Belajar Red Team Operator - Zero Trust Evasion & Testing

#Pendahuluan

Setelah di episode 17 kita mempelajari metrics & maturity red team — mengukur efektivitas dan maturity model — pada episode ini kita masuk ke zero trust testing: bagaimana menguji Zero Trust Architecture (ZTA) yang menjadi standar keamanan modern.

Zero trust berarti "never trust, always verify" — setiap request harus terotentikasi dan terotorisasi, terlepas dari lokasinya. Red team harus memahami cara kerja zero trust untuk bisa mengujinya secara efektif.

#Zero Trust Concepts

#Principles

text

Zero Trust Principles
=======================
1. Verify explicitly: authenticate & authorize semua request
2. Least privilege: akses minimal yang diperlukan
3. Assume breach: minimalisasi blast radius
4. Microsegmentation: network divided ke small zones
5. Continuous verification: tidak cukup sekali login

#Components

Component	Fungsi	Testing Focus
Identity Provider (IdP)	Autentikasi	Credential abuse, token theft
Policy Engine	Keputusan akses	Policy bypass, logic flaws
Policy Enforcement	Implementasi keputusan	Bypass controls
Device Trust	Postur device	Device spoofing
Network	Microsegmentation	Lateral movement

#Zero Trust Testing Methodology

#Assessment Framework

text

Zero Trust Assessment
=======================
1. Map zero trust architecture
   - Identify all enforcement points
   - Map trust relationships
   - Document policies
 
2. Test identity controls
   - MFA bypass attempts
   - Token/session attacks
   - Credential stuffing
 
3. Test policy enforcement
   - Policy bypass attempts
   - Logic flaws in policy engine
   - Time-of-check vs time-of-use
 
4. Test microsegmentation
   - Lateral movement attempts
   - Network segmentation validation
   - East-west traffic monitoring
 
5. Test device trust
   - Device posture spoofing
   - Certificate-based auth bypass
   - Compliance check bypass

#Attack Vectors

Vector	Technique	Target
Identity compromise	Token theft, session hijack	IdP
Policy bypass	Logic manipulation	Policy engine
Device spoofing	Fake posture attestation	Device trust
Microsegmentation bypass	Encrypted tunneling	Network
API abuse	Direct API calls	Service mesh

#Zero Trust Bypass Techniques

#Identity Bypass

bash

# Token theft (from compromised device)
# DPAPI → extract browser tokens
# Or token injection via AADInternals
 
# Session hijacking
# Steal session cookies from browser
# Replay session tokens
 
# MFA fatigue
# Repeated push notifications until user approves

#Policy Bypass

text

Policy Bypass Techniques
==========================
1. Race condition: concurrent requests
2. Input manipulation: modify policy attributes
3. Logic flaws: incorrect policy evaluation
4. Time-of-check: action between check and enforce

#Microsegmentation Bypass

bash

# Encrypted tunnel through allowed protocol
# DNS tunneling through DNS firewall
# HTTPS tunnel through web proxy
# ICMP tunneling through monitoring gap
 
# Example: DNS tunneling
dnscat2 server attacker_domain
# Tunnel internal traffic via DNS queries

#Testing Tools

Tool	Purpose
BloodHound	Map trust relationships
Certify/Certipy	Test certificate-based auth
ROADtools	Azure AD exploration
AADInternals	Azure AD testing
ZAP/Burp	API policy testing

bash

# Test Azure AD zero trust
roadrecon auth -u user@tenant.com -p password
roadrecon gather
roadrecon gui  # Visual attack path mapping

Note

Zero trust testing membutuhkan pemahaman mendalam tentang arsitektur identity provider (Azure AD, Okta) dan policy engine. Mulai dengan memahami bagaimana zero trust bekerja sebelum mencoba mengujinya.

#Praktik: Zero Trust Lab

bash

# 1. Setup zero trust lab (Azure AD + Conditional Access)
# 2. Map enforcement points
# 3. Test: identity bypass attempts
# 4. Test: policy bypass attempts
# 5. Test: lateral movement (microsegmentation)
# 6. Document: gaps ditemukan

#Penutup

Inti yang harus dibawa pulang:

Zero trust principles: verify explicitly, least privilege, assume breach.
Testing framework: map architecture → test identity → test policy → test segmentation.
Bypass techniques: token theft, policy manipulation, device spoofing, tunneling.
Tools: BloodHound, ROADtools, AADInternals.

Di episode 19 selanjutnya, kita akan mempelajari supply chain & third-party risk — simulasi supply chain compromise dan third-party risk assessment.