Good News for Auditors – Nipper Studio 2.3.4 Is Here and Includes a Check Point Configuration Retriever

Update now or download a free 30 day evaluation license and benefit from the Check Point configuration retriever and a new "Exclude Vulnerabilities" function that caters to bespoke network setups

With the launch of Nipper Studio’s 2.3.4, Titania is integrating Check Point devices into the 
software’s remote audit functionality. Now auditors will be able to use the tool to remotely retrieve files from Check Point devices, with the configuration retriever supported by Nipper Studio 2.3.4. This includes the Check Point management systems, thus allowing the auditing of multiple devices simultaneously. 

Aside from the convenience that remote auditing adds to any Nipper Studio audit, the configuration retriever was created specifically to assist Titania customers. Check Point software can run on a variety of different operating systems and platforms, but extracting the configuration file is a time-consuming process that many auditors often struggle with. The configuration retriever is designed to simplify the process and reduce support time for penetration testers.

As well as the configuration retriever, Nipper Studio 2.3.4 has also added the “Exclude
Vulnerabilities” functionality for vulnerability auditing, which allows users to specify vulnerabilities that may be erroneously flagged due to the system they operate. The “Exclude Security Issues” functionality was already available for security auditing, in order to exempt specific issues for bespoke network setups. This enhancement was added in response to customer feedback carefully reviewed by the Technical Team.

Nipper Studio was designed by Ian Whiting, a former penetration tester who truly believed that “an auditor’s time is best spent assessing things that require human input, while mundane and routine tasks are excellent candidates for automation”. This was the underlying concept for Nipper Studio. Today the software serves information security professionals worldwide, in more than 60 countries, while features and functionalities continue to be added in answer to their needs.

More information about Nipper Studio 2.3.4, supported devices and features can be found here. For updates from the Titania team, follow us on Twitter @TitaniaLimited 

Retrieving a Configuration for Use in Nipper Studio

Aran Jarvis, Support Technician at Titania

About the Author

Aran has a key role within both the support and testing teams at Titania ensuring
that users of the software receive the best products and services possible.
Throughout his career Aran has always had a passion for cyber security and since
joining Titania his interest and knowledge of the industry has continued to grow.

When retrieving a configuration from a network device it is always advisable to use the securest method possible. Often the securest method will be to use a console port but not all devices will have a console port or it may not be possible to access it. Connecting to this port helps to cut down the possibility of a third party intercepting the information being sent from the network device. When you are not able to physically connect to the device there are
several other possibilities for retrieving the configuration. These will all depend on how the device has been set up, its capabilities and what access you have.

Retrieving a configuration from a network device’s CLI (command line interface) is very similar across the majority of network devices. Devices can typically be assessed using SSH or Telnet. On Windows the PuTTy client supports both methods. SSH v2 is the suggested protocol to use as it will encrypt the data. Telnet is not an advisable form of connecting as it has no encryption and all information is sent in clear text, this includes the username and password used to log into the network device. Once you have initiated contact with the network device you will then need to log in with an account that has raised privileges, this is usually the admin account or super-user account. Once logged in you may need to elevate your privileges further with a command such as ‘enable’, note this may also require a password. The next step will be to have the device print the configuration to the screen. A command such as ‘show config’ or ‘show running config’ will be used. This can be different depending on the Operating System that is running on the network device that you are retrieving the configuration from. Once the configuration has been printed to the screen, you will need to copy and paste it into a .txt file, it will then be ready to be processed by Nipper Studio.

Example: How to retrieve the configuration from a Cisco ASA network device.

Below are step by step instructions for retrieving the configuration from a Cisco ASA network device using a terminal emulator over SSH v2.

1. Enter the necessary information into PuTTy or program of your choosing (see Figure 1).

Figure 1. Enter the necessary information into PuTTy

2. Enter the username of either the system administrator or super-user and then the associated password when prompted (see Figure 2).

Figure 2. Enter the username and the associated password

3. Next enter the command ‘enable’ and the password when prompted (see Figure 3).

Figure 3. Enter the command ‘enable’ and the password

4. Enter the command ‘show config’ and the configuration will be printed to the terminal (see Figure 4).

Figure 4. Enter the command ‘show config’

5. Once the full configuration has been printed to the screen, copy and paste it into a .txt file ready for Nipper Studio to process (see Figures 5, 6).

Figure 5. Printed configuration

Figure 6. Copy and paste the full configuration into a .txt file

Remote Configuration Retrieval

As well as the extensive configuration retrieval instructions integrated into the Nipper Studio software, Nipper Studio also has the functionality to retrieve configurations from selected devices using either HTTP, HTTPS, Telnet or SSH. Note, not all protocols are supported on all devices.

Below are step by step instructions for retrieving the configuration via SSH v2 from one of our test Cisco ASA devices.

1. Launch Nipper Studio and click New Report (see Figure 7).

Figure 7. Launch Nipper Studio and click New Report

2. Click Add Network (see Figure 8).

Figure 8. Click Add Network

3. Select the type of device that you will be connecting to from the Device Type drop down menu (see Figure 9).

Figure 9. Select the type of device

4. Enter the device’s IP address, then the username and password used to log into the device. Select the protocol to use, the port number will be changed to the default for the protocol. You may need to change this depending on how the device is set up. Now enter the Privilege/Enable password (see Figure 10).

Figure 10. Enter the device’s IP address, username and password

5. Once Nipper Studio has retrieved the configuration from your device, carry on creating

your report as if you had manually retrieved your configuration (see Figure 11).

Figure 11. Retrived configuration

There is extensive advice within Nipper Studio that can assist you with retrieving configurations from a number of devices.

Retrieving Config Files from WatchGuard Firewalls

You will need to connect to your WatchGuard firewall using the WatchGuard System Manager software that came with your firewall (you can also download this software using your WatchGuard support login).

The procedure for getting the configuration from the device using WatchGuard System Manager is as follows:

1. Run WatchGuard System Manager.
2. Connect to your firewall device and logon.
3. From the "Tools" menu select "Policy Manager".
4. Inside Policy Manager, select from the "File" menu "Save" and then "As File...". This will enable you to save your configuration as a file that can be used with Nipper Studio.

Foundry Network Server Iron XL configuration retrieval instructions

Foundry Network Server Iron XL configuration retrieval instructions

(Tested on a Foundry Network Server Iron XL)
Using SSH, Telnet Or The Console

For this procedure you will be using the Command Line Interface (CLI) of your Foundry Network Server Iron device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Foundry Network Server Iron using your favourite SSH client, Telnet or a direct console connection.
(NB: You may need to set the baud rate to the appropriate speed for your device. A list of standard rates can be found at the end of this document. On our Foundry Network Server Iron XL test device, the baud rate was 9600)
2. By default the Server Iron XL does not have a log in for the CLI.

3. Enter the command ‘
enable’ followed by your password. This will elevate your privilege level.

4. Enter command 'show config'

5. Save the captured output to a file and remove any visible page lines (i.e. --More--).

If you are unsure about the baud rate that your device is set to we would suggest trying the most common default baud rates which are 9600, 19200 & 115200

For your convenience, we have listed the other baud rates commonly supported by serial ports below:

110

300

600

1200

2400

4800

14400

28800

38400

56000

57600

Standard baud rates supported by some serial ports:

128000

153600

230400

256000

460800

921600

If you need help with auditing your network devices (firewalls, switches and routers) then try Nipper Studio for free.  Foundry devices are one of over 100 network devices supported by Nipper Studio. 

These instructions are provided by Titania, the network security auditing experts  and are not official instructions from Foundry.

Brocade FastIron Edge Configuration Retrieval Instructions

These are Brocade FastIron Edge configuration retrieval instructions (Tested on a Brocade FastIron Edge switch) using HTTP(S) 

We would recommend using HTTPS rather than HTTP for transferring your devices configuration as the latter provides no encryption. 

The procedure for getting the configuration from the device using HTTP(S) is as follows: 

1. Using your favorite web browser, connect to the HTTP(S) service provided by your Brocade FastIron Edge for remote management. You can do this by entering "https://" (recommended) or "http://" followed by your devices IP address. 

2. Logon using your administration username and password. 

3. Scroll down to ‘TFTP – Configuration’ from the list on the left. 

4. Enter the IP address of your TFTP server. 

5. Enter a name for your configuration file; you will need to add the extension .txt on to the name of the file so that it is readable by Nipper Studio.

6. Click ‘Save from Flash to Server’ or ‘Save from RAM to Server’ 

7. Your configuration will now be saved to your TFTP server. 

If you need help with auditing your network devices (firewalls, switches and routers) then try Nipper Studio for free.  Brocade FastIron Edge Devices are one of over 100 network devices supported by Nipper Studio. 

This information was brought to you by Titania and is not official information from Brocade.

Extracting Configuration Files from Brocade Fastlron Edge Devices

Brocade FastIron Edge configuration retrieval instructions

(Tested on a Brocade FastIron Edge 2402)
Using SSH, Telnet Or The Console

For this procedure you will be using the Command Line Interface (CLI) of your Brocade FastIron Edge device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Brocade FastIron Edge using your favourite SSH client, Telnet or a direct console connection.

(NB: You may need to set the baud rate to the appropriate speed for your device. A list of standard rates can be found at the end of this document. On our Brocade FastIron Edge test device, the baud rate was 9600 and used a straight through cable to connect via the console)
2. Logon using your administration authentication credentials.

3. Enter the command ‘Enable’ followed by your password. This will elevate your privilege level.

4. Enter command 'Show config'

5. Save the captured output to a file and remove any visible page lines (i.e.--More--).

If you are unsure about the baud rate that your device is set to we would suggest trying the most common default baud rates which are 9600, 19200 & 115200
For your convenience, we have listed the other baud rates commonly supported by serial ports below:

110
300
600
1200
2400
4800
14400

28800
38400
56000
57600

Standard baud rates supported by some serial ports:
128000
153600
230400
256000
460800
921600

Brocade Fastlron Edge Devices are one of the many devices supported by Nipper Studio network device auditing software. You can find a full list of supported devices and more information at www.titania.com

Extracting Configurations from an Extreme Networks Summit Switch

(Tested on a Extreme Networks Summit 300-48)

Using SSH, Telnet or direct console connection

For this procedure you will be using the Command Line Interface (CLI) of your Extreme Networks Summit switch device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Extreme Networks Summit Switch using your favorite SSH client, Telnet or a direct console connection. (NB: You may need to set the baud rate to the appropriate speed for your device. On our Extreme Networks test device, the baud rate was 10000)
2. Logon using your administration authentication credentials.

3.       For older versions of Extremeware you will need to use the command

show config

On newer versions of Extremeware you will need to use the command

show config detail

4.      Save the captured output to a file and remove any visible page lines (i.e. --More--).

Retrieving a Cisco Contents Service Switch Configuration

Tested on a Cisco CSS

Using SSH, Telnet or the Console

For this procedure you will be using the Command Line Interface (CLI) of your Cisco Contents Service Switch device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

 1.       Connect to the Cisco CSS using your favorite SSH client, Telnet or a direct console connection. (NB: You may need to set the baud rate to the appropriate speed for your device.  A list of standard rates can be found at the end of this document.  On our Cisco CSS test device, the baud rate was 9600)

2.       Logon using your administration authentication credentials.

3. Execute the following CLI command and capture the output (possibly using the cut and paste facility):

show startup-config

4. Save the captured output to a file and remove any visible page lines (i.e. --More--).

If you are unsure about the baud rate that your device is set to we would suggest trying the most common default baud rates which are 9600, 19200 & 115200

For your convenience, we have listed the other baud rates commonly supported by serial ports below:

110

300

600

1200

2400

4800

14400

28800

38400

56000

57600

Standard baud rates supported by some serial ports:

128000

153600 

230400

256000

460800

921600

How to Extract a 3Com Switch Configuration

3Com Switch configuration retrieval instructions

(Tested on a 3Com Switch 5500-SI)

Using SSH, Telnet or the Console.

For this procedure you will be using the Command Line Interface (CLI) of your 3Com Switch device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection. 

1.       Connect to the 3Com Switch using your favourite SSH client, Telnet or a direct console connection.  (NB: You may need to set the baud rate to the appropriate speed for your device.  A list of standard rates can be found at the end of this document.  On our 3Com test device, the baud rate was 19200)

2.       Press ENTER twice to get started.

3.       If required, log in using your administration authentication credentials.

4.       Execute the following CLI command and capture the output (possibly using the cut and paste facility):

display current-config

1.       Save the captured output to a file and, if necessary, remove any visible page lines (i.e. --More--).

2.       The resulting file should now be auto-detected as a 3Com device when entered into Nipper Studio. 

If you are unsure about the baud rate that your device is set to we would suggest trying the most common default baud rates which are 9600, 19200 & 115200

For your convenience, we have listed the other baud rates commonly supported by serial ports below:

110

300

600

1200

2400

4800

14400

28800

38400

56000

57600

 Standard baud rates supported by some serial ports:

128000

153600 

230400

256000

460800

921600

Retrieving Configuration Files from 3Com Switches

(Tested on a 3Com Switch 5500-SI)

Using SSH, Telnet or the Console.

For this procedure you will be using the Command Line Interface (CLI) of your 3Com Switch device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1.       Connect to the 3Com Switch using your favourite SSH client, Telnet or a direct console connection.  (NB: You may need to set the baud rate to the appropriate speed for your device.  A list of standard rates can be found at the end of this document.  On our 3Com test device, the baud rate was 19200)

2.       Press ENTER twice to get started.

3.       If required, log in using your administration authentication credentials.

4.       Execute the following CLI command and capture the output (possibly using the cut and paste facility):

display current-config

1.       Save the captured output to a file and, if necessary, remove any visible page lines (i.e. --More--).

2.       The resulting file should now be auto-detected as a 3Com device when entered into Nipper Studio.

If you are unsure about the baud rate that your device is set to we would suggest trying the most common default baud rates which are 9600, 19200 & 115200

For your convenience, we have listed the other baud rates commonly supported by serial ports below:

110

300

600

1200

2400

4800

14400

28800

38400

56000

57600

Standard baud rates supported by some serial ports:

128000

153600 

230400

256000

460800

921600

Brought to you by Titania www.titania.com

Retrieving 3Com SuperStack 3 Configuration Files

We would recommend using HTTPS rather than HTTP for transferring your devices configuration as the latter provides no encryption. The procedure for getting the configuration from the device using HTTP(S) is as follows:

1. Using your favorite web browser, connect to the HTTP(S) service provided by your 3Com SuperStack 3 firewall for remote management. You can do this by entering "https://" (recommended) or "http://" followed by your devices IP address.
2. Logon using your administration username and password. 3Com SuperStack 3 firewalls default to using "admin" for the username and "password" for the password.
3. Select from the menu on the right; "Tools".
4. Select the "Configuration" tab at the top.
5. Click the "Export" button and follow the instructions to save the device configuration to a file.

Getting the Config files from Check Point Based Firewalls

This configuration guide specifically focuses on Check Point firewall devices and those devices that run Check Point software such as Nokia IP and Crossbeam devices (collectively known as Check Point from this point on).

Check Point software can run on a variety of different operating systems and platforms. Nipper Studio requires a number of different configuration files from Check Point devices in order to perform the audit and these files can change between different configurations. This procedure will outline how to identify the configuration files that are required and how you can transfer them to your computer for processing with Nipper Studio. Ultimately you will end up with a directory containing Check Point configuration files that you can use.

Identifying the Configuration Files

Before continuing it is important to note that not all of these files may be on your system. On some deployments the information needed is stored in files with a different name. The sub-sections following this will show you how to search for those files depending on the firewall operating system / firmware.

The key files that you should look for are (names are case-sensitive on some systems and not all files will be present):

• objects.C
• objects.C_41
• objects_5_0.C
• rules.C
• rulebases.fws
• rulebases_5_0.fws

The files that you are looking for will probably be stored in a directory called "conf" or "database".

NOTE: If your device contains directories called "conf" and "database" with a number of the files listed above, you should select the "database" directory. Choosing the wrong directory will usually lead to Nipper Studio reporting that you have no firewall rules.

NOTE: The file list above does not represent a full list of the files used by Nipper Studio, you will need to get copy the entire configuration directory.

IPSO And Other UNIX Check Point Systems

On IPSO and other UNIX type systems you will most likely need to use a command line interface to search for configuration files. The command line interface posibilities are SSH, Telnet (not-recommended) or using a direct console connection. Mac OS X and GNU/Linux systems will already have tools to connect to those services ("ssh" and "telnet"), for Windows users you will probably need to download a tool such as PuTTY.

Once you are logged into your Check Point device you can search for files using the "find" command. For example you can search your entire system for the "objects.C" file using the following command:

     find / -name objects.C

The results will be 0 or more locations of that file on your system. So if you get no results, try the next file from the list above. On one of our test systems we get the following result from the command:

     /var/opt/CPsuite-R62/fw1/conf/objects.C

From that we can see that we will need the "/var/opt/CPsuite-R62/fw1/conf" directory from the system. If we were to change to the directory (using the "cd" command) and list the contents (using the "ls" command) we can see that some of the other files are present in the same directory.

     bash# cd /var/opt/CPsuite-R62/fw1/conf                                             
     bash# ls -l conf                                                                   
     total 21056                                                                        
     -rw-r-----  1 root  wheel     7168 Dec 22  1998 CPMILinksMgr.db.private            
     drwx------  3 root  wheel      512 Dec 22  1998 ConversionCache                    
     -rw-r--r--  1 root  wheel     1309 Oct  2 20:56 InoDistLocal.ini                   
     -rwxr-xr-x  1 root  wheel      169 Oct  2 20:56 InternalCA.C                       
     -rwxr-xr-x  1 root  wheel     1759 Oct  2 20:56 MVS_Default.W                      
     -rw-rw----  1 root  wheel     2904 Dec 22  1998 SDS_objects.c                      
     ...
     -rw-r--r--  1 root  wheel    57549 Oct  2 20:57 objects.C                          
     -rwxr-xr-x  1 root  wheel    36876 Oct  2 20:56 objects.C_41                       
     -rw-rw----  1 root  wheel   594000 Dec 22  1998 objects_5_0.C                      
     ...
     -rw-rw----  1 root  wheel       21 Dec 22  1998 rulebases_5_0.fws                     
     ...

It will probably be easiest to transfer the configuration to your system as a single file rather than as a large number of individual files. So we would recommend using the "tar" tool which should be available on your system. The "tar" command to create an archive stored as "/tmp/my-config.tar" has the following format:

     tar -cvf /tmp/my-config.tar <directory>

To make it easier to navigate to the configuration directory latter, we will change to the directory below the conf directory first. Then on our system we could use the commands:

     cd /var/opt/CPsuite-R62/fw1/
     tar -cvf /tmp/my-config.tar conf

The method of transfer will depend on what you have available. Standard systems will support SCP and FTP. You may also be able to make use of a USB pen device. To secure copy the file to a device that offers FTP you could use the following commands:

     ftp 
     ftp> bin                                                                                  
     ftp> hash                                                                                 
     ftp> put /tmp/my-config.tar
     ftp> quit

To Secure CoPy (SCP) the file to a SSH service with Secure Copy enabled, you could use the following command:

     scp /tmp/my-config.tar <username>@<ip-address>:<file-destination>

If you have SCP capabilities from your computer you could use the following to connect from your computer to the firewall:

     scp <firewall-username>@<firewall-ip>:/tmp/my-config.tar <filename>

If your firewall has a USB port you may be able to use that in order to transfer your configuration. These procedures may vary slightly depending on the UNIX varient:

1. Insert the USB storage device into the USB port of the firewall.
2. Wait a few seconds and use the "df" command to see if it has been automatically detected and mounted.
3. If it has not been mounted, use "dmesg" to view the system messages to see what /dev/<devicename> it has been assigned. Then mount the device using the "mount /dev/devicename /mnt" command.
4. Copy the file to the mounted USB device using a command such as "cp /tmp/my-config.tar /mnt/".
5. Unmount the USB device, for example using the command "umount /mnt"

Windows Check Point Systems

On Check Point-based Windows systems you can use the Windows search facility in order to find the files. You can do this by right clicking on a disk or directory in Windows Explorer and selecting the "search" option. On some versions the search facility is shown at the top of the Windows Explorer window.

NOTE: The installation of Smart Dashboard and other Check Point tools may have included demo configuration files (accessed using the demo mode tick box in the interface). This may be picked up by your search and probably stored in a "PROGRAM\textbackslash cpml\_dir\textbackslash conf" directory. If you have several installations then you will probably have several copies of the demo files.

It will probably be easiest to transfer the configuration to your system as a single file rather than as a large number of individual files. You can do this under Windows using the compress folder facility. Using the right mouse button on the folder, select the "Send To" and then "Compressed (zipped) Folder" option. This will create the compressed folder containing the configuration files in the same directory.

Depending on your system setup the archived configuration file could be transferred to your system using a USB pen, FTP or using a network share.

Using The Configuration With Nipper Studio

Before you can use the configuration with Nipper Studio you will have to extract it from the archive file. The configuration can then be selected in Nipper Studio using the "Add Directory" option in the "New Report" wizard.

Retrieving config files from Cisco ASA, PIX And FWSM Firewalls

There are multiple different methods of extracting the configuration from your Cisco Security Appliance, this guide outlines just three of those.

Using ASDM And PDM

The ASDM and PDM interfaces can be accessed using a web browser with Java capabilities. Whether you have access to ASDM or PDM will depend on your security appliance (and its age), but the procedure is the same for both. The procedure for getting the configuration from the your device is as follows:

1. Using your favorite web browser, connect to the HTTPS service provided by your Cisco device for remote management. You can do this by entering "https://" followed by your devices IP address.
2. On ADSM-capable devices, click on the "Run ADSM as a Java Applet" button.
3. Logon using your administration username and password.
4. You should now see the ADSM or PDM application, both of which are shown in the screens below.
5. You can show the "running-config" using the option on the File menu.
6. Copy and paste the configuration into a file to use with Nipper Studio.

 Using TFTP

We don't recommend using TFTP to transfer your configuration due to weaknesses in the protocol, the other methods described in this section are more secure. However, here is the procedure for using TFTP:

1. Connect to the Cisco device using SSH, Telnet, ASDM, PDM or through a Console connection.
2. Login to your Cisco PIX device.
3. Transfer the configuration using the TFTP command "write net <ip-address>:<filename>"

Using SSH, Telnet Or The Console

For this procedure you will be using the Command Line Interface (CLI) of your Cisco device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Cisco using your favorite SSH client, Telnet or a direct console connection.
2. Logon using your administration authentication credentials.
3. Enter "enable" and type in your enable password.
4. Execute the following CLI command and capture the output (possibly using the cut and paste facility):

   show run

5. Save the captured output to a file and remove any visible page lines (i.e. --More--).