jd’s toolbox – fire and water toolkit next generation web assessment technology nt objectives,...
TRANSCRIPT
![Page 1: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/1.jpg)
![Page 2: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/2.jpg)
JD’s ToolBox – Fire and Water Toolkit
Next Generation Web Assessment Technology
NT OBJECTives, Inc.
![Page 3: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/3.jpg)
NT OBJECTives, Inc.
Overview
Web Architecture
Web Hack Attacks
Our solution
Fire and Water Toolkit
![Page 4: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/4.jpg)
NT OBJECTives, Inc.
WebServer DB
DB
Web app
WebClient Web app
Web app
Web app
HTTPrequest
(cleartext or SSL)
HTTP reply(HTML,
Javascript, VBscript,
etc)
Plugins:•Perl•C/C++•JSP, etc
Database connection:•ADO,•ODBC, etc.
SQL Database
•Apache•IIS•Netscape etc…
Firewall
![Page 5: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/5.jpg)
NT OBJECTives, Inc.
WebServer DB
DB
Web app
Web app
Web app
Web app
http: // 10.0.0.1 / catalog / display.asp ? pg = 1 & product = 7
![Page 6: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/6.jpg)
NT OBJECTives, Inc.
Current Top Web Issues are:1. Source Code Disclosure
2. Directory Browsing
3. File Upload Attacks
4. Backup and Archive Issues
5. Web Server Vulns
6. Remote Command Execution
7. SQL Injection Attacks
![Page 7: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/7.jpg)
NT OBJECTives, Inc.
The web and e-commerce applications are the main focus of our efforts
Web applications are important and growing in importance
Web applications are complex and growing in complexity
Our tool releases our going to have web specific priority
![Page 8: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/8.jpg)
NT OBJECTives, Inc.
Fire and Water
Our attempt to take web assessment to the next level
Toolkit is targeted at assessment professionals
Supports our initiative for providing complete assessment and defense services
![Page 9: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/9.jpg)
NT OBJECTives, Inc.
Chaos – Current Situation
Lots of good tools on the net – but none work together
No standard for output
Making a report from all these src’s is difficult at best
- To do your job well, you require all this info
![Page 10: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/10.jpg)
NT OBJECTives, Inc.
Fire
Set of tools for assessment professionals
Allows scripting
Allows remote usage
- Really shines on mapping internal networks
from external findings
![Page 11: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/11.jpg)
NT OBJECTives, Inc.
XML Automation
ntoscan | ntoroute | ntoweb | ntomap | ntotrend = coolness
![Page 12: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/12.jpg)
NT OBJECTives, Inc.
Tool Descriptions
ntoscan – TCP/UDP scanner – No Banners, OSPrints
ntoroute – TCMP/TCP traceroute tool
ntoweb - web vuln crawler
ntomap - network topology generator
ntotrend – data trend tool (multiple reports over time)
![Page 13: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/13.jpg)
NT OBJECTives, Inc.
Fire and Water Architecture
1. Complete XML Data Architecture
2. XML/XSL Reports are THE solution
3. Targeted Web Priority and Visualization
4. XML Mapping technology highlights web trouble spots
5. Superior Support for Data Trends over Time
![Page 14: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/14.jpg)
NT OBJECTives, Inc.
CLI Interface Power
CLI chosen as most powerful for experts
Allows scripting
Allows remote usage - Really shines on mapping internal networks
from external findings
![Page 15: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/15.jpg)
NT OBJECTives, Inc.
Web Focused Data Model
By default, tools record web data
Pinpoints and highlights web trouble spots
Map visually distinguishes between web services and traditional services
Completely designed to help resolve web security issues
![Page 16: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/16.jpg)
NT OBJECTives, Inc.
XML Data Cohesion
All tools output XML
Results are sortable
Reports are appendable
Building large analysis sets from tools is possible
DB storage with SQL databases is possible
Query analysis
Trend analysis
![Page 17: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/17.jpg)
NTOScanner
![Page 18: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/18.jpg)
NTOScanner
![Page 19: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/19.jpg)
NTOScanner
![Page 20: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/20.jpg)
NTOScanner + NTORoute
![Page 21: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/21.jpg)
NTOScanner + NTORoute
![Page 22: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/22.jpg)
NTOMap
![Page 23: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/23.jpg)
NTOMap
![Page 24: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/24.jpg)
NT OBJECTives, Inc.
NTOScan Report
![Page 25: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/25.jpg)
NT OBJECTives, Inc.
Water = NTOWire
Command line driver ISAPI filter
Installable remotely/scriptable
Updateable via Snort Signatures - stay quickly up to date against the latest vulns
![Page 26: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/26.jpg)
NT OBJECTives, Inc.
NTOWire Usage
ntowire –install
ntowire –load
ntowire –unload
ntowire -uninstall
![Page 27: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/27.jpg)
NT OBJECTives, Inc.
Look for updates from us
We’re back, We’re just getting started
New toolsNew vision
New capabilities
![Page 28: JD’s ToolBox – Fire and Water Toolkit Next Generation Web Assessment Technology NT OBJECTives, Inc](https://reader030.vdocuments.mx/reader030/viewer/2022033103/56649e795503460f94b78dab/html5/thumbnails/28.jpg)
NT OBJECTives, Inc.
JD Glaser
Erik Caso
Mike Morton
NT OBJECTives, Inc.