Archive | April, 2013

New eLearnSecurity Course – WAPT – Web Application Penetration Testing

Find your website's Achilles' Heel


eLearnSecurity is coming out with a new course, it’s intended to be a comprehensive training on web application penetration testing with large coverage of the newest attack vectors introduced by HTML5 and other W3C protocols.

Over 40 new labs in the Coliseum cloud based virtual lab are included in the course.

eLearnSecurity

Course Description

The Web Application Penetration Testing course (WAPT) is the online, self paced training course that provides all the necessary advanced skills to carry out a thorough and professional penetration test against modern web applications. Thanks to the extensive use of Coliseum Lab and the coverage of the latest researches in the web application security field, the WAPT course is not only the most practical training course on the subject but also the most up to date. The course, although based on the offensive approach, contains, for each chapter, advices and best practices to solve the security issues detected during the penetration test.

Target Audience & Pre-requisites

The WAPT training course benefits the career of penetration testers and IT Security personnel in charge of defending their organization web applications. This course allows organizations of all sizes assess and mitigate the risk at which their web applications are exposed, by building strong, practical inhouse skills. Penetration testing companies can train their teams with a comprehensive and practical training course without having to deploy internal labs that are often outdated and not backed by solid theoretical material.


The student willing to enroll in the course must possess a solid understanding of web applications and web application security models. No programming skills are required, however snippets of Javascript/HTML/PHP code will be used during the course.

eWPT Certification

eWPT Certification

The WAPT course leads to the eWPT certification. The certification can be obtained by successfully completing the requirements of a 100% practical exam consisting in a penetration test of a real world complex web application hosted in our eLearnSecurity Hera labs.

An eWPT voucher is included in all the plans of the WAPT course.

Get More Info

If you want to read more and see the full Syllabus, you can download this:

http://www.elearnsecurity.com/collateral/syllabus_wapt.pdf

The course will be launching on April 29th and you can register for the launch webinar here:

https://www3.gotomeeting.com/register/571727142


Posted in: Advertorial, General Hacking

Tags: , , , , , , , ,

Posted in: Advertorial, General Hacking | Add a Comment
Recent in Advertorial:
- Defence In Depth For Web Applications
- 13 WordPress Security Tips From Acunetix
- Acunetix WVS 10 Released – Keeping Your Website Secure just got Easier

Related Posts:

Most Read in Advertorial:
- eLearnSecurity – Online Penetration Testing Training - 41,447 views
- Acunetix Web Vulnerability Scanner 6 Review - 15,261 views
- Acunetix WVS (Web Vulnerability Scanner) 7 Review – Engine & Scanning Improvements - 15,084 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Large Scale Botnet Brute Force Password Cracking Against WordPress Sites

Find your website's Achilles' Heel


There have always been a lot of brute force attempts/bot scans and hacking attempts on WordPress hosted sites (due to flaws in the core and a multitude of insecure plugins) – this site being no exception (they’ve even done some minor damage before).

But things appear to have really ramped up recently with a large increase in brute force attacks on WordPress sites. It seems to be the work of a rather crude botnet, which hits up the normal admin username (along with a few others like test/root etc) with a bunch of common passwords. Once it gets in, it leaves a backdoor and adss itself to the botnet – and starts scanning for other victims.

Sucuri have confirmed that the number of brute force attacks in April is double than that of previous months in their blog post here – Mass WordPress Brute Force Attacks? – Myth or Reality

Hosting providers are reporting a major upsurge in attempts to hack into blogs and content management systems late last week, with WordPress installations bearing the brunt of the hackers’ offensive.

WordPress installations across the world were hit by a brute force botnet attack, featuring attempts to hack into installations using a combination of popular usernames (eg, “admin” and “user”) and an array of common passwords. Attacks of this type are commonplace; it is the sharp rise in volume late last week to around three times the normal volume rather than anything technically cunning or devious that has set alarm bells ringing.

The primary target appears to be WordPress installations but Joomla users also reportedly took a bit of a hammering.

Early suggestions are that hackers are looking to harvest “low-hanging fruit” as quickly as possible in order to gain access to a bank of compromised sites for follow-up malfeasance, which could be anything from hosting malware to publishing phishing pages or running some sort of denial of service attack. “It’s doorknob rattling, but on an industrial and international scale,” notes Paul Ducklin, Sophos’s head of technology for Asia Pacific.

This is a large scale attack though, well organized and very well distributed with over 90,000 IP addresses involved. So using something like the WordPress plugin Limit Login Attempts wouldn’t help much – as they are not sending many login requests from each IP address.

Cloudflare have already pushed out a block for this type of attack, both for paying and free customers – so if you’re using that you should be safe. (Patching the Internet in Realtime: Fixing the Current WordPress Brute Force Attack)

If you notice your admin login or blog in general is very sluggish, you might have already been hacked. The outgoing brute force attempts take a lot of server resources.


WordPress founder Matt Mullenweg said that the attack illustrates the need to use a distinct username and a hard-to-guess password, common-sense advice that applies to using web services in general, not just for blog administration.

Olli-Pekka Niemi, vulnerability expert at security biz Stonesoft, outlined the range of possible motives behind the attack.

“A concern of this attack is that by compromising WordPress blogs attackers may be able to upload malicious content and embed this into the blog,” Niemi said. “When readers visit the blogs in question they would be then be subject to attack, come under compromise and develop into botnets. The attacks against the word press blogs seem to be distributed, with automated attacks coming from multiple sources.”

Matt Middleton-Leal, UK & Ireland regional director of corporate security dashboard firm Cyber-Ark, said hacks on corporate blogs might be used as an access point to hack into other (more sensitive) enterprise systems. Weak passwords need to be changed pronto, he argues.

“Common usernames and weak passwords are extremely risky online, however, the dangers are compounded if users re-use the same login credentials for other sites. Once the bad guys have cracked a username and password, it’s extremely common that they’ll attempt to use the same combination for additional sites in the attempt to fraudulently use accounts, or access information such as credit card details or corporate data.

“If WordPress users have been targeted in this attack, they should immediately seek to change their username and password details for their WordPress account, but also for any other accounts for which they use the same credentials,” he added.

There’s not a lot of info going around on what happens after a site has been compromised, in technical terms anyway – so I can’t really comment on that. But if you have decent file permissions, a strong password, you have already deleted the admin user long ago you should be safe.

If you want to add another level, just htpasswd protect your wp-admin directory. That will stop this (and any other similar attacks) dead in it’s tracks.

Stay safe fellow WordPress users.

Source: The Register


Posted in: Password Cracking, Web Hacking

Tags: , , , , , , , , ,

Posted in: Password Cracking, Web Hacking | Add a Comment
Recent in Password Cracking:
- RWMC – Retrieve Windows Credentials With PowerShell
- 123456 Still The Most Common Password For 2015
- LaZagne – Password Recovery Tool For Windows & Linux

Related Posts:

Most Read in Password Cracking:
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,139 views
- Password Cracking Wordlists and Tools for Brute Forcing - 574,982 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 433,578 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


HoneyDrive Desktop v0.2 Released – Honeypot LiveCD

Find your website's Achilles' Heel


HoneyDrive is a virtual appliance (OVA) with Xubuntu Desktop 12.04 32-bit edition installed. It contains various honeypot software packages such as Kippo SSH honeypot, Dionaea malware honeypot, Honeyd low-interaction honeypot, Glastopf web honeypot along with Wordpot, Thug honeyclient and more. Additionally it includes useful pre-configured scripts and utilities to analyze, visualize and process the data it can capture, such as Kippo-Graph, Honeyd-Viz, and much more. Lastly, many other helpful security, forensics and malware related tools are also present in the distribution.

We wrote about HoneyDrive when it first surfaced and was quite unpolished, it’s come a long way since then! Here’s the original post:

HoneyDrive – Honeypots In A Box

The feature set is a lot more complete now, with a whole range of different honeypots available and some useful tools too:

  • Virtual appliance based on Xubuntu 12.04 Desktop.
  • Distributed as a single OVA file, ready to be imported.
  • Full LAMP stack installed (Apache 2, MySQL 5), plus tools such as phpMyAdmin.
  • Kippo SSH Honeypot, plus Kippo-Graph, Kippo2MySQL and other helpful scripts.
  • Dionaea malware honeypot, plus phpLiteAdmin and other helpful scripts.
  • Honeyd low-interaction honeypot, plus Honeyd2MySQL, Honeyd-Viz and other helpful scripts.
  • LaBrea sticky honeypot, Tiny Honeypot, IIS Emulator, INetSim and SimH.
  • A full suite of security, forensics and anti-malware tools for network monitoring, malicious shellcode and PDF analysis, such as ntop, p0f, EtherApe, nmap, DFF, Wireshark, ClamAV, ettercap, Automater, UPX, pdftk, Flasm, pdf-parser, Pyew, dex2jar and more.
  • Firefox plugins pre-installed, plus extra helpful software such as GParted, Terminator, VYM, Xpdf and more.

You can download HoneyDrive v0.2 here:

HoneyDrive_0.2_Nectar_edition.ova

Or read more here.


Posted in: Countermeasures, Forensics, Network Hacking

Tags: , , , , , , , , , ,

Posted in: Countermeasures, Forensics, Network Hacking | Add a Comment
Recent in Countermeasures:
- Cuckoo Sandbox – Automated Malware Analysis System
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,108 views
- Password Hasher Firefox Extension - 117,781 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,727 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95