Attacking an ERP with Open Source Software

Authors

  • Esteban Crespo Universidad de Azuay https://orcid.org/0000-0002-3061-9045
  • Fabian Carvajal Universidad del Azuay
  • Catalina Astudillo Universidad del Azuay
  • Marcos Orellana Universidad del Azuay
  • Rosalva Vintimilla Universidad del Azuay
  • Juan Pablo Carvallo Universidad del Azuay

DOI:

https://doi.org/10.29019/enfoqueute.v9n1.253

Keywords:

Pentesting, IT Security, Hacking, ERP, APEX

Abstract

Information security is a growing concern in companies and organizations, being even higher when linked to financial platforms where sensitive information exists. This article explains the techniques used in the pentesting performed on the ERP software developed in APEX 5 by the University of Azuay. To achieve this goal, six stages has been considered for perform a penetration test: I) Conceptualization, where is defined the scope of the tests to be performed. II) Preparation of the laboratory, which identifies some of the tools used to initiate the safety tests. III) Obtaining of information, where the possible objects are recognized and scanned in greater depth to identify intrinsic characteristics for subsequently exploit them. IV) Analysis of the vulnerabilities found in the previous stage. V) Exploitation of vulnerabilities; and VI) post-exploitation, a stage that contemplates the destruction of evidence of the attack and the conservation of the connection and the accesses obtained to extract information. All these stages were carried out within the facilities of the “Universidad del Azuay”, considering the development environment in which this software is currently located.

Downloads

Download data is not yet available.

References

Alcides, G. (2009). Seguridad informática. Antioquía, Colombia: Universidad de Antioquía.
Caballero, A. (2015). Hacking con Kali Linux. Lima.
Chakrabarti, S., Chakraborty, M., & Mukhopadhyay, I. (2010). Study of snort-based IDS. ACM, 43-47.
Crespo, E. (15 de 01 de 2017). ECU@Risk. Metodología de Seguridad de la información para la gestión del riesgo informático aplicable a MPYMES. Cuenca, Azuay, Ecuador.
Gallo, F. (2011). Inseguridad Informática. España.
Hernández, A. (2007). Fuzzing para pruebas de seguridad en software. brainoverflow.org.
Mansoor, A., Muthuprasanna, M., & Vijay, K. (2006). High Speed Pattern Matching for Network IDS/IPS. IEEE Xplore.
Microsoft. (2017). SDL Threat Modeling Tool. Obtenido de https://www.microsoft.com/en-us/sdl/adopt/threatmodeling.aspx
NMAP. (19 de 04 de 2017). Resumen de Opciones. Obtenido de https://nmap.org/man/es/man-briefoptions.html
Rocha, L. (29 de Mayo de 2014). Count Upon Security. Obtenido de Incident Handling and Hacker Techniques: https://countuponsecurity.com/2014/05/29/simple-and-practical-attack-part-2/
Security, O. (2017). Kali Tools. Recuperado el 31 de 07 de 2017, de https://tools.kali.org/tools-listing
Spendolini, S. (2016). Expert Oracle Application Express Security. Apress.
Stallman, R. (2004). Software libre para una sociedad libre. Madrid: Traficantes de sueños.
The OWASP Project. (2017). OWASP Testing Guide 4.0. N/E: The OWASP Project.
UNAM-CERT. (25 de Mayo de 2016). Aspectos Básicos de la Seguridad en Aplicaciones Web. Recuperado el 14 de 07 de 2017, de https://www.seguridad.unam.mx/historico/documento/index.html-id=17
University of Adelaide. (2015). The Risk Management Handbook. Sydney: Legal and risk.
Weidman, G. (2014). Penetration Testing, A Hands-On Introduction to Hacking (1). EEUU: No Starch Press.

Downloads

Published

2018-03-30

How to Cite

Crespo, E., Carvajal, F., Astudillo, C., Orellana, M., Vintimilla, R., & Carvallo, J. P. (2018). Attacking an ERP with Open Source Software. Enfoque UTE, 9(1), pp. 138 – 148. https://doi.org/10.29019/enfoqueute.v9n1.253

Issue

Vol. 9 No. 1 (2018)

Section

Computer Science, ICTs

License

The articles and research published by the UTE University are carried out under the Open Access regime in electronic format.  This means that all content is freely available without charge to the user or his/her institution. Users are allowed to read, download, copy, distribute, print, search, or link to the full texts of the articles, or use them for any other lawful purpose, without asking prior permission from the publisher or the author. This is in accordance with the BOAI definition of open access. By submitting an article to any of the scientific journals of the UTE University, the author or authors accept these conditions.

The UTE applies the Creative Commons Attribution (CC-BY) license to articles in its scientific journals. Under this open access license, as an author you agree that anyone may reuse your article in whole or in part for any purpose, free of charge, including commercial purposes. Anyone can copy, distribute or reuse the content as long as the author and original source are correctly cited. This facilitates freedom of reuse and also ensures that content can be extracted without barriers for research needs.

 

This work is licensed under a Creative Commons Attribution 3.0 International (CC BY 3.0).

 

The Enfoque UTE journal guarantees and declares that authors always retain all copyrights and full publishing rights without restrictions [© The Author(s)]. Acknowledgment (BY): Any exploitation of the work is allowed, including a commercial purpose, as well as the creation of derivative works, the distribution of which is also allowed without any restriction.