## Breach Testing Report

### Introduction

This report contains observations and recommendations from our penetration test, which focused on the tax card web application and the IIS web server that belongs to the network. The objective of the test was to identify possible security issues and provide clear instructions for resolving these problems.

It is important to note that this is not a comprehensive security test in which all possible ways to improve the overall security of information systems were attempted to be invented, but a penetration test in which an attempt was made to find a way to take control of the Windows network and only report the most important vulnerabilities found along the attack path.

### Observations and recommendations

- **The tax card web application did not include authentication**. We recommend that you implement a strong authentication mechanism that requires users to log in with company credentials or with verified two-factor authentication (e.g., user password and verification code sent via text message). This way, you can ensure that only authorized and authenticated users can access the tax card application.
- **A file download vulnerability was detected in the Verokorttiweb application**. We recommend fixing this vulnerability immediately. One way to do this is to restrict file downloads in the application to allowed file types, such as PDF files or images. Additionally, consider using cloud storage containers (e.g. Amazon S3, Microsoft Azure Blob Storage) or using binary data records in databases to store files instead of storing them directly in the file system. This helps prevent file download attacks and improves security.
- **The root folder of the IIS web server was writable**. We recommend changing it to be non-writable, as a writable root folder can lead to malicious file downloads and other security issues. Ensure that only necessary users and processes can modify and save files in the web server's root folder.
- **The IIS web server was functioning as the SYSTEM user**. We recommend changing it to operate as the IIS user in order to restrict privileges. The SYSTEM user has extensive privileges, and using it on a web server can expose it to attacks and enable broader damage. Ensure that the web service is executed only with necessary privileges, if it requires file system permissions or other special privileges.
- **Both servers were without Windows Defender protection**. We recommend enabling Windows Defender on both servers. Windows Defender is Microsoft's built-in security program that provides protection against malware and other cybersecurity threats. Make sure that Windows Defender is updated and that its automatic updates are enabled so that it can detect and combat the latest security issues.
- **Both servers unnecessarily allowed the attacker's virtual machine to connect to SMB, RPC, and HTTP ports**. We recommend improving firewall rules so that only necessary traffic types and IP addresses are allowed. Close unnecessary ports and protocols and restrict traffic to only those connections that are essential for the services to function.
- **The password of the same local administrator was reused for the entire domain**. We recommend using unique local administrator passwords on each server and computer. Do not use the same password in more than one place, as this can expose the entire domain to a wider attack if the password is leaked or revealed from one server.
- **Domain allows remote login with local accounts. This was fixed by using the** "Prevent access to this computer from the network" group policy to prevent remote login for local accounts. This helps prevent potential remote management-related attacks and reinforces the security of the domain.

### Summary

Based on this penetration test, several security risks were detected in the tax card web application and IIS web server. It is important that these vulnerabilities are fixed as soon as possible by following the recommendations above. By implementing these corrective measures, you can significantly improve the level of cybersecurity.


Scenario 1 - Break Test Report

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

Scenario 1 - Break Test Report

Learn to hack — start here