diff --git a/Document1-Network.md b/Document1-Network.md index 8826fe6..d4342ab 100644 --- a/Document1-Network.md +++ b/Document1-Network.md @@ -1,11 +1,10 @@ - | Test-ID | ISTG Reference | Name | Tools | Status | Finding | | ------- | -------------- | ---- | ----- | ------ | ------- | | DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. | | DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. | | DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. | | DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | Open | Test not yet performed. | -| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | Open | Test not yet performed. | +| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge | | DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. | | DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. | | DES-12 | ISTG-DES-INPV-001 | Insufficient Input Validation (Network API) | mitm | Open | Test not yet performed. | @@ -13,8 +12,59 @@ --- -### Example Commands +## Test Case Execution + +### DES-02 + +- **Verdict: Open** + +### DES-06 + +- **Verdict: Open** + +### DES-07 + +- **Verdict: Open** + +### DES-08 + +- **Verdict: Open** + +### DES-09 + +Some ports have already been scanned, see [initial information gathering](Document0-Initial_Information_Gathering.md). ```bash +nmap -p 1-65535 -T4 -A -v 10.12.2.30 +``` -``` \ No newline at end of file +> Zenmap's "intense scan, all TCP ports". + +The bridge is the only device with an IP network interface (the lock is BLE-only). +In our network it currently has the address `10.12.2.30`. + +> After the factory reset I had to reconfigure the bridge to determine its new IP. +> The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md). + +- **Result**: [nmap report](network/nmap/des09_bridge.nmap) + +Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext). +All other ports are filtered. + +- **Verdict: PASS** + +### DES-10 + +- **Verdict: Open** + +### DES-11 + +- **Verdict: Open** + +### DES-12 + +- **Verdict: Open** + +### DES-13 + +- **Verdict: Open** \ No newline at end of file diff --git a/network/captures/init_after_reset.pcapng b/network/captures/init_after_reset.pcapng new file mode 100644 index 0000000..c1312c5 Binary files /dev/null and b/network/captures/init_after_reset.pcapng differ diff --git a/network/nmap/des_09_bridge.nmap b/network/nmap/des_09_bridge.nmap new file mode 100644 index 0000000..2e3a290 --- /dev/null +++ b/network/nmap/des_09_bridge.nmap @@ -0,0 +1,115 @@ +Starting Nmap 7.991 ( https://nmap.org ) at 2026-11-03 09:51 +0100 +NSE: Loaded 158 scripts for scanning. +NSE: Script Pre-scanning. +Initiating NSE at 09:51 +Completed NSE at 09:51, 0.00s elapsed +Initiating NSE at 09:51 +Completed NSE at 09:51, 0.00s elapsed +Initiating NSE at 09:51 +Completed NSE at 09:51, 0.00s elapsed +Initiating Ping Scan at 09:51 +Scanning 10.12.2.30 [4 ports] +Completed Ping Scan at 09:51, 0.02s elapsed (1 total hosts) +Initiating Parallel DNS resolution of 1 host. at 09:51 +Completed Parallel DNS resolution of 1 host. at 09:51, 0.50s elapsed +Initiating SYN Stealth Scan at 09:51 +Scanning 10.12.2.30 [65535 ports] +Discovered open port 80/tcp on 10.12.2.30 +SYN Stealth Scan Timing: About 32.16% done; ETC: 09:52 (0:01:05 remaining) +SYN Stealth Scan Timing: About 57.81% done; ETC: 09:52 (0:00:49 remaining) +Completed SYN Stealth Scan at 09:52, 87.79s elapsed (65535 total ports) +Initiating Service scan at 09:52 +Scanning 1 service on 10.12.2.30 +Completed Service scan at 09:52, 12.27s elapsed (1 service on 1 host) +Initiating OS detection (try #1) against 10.12.2.30 +Retrying OS detection (try #2) against 10.12.2.30 +Initiating Traceroute at 09:52 +Completed Traceroute at 09:52, 0.02s elapsed +Initiating Parallel DNS resolution of 2 hosts. at 09:52 +Completed Parallel DNS resolution of 2 hosts. at 09:52, 0.50s elapsed +NSE: Script scanning 10.12.2.30. +Initiating NSE at 09:52 +Completed NSE at 09:52, 5.03s elapsed +Initiating NSE at 09:52 +Completed NSE at 09:52, 1.14s elapsed +Initiating NSE at 09:52 +Completed NSE at 09:52, 0.00s elapsed +Nmap scan report for 10.12.2.30 +Host is up (0.0047s latency). +Not shown: 65534 filtered tcp ports (no-response) +PORT STATE SERVICE VERSION +80/tcp open http +|_http-title: Site doesn't have a title (text/html). +| http-methods: +|_ Supported Methods: GET HEAD POST OPTIONS +| fingerprint-strings: +| DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie, X11Probe: +| HTTP/1.1 400 Bad Request +| Content-Type: text/html +| Content-Length: 57 +| Server unable to understand request due to invalid syntax +| FourOhFourRequest: +| HTTP/1.1 404 Not Found +| Content-Type: text/html +| Content-Length: 56 +| Resource /nice%20ports%2C/Tri%6Eity.txt%2ebak not found! +| GetRequest, HTTPOptions: +| HTTP/1.1 404 Not Found +| Content-Type: text/html +| Content-Length: 21 +|_ Resource / not found! +1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : +SF-Port80-TCP:V=7.991%I=7%D=11/3%Time=6AE9A0D2%P=x86_64-pc-linux-gnu%r(Get +SF:Request,5C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20text/h +SF:tml\r\nContent-Length:\x2021\r\n\r\nResource\x20/\x20not\x20found!")%r( +SF:HTTPOptions,5C,"HTTP/1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20te +SF:xt/html\r\nContent-Length:\x2021\r\n\r\nResource\x20/\x20not\x20found!" +SF:)%r(RTSPRequest,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type: +SF:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x2 +SF:0understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(X11Probe,8 +SF:2,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\n +SF:Content-Length:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20re +SF:quest\x20due\x20to\x20invalid\x20syntax")%r(FourOhFourRequest,7F,"HTTP/ +SF:1\.1\x20404\x20Not\x20Found\r\nContent-Type:\x20text/html\r\nContent-Le +SF:ngth:\x2056\r\n\r\nResource\x20/nice%20ports%2C/Tri%6Eity\.txt%2ebak\x2 +SF:0not\x20found!")%r(RPCCheck,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nC +SF:ontent-Type:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20una +SF:ble\x20to\x20understand\x20request\x20due\x20to\x20invalid\x20syntax")% +SF:r(DNSVersionBindReqTCP,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConten +SF:t-Type:\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x +SF:20to\x20understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(DNS +SF:StatusRequestTCP,82,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type +SF::\x20text/html\r\nContent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x +SF:20understand\x20request\x20due\x20to\x20invalid\x20syntax")%r(Help,82," +SF:HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nCon +SF:tent-Length:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20reque +SF:st\x20due\x20to\x20invalid\x20syntax")%r(SSLSessionReq,82,"HTTP/1\.1\x2 +SF:0400\x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nContent-Length: +SF:\x2057\r\n\r\nServer\x20unable\x20to\x20understand\x20request\x20due\x2 +SF:0to\x20invalid\x20syntax")%r(TerminalServerCookie,82,"HTTP/1\.1\x20400\ +SF:x20Bad\x20Request\r\nContent-Type:\x20text/html\r\nContent-Length:\x205 +SF:7\r\n\r\nServer\x20unable\x20to\x20understand\x20request\x20due\x20to\x +SF:20invalid\x20syntax"); +Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port +Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (90%), DD-WRT v24-sp2 (Linux 2.4.37) (90%), Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012 (90%), Linux 3.2 (88%), Microsoft Windows XP SP3 (88%), VMware Player virtual NAT device (88%), Linux 4.4 (87%) +No exact OS matches for host (test conditions non-ideal). +Network Distance: 2 hops +TCP Sequence Prediction: Difficulty=255 (Good luck!) +IP ID Sequence Generation: Randomized + +TRACEROUTE (using port 80/tcp) +HOP RTT ADDRESS +1 0.38 ms 192.168.212.2 +2 0.44 ms 10.12.2.30 + +NSE: Script Post-scanning. +Initiating NSE at 09:52 +Completed NSE at 09:52, 0.00s elapsed +Initiating NSE at 09:52 +Completed NSE at 09:52, 0.00s elapsed +Initiating NSE at 09:52 +Completed NSE at 09:52, 0.00s elapsed +Read data files from: /usr/share/nmap +OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 111.22 seconds + Raw packets sent: 131214 (5.777MB) | Rcvd: 15482 (620.606KB)