|
|
Tools for application server penetration testing
Vašíček, Tomáš ; Šeda, Pavel (referee) ; Martinásek, Zdeněk (advisor)
This thesis explores the field of penetration testing of application protocols. The thesis introduces the application protocols FTP, SSH, SMTP, POP3 and IMAP and explores their possible vulnerabilities. Information about vulnerabilities is obtained from publicly available collections such as HackTricks and The Hacker Recipes, but also by studying the RFC documents of each protocol. Based on the vulnerabilities found, penetration testing checklists are constructed to provide guidance through the process of testing a given protocol. The main contribution of the work is the development of a modular automated tool ptapptest and another auxiliary tool ptntlmauth, which are used for penetration testing of the mentioned application protocols. Finally, the thesis concludes by testing the ptapptest tool on application servers discovered using the Shodan search engine.
|
|
|
Interactive graphical environment for visualization of penetration testing
Klampár, Roman ; Martinásek, Zdeněk (referee) ; Lieskovan, Tomáš (advisor)
This thesis deals with the design, development and implementation of an interactive graphical environment to support penetration testing. The theoretical part describes the basic concepts of penetration testing, introduces the Penterep platform and the technologies used in the development, such as Vue 3, TypeScript and D3.js. The practical part focuses on the design of the data structure and architecture, as well as the implementation of the network graph with interactivity including drag and drop, zoom and pan. The implemented solution allows manipulation of the graph and its data, making it possible to change the graph structure. The thesis resulted in a package designed for flexible integration into existing projects such as the Penterep platform, into which the solution was also integrated. The thesis also analyses the performance of graph rendering using HTML5 Canvas and SVG. Rendering time, FPS and memory usage for different sizes of graphs were monitored during testing. The results show that HTML5 Canvas achieves better performance for larger amount of data. The aim of this work is to increase the efficiency of penetration testing, reduce the time consumption and simplify the necessary processes compared to the currently available tools.
|
|
|
Tools for Wi-Fi and IPv4 penetration testing
Jančík, David ; Lieskovan, Tomáš (referee) ; Martinásek, Zdeněk (advisor)
The master thesis deals with the design and implementation of support tools and methodologies for security penetration testing of Wi-Fi networks and IPv4 network infrastructure. The theoretical part covers penetration testing itself, approaches, phases, and types. It also describes the development of Wi-Fi networks and their security protocols. Various penetration tools for Wi-Fi networks and types of attacks are introduced. In the last theoretical part, a basic overview of IPv4 and tools for IPv4 scanning is provided. Initially, in the practical part, a proprietary methodology for Wi-Fi networks and IPv4 and tools for penetration testing are proposed. The Python programming language is defined, along with the output of various tools for the Penterep platform. A review of tools from the theoretical part is conducted to select suitable tools for new support tools. The implementation of penetration tools is based on the design diagram created. The conclusion summarizes the results achieved and suggestions for further expansion of tools for Wi-Fi and IPv4. The result of this thesis is the implementation of support tools and the design diagram for Wi-Fi networks and IPv4.
|
|
|
Analyzer of web application
Vašíček, Tomáš ; Lieskovan, Tomáš (referee) ; Martinásek, Zdeněk (advisor)
This work focuses on the identification of technologies in web applications. The main goal is to develop a software tool for basic analysis of web applications that aims to identify the application's operating system, web server, and programming language. This work further aims to allow the developed tool to be integrated into the Penterep platform as an extension module. The theoretical part of this work is an introduction into the area of web application analysis with emphasis on describing and manually demonstrating the existing identification methods. The practical part presents the design, implementation and testing of the developed tool. This part also includes a description of an experimental environment that was built using the Docker platform.
|
|
|
Web platform to support penetration testing
Lazarov, Willi ; Kuchař, Karel (referee) ; Martinásek, Zdeněk (advisor)
The bachelor thesis deals with the design, development, and implementation of a web platform to support penetration testing. The theoretical part of the thesis is devoted to the description of penetration testing and vulnerability severity assessment. Next, the technologies used in the development of the final solution are described. The practical part describes the gradual solution of partial requirements of the web platform. The individual chapters summarize the problem, design, and implementation of the solution. The practical part starts with the design of a highly scalable model that addresses the main problem of the assignment of this thesis. Next, the design of the platform, its embedding in the proposed model, and the development of a modular web application. Furthermore, the actual development of the application part is described, specifically, its connection with the relational database, tools for automated penetration testing, and the report generator. In the next chapter, the testing of the platform in a production environment is described. The last chapter compares relevant tools for penetration testing. The result of the work is a web platform with the main purpose of increasing the effect of penetration testing to such an extent that the time, complexity, and work required to successfully complete the entire test will be considerably lower than using currently relevant available tools.
|
|
|
Tool to support DoS testing
Kamenář, Filip ; Gerlich, Tomáš (referee) ; Martinásek, Zdeněk (advisor)
The master thesis deals with denial of service attacks and their implementation in own application, called ptdos, that allows testing of web applications using the implemented attacks. Ptdos is also capable of monitoring the progress of testing as well as its evaluation. In the theoretical part of the thesis, the basic concepts are defined, the classification of attacks into categories is described and the individual attacks are discussed in detail in order to explain how the denial of service should occur in the context of an attack. The practical part of the thesis describes the design of the ptdos application architecture and its subsequent development, including a description of the implementation of all the selected attacks. The last part of the thesis is the testing of the application, which includes the creation of a test network and the analysis of all implemented attacks using different scenarios.
|
|
|
PTDOS:Tool to support DoS testing
Kamenář, Filip ; Martinásek, Zdeněk
Nowadays, cyber attacks are a common part of our lives. Targets of attacks are various, such as obtaining sensitive data, network infiltration, system sabotage or denial of service (DoS). This paper deals with the attacks that target denial of service. The main goal is the custom design and development of the ptdos application, which allows testing of the resilience of network infrastructure and web servers against these types of cyber attacks. The application will be freely available and will contain various types of attacks (both flood and logic) to sufficiently test the system. The purpose of the work is to create a quality and simple tool to enhance cyber security.
|
|
|
Web platform to support penetration testing
Lazarov, Willi ; Kuchař, Karel (referee) ; Martinásek, Zdeněk (advisor)
The bachelor thesis deals with the design, development, and implementation of a web platform to support penetration testing. The theoretical part of the thesis is devoted to the description of penetration testing and vulnerability severity assessment. Next, the technologies used in the development of the final solution are described. The practical part describes the gradual solution of partial requirements of the web platform. The individual chapters summarize the problem, design, and implementation of the solution. The practical part starts with the design of a highly scalable model that addresses the main problem of the assignment of this thesis. Next, the design of the platform, its embedding in the proposed model, and the development of a modular web application. Furthermore, the actual development of the application part is described, specifically, its connection with the relational database, tools for automated penetration testing, and the report generator. In the next chapter, the testing of the platform in a production environment is described. The last chapter compares relevant tools for penetration testing. The result of the work is a web platform with the main purpose of increasing the effect of penetration testing to such an extent that the time, complexity, and work required to successfully complete the entire test will be considerably lower than using currently relevant available tools.
|
|
|
Analyzer of web application
Vašíček, Tomáš ; Lieskovan, Tomáš (referee) ; Martinásek, Zdeněk (advisor)
This work focuses on the identification of technologies in web applications. The main goal is to develop a software tool for basic analysis of web applications that aims to identify the application's operating system, web server, and programming language. This work further aims to allow the developed tool to be integrated into the Penterep platform as an extension module. The theoretical part of this work is an introduction into the area of web application analysis with emphasis on describing and manually demonstrating the existing identification methods. The practical part presents the design, implementation and testing of the developed tool. This part also includes a description of an experimental environment that was built using the Docker platform.
|
|
|
Tool to support DoS testing
Kamenář, Filip ; Gerlich, Tomáš (referee) ; Martinásek, Zdeněk (advisor)
The master thesis deals with denial of service attacks and their implementation in own application, called ptdos, that allows testing of web applications using the implemented attacks. Ptdos is also capable of monitoring the progress of testing as well as its evaluation. In the theoretical part of the thesis, the basic concepts are defined, the classification of attacks into categories is described and the individual attacks are discussed in detail in order to explain how the denial of service should occur in the context of an attack. The practical part of the thesis describes the design of the ptdos application architecture and its subsequent development, including a description of the implementation of all the selected attacks. The last part of the thesis is the testing of the application, which includes the creation of a test network and the analysis of all implemented attacks using different scenarios.
|
guest ::
