[Music] what's going on everyone in this video
I've done a bit of an experiment to see how good cheap freelance penetration
testers actually are what's the value for money so I've hired some seriously
cheap ones I've got three under $15 penetration tests on a website so let's
see how good they actually are so to start this experiment I needed to make a
vulnerable website so I made a wordpress website called she travels with a
premise that it's gonna be my blog for a woman called Emma so I need this to make
this vulnerable to something something for the test is defined so it doesn't
have HTTPS I've made the SSH password very weak so this could be brute forced
I put a vulnerable WordPress plug-in which was theme grow it's a recent
runnable plug-in I've made the MySQL database accessible to the Internet and
also have a weak password and last but not least I've made a directory or a
file sorry after a page called s2 and it has cross-site scripting and also the
ability to gain a reverse shell into the box so I was hoping the penetration
testers would be able to find this it's easily accessible with something like Dr
Buster so to find these freelance penetration testers I use the website
called Fiverr are literally typed in penetration testing and this brought up
hundreds of penetration testers that I could go through a few terrible images
later I found my penetration testers that I wanted to use so I basically said
I'd like you to test my website for any vulnerabilities I've had trouble in the
past with my wordpress being hacked so I've set up a new WordPress but before I
add any content I want to ensure it's safe so it can't be hacked so I bought a
domain called try hack me so I know it's kind of obvious but can you please test
this for me kind regards Emma hello I'm Emma so the first one shows fifteen
dollars advanced penetration testing domain a DDoS protection database
penetration detailed documentation yeah sure why not
I'll order that the next one $5.00 yeah sure not much information but let's
have a look okay more information some few bits from the eyewash top ten
doesn't look too bad so yeah sure I'll go ahead and order that the next one
fifteen dollars again standard web site testing vulnerability exploitation bug
hunting report recommendations sounds good looking in a description ethical
hacker services include bug hunting SQL injection XSS o top ten deep crawled and
analysis whatever that is high detection rate low false positives sounds pretty
good for fifteen dollars I'll go for that
so communications now start to come in from the testers the five-dollar tester
asked me to remove IP restrictions so did one of the fifteen dollar testers I
obviously said no because it's a development website and only want myself
and them it's a via to access the website so give me your IP addresses and
I'll whitelist you I had to actually ask the five dollar tester to see if he's
actually started yet because he didn't tell me it turns out he's got a dynamic
IP address which means it changed and he couldn't access the website but again he
didn't tell me this so I thought it was more hassle than it was worth trying to
whitelist him so for this test I just allowed the firewall so pretty bad
practice on his part the fifteen dollar tester said yeah this is fine to
whitelist my appear dress but I can only use manual tools and not private tools
whatever that means he also said he can install security so
I mean that's an interesting one later on he said that he's found a
vulnerability in the web site and it needs deep analysis so allow this IP
address so I had a look at what that IP was and it turns out it's a third party
WordPress scanner website so I mean this isn't great practice to be using my
website on this you should be doing things manually but um yeah
not great after this he tells me he's found a C surf on ur ability that can
redirect to my sites of spam it can blacklist me from Google and attacker
can assume a backdoor I mean this is a very interesting way to tell someone
they've got a C surf the second 15-dollar tester initially asked me if
the website was staging or testing this is something you commonly asked when
you're doing web application assessments so this is good
I got his IP address whitelist it and he was well on his way
to doing the testing quite quickly he came back to me with a vulnerability
it was the MySQL database weak password and accessible publicly so I thought
this guy was gonna find everything I thought he's found the low-hanging fruit
here he's gonna go on to find everything else as well that wasn't actually the
case this was the only communication that he sent me which is quite
disappointing and then I got a report after this so you know it wasn't
actually as good as I expected it so let's take a look at the pen tester
reports the first one was the five dollar report I got so you've got some
obvious information here that any penetration tester will probably provide
which is the website that IP address what WordPress version is being used
WordPress spelt wrong and the FEMA newsflashes
bit of description about what's going on so the first finding not using HTTPS
good finding this is something I wanted them to find so I'm happy with that
second finding website is vulnerable to DDoS slow loris attacks not true I'm
using CloudFlare as a CDN so that's protecting me against DDoS so that is
not a true finding he's probably just using a tool that's told him that is
true but actually it's not we don't have any other vulnerabilities and all
plugins are not vulnerable well that's not true because I've got a vinyl plug
in there what actually allow you to do my website so you didn't find that next
finding to increase security change website logging admin panel from WP
admin to admin I mean that's a terrible recommendation really I mean if anyone
just does a directory brute-forcing on your website they will find slash admin
straightaway if you really want to do this you want to just make a a random
string that won't be in a directory busting word list although I wouldn't
really recommend this anyway why I would recommend is actually what he recommends
next which is to put two-factor authentication on so although they might
find the directory and they might gain the password they still need another
factor to log in so that's a good recommendation although overall I
wouldn't say it's a great recommendation the next thing is you need to install a
wordpress security plug-in all-in-one WordPress secure
while always a good one yeah you can do that you can also do wordfence yeah I
mean it's a good recommendation but I mean overall I'd say the report looks
pretty bad and the recommendations are amazing and they obviously haven't found
all of my my security problems in the website that I set out so although it's
found the HTTPS really in the grand scheme of things that's that is nothing
it's just encryption and yeah when you can get a reverse show and XS and things
like that it's kind of not great so it's five dollars what do you expect I
suppose but you should really shouldn't be doing penetration tests if this is
going to be your output so next up we'll look at one of the $15 ones so first of
all testing results and recommendations for try hack me DDoS protection so Ike
looks good and his DDoS protected so already this counter is the last guy
because this guy says we have the English protection the last guy says
that don't so this is the difference in five dollars and fifteen dollars it
seems add HTTP so that's two people that have found this now so that's good so
that's that's one good finding that both are found not vulnerable to XSS now this
is an interesting one because why would he not say not
vulnerable to sqli or xse or other Aiwass top ten type things or other
injection attacks why specifically has he said XSS interesting weak database
protection so I thought I thought this guy was gonna find everything because
very quickly he found that the MySQL database was on the internet and it had
a weak password so I thought yeah this guy was gonna be pretty good so he's
gonna go straight out there find everything and it's gonna be a really
good pen test for $15.00 I mean this is the only thing he really found so it
didn't work out that way but he did provide recommendations here to to not
have a weak password and take it off the internet so that's that's quite good
avoid over usage over-usage of were WooCommerce I mean a lot of websites use
WooCommerce it's a very very big commercial
car software for WordPress so although yeah it does have a lot of
vulnerabilities out there as long as you keep it patched it's probably not much
of an issue you know zero days exists yeah I suppose yeah no I'll give him
it's an informational risk so it's probably worth adding in there but I
mean overall that the report isn't great it's in a notepad file for a start but
for $15 again can I really expect him to find everything he found the one of the
biggest low-hanging fruits there was so that's something and finally the last
$15 pen test report first and foremost your WordPress website is run bought to
attack imminently scary in red font conclusion we have good indication that
your site is vulnerable and can be exploited by attackers or malware boss
some scary report this I mean I'm guessing it's a PDF of a PowerPoint
presentation because that's what it looks like so let's see we've got
WordPress vulnerability my software shows that the vulnerability in your
WordPress file there isn't okay so that this is vulnerable apparently secure
okay I'm gap secure solutions yeah this is what we want we want solutions I
don't need any information on solutions update the theme it is up to date my
software shows the vulnerability in your WordPress file URL well no because
WordPress is up to date so I don't need any of this it's fine I think this guy
is obviously just use the scanner and not verified the output recommendations
okay this is what we need I don't need a solution I need the recommendations make
sure you're plugging the themes are up to date the themes up today I've got a
vulnerable plugin but you've clearly not found that if it's possible kindly
change permission of your WP config file to seven seven seven two six four four
so that he's saying basically don't make the WP config file available to everyone
in your Linux directory only make the root user and people allowed to access
it I mean it's actually set to six four four not seven seven seven so
this recommendation is irrelevant it doesn't need to be put there and he
wouldn't have been able to see this anyway so I'm not really sure why this
is a recommendation always use wordfriends plugin okay again yeah it's
a recommendation to use a security plug-in it's a good recommendation but I
mean overall the report hasn't actually found anything so for $15 all I've got
is I can't even call it a pre report really can I so I don't really got much
for $15 here I'd say the $5 guy was actually better
what can you take away from this really well by cheap you're gonna get cheap
very evidently make sure your penetration testers are certified you
know there's a reason why companies have to be accredited there's a reason why
their penetration testers have to do exams and be certified they need to be a
certain level or penetration tester gain a certain level of knowledge to actually
be able to do this stuff or essentially this is going to be the output you're
gonna get kind of bad reports that don't actually find anything even though the
website has the ability to upload a reverse share or gain XSS or you know
various other things that these people haven't found I mean it has a plug in
which you'd be able to enumerate that would allow you to actually delete the
website so now that no one's found this and it's it would have been simple to
find you could have just brute force of directories with Dr Buster and that
would have found the s2 PHP and that would allow you to get the excess and
the reverse shell and all that so nobody seems to have done that but again I
suppose what can you expect for $15 but that really raises the question should
these people be selling $15 pen tests if they're just gonna say yes you're secure
or just give you know basically null recommendations it's they're basically
just gone is really I mean I'm not here to flame people and that's why I'm not
showing their names but it's just not good I hope you guys have been
interested in this little experiment I think we found that you buy cheap you're
gonna get cheap is it the bottom line here and always go for accredited people
it's gonna be expensive but you are gonna get your
for money and that's kind of what you need you know you want to be secure be
secure don't just be a tech tick box exercise make sure your entities are
secure but anyway thanks for watching guys it's been an interesting experiment
give us a like and subscribe and preciate it