Checking Port

Powershell

eg: Test-NetConnection -ComputerName target_ip -Port 80 -InformationLevel "Detailed"
https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=win10-ps

Bulk scanning powershell

1..10 | % {"192.168.0.$"} | ForEach-Object { Test-Connection -Count 1 -ComputerName $ 2>$null}

XSS Payload

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Source Code Review Rule

https://rules.sonarsource.com/php/RSPEC-5335

FTP Check (TCP 21)

FTP Anonymous Login

Tools

nmap -sSV --script ftp-anon.nse -p21 IP -T4 --reason

Solution

1. Disable FTP and use SSH
   
2. Disable FTP Anonymous Login
   https://antnix07.blogspot.com/2018/01/disable-anonymous-user-in-ftp-server-on.html
   

---

DNS Check (TCP 53)

DNS Server Cache Snooping Remote Information Disclosure

Tools

nmap -sU -p 53 --script dns-cache-snoop <ip_address>

Solution

1. Leave recursion enabled if the DNS Server resides on a corporate network that cannot be reached by untrusted clients
   
2. Do not allow public access to DNS Servers performing recursion
   
3. Disable recursion
   https://support.microsoft.com/en-us/help/2678371/microsoft-dns-server-vulnerability-to-dns-server-cache-snooping-attack

---

DNS Server Spoofed Request Amplification DDoS

Tools

msf > use auxiliary/scanner/dns/dns_amp

Solution

1. Restrict access to your DNS server from public network or reconfigure it to reject such queries

---

DNS Server Recursive Query Cache Poisoning Weakness

Tools

nmap -Pn -sU -p 53 --script=dns-recursion <ip_address>

Solution

1. Restrict recursive queries to the hosts that should use this nameserver (such as those of the LAN connected to it)
   
2. If bind 8 is in use, use the instruction 'allow-recursion' in the 'options' section of the named.conf
   
3. If bind 9 is in use, define a grouping of internal addresses using the 'acl' command
   Then, within the options block, you can explicitly state:
   'allow-recursion { hosts_defined_in_acl }'
   If another name server is in use, consult its documentation.
   

---

DNS Server Zone Transfer Information Disclosure (AXFR)

Tools

dig axfr @<ip_address> <domain.name>

Solution

N/A

---

Domain misconfiguration scanner

https://mxtoolbox.com/domain/

Http Testing Server

#openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
import http.server, ssl

server_address = ('192.168.0.5', 443)
httpd = http.server.HTTPServer(server_address, http.server.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket(httpd.socket,
            server_side=True,
            certfile='server.pem',
            ssl_version=ssl.PROTOCOL_TLSv1)
httpd.serve_forever()

Header Check (TCP 80 and 443)

Tools

nmap -sV -T5 -Pn -p 80 --script http-headers IPs
https://github.com/koenbuyens/securityheaders

Solution

http://securityheaders.io/

Link

Content Security Policy Explaination

https://csp.withgoogle.com/docs/index.html

Nginx Security Headers

Harderning

Solution

https://www.attosol.com/http-security-headers-with-nginx/

Remove IIS Server version HTTP Response Header (TCP 80)

Solution

https://www.saotn.org/remove-iis-server-version-http-response-header/
https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

Etag Headers

What benefit using etag?
The ETag HTTP response header is an identifier for a specific version of a resource. It lets caches be more efficient and save bandwidth, as a web server does not need to resend a full response if the content has not changed. Additionally, etags help prevent simultaneous updates of a resource from overwriting each other

link

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag

misconfiguration of etag

Sometimes ETag header providing sensitive information that could aid an attacker, such as the inode number

link

https://www.tenable.com/plugins/nessus/88098
https://www.securityfocus.com/bid/6939/discuss

What the use of inode number?

https://tecadmin.net/what-is-inode-number-in-linux/

Solution

IIS : https://www.saotn.org/remove-etags-http-header-iis/

---

HTTP Method Check (TCP 80 and 443)

nmap -sV -T5 -Pn -p 80 --script http-headers IPs -v

Solutions

https://hostadvice.com/how-to/how-to-disable-the-vulnerability-of-options-method-in-iis-and-apache/

SNMP (TCP/UDP 161)

SNMP Enum

Tools

nmap -sV -p161 --script snmp-info IP --reason -T4
nmap -sU -p161 --script snmp-info IP --reason -T4
snmpwalk -c public/private/any -v1/2c IP

Solution

N/A

---

SNMP Agent Default Community Name (public)

Tools

onesixtyone -c /usr/share/doc/onesixtyone/dict.txt

Solution

Change the default community string “public” to something complex

---

SNMP 'GETBULK' Reflection DDoS

Tools

snmpbulkget -v2c -Cn0 -Cr2500 -Os -c public 1.3.6.1.2.1

Solution

Restrict and monitor access to this service, and consider changing the default 'public' community string

---

SSL Check (TCP 443)

1. Check for cipher strength nmap -sSCV -Pn --script ssl-enum-ciphers -p443 IP
   sslscan IP
   

Tools

https://github.com/rbsec/sslscan
https://github.com/nabla-c0d3/sslyze
https://testssl.sh/

Solution

Windows: https://www.nartac.com/Products/IISCrypto/
https://www.phr33fall.co.uk/ssl-tls-issues-server-2012/ (Manual Solution)

---

SMBv1 Check (TCP 445)

Smb protocols

nmap -sV -T5 -Pn -p 445 --script smb-protocols IPs

Solution

https://support.microsoft.com/en-us/help/2696547/detect-enable-disable-smbv1-smbv2-smbv3-in-windows-and-windows-server

Smb Singing

nmap -sV -T5 -Pn -p 445 --script smb-security-mode IPs

Solution

https://support.microsoft.com/en-my/help/161372/how-to-enable-smb-signing-in-windows-nt

---

MS17-010 Microsoft Windows SMBv1 Multiple Vulnerabilities (MS17-010)

nmap -p445 --script smb-vuln-ms17-010

Solution

Microsoft has released a set of patches for Windows Vista, 2008, 7, 2008 R2, 2012, 8.1, RT 8.1, 2012 R2, 10, and 2016. Microsoft has also released emergency patches for Windows operating systems that are no longer supported, including Windows XP, 2003, and 8.

---

Microsoft Windows SMB NULL Session Authentication

smbclient -L <ip_address>

Solution

Disable the SMB service if not required.

---

RDP Check (TCP 3389)

NLA,FIPS,ENC

Network Level Authentication (NLA) Disabled
Terminal Services Encryption Level is Medium or Low, or
Terminal Services Encryption Level is not FIPS-140 Compliant

Tools

https://github.com/portcullislabs/rdp-sec-check

Solution

videos:https://www.youtube.com/watch?v=nyBOJwvUaKQ
Link:https://www.phr33fall.co.uk/windows-rdp-hardening/

---

MSSQL Check (TCP 1433)

Check TCP port if assign not default

https://www.mssqltips.com/sqlservertip/2495/identify-sql-server-tcp-ip-port-being-used/
https://www.sqlshack.com/overview-of-sql-server-ports/

---