he focuses on the research of designing and
development of mobile and telecommunication software.
His main research activity in IT security is in the area
of Intrusion Prevention and Detection (ITD). He is
currently active in various academic activities and in-
volves in university-industry link initiative in both areas.