Perguntas para Entrevista de Engenheiro de Segurança Júnior: Guia Completo

# Código vulnerável
username = request.GET['username']
query = f"SELECT * FROM users WHERE username = '{username}'"
# Ataque: username = "admin' OR '1'='1"

# Código seguro (consulta parametrizada)
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

# Vulnerável: Nenhuma verificação de autorização
@app.route('/admin/users/<user_id>')
def get_user(user_id):
    return User.query.get(user_id)

# Seguro: Verificação de autorização
@app.route('/admin/users/<user_id>')
@require_admin
def get_user(user_id):
    if not current_user.is_admin:
        abort(403)
    return User.query.get(user_id)

<!-- Vulnerável -->
<div>Bem-vindo, {{ username }}</div>

<!-- Ataque -->
username = "<script>alert('XSS')</script>"

<!-- Seguro (escape da saída) -->
<div>Bem-vindo, {{ username | escape }}</div>

# Escaneamento de vulnerabilidades com Nmap
nmap --script vuln 192.168.1.100

# Escaneamento com OpenVAS
openvas-start
# Acessar interface web em https://localhost:9392

# Escaneamento com Nessus (comercial)
# Configurar via interface web

# Automatizar escaneamento com Nessus
import requests
import time

class NessusScanner:
    def __init__(self, url, access_key, secret_key):
        self.url = url
        self.headers = {
            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}'
        }
    
    def create_scan(self, name, targets):
        data = {
            'uuid': 'template-uuid',  # Escaneamento Básico de Rede
            'settings': {
                'name': name,
                'text_targets': targets
            }
        }
        response = requests.post(
            f'{self.url}/scans',
            headers=self.headers,
            json=data,
            verify=False
        )
        return response.json()['scan']['id']
    
    def launch_scan(self, scan_id):
        requests.post(
            f'{self.url}/scans/{scan_id}/launch',
            headers=self.headers,
            verify=False
        )
    
    def get_results(self, scan_id):
        response = requests.get(
            f'{self.url}/scans/{scan_id}',
            headers=self.headers,
            verify=False
        )
        return response.json()

# Uso
scanner = NessusScanner('https://nessus:8834', 'access_key', 'secret_key')
scan_id = scanner.create_scan('Escaneamento Semanal', '192.168.1.0/24')
scanner.launch_scan(scan_id)

# Gerenciamento de patch no Linux
# Ubuntu/Debian
sudo apt update
sudo apt list --upgradable
sudo apt upgrade -y

# CentOS/RHEL
sudo yum check-update
sudo yum update -y

# Patch automatizado
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Rastreamento de vulnerabilidades
class VulnerabilityTracker:
    def __init__(self):
        self.vulnerabilities = []
    
    def add_vulnerability(self, vuln):
        self.vulnerabilities.append({
            'id': vuln['id'],
            'severity': vuln['severity'],
            'asset': vuln['asset'],
            'status': 'open',
            'discovered': datetime.now(),
            'sla_deadline': self.calculate_sla(vuln['severity'])
        })
    
    def calculate_sla(self, severity):
        sla_days = {
            'critical': 7,
            'high': 30,
            'medium': 90,
            'low': 180
        }
        return datetime.now() + timedelta(days=sla_days[severity])
    
    def get_overdue(self):
        return [v for v in self.vulnerabilities 
                if v['status'] == 'open' and 
                datetime.now() > v['sla_deadline']]

# Criptografia simétrica (AES)
from cryptography.fernet import Fernet

# Gerar chave
key = Fernet.generate_key()
cipher = Fernet(key)

# Criptografar
encrypted = cipher.encrypt(b"Mensagem secreta")

# Descriptografar
decrypted = cipher.decrypt(encrypted)

# Criptografia assimétrica (RSA)
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

# Gerar par de chaves
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)
public_key = private_key.public_key()

# Criptografar com chave pública, descriptografar com chave privada

# Visualizar detalhes do certificado
openssl x509 -in certificate.crt -text -noout

# O certificado contém:
# - Subject (nome do domínio)
# - Issuer (CA)
# - Período de validade
# - Chave pública
# - Assinatura

# Gerar chave privada
openssl genrsa -out private.key 2048

# Gerar CSR
openssl req -new -key private.key -out request.csr

# Visualizar CSR
openssl req -text -noout -verify -in request.csr

# Gerar certificado autoassinado
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

# Combinar para uso no servidor
cat cert.pem key.pem > server.pem

# Nginx
server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

# Apache
<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/cert.pem
    SSLCertificateKeyFile /etc/apache2/ssl/key.pem
    SSLCertificateChainFile /etc/apache2/ssl/chain.pem
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

# Ruim: Permite SSLv3, TLSv1.0
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

# Bom: Apenas TLS moderno
ssl_protocols TLSv1.2 TLSv1.3;

# Testar configuração SSL
sslscan example.com
nmap --script ssl-enum-ciphers -p 443 example.com

# Ou usar ferramentas online
# https://www.ssllabs.com/ssltest/

# Verificar expiração do certificado
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | \
    openssl x509 -noout -dates

# Monitorar expiração
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | \
    openssl x509 -noout -enddate

# Instalar certbot
sudo apt install certbot python3-certbot-nginx

# Obter certificado
sudo certbot --nginx -d example.com -d www.example.com

# Auto-renovação (cron)
0 0 * * * certbot renew --quiet

# Testar conexão TLS
openssl s_client -connect example.com:443 -servername example.com

# Verificar cadeia de certificados
openssl verify -CAfile ca-bundle.crt certificate.crt

# Verificar se o certificado corresponde à chave privada
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5
# Os hashes devem corresponder

# iptables (stateful)
# Permitir conexões estabelecidas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Permitir novas conexões SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

# Descartar todo o resto
iptables -A INPUT -j DROP

# Instalar Snort
sudo apt install snort

# Configurar rede
sudo vi /etc/snort/snort.conf
# Definir HOME_NET
ipvar HOME_NET 192.168.1.0/24
ipvar EXTERNAL_NET !$HOME_NET

# Executar em modo IDS
sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

# Executar em modo IPS (inline)
sudo snort -Q -c /etc/snort/snort.conf -i eth0

# Sintaxe da regra
# action protocol src_ip src_port -> dst_ip dst_port (options)

# Detectar injeção SQL
alert tcp any any -> $HOME_NET 80 (msg:"Tentativa de Injeção SQL"; \
    content:"UNION SELECT"; nocase; sid:1000001; rev:1;)

# Detectar port scan
alert tcp any any -> $HOME_NET any (msg:"Port Scan Detectado"; \
    flags:S; threshold:type both, track by_src, count 20, seconds 60; \
    sid:1000002; rev:1;)

# Detectar força bruta SSH
alert tcp any any -> $HOME_NET 22 (msg:"Força Bruta SSH"; \
    flags:S; threshold:type both, track by_src, count 5, seconds 60; \
    sid:1000003; rev:1;)

# Bloquear IP malicioso (modo IPS)
drop tcp 203.0.113.50 any -> $HOME_NET any (msg:"IP Malicioso Bloqueado"; \
    sid:1000004; rev:1;)

# Instalar Suricata
sudo apt install suricata

# Atualizar regras
sudo suricata-update

# Executar Suricata
sudo suricata -c /etc/suricata/suricata.yaml -i eth0

# Visualizar alertas
sudo tail -f /var/log/suricata/fast.log

# Analisar alertas do Snort
import re
from collections import Counter

def analyze_snort_alerts(log_file):
    alerts = []
    
    with open(log_file, 'r') as f:
        for line in f:
            # Analisar alerta
            match = re.search(r'\[\*\*\] \[(\d+):(\d+):(\d+)\] (.+?) \[\*\*\]', line)
            if match:
                alerts.append({
                    'sid': match.group(1),
                    'message': match.group(4),
                    'line': line
                })
    
    # Principais alertas
    alert_counts = Counter([a['message'] for a in alerts])
    print("Top 10 Alertas:")
    for alert, count in alert_counts.most_common(10):
        print(f"{count:5d} - {alert}")
    
    return alerts

# Uso
alerts = analyze_snort_alerts('/var/log/snort/alert')

# Injeção SQL
content:"' OR 1=1--";
content:"UNION SELECT";

# XSS
content:"<script>";
content:"javascript:";

# Injeção de Comando
content:";cat /etc/passwd";
content:"|whoami";

# Directory Traversal
content:"../../../";

# Shellshock
content:"() { :; };";

import hashlib
import os

def hash_password(password):
    # Gerar salt
    salt = os.urandom(32)
    
    # Hashear senha com salt
    key = hashlib.pbkdf2_hmac(
        'sha256',
        password.encode('utf-8'),
        salt,
        100000  # iterações
    )
    
    # Armazenar salt + hash
    return salt + key

def verify_password(stored_password, provided_password):
    salt = stored_password[:32]
    stored_key = stored_password[32:]
    
    key = hashlib.pbkdf2_hmac(
        'sha256',
        provided_password.encode('utf-8'),
        salt,
        100000
    )
    
    return key == stored_key