Case 2

A client meticulously designed his network providing access to different users: employees, guest and
handheld wireless scanners. He granted the employees an access to internal systems and applications but
needs to authenticate to the wireless network first using two factor devices. He wanted Mr Santos to
validate his network design and implementation. Mr Santos who was a computer security consultant
needs to administer wireless penetration test. The legacy handheld wireless scanners were only allowed
to access limited number of needed resources using WPA with pre-shared key authentication. The guest
users were restricted to internet access only over an open wireless network. Mr Santos’ job was to break
in to the network and to demonstrate the weakness to the costumer. Describe methods that Mr Santos
can do to get this job done?

ANALYSIS

Mr Santos will do the Gray box penetration test that is very useful in testing web applications. The
main objective of this test is to find the vulnerabilities within the application. It is a combination of white
and black box penetration test.

The first method that Mr Santos will apply to demonstrate the weakness to the costumer is the
Man in the middle attack (MitM). It is an attack that is used by the attackers to intercepts the connection
of two parties. He/she can secretly intrude to know the traffic travelling of the two parties. This attack can
steal the personal information of the user including the log in credentials and can sabotage the
communications to corrupt data.

Second, Mr Santos will apply the method of Denial of service (DOS) is an attack where the hackers
will attempt to prevent authentic users in accessing the service. In this attack, the hacker will notify the
user asking the network or server to authenticate request that have invalid return addresses. The network
or server is unable to find the return address of the hacker in sending the authentication approval, causing
the server to wait before interrupting the connection. When the server closes the connection, the
attacker sends more authentication messages with invalid return addresses. So the process of
authentication and server wait will begin again, keeping the network or server busy. That will
cause the following problems.

 Ineffective services
 Inaccessible services
 Interruption of network traffic
 Connection interference

References

Gilberto Najera-Gutierrez & Juned Ahmed Ansari (September 2013). Web Penetration Testing with Kali
Linux: Intro to Penetration Testing and Proactive security testing, 8-10, Birmingham UK.

Roger Grimes.”11 ways to Defeat Two way Factor Authentication.”

Retrieved from: https://www.knowbe4.com/hubfs/KB4-11WaystoDefeat2FA-RogerGrimes.pdf