Test SSL / TLS version using OpenSSL

How to test for SSL / TLS version supported / enforced by a web application?

OpenSSL is a powerful and open source toolkit for Secure Sockets Layer (SSL) and Transport Layer Security (TLS).

Step 1: Check if OpenSSL is already on your system. It is usually installed as OpenSSL libraries are used by many applications. Go to Command Prompt and Enter “OpenSSL” to check if it is already installed. If you see OpenSSL prompt, it means you already have OpenSSL installed.

If OpenSSL is not installed on your system, you can download and install it from here: https://www.openssl.org/source/

Step 2: Use the below OpenSSL command to check if a web application “SUPPORTS” TLS 1.2. If you see Certification negotiation in the response, it means the application SUPPORTS TLS 1.2.

s_client -tls1_2 -connect [hostname]:[port]

Below is the OpenSSL response of an application that supports TLS 1.2:

Step 3: Check if TLS 1.2 is “ENFORCED” on a web application. If a web application enforces TLS 1.2, it means the application does not accept any connections with protocols older than TLS 1.2. PCI DSS standard recommends to enforce TLS 1.2 so that clients cannot downgrade to a lower TLS / SSL versions that are vulnerable.

This command tells OpenSSL to connect to the host with any protocol other than TLS 1.2.

s_client -no_tls1_2 -connect [hostname]:[Port]

In the below example, observe that the communication happened using TLS 1.1. It means TLS 1.2 is not ENFORCED by the host.

Step 4: Check if older versions of SSL / TLS are supported. “Handshake failure” error is returned if the version of SSL / TLS you are trying to test is not supported.

s_client -ssl3 -connect [hostname]:Port

In the below example, the host does not support SSL v3. Therefore, it returns “handshake failure” error.

Below are other tools that can be used to check SSL / TLS version:

• Nmap
• Nessus

 

Network Penetration Testing Interview Questions & Answers

1.What is your penetration testing methodology?

• Typical penetration testing methodology includes below steps:
  • Information Gathering
  • Planning and Analysis
  • Vulnerability Identification
  • Exploitation
  • Risk Analysis and Remediation Recommendation
  • Reporting

2. What are common network vulnerability identification steps? 

• Fingerprinting – Obtain information on open ports, services, OS
• Vulnerability Scanning –  using tools like Nessus, Nexpose
• Brute force default accounts – using password cracking tools
• Manual penetration testing
  •  Packet analysis – using tools like WireShark
  •  Analyse cryptographic issues
  •  Test published vulnerabilities specific to OS/Software/Service
  •  Phishing attacks

3. What are common ports and services to focus on during penetration testing?

Ideally, only required ports should be enabled and all other ports need to be disabled. Common ports to look for during penetration testing are:

• Port         Service
• 20             FTP – TCP {Data Stream} (File Transfer Protocol
• 21              FTP – TCP {Control Stream}
• 23              Telnet
• 25              SMTP – TCP (Simple Mail Transfer Protocol)
• 53               DNS – TCP/UDP (Domain Name Service)
• 69              TFTP – UDP (Trivial File Transfer Protocol)
• 80              HTTP – TCP (Hypertext Transfer Protocol)
• 110             POP3
• 135, 139     NETBIOS -UDP (Network Basic Input Output System)
• 137, 138    NETBIOS – TCP
• 143             IMAP
• 389            LDAP – TCP/UDP (Lightweight Directory Access Protocol)
• 445            SMB   – TCP  ( Server Message Block)
• 2049         NFS  v4  – TCP (Network File System)
• 5060         SIP  – TCP/UDP (Session Initiation Protocol)

4. Why windows is considered less secure than other OS?

• Windows is the widely used Operating System. Hence, it is the target for many hackers.
• User account management in Windows is not very secure. Attackers first target is to crack windows user names and passwords on a organization network and then escalate privileges to Domain admin account.

5. What tools do you use for Network Penetration testing?

Kali linux has many open source penetration testing tools

• Port Scanners: Nmap
• Network Vulnerability Scanners: Nessus, Nexpose
• Packet analysis: WireShark
• Web proxy: Burp Suite, OWASP ZAP
• Web Scanners: WebInspect, AppScan, Burp Suite Professional

Reference: Security Products / Tools

6. List common network security vulnerabilities.

• Insecure open ports and services
• Authentication
  • Authentication Bypass
  • Default accounts enabled
  • Weak passwords
  • Plain text passwords
• Authorization
  • Privilege Escalation
  • Gaining access
• Improper Input Validation
• Cryptography
  • Weak encryption
  • Weak keys
• Denial of Service
  • SYN flood
  • UDP flood
  • ICMP flood
  • Ping to Death
  • Distributed Denial of Service
• System Configuration
  • Unpatched software
  • Liberal access control
• Sensitive Information Leakage
• ARP Spoofing
• Vulnerabilities specific to Software or Operating System or Network Devices

7. What are common levels of network penetration testing?

• External penetration testing
  • Testing the network from external network reveals vulnerabilities from external attackers perspective.
• Internal penetration testing
  • Internal penetration testing allows testers to get additional access to internal assets and helps to assess threats from internal malicious users. Internal penetration testers need to crack the NAC and test network by connecting to the intranet.

8. What is the use of NIS

NIS – Network Information Service is commonly used for managing user credentials across a group of machines. It is a client-service directory service protocol for storing users and hostnames in a network. For instance, linux machines use /etc/hosts, /etc/passwd, /etc/shadow to store host names, list of users, secret auth hashes respectively.

9. How do you penetrate into an organization network in Internal penetration testing?

• Network Access Control (NAC) Bypass
• Crack user accounts
• Obtain Domain Controller access
• Escalate privileges to Domain Controller
• Obtain access to shared drives or FTP
• Retrieve sensitive files on shared drives or FTP
• Obtain DBA / sa account on databases
• Crack SMTP packets

10. What is NAC?

Network Access Control (NAC) enforces user authentication, endpoint security on devices connected to a network. Networks with NAC only allow devices that comply to the organization security policy. Meaning, any external device cannot obtain network access by connecting to a open LAN port of a network that implements NAC.

11. How do you bypass NAC?

Bypassing NAC is the first goal of a network pentester. Below are the easiest ways to bypass NAC:

• Connect to a open port using an ethernet cable and check if you can access the organization internet
• By spoofing IP Address / MAC address of a valid network device like a VOIP phone or a printer.

References for techniques to bypass NAC:

• https://www.blackhat.com/presentations/bh-dc-07/Arkin/Presentation/bh-dc-07-Arkin-ppt-up.pdf

 

12. How can you obtain access to FTP servers?

• First, identify all the FTP servers on the organization network (eg: 192.168.1.1/24). Below nmap command can be used to obtain all the servers with FTP ports (20, 21) open.
  • nmap -p 20,21 192.168.1.1/24 -vvv –randomize-hosts -sS -sV -oG –excludefile exclude.txt >> nmap_ftpservers.txt
•  Check if any of the FTP servers have anonymous account enabled
  • Type “ftp://[server name]” in browser
  • Enter username as “Anonymous”
  • Password as your email address
  • Verify whether you are able to access the folders in the FTP server
• Check if any cracked user accounts work on FTP servers
• Brute force passwords for valid user accounts. Valid username and blank password could work some times.

13. How do you get sensitive files on the shared drives or FTP?

• We can search for words like “username”, “password”, “credit card”, “client data” in file search box
• Windows Grep is a useful tool to search file shares for sensitive files

14. What are the ways to crack database accounts?

• Check if default database accounts / passwords are enabled
  • For Oracle DB, defaults dba user accounts are sys, system.
  • For SQL Server, default administrator account is SA
    • Note: These accounts should be disabled for better security
• Try to brute force passwords for DB administrator accounts
  • Below are the metasploit commands to crack SA account on SQL Server
    • use auxiliary/scanner/mssql/mssql_login
    • set pass_file /usr/share/set/src/fasttrack/wordlist.txt
    • set RHOSTS [IP]
    • set threads 8
    • run
  • Caution: You may be caught by the organization intrusion detection system if you brute force passwords of SA accounts!

15. What is risk if database accounts are compromised?

If database administrator accounts (e.g: sa, dba) accounts are compromised, whole data in the database which could include Personally Identifiable Information (PII), user credentials can be compromised. The database could be deleted or shutdown which could cause Denial of Service (DOS) for some applications.

16. What tools/infrastructure do you have on your pentesting lab?

• Kali 2.0 VM
  • Nmap
  • Wireshark
  • Responder
  • Metasploit
  • John the Ripper (password cracker)
  • Burp Suite
• Windows 7 VM
  • Power Shell

17. When network controls would you recommend to strengthen network security of an organization

• Implement Network Access Control (NAC) properly.
• Do not leave unattended network ports or rogue Wifi on the network
• Secure File Shares. Do not use anonymous FTP accounts.
• Implement proper authentication / authorization to Domain Controllers.
• Implement strong password policy
• Encrypt user passwords. Do not allow users to store passwords on their machines.
• Implement appropriate network, host, web firewalls.
• Regularly identify and remediate network vulnerabilities using tools like Qualys, Nexpose, Nessus
• Implement appropriate Intrusion Detection System, Intrusion Prevention System.
• Implement proper network segmentation

 

Security Products / Tools

Security Testing Tools:

Application Security Scanner

• IBM AppScan
• HP WebInspect
• Portswigger Burp Scanner

Application Proxy for Manual Vulnerability Assessment

• Portswigger Burp Proxy
• OWASP ZAP

Static Code Analysis 

• HP Fortify
• IBM AppScan Source

Network Vulnerability Scanning

• Nessus
• Nexpose
• Qualys

Network Security Assessment

• RedSeal – to assess security of a network, firewall configuration
• USBDeview – to get information on all USB devices connected currently and previously to a computer

Network Penetration Testing

• Nmap – port scanning
• Caldera – automated red team system by MITRE (open source & licensed)
• Wireshark – packet sniffing
• Scapy – packet manipulation
• Very Simple Network Scanner – to ping windows based platforms
• Firewalk –  to enumerate firewall rule set, works similar to Traceroute, currently the tool functionality is merged with NMAP
• Useful windows utilities:
  • netstat – to obtain information on current TCP/UDP connections, routing table

Active Directory Penetration Testing

• Mimikatz – extracts plaintext passwords, hash, pin codes and Kerberos tickets from memory
• DCShadow – a mimikatz feature used to manipulate AD data
• DCSync – used to simulate DC and ask for pwd
• SkeletonKey – it is a malware that allows any Domain user to authenticate using master pwd

Wireless Penetration Testing

• Kismet – identify wireless access points
• aircrack-ng – crack wifi key

Exploitation

• Metasploit

 SAP security scanner

• Onapsis
• Virtual Forge – static code analysis for SAP and ABAP

Network Security:

• Cisco Meraki – Cloud managed networking and security
• CyberArk
• FireEye
• Infoblox – to improve network uptime and protect from DDOS attacks

Network Access Control

• Cisco ISE
• ForeScout CounterACT

Network Firewall

• Juniper NetScreen
• Palo Alto
• Cisco ASA
• Dell SecureWorks

Web Application Firewall (WAF)

• f5
• Websense

Advanced Threat Detection:

• IBM QRadar – easy to use – it has three main servers (syslog, netflow, management)
• Damballa Failsafe

Endpoint Security:

• CIS-CAT – assess the benchmark for desktops
• Bit9
• Carbon Black
• Fedelis
• SentinalOne – Active Endpoint detection and response

Malware Research:

• YARA – helps malware researchers identify and classify malware samples

Encryption:

Desktop EndPoint Security

•  BitLocker
• Data Guardian – Data Loss Prevention (DLP)
• Tanium

Document Encryption Tools

• Safenet
• Protegrity
• Townsend
• Varmetric

Identity Management:

• Enterprise RBAC – protect privileged accounts, service accounts
• OIM
• OPAM
• Oracle Adaptive Access Manager (OAAM) – session recording on jumpbox
• CyberArk

IT Infrastructure Management:

• SolarWinds
• ServiceNow
• Sapphire IMS – to manage distributed IT assets

Log Management:

• Splunk

Password Management on Desktop:

• Keeper

 

 

Web Penetration Testing Interview Questions & Answers

1. What is the need for penetration testing?
   Penetration testing helps to find security vulnerabilities in the application before an attacker could attack or a customer could find out and report it. Also, it is easier and cost effective to find bugs as early in the software development life cycle as possible.
   
2. What is a vulnerability?
   A vulnerability is a flaw or weakness in a system’s design, implementation, operation or management that could be exploited to compromise the system’s security objectives.
3. What are most common web vulnerabilities? or what are OWASP top listed vulnerabilities?
   Injection flaws
   Authentication Bypass and Session Management
   Cross Site Scripting
   Authorization Bypass
   Security Configuration
   Sensitive Data Exposure
   Cross Site Request Forgery
   Using Vulnerable Third Party Components
   UnValidated redirects or forwards
4. What is XSS?
   Cross-site scripting(XSS) is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users.
   XSS is an attack technique that involves echoing attacker-supplied code into a user’s browser instance.
5. What are types of XSS?
   Reflected XSS
   Stored XSS
   DOM bases XSS
   
6. Which type of XSS is more dangerous?
   Stored XSS is more risky as it lasts in the application and affects all users who visit the vulnerable page.
   
7. How do you test XSS vulnerability in  web applications?
   – Identify parameters that take user input parameters that are displayed back on the browser in the same page or in another page.
   – Input parameters can be in GET or POST requests.
   – Hidden parameters also may be vulnerable.
   – Web proxy tool like BurpSuite or Paros Proxy is required to bypass client side authentication and to test XSS in hidden parameters
   – Inject XSS scripts like alert(1); in parameters to be tested and observe  application response.
   – If the application is executing the injected script, it could be vulnerable to XSS.
8. Can you say few common XSS attack vectors that are commonly used for testing?
   onload=’confirm(“test XSS”)’
   ” onload=’javascript:alert(1)’
   “>
   alert(1);
   ;alert(1)
   
9. How can we prevent XSS?
   Input Validation: Validate user input. Use whitelisting. Whitelisting is maintaining an accepting list of characters of each parameter and allowing only those characters in user input.
   Output Encoding: This is the best technique to re-mediate XSS. Encode all special characters in user input before displaying on the browser. HTML encoding of are &lt and &gt. Encoding will prevent execution of scripts.
10. What is SQL injection?
    SQL injection is an input validation vulnerability in which an attacker injects SQL scripts in user input to gain unauthorized access to application or data.
11. What are variants of SQLi?
    Blind SQL injection
    SQLinjection using UNION based queries
    SQLinjection using unhandled DB exceptions
12. How do you test for SQLi?
    – Identify user input parameters that are used in DataBase queries.
    – The parameters in can be GET or POST requests and also hidden parameters.
    – To test SQL injection, start by entering small SQL queries like ‘ or ‘1’=’1 and observe application response.
    – If the application responds with DB error message, we can conclude the script we entered has reached DB and no input validation has been implemented to block. 
    – We can continue testing with advanced attack vectors.
13. What is blind SQL injection?
    Blind SQL injection does not let user to obtain data upon successful attack directly.
    The application behaves differently for true or false conditions in SQL injection.
    Basing on this difference in behavior, we try to obtain information from database by using ascii values of each character i.e., bit by bit 
    It is a tedious process. But allows to extract the whole database.
14. How can we prevent SQLi?
    SQL Injection can be prevented by implementing proper input validation. Use whitelisting for parameters like usersname which expects only alphanumerics.
    Use parameterised queries in application code instead of concatenated string queries
    Implement proper DB user authorization to mitigate SQL injection attacks.
15. What is CSRF vulnerability?
    Cross site request forgery vulnerability occurs when a victim clicks on a crafted link sent by an attacker which contains requests to the application. So, the attacker will be able to get his intended task done by the victim without victim’ s knowledge. The attack will be successful when the user is logged into the application and then clicks on the link sent by the attacker.
    The CSRF vulnerability occurs because of browser feature to send the active session cookies basing on domain name. 
16. How can you exploit CSRF vulnerability?
    Cross site request forgery vulnerability occurs when a victim clicks on a crafted link sent by an attacker which contains requests to the application. So, the attacker will be able to get his intended task done by the victim without victim’ s knowledge. The attack will be successful when the user is logged into the application and then clicks on the link sent by the attacker.
    Below is the same code for the attackers link. 
    
    Below is a sample exploit code for the page:

    http://example.com/ Update_user_details.jsp”>

      
     document.badform.submit();  
    </body>
    </html>The HTML code above contains hidden parameters corresponding to legitimate form in the user application with attackers intended values to submit the form.
17. What are recommended remediation measures for CSRF?
    The recommended remediation for CSRF vulnerability is to implement secondary random variable in sensitive forms of the application. The server has to send a hidden random variable for each user session and should validate this variable value when the form form gets submitted.
18. What is a session fixation issue?
    Session fixation vulnerability allows an attacker to choose victim’s session cookie. This vulnerability occurs when applications generate session cookie before authentication and does not change the cookie value after authentication.
19. What are various ways to by pass authentication?
    SQL injection
    Cookie Manipulation
    Forceful Browsing
20. What is meant by horizontal privilege escalation?
    Horizontal Privilege escalation is being able to bypass authorization mechanism and access information of other users who have the same level of permission.
21. What is meant by vertical privilege escalation?
    Vertical Privilege escalation is being able to bypass authorization mechanism and access information of other users who have higher privileges than current user.
    For instance, a normal application user being able to access the administrator pages.
22. What is a buffer overflow vulnerability?
    Buffer overflow vulnerability allows to write onto unintended memory locations.  Examples of ‘C’ buffer overflow vulnerable functions are ‘gets’, ‘puts’

References:

https://www.owasp.org/index.php/Top10#OWASP_Top_10_for_2013

 

Secure SDLC

The earlier we find security flaws during SDLC, the cheaper they are to fix.

Security should be included in every stage of SDLC to develop a secure application.

 

Threat: A threat is anything that may harm the assets owned by an application by exploiting a vulnerability.

Threat Modeling is identification of possible threats for the given application functionality. Identify the security threats while gathering or analyzing requirements for the application.

Security requirements for the application also need to be defined during requirements gathering phase of SDLC and application should be designed taking the security requirements into consideration.

Vulnerability is a flaw or weakness in a system’s design, implementation, operation or management that could be exploited to compromise the system’s security objectives.

Source Code Analysis identifies security flaws in code. Developers can use static code analysis tools like Fortify or Appscan Source Edition to find security flaws in various stages of development. Security flaws identified early in the software development life cycle are easy or less costly to fix.

Penetration Testing  helps to identify security vulnerabilities by various techniques used by hackers to attack applications. Penetration testing should be done for the application, infrastructure, network and servers using manual penetration testing techniques and automated scanners like Appscan, WebInspect, Nessus.

Audits help to verify whether the application or infrastructure abides by security standards like ISO 27001, HIPPA, SOX, PCI and security recommendations by various vendors.

 

Penetration Testing Methodology

The objective of ethical hacking or manual penetration testing is to test the application and infrastructure for security flaws or vulnerabilities by using the techniques used by hackers without causing intentional damage.

Penetration Testing Methodology:

Below penetration testing methodology can be used to test web, mobile, desktop based applications or network for security vulnerabilities

Penetration Testing Methodology

 

Information Gathering:  The first step in penetration testing is to obtain information on environment to be tested. Typical information required for penetration testing is

• Application or URL to be tested
• Credentials of the application
• Network hosts to be tested

Analysis and Planning: This phase of testing involves the following steps

• Identify the assets (Hosts, sensitive data, application logic) for the environment.
• Identify the threats for the environment to be tested.
• Identify the vulnerabilities to be tested
• Identify the tools that can be used for testing.

Vulnerability Identification:  Use the techniques for identifying the vulnerabilities and test the environment for these vulnerabilities. This is the actual testing phase.

Exploitation: Exploitation of identified security vulnerabilities may be required to assess the risk of security issues.

Risk Analysis and Remediation Suggestion:  Assess the Risk caused by the vulnerability and recommend remediation measures to fix the vulnerability. Risk assessment helps to set priority for remediating each security issue.

• Risk = Likelihood * Impact
• Likelihood: measure of how likely this particular vulnerability is to be uncovered and exploited by an attacker
• Impact: impact of a successful attack

Reporting: A penetration test report typically contains the following information

• Summary of Pen Test
• List of vulnerabilities with below information
  • Vulnerability Name
  • Vulnerability Description
  • Vulnerable Functionality
  • Steps to reproduce the vulnerability
  • Risk Rating of the vulnerability
  • Remediation Recommendation

 

Integer Overflow

An Integer Overflow is the condition that occurs when the result of an arithmetic operation, such as multiplication or addition, exceeds the maximum size of the integer type used to store it.

When an integer overflow occurs, the interpreted value will appear to have “wrapped around” the maximum value and gets the minimum value, similar to a clock that represents 13:00 by pointing at 1:00.

For example, an 8-bit signed integer on most common computer architectures has a maximum value of 127 and a minimum value of -128. If a programmer stores the value 127 in such a variable and adds 1 to it, the result should be 128. However, this value exceeds the maximum for this integer type, so the interpreted value will “wrap around” and becomes -128.

127      =  0111 1111

127 +1 = 1000 0000 = -128

 

Security Impact of Integer Overflow:

An integer overflow during a buffer length calculation can result in allocating a buffer that is too small to hold the data to be copied into it. A buffer overflow can result when the data is copied.

Integer overflow or underflow could cause significant damage when sensitive data is stored in integers. For instance, withdrawing 1 dollar from an account with a balance of 0 could cause an integer underflow and yield a new balance of 4,294,967,295.

Example: Integer overflow in bufferobject.c in Python  (CVE-2014-7185)

The vulnerability is in buffer function in bufferobject.c file

Buffer(Object, Offset, Size) // buffer’s contents will refer to the base object’s buffer interface, starting as position offset and extending for size bytes

The Buffer function is similar to SubStr function which reads a substring of Size bits from Offset position in a String Object.

Below exploit code reads unlimited heap dump

Buffer function allocates memory on heap. In above exploit code, the maximum values in offset and size parameters cause the integer overflow and allows to dump heap.

The vulnerable code snippet in buffer function is the conditional statement: if (offset + *size > count) 

The conditional statement adds offset and size parameters which causes the overflow when large offset and size are given. Offset + Size then becomes a negative value and skips the conditional check above.

The fix implemented for this integer overflow in bufferobject.c is  if (*size > count – offset)

Verify the size of   input variables to avoid integer overflow vulnerabilities.

References:

• http://projects.webappsec.org/w/page/13246946/Integer%20Overflows
• http://svn.python.org/projects/python/trunk/Objects/bufferobject.c
• http://bugs.python.org/issue21831

 

Crypto Jargon

Cryptography: Study of various techniques used for encryption.

Cryptanalysis: The techniques used for deciphering a message without any knowledge of the enciphering details.

Cryptology: The areas of cryptography and cryptanalysis together are called cryptology.

Encryption: It is the process of converting ordinary information (called plaintext) into unintelligible text (called ciphertext)

Decryption: Restoring the plain text from ciphertext

Digital Signature: Used to verify the integrity of data and authenticity of sender of data. Public Key cryptography is often used for digital signature.Public key is used to “sign” a message and corresponding Private key is used to verify the signed message.

Hashing: It is a One Way function. In other words, there is no reverse algorithm. Output of hash function is of fixed length irrespective of the size of input. Two distinct messages ideally should not result in same Hash value (no collision).

Hash Functions:

MD5:

• 128 bit output
• The hash function is cracked. Hence, not secure

SHA1:

• 160 bit output.
• No collision found yet. Hence, considered secure

SHA-2/3:

• 256/512 bit output

Types of Encryption:

Symmetric encryption: It is a form of cryptosystem in which encryption and decryption are performed using the same key.

• Stream Cipher: It is a symmetric encryption technique which encrypts a digital data stream one bit or byte at a time. Usually, the key used for stream ciphers should be of the length of the plain text. For practical purpose, the bit-stream generator must be implemented as an algorithmic procedure, so that the cryptographic bit stream can be produced by both users. A shared key will be used to generate the key stream.
  Algorithms:
  • Vernam Cipher
  • RC4
•  Block Cipher: It is a symmetric encryption technique in which a block of plain text is treated as a whole and used to produce a cipher text block of equal length.
  Algorithms:
  • DES – Data Encryption Standard
  • AES – Advanced Encryption Standard
    DES algorithm has been broken. Hence, 3DES or AES are recommended.

Asymmetric encryption: It is a form of cryptosystem in which encryption and decryption are performed using the different keys, one a public key and one a private key. It is also known as public-key encryption. It is computationally infeasible to determine the decryption key given only knowledge of the cryptographic algorithm and the encryption key. Either of the two keys can be used for encryption, with the other used for decryption.

• Algorithms:
  • RSA – most widely used public-key cryptosystem. It is based on the difficulty of finding the prime factors of a composite number.

 

8086 Microprocessor Basics

Its inevitable to understand the basics of how computers operate at low level to perform reverse engineering or to understand security in depth.

So, I am revisiting 8086 Microprocessor. This blog could be a refresher for you too 🙂

• 8086 is a 16-Bit microprocessor designed by Intel between 1976-1978.
• The 8086 gave rise to the x86 architecture which is used in Intel’s most successful line of processors.

BUSES & OPERATION

• BUS is a set of parallel lines on which information (data, address, instructions) gets transmitted in a computer
• 8086 is called 16 bit microprocessor because all the internal registers and ALU are 16 bit
• 20 bit address bus can address 2^20 = 1 MB physical address space
• 8086 has 16 bit I/O address space, which can address 2^16 = 65536 unique I/O devices

8086 Pin Diagram

REGISTERS:

• 8086 has eight, 16 bit general purpose registers : AX, BX, CX, DX, SP, BP, DI, SI.
• The general purpose registers: AX, BX, CX, DX can be used for 8-Bit operations also
• The 16 bit Instruction Pointer register holds the off set address of the next instruction to be executed
• There are four, 16 bit segment registers: CS, DS, ES, SS which hold the base address of the four memory segments
• SP, BP, DI, SI registers hold the off-set address
• A 16 bit Flag register contains various flags that indicate the current state of the processor: Carry flag (CF), Parity flag (PF), Auxiliary carry flag (AF), Zero flag (ZF), Sign flag (SF), Trap flag (TF), Interrupt flag (IF), Direction flag (DF), and Overflow flag (OF).

MEMORY ORGANIZATION:

• The memory is logically divided into CODE, DATA, EXTRA and STACK segments each of 64KB in 8086
• The 8086 shifts the 16-bit segment, four bits left before adding it to the 16-bit offset (16×segment + offset), thus producing a 20-bit external (or effective or physical) address

 

How to Install Ubuntu VM on VirtualBox

My goal was to create an Ubuntu virtual machine on my Laptop which has Windows 8.1 OS. Chose to use Oracle VirtualBox virtualization software as it is a freeware. Faced few issues during this process and had to google a lot to fix. So, sharing the issues and the solutions that finally worked out. 🙂

• HOST OS : Windows 8.1
• VIRTUALIZATION SOFTWARE : Oracle VM VirtualBox
• GUEST OS : Ubuntu 14.04

Step 0: In BIOS, Set VIRTUALIZATION option of your CPU to ENABLED.

Step 1: Download and Install Oracle VirtualBox for WIndows from  https://www.virtualbox.org/wiki/Downloads . Its a typical .exe file and the installation steps are quite obvious. Default options can be used during installation.

Step 2: Download appropriate flavor of Ubuntu from http://www.ubuntu.com/download/desktop .

Step 3: Create a new Ubuntu VM in VirtualBox. Use the downloaded iso file for booting the VM. Refer: http://www.psychocats.net/ubuntu/virtualbox for detailed steps.

I could do above three steps pretty quickly. However, faced the below issues when I started the Ubuntu VM.

• Ubuntu VM desktop is blank.

  The VM displays a login screen and allows to log in successfully. However, the desktop does not show any applications. It was completely blank.
  The issue occurred because VIRTUALIZATION on my CPU in BIOS was not enabled.
  Realized that this is a prerequisite check before installing any virtualization software. 

  Steps to enable VIRTUALIZATION in BIOS:
  1. Press F10 before booting your machine. This takes you to BIOS
  2. VIRTUALIZATION option is generally found in Security tab. ENABLE it, SAVE and EXIT from BIOS.

• Ubuntu VM could not be opened in full screen mode

  Ubuntu virtual machine screen on Virtualbox was very small (lesser than 1/4th of full screen) when the VM was started for the first time.

  VirtualBox Guest Additions are packages designed to be installed inside a virtual machine after the guest operating system has been installed. They consist of device drivers and system applications that optimize the guest operating system for better performance and usability. So, guest additions need to installed on Ubuntu after installing the OS.

  Open Terminal (Ctrl+Alt+F1) in Ubuntu VM, provide user credentials and execute the below commands to install Ubuntu Guest Additions.

  sudo apt-get update
  sudo apt-get upgrade
  sudo apt-get install dkms

  sudo apt-get install virtualbox-guest-additions-iso
  sudo apt-get update
  sudo apt-get dist-upgrade
  sudo apt-get install virtualbox-guest-x11

  Also, set VirtualBox instance to use like 128MB video ram and Enable 3D Acceleration under the “Display” settings section.
  Finally, I could get a working Ubuntu VM with full screen and default desktop applications.

• References:
  

  http://askubuntu.com/questions/230304/ubuntu-12-10-desktop-interface-not-showing-on-virtualbox-vm-after-login-screen
  http://askubuntu.com/questions/22743/how-do-i-install-guest-additions-in-a-virtualbox-vm
  https://www.virtualbox.org/manual/ch04.html#idp55330864