examplereport.xml

<?xml version="1.0" encoding="UTF-8"?>
<pentest_report xmlns:xi="http://www.w3.org/2001/XInclude"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" findingCode="SID"
        xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd">
        <meta>
                <title>Penetration Test Report</title>
                <targets>
                        <target>fishinabarrel.sittingduck.com</target>
                </targets>
                <activityinfo>
                        <duration>4</duration>
                        <persondays>4</persondays>
                        <planning>
                                <start>TBD</start>
                                <end>TBD</end>
                        </planning>
                        <report_due>bla</report_due>
                        <nature>something</nature>
                        <type>black-box</type>
                </activityinfo>
                <permission_parties>
                        <xi:include href="client_info.xml"/>
                </permission_parties>

                <collaborators>
                        <reviewers>
                                <reviewer>Melanie Rieback</reviewer>
                        </reviewers>
                        <approver>
                                <name>Melanie Rieback</name>
                                <bio>Melanie Rieback is a former Asst. Prof. of Computer Science from the VU,
who is also the co-founder/CEO of Radically Open Security.</bio>
                        </approver>
                        <pentesters>
                                <pentester>
                                        <name>Melanie Rieback</name>
                                        <bio>Melanie Rieback is a former Asst. Prof. of Computer Science from the VU,
                                                who is also the co-founder/CEO of Radically Open Security.</bio>
                                </pentester>
                                <pentester>
                                        <name>Aristotle</name>
                                        <bio>Greek philosopher and scientist born in the Macedonian city of Stagira, Chalkidice, on the northern periphery of Classical Greece.</bio>
                                </pentester>
                                <pentester>
                                        <name>George Boole</name>
                                        <bio>English mathematician, philosopher and logician. Works in the fields of differential equations and algebraic logic, and is now best known as the author of The Laws of Thought.</bio>
                                </pentester>
                                <pentester>
                                        <name>William of Ockham</name>
                                        <bio>English Franciscan friar and scholastic philosopher and theologian. Considered to be one of the major figures of medieval thought. At the centre of some major intellectual and political controversies.</bio>
                                </pentester>
                                <pentester>
                                        <name>Ludwig Josef Johann Wittgenstein</name>
                                        <bio>Austrian-British philosopher who works primarily in logic, the philosophy of mathematics, the philosophy of mind, and the philosophy of language.</bio>
                                </pentester>
                        </pentesters>
                </collaborators>
                <classification>Confidential</classification>
                <version_history>
                        <version date="2015-01-19T01:00:00" number="auto">
                                <v_author>Patricia Piolon</v_author>
                                <v_description>Initial draft</v_description>
                        </version>
                        <version date="2015-01-20T01:00:00" number="auto">
                                <v_author>Ernest Hemingway</v_author>
                                <v_description>Structure &amp; contents revision</v_description>
                        </version>
                        <version date="2015-01-21T01:00:00" number="auto">
                                <v_author>Patricia Piolon</v_author>
                                <v_description>Added threat levels and recommendations</v_description>
                        </version>
                        <version date="2015-01-22T01:00:00" number="auto">
                                <v_author>Patricia Piolon</v_author>
                                <v_author>JRR Tolkien</v_author>
                                <v_description>Revision</v_description>
                        </version>
                        <version date="2015-01-23T01:00:00" number="auto">
                                <v_author>Patricia Piolon</v_author>
                                <v_description>Revision</v_description>
                        </version>
                        <version date="2015-01-26T01:00:00" number="1.0">
                                <v_author>Arthur Conan Doyle</v_author>
                                <v_description>Finalizing</v_description>
                        </version>
                </version_history>
                <xi:include href="snippets/company_info.xml"/>
        </meta>

        <generate_index/>

        <section id="executiveSummary">
                <title>Executive Summary</title>
                <section id="introduction">
                        <title>Introduction</title>
                        <p>Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a
                                Penetration Test of the FishInABarrel Web Application to Radically
                                Open Security BV (hereafter “ROS”). Sitting Duck has made this
                                request to better evaluate the security of the application and to
                                identify application level vulnerabilities in order to see whether
                                the FishInABarrel Web Application is ready, security-wise, for
                                production deployment.</p>
                        <p>This report contains our findings as well as detailed explanations of
                                exactly how ROS performed the penetration test.</p>
                </section>
                <section id="scope">
                        <title>Scope of work</title>
                        <p>The scope of the Sitting Duck penetration test was limited to the
                                following target:</p>
                        <generate_targets/>
                        <p>The penetration test was carried out from a black box perspective: no
                                information regarding the system(s) tested was provided by Sitting
                                Duck or FishInABarrel, although FishInABarrel did provide ROS with
                                two test user accounts.</p>
                </section>
                <section id="objectives">
                        <title>Project objectives</title>
                        <p>The objective of the security assessment is to gain insight into the
                                security of the host and the FishInABarrel Web Application.</p>
                </section>
                <section id="timeline">
                        <title>Timeline</title>
                        <p>The FishInABarrel Security Audit took place between January 14 and
                                January 16, 2015.</p>
                </section>
                <section id="results">
                        <title>Results in a Nutshell</title>
                        <p>During this pentest, we found quite a number of different security
                                problems – Cross-site Scripting (XSS) vulnerabilities, both stored
                                and reflected, Cross-site Request Forgery (CSRF) vulnerabilities,
                                information disclosures (multiple instances), and lack of brute
                                force protection.</p>
                </section>
                <section id="findingSummary">
                        <title>Summary of Findings</title>
                        <generate_findings/>
                        <!-- generated from Findings section -->
                </section>
                <section id="recommendationSummary">
                        <title>Summary of Recommendations</title>
                        <generate_recommendations/>
                        <!-- generated from Findings section -->
                </section>
                <section id="dataSummary">
                        <title>Charts</title>
                        <section id="threatlevelpie">
                                <title>Findings by Threat Level</title>
                                <generate_piechart pieAttr="threatLevel" pieElem="finding"
                                        pieHeight="200"/>
                        </section>
                        <section id="typepie">
                                <title>Findings by Type</title>
                                <generate_piechart pieAttr="type" pieElem="finding" pieHeight="200"
                                />
                        </section>

                        <!-- generated from Findings section -->
                </section>
        </section>

        <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
                href="snippets/report/methodology.xml"/>

        <section id="recon">
                <title>Reconnaissance and Fingerprinting</title>
                <p>Through automated scans we were able to gain the following information about the
                        software and infrastructure. Detailed scan output can be found in the
                        sections below.</p>

                <table border="1">
                        <tr>
                                <th>Fingerprinted Information</th>
                        </tr>
                        <tr>
                                <td>Windows XP<br/>Microsoft IIS 6.0<br/>PHP 5.4.29<br/>jQuery
                                        1.7.2<br/>Mailserver XYZ<br/>FTPserver ABC</td>
                        </tr>
                </table>

                <section id="scans">
                        <title>Automated Scans</title>
                        <p>As part of our active reconnaissance we used the following automated
                                scans:</p>
                        <ul>
                                <li>nmap – <a href="http://nmap.org">http://nmap.org</a></li>
                                <li>skipfish -
                                        <a href="https://code.google.com/p/skipfish/">https://code.google.com/p/skipfish/</a></li>
                                <li>sqlmap – <a href="http://sqlmap.org">http://sqlmap.org</a></li>
                                <li>Wapiti –
                                        <a href="http://wapiti.sourceforge.net">http://wapiti.sourceforge.net</a></li>
                        </ul>
                        <p>Of these, only the output of nmap turned out to be useful; consequently
                                only nmap and output will be discussed in this section.</p>
                </section>
                <section id="nmap">
                        <title>nmap</title>
                        <p>Command:</p>
                        <pre>$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
fishinabarrel.sittingduck.com</pre>

                        <p>Outcome:</p>
                        <pre> Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
Initiating ARP Ping Scan against 10.10.10.1 [1 port] at 15:43
The ARP Ping Scan took 0.01s to scan 1 total hosts.
Initiating SYN Stealth Scan against fishinabarrel.sittingduck.com (10.10.10.1) [1680 ports] at 15:43
Discovered open port 22/tcp on 10.10.10.1
Discovered open port 80/tcp on 10.10.10.1
Discovered open port 8888/tcp on 10.10.10.1
Discovered open port 111/tcp on 10.10.10.1
Discovered open port 3306/tcp on 10.10.10.1
Discovered open port 957/tcp on 10.10.10.1
The SYN Stealth Scan took 0.30s to scan 1680 total ports.
Host fishinabarrel.sittingduck.com (10.10.10.1) appears to be up ... good.
Interesting ports on fishinabarrel.sittingduck.com (10.10.10.1):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
4000/tcp open  dangerous service

Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>

                        <p>The scan revealed a very large number of open services on this machine,
                                which greatly increases the attack surface; see <a href="#f2"/> for
                                more information on the security risk.</p>

                </section>

        </section>

        <section id="findings">
                <title>Findings</title>

                <p>We have identified the following issues:</p>

                <finding id="f1" threatLevel="Moderate" type="Information Leak">
                        <title>PHPInfo Disclosure</title>
                        <description>
                                <p>The phpinfo() function of the PHP language is readable, resulting
                                        in a listing of all the runtime information of the
                                        environment, thus disclosing potentially valuable
                                        information to attackers.</p>
                        </description>
                        <technicaldescription>
                                <p>This is where the good stuff goes. We give a detailed technical
                                        description of the problem.</p>
                                <p>Illustrative picture of an evil hacker pondering dark deeds:</p>
                                <img height="10" src="../graphics/screenshot.jpg"/>
                        </technicaldescription>
                        <impact>
                                <p>This is where we explain how the sh*t is hitting the fan,
                                        exactly.</p>
                        </impact>
                        <recommendation>
                                <p>Here is where we write some tips to solve the problem.</p>
                        </recommendation>
                </finding>

                <finding id="f2" threatLevel="High" type="XSS">
                        <title>A terrible XSS issue</title>
                        <description>
                                <p>A general description of the problem.</p>
                        </description>
                        <technicaldescription>
                                <p>This is we go into great detail about the vulnerability.</p>
                        </technicaldescription>
                        <impact>
                                <p>This is where we explain why this vulnerability is a problem.</p>
                        </impact>
                        <recommendation>
                                <p>This is where we solve everything and the sun starts shining
                                        again.</p>
                        </recommendation>
                </finding>

                <finding id="f3" threatLevel="Low" type="XSS">
                        <title>A not quite so terrible XSS issue</title>
                        <description>
                                <p>A description of the problem.</p>
                        </description>
                        <technicaldescription>
                                <p>Vulnerability described in detail.</p>
                        </technicaldescription>
                        <impact>
                                <p>Impact on security.</p>
                        </impact>
                        <recommendation>
                                <p>A ready solution.</p>
                        </recommendation>
                </finding>
        </section>

        <section id="nonFindings">
                <title>Non-Findings</title>
                <p>In this section we list some of the things that were tried but turned out to be
                        dead ends.</p>

                <non-finding id="ftp">
                        <title>FTP</title>
                        <p>The server was running FTPserver ABC, the most recent version of this
                                particular piece of software. Anonymous login was turned off and no
                                relevant vulnerabilities or exploits were found.</p>
                </non-finding>
                <non-finding id="mail">
                        <title>Mail Server</title>
                        <p>The server was running Mailserver XYZ, the most recent version of this
                                particular piece of software. No relevant vulnerabilities or
                                exploits were found. </p>
                </non-finding>
                <non-finding id="sqlInjection">
                        <title>SQL Code Injection</title>
                        <p>The following parameters are not vulnerable to SQL injection. </p>
                        <p>All parameters have been checked manually.</p>
                        <pre>-file1.php
-file2.php
-file3.php
</pre>
                </non-finding>
                <non-finding id="heartbleed">
                        <title>Heartbleed</title>
                        <p>System was not vulnerable to heartbleed.</p>
                </non-finding>
                <non-finding id="sp2">
                        <title>Windows XP</title>
                        <p>The host is running Windows XP. As we all know, Windows XP is
                                bulletproof.</p>
                </non-finding>
        </section>
        <section id="conclusion">
                <title>Conclusion</title>
                <p>In the course of this penetration test, we have demonstrated that the
                        FishInABarrel Web Application faces a range of security issues which makes
                        it vulnerable to a number of different attacks. Vulnerabilities found
                        included: cross-site scripting (both stored and reflected), cross-site
                        request forgery, information disclosure and lack of brute force
                        protection.</p>
                <p>Our conclusion is that there are a number of things that FishInABarrel BV has to
                        fix before Sitting Duck should use their software. A number of the security
                        issues highlighted in this report have fairly simple solutions, but these
                        should nevertheless be fixed before use of the FishInABarrel Web App
                        continues.</p>
                <p>We finally want to emphasize that security is a process – and this penetration
                        test is just a one-time snapshot. Security posture must be continuously
                        evaluated and improved. Regular audits and ongoing improvements are
                        essential in order to maintain control of your corporate information
                        security. We hope that this pentest report (and the detailed explanations of
                        our findings) will contribute meaningfully towards that end. Don't hesitate
                        to let us know if you have any further questions or need further
                        clarification of anything in this report.</p>
        </section>
        <appendix id="testteam">
                <title>Testing team</title>
                <generate_testteam/>
        </appendix>
</pentest_report>