PCTAMALOU

🔬 Mission pratique – Laboratoire (2 heures)

Scénario : Analyse forensic d'une communication web compromise

Vous devez analyser le trafic web d'une entreprise soupçonnée d'avoir des communications non sécurisées. Votre mission : capturer, analyser et documenter les vulnérabilités.

sudo apt update
sudo apt install -y tcpdump dnsutils curl openssl nmap
# tcpdump: capture réseau
# dnsutils: dig, nslookup
# curl: client HTTP/HTTPS
# openssl: analyse TLS
# nmap: scanning (semaines suivantes)Copier

Étapes détaillées : Analyse complète

1. Analyse DNS approfondie
   Comprenez la résolution DNS en détail :

   echo "=== ANALYSE DNS COMPLÈTE ==="
   
   # 1. Résolution directe
   echo "1. Résolution A record:"
   dig google.com A +short
   
   echo -e "\n2. Tous les records:"
   dig google.com ANY +noall +answer
   
   echo -e "\n3. Résolution récursive complète:"
   dig google.com +trace
   
   echo -e "\n4. Serveurs DNS faisant autorité:"
   dig google.com NS +short
   
   echo -e "\n5. MX records (email):"
   dig google.com MX +short
   
   echo -e "\n6. Analyse avec nslookup:"
   nslookup -type=any google.com
   
   # 7. Test DNSSEC
   echo -e "\n7. Vérification DNSSEC:"
   dig google.com +dnssec +multi | grep -E "(flags:|RRSIG)"
   
   # Sauvegarde
   dig google.com ANY > dns_analysis.txt
   echo "Analyse DNS sauvegardée dans dns_analysis.txt"Copier

2. Capture et analyse HTTP avec tcpdump
   Capturez et analysez le trafic HTTP :

   echo "=== CAPTURE TRAFIC HTTP ==="
   
   # Dans le terminal 1 : Lancez la capture
   echo "Terminal 1 - Capture:"
   echo "sudo tcpdump -i any port 80 -A -c 20"
   echo "Ou mieux, sauvegardez dans un fichier:"
   echo "sudo tcpdump -i any port 80 -w http_capture.pcap"
   
   # Dans le terminal 2 : Générez du trafic
   echo -e "\nTerminal 2 - Génération trafic:"
   echo "curl http://httpbin.org/get"
   echo "curl -X POST http://httpbin.org/post -d 'username=test&password=secret'"
   
   read -p "Appuyez sur Entrée quand c'est fait..."
   
   # Analyse de la capture sauvegardée
   echo -e "\n=== ANALYSE CAPTURE PCAP ==="
   sudo tcpdump -r http_capture.pcap -A 2>/dev/null | head -30
   
   # Filtres avancés
   echo -e "\n=== FILTRES TCPDUMP AVANCÉS ==="
   echo "Requêtes POST uniquement:"
   echo "sudo tcpdump -r http_capture.pcap -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354' 2>/dev/null"
   
   echo -e "\nHeaders HTTP:"
   echo "sudo tcpdump -r http_capture.pcap -A 'port 80' 2>/dev/null | grep -E '(GET|POST|Host:|User-Agent:|Cookie:)'"Copier

3. Analyse HTTP/HTTPS avec curl
   Utilisez curl comme un outil d'analyse :

   echo "=== ANALYSE AVEC CURL ==="
   
   # 1. Headers seulement
   echo "1. Headers HTTP:"
   curl -I http://httpbin.org
   
   # 2. Requête détaillée
   echo -e "\n2. Requête détaillée (verbose):"
   curl -v http://httpbin.org/get
   
   # 3. Test de méthodes HTTP
   echo -e "\n3. Test différentes méthodes:"
   echo "GET:" && curl -X GET http://httpbin.org/get
   echo -e "\nPOST:" && curl -X POST http://httpbin.org/post -d 'test=data'
   echo -e "\nPUT:" && curl -X PUT http://httpbin.org/put -d 'update=data'
   echo -e "\nDELETE:" && curl -X DELETE http://httpbin.org/delete
   
   # 4. Headers personnalisés
   echo -e "\n4. Headers personnalisés:"
   curl -H "User-Agent: PCTAMALOU-Scanner" \
        -H "X-Custom-Header: MyValue" \
        http://httpbin.org/headers
   
   # 5. Analyse HTTPS/TLS
   echo -e "\n5. Analyse TLS:"
   curl -v --tlsv1.3 --tls-max 1.3 https://www.google.com 2>&1 | grep -E "(TLS|SSL|certificate)"
   
   # 6. Test de vulnérabilités
   echo -e "\n6. Test chiffrements faibles:"
   curl --sslv3 https://www.google.com 2>&1 | head -5 || echo "SSLv3 non supporté (bon!)"
   
   # 7. Sauvegarde sortie
   curl -v http://httpbin.org/get > curl_analysis.txt 2>&1
   echo "Analyse curl sauvegardée dans curl_analysis.txt"Copier

4. Analyse TLS avec openssl
   Analysez en détail les configurations TLS :

   echo "=== ANALYSE TLS AVEC OPENSSL ==="
   
   # 1. Test de connexion TLS basique
   echo "1. Connexion TLS:"
   openssl s_client -connect www.google.com:443 -servername www.google.com <<< "Q" 2>/dev/null | head -30
   
   # 2. Informations certificat
   echo -e "\n2. Certificat serveur:"
   openssl s_client -connect www.google.com:443 -servername www.google.com 2>/dev/null /dev/null | grep -i cipher
   
   # 5. Vérification OCSP
   echo -e "\n5. Vérification OCSP (Online Certificate Status Protocol):"
   openssl s_client -connect www.google.com:443 -status 2>/dev/null | grep -A 10 "OCSP"
   
   # 6. Test TLS 1.0/1.1 (dangereux)
   echo -e "\n6. Test versions obsolètes:"
   for version in tls1 tls1_1; do
       echo -n "Testing $version: "
       openssl s_client -connect www.google.com:443 -$version 2>/dev/null /dev/null | \
     grep -E "(TLS|Protocol|Cipher|OCSP|ALPN)" | head -20Copier

5. Script Python d'analyse web automatique
   Créez un outil d'audit professionnel :

   #!/usr/bin/env python3
   """
   PCTAMALOU - Semaine 8 : Analyseur de sécurité web
   Outils pour auditer DNS, HTTP, HTTPS et TLS
   """
   
   import subprocess
   import json
   import re
   import ssl
   import socket
   from datetime import datetime
   from urllib.parse import urlparse
   
   def check_dns(domain):
       """Analyse DNS d'un domaine"""
       results = {'domain': domain, 'records': {}}
       
       try:
           # A records
           cmd = f"dig {domain} A +short"
           output = subprocess.check_output(cmd, shell=True, text=True)
           results['records']['A'] = output.strip().split('\n')
           
           # MX records
           cmd = f"dig {domain} MX +short"
           output = subprocess.check_output(cmd, shell=True, text=True)
           results['records']['MX'] = output.strip().split('\n')
           
           # NS records
           cmd = f"dig {domain} NS +short"
           output = subprocess.check_output(cmd, shell=True, text=True)
           results['records']['NS'] = output.strip().split('\n')
           
           # TXT records
           cmd = f"dig {domain} TXT +short"
           output = subprocess.check_output(cmd, shell=True, text=True)
           results['records']['TXT'] = output.strip().split('\n')
           
           # DNSSEC
           cmd = f"dig {domain} +dnssec +multi | grep -E '(flags:|RRSIG)'"
           output = subprocess.check_output(cmd, shell=True, text=True)
           results['dnssec'] = 'RRSIG' in output
           
       except subprocess.CalledProcessError as e:
           results['error'] = str(e)
       
       return results
   
   def check_http(url):
       """Analyse HTTP d'une URL"""
       results = {'url': url, 'headers': {}, 'security_issues': []}
       
       try:
           import http.client
           from urllib.parse import urlparse
           
           parsed = urlparse(url)
           conn = http.client.HTTPConnection(parsed.netloc, timeout=10)
           conn.request("GET", parsed.path or "/")
           response = conn.getresponse()
           
           results['status'] = response.status
           results['reason'] = response.reason
           
           # Headers
           for header, value in response.getheaders():
               results['headers'][header] = value
           
           # Security checks
           if 'strict-transport-security' not in results['headers']:
               results['security_issues'].append('HSTS non implémenté')
           
           if 'x-frame-options' not in results['headers']:
               results['security_issues'].append('X-Frame-Options manquant')
           
           if 'x-content-type-options' not in results['headers']:
               results['security_issues'].append('X-Content-Type-Options manquant')
           
           conn.close()
           
       except Exception as e:
           results['error'] = str(e)
       
       return results
   
   def check_ssl(domain, port=443):
       """Analyse SSL/TLS d'un domaine"""
       results = {'domain': domain, 'port': port, 'issues': []}
       
       try:
           context = ssl.create_default_context()
           with socket.create_connection((domain, port), timeout=10) as sock:
               with context.wrap_socket(sock, server_hostname=domain) as ssock:
                   cert = ssock.getpeercert()
                   
                   # Certificate info
                   results['certificate'] = {
                       'subject': dict(x[0] for x in cert['subject']),
                       'issuer': dict(x[0] for x in cert['issuer']),
                       'version': cert['version'],
                       'notBefore': cert['notBefore'],
                       'notAfter': cert['notAfter'],
                       'serialNumber': cert['serialNumber']
                   }
                   
                   # SSL/TLS info
                   results['ssl_info'] = {
                       'version': ssock.version(),
                       'cipher': ssock.cipher(),
                       'compression': ssock.compression()
                   }
                   
                   # Security checks
                   import datetime
                   expiry_date = datetime.datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')
                   days_until_expiry = (expiry_date - datetime.datetime.now()).days
                   
                   if days_until_expiry < 30:
                       results['issues'].append(f'Certificat expire dans {days_until_expiry} jours')
                   
                   if 'subjectAltName' not in cert:
                       results['issues'].append('Pas de subjectAltName')
                   
                   # Check for weak protocols/ciphers
                   weak_protocols = ['SSLv2', 'SSLv3', 'TLSv1', 'TLSv1.1']
                   if results['ssl_info']['version'] in weak_protocols:
                       results['issues'].append(f'Protocole faible: {results["ssl_info"]["version"]}')
           
       except ssl.SSLError as e:
           results['error'] = f"SSL Error: {e}"
       except Exception as e:
           results['error'] = str(e)
       
       return results
   
   def analyze_website(url):
       """Analyse complète d'un site web"""
       print(f"🔍 Analyse de {url}")
       print("=" * 60)
       
       parsed = urlparse(url)
       domain = parsed.netloc or parsed.path
       
       # 1. DNS Analysis
       print("\n1. 📞 ANALYSE DNS:")
       dns_results = check_dns(domain)
       if 'error' not in dns_results:
           for record_type, records in dns_results['records'].items():
               if records and records[0]:
                   print(f"   • {record_type}: {', '.join(records[:3])}")
           print(f"   • DNSSEC: {'✅ Actif' if dns_results.get('dnssec') else '❌ Inactif'}")
       else:
           print(f"   ❌ Erreur DNS: {dns_results['error']}")
       
       # 2. HTTP/HTTPS Analysis
       print("\n2. 🌐 ANALYSE HTTP/HTTPS:")
       if url.startswith('http://'):
           print("   ⚠️  ATTENTION: HTTP non sécurisé!")
           http_results = check_http(url)
           if 'status' in http_results:
               print(f"   • Statut: {http_results['status']} {http_results['reason']}")
               if http_results['security_issues']:
                   print(f"   • Problèmes: {', '.join(http_results['security_issues'])}")
       else:
           print("   ✅ HTTPS détecté")
       
       # 3. SSL/TLS Analysis
       print("\n3. 🔐 ANALYSE SSL/TLS:")
       ssl_results = check_ssl(domain)
       if 'ssl_info' in ssl_results:
           print(f"   • Version: {ssl_results['ssl_info']['version']}")
           print(f"   • Cipher: {ssl_results['ssl_info']['cipher'][0]}")
           
           if ssl_results['issues']:
               print(f"   • Problèmes: {', '.join(ssl_results['issues'])}")
           else:
               print("   • ✅ Aucun problème majeur détecté")
           
           # Certificate info
           if 'certificate' in ssl_results:
               cert = ssl_results['certificate']
               print(f"   • Sujet: {cert['subject'].get('commonName', 'N/A')}")
               print(f"   • Émetteur: {cert['issuer'].get('organizationName', 'N/A')}")
               print(f"   • Expire le: {cert['notAfter']}")
       elif 'error' in ssl_results:
           print(f"   ❌ Erreur SSL: {ssl_results['error']}")
       
       # 4. Security Recommendations
       print("\n4. 💡 RECOMMANDATIONS:")
       recommendations = []
       
       if url.startswith('http://'):
           recommendations.append("Passer à HTTPS immédiatement")
       
       if ssl_results.get('issues'):
           recommendations.append("Mettre à jour la configuration SSL/TLS")
       
       if not dns_results.get('dnssec'):
           recommendations.append("Activer DNSSEC")
       
       if not recommendations:
           recommendations.append("Configuration généralement sécurisée")
       
       for i, rec in enumerate(recommendations, 1):
           print(f"   {i}. {rec}")
       
       return {
           'dns': dns_results,
           'ssl': ssl_results,
           'url': url,
           'timestamp': datetime.now().isoformat()
       }
   
   def main():
       print("🌐 PCTAMALOU - Analyseur de sécurité web")
       print("=" * 60)
       
       # Sites de test
       test_sites = [
           'http://httpbin.org',
           'https://www.google.com',
           'https://expired.badssl.com',
           'https://httpbin.org'
       ]
       
       all_results = []
       
       for site in test_sites:
           results = analyze_website(site)
           all_results.append(results)
           print("\n" + "=" * 60 + "\n")
       
       # Export JSON
       with open('web_security_audit.json', 'w') as f:
           json.dump(all_results, f, indent=2, default=str)
       
       print("💾 Rapport exporté: web_security_audit.json")
       
       # Analyse des résultats
       print("\n📊 RÉSUMÉ DE L'AUDIT:")
       http_sites = [r for r in all_results if r['url'].startswith('http://')]
       ssl_issues = [r for r in all_results if r.get('ssl', {}).get('issues')]
       
       print(f"• Sites HTTP non sécurisés: {len(http_sites)}")
       print(f"• Sites avec problèmes SSL/TLS: {len(ssl_issues)}")
       
       if http_sites:
           print("⚠️  ACTION REQUISE: Sites HTTP détectés!")
           for site in http_sites:
               print(f"   - {site['url']}")
   
   if __name__ == "__main__":
       main()Copier