Good News for Auditors – Nipper Studio 2.3.4 Is Here and Includes a Check Point Configuration Retriever

Update now or download a free 30 day evaluation license and benefit from the Check Point configuration retriever and a new "Exclude Vulnerabilities" function that caters to bespoke network setups

With the launch of Nipper Studio’s 2.3.4, Titania is integrating Check Point devices into the 
software’s remote audit functionality. Now auditors will be able to use the tool to remotely retrieve files from Check Point devices, with the configuration retriever supported by Nipper Studio 2.3.4. This includes the Check Point management systems, thus allowing the auditing of multiple devices simultaneously. 

Aside from the convenience that remote auditing adds to any Nipper Studio audit, the configuration retriever was created specifically to assist Titania customers. Check Point software can run on a variety of different operating systems and platforms, but extracting the configuration file is a time-consuming process that many auditors often struggle with. The configuration retriever is designed to simplify the process and reduce support time for penetration testers.

As well as the configuration retriever, Nipper Studio 2.3.4 has also added the “Exclude
Vulnerabilities” functionality for vulnerability auditing, which allows users to specify vulnerabilities that may be erroneously flagged due to the system they operate. The “Exclude Security Issues” functionality was already available for security auditing, in order to exempt specific issues for bespoke network setups. This enhancement was added in response to customer feedback carefully reviewed by the Technical Team.

Nipper Studio was designed by Ian Whiting, a former penetration tester who truly believed that “an auditor’s time is best spent assessing things that require human input, while mundane and routine tasks are excellent candidates for automation”. This was the underlying concept for Nipper Studio. Today the software serves information security professionals worldwide, in more than 60 countries, while features and functionalities continue to be added in answer to their needs.

More information about Nipper Studio 2.3.4, supported devices and features can be found here. For updates from the Titania team, follow us on Twitter @TitaniaLimited 

Shellshock: Titania Confirms Nipper Studio and Paws Studio Are Not Affected

The Technical Support Team at Titania would like to inform all users that the network security auditing software, Nipper Studio and the compliance auditing tool, Paws Studio are not affected by the Shellshock vulnerability. Neither tool relies on Bash, which is the shell software vulnerable to the exploit.  We can also confirm that our own infrastructure and our website are up to date and not subject to the vulnerability.

Patches to operating systems are being currently issued and a complete list can be found on the US-CERT (United States Computer Readiness Team) website. For accurate results, keep checking this page, as patches are continuously developed and improved.

We will continue to monitor the situation and keep you up to date.  

Compliance Auditing & Vulnerability Assessment in One Tool: Paws Studio

For the first time, Paws Studio, Titania’s powerful compliance auditing tool, will now include vulnerability assessments as well as compliance. This enhancement is the first step towards delivering a more holistic solution for auditors of workstations and servers, just as Titania’s flagship product Nipper Studio has for auditor of firewalls, switches and routers.

Titania is pleased to announce the introduction of OVAL (Open Vulnerability Assessment Language) compliance and vulnerability assessment to Paws Studio, the compliance auditing tool for workstations and servers. The latest release will complement existent policies such as: PCI DSS, SANS, NERC CIP 007-4, NSA and DISA STIG, in order to provide an even more comprehensive view for auditors.

OVAL is supported by the Department of Homeland Security as well as other U.S. governmental agencies and it is a risk and compliance management solution, extensively used by the IT industry. The OVAL compliance framework supports 560+ checks, depending on the operating system, with further check support to be added in the future. The OVAL vulnerability directory carries out 70+ checks, subject to the operating system. Due to frequent updates applied to OVAL, Paws Studio will facilitate the updating process through a convenient Policy Converter which can be found in the ‘Utilities’ tab. The Policy Converter allows the user to download the latest updates from the OVAL website, save it and then upload it to Paws Studio. The Titania Technical Team will also update OVAL on a regular basis within Paws Studio.

Additional improvements to the software include enhancing the Registry Checks to be case sensitive or insensitive, which will minimise the risk of false reporting. Registry values can now be evaluated against regular expressions. Also for a more accurate view, Paws Studio now allows checks for “<=” and “>=” in conjunction with the already present “<” and “>”.

For the Technical Team to offer the best support possible to customers, Paws Studio now offers an easy logging option which can be accessed through GUI, under ‘Settings’, by checking the box for ‘Enable logging’. This option enables the support team to extract a log with useful information for supplying specific and time-efficient assistance.

Overall, the team has also performed general maintenance work to consolidate Paws Studio to an even more robust structure and improved user experience. Titania cares about customers’ suggestions and endeavours to add new features to its products, according to users’ feedback. If you have any suggestions or questions about Paws Studio, please contact the Titania team at support@titania.com

[Note this release is for Windows, Ubuntu 12.04, Open Suse 12.3 and Fedora 19 platforms with releases for CentOS, Open Suse 13.1 and Ubuntu 13.10 to follow.]

Paws Studio Review

By Jim Halfpenny 

About the Author 


Jim is an experienced IT practitioner with 14 years experience in both academia and industry, working with renowned companies including British Airways, Oracle, BSkyB and Cloudera.

Whether you see compliance as a burden or an aspiration we are frequently mandated to meet a certain set of security requirements around our information assets. One important aspect is being able to demonstrate to yourself and to others that your systems meet the criteria set by your compliance regime. How do you ensure that your systems are compliant with your policies or those mandated by compliance standards? A program of auditing your systems will help you understand the state of your estate.

Titania’s Paws Studio provides a means to audit Windows and Linux systems and provide compliance reports against a defined set of policies. It sets out to provide clear and detailed reports of the system’s level of compliance. Policy templates are editable and Paws Studio comes with predefined templates based on established policies and best practice including PCI, SANS and DoD STIG.

Policy templates are essentially a group of compliance audit checks built from the check library provided by Paws Studio. Checks range from high-level tests such as the presence of antimalware software right down to individual file permissions and registry settings.

There are two ways of creating and customising policy templates. The first is a wizard that guides you through creating your policy. Here you can define the rules that comprise your policy by clicking through a series of screen and selecting checks from the library. The interface is straightforward and self-explanatory and it is a great tool for less advanced users. However, the more technically minded user might find it time consuming and prefer to use the supplied Policy Editor instead which is undoubtedly the more powerful tool.

The Policy Editor provides you with a tree layout of your policy, giving you a bird’s eye view on the ability to quickly navigate through the rules.

In addition clicking on the advanced tab gives you a syntax-highlighted view of the raw policy XML. Whatever tool you choose, the result is an XML file defining the compliance checks for your policy and metadata used to generate the final compliance reports.

Once you have your policy defined it’s time to audit your systems. In order to compile a report you need the compliance audit data collected from a machine. At this point you have three options. You can choose to audit the local machine where Paws Studio is installed. You can also audit a system over the network. To do this will need valid administrator credentials on the remote system. Paws Studio will scan the local network for hosts to audit or you can specify the IP address of the machines in scope.

The third option is to use the portable data collector software, a small executable that can be run from a thumb drive. This is particularly useful where you need to audit a system that is not on the network or is air gapped from your audit workstation. Run the Data Collector, choose an audit policy and it will create a .paws file with the audit results.

Once you have collected your audit data you can produce a report on the audited system. Reports contain the result of each test on the system as well as summary charts showing percent tests passed and a breakdown of tests that failed by severity. Paws Studio creates a compliance audit report that can be saved as HTML, PDF, PostScript or Microsoft Word document. CSV and XML formats are also available so you can feed machine-readable reports into other reporting systems or build your own applications to consume your compliance data.

Paws Studio is available for Windows, Mac OS X and various flavours of Linux and currently supports auditing of Windows and Linux systems. This software pitches to the SME market who could be priced out by enterprise-grade auditing software though they are unlikely to benefit from the bells and whistles these tools provide. If you need a cost effective and easy to use compliance reporting tool, Titania’s Paws Studio certainly merits a second look.

Paws Studio Walkthrough

by Alen Damadzic (Software Developer, Titania)

About the Author

Alen is a key member of the technical team and is the lead developer of Paws Studio compliance auditing software. Since joining Titania as a computing graduate three years ago, Alen’s knowledge of software development and cyber security has grown with the company and he now uses this knowledge to support and train new members to the ever growing development team.

Paws Studio is a compliance auditing tool for servers, workstations and other Windows or Linux based systems. At a basic level, creating a compliance report in Paws Studio can be as simple as selecting an audit policy and clicking go. However, behind the scenes, Paws Studio is performing a number of different processes in order to determine what needs to be checked, collecting the data, comparing the collected data against a policy and finally creating a report. This article provides a walkthrough of those processes to enable you to create truly effective and thorough custom policies to audit against.

Figure 1. Paws Studio audit process

A typical Paws Studio audit is a two-step process. The initial step is to collect the data for the audit and the second is to create the report by comparing that data against a compliance list (see Figure 1).

Collecting Audit Data

Data, such as password policy settings, are collected using a data collector. On Windows, the data collector is a small native program that reads the registry, file permissions and so on. The data collector does not require installing on the system that is being audited and does not require anything to be installed. On Linux systems the data collector is a shell script.

The data collector only collects what is required to create the report. Those audit parameters are specified in a policy file, which we will come back to later.

Figure 2. Report creation methods

When you select to create a new report in Paws Studio (see Figure 2), it will give you the option to add all the systems that you want to audit (local and remote). Paws Studio will then deal with executing the data collector for you and retrieve the results. It is important to note that during this process, Paws Studio will tidy up after itself, so no audit files will be left on the audited system.

Figure 3. Manual data collector option

It is also possible for you to run the data collector yourself on various systems and provide Paws Studio with the collected data; this is shown as the “Manual” option (see Figure 3).

To obtain the latest data collector so that you can perform the audit yourself, select the “Export Collector” option from the “Utilities” menu. You will also need a copy of the audit policy file for the data collector. By default on a Windows system the policy files are stored in “C:\Program Files\Paws Studio\XML”. You will find policy files for PCI, STIG, SANS, and others.

The data collector can be executed from the command line on both Windows and Linux systems. This gives you the ability to script the software so you can automate the audit data collection process.

The Audit Policy

Figure 4. Audit policies

When you create a compliance audit report in Paws Studio you have to select an audit policy that you want to check compliance with. It could be a PCI policy, STIG or others. The policy that you check compliance against when producing a Paws Studio report is stored in a specially formatted XML file.

Although Paws Studio is supplied with a number of pre-defined audit policies, you can create your own. You could use your favourite XML editor to create an audit policy file but Paws Studio includes a policy editor.

The audit policy editor has two modes of operation, a wizard mode and editor mode (see Figures 5, 6). The wizard mode is designed to easily enable you to create your own new audit policy, or edit an existing one, and guide you through the process. The editor mode is more suited for advanced users and editing existing policies.

Figure 5. Policy editor: editor mode

Figure 6. Policy editor: wizard mode

Figure 7. Paws Studio Settings

Customizing an Audit Report

Your audit reports can be customized to change the company name, logo, classification and so on. If you want to override the default Cascading Style Sheet (CSS) there is even an option to do that.

Some key customization options such as the “Policy Editor” “Authorized Software” and “Authorized Startup Items” contain the lists of what is determined to be authorized or not during those particular checks.

The “Reporting” options include an “Interactive Mode” setting that will cause Paws Studio to potentially ask you some questions during an audit. For example, some checks may require a physical analysis, such as “is the server room door locked?”.

An Audit Walkthrough

Figure 8. Paws Studio main frame

Now that we have highlighted the key components of a Paws Studio audit, the simple process of performing a report with all the available options is straight forward.

Select the “Create Report” option (see Figure 8).

Figure 9. Report creation methods

Select what you want to audit (see Figure 9).

“Local” will enable you to perform an audit of your local machine.

“Network” will enable to audit other computers on the network. You many need to specify a username and password.

“Manual” will allow you to add manually collected audit data.

Figure 10. Audit policies

Select the audit policy report that you are interested in. You can select multiple audit policies or specify your own using the “Import Policy” button (see Figure 10).

Click on “Create Report”.

Then you can read your report and save it out to a number of different formats such as HTML, Word, PDF, CSV and others.

Conclusion

This article has delved into what goes on behind the scenes of Paws Studio. By walking you through the key processes involved in creating your own compliance reports, it will enable you to get the most out of the software.

CEO in the Spotlight: Interview with Ian Whiting

by PenTest Team

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has been accredited by CESG for his security and team leading expertise for over 5 years. 

In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve. Today Titania’s products are used in over 60 countries by government and military agencies, financial institutions, telecommunications companies, national infrastructure organizations and auditing companies, to help them secure critical systems.

Hello Ian, please tell us few words about Titania.

Titania was founded with the aim of developing easy to use security auditing software that performs a detailed analysis of systems that otherwise would require specialist knowledge. The software that we have released to date has assisted both government and leading businesses in better securing their networks. In the process, Titania has gained critical acclaim from leading industry analysts and several awards.

Since opening our first office in December 2010, Titania has experienced considerable growth. We now supply our products directly, and through a network of global partners, to organizations in over 50 countries worldwide. Our customers tend to be those that are security conscious, in sectors such as finance, defence, telecommunications, auditing and manufacturing.

What is it like leading a company like Titania and what are some of the challenges you face?

There are of course many technical and development challenges to running a business like Titania that specializes in cyber security auditing. However, as soon as we started trading our largest problem was responding to our customers’ requests to purchase the software and keep up with the demand for new features and functionality. In fact our largest challenge to date has been to manage the growth of the company. 

We are always looking to keep ahead of the competition and we have decided on a plan to achieve that goal through the technical capabilities of our products rather than through our company's marketing arm. So although we sometimes have a difficult time communicating our message, our products speak for themselves.

Do you offer any professional services?

We do not provide any professional services at present, though we are always continuing to review that situation. So we may add professional services at a later stage, both directly and through our network of global partners.

Users of our software do not require training services as one of our development goals was always to make our products as easy to use as possible. I believe we have succeeded in that goal. I have personally seen non-technical people produce detailed and complex security audit reports using our software with no previous experience with the tool. This being said, we are not resting on our laurels and we continue to look at ways to further improve user interaction with our products.

How often do you refresh (update) your products to meet the latest security challenges and threats?

Our products are continually being updated and are evolving to meet the requirements of our customers and the new issues that emerge in the industry. Typically each of our products has a short release cycle with updates being made available monthly.

Can you mention some of your top-selling products?

Nipper Studio is our company’s flagship product. It takes the manual process of reviewing how network switches, routers and firewalls have been configured and automates it. This is not done using the intrusive method of scanning a network device, which would not give you the full picture of how the device has been setup, but by analysing their native configuration.

The reports that are produced by Nipper Studio can contain security audit findings, compliance reporting, configuration reporting and more. The reports produced are equally detailed and specific, they were designed with technology that writes the report just like a human would. This is in contrast to traditional computer report writing technology that simply joins pre-written paragraphs of text together and rarely accurately describes how something specific has been configured.

Our most recent product, Paws Studio, is a Windows and Linux compliance product for servers, workstations and cloud-based systems. It was developed based on very specific security requirements of our customers who work in highly secure environments, with very sensitive information. They needed a solution that could be run without installing software on the audited system. Therefore we built Paws Studio to be able to run over the network, on the local system or offline with no connection to the audited system.

Although we have pre-configured Paws Studio with a number of different compliance check lists, you can define your own compliance checklist within the product. We have developed a Policy Editor that enables you to either modify one of the pre-defined compliance lists or create one of your own from scratch.

All of our products have been designed to be integrated with bespoke and third-party systems, including continuous monitoring setups. They can easily be integrated using a scriptable interface and you can export the report data in a variety of different formats. We also release our products with multi-platform support covering Microsoft Windows, Apple Mac OS X, Red Hat Linux, Ubuntu, Fedora and so on.

Our customers are very important to us and their needs play a key role in the development of all of our products. We base a lot of our development plans around their feedback and requests.

Where do you see network security heading in next few years? What are some of your predictions?

I see that security compliance is going to play an ever larger role within the industry than it does today. It is great to see progress towards an ever improving security baseline, but it also saddens me to see many organizations depending solely on compliance as the means to being secure. It is why I believe it is important that the security industry, in addition to enhancing security compliance lists, highlights the fact that being compliant does not mean you are secure. Unfortunately I can see there will continue to be security breaches in organizations who manage security risks with compliance instead of striving to ensure a truly
secure environment. You can almost picture the victim company’s statement now. It would read something along the lines of: “The company had met their compliance standards and we are now reviewing our current operating practices to ensure how best future breaches could be avoided”. 

Nipper Studio is fairly popular in the network security industry; can you give us some historical background on that product?

I have a background as a penetration tester and regularly performed manual assessments of various network devices. A proper assessment of a network device is not a five minute task, each aspect of how a device can be configured needs to be properly analysed and any potential security risks highlighted. Anyone who is simply reviewing firewall rules is not doing a thorough job. It is also a task that requires a high level of knowledge about the device being reviewed. It seemed by me that this is exactly the type of task that is suitable for automation.

***** It is worth noting that although penetration testers are typically both highly skilled and adaptable, they cannot be expected to have in-depth knowledge of every system they come across. The same is also true of the network administrators who manage those systems, they may not have the in-depth security background required to identify potential weaknesses in their systems. Nipper Studio is exactly the type of solution that could help each side. Giving penetration testers, device specific assistance and helping network administrators identify potential security weaknesses. *****

Although Nipper Studio originally started life simply identifying a limited number of security weaknesses with Cisco configurations, it soon grew by adding support for more devices, identifying more security weaknesses and eventually writing the security audit report for you.

At Titania, how do you strive to achieve top-quality software? What kind of quality control do the products go through?

This is a very challenging aspect of developing a product such as Nipper Studio. The number of moving variables involved with the development process is huge. We support a large number of different devices, the manufacturers of which are constantly updating and revising their platforms. Plus the vulnerabilities in each platform are forever evolving.

We maintain a growing test environment that includes the different devices that we support, plan to support and some others that may never get added to Nipper Studio. These are all used during the development and testing process, together with different firmware versions. To help manage the development plan for this we employ a development and tracking system that enables us to manage all these variables together with improvements suggested by our customers. Each developer and tester knows from our tracking system what tasks they need to be working on next.

Nipper Studio supports various Cisco devices and some people may be under the impression it only supports Cisco devices. What would you like to say about that?

Nipper Studio does support a wide range of Cisco devices, it was originally developed with only Cisco support and it is used by Cisco. So it is easy to understand how historically Nipper Studio could be mistaken for supporting only Cisco devices. However, the latest versions of Nipper Studio support over 100 different devices from different manufacturers and are used internally by a growing number of those manufacturers. Even a network that predominantly uses devices made by a single manufacturer will undoubtedly have a number of network devices made by someone else. We are often approached by customers asking for us to add support for unusual systems and devices. The network devices that we see deployed in data centers has evolved over time with increasing deployments of some devices and the reduction in others. We have developed a plugin-based architecture for Nipper Studio to help us adapt to those changes, enabling us to quickly develop, test and deploy support for new devices.

Very often clients complain that they are not offered good product/customer support. How do you ensure good customer support?

It was important for us to achieve our ISO 9001 accreditation as it helps us to ensure that every customer receives the same high standard of support from the point that they first engage with the company to when they receive the product and the subsequent support process that follows. We believe that every customer deserves great customer service and technical support and we offer these services free of charge to every one of our customers. Our ISO 9001 conformance not only ensures that all of our staff deliver the highest level of support but also promotes continuous improvement throughout the company. We achieve this through collecting and reviewing customer feedback and auditing our customer care processes.

Thank you for the interview

Configuration Auditing: The Hygienist You've Always Wanted

by Nicola Whiting (COO, Titania)

About the Author

Nicola Whiting is Titania Ltd’s Chief Operating Officer and has a solid reputation for increasing revenues and profitability within technology based SME environments. She joined the team in 2011 has overseen a period of intense growth and change. Now Nicola’s focus is on extending the organizational capabilities and workforce skills, in order to continue to embrace innovation.



For many, configuration security ranks about the same as dental hygiene.

Critical infrastructure devices such as firewalls, switches and routers need to be secured against external hackers and internal threats, but it’s not seen as exciting and does not rank highly on boardroom agendas.

Source: evlad.com 

The most common result is to use a dual approach, combining scanning or agent based software, with annual penetration test reviews – to use the same analogy, daily brushing and an annual trip to the dentist.

This two-layer response does offer some advantage, it’s great for regular big-picture analytics (the ones that boardrooms like) and the annual penetration testers do a thorough job of analysing vulnerabilities and providing a detailed report.

Unfortunately as anyone with a mouthful of fillings can testify, it also often lets the rot set in!

The Dual Response Issue

Network scanners send huge numbers of network probes to a device and can impact performance. Only exposed vulnerabilities are identified, this potentially misses many issues that would be found with a detailed manual audit.

Agent-based audit software requires software to be installed on the audit devices and this is not possible for all devices. Furthermore, the required agent software can introduce additional security vulnerabilities.

Penetration testing requires expert level knowledge and is one of the most widely used and trusted forms of detailed security analysis. The process involves simulating an attack on your network systems through active exploitation of security vulnerabilities. To the resident network team, it can feel like the equivalent of lining up for a root canal….

Typically your primary goal is to test the operational capability of your network defenses to successfully detect and respond to attacks. Depending on the agreed scope of the test, reported elements may include: hardware and software vulnerabilities, poor or improper system configuration and suggested improvements to operational processes.

Part of the testing process may involve a manual configuration review.

Examining individual device configurations is highly time-consuming with significant manpower costs. Typically this results in point in time audits, extrapolating results from a sample of devices and potentially leaving vulnerabilities on non-assessed devices.

The Third Option

Early in his career as a Penetration Tester and CHECK team leader, Ian Whiting (CEO of Titania Ltd) realized there was a third option that was not being provided within the security marketplace. He realized that by automating the detailed configuration vulnerability analysis he could improve auditing speed, accuracy and return on investment.

His initial requirements were to:

• Flatten the security assessment process
• Achieve significant cost savings on current audit practices
• Improve the productivity of the audit process
• Reduce human error factor through automation
• Provide instant, device-specific expertise to non-specialist auditors

Through many years of hard work he developed a configuration auditing solution, that is now a “go to” tool in both SME and global Penetration Testers tool kits and has grown far past its original brief.

The “Configuration Hygienist” 

Whilst penetration testers are typically both highly skilled and adaptable, you cannot be expected to have in depth knowledge of every system you come across! The same is also true of the network administrators who manage those systems, they may not have the in-depth security background required to identify potential weaknesses in their systems.

Typically your penetration tester’s toolkit is not something you can pass on, but as a “cyber hygiene” professional, it makes sense to look for ways to reduce the likelihood of vulnerability cavities developing between visits.

The interim use of a cost effective configuration auditor widens the potential for detailed device analysis and on-going identification of potential security weaknesses. Return visits can then be less about finding conflicting rules and compliance failures and allow more focus on operational improvements and higher level security issues.

Nipper Studio - Configuration Auditing Tool

Nipper Studio’s early growth was entirely by word of mouth and Titania is very grateful to the penetration testing community. Thanks to you, Nipper Studio is now a multi-award winning, global solution used in over 60 countries and on every continent.

Nipper Studio quickly performs a thorough security assessment of multiple complex network devices, providing a detailed audit report, typically unachievable with scanning based technologies. The audit report can be used in a variety of ways and includes recommendations and commands to mitigate the issues.

It requires no additional services on the device or any agents to be installed and can audit the devices without either scanning or connecting to them (ideal for high security clients!).

Figure 1. Scanning in Nipper Studio

It is designed to be both flexible and easy to use. Functionality can be extended through plugins and allows for custom integration into bespoke systems e.g. for use in continuous monitoring. 

The device configuration can be read in by loading a saved configuration file obtained from the device or by connecting to the device over the network.

Figure 2. Reading a configuration in Nipper Studio

Once a device’s configuration has been processed by Nipper Studio a wide range of report types can be created, such as a penetration tester grade security audit, configuration reporting, compliance analysis, change reporting and more.

An extensive range of options enable you to fine tune and customise your reports with no expert knowledge required.

So if you’re looking at what configuration auditors could do to improve your own ROI, or a tool to aid your clients monitor their internal controls then you can refer to our Nipper Studio overview above.

Other products in the marketplace now have some overlap, but it’s a good guide for what to expect your configuration auditor to deliver.

For more information or to arrange a free trial please contact sales@titania.com

Titania Free Tools

Nigel Matthews and Max McFarlane (Free Tools Development Team, Titania)

About the Authors

Titania's Free Tools Team have worked hard to build and maintain a number of free tools which have now been released to help assist other auditors and penetration testers with their work.

Since the developers at Titania come from a penetration testing background, over the years they have created a number of tools to assist with their work. Furthermore, some of those tools have been released to help assist other penetration testers with their work. This article takes a look at two of those tools, SSL Scan and Banner Grab, and will also offer an exclusive insight into a number of updates that will be released soon.

Although packages are available on Linux platforms for some of these tools, they are distributed in source code form. This article shows how they can be compiled from the source code and run.

SSL Scan

The purpose of SSL Scan is to determine what encryption ciphers are supported by a particular SSL service. It also obtains a copy of the SSL certificate, determines default ciphers and can send additional service probes to determine if the cipher can actually be used with the service. Some SSL servers will accept negotiation with an encryption cipher, but the service then disallows it.

SSL Scan makes use of the OpenSSL library to create a list of potential ciphers that are then used to test a service.

Compilation

From the SSL Scan page on the Titania website, follow the link to download SSL Scan (the latest version is 1.8.2). You will also need OpenSSL (and the development libraries, if these are separate on your system) and the GNU C++ compiler. You may be able to use Cygwin / MinGW on Windows.

Extract the source code to a directory and then option a command prompt in that directory. You can then compile the source code using the following command:

gcc -lssl -lcrypto -o sslscan sslscan.c

On Apple Mac OS X systems, the procedure is slightly different as you need to use the Ports version of OpenSSL, rather than the restricted version that Apple supply. You can download and install Ports from macports.org. Once installed execute the following command to install the Ports version of OpenSSL:

sudo port install openssl 

Then you can compile SSL Scan using the following command:

gcc -I/opt/local/include -L/opt/local/lib -lssl -lcrypto -o sslscan sslscan.c

Using SSL Scan

Now that SSL Scan is compiled, you can obtain help on the command line options by typing the following command (see Listing 1):

./sslscan --help

Listing 1. ‘sslscan --help’ results

Command:

./sslscan [Options] [host:port | host]

Options:

--targets=<file>             A file containing a list of hosts to

                             check. Hosts can be supplied with

                             ports (i.e. host:port).

--no-failed                  List only accepted ciphers (default
                             is to listing all ciphers).

--ssl2                       Only check SSLv2 ciphers.

--ssl3                       Only check SSLv3 ciphers.

--tls1                       Only check TLSv1 ciphers.

--pk=<file>                  A file containing the private key or
                             a PKCS#12 file containing a private
                             key/certificate pair (as produced by

                             MSIE and Netscape).

--pkpass=<password>          The password for the private key or

                             PKCS#12 file.

--certs=<file>               A file containing PEM/ASN1 formatted
                             client certificates.

--starttls                   If a STARTTLS is required to kick an

                             SMTP service into action.

--http                       Test a HTTP connection.

--bugs                       Enable SSL implementation bug                                          workarounds.

--xml=<file>                 Output results to an XML file.

--version                    Display the program version.

--quiet                      Be quiet

--help                       Display the help text you are now
                             reading.

Example:
./sslscan 127.0.0.1

To use SSL Scan to determine what ciphers a standard HTTPS server operating on port 443 supports (using Google as an example):
./sslscan www.google.com

You will then receive information similar to what you can see in Listing 2.

Listing 2. Testing SSL server www.google.com on port 443

Testing SSL server www.google.com on port 443

Supported	Server	Cipher(s):
Rejected	SSLv2	168 bits	DES-CBC3-MD5
Rejected	SSLv2	128 bits	RC2-CBC-MD5
Rejected	SSLv2	128 bits	RC4-MD5
Rejected	SSLv2	56  bits	DES-CBC-MD5
Rejected	SSLv2	40  bits	EXP-RC2-CBC-MD5
Rejected	SSLv2	40  bits	EXP-RC4-MD5
Failed	SSLv3	256 bits	ECDHE-RSA-AES256-GCM-SHA384
Failed	SSLv3	256 bits	ECDHE-ECDSA-AES256-GCM-SHA384
Failed	SSLv3	256 bits	ECDHE-RSA-AES256-SHA384
Failed	SSLv3	256 bits	ECDHE-ECDSA-AES256-SHA384
Accepted	SSLv3	256 bits	ECDHE-RSA-AES256-SHA
Rejected	SSLv3	256 bits	ECDHE-ECDSA-AES256-SHA
Rejected	SSLv3	256 bits	SRP-DSS-AES-256-CBC-SHA
Rejected	SSLv3	257 bits	SRP-RSA-AES-256-CBC-SHA
Failed	SSLv3	258 bits	DHE-DSS-AES256-GCM-SHA384

…

SSL Scan can be integrated in to third-party products by using the XML output option. The XML results can then be easily imported and managed by your own custom applications. To do this you can use the following command:
./sslscan --xml=scan-results.xml www.google.com

Banner Grab

When performing a penetration assessment, obtaining network service banners can often provide useful information. This information is not always accurately processed and reported by vulnerability scanners. Information leakage from a network service banner can have the potential to lead an attacker toward software vulnerabilities. For example, SSH service banners will often include both software and version details.

Titania developed Banner Grab to go and get the service banner information for you. In addition to standard service banners, Banner Grab has the ability to send specially formatted triggers for different types of service in order to obtain as much information as possible. By default Banner Grab will send triggers when a common port is used that has a trigger defined.

Compilation

From the Banner Grab page on the Titania website, follow the link to download Banner Grab (the latest version is 3.6). If you want to compile Banner Grab with SSL support then you will need to download OpenSSL (and the development libraries, if these are separate on your system). You will also need the GNU C++ compiler. You may be able to use Cygwin / MinGW on Windows.

Extract the source code to a directory and then option a command prompt in that directory. You can then compile the source code using the following command:
gcc –lssl –lcrypto –o bannergrab bannergrab.c

If you want to build Banner Grab without SSL support you can use the following:
gcc –DNOSSL –o bannergrab bannergrab.c

Using Banner Grab

Once compiled you can get help on Banner Grab by typing the following command:
./bannergrab --help

The result should be similar to what you can see in Listing 3.

Listing 3. ‘./bannergrab --help’ results

Command:
./bannergrab [Options] host port

Options:
--udp                        Connect to a port using UDP.                                          The default is to use TCP.

--no-triggers                Collect only the connection banner,                                    no triggers and no SSL.

--trigger=<trigger>          Specify the trigger to use. Specify
                             DEFAULT to use the default trigger.

--no-ssl                     Prevent SSL connection creation.

--no-hex                     Output containing non-printable
                             characters are converted to hex.                                      This option prevents the                                              conversion.

--conn-time=<secs>           Connection timeout (default is 5s).

--read-time=<secs>           Read timeout (default is 3s).

--verbose                    Show additional program details such                                  as any errors.

--show-triggers              Show the supported triggers.

--version                    Show the program version.

--help                       Display the help text you are                                          reading now.

Example:

./bannergrab 127.0.0.1 80

To get a simple banner from an SSH server you could type the following:
./bannergrab 192.168.0.22 22

On my test SSH service the result was:
SSH-2.0-OpenSSH_5.3

As you can see the SSH service returned not only the SSH protocol but the SSH service software and version. This is very useful information for an attacker attempting to identify software vulnerabilities to exploit.

I mentioned earlier about Banner Grab sending triggers to a service to identify additional information. In the next example I will use Banner Grab to get service information from a SNMP service. The command was:
./bannergrab --udp 192.168.0.12 161

See the results in Listing 4.

Listing 4. ‘./bannergrab --udp 192.168.0.12 161’ results



When the information returned from a service includes non-printable characters, Banner Grab returns the information in a HEX value format with the printable characters to the right. As you can see from the returned information it appears to be a HP device and has community strings of “public” and “private” supported.

Future Developments

There are a number of exciting updates coming through the Titania Free Tool Development Team at the moment. SSL Scan and Banner Grab tools described in this article are being updated, together with graphical versions of the tools. The Banner Grab tool now also includes a port scanning tool to identify the live ports on a device prior to performing the banner grabbing.

The Free Tool Team has also been updating our other tools such as IP Calculator, which now includes IPv6 support and provides much more address details. Plus there will be pre-compiled binary packages available for Windows, Linux and Mac systems making them all much easier to use. For more information on our full portfolio of free tools, visit our website.