June 24, 2009

Last Updated on January 15, 2024

On first blush providing credentials to a tiger team conducting penetration tests sounds like giving the fox a key to the chicken coop.  However, there are many cases where it can provide significant value.  For example; you want to assess whether an authenticated user (network or application) can escalate privilege.  Another great place to use credentials is during the Vulnerability Assessment phase of a network Penetration Test.
A network vulnerability scan is essentially a “best effort”.  The three predominant challenges to Vulnerability Assessments are;

  • The scanner assumes that the host it is interrogating is “trustworthy” (the level of trust is usually adjustable) and bases its assumptions as to the services, versions, and vulnerabilities on the answers it receives. The false positives we are all familiar with are assumptions gone awry.
  • The scanner cannot directly assess many important system settings, for example the password policies’ complexity setting or the system audit policies event logging settings.
  • Packet filtering “devices” in the network path between the scanner and the device (e.g., firewalls, load balancers, routers, network IPs, Host-based IPs) may respond on behalf of the device, providing incorrect data and a false sense of security.

The key benefit to running the vulnerability scan with administrative level credentials is that it allows the scanner to directly assess the system’s configuration rather than guess it based on the answers it received.  This not only provides a greater quantity of, and more accurate, information, but it opens up the possibility of using the vulnerability assessment as a compliance check against relevant standards (e.g., PCI, Center for Internet Security, or organization specific).  The last benefit is that a vulnerability  scan with credentials avoids most of the problems encountered with packet filtering devices in the path as the scan is essentially local and authorized.
In a future blog we will look at one of the other unique benefits of running a credentialed scan – running a content scan on the hosts at the same time to determine whether sensitive data (e.g., credit card, medical, identity theft, intellectual property) exists on the systems in violation of policy.