Three years ago we published an article \u201c Online tools for the simplest Pentest \u201d. There we talked about affordable and quick ways to check the protection of your network perimeter using tools such as Check Point CheckMe , Fortinet Test Your Metal , etc. But sometimes a more serious test is required when you want to “make noise” already inside the network (and preferably safe for the infrastructure). A free tool like Infection Monkey can be very useful for this purpose . For example, we decided to scan the network through the Check Point gateway and see what the IPS sees. Although nothing prevents you from conducting a similar experiment with other solutions to check how your IPS system or NGFW works. Results under the cut.<\/p>\n\n\n\n
This tool can be classified as BAS (Breach and Attack Simulation) systems that allow you to assess the security of your network in an automatic mode. At the same time, a secure “penetration test” of your infrastructure is performed. The tool is open source and actively developed. Probably its main difference is that all tests pass inside your network, as if an attacker has already penetrated you. The majority are still focusing on perimeter protection, while forgetting about the need for other measures. The same IDS \/ IPS is very important for complex protection, since allows you to identify threats that are already inside the network. Infection Monkey is a good way to assess the maturity of information security in your company.<\/p>\n\n\n\n
Infection Monkey itself can be deployed as a virtual machine. The following platforms are supported:<\/p>\n\n\n\n
AWS has a pre-built template that you can use with your free account. We use ESXi most often. The image can be requested at the office. website , or with us .<\/p>\n\n\n\n
The installation itself is extremely simple and is described here , I see no reason to duplicate this information. There is also an instruction for starting the check. We’d better focus on the test results.<\/p>\n\n\n\n
Infection Monkey uses several attack vectors and allows you to see the following things:<\/p>\n\n\n\n
1) Vulnerable hosts<\/strong> . Finds hosts with weak passwords, old software versions, or known vulnerabilities. Here is a list of onboard exploits:<\/p>\n\n\n\n 2) Prohibited interaction<\/strong> . It is possible to detect interactions between networks that should be prohibited at the DOE or router level.<\/p>\n\n\n\n 3) Horizontal spread<\/strong> . Graphical display of the movement of the “malware”. How a bot “transplants” in your network.<\/p>\n\n\n\n All this is complemented by detailed reporting. For example using the MITER ATT & CK matrix:<\/p>\n\n\n\n Scanmap:<\/p>\n\n\n\n Zero Trust Model Report : This is<\/p>\n\n\n\n also a good check for your existing defenses. Were they able to detect this activity? Have all the logs arrived at your SIEM?<\/p>\n\n\n\n Before moving on to the test results, I would like to answer a few of the most common questions about Infection Monkey.<\/p>\n\n\n\n Is this test dangerous for my infrastructure?<\/strong> The scheme is quite simple. The virtual machine with Infection Monkey is in a dedicated segment. From it we scan the local network segment through the Check Point gateway:<\/p>\n\n\n\n Even in the Check Point course, I tried to show to the maximum how dangerous the default settings are. This applies to all vendors. You must be able to properly \u201ctighten\u201d the nuts. In this case, I decided to first check the Check Point default profile – Optimized. The results can be seen in the picture below:<\/p>\n\n\n\n It is worth noting that with the default profile Infection Monkey successfully \u201chacked\u201d the test host (despite the primitiveness of the attack). The required signature was simply not included.<\/p>\n\n\n\n The settings were made in accordance with the recommendations that were given in the course \u201c Check Point to Maximum \u201d. The result was completely different:<\/p>\n\n\n\n At the same time, IPS prevented infection of the host and further spread of Infection Monkey. Here you can see the traffic dump, the CVE number, the type of attack, and detailed information about it, as well as recommendations for configuring Check Point. Example:<\/p>\n\n\n\n Check Point did a good job in this regard, since they have a rich knowledge base of all kinds of malware.<\/p>\n\n\n\n Of course, Infection Monkey is not a panacea and cannot address all potential network security problems. But for a free tool, this is more than interesting. As I said before, you can \u201cmake some noise\u201d on the net and see how your defenses behave. The same NGFWs with default settings can behave extremely unsatisfactorily. If you are not satisfied with the result, we can help you analyze your configuration .<\/p>\n\n\n\n In the near future we plan to publish similar tests for another tool ( Cymulate ), which can be used for free, a trial version. There are already many more attack options. In addition to the results, we will share recommendations on how to strengthen the protection. In order not to miss the following articles, stay tuned in our channels<\/p>\n","protected":false},"excerpt":{"rendered":" Three years ago we published an article \u201c Online tools for the simplest Pentest \u201d. There we talked about affordable and quick ways to check the protection of your network perimeter using tools such as Check Point CheckMe , Fortinet Test Your Metal , etc. But sometimes a more serious test is required when you want to “make noise” already inside the network…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"yoast_head":"\nInfection Monkey FAQ<\/h4>\n\n\n\n
Can I clean ‘infected’ devices after the test?<\/strong>
Are there any traces left on the ‘infected’ system after removing Infection Monkey?<\/strong>
Does the Infection Monkey put a strain on the system?<\/strong>
Does the program require Internet access?<\/strong><\/p>\n\n\n\nTesting scheme<\/h2>\n\n\n\n
Check Point IPS Results with Optimized Profile<\/h2>\n\n\n\n
Check Point IPS Results with My Profile<\/h2>\n\n\n\n
It is worth noting that Check Point has pretty good forensics. This is how the log itself looks like:<\/p>\n\n\n\nConclusion<\/h2>\n\n\n\n