2KKUU7ita

312
Part V: Hacking Applications
Finding storage systems on the network
To seek out storage-related vulnerabilities, you have to figure out what information
is where. The best way to get rolling is to use a port scanner and, ideally,
an all-in-one vulnerability scanner, such as QualysGuard or LanGuard.
Also, given that many storage servers have web servers built in, you can
use such tools as Acunetix Web Vulnerability Scanner and WebInspect to
uncover web-based flaws. You can use these vulnerability scanners to gain
good insight into areas that need further inspection, such as weak authentication,
DNS server name pollution, unpatched operating systems, unprotected
web servers, and so on.
A commonly overlooked storage vulnerability is that many storage systems
can be accessed from both the de-militarized zone (DMZ) segment and the
internal network segment(s). This vulnerability poses risks to both sides of
the network. Be sure to manually assess whether you can reach the DMZ from
the internal network and vice versa.
You can also perform basic file permission and share scans (as outlined in
Chapter 11) in conjunction with a text search tool to uncover sensitive information
that everyone on the network should not have access to.
Rooting out sensitive text in network files
An important authenticated test to run on your storage systems is to scan
for sensitive information stored in readily accessible text files. It’s as simple
as using a text search utility, such as FileLocator Pro or Effective File Search
(www.sowsoft.com/search.htm). Alternatively, you can use Windows
Explorer to scan for sensitive information, but it’s just too slow and cumbersome
for my liking.
You’ll be amazed at what you come across stored insecurely on users’
Windows desktops, server shares, and more, such as
✓ Employee health records
✓ Customer credit card numbers
✓ Corporate financial reports
Such sensitive information should not only be protected by good business
practices, but is also governed by state, federal, and international regulations.
Do your searches for sensitive text while you’re logged in to the local system
or domain as a regular user — not as an administrator. This will give you a
better view of regular users who have unauthorized access to sensitive files
and shares that you thought were otherwise secure. When using a basic text
search tool, such as FileLocator Pro, look for the following text strings: