Enlive is a learning management system (LMS) that delivers an environment for  increasing knowledge ,productivity, creativity and colaboration. It is primarily used by schools and universities. However, due to the COVID-19 pandemic, it has gained popularity with other types of organizations including SMB (small-medium business). We will discuss how we at Oyster Technologies along with our service partners at Vision View International performed penetration testing on Enlive LMS and showcase the various tools used.

Why Do Companies Use Enlive:

Before diving into the Enlive penetration testing, we have to understand why this software is used for, in the first place:

• To train employees and students: As the cyberattacks keep increasing, it is important to make sure the employees know how to recognise basic cyber threats. Also, security awareness is required by GDPR. Enlive is a good fit for providing learning material, and then testing gained knowledge.
• To test employees and students: It can be used for usual business activities. For example, you can provide a fire safety test that each employee has to pass regularly.

Hence, from the perspective of an enterprise, there are many use cases as to how Enlive can be useful. And therefore the reason why the product is popular and is utilized by many organisations.

Enlive: A Security Perspective

Before diving into the analysis of how Enlive can be exploited, it is important to understand the technologies that the software is built with.

Enlive is programmed in C# and built based on the MVC architecture. The backend is based on Microsoft SQL Server. It is a closed source solution and hence the analysis of the source code for vulnerabilities is even important.

From a point of view of cyber security the following points are important to understand:

• Enlive contain personal data – that can be either entered directly when creating an account for the student, employee or might be synchronized from another system such as Active directory.
• If Enlive is exposed publicly, it might become an initial attack vector – hence the security of the software should be taken seriously.

We will cover in this blog how we can perform vulnerability assessment on Enlive.

Enlive Penetration Testing methodology:

The following  tasks were performed during  pentesting of  Enlive:

• Check for known exploits (.net, C#)on the Metasploit database. We can also use Rapid7 InsightVM to check for known vulnerabilities in software and hardware.
• DAST type vulnerability scanning. InsightAppScan was used in this process.
• Use SAST type vulnerability scanning (if you have the source code). We used HCL AppScan.

Conclusion:

As with any other software, Enlive has to be actively maintained. Periodic updates are important, as it prevents the attackers from exploiting publicly known weaknesses in software and hardware although updates won’t protect from the zero-days.