ECSA/LPT

Module XXI
EC Council
EC-Council Firewall Penetration
Testing
 Penetration Testing Roadmap
Start Here
Information Vulnerability External
Gathering Analysis Penetration Testing

Fi
Firewall
ll Router and Internal
Switches Network
Penetration Testing
Penetration Testing Penetration Testing

IDS Wireless Denial of

Network Service
Penetration Testing
Penetration Testing Penetration Testing

Cont’d

Stolen Laptop, PDAs Social Password

Application and Cell Phones Engineering Cracking
Penetration Testing Penetration Testing Penetration Testing Penetration Testing

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Penetration Testing Roadmap
(cont d)
(cont’d)
Cont’d
Physical Database VoIP
S
Security
i P
Penetration
i testing
i P
Penetration
i T Testing
i
Penetration Testing

Virus and
Vi d VPN
Trojan War Dialing
Penetration Testing
Detection

Log File Integrity Blue Tooth and

Management Checking Hand held
Penetration Testing Device
Penetration Testing

End Here
Telecommunication
Data Leakage Security Email Security
And Broadband
Penetration Testing Patches Penetration Testingg
Communication
Penetration Testing
Penetration Testing

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 What is a Firewall?

A firewall is a set of related programs, located at a network

gateway server, that protects the resources of a private network
from users from other networks.

A firewall sits at the junction point or gateway between the two

networks, usually a private network and a public network, such
as the Internet.

Firewalls protect against hackers and malicious intruders.

It is a combination of hardware and software that separates a

LAN into two or more parts for security purposes.
purposes

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 What Does a Firewall Do?

A firewall examines all traffic routed between the two

networks to see if it meets certain criteria.
criteria

It routes p
packets between the networks.

It filters both inbound and outbound traffic.

It manages public access to private networked resources

suchh as host
h applications.
li i

It logs all attempts to enter the private network and triggers

alarms when hostile or unauthorized entry is attempted.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Packet Filtering

Address filtering:

• Firewalls can filter packets based on their source and

d ti ti addresses
destination dd and
d portt numbers.
b

Network filtering:

• Firewalls can also filter specific types of network traffic.

• The
Th ddecision
i i to fforward d or reject
j traffic
ffi iis d
dependant
d upon
the protocol used, for example HTTP, FTP, or Telnet.
• Firewalls can also filter traffic by packet attribute or state.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 What Can't a Firewall Do?

A firewall cannot prevent individual users with modems from dialing

into or out of the network, bypassing the firewall altogether.

Employee misconduct or carelessness cannot be controlled by firewalls.

Policies involving the use and misuse of passwords and user accounts
must be strictly enforced.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 How Does a Firewall Work?

A firewall may allow all traffic through unless it meets certain criteria, or
i may d
it deny all
ll traffic
ffi unless
l iit meets certain
i criteria.
i i

The type of criteria used to determine whether traffic should be allowed

through varies from one type of firewall to another.

Firewalls may be concerned with the type of traffic, or with source or

destination addresses and ports.

They may also use complex rule bases that analyze the application data
to determine if the traffic should be allowed through.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Firewall Operations

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Firewall Logging Functionality

UNIX syslog application is the commonly

accepted logging functionality.

Scans and parses the logs to a centralized

logging server.

Syslog-based
y gb logging
gg g environments supplies
pp
inputs to IDS and forensic analysis project.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Firewall Policy

Build a firewall that handles application traffic like web, email, or

Telnet.
Telnet
The policy should explain how the firewall is to be updated and
managed.
The steps involved in creating a firewall policy
are as follows:
• Step1: Identify the network applications that are of utmost
importance
• Step2: Identify the vulnerabilities that are related to the network
applications
• Step3: Prepare a cost-benefits analysis to secure the network
applications
• Step4: Create a network application traffic matrix to identify the
protection method
• Step5: Create a firewall ruleset that depends on the application’s
traffic matrix
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Periodic Review of Information
Security Policies
Create periodic reviews for information security policies to achieve accuracy and
timeliness.
timeliness

Review and update information security policies in every six months.

If a firewall’s application is upgraded, then the firewall’s ruleset must be formally

changed.

Firewall installations along with systems and other resources should be audited
on a regular basis.

Periodic reviews should include:

• Actual audits and vulnerability assessments of production.

• Backup infrastructure components.
components
• Computer systems.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Firewall Implementation

Firewalls can be implemented in two different

ways as follows:
• Appliance-based firewall.
• Commercial operating system.

An appliance-based firewall:

• Is more secure than those implemented

p on top p of the commercial operating
p g
system.
• Does not suffer from any security vulnerabilities associated with underlying
operating system.
pp p
• Uses Application-Specific Integrated
g Circuit ((ASIC)) technology.
gy

Commercial operating system:

• Firewalls implemented on commercial operating system are highly scalable.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Build a Firewall Ruleset

Most firewall p
platforms use rulesets as their common system
y for
implementing security controls.

The contents of the firewall ruleset will establish the functionality of the
firewall.

Based on the firewall’s platform architecture, firewall rulesets contain

the following information:

• Source address of the packet.

• Destination address of the packet.
• Type of traffic.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Maintenance and Management of
Firewall
The two mechanisms used by commercial firewall platforms for configuring and
maintenance are:
• Command line interface (CLI) configuration.
• Graphical user interface (GUI) configuration.

CLI configuration mode enables the administrator to configure the firewall by

typing the commands in command prompt.

GUI configuration mode enables the administrator to configure the firewall

through graphical user interface.

For web-based
F b b d iinterfaces,
t f security
it iis provided
id d th
through
hSSecure S
Socket
k tLLayer
(SSL) encryption, along with user id and password.

For non
non-web
web interfaces, security is implemented through custom transport
encryption.
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Maintenance and Management of
Firewall (cont
(cont’d)
d)
By monitoring the firewall, you can find suspicious activities like port
scans or h
half
lf scans.

In order to perform these monitoring mechanisms, organizations must

establish effective incident response procedures.
procedures

Both logs and alerts together form a monitoring system.

If logs as well as firewall alerts are properly monitored, it is easy to

detect intrusion attempts
p in an organization.
g

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Hardware Firewall

Secure Private Network

P bli Network
Public N t k

Public
Network

Hardware
Firewall
Private Local Area Network
Usually part
of a TCP/IP
Router

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Software Firewall

Secure Private Network

P bli Network
Public N t k

Public
Network

Computer
with Firewall
Private Local Area Network
Software

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Types of Firewall

Firewalls fall into four broad categories:

g

Packet filters

Circuit level gateways

g y

Application
pp cat o level
e e gate
gateways
ays

Stateful multilayer inspection firewalls

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Packet Filtering Firewall

Packet filtering firewalls work at the network level of the OSI model (or the IP layer of
TCP/IP).

They are usually part of a router.

In a packet filtering firewall,

firewall each packet is compared to a set of criteria before it is
forwarded.

Depending on the packet and the criteria, the firewall can:

• Drop the packet.

• Forward it or send a message to the originator.
Rules can include source and destination IP address, source and destination port number
and protocol used.
used

The advantage of packet filtering firewalls is their low cost and low impact on network
performance.

Most routers support packet filtering.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 IP Packet Filtering Firewall
: = Disallowed
; = Allowed
All d
5 Application
Traffic is filtered based on
4 TCP specified rules, including
source and destination IP
3 Internet Protocol (IP) :; address, packet type, and
2 Data Link port number.
1 Physical Unknown traffic is only
allowed up to level 3 of the
network stack.

Incoming Traffic Allowed Outgoing Traffic

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Circuit Level Gateway

Circuit level gateways work at the session layer of the OSI model, or the TCP
layer of TCP/IP.
TCP/IP

They monitor TCP handshaking between packets to determine whether a

requested session is legitimate.

Information passed to remote computer through a circuit level gateway appears

to have originated from the gateway.

Circuit level gateways are relatively inexpensive.

They h
Th have th
the advantage
d t off hidi
hiding iinformation
f ti about
b t th
the private
i t network
t k th
they
protect.

Circuit level gateways do not filter individual packets.

packets

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 TCP Packet Filtering Firewall
: = Disallowed
; = Allowed
All d
5 Application
Traffic is filtered based on
4 TCP :; specified session rules, such
as when a session is
3 Internet Protocol (IP)
initiated by a recognized
2 Data Link computer.
1 Physical Unknown traffic is only
allowed up to level 4 of the
network stack.

Incoming Traffic Allowed Outgoing Traffic

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Application Level Firewall

Application level gateways are also called proxies.

proxies

Theyy can filter p

packets at the application
pp layer
y of the OSI model.

Incoming or outgoing packets cannot access services for which there is no

p y
proxy.

In plain terms, an application level gateway that is configured to be a web

proxy will not allow any FTP, gopher, Telnet or other traffic through.

Because they examine packets at application layer, they can filter application
specific commands such as http:post and get.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Application Packet Filtering
Firewall
: = Disallowed
; = Allowed
All d
5 Application :; Traffic is filtered based on
4 TCP specified application rules,
such as specified
3 Internet Protocol (IP)
applications (such as a
2 Data Link browser) or a protocol, such
as FTP,
FTP or combinations
combinations.
1 Physical
Unknown traffic is only
allowed up to the top of
network stack.
stack
Incoming Traffic Allowed Outgoing Traffic

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Stateful Multilayer Inspection
Firewall

Stateful multilayer inspection firewalls combine the aspects of the other

three types of firewalls.

They filter packets at the network layer, determine whether session

packets are legitimate and evaluate contents of packets at the
application layer.

Theyy are expensive

p and require
q competent
p p
personal to administer the
device.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Multilayer Inspection Firewall
: = Disallowed
; = Allowed
All d
5 Application :; Traffic is filtered at three
4 TCP :; levels, based on a wide
range of specified
3 Internet Protocol (IP) : ;
application, session and
2 Data Link packet filtering rules.
1 Physical Unknown traffic is allowed
up to level 3 of the network
stack.

Incoming Traffic Allowed Outgoing Traffic

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Steps for Conducting Firewall
Penetration Testing
• Locate the firewall
1

• Traceroute to identify the network range

2

• Port scan the router

3

• Grab the banner

4

• Create custom packets and look for firewall responses

5

• Test access control enumeration

6

• Test to identify firewall architecture

7

• Testing firewall policy

8
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Steps for Conducting Firewall
Penetration Testing (cont
(cont’d)
d)
• Test firewall using firewalking tool
9

• Test for port redirection

10

• Testing the firewall from both sides

11

• Overt firewall test from outside

12

• Test covert channels

13

• Covert firewall test from outside

14

• Test HTTP tunneling

15

• Test firewall specific vulnerabilities

16
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 1: Locate the Firewall

Craft an SYN packet using Hping or any other packet crafter send it to
the firewall.

If you get ICMP unreachable type 13 message (which is admin

prohibited packet) with a source IP address of access control device,
usually this is a packet filter firewall.

Tools:
• hping2 www.xsecurity.com –c2 –S –p23 –n
• ICMP Unreachable type 13 from 10.10.2.3
10 10 2 3

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 2: Traceroute to Identify
the Network Range

Running traceroute against the router

will reveal:

• The path to that network.

network
• Intermediate routers and/or devices
• Information about filtering devices and protocols
allowed/denied.
/

Tool:

• tracert www.xsecurity.com

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 3: Port Scan the Firewall

Most firewall implementations have default ports in use for remote

management purposes.

Example: user authentication, management, VPN connections, etc.

Tool: #nmap –n –vv –P0 –p256, 1080 <www.xsecurity.com>

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 4: Grab the Banner

Connect to the router and grab the banner.

Example:
• Symantec
y Enterprise
p Firewall 8.0 HTTP Proxyy
• C:\>nc -nvv 10.0.0.1 80
• HEAD / HTTP/1.0
• HTTP/1.1 503 Service Unavailable
• MIME-Version: 1.0
• Server: Simple, Secure Web Server 1.1
• Date: Tue, 12 Dec 2005 19:08:35 GMT
• Connection: close
• Content-Type: text/html
• <HTML>
• <HEAD><TITLE>Firewall Error: Service
Unavailable</TITLE></HEAD>
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 5: Create Custom Packets and
Look for Firewall Responses

Creating custom packets that are sent towards the firewall can elicit
unique responses from the firewall.
fire all

This can also be used to determine the type

yp of firewall.

Example:

• hping 10.0.0.5 –c 2 –S –p 23 –n
• HPING 10.0.0.5 (eth0 10.0.0.5 ): S set, 40 data bytes
• 60 by
bytes from 10.0.0.5
5 : flags=RA
g seg=0
g ttl=5959 id=0 win=0
time=0.4 ms

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 6: Test Access Control
Enumeration
Use Nmap to enumerate the firewall access control list.

Nmap shows three states of ports:

• Open – port is listening
• Filtered – port is blocked by an access control device (Router/Firewall)
• Unfiltered – traffic is passing from access control devices (Firewall/Router) but the port
is not open

Example:
p
• #nmap –sA 192.168.0.1
• Interesting ports on 192.168.0.1:
• (The 65530 ports scanned but not shown below are in state: filtered)
• PORT STATE SERVICE
• 110/tcp UNfiltered pop-3
• 13701/tcp UNfiltered VeritasNetbackup
• 13711/tcp UNfiltered VeritasNetbackup
• 13721/tcp UNfiltered VeritasNetbackup
• 13782/tcp
8 / UNfiltered
UNfil dVVeritasNetbackup
i N b k
• Nmap run completed -- 1 IP address (1 host up) scanned in 12205.371 seconds

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 7: Test to Identify Firewall
Architecture
Hping2
p g is a tool for custom p
packet crafting.
g

Use hping2 to identify packets that

are:
• Open.
• Blocked.
• Dropped
Dropped.
• Rejected.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 8: Testing Firewall Policy

The two different methods to verify the

firewall policy are as follows:

• In the first method,

method get the hardcopies of the firewall
configuration and compare them with the hardcopies that
are against the expected configuration.
• The second method involves actual inin-place
place testing that
determines the configuration of a device by attempting to
perform operations that must be prohibited.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 9: Test Firewall Using
Firewalking Tool
Firewalk can be used to discover open ports behind a firewall and it can be used for access
control list discovery.
discovery

Helps determine open ports on a firewall (packet filter).

Firewalk determines if a given port is allowed through a firewall.

Traceroute to any machine behind the firewall or the router before the firewall.

Once the hop count of the router is known, we can change our TTL value for our IP packet to
be 1 more than the hop count of the router & perform a port scan on the firewall.

Thus, if a “TTL exceeded error” comes back, the port on the firewall is open.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 10: Test for Port Redirection

If yyou cannot g
get direct access to a p
port,, then use p
port redirection.

It is used to bypass port filtering.

Install a port redirector and make it listen on a selected port number.

Packets received on the listening port number are forwarded to desired

port on remote host.

• fpipe –l 80 –r 139 192.168.10.40

Tools: • datapipe 80 139 192.168.10.40

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Firewall Identification

Identify the firewall used to find out the

vulnerability by:
• Type of firewall implemented.
• Firewall model.
• Firewall configuration.
configuration

Two types of firewall identification techniques

include:
• Covert firewall identification.
• Overt firewall identification.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 11: Testing the Firewall from
Both Sides
Examine the firewall by simultaneously testing both sides of the firewall.

The firewall system

y that is tested outside will send p
packet and the firewall that is tested
inside will analyze the packets that arrives and vice versa.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 11: Testing the Firewall from
Both Sides (cont
(cont’d)
d)
The following are the steps to be performed for testing the
fi
firewall
ll ffrom b
both
th sides:
id

Step1: Test whether (possibly using tunneled protocols) unauthorized connections from the internal
network
t k to
t the
th Internet
I t t can b
be created.
t d

Step2: Execute a vulnerability scanner on the hosts of the firewall system (i.e., firewall host, internal
router, externall router)) ffrom iinside.
id

Step3: Identify the firewall rules by using appropriate firewall tools (Like firewalking from both sides).
sides)

Step4:
p4 Check for the reaction of the firewall to fragmented
g and spoofed
p p
packets that can be g
generated
using a packet generator.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 12: Overt Firewall Test from
Outside

In overt firewall testing

testing, the tester will create network connection from outside
to protect the network segment.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 12: Overt Firewall Test
from Outside (cont
(cont’d)
d)
The following are the steps to be performed for overt firewall
testing
i from
f outside:
id

Step1:
p Execute a vulnerabilityy scanner on the hosts of the firewall
system (i.e., firewall host, internal router, external router)

Step2: Identify the firewall rules by using appropriate firewall tools

(Like firewalking)

Step3: Try to reach the systems that are behind the firewall

STEP 12: OVERT FIREWALL

TEST FROM OUTSIDE
Step4: Check for the reaction of the firewall to fragmented and spoofed
packets that can be generated using a packet generator

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 13: Test Covert Channels

I t ll a b
Install backdoor
kd on a victim
i ti machine
hi iinside
id th
the network.
t k

Reverse connect to a machine outside the firewall.

firewall

Tool:

• WWW Reverse Shell

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 14: Covert Firewall Test
from Outside

In covert firewall testing, the testers create a network connection to the

secured network segment from the outside.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 14: Covert Firewall Test
from Outside (cont
(cont’d)
d)
The following are the steps to perform testing for covert
firewall from outside:

Step1: Identify the firewall rules by using

appropriate firewall tools (like firewalking from
outside).

Step2: Try to reach the systems that are behind

the firewall.

Step3: Check for the reaction of the firewall to

fragmented and spoofed packets that can be
generated
t d using
i a packet
k t generator.
t

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 15: Test HTTP Tunneling

Test to connect to the inside network using HTTP tunneling

techniques.
h i

T l
Tools:

HTTPORT

HTTHOST

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Step 16: Test Firewall Specific
Vulnerabilities

Firewalls have specific vulnerabilities.

If a firewall is not patched up, then it

i vulnerable
is l bl to attacks.
k

Send product specific exploits

against firewall vulnerabilities and
test for responses.

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Document Everything

Document all yyour findings

g from firewall
testing results.

D
Document the
h ffollowing:
ll i
• Firewall logs.
• Tools output.
output
• Your analysis.
• Recommendations (if any).

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
 Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited