Dynamic, Black Box Testing on the Portmap Client
BeSTORM is the most efficient, enterprise ready and automated dynamic testing tool for testing the security of any application or product that uses the Portmap Client.
The port mapper (rpc.portmap or just portmap, or rpcbind) is an Open Network Computing Remote Procedure Call (ONC RPC) service that runs on network nodes that provide other ONC RPC services. Version 2 of the port mapper protocol maps ONC RPC program number/version number pairs to the network port number for that version of that program. When an ONC RPC server is started, it will tell the port mapper, for each particular program number/version number pair it supports for a particular transport protocol (TCP or UDP), what port number it is using for that particular program number/version number pair on that transport protocol. Clients wishing to make an ONC RPC call to a particular version of a particular ONC RPC service must first contact the port mapper on the server machine to determine the actual TCP or UDP port to use.
Versions 3 and 4 of the protocol, called the rpcbind protocol, map a program number/version number pair, and an indicator that specifies a transport protocol, to a transport-layer endpoint address for that program number/version number pair on that transport protocol. The port mapper service always uses TCP or UDP port 111; a fixed port is required for it, as a client would not be able to get the port number for the port mapper service from the port mapper itself. The port mapper must be started before any other RPC servers are started. The port mapper service first appeared in SunOS 2.0.
The port mapper service was discovered to be used in Distributed Denial of Service (DDoS) attacks and Distributed Reflective Denial of Service (DRDoS) attacks in 2015. By using a spoofed port mapper request, an attacker can amplify the effects on a target because a portmap query will return many times more data than in the original request.
BeSTORM specializes in black box testing the reliability of any hardware or software that uses this transport protocol as well as ensuring the function and security of its implementation.
By intelligently testing up to billions of combinations of dynamically generated input, BeSTORM ensures the security and reliability of your products prior to deployment. It is also used around the world by government and industry certification centers to ensure that products are secure before purchase and deployment.
Unlike static testing tools, BeSTORM does not require source code and can therefore be used to test extremely complicated products with a large code base. In comparison static source code testing tools must have access to the source code and testing very large code bases can be problematic. BeSTORM also reduces the number of false positives by reporting only actual successful attacks.
BeSTORM uses an approach known as Smart Fuzzing, which prioritizes the use of attacks that would likely yield the highest probably of product failure. These methods of testing are unique compared to older generation tools that use a fixed number of attack signatures to locate known vulnerabilities in products.
In addition, BeSTORM can also be used to test proprietary protocols and specifications (textual or binary) via its Auto Learn feature. This results in a full featured, versatile, and efficient tool that can help your QA team ensure the reliability and security of your software development project.