Jump to content
Nytro

Introducing Armory: External Pentesting Like a Boss

Recommended Posts

Introducing Armory: External Pentesting Like a Boss

IMG_20180123_144642.jpg?d=1516741508Posted by Dan Lawson on February 04, 2019 Link 

 

 

TLDR;

We are introducing Armory, a tool that adds a database backend to dozens of popular external and discovery tools. This allows you to run the tools directly from Armory, automatically ingest the results back into the database and use the new data to supply targets for other tools.  

Why?  

Over the past few years I’ve spent a lot of time conducting some relatively large-scale external penetration tests. This ends up being a massive exercise in managing various text files, with a moderately unhealthy dose of grep, cut, sed, and sort. It gets even more interesting as you discover new domains, new IP ranges or other new assets and must start the entire process over again. 

Long story short, I realized that if I could automate handling the data, my time would be freed up for actual testing and exploitation. So, Armory was born.

What?  

Armory is written in Python. It works with both Python2 and Python3. It is composed of the main application, as well as modules and reports. Modules are wrapper scripts that run public (or private) tools using either data from the command line or from data in the database. The results of this are then either processed and imported into the database or just left in their text files for manual perusal.  

The database handles the following types of data:  

  • BaseDomains: Base domain names, mainly used in domain enumeration tools
  • Domains: All discovered domains (and subdomains)
  • IPs: IP addresses discovered
  • CIDRs: CIDRs, along with owners that these IP addresses reside in, pulled from whois data
  • ScopeCIDRs: CIDRs that are explicitly added are in scope. This is separated out from CIDRs since many times whois servers will return much larger CIDRs then may belong to a target/customer.
  • Ports: Port numbers and services, usually populated by Nmap, Nessus, or Shodan
  • Users: Users discovered via various means (leaked cred databases, LinkedIn, etc.)
  • Creds: Sets of credentials discovered

 

Additionally, with Basedomains, Domains and IPs you have two types of scoping:  

  • Active scope: Host is in scope and can have bad-touch tools run on it (i.e. nmap, gobuster, etc.).
  • Passive scope: Host isn’t directly in scope but can have enumeration tools run against it (i.e. aquatone, sublist3r, etc.). 

If something is Active Scoped, it should also be Passive Scoped. The main purpose of Passive scoping is to handle situations where you may want data ingested into the database and the data may be useful to your customers, but you do not want to actively attack those targets. Take the following scenario:

You are doing discovery and an external penetration test for a client trying to find out all of their assets. You find a few dozen random domains registered to that client but you are explicitly scoped to the subnets that they own. During the subdomain enumeration, you discover multiple development web servers hosted on Digital Ocean. Since you do not have permission to test against Digital Ocean, you don't want to actively attack it. However, this would still be valuable information for the client to receive. Therefore you can leave those hosts scoped Passive and you will not run any active tools on it. You can still generate reports later on including the passive hosts, thereby still capturing the data without breaking scope.

 

Detalii complete: https://depthsecurity.com/blog/introducing-armory-external-pentesting-like-a-boss

  • Thanks 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...