Preguntas de Entrevista para Ingeniero de Seguridad Junior

# Código vulnerable
username = request.GET['username']
query = f"SELECT * FROM users WHERE username = '{username}'"
# Ataque: username = "admin' OR '1'='1"

# Código seguro (consulta parametrizada)
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

# Vulnerable: Sin verificación de autorización
@app.route('/admin/users/<user_id>')
def get_user(user_id):
    return User.query.get(user_id)

# Seguro: Verificar autorización
@app.route('/admin/users/<user_id>')
@require_admin
def get_user(user_id):
    if not current_user.is_admin:
        abort(403)
    return User.query.get(user_id)

<!-- Vulnerable -->
<div>Bienvenido, {{ username }}</div>

<!-- Ataque -->
username = "<script>alert('XSS')</script>"

<!-- Seguro (escapar salida) -->
<div>Bienvenido, {{ username | escape }}</div>

# Escaneo de vulnerabilidades Nmap
nmap --script vuln 192.168.1.100

# Escaneo OpenVAS
openvas-start
# Acceder a la interfaz web en https://localhost:9392

# Escaneo Nessus (comercial)
# Configurar a través de la interfaz web

# Automatizar el escaneo de Nessus
import requests
import time

class NessusScanner:
    def __init__(self, url, access_key, secret_key):
        self.url = url
        self.headers = {
            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}'
        }
    
    def create_scan(self, name, targets):
        data = {
            'uuid': 'template-uuid',  # Escaneo de red básico
            'settings': {
                'name': name,
                'text_targets': targets
            }
        }
        response = requests.post(
            f'{self.url}/scans',
            headers=self.headers,
            json=data,
            verify=False
        )
        return response.json()['scan']['id']
    
    def launch_scan(self, scan_id):
        requests.post(
            f'{self.url}/scans/{scan_id}/launch',
            headers=self.headers,
            verify=False
        )
    
    def get_results(self, scan_id):
        response = requests.get(
            f'{self.url}/scans/{scan_id}',
            headers=self.headers,
            verify=False
        )
        return response.json()

# Uso
scanner = NessusScanner('https://nessus:8834', 'access_key', 'secret_key')
scan_id = scanner.create_scan('Escaneo semanal', '192.168.1.0/24')
scanner.launch_scan(scan_id)

# Gestión de parches de Linux
# Ubuntu/Debian
sudo apt update
sudo apt list --upgradable
sudo apt upgrade -y

# CentOS/RHEL
sudo yum check-update
sudo yum update -y

# Aplicación automatizada de parches
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Seguimiento de vulnerabilidades
class VulnerabilityTracker:
    def __init__(self):
        self.vulnerabilities = []
    
    def add_vulnerability(self, vuln):
        self.vulnerabilities.append({
            'id': vuln['id'],
            'severity': vuln['severity'],
            'asset': vuln['asset'],
            'status': 'open',
            'discovered': datetime.now(),
            'sla_deadline': self.calculate_sla(vuln['severity'])
        })
    
    def calculate_sla(self, severity):
        sla_days = {
            'critical': 7,
            'high': 30,
            'medium': 90,
            'low': 180
        }
        return datetime.now() + timedelta(days=sla_days[severity])
    
    def get_overdue(self):
        return [v for v in self.vulnerabilities 
                if v['status'] == 'open' and 
                datetime.now() > v['sla_deadline']]

# Cifrado simétrico (AES)
from cryptography.fernet import Fernet

# Generar clave
key = Fernet.generate_key()
cipher = Fernet(key)

# Cifrar
encrypted = cipher.encrypt(b"Mensaje secreto")

# Descifrar
decrypted = cipher.decrypt(encrypted)

# Cifrado asimétrico (RSA)
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

# Generar par de claves
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)
public_key = private_key.public_key()

# Cifrar con clave pública, descifrar con clave privada

# Ver detalles del certificado
openssl x509 -in certificate.crt -text -noout

# El certificado contiene:
# - Sujeto (nombre de dominio)
# - Emisor (CA)
# - Periodo de validez
# - Clave pública
# - Firma

# Generar clave privada
openssl genrsa -out private.key 2048

# Generar CSR
openssl req -new -key private.key -out request.csr

# Ver CSR
openssl req -text -noout -verify -in request.csr

# Generar certificado autofirmado
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

# Combinar para el uso del servidor
cat cert.pem key.pem > server.pem

# Nginx
server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

# Apache
<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/cert.pem
    SSLCertificateKeyFile /etc/apache2/ssl/key.pem
    SSLCertificateChainFile /etc/apache2/ssl/chain.pem
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

# Malo: Permite SSLv3, TLSv1.0
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

# Bueno: Solo TLS moderno
ssl_protocols TLSv1.2 TLSv1.3;

# Probar la configuración SSL
sslscan example.com
nmap --script ssl-enum-ciphers -p 443 example.com

# O utilizar herramientas en línea
# https://www.ssllabs.com/ssltest/

# Comprobar la caducidad del certificado
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | \
    openssl x509 -noout -dates

# Supervisar la caducidad
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | \
    openssl x509 -noout -enddate

# Instalar certbot
sudo apt install certbot python3-certbot-nginx

# Obtener certificado
sudo certbot --nginx -d example.com -d www.example.com

# Renovación automática (cron)
0 0 * * * certbot renew --quiet

# Probar la conexión TLS
openssl s_client -connect example.com:443 -servername example.com

# Verificar la cadena de certificados
openssl verify -CAfile ca-bundle.crt certificate.crt

# Comprobar que el certificado coincide con la clave privada
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5
# Los hashes deben coincidir

# iptables (con estado)
# Permitir conexiones establecidas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Permitir nuevas conexiones SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

# Descartar todo lo demás
iptables -A INPUT -j DROP

# Instalar Snort
sudo apt install snort

# Configurar la red
sudo vi /etc/snort/snort.conf
# Establecer HOME_NET
ipvar HOME_NET 192.168.1.0/24
ipvar EXTERNAL_NET !$HOME_NET

# Ejecutar en modo IDS
sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

# Ejecutar en modo IPS (en línea)
sudo snort -Q -c /etc/snort/snort.conf -i eth0

# Sintaxis de la regla
# action protocol src_ip src_port -> dst_ip dst_port (options)

# Detectar inyección SQL
alert tcp any any -> $HOME_NET 80 (msg:"Intento de inyección SQL"; \
    content:"UNION SELECT"; nocase; sid:1000001; rev:1;)

# Detectar escaneo de puertos
alert tcp any any -> $HOME_NET any (msg:"Escaneo de puertos detectado"; \
    flags:S; threshold:type both, track by_src, count 20, seconds 60; \
    sid:1000002; rev:1;)

# Detectar fuerza bruta SSH
alert tcp any any -> $HOME_NET 22 (msg:"Fuerza bruta SSH"; \
    flags:S; threshold:type both, track by_src, count 5, seconds 60; \
    sid:1000003; rev:1;)

# Bloquear IP maliciosa (modo IPS)
drop tcp 203.0.113.50 any -> $HOME_NET any (msg:"IP maliciosa bloqueada"; \
    sid:1000004; rev:1;)

# Instalar Suricata
sudo apt install suricata

# Actualizar las reglas
sudo suricata-update

# Ejecutar Suricata
sudo suricata -c /etc/suricata/suricata.yaml -i eth0

# Ver alertas
sudo tail -f /var/log/suricata/fast.log

# Analizar las alertas de Snort
import re
from collections import Counter

def analyze_snort_alerts(log_file):
    alerts = []
    
    with open(log_file, 'r') as f:
        for line in f:
            # Analizar la alerta
            match = re.search(r'\[\*\*\] \[(\d+):(\d+):(\d+)\] (.+?) \[\*\*\]', line)
            if match:
                alerts.append({
                    'sid': match.group(1),
                    'message': match.group(4),
                    'line': line
                })
    
    # Principales alertas
    alert_counts = Counter([a['message'] for a in alerts])
    print("Top 10 de alertas:")
    for alert, count in alert_counts.most_common(10):
        print(f"{count:5d} - {alert}")
    
    return alerts

# Uso
alerts = analyze_snort_alerts('/var/log/snort/alert')

# Inyección SQL
content:"' OR 1=1--";
content:"UNION SELECT";

# XSS
content:"<script>";
content:"javascript:";

# Inyección de comandos
content:";cat /etc/passwd";
content:"|whoami";

# Recorrido de directorios
content:"../../../";

# Shellshock
content:"() { :; };";

import hashlib
import os

def hash_password(password):
    # Generar salt
    salt = os.urandom(32)
    
    # Aplicar hash a la contraseña con salt
    key = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        100000  # iteraciones
    )
    
    # Almacenar salt + hash
    return salt + key

def verify_password(stored_password, provided_password):
    salt = stored_password[:32]
    stored_key = stored_password[32:]
    
    key = hashlib.pbkdf2_hmac(
        'sha256',
        provided_password.encode('utf-8'),
        salt,
        100000
    )
    
    return key == stored_key