Cybersecurity Insights

Setting the scene

A fair amount of the work we do in the Foregenix Penetration Testing team is, in one way or another, a flavour of web application penetration testing. In these assessments we come across command execution vulnerabilities that belong in one of two different categories:

1. Those were the output is returned directly to the user and,
2. Well… those that are not.

In this blog post we will discuss the latter, cases where the output of our command is not directly displayed on the application, and present a strategy for obtaining access to the output of our command using recursive DNS queries. Finally we construct a practical example of the discussed strategy via a step by step process bypassing different constraints imposed to us by the use of DNS as an out of band retrieval method.

Red teaming, in an information security context, is an adversarial-based offensive activity against an organisation's assets, whether this is infrastructure, applications or people. Red teaming is a specialised penetration testing service offering wherein the attacker assumes the role of an advanced threat actor and attempts to compromise agreed upon components inside the target. The threat actors use Tactics, Techniques and Procedures (TTPs) in their compromise campaigns. It is designed to be stealthier than a typical penetration test and test the defences of a network against a persistent attacker. It is also goal driven to provide focus and guide the test towards what the targeted organisation sees as its most valuable assets rather than the common misconception of "get domain admin". Mitre's ATT&CK framework, provides a comprehensive breakdown of all the different tactics in a red teaming engagement and outline of all different techniques inside each tactic.

We have talked about purple teaming at great lengths in a previous post "Purple Teaming, here's what you need to know". Essentially purple teaming is the execution of Tactics, Techniques and Procedures (TTP) of a threat actor on monitored systems with the objective of identifying and bridging gaps in detection capabilities. We had a few comments on that blog post that such an activity seems daunting and requires an initial investment in both people and hardware resources.

Information security is infatuated with colours. It started with the blue boxing that allowed anyone to make free calls, then moved to black hats, white hats, grey hats (to denote attackers), then off to black box, grey box and white box testing to define the type of testing. The latest trend in colours reference red teaming, blue teaming and purple teaming. We will deal with the last one in the remainder of this blog.

Cybersecurity is beginning to take it's rightful place at the forefront of business operations, but hackers are constantly searching for work arounds. They're constantly looking for weak links to increase their chance of breaching secure targets. That's where supply chain attacks come in. 

We, as Foregenix and as a security community, have seen our fair amount of breaches publicised the last year or so. Many of them are your run-of-the-mill breach where software is out-of-date, which provides an avenue for attackers within your infrastructure; or a phishing email that is sent to a list of potential targets to act upon it. We have also seen an increase in a certain category of attacks called a supply chain attack. But, what is a supply chain attack and why should you care?