Domande di colloquio per Junior Security Engineer: Guida Completa

# Codice vulnerabile
username = request.GET['username']
query = f"SELECT * FROM users WHERE username = '{username}'"
# Attacco: username = "admin' OR '1'='1"

# Codice sicuro (query parametrizzata)
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

# Vulnerabile: Nessun controllo di autorizzazione
@app.route('/admin/users/<user_id>')
def get_user(user_id):
    return User.query.get(user_id)

# Sicuro: Controllo dell'autorizzazione
@app.route('/admin/users/<user_id>')
@require_admin
def get_user(user_id):
    if not current_user.is_admin:
        abort(403)
    return User.query.get(user_id)

<!-- Vulnerabile -->
<div>Benvenuto, {{ username }}</div>

<!-- Attacco -->
username = "<script>alert('XSS')</script>"

<!-- Sicuro (escape output) -->
<div>Benvenuto, {{ username | escape }}</div>

# Scansione delle vulnerabilità con Nmap
nmap --script vuln 192.168.1.100

# Scansione OpenVAS
openvas-start
# Accedi all'interfaccia web all'indirizzo https://localhost:9392

# Scansione Nessus (commerciale)
# Configura tramite interfaccia web

# Automatizza la scansione di Nessus
import requests
import time

class NessusScanner:
    def __init__(self, url, access_key, secret_key):
        self.url = url
        self.headers = {
            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}'
        }
    
    def create_scan(self, name, targets):
        data = {
            'uuid': 'template-uuid',  # Basic Network Scan
            'settings': {
                'name': name,
                'text_targets': targets
            }
        }
        response = requests.post(
            f'{self.url}/scans',
            headers=self.headers,
            json=data,
            verify=False
        )
        return response.json()['scan']['id']
    
    def launch_scan(self, scan_id):
        requests.post(
            f'{self.url}/scans/{scan_id}/launch',
            headers=self.headers,
            verify=False
        )
    
    def get_results(self, scan_id):
        response = requests.get(
            f'{self.url}/scans/{scan_id}',
            headers=self.headers,
            verify=False
        )
        return response.json()

# Utilizzo
scanner = NessusScanner('https://nessus:8834', 'access_key', 'secret_key')
scan_id = scanner.create_scan('Weekly Scan', '192.168.1.0/24')
scanner.launch_scan(scan_id)

# Gestione delle patch Linux
# Ubuntu/Debian
sudo apt update
sudo apt list --upgradable
sudo apt upgrade -y

# CentOS/RHEL
sudo yum check-update
sudo yum update -y

# Patching automatizzato
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Monitoraggio delle vulnerabilità
class VulnerabilityTracker:
    def __init__(self):
        self.vulnerabilities = []
    
    def add_vulnerability(self, vuln):
        self.vulnerabilities.append({
            'id': vuln['id'],
            'severity': vuln['severity'],
            'asset': vuln['asset'],
            'status': 'open',
            'discovered': datetime.now(),
            'sla_deadline': self.calculate_sla(vuln['severity'])
        })
    
    def calculate_sla(self, severity):
        sla_days = {
            'critical': 7,
            'high': 30,
            'medium': 90,
            'low': 180
        }
        return datetime.now() + timedelta(days=sla_days[severity])
    
    def get_overdue(self):
        return [v for v in self.vulnerabilities 
                if v['status'] == 'open' and 
                datetime.now() > v['sla_deadline']]

# Crittografia simmetrica (AES)
from cryptography.fernet import Fernet

# Genera la chiave
key = Fernet.generate_key()
cipher = Fernet(key)

# Crittografa
encrypted = cipher.encrypt(b"Secret message")

# Decrittografa
decrypted = cipher.decrypt(encrypted)

# Crittografia asimmetrica (RSA)
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

# Genera la coppia di chiavi
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)
public_key = private_key.public_key()

# Crittografa con la chiave pubblica, decrittografa con la chiave privata

# Visualizza i dettagli del certificato
openssl x509 -in certificate.crt -text -noout

# Il certificato contiene:
# - Soggetto (nome del dominio)
# - Emittente (CA)
# - Periodo di validità
# - Chiave pubblica
# - Firma

# Genera la chiave privata
openssl genrsa -out private.key 2048

# Genera CSR
openssl req -new -key private.key -out request.csr

# Visualizza CSR
openssl req -text -noout -verify -in request.csr

# Genera certificato autofirmato
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

# Combina per l'uso del server
cat cert.pem key.pem > server.pem

# Nginx
server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

# Apache
<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/cert.pem
    SSLCertificateKeyFile /etc/apache2/ssl/key.pem
    SSLCertificateChainFile /etc/apache2/ssl/chain.pem
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

# Errato: Consente SSLv3, TLSv1.0
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

# Corretto: Solo TLS moderno
ssl_protocols TLSv1.2 TLSv1.3;

# Testa la configurazione SSL
sslscan example.com
nmap --script ssl-enum-ciphers -p 443 example.com

# Oppure usa strumenti online
# https://www.ssllabs.com/ssltest/

# Controlla la scadenza del certificato
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | \
    openssl x509 -noout -dates

# Monitora la scadenza
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | \
    openssl x509 -noout -enddate

# Installa certbot
sudo apt install certbot python3-certbot-nginx

# Ottieni il certificato
sudo certbot --nginx -d example.com -d www.example.com

# Rinnovo automatico (cron)
0 0 * * * certbot renew --quiet

# Testa la connessione TLS
openssl s_client -connect example.com:443 -servername example.com

# Verifica la catena di certificati
openssl verify -CAfile ca-bundle.crt certificate.crt

# Controlla che il certificato corrisponda alla chiave privata
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5
# Gli hash dovrebbero corrispondere

# iptables (stateful)
# Consenti connessioni stabilite
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Consenti nuove connessioni SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

# Elimina tutto il resto
iptables -A INPUT -j DROP

# Installa Snort
sudo apt install snort

# Configura la rete
sudo vi /etc/snort/snort.conf
# Imposta HOME_NET
ipvar HOME_NET 192.168.1.0/24
ipvar EXTERNAL_NET !$HOME_NET

# Esegui in modalità IDS
sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

# Esegui in modalità IPS (inline)
sudo snort -Q -c /etc/snort/snort.conf -i eth0

# Sintassi della regola
# action protocol src_ip src_port -> dst_ip dst_port (options)

# Rileva SQL injection
alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Attempt"; \
    content:"UNION SELECT"; nocase; sid:1000001; rev:1;)

# Rileva la scansione delle porte
alert tcp any any -> $HOME_NET any (msg:"Port Scan Detected"; \
    flags:S; threshold:type both, track by_src, count 20, seconds 60; \
    sid:1000002; rev:1;)

# Rileva la forza bruta SSH
alert tcp any any -> $HOME_NET 22 (msg:"SSH Brute Force"; \
    flags:S; threshold:type both, track by_src, count 5, seconds 60; \
    sid:1000003; rev:1;)

# Blocca IP dannoso (modalità IPS)
drop tcp 203.0.113.50 any -> $HOME_NET any (msg:"Blocked Malicious IP"; \
    sid:1000004; rev:1;)

# Installa Suricata
sudo apt install suricata

# Aggiorna le regole
sudo suricata-update

# Esegui Suricata
sudo suricata -c /etc/suricata/suricata.yaml -i eth0

# Visualizza gli avvisi
sudo tail -f /var/log/suricata/fast.log

# Analizza gli avvisi Snort
import re
from collections import Counter

def analyze_snort_alerts(log_file):
    alerts = []
    
    with open(log_file, 'r') as f:
        for line in f:
            # Analizza l'avviso
            match = re.search(r'\[\*\*\] \[(\d+):(\d+):(\d+)\] (.+?) \[\*\*\]', line)
            if match:
                alerts.append({
                    'sid': match.group(1),
                    'message': match.group(4),
                    'line': line
                })
    
    # Avvisi principali
    alert_counts = Counter([a['message'] for a in alerts])
    print("Top 10 Alerts:")
    for alert, count in alert_counts.most_common(10):
        print(f"{count:5d} - {alert}")
    
    return alerts

# Utilizzo
alerts = analyze_snort_alerts('/var/log/snort/alert')

# SQL Injection
content:"' OR 1=1--";
content:"UNION SELECT";

# XSS
content:"<script>";
content:"javascript:";

# Command Injection
content:";cat /etc/passwd";
content:"|whoami";

# Directory Traversal
content:"../../../";

# Shellshock
content:"() { :; };";

import hashlib
import os

def hash_password(password):
    # Genera il salt
    salt = os.urandom(32)
    
    # Hash della password con il salt
    key = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        100000  # iterazioni
    )
    
    # Memorizza salt + hash
    return salt + key

def verify_password(stored_password, provided_password):
    salt = stored_password[:32]
    stored_key = stored_password[32:]
    
    key = hashlib.pbkdf2_hmac(
        'sha256',
        provided_password.encode('utf-8'),
        salt,
        100000
    )
    
    return key == stored_key