Demonstration and Evaluation of Penetration Testing Tools - MN623

This report details a penetration testing exercise, focusing on the use of tools like John the Ripper and RainbowCrack for password cracking, and nmap and Metasploit for vulnerability assessment and exploitation. The process begins with information gathering using nmap to identify open ports and running services on a target web server. Vulnerabilities are then identified, leading to the exploitation of an FTP service using the Metasploit framework. The report compares John the Ripper and RainbowCrack, highlighting their features, strengths, and weaknesses, including GPU utilization by John the Ripper. It concludes that John the Ripper is better and easier to use, while RainbowCrack excels when a large amount of hash data is available. The report also discusses the vulnerabilities found in the web application and provides recommendations for improving security, such as updating services, implementing a web application firewall, and disabling unused ports and services.

Slide 1
• John the Ripper is a free password cracking software tool. It is one of the most popular
password testing and breaking programs as it combines a number of password crackers into
one package.
John the ripper is a free password cracking tool mostly used in linux. It is used by penetration testers
for password breaking.
It has wide range of features like identifying the hash type and breaking it.
• RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-
memory trade-off technique. It crack hashes with rainbow tables.
Rainbow crack is a good tool which breaks the hashes based on the input file.
Slide 2
• Initial stage information gathering is performed using nmap tool.
• Information gathering is performed on the given web server for checking the open ports on
the server using nmap.
• Then the services running on the ports with version is identified using the same tool.
• Then vulnerability’s are identified in second stage.
• We used google for identifying the type of vulnerabilities available on the services.
• We found many vulnerabilities on the services hosted b the server.
• We felt attacking ftp server will bring us more result with stable connection.
• Then exploitation is undergone in third stage.
• We have used Metasploit framework for exploiting the ftp service hosted by the server.
• Finally password breaking was performed using both the tools
Slide 3
 Recently john the ripper is upgraded in such a way that it performs attack using GPU-
graphical process unit  graphic cards.
 Rainbow attack doesn’t use the GPU.
 So this attack performed by john the ripper is much faster as GPU processing speed is much
faster than the CPU.
 Rainbow crack is also fast as it checks the hashes resent in the loaded file.
 John the ripper automatically identifies the hash type. So, there is no use of any other tools
for identifying the hash value.
 We need to specify the hash type for this Rainbow crack. It can not identify the hash value
by its own.
 We don’t load any hashes for checking in John the ripper tool.
 We load all the hashes which are to be checked for using rainbowcrack tool.
 We can use bruteforce attack using john the ripper.
 Where rainbowcrack doesn’t support any of those type.
Slide 4

From the above Comparison we can say that
for password breaking tool prospective it is clear that john the ripper is better and easier to use.
We cannot guarantee to identify the password. Using john the ripper.
But as the performance point of view rainbow cracker attack takes the first place if a huge large
amount of hash data is available. We can guarantee that we can identify the password hash if that
hash is present in the database.
Slide 5
• The web application hosted had a lot vulnerabilities.
• It has a lot of vulnerabilities like sql injection and brute force and many more, at the server
point of view it has a lot of services which are hugely exploitable.
• ftp protocol led us to take control of whole web server.
• ftp is one of the most vulnerable service on the sever, it easily allowed us to take a back door
and get control of it.
• All the services used by the web server are out dated.
• Those services should not be used any more.
• There are services whose services were stopped long back but they were still used by the
client.
Slide 6
 All the services should be updated.
 A web application firewall should be used.
 The unwanted services should be removed.
 The unused ports should be disabled.