Good News for Auditors – Nipper Studio 2.3.4 Is Here and Includes a Check Point Configuration Retriever

Update now or download a free 30 day evaluation license and benefit from the Check Point configuration retriever and a new "Exclude Vulnerabilities" function that caters to bespoke network setups

With the launch of Nipper Studio’s 2.3.4, Titania is integrating Check Point devices into the 
software’s remote audit functionality. Now auditors will be able to use the tool to remotely retrieve files from Check Point devices, with the configuration retriever supported by Nipper Studio 2.3.4. This includes the Check Point management systems, thus allowing the auditing of multiple devices simultaneously. 

Aside from the convenience that remote auditing adds to any Nipper Studio audit, the configuration retriever was created specifically to assist Titania customers. Check Point software can run on a variety of different operating systems and platforms, but extracting the configuration file is a time-consuming process that many auditors often struggle with. The configuration retriever is designed to simplify the process and reduce support time for penetration testers.

As well as the configuration retriever, Nipper Studio 2.3.4 has also added the “Exclude
Vulnerabilities” functionality for vulnerability auditing, which allows users to specify vulnerabilities that may be erroneously flagged due to the system they operate. The “Exclude Security Issues” functionality was already available for security auditing, in order to exempt specific issues for bespoke network setups. This enhancement was added in response to customer feedback carefully reviewed by the Technical Team.

Nipper Studio was designed by Ian Whiting, a former penetration tester who truly believed that “an auditor’s time is best spent assessing things that require human input, while mundane and routine tasks are excellent candidates for automation”. This was the underlying concept for Nipper Studio. Today the software serves information security professionals worldwide, in more than 60 countries, while features and functionalities continue to be added in answer to their needs.

More information about Nipper Studio 2.3.4, supported devices and features can be found here. For updates from the Titania team, follow us on Twitter @TitaniaLimited 

Brocade FastIron Edge Configuration Retrieval Instructions

These are Brocade FastIron Edge configuration retrieval instructions (Tested on a Brocade FastIron Edge switch) using HTTP(S) 

We would recommend using HTTPS rather than HTTP for transferring your devices configuration as the latter provides no encryption. 

The procedure for getting the configuration from the device using HTTP(S) is as follows: 

1. Using your favorite web browser, connect to the HTTP(S) service provided by your Brocade FastIron Edge for remote management. You can do this by entering "https://" (recommended) or "http://" followed by your devices IP address. 

2. Logon using your administration username and password. 

3. Scroll down to ‘TFTP – Configuration’ from the list on the left. 

4. Enter the IP address of your TFTP server. 

5. Enter a name for your configuration file; you will need to add the extension .txt on to the name of the file so that it is readable by Nipper Studio.

6. Click ‘Save from Flash to Server’ or ‘Save from RAM to Server’ 

7. Your configuration will now be saved to your TFTP server. 

If you need help with auditing your network devices (firewalls, switches and routers) then try Nipper Studio for free.  Brocade FastIron Edge Devices are one of over 100 network devices supported by Nipper Studio. 

This information was brought to you by Titania and is not official information from Brocade.

Extracting Config Files from IBM Proventia M Series Devices

For IBM Proventia M series devices you can use the standard backup option from the administrative web interface. You can find this option under the System Maintenance section of the web-based administration interface. You can select to backup the configuration and then download the configuration backup to your local system.

The backup made by the Proventia device is a standard tar file, so you could rename the file with a .tar file extension. You will need to extract the backup before using it as the source for Nipper Studio. On UNIX type systems tar is usually installed by default, on Windows systems there are several archive tools that support tar (such as 7-zip). Once you have extracted the configuration files from the backup you can select the configuration using the "Add Directory" option in the "New Report" wizard, and then selecting the directory where the configuration files were extracted.

Extracting Config Files from Microsoft Forefront Threat Management Gateway devices

You can get the configuration from your Microsoft ForeFront device by using the Management console.

1. Click on the ForeFront TMG tab
2. Click one of the options to export the configuration, denoted by a blue arrow, either on the toolbar on the top, or in the "tasks" option on the right hand side of the screen







3. Follow the instructions on the wizard
4. When it comes to the "Export Preferences" screen shown below, tick both boxes and enter a password





5. Follow the rest of the instructions and the configuration will be saved ready for use with Nipper Studio

Retrieving Config Files from Nortel Passport 8000 Series Devices

For this procedure you will be using the Command Line Interface (CLI) of your Nortel Passport device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Nortel Passport using your favorite SSH client, Telnet or a direct console connection.
2. Logon using your administration authentication credentials.
3. Execute the following CLI command and capture the output (possibly using the cut and paste facility):

   show config

4. Save the captured output to a file and remove any visible page lines (i.e. --More--).

Your configuration should look similar to this:

#
# MON NOV 15 11:21:59 2010 UTC
# box type             : Passport-8010
# software version     : 3.5.0.0
# monitor version      : 3.5.0.0/058
#

#
# Asic Info : 
# SlotNum|Name  |CardType   |MdaType |Parts Description 
#
# Slot  1 8608GBE  0x20325108 0x00000000   IOM: GMAC=5  BFM: OP=3 TMUX=2...
# Slot  2   --     0x00000001 0x00000000  
# Slot  3   --     0x00000001 0x00000000  
# Slot  4   --     0x00000001 0x00000000  
# Slot  5 8691SF   0x200e0100 0x00000000  CPU: CPLD=19 SFM: OP=3 TMUX=2...
# Slot  6 8691SF   0x200e0100 0x00000000  CPU: CPLD=19 SFM: OP=3 TMUX=2...
# Slot  7 8616SXE  0x20320110 0x00000000  BFM: OP=3 TMUX=2 RARU=4 CPLD=9...
# Slot  8 8632TXE  0x20210120 0x00000000   IOM: PLRO=3  GMAC=5  BFM: OP=3...
# Slot  9 8648TXE  0x20210130 0x00000000   IOM: PLRO=3  BFM: OP=3 TMUX=2...
# Slot 10 8608GBE  0x20325108 0x00000000   IOM: GMAC=5  BFM: OP=3 TMUX=2...
#
#!flags m-mode false
#!flags enhanced-operational-mode false
#!flags vlan-optimization-mode false
#!record-reservation filter 4096
#!record-reservation ipmc 500
#!record-reservation local 2000
#!record-reservation mac 2000
#!record-reservation static-route 200
#!record-reservation vrrp 500
#!end
#
config
mac-flap-time-limit 500

#
# CLI CONFIGURATION
#

cli prompt "norteltest" 

#
# SYSTEM CONFIGURATION
#

sys set contact "Titania" 
sys set location "Office" 
...

1. Extracting Configurations from Dell PowerConnect Switches

There are multiple different methods of extracting the configuration from your Dell PowerConnect devices, this guide outlines two of those methods.

Using HTTP

The procedure for getting the configuration from the device using HTTP is as follows:

1. Using your favorite web browser, connect to the HTTP service provided by your Dell PowerConnect Device for remote management. You can do this by entering "http://" followed by your devices IP address.
2. Logon using your administration username and password.
3. Select the "Systems" tab, then the "File Management" tab, then the "File Upload" option.
4. Select the "Configuration upload" button, and the "Upload via HTTP" button.
5. Select the "Running Configuration" option in the "Transfer File Name" drop down menu.
6. Press the "Apply Changes" button, and the configuration will be saved in a format ready for use with Nipper Studio.

Using SSH, Telnet Or The Console

For this procedure you will be using the Command Line Interface (CLI) of your Dell PowerConnect device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Dell PowerConnect device using your favorite SSH client, Telnet or a direct console connection.
2. Logon using your administration authentication credentials.
3. Execute the following CLI command and capture the output (possibly using the cut and paste facility):

   show config

4. Save the captured output to a file and remove any visible page lines (i.e. --More--).