Gray Box Pentesting for a US Nonprofit

Summary

A US nonprofit that advocates for a more equitable and efficient public-benefits system helps citizens access public benefits through a web application with an eligibility self-screening tool. To verify the security of its beneficiaries' personal health information (PHI) and personally identifiable information (PII), the organization engaged INNERLUXES to test its intranet and benefits-eligibility app and check employee security awareness. In ten days, INNERLUXES delivered a comprehensive report and confirmed the fixes with a retest.

About the Customer

The Customer is a nonprofit organization advocating for a more equitable and efficient benefits system in the US, supporting large numbers of households in need of healthcare, food, and shelter.

The Challenge

The Customer assists American citizens with accessing public benefits and has a web application with a self-screening tool that helps individuals find public benefit programs they may be eligible for. The organization was looking for an experienced cybersecurity vendor to verify the security of the PHI and PII of its beneficiaries, and enlisted INNERLUXES to test its intranet and benefits-eligibility app and check employee security awareness.

The Solution

Vulnerability assessment and penetration testing

INNERLUXES's pentesters started the vulnerability assessment with automated scanning of the target public-facing app and private network, then manually verified the detected weaknesses to eliminate false positives.

The Customer provided user credentials to enable gray-box pentesting. The pentesters evaluated the potential impact of the verified weaknesses using techniques such as input-data manipulation and access-control checks. The testing was based on the PTES, OWASP Web Security Testing Guide, and NIST 800-115 methodologies. Key findings included:

• A network device with the Cisco Smart Install feature enabled — which by design enforces no authentication. Without appropriate controls, a remote attacker could steal configuration files with password hashes and encryption keys, or force the device to reload, causing a denial-of-service (DoS) condition.
• Another internal device using default credentials, letting the pentesters guess the login details and access the device's control interface.
• Lack of brute-force protection in the web app — the pentesters could perform 3,400+ login attempts without any anti-brute-force mechanism such as account lockout or IP blocking.

To fix these and other issues, INNERLUXES recommended:

• Applying access control lists (ACLs) so only the Smart Install director has a TCP connection to Smart Install clients, and configuring Cisco Control Plane Policing to protect the routing protocol from unnecessary traffic.
• Ensuring no devices use default credentials and implementing a strong password policy.
• Implementing rate limiting, brute-force protection, and an account lockout or captcha mechanism.
• Configuring a High or FIPS-compliant encryption level for Remote Desktop Protocol (RDP) to prevent eavesdropping on Terminal Services communications.
• Updating outdated and vulnerable software to the latest versions.

Social engineering testing

INNERLUXES's pentesters ran several social-engineering scenarios against 325 of the Customer's employee email addresses, sending emails with malicious URLs, fake forms, and executable files. Most users stayed vigilant, but eight employees followed the malicious link and one submitted their credentials via a fake form — so INNERLUXES recommended providing security-awareness training.

The Results

• In ten days, INNERLUXES performed security testing of 30+ IP addresses, 3 URLs, and 325 email addresses.
• The Customer received a comprehensive report detailing the identified vulnerabilities, their potential impact, and actionable remediation guidelines.
• Using INNERLUXES's remediation advice, the Customer enhanced the protection of its beneficiaries' PHI and PII, which the pentesters confirmed during a retest.

Technologies and Tools

Metasploit, Nessus, Burp Suite, Acunetix, Nmap, tcpdump, SQLMap, Zed Attack Proxy (ZAP), JWT_Tool, SMBMap, Responder, Impacket, Invoke-Obfuscation, enum4linux, snmp-check, DNSRecon, NBTscan, Printer Exploitation Toolkit, Remote Server Administration Tools (RSAT), PHP, Bash, Python, PowerShell.