Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

07 August 2006 | 11,858 views

Wapiti – Web Application Scanner / Black-box testing

Don't let your data go over to the Dark Side!

Wapiti allows you to audit the security of your web applications.

It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti can detect the following vulnerabilities :

  • File Handling Errors (Local and remote include/require, fopen, readfile…)
  • Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
  • XSS (Cross Site Scripting) Injection
  • LDAP Injection
  • Command Execution detection (eval(), system(), passtru()…)
  • CRLF Injection (HTTP Response Splitting, session fixation…)

Wapiti is able to differentiate ponctual and permanent XSS vulnerabilities. Wapiti prints a warning everytime it founds a script allowing HTTP uploads. A warning is also issued when a HTTP 500 code is returned (useful for ASP/IIS). Wapiti does not rely on a vulnerability database like Nikto do. Wapiti aims to discover unknown vulnerabilities in web applications. It does not provide a GUI for the moment and you must use it from a terminal.

Efficiency

Wapiti is developed in Python and use a Python library I made called lswww. This web spider library does the most of the work.
Unfortunately, the html parsers module within Python only works with well formated html pages so lswww fails to extract informations from bad-coded webpages.

You can read more here:

Wapiti

Advertisements



04 August 2006 | 4,806 views

419 Scammers Duplicate Interpol Site

Scammers are getting more inventive and so it seems more technically advanced. They have actually duplicated the Interpol site to dupe people.

419 advanced fee scammers have created an exact copy of the Interpol website, which is expected to be used to dupe victims into believing they are dealing with the real International Criminal Police Organisation.

A spokesman for Ultrascan Advanced Global Investigations, a Netherlands-based firm which has been studying 419 matters since the mid 90s, says Interpolglobal is “the best scam site we’ve seen so far. They’ve totally looted the original Interpol site, by taking 200 megabytes or so of content and copied it to a remote server”.

They have totally ripped it.

The fake site is http://www.interpolglobal.com/

The website – registered last December by “Interpol” based in “London, Beijing, GB” – went up last week, but removing it won’t be easy as it is running from a server in China.

“419 scammers now include people with PhDs, well capable of creating good looking websites and running them from bullet proof servers,” says Frank Engelsman of Ultrascan.

The real Interpol has already responded to the new site.

“Interpol would like to draw your attention to a series of recent email scams sent to members of the public using the Interpol name,” the organisation warns.

Interesting stuff.

Source: The Register


03 August 2006 | 4,475 views

eEye Duster – Dead/Uninitialized Stack Eraser

Duster is the Dead/Uninitialized Stack Eraser, an injectable DLL that causes uninitialized stack and heap memory in its host process to be wiped over with a specific value. It is intended as a crude tool to assist in the run-time discovery of uninitialized memory usage problems by increasing the chances that the host process will raise an exception when a value in uninitialized memory is used. To use Duster, just inject it into the target process (using the DLLInject utility), or add it to AppInit_DLLs (possible but not recommended).

Duster is a quick and dirty implementation of its concept, and as such, it has a number of limitations:

Stack wiping is accomplished by overwriting all memory between the stack commit “ceiling” and ESP, whenever RtlAllocateHeap, RtlReAllocateHeap, or RtlFreeHeap is called, an exception occurs, or a system call is dispatched, which seriously limits the execution flow “granularity” with which stack wiping occurs. Additionally, system call dispatch hooking is accomplished by replacing specific “INT 2Eh” or “MOV EDX, 7FFE0300h” instructions, the first of which currently relies upon a two-byte privileged instruction which is handled specially by the exception handler hook, resulting in some overhead but mostly making it difficult to use a debugger in conjunction with Duster on Windows 2000.

Heap wiping, in addition to a limited amount of heap and argument validation, is performed whenever a heap block is allocated or freed. This is roughly a subset of the functionality provided by the Windows heap manager in debug mode, with the most significant deficiency on Duster’s part being that it does not wipe memory following a call to RtlReAllocateHeap.

You can download here:

Duster


02 August 2006 | 7,185 views

eEye Binary Diffing Suite (EBDS)

The eEye Binary Diffing Suite (EBDS) is a free and open source set of utilities for performing automated binary differential analysis. This becomes very useful for reverse engineering patches as well as program updates.

The first tool is BDS, the Binary Diffing Starter from Andre Derek Protas. This tool helps reverse engineers with batch-analysis of patches by dispatching IDA with its many powerful plugins against groups of binaries. This especially comes in useful for Update Rollups or Service Packs, where automation is necessary to be able to reverse engineer the updates in a reasonable amount of time.

The second tool is DarunGrim, a code-analysis tool to actually find the distinct code-changes between two binaries. In Korean, DarunGrim translates to “difference in picture”. DarunGrim performs multiple matching techniques against functions in order to find function pairs and analyze the differences/similarities between the functions.

This allows reverse engineers to pinpoint code changes between two binaries with a graphical interface, much more rapid than “side-by-side” disassembly instances. Much like most powerful disassembly tools, DarunGrim is also using the power of IDA Pro for analysis.

You can download it here:

EBDS v1.0.1

More info here, IDA.


02 August 2006 | 14,354 views

Firefox Extension Spyware – FormSpy

The antivirus specialists at McAfee have warned of a Trojan that disguises itself as a Firefox extension. The trojan installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks.

It then begins intercepting passwords and credit card numbers entered into the browser, which it then sends to an external server. The most dangerous part of the issue is that it records itself directly into the Firefox configuration data, avoiding the regular installation and confirmation process.

The file attached to the email consists of an executable Windows program, the AXM downloader. Once launched, it fetches the extension from the Internet and records itself directly into the Firefox configuration data, avoiding the regular installation process. Firefox extensions are normally distributed as XPI files, which ask the user for confirmation after forcing a pause of several seconds.

You should be extremely careful when installing unsigned Firefox extensions from unknown sources.

Websites were found to be linking to the FormSpy website hosted at IP address 81.95.xx.xx and installing FormSpy using an old VBS/Psyme exploit targeting Internet Explorer. These websites are believed to have been penetrated and modified by hackers

You can read the McAfee info on Formspy here.

Source: Heise Security


01 August 2006 | 12,037 views

Israeli Hackers Join the War Against Palestinian Sites

Israeli hackers have decided to ‘help’ and join the war against Palestine.

The hackers group that calls itself “IDF” (which also means Israeli Defence Force) has hacked dozens of sites, erased the site content and replaced it the index with a picture of the Lebanon destruction that is made by Israeli Defence Force as an answer for the Palestinian terror in the past few days.

Above the picture they left a text saying “You touch Israel, We touch you”

Israel Hack

All Your Middle East Are Belong To US?

Source: http://livewavecam.com/hackedsited.htm


01 August 2006 | 14,207 views

SpikeSource Spike PHP Security Audit Tool

Spike is an Open Source tool based on the popular RATS C based auditing tool implemented for PHP.

The tool Spike basically does static analysis of php code for security exploits, PHP5 and call-time pass-by-reference are currently required, but a PHP4 version is coming out this week.

This tool is especially welcomed by Darknet as there aren’t many static analysis tools out there that are free, and there are very few tools for auditing PHP code..which as we all known tends to be coded quite insecurely at times (just look at phpBB and PhpNUKE).

You can find the latest version here:

Spike PHP Audit Tool


31 July 2006 | 6,411 views

WordPress 2.0.4 Released – Fixes Security Issues

Just to let you all know, if you are using WordPress you can upgrade today.

The latest stable release of WordPress (Version 2.0.4) is available.

his release contains several important security fixes, so it’s highly recommended for all users. We’ve also rolled in a number of bug fixes (over 50!), so it’s a pretty solid release across the board.

Also fixes for the serious SQL vulnerabilities that led to several WordPress sites being hacked.

Upgrading is fairly simple, just overwrite your old files with the latest from the download. If you’d like more thorough instructions, the Codex is always the best spot.

Since this is a security release, if you have any friends with blogs make sure to remind them to upgrade and lend a hand if they’re not too savvy. We’re all in this together.

As we reported here at Darknet, there was some serious security issues in 2.0.3 and below so it’s recommended you upgrade immediately.


30 July 2006 | 5,926 views

Netscape.com HACKED With Cross Site Scripting (XSS) Vulnerability

Netscape.com has been hacked via a persistent Cross Site Scripting (XSS) vulnerability in their newly launched Digg-like news service.

It seems the attacker did report the flaw to them repeatedly but they didn’t heed and ignored it, so he performed the XSS all over the site.

eplawless stated the following:

It was me. I did it. C’est moi, etc. This was in response to my having reported the month and a half old vulnerability to Netscape over a week ago. They ignored me. I reported it again, multiple times; they continued to ignore. I posted a few stories on their site, which made it to the front page and were deleted. I made the decision, in response to the recent Rose/Calacanis debacle, to add a benign script to the site that everyone would see and recognize as a compromise of security because this vulnerability is serious and they were not taking it as such. They had this coming; this isn’t a juvenile prank, and is only marginally retaliation against Calacanis for being a twit. This is making sure their users don’t get hacked too.

The guy made use of a fairly simple XSS vulnerability to inject their own javascript code snippets into pages on the website, including the homepage. As of now, it has only been used to display javascript alerts with “comical” messages and to redirect visitors to Digg.com!

Luckily nothing malicious has been done and the users aren’t at risk, as far as we know anyhow..

You can see the screenshots of the hacked JavaScript alerts here:

Shot 1, Shot 2 & Shot 3

Source: F-Secure Blog


28 July 2006 | 6,560 views

BASE 1.2.6 Released (Basic Analysis & Security Engine)

We are happy to announce that the 1.2.6 (christine) release of the Basic Analysis and Security Engine (BASE) is available.

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

I used to LOVE ACID, and I have to say BASE has taken it one step further, it’s a superb project.

A number of bugs have been fixed including some that affected IE and the setup system for BASE. A couple of interface tweaks have also been done to make it more user friendly.

The developers are currently looking for more people willing to test the BASE releases as they work on them. If you are interested, feel free to contact base@secureideas.net

The BASE team have also started coding the 2.x code base. If you have any ideas or feedback regarding that rewrite, please forward them to the BASE developers list which is a public mailing list.

You can download the new version of BASE at:

http://sourceforge.net/projects/secureideas