Top 10 Critical Network Pentest Findings IT Teams Overlook

A security tool has already discovered the alarming fact that many companies still have serious security flaws that hackers may readily take advantage of after doing more than 10,000 automated internal network penetration tests last year.

Businesses frequently believe that SIEMs, firewalls, and endpoint security are sufficient to maintain their security. When tested, however, how successful are these defenses? Craw Security’s automated network pentesting solutions delivered by a highly experienced team of world-class penetration testers with many years of quality work experience can help with that.  Our Red Team of Penetration Testers, which mimics actual attack situations, assists enterprises in identifying exploitable weaknesses before cyber criminals do.

These exploits aren’t sophisticated zero-day ones. Attackers frequently use these setup errors, weak passwords, and unpatched vulnerabilities to enter networks, move laterally, and elevate privileges. The breakdown of these risks is as follows:

50% stem from misconfigurations	Default configurations, lax access restrictions, and neglected security guidelines.
30% are due to missing patches	Systems that are not patched, expose them to known vulnerabilities.
20% involve weak passwords	Services that operate without adequate authentication make it simple for hackers to gain access.

The 10 Most Critical Network Pentest Findings or Security Threats will be discussed in this article, along with their definitions, the reasons behind their hazard, and solutions to prevent more issues. We’ll begin with the least frequent problem and go to the most frequent one we’ve observed in thousands of our penetration test examinations over several IT infrastructures of numerous organizations. It’s only a matter of time until attackers discover these vulnerabilities in your environment.

10. Password Deficiencies – Redis Service

CVSS3: 9.9

% of occurrence: 1.3%

• What is it:

Redis is an in-memory key-value data store that is frequently used for real-time analytics, message brokering, and caching.  Redis does not require authentication by default, enabling clients to connect without login information.

• Security Impact:

Depending on the Redis service’s abilities and the authorizations that are linked to the compromised user account, an intruder may be able gain entry to sensitive information kept in the server’s databases and potentially escalate privileges to obtain system-level access. Unauthorized data alteration, data exfiltration, or other system exploitation could result from this.

• Recommendation:

Configuring the Redis service requires a strong password that complies with the organization’s password policy, which is essential.  A strong password should meet the following requirements:

• A minimum of twelve characters
• Not readily guessed, for example, not in a dictionary
• combination of special characters, numbers, capital and lowercase letters, and/or
• Checkable against databases of known compromised passwords (such as haveibeenpwned.com)

By creating complicated passwords that are challenging to recover, even if the password hash is discovered through a breach, using a password manager can also improve security.

9. Firebird Servers Accept Default Credentials

CVSS3: 9.0

% of occurrence: 1.4%

• What is it:

In order to preserve security, default credentials—which are sometimes hard-coded usernames and passwords meant for initial setup—should be changed as soon as possible.  This problem occurs when default settings are missed during setup or when systems are deployed without reconfiguration.

• Security Impact:

Relying on Firebird servers’ default credentials may result in illegal access, giving hackers the opportunity to authenticate and scout the compromised networks.  They might list files or change system settings, creating opportunities for more abuse.  The attacker may be able to read or alter private database data if they figure out where Firebird database files are stored.  An attacker’s influence over the remote host can also be increased by manipulating specific versions of Firebird to carry out system commands.

• Recommendation:

Changing the Firebird servers’ default credentials with the GSEC tool is crucial to reducing this issue.  Security can be further improved by putting in place a process for routine credential audits and making sure that all default settings are changed prior to deployment.  Early detection of possible exploitations can be facilitated by regularly checking server access logs for unauthorized attempts and turning on notifications for questionable activity.

8. Microsoft Windows RCE (BlueKeep)

CVSS3: 9.8

% of occurrence: 4.4%

• What is it:

BlueKeep, classified as CVE-2019-0708, is a remote code execution flaw in Microsoft’s Remote Desktop Protocol (RDP).

Security Impact:

An attacker can take total control of the compromised machine or systems by taking advantage of the BlueKeep vulnerability.  This degree of access could make it easier to launch additional assaults on the infrastructure of the company, including possibly extracting private information like passwords and hashes.  Furthermore, by moving laterally via the network, the attacker could compromise more systems and services.  Because of the nature of the vulnerability, the attacker’s task is made easier, and the potential damage to the organization is increased because no specific privileges or authenticated access are needed to carry out the attack.

• Recommendation:

To lessen the BlueKeep vulnerability, it is imperative that any pertinent security upgrades be applied to the impacted system or systems as soon as possible. To determine the reasons for the lack of timely updates, organizations should thoroughly examine their patch management procedures. The organization’s digital environment must be protected immediately due to the vulnerability’s exploitability and potential to seriously compromise systems.

7. Microsoft Windows RCE (EternalBlue)

CVSS3: 9.8

% of occurrence: 4.5%

• What is it:

A remote code execution flaw in the Microsoft Server Message Block (SMBv1) protocol is known as EternalBlue.  It enables unauthorized access and the execution of arbitrary code with system-level privileges by allowing an attacker to submit specially constructed packets to a system that is vulnerable.

• Security Impact:

An attacker can obtain complete administrative access to the compromised system or systems by taking advantage of the EternalBlue vulnerability. Further hostile activities within the company’s network, including the extraction of password hashes and cleartext passwords, as well as lateral migration to other systems, may be made easier by this access. Crucially, the attacker can launch reconnaissance and other attacks with little additional work because this vulnerability does not need them to raise privileges on the compromised system.

• Recommendation:

Applying the necessary security fixes to all impacted systems as soon as possible is essential to reducing the risk related to the EternalBlue vulnerability.  To find any flaws that caused these systems to remain unpatched, a comprehensive evaluation of the company’s patch management procedures should also be carried out.  Immediate remedial efforts are essential due to the high risk and frequency of exploitation of this vulnerability.

6. IPMI Authentication Bypass

CVSS3: 10.0

% of occurrence: 15.7%

• What is it:

One essential piece of hardware that network managers use for centralized server control is the Intelligent Platform Management Interface (IPMI). There may be some flaws in the setup of the server or servers that have IPMI installed that let hackers remotely get around the authentication system. As a result, password hashes are extracted, and in situations where weak or default hashing techniques are used, attackers may be able to retrieve the cleartext passwords.

• Security Impact:

Because an attacker may use this information to obtain illegal remote access to sensitive services like Secure Shell (SSH), Telnet, or web-based interfaces, the ability to extract cleartext passwords poses a serious security concern. Such unapproved access might make it possible to alter configurations, which would have a detrimental effect on the availability and consistency of services offered by the compromised server or servers.

• Recommendation:

Since there isn’t a fix for this vulnerability, one or more of the following mitigation techniques must be used:

Only allow authorized systems that need administrative features to have IPMI access.

• On the server or servers that are not required for business operations, turn off IPMI service.
• To improve security, replace the default administrator password or passwords with secure, complicated ones.
• Use secure communication methods, like SSH and HTTPS, to reduce the possibility of man-in-the-middle attacks that might reveal private information.

5. Outdated Microsoft Windows Systems

CVSS3: 9.8

% of occurrence: 24.9%

• What is it:

Because Microsoft no longer provides essential updates for outdated Windows systems, they pose serious security threats. These systems could not have the necessary security patches installed to fix known vulnerabilities, which makes them more vulnerable to attack. Furthermore, the lack of upgrades may cause problems with contemporary security tools and software, which would further weaken the defenses of the system or systems. Attacks like virus dissemination, data exfiltration, and unauthorized access can frequently take use of flaws in out-of-date systems.

• Security Impact:

An attacker could obtain unauthorized access to the compromised system or systems and expose private information and resources if an old Microsoft Windows system is exploited.  Additionally, because systems inside the same network may have identical setups, an attacker could use the compromised system or systems as a starting point to migrate laterally, compromising more systems and expanding the breach’s entire footprint.

• Recommendation:

It is strongly recommended to replace outdated Microsoft Windows versions with the latest supported operating systems. This process should begin with a thorough inventory of all systems to identify and prioritize outdated versions, followed by a structured upgrade plan. To maintain security integrity, ensure all systems receive regular patches and updates.

4. IPv6 DNS Spoofing

CVSS3: 10.0

% of occurrence: 49.9%

• What is it:

A rogue DHCPv6 server might be introduced into the internal network infrastructure, which would increase the danger of IPv6 DNS spoofing. IPv6-capable clients are likely to get their IP address configurations from any accessible DHCPv6 server since Microsoft Windows systems favor IPv6 over IPv4.

• Security Impact:

By rerouting IPv6-enabled clients to use the attacker’s system as their DNS server, a rogue DHCPv6 server can be used to influence DNS requests. Serious repercussions could result from this capacity, including the illegal acquisition of private information like user credentials. The victim’s system may unintentionally interact with malicious services running on the attacker’s infrastructure, including platforms like SMB, HTTP, RDP, and MSSQL, if all DNS requests resolve to the attacker’s server.

• Recommendation:

The following tactics are advised in order to reduce the dangers related to IPv6 DNS spoofing, with a focus on coordinating each strategy with organizational operations and doing extensive testing before putting it into practice:

Manage Rogue DHCP at the Network Layer	To manage unauthorized DHCP servers and reduce the possibility of DNS spoofing attacks, include capabilities like DHCP authentication, DHCP snooping, and Rogue DHCP detection on network switches and firewalls.
Prefer IPv4 over IPv6	Use Group Policy Preferences (GPPs) or Group Policy Objects (GPOs) to implement registry changes that set up Windows computers to prioritize IPv4 over IPv6. It is crucial to remember that this strategy won’t stop assaults on non-Windows devices.
Disable IPv6	Disabling IPv6 for Microsoft Windows systems is generally not advised, although it can be a last resort if careful testing guarantees that there won’t be any major delays to company activities.

3. Link-Local Multicast Name Resolution (LLMNR) Spoofing

CVSS3: 9.8

% of occurrence: 65.5%

• What is it:

A protocol called Link-Local Multicast Name Resolution (LLMNR) was created to resolve names in internal network settings when conventional Domain Name System (DNS) services are inefficient or unavailable.  As a backup method, LLMNR makes it easier to resolve DNS names using multicast queries.  The following is how the resolution procedure goes:

1. To find an IP address that corresponds to the provided DNS name, the system first searches its local host file.
2. The system sends a DNS query to its configured DNS server or servers to resolve the name if there isn’t a local record.
3. The system sends an LLMNR query around the local network to determine whether other hosts can respond if the DNS server or servers are unable to deliver a resolution.

Because any active system can reply to the requests and possibly deceive the requesting system, this reliance on multicast broadcasts creates risks.

• Security Impact:

Any system on the local network can reply to a resolution request with its own IP address because LLMNR inquiries are broadcast.  By sending carefully constructed answers that include the address of the attacker’s system, malicious actors can take advantage of this.  This feature creates opportunities for serious security lapses, especially if the query is connected to critical services like HTTP, MSSQL, or SMB.  A successful redirection can make it easier to obtain private data, such as hashed account passwords and plaintext.  It is important to remember that hashed credentials are vulnerable to contemporary brute-force assaults, which jeopardize account security.

• Recommendation:

Disabling LLMNR capabilities on all impacted systems is essential to reducing the dangers related to LLMNR spoofing.  The following techniques can be used to achieve this:

Group Policy Configuration	Set ‘Turn off Multicast Name Resolution’ to Enabled under Computer Configuration\Administrative Templates\Network\DNS Client. Use the Remote Server Administration Tools for Windows 7 found at this URL to manage settings on a Windows Server 2003 domain controller.
Registry Modification for Windows Vista/7/10 Home Edition	For the purpose of disabling the capability, go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient and change the ‘EnableMulticast’ key to 0 or remove it.

2. NetBIOS Name Service (NBNS) Spoofing

CVSS3: 9.8

% of occurrence: 73.3%

• What is it:

In the event that a DNS server is unavailable or unresponsive, workstations connected to an internal network use the NetBIOS Name Service (NBNS) protocol to resolve domain names. A system takes the following actions when attempting to resolve a DNS name:

1. In order to find an item that maps the DNS name to an IP address, the system first looks through its local host file.
2. In the event that there is no local mapping, the system tries to obtain the matching IP address by sending a DNS query to the DNS server or servers it has set.
3. The system sends an NBNS query around the local network, asking other systems for answers, in the event that the DNS server or servers are unable to resolve the name.

Because of its reliance on broadcasts, the NBNS is susceptible to spoofing attacks, in which a hacker might reply with a fictitious IP address.

• Security Impact:

Because NBNS requests are broadcast, any system on the local network can reply.  Malicious actors may use this issue to reroute traffic meant for legitimate services by responding to these queries with the attacker’s system’s IP address.  Services like SMB, MSSQL, or HTTP, for example, may unintentionally transmit private information to the attacker’s machine, such as hashed account passwords or cleartext.  Furthermore, hashed credentials can be cracked more easily thanks to contemporary computing power, which could provide unauthorized users access to their accounts.

• Recommendation:

Disabling the NetBIOS service on all hosts in the internal network is advised to reduce the possibility of NBNS spoofing.  Numerous techniques, such as DHCP option configuration, network adapter settings tweaks, or system registry updates, can be used to do this.  By putting these modifications into practice, the possible attack surface linked to NBNS will be greatly decreased.

1. Multicast DNS (mDNS) Spoofing

CVSS3: 9.8

% of occurrence: 78.2%

• What it is:

When a dedicated DNS server is not accessible, multicast DNS (mDNS), a name resolution technology for local networks, helps resolve domain names.  There are phases to the resolution process:

1. First, the system looks for any relevant DNS name/IP address mappings in its local host file.
2. The system uses mDNS when there isn’t a DNS server setup. It broadcasts an IP multicast query asking the host associated with the DNS name to identify itself.  This protocol behavior reveals a possible weakness that bad actors could take advantage of, allowing them to respond to these inquiries and appear as trustworthy services.

• Security Impact:

Any device that can receive them can respond to mDNS inquiries, which are sent across the local subnet.  This flaw enables an attacker to reply with the IP address of their system, possibly deceiving the system that is doing the query.  Depending on the particular service the victim is attempting to access (e.g., SMB, MSSQL, HTTP), such exploitation may result in the interception of sensitive data, including unencrypted and hashed credentials.  It should be mentioned that hashed credentials can frequently be compromised in a short amount of time by utilizing brute-force attack techniques and modern computing power.

• Recommendation:

The main suggestion for reducing the risk of mDNS spoofing is to turn off mDNS entirely when not in use. This is frequently accomplished on Windows systems by putting the ‘Disable Multicast Name Resolution’ group policy into effect. Blocking UDP port 5353 using the Windows firewall is an alternate tactic because many applications have the ability to restore mDNS capability. Disabling programs like Avahi-daemon or Apple Bonjour can offer comparable security for non-Windows PCs.

It is crucial to remember that turning off mDNS could interfere with features like screen casting and some conference room technology.  Consider isolating impacted systems within a restricted network segment and requiring the use of strong, complex passwords for any accounts that access these systems if total disabling is not practical.

What Pentesting Reveals About Security Gaps?

One thing is evident from the analysis of tens of thousands of network assessments: many security flaws are caused by straightforward, preventable errors rather than sophisticated hacking techniques.  Attackers can easily exploit unpatched systems, forgotten setups, and weak passwords.  These vulnerabilities do not occur once in a lifetime.  These are persistent issues that arise year after year in networks of all sizes.

Pentesting is similar to putting your security through its paces before an actual attacker does.  It shows how someone may enter, move around, and increase privileges by employing the same strategies that actual attackers use.  Assessments repeatedly shown that even businesses with robust defenses frequently have undiscovered vulnerabilities that are just waiting to be taken advantage of.

The issue?  The majority of businesses still rely on yearly pentests to ensure compliance, which results in months of blind spots in between.  Craw Security can genuinely help with that.  With its automatic, on-demand network pentesting, you can identify and address exploitable vulnerabilities all year long rather than waiting for an audit to reveal what went wrong.

Security testing shouldn’t slow down because cyber threats aren’t.  Frequent network pentesting, whether automated or human, is essential to remain ahead of attackers and not merely tick a compliance box.  Would you like to learn more about our penetration testing methodologies duly customized for your IT Security enhancement and experience the effectiveness of our world-class network pentesting?  Make an appointment for a free security check demo just by calling our 24X7 hotline mobile number, +91-9513805401!  You may also make the call or text over WhatsApp on the same number if you are an international caller.  The highly talented and experienced penetration testers at Craw Security, the Best VAPT Solutions Provider in India and other prominent nations worldwide, will work on the varied IoT gadgets over your IT infrastructure to hone the security algorithms for a better security posture.