Chapter 9: Ninja 308

In the previous chapter, we discussed the fundamentals of industrial protocols and specifically the nuances of two in particular: Modbus and Ethernet/IP. We discussed and used tools that allowed us to enumerate ports and discover services running on those devices. We also used tools to traverse directories and vhosts in Chapter 7, Scanning 101, which means that we have a great foundational knowledge of both ends of the attack chain.

Now, we need to spend time looking at attacks and, most importantly, brute forcing. As exciting as it is to find a legacy service that we then spend time reverse engineering and building an exploit for, time is typically not on our side. If you discover a system such as Ignition SCADA, which we installed in Chapter 7, Scanning 101, it is fairly common for operational personnel to use simple passwords or factory defaults to access the system. Gaining access to a SCADA system as a user allows you to take over absolute control of the...

Technical requirements

For this chapter, you will need the following:

• A Kali Linux VM running with Firefox installed.
• BurpSuite Community Edition installed. Go to this link to find the latest version: https://portswigger.net/burp/communitydownload.
• A default list of SCADA equipment passwords, which can be found at this link: https://github.com/scadastrangelove/SCADAPASS/blob/master/scadapass.csv.

You can view this chapter's code in action here: https://bit.ly/3lAinwm

Installing FoxyProxy

Before diving into the installation of FoxyProxy, we should define what a proxy server is and why we would want to use one. A proxy server is a system that translates traffic from one network or device into another device or network. This is easier said than done, though: what does this mean for us and why would we care about translating traffic? A proxy server allows us to intercept all communication originating from and designated to our attacking host. This allows us to augment and change the behavior of how the request interacts with the server, such as by dropping JavaScript UI filtering and other interesting tasks. So, now that we know what a proxy server is, what is FoxyProxy? FoxyProxy is a simple but powerful proxy switch. It takes all the tediousness out of having to change the internal proxy settings of your browser. Simply add your new setting and use a switch to toggle between proxy servers and turn them on and off.

Follow these steps to install...

Running BurpSuite

In the previous section, we installed FoxyProxy and configured some settings to accommodate our BurpSuite software. In this section, we are going to utilize BurpSuite to help us understand the Request/Response actions that Ignition SCADA utilizes to perform authentication and authorization. Now, for us to proceed, we need to add BurpSuite's certificate as a trusted source; otherwise, we will be forced to acknowledge every website we've visited as an exception.

To do this, we must navigate to the IP address and port that we configured in our settings. Upon doing this, you will be presented with a BurpSuite Community Edition splash page with a CA Certificate button on the right-hand side, as shown here:

Figure 9.10 – CA Certificate location

Upon clicking this button, you will be presented with the following screen:

Figure 9.11 – Saving the CA Certificate

Select Save File and click the OK button...

Building a script for brute-forcing SCADA

I am going to assume that by reading this book, you have a relative level of proficiency or exposure to programming/bash scripting. If not, I strongly recommend brushing up on bash scripting and/or Python. Two books that I personally recommend are as follows:

• Cybersecurity Ops with bash, by Paul Troncone and Carl Albing, PhD
• Black Hat Python, by Justin Seitz

These are great resources for you to get a good idea of how and what Bash and Python can do and perform. The biggest takeaway is that by reading this book and going through these chapters, you will learn how to make these scripting/programming languages useful inside your pentesting engagement.

I prefaced this section with the preceding note as I am going to try and make this process as painless as possible. As a disclaimer, I have to say that I am a developer at best, not a programmer by any means. I am making this distinction as programmers who decide to make their...

Summary

I feel that we have covered a lot in this chapter, from installing FoxyProxy and using BurpSuite to capture and replay requests, to formulating how Ignition SCADA handles authentication and extracting that knowledge and building scriptable tools to help automate and generate tokens for brute forcing. You will definitely use each and every one of these tools and techniques throughout your career.

In the next chapter, we will be using everything we have learned up to this point to perform a pseudo mock pentest against our ICS lab.