BackTrack 4 Final Release

Taken from the new BackTrack Site : BackTrack 4 Final is out and along with this release come some exciting news, updates, and developments. BackTrack 4 has been a long and steady road, with the release of abeta last year, we decided to hold off on releasing BackTrack 4 Final until it was perfected in every [...]

http://www.offensive-security.com/blog/backtrack/backtrack-4-final-release/

You can download BT4 from here.

Exploiting SAP Business Platforms: The Pen-Testing Analysis

SAP simply stands for "Systems, Applications and Products in data processing". SAP as a unique business solution developer integrates range of solutions including ERP, CRM, GRC, PLM, SCM and many more. The ease of usage, implementation and market reputation has put forward a strong basis for the company (german based) worldwide. Deploying SAP solution is a bit lengthy and complex process and that's why a core security settings left default or unattended. This could results in serious exposure of the SAP platforms and flag a high risk to the organization.

SAP Basic Components

ClientID - Business unit or Corporation with unique identifier.
Transaction - A conversation between client interface and backend database.
Authorization - Users assigned roles/profiles.
ABAP - SAP high-level programming language.
Reports - A component to generate report on user requests.
Functional Modules - A set of remote or local procedures.
RFC Interface - Remote funtion call library.


SAP Security

Talking in the specific context of SAP platform, many auditors would like to harden the SAP authorization subsystem (roles and profiles). While hardening the authorization process and segregation of duties is considered vital but there is also another aspect of security which involves technical assessment of all the networked components within SAP environment. Conducting "Penetration Testing" using industry-proven methodology gives more clear outlook for security vulnerabilities and threats in the existing infrastructure. Such as, weakness in configuration may result in business frauds. The typical number of steps followed under SAP Pen-Testing are:

-Discovery (Find the target)
-Enumeration (Services running on the platform)
-Vulnerability Assessment (Check for the presence of known/unknown vulnerabilities)
-Exploitation (Try to gain administrator privileges on the defined system)

The main goal is to achieve the highest possible privileges in the production environment which can be accomplished by:

-Getting SAP Administration access
-DBA privileges
-SAP_ALL access privileges

Though obtaining any of the above access may give complete control over SAP systems.


SAP Penetration Toolkit

Following are some of the key tools necessary to assess the SAP infrastructure.

-NMap
-rsh,rlogin,rexec
-BurbSuite
-W3af
-Nessus
-JTR (John The Ripper)
-THC Hydra
-SQL Client Tools
-NFS Client Tools
-Sapyto
-Metasploit

It worth to mention that "Sapyto" is specially designed as SAP Penetration Testing Framework to cover all aspects of Pen-Testing methodology. And because it is developed in python and C, it is easier port plugins.

Countermeasures

1.Restrict connections to the SAP gateway.
2.Restrict access to shared resources. Such that, allow only internal connections.
3.Harden the configuration settings.
4.Remove/Change the default user accounts.
5.Enable "SNC" to protect against evasdropping.
6.Good password security should be enforced.
7.Access to transactions should be restricted.
8.Use SAP authorization object "S_Program" to protect report confidentiality.

Source: EthicalHacker.

PenTBox es una Suite de Seguridad orientada a Penetration Test

(from dragonjar)

PenTBox es una Suite de Seguridad orientada a Penetration_test , de ahí su nombre Penetration Testing Box. Esta programada en un lenguaje interpretado, Ruby que le permite ser multiplataforma y tener un código bastante claro. El código esta liberado bajo licencia GNU GPL v3.

La idea principal es que es un conjunto de programas, que pueden ser ejecutados individualmente, sin dependencia de la Suite en sí. Además, el proyecto puede ir creciendo fácilmente grácias a la comunidad, por lo fácil que es implementar nuevos programas individualmente.
El programa es multiplataforma, pero esta orientado a sistemas GNU/Linux. Todas las pruebas se hacen sobre estos y solo a estos se les da un soporte y una garantía de que todo debería funcionar bien. Aún así, PenTBox se puede ejecutar en todos los sistemas que soportan Ruby (MacOS, BSD, DOS, BeOS, OS/2 y más), además de haber desarrollado también una versión funcional para Windows. Se intentan probar todas las funciones en la mayoría de los sistemas soportados, pero como es comprensible no siempre es posible.