Ανάπτυξη μιας πλατφόρμας μέτρησης της εξωτερικής επιθετικής επιφάνειας ενός οργανισμού με εργαλεία ανοικτού κώδικα

Παπαδόπουλος, Γεώργιος

Development of a platform for monitoring the external attack surface of an organization with open source tools

Master Thesis

Author

Παπαδόπουλος, Γεώργιος

Date

2022-12

Abstract

In the modern era the organizations that use cyberspace to provide their services are constantly increasing. Also, organizations that already take advantage of cyberspace tend to digitize their services even more. This trend towards the digital world, if not done correctly and especially safely, poses many risks. Thus, while organizations and their customers enjoy the conveniences offered by IT technologies, the exchange of sensitive data over the Internet can attract many malicious users. The purpose of this master thesis is to assist in the effort of securing sensitive data and shielding computing systems by extending the functionality of an existing external attack surface monitoring software, Sn1per. The Sn1per software is distributed in two versions. The free, open source version, which runs in a command-line environment, and the paid, professional, closed source version, which runs in a friendly graphical environment (GUI). For the purposes of this thesis, the open-source version was used, as its source code is publicly available and can be easily modified and extended. In the context of this thesis, three new functions were developed in the open-source version of Sn1per. The first one concerns the development of a new graphical environment, inspired by the one used by the professional version of Sn1per, thus making the free version friendly even to the non-expert user. The second function extends the capabilities of the Sn1per's already existing functionality to detect exposed email addresses. Specifically, Sn1per after creating a list of all exposed e-mail addresses of the protected computing system, then automatically communicates with the haveibeenpwned website to detect possible leaks of their passwords in order to take the appropriate actions to secure them. The third function concerns the ability to submit Google dorks queries, via multiple proxy servers, to the famous Google search engine. This allows Sn1per to identify any incorrectly revealed sensitive information about the protected organization. Finally, a pilot application of the new upgraded version of Sn1per was carried out, with all the above functions, the results of which are discussed in the last chapter of the master thesis.

Postgraduate Studies Programme

Κατανεμημένα Συστήματα, Ασφάλεια και Αναδυόμενες Τεχνολογίες Πληροφορίας

Department

Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα Πληροφορικής

Number of pages

Language

Greek

URI

https://dione.lib.unipi.gr/xmlui/handle/unipi/15196
http://dx.doi.org/10.26267/unipi_dione/2618

Collections

Τμήμα Πληροφορικής

Show full item record

Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού - Μη Εμπορική Χρήση - Παρόμοια Διανομή 3.0 Ελλάδα