Browser Audit

Comparing 3 browsers, Firefox, MS Edge, and MS IE, and here is the results.

 

 Firefox 103.0

Firefox 103.0

MSIE 11.0

MS Internet Explorer 11.0

MS Edge 105.0

MS Edge 105.0

Links:

• https://browseraudit.com/
  

HTML5 Test

How well does your browser support HTML5?

MS Edge 105.0

Firefox 103.0

MS Internet Explorer 11.0

Links:

• https://html5test.com/
  

Qualys BrowserCheck Summary

Visit to Qualys^® BrowserCheck to perform a security analysis of your browsers and plugins. And it will run several system checks including the Top4 Security Controls.

 

Method 1 - Install plugin

• Click the "Install Plugin" button.
• Scan and view all the security issues.
• Follow recommended steps to resolve each vulnerability found.  

Method 2 - Scan without installing plugin

Link:

• Scan without installing plugin
  

DllHijackAuditor – Free Audit Tool For DLL Hijack Vulnerability

DllHijackAuditor is the smart tool to Audit against the Dll Hijacking Vulnerability in any Windows application. This is recently discovered critical security issue affecting almost all Windows systems on the planet. It appears that large amount of Windows applications are currently susceptible to this vulnerability which can allow any attacker to completely take over the system.

DllHijackAuditor helps in discovering all such Vulnerable Dlls in a Windows application which otherwise can lead to successful exploitation resulting in total compromise of the system. With its simple GUI interface, DllHijackAuditor makes it easy for anyone to instantly perform the auditing operation. It also presents detailed technical Audit report which can help the developer in fixing all vulnerable points in the application.

New version v2 brings out following features,

• New & Smart Debugger based ‘Interception Engine’ for consistent and efficient performance.
• Support for specifying as well as auditing of application with custom & multiple Extensions.
• Timeout Configuration to alter the waiting time for each Application.

DllHijackAuditor is a standalone portable application which support from Windows XP to Windows 7.

Reference:

• more info & download

SSL Audit

SSL is not a panacea. Thus, it is important to learn how to audit a SSL/TLS host effectively. This is a compilation of various articles on how to audit a weak SSL host.

Attempt to connect to target (in this case google.com) with SSLv2:

~# openssl s_client -no_tls1 -no_ssl3 -connect www.google.com:443

Check the output if it works. You can also do this with NMAP (with NSE script):

~# nmap -n -p443 -v --script=sslv2 -iL target.list -oG https.gnmap

Next, we will need to parse the NMAP output and dump the all the X.509 certificates with OpenSSL tool:

~# gawk "/https/{print $0}" https.gnmap > https-ip.txt
~# ./get-cert-info.sh https-ip.txt

Below is the "get-cert-info.sh":

#!/bin/bash
# You will need OpenSSL for this script to work

processLine(){
# Use OpenSSl to download the cert and extract the right info
# from it witht he X509 utility e.o.
 line="$@" # get all args
 IP=$(echo "$line" | cut -d" " -f1)
 TARGETDOM=$(echo "$line" | cut -d" " -f2)
 HOST="$TARGETDOM:443"
# Connect to HOST, defer errors to /dev/null,
# send standard output to RAWCERT variable
 RAWCERT=$(openssl s_client -connect ${HOST} 2>/dev/null)
# Obtain encoded certificate from RAWCERT
 CERTTEXT=$(echo "$RAWCERT" | /
   sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p')
# Process certificate for the different variables
 SIGALG=$(echo "$CERTTEXT" | /
   openssl x509 -noout -text | /
   grep -m 1 "Signature Algo" | cut -d: -f2)
 SUBJECT=$(echo "$CERTTEXT" | /
   openssl x509 -noout -subject | sed -e 's/subject= //')
 ISSUER=$(echo "$CERTTEXT" | /
   openssl x509 -noout -issuer | sed -e 's/issuer= //')
 START=$(echo "$CERTTEXT" | /
   openssl x509 -noout -startdate | cut -d= -f2)
 END=$(echo "$CERTTEXT" | /
   openssl x509 -noout -enddate | cut -d= -f2)
 SERIAL=$(echo "$CERTTEXT" | /
    openssl x509 -noout -serial | cut -d= -f2)

#Clean-up dates
START=$(echo "$START" | sed -e 's/GMT//')
START=$(echo "$START" | cut -d" " -f1,2,4)
STARTDAY=$(echo "$START" | cut -d" " -f2)
STARTMONTH=$(echo "$START" | cut -d" " -f1)
STARTYEAR=$(echo "$START" | cut -d" " -f3)
START=$STARTDAY\/$STARTMONTH\/$STARTYEAR

END=$(echo "$END" | sed -e 's/GMT//')
END=$(echo "$END" | cut -d" " -f1,2,4)
ENDDAY=$(echo "$END" | cut -d" " -f2)
ENDMONTH=$(echo "$END" | cut -d" " -f1)
ENDYEAR=$(echo "$END" | cut -d" " -f3)
END=$STARTDAY\/$STARTMONTH\/$STARTYEAR

# Output in CSV format
 echo $IP, $TARGETDOM, $SIGALG, $SUBJECT,/
   $ISSUER, $START, $END, $SERIAL
}

### File line loop ###
# Store file name
FILE=""

# Make sure we get file name as command line argument
FILE=${1?"No file name specified"}
# Check that file exists and is readable
[ ! -f $FILE ] && { echo "$FILE: does not exist"; exit 1; }
[ ! -r $FILE ] && { echo "$FILE: cannot be read"; exit 2; }

#Open file for reading
exec 3< $FILE

#Process file line by line
while read -u 3 line
do
  # use $line variable to process line
  # in processLine() function
  processLine $line
done

# Close file after reading
exec 3<&-

exit 0

Related links:

• Testing for SSL-TLS
• Automated scan for SSL hosts and dowload of SSL-certificates
  

SANS Consensus Audit Guidelines (Draft 1.0)

On Feb 23, 2009 SANS publishes the first draft of the Consensus Audit Guidelines (CAG). As represented in the press release, the CAG includes 20 controls, 15 of which can be automated and 5 are not.

The 20 Critical Controls subject to automated measurement and validation (AMV):

1. Inventory of Authorized and Unauthorized Hardware.
2. Inventory of Authorized and Unauthorized Software.
3. Secure Configurations for Hardware and Software For Which Such Configurations Are Available.
4. Secure Configurations of Network Devices Such as Firewalls And Routers.
5. Boundary Defense
6. Maintenance and Analysis of Complete Security Audit Logs
7. Application Software Security ***
   
8. Controlled Use of Administrative Privileges
9. Controlled Access Based On Need to Know
10. Continuous Vulnerability Testing and Remediation
11. Dormant Account Monitoring and Control
12. Anti-Malware Defenses
13. Limitation and Control of Ports, Protocols and Services
14. Wireless Device Control
15. Data Leakage Protection
    
16. Secure Network Engineering (not AMV)
17. Red Team Exercises (not AMV)
18. Incident Response Capability (not AMV)
19. Assured Data Back-Ups (not AMV)
20. Security Skills Assessment and Training to Fill Gaps (not AMV)

Two (2) points I would like to make here:

• When your only tool is hammer (For*ify), you tend to see every problem as a nail. Hey dude, *** is only 1/20 of the entire infosec.
• RedTeam Exercise isn't an automated measurement and validation.
  

Two Database Audit Tools

Today I found 2 audit tools for database: SQLAudit and DBAudit.

SQLAudit is made up of two .NET 2.0 Assemblies: SqlAudit.dll and SqlAuditGenerator.exe
T-SQL Script Generator for SQL Server 2000/2005 to Allow Auditing on Database Tables using Triggers and Additional tables for Auditing.

DBAudit Expert is a professional database auditing solution for Oracle, Sybase, DB2, MySQL and Microsoft SQL Server. DB Audit Expert enables database and system administrators, security administrators, auditors and operators to track and analyze any database activity including database security, access and usage, data creation, change or deletion. What makes DB Audit really unique is its built-in support for multiple auditing methods giving you the flexibility to choose the best fit for your database security requirements.