Advice on Penetration testing. reddit / selfhosted ---------------------------------------------------------------------- Genubath 路 2023-11-02 20:49 I would like to increase my confidence in the security of my homelab by doing some penetration testing and I'd like some advice on where to start with that as well as help spotting any holes I might have. I have some services hosted as subdomains on a domain I have (service.domain.com) which is accessed through a clouflare tunnel. All http traffic is redirected to https and I get my certs through letsencrypt. Outbound traffic goes through a VPN. On Cloudflare, I block traffic that isn't from my country and have all of their security settings turned on. I also use fail2ban with my reverse proxy (linuxserver's swag). I use authelia as my SSO. ---------------------------------------------------------------------- emprahsFury 路 2023-11-02 22:34 LockMart: All the homies love the Cyber Kill Chain^庐 ---------------------------------------------------------------------- Ike_8 路 2023-11-03 01:09 Your on the right track!! Knowing what you have running is harder than it seems 馃ゲ馃槄馃槀 ---------------------------------------------------------------------- skyrunner15 路 2023-11-03 02:42 I immediately read this without the word "testing" in the subject. Oh my. ---------------------------------------------------------------------- bucksnort2 路 2023-11-03 03:00 Run nmap and openVAS scans on your network. Nmap will tell you which ports are open and openVAS will tell you what you are vulnerable to. To test fail2ban, you can set up a simple brute force attack with hydra against your services. If you鈥檙e running a hypervisor of some sort (proxmox, ESXi, etc.), you can install Kali Linux, Parrot OS, BlackArch, or create a vm and install all the tools you need. You can also set up an IDS (Intrusion Detection System). I use Wazuh at work (open source IDS/SIEM) and have agents deployed on production servers and VMs. This looks at logs and can be configured to send alerts if certain conditions are met. You can also specify specific logs/files to collect on each agent and set up custom decoders and rules to trigger on anything you want. ---------------------------------------------------------------------- Genubath 路 2023-11-03 03:35 ( 汀掳 蜏蕱 汀掳) ---------------------------------------------------------------------- Genubath 路 2023-11-03 04:37 Thank you, that is helpful! Is Wazuh able to send alerts via Prometheus? ---------------------------------------------------------------------- bucksnort2 路 2023-11-03 05:25 I鈥檝e never done that, but I don鈥檛 see why not. I know you can integrate it with Teams using webhook integrations and a custom Python script. You鈥檇 have to look up Prometheus and Wazuh integrations. ---------------------------------------------------------------------- [deleted] 路 2023-11-29 10:12 [removed] ---------------------------------------------------------------------- Wonderful_Fennel6439 路 2023-12-04 05:43 Try to check their website for [https://www.vertexcybersecurity.com.au/penetration- testing/](https://www.vertexcybersecurity.com.au/penetration-testing/)