Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

31 May 2015 | 2,119 views

OWASP Zed Attack Proxy – Integrated Penetration Testing Tool

Check Your Web Security with Acunetix

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.

With its automated scanner and powerful REST API, ZAP fits seamlessly into your continuous integration environment, allowing you to automate the finding of common issues while you’re still in development.

OWASP Zed Attack Proxy Version - Integrated Penetration Testing Tool

It’s classified as a flagship project for OWASP meaning it’s mature and has demonstrated strategic value to OWASP and application security as a whole. It’s also fully translated into 25 different languages, which is more than a lot of commercial/enterprise tools.

Alternatives to ZAP would be:

Fiddler – Web Debugging Proxy For HTTP(S)
Burp Suite Free Edition v1.4 – Web Application Security Testing Tool
Charles Web Debugging Proxy – HTTP Monitor & Reverse Proxy

We have written about ZAP before, when it first hit v1.0 back in 2010 and again when they had a major update in 2011.

Features

  • Open source
  • Cross platform
  • Easy to install
  • Completely free
  • Ease of use a priority
  • Comprehensive help pages
  • Fully internationalized
  • Translated into a dozen languages
  • Community based, with involvement actively encouraged
  • Under active development by an international team of volunteers

Functionality

  • Intercepting proxy
  • Traditional and AJAX spiders
  • Active scanner
  • Passive scanner
  • Forced Browsing
  • Fuzzer
  • Dynamic SSL certificates
  • Smart card support
  • Web sockets support
  • Authentication and session support
  • Powerful REST based API
  • Support for a wide range of scripting languages
  • Automatic updating option
  • Integrated and growing marketplace of add-ons

When used as a proxy server it allows the user to manipulate all of the traffic that passes through it, including traffic using https. It can also run in a ‘daemon’ mode which is then controlled via a REST Application programming interface.

This cross-platform tool is written in Java and is available in all of the popular operating systems including Microsoft Windows, Linux and Mac OS X.

You can download ZAP here:

Windows – ZAP_2.4.0_Windows.exe
Linux – ZAP_2.4.0_Linux.tar.gz
Mac OS X – ZAP_2.4.0_Mac_OS_X.dmg

There is also a Docker image available here.

Or read more here.

Advertisements



28 May 2015 | 1,039 views

IRS Was Not Hacked – Taxpayer Data Stolen For 100,000 People

So the IRS was not hacked – as many media outlets are claiming. Was taxpayer data stolen from IRS systems? Yes, did it involve any kind of hack (by any definition) – no.

There was no intrusion, there was some clever phishing, data slurping and brute forcing – of people who already had their data stolen it’s important to note.

IRS Was Not Hacked - Taxpayer Data Stolen For 100,000 People

It seems the biggest leak was of tax returns and the illegal access is to bolster the stolen identities of folks who had already been compromised by some other means.

The US Internal Revenue Service said on Tuesday that info including tax returns and income forms for some 100,000 people were illegally accessed this year.

The US tax agency believes a group collected a trove of information on the victims and then used that data to fill out the authentication forms for the IRS’s online “Get Transcript” feature, which allows taxpayers to access past tax records.

To say that the IRS itself was “hacked” – as some journos squawked today – is more than a stretch. The criminals did not compromise any IRS servers or exploit technical glitches in the Get Transcript feature. Rather, they gathered an obscene amount of personal data from their victims via other means, and then typed that data to the IRS site.

“Third parties succeeded in clearing a multi-step authentication process that required prior personal knowledge about the taxpayer, including Social Security information, date of birth, tax filing status and street address before accessing IRS systems,” the IRS told The Reg in an emailed statement.

“The multi-layer process also requires an additional step, where applicants must correctly answer several personal identity verification questions that typically are only known by the taxpayer.”

According to the IRS, the data theft operation ran from February through mid-May, when the activity was detected. In total, the IRS said 200,000 attempts to access personal information were made from “questionable” email accounts, about half of which resulted in successfully accessing the Get Transcript function.

The one thing that surprises me is that so many bogus requests were not detected earlier, as I’m pretty sure a lot of questions were answered wrongly and retried possibly multiple times.

Perhaps the attackers were very smart though and used different IP addresses, different browser agents, different submission timings etc. And not noticing 200,000 illicit requests from “questionable” e-mail addresses – that seems kinda lackadaisical.

It is not known how the personal information used to fill out the transcript requests was gathered, or from where.

“The matter is under continuing review by the Treasury Inspector General for Tax Administration and IRS offices, including Criminal Investigation,” the IRS said. “The IRS notes this issue does not involve its main computer system that handles tax filing submission; that system remains secure.”

The IRS has shut down the Get Transcript portal until further notice. The tax authority will also provide free credit monitoring services to those who were affected by the illegal access – and given the nature of the data required for access, they’ll need it.

When your Social Security Number, date of birth, marital state, home address, and enough personal background to answer a handful of verification questions has been taken by an identity thief, you probably have other things to worry about than whether they view your 1040EZ.

Again, we would advise those not affected not to panic over any sensationalist “IRS has been hacked!” headlines currently floating around news and social media. This was not a breach of any IRS systems, but rather what appears to be the result of some very extensive phishing/data harvesting from 100,000 unlucky individuals.

So yah to summarise it’s not a hack, but it does expose some weakness in the IRS Get Transcript service and due to that, they’ve disabled it at the moment.

But as the article mentions, if the attackers already had that much information on you (SSN, address, personal information) – them getting access to your historical tax returns is the least of your worries.

Source: The Register


26 May 2015 | 1,241 views

zzuf – Multi-Purpose Application Input Fuzzing Tool

zzuf is a transparent application input fuzzing tool or fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data (which more than often comes from untrusted sources on the Internet). It works by intercepting file and network operations and changing random bits in the program’s input.

zzuf’s behaviour is deterministic, making it easier to reproduce bugs.

zzuf - Multi-Purpose Application Input Fuzzing Tool

Its main areas of use are:

  • quality assurance: use zzuf to test existing software, or integrate it into your own software’s testsuite
  • security: very often, segmentation faults or memory corruption issues mean a potential security hole, zzuf helps exposing some of them
  • code coverage analysis: use zzuf to maximise code coverage

zzuf’s primary target is media players, image viewers and web browsers, because the data they process is inherently insecure, but it was also successfully used to find bugs in system utilities such as objdump.

zzuf is not rocket science: the idea of fuzzing input data is barely new, but zzuf’s main purpose is to make things easier and automated.

You can download zzuf here:

Mac OS X universal binary: zzuf-osx-0.13.tar.gz
Latest Source from Github: master.zip

Or read more here.


22 May 2015 | 3,500 views

Web Security Dojo 2.0 – Self-Contained Web Hacking Training

Web Security Dojo is a free open-source self-contained web hacking training environment for Web Application Security penetration testing. Tools + Targets = Dojo

Web Security Dojo 2.0 - Self-Contained Web Hacking Training

What?

Various web application security testing tools and vulnerable web applications were added to a clean install of xubuntu 12.04. Build scripts are available in git at Sourceforge.

Targets include:

Why?

The Web Security Dojo is for learning and practising web app security testing techniques. It is ideal for self-teaching and skill assessment, as well as training classes and conferences since it does not need a network connection since it contains both tools and targets. Also, this removes the possibility of remote attack on the targets, which are insecure by design. The Dojo contains everything needed to get started – tools, targets, and documentation.

Tools included (starred = new this version):

You can download Web Security Dojo v2.0 here:

Web_Security_Dojo-2.0.ova

Or read more here.


21 May 2015 | 2,278 views

The Logjam Attack – ANOTHER Critical TLS Weakness

So it seems SSL/TLS has not been having a good time lately, alongside Heartbleed and POODLE we now have the Logjam attack.

It’s somewhat similar to the FREAK attack earlier this year, but that attacked the RSA key exchange and was due to an implementation vulnerability rather than Logjam which attacks the Diffie-Hellman key exchange as is due to a flaw in the TLS protocol.

The Logjam Attack - ANOTHER Critical TLS Weakness

The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack affects any server that supports DHE_EXPORT ciphers, and affects all modern web browsers. 8.4% of the Top 1 Million domains were initially vulnerable.

Source – weakdh.org

The full technical report is here: Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice [PDF]

Who is affected?

Websites, mail servers, and other TLS-dependent services that support DHE_EXPORT ciphers are at risk for the Logjam attack. Websites that use one of a few commonly shared 1024-bit Diffie-Hellman groups may be susceptible to passive eavesdropping from an attacker with nation-state resources.

Millions of HTTPS, SSH, and VPN servers all use the same prime numbers for Diffie-Hellman key exchange. Practitioners believed this was safe as long as new key exchange messages were generated for every connection. However, the first step in the number field sieve—the most efficient algorithm for breaking a Diffie-Hellman connection—is dependent only on this prime. After this first step, an attacker can quickly break individual connections.

The researchers estimate that an academic team can break a 768-bit prime and that a nation-state can break a 1024-bit prime. Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break.

Are you at risk?

If you update as soon as patches are available on a regular basis, probably not. Microsoft patched it on May 12 with security bulletin MS15-055, Google fixed the issue with the Chrome 42 update, which debuted on April 15 and the Firefox patch is on the way.

If you run servers or are a Sys Admin, there’s full details here on what you can do and a test tool:

Guide to Deploying Diffie-Hellman for TLS

The researchers have 3 recommendations for deploying Diffie-Hellman:

  • Disable Export Cipher Suites. Even though modern browsers no longer support export suites, the FREAK and Logjam attacks allow a man-in-the-middle attacker to trick browsers into using export-grade cryptography, after which the TLS connection can be decrypted. Export ciphers are a remnant of 1990s-era policy that prevented strong cryptographic protocols from being exported from United States. No modern clients rely on export suites and there is little downside in disabling them.
  • Deploy (Ephemeral) Elliptic-Curve Diffie-Hellman (ECDHE). Elliptic-Curve Diffie-Hellman (ECDH) key exchange avoids all known feasible cryptanalytic attacks, and modern web browsers now prefer ECDHE over the original, finite field, Diffie-Hellman. The discrete log algorithms we used to attack standard Diffie-Hellman groups do not gain as strong of an advantage from precomputation, and individual servers do not need to generate unique elliptic curves.
  • Generate a Strong, Unique Diffie Hellman Group. A few fixed groups are used by millions of servers, which makes them an optimal target for precomputation, and potential eavesdropping. Administrators should generate unique, 2048-bit or stronger Diffie-Hellman groups using “safe” primes for each website or server.

This whole thing does raise some issues with trust, trust in cryptography, in the algorithms, the implementation and the fact that cryptography brings along with it certain promises that should avoid nation state eavesdropping.

I guess we’ll have to wait a little longer to see how dangerous this is in the practical world.


16 May 2015 | 1,648 views

Plecost – WordPress Fingerprinting Tool

Plecost is a WordPress fingerprinting tool, it can search and retrieve information about the plug-in versions installed in a WordPress installation. It can be used to analyse a single URL or perform an analysis based on the results indexed by Google.

Additionally it also displays the CVE code associated with each plug-in vulnerability, if any exist.

Plecost - WordPress Fingerprinting Tool

The other tool similar to this is – WPScan – WordPress Security/Vulnerability Scanner. There’s also CMSmap – Content Management System Security Scanner – which has some WordPress functionality.

What’s New?

This Plecost v1.0.1 (major release) has a lot of new features and fixes, like:

  • Code rewritten in Python 3.
  • Thread support removed, now runs faster & uses less memory with Python 3 asyncio and non-blocking connections.
  • Changed CVE update system and storage: Now Plecost get vulnerabilities directly from NIST and create a local SQLite data base with filtered information for WordPress and their plugins.
  • WordPress Core vulnerabilities: Now Plecost also manage WordPress Core Vulnerabilities (not only for the plug-ins).
  • Add local vulnerability database are queryable. You can consult the vulnerabilities for a concrete WordPress or plug-ins without, using the local database.
  • Installation via pip

You can download Plecost here:

plecost-v1.0.1.zip

Or read more here.


14 May 2015 | 1,125 views

BitTorrent Bleep – Encrypted, Decentralized Voice & Text App

So after running an open alpha for a while, BitTorrent Bleep is now finally public and official. The whole secure/transient messaging app/platform area is an interesting space, companies have come and gone, some have been compromised and some are still around (Snapchat, Poke, Wickr, Armortext etc).

BitTorrent Bleep - Encrypted, Decentralized Voice & Text App

Bleep requires no personal info, just a nickname and then you can share your Bleep key anywhere you like. There’s a Whisper mode, which is an entry into the transient messaging space – messages are destroyed after 25 seconds.

After an initial pre-alpha release in July 2014, BitTorrent’s peer-to-peer private voice and text app Bleep is finally available for curious Windows, Mac, iOS and Android users to test it out.

The app offers end-to-end encryption of all communication (calls are connected directly), and you don’t have to pay to use it. You also don’t have to provide any information about yourself in order to use it – a random nickname is enough, and a Bleep key will be created to identify the device for other users to be able to contact you.

“Bleep’s logo represents a folded note – a message passed directly, hand-to-hand. In our implementation, we keep messages and the encryption keys for images stored on your local device, not the cloud,” explained Farid Fadaie, head of the BitTorrent Bleep project. “For messages and metadata, there is no server for hackers to target and because you hold the keys, images can’t be leaked to haunt you later.”

The official blog post from BitTorrent is here: Bleep Now Publicly Available Across All Major Platforms

The downside of this, is that it’s not open-source – so the security implementation and claims made by Bleep are not verifiable by the community. This will be a concern for some of course.

The developers have added a “whisper” mode. “For parts of a conversation that you’d like to keep temporary, tapping ‘Go to Whisper’ on your phone sends messages and pictures that disappear from devices after they’ve been viewed (25 seconds),” says Fadaie.

They have also attempted to make it impossible for anyone to take a complete screenshot of a message, as the screenshot will show either the conversation or the nickname of the user, never both.

Of course, it’s difficult to confirm all these claims as the software is not open source.

You can check out Bleep here: http://www.bleep.pm/ – it’s available for Android, iOS, Mac & Windows desktop.

There are good parts too of course, like the fact the keys are not held in the cloud – thus can’t be targeted by hackers. Then there’s the screenshot protection which blurs out the name at the top of the conversation unless you press the “eye” button. If you press the “eye” button, it shows the name but blurs the message – so even with a physical camera you can’t capture it all.

Well you can, just take 2 shots with a physical camera or another phone and splice them together..so yah, don’t believe too much in the security of that.

Source: Help Net Security


12 May 2015 | 1,719 views

InstaRecon – Automated Subdomain Discovery Tool

InstaRecon is an automated basic digital reconnaissance tool which is great for getting an initial footprint of your targets and discovering additional subdomains. In basic terms, it’s an automated subdomain discovery tool for the information gathering phase of penetration tests.

InstaRecon - Automated Subdomain Discovery Tool

There are other tools which cover some parts of the InstaRecon functionality such as:

dnsmap 0.22 Released – Subdomain Bruteforcing Tool
DNSenum – Domain Information Gathering Tool
Complemento v0.6 – ReverseRaider Subdomain Scanner

Features

InstaRecon will do:

  • DNS (direct, PTR, MX, NS) lookups
  • Whois (domains and IP) lookups
  • Google dorks in search of subdomains
  • Shodan lookups
  • Reverse DNS lookups on entire CIDRs

The outputs from the above will all be printed nicely on your console or into a csv file for further parsing or reporting.

InstaRecon will never scan a target directly. Information is retrieved from DNS/Whois servers, Google, and Shodan.

So you’ll need a Shodan API key for full functionality.

You can download InstaRecon here:

master.zip

Or read more here.


09 May 2015 | 2,433 views

Wapiti – Web Application Vulnerability Scanner v2.3.0

Wapiti is a web application vulnerability scanner, it allows you to audit the security of your web applications. It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the web pages of the deployed web application, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti - Web Application Vulnerability Scanner v2.3.0

We first wrote about Wapiti WAYYY back in 2006 – Wapiti – Web Application Scanner / Black-box testing. It’s come a long way since then, but there doesn’t seem to be much active development since 2013 – which is a shame as it’s a good tool.

Wapiti can detect the following vulnerabilities :

  • File disclosure (Local and remote include/require, fopen, readfile…)
  • Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
  • XSS (Cross Site Scripting) injection (reflected and permanent)
  • Command Execution detection (eval(), system(), passtru()…)
  • CRLF Injection (HTTP Response Splitting, session fixation…)
  • XXE (XmleXternal Entity) injection
  • Use of know potentially dangerous files (thanks to the Nikto database)
  • Weak .htaccess configurations that can be bypassed
  • Presence of backup files giving sensitive information (source code disclosure)

Features

  • Generates vulnerability reports in various formats (HTML, XML, JSON, TXT…)
  • Can suspend and resume a scan or an attack
  • Can give you colors in the terminal to highlight vulnerabilities
  • Different levels of verbosity
  • Fast and easy way to activate/deactivate attack modules
  • Adding a payload can be as easy as adding a line to a text file
  • Supports both GET and POST HTTP methods for attacks
  • It also supports multipart and can inject payloads in filenames (upload)
  • Display a warning when an anomaly is found (for example 500 errors and timeouts)
  • Makes the difference beetween permanent and reflected XSS vulnerabilities.

You can download Wapiti v2.3.0 here:

Windowswapiti-2.3.0-win32-standalone.zip
Linuxwapiti-2.3.0.tar.gz

Or read more here.


08 May 2015 | 1,061 views

Double For Your Money With Acunetix Vulnerability Scanner

Acunetix have announced that they are extending their current free offering of the network security scan, part of their cloud-based web and network vulnerability scanner. Those signing up for a trial of the online version of Acunetix vulnerability scanner will now be able to scan their perimeter servers for network security issues on up to 3 targets with no expiry.

In addition, existing Acunetix customers will also be able to double up on their current license-based quota of scan targets by adding the same amount of network scans. i.e a 25 scan target license can now make use of an extra 25 network-only scan targets for free.

Double For your Money With Acunetix Vulnerability Scanner

An analysis of scans performed over the past year following the launch of Acunetix Vulnerability Scanner (online version) show that on average 50% of the targets scanned have a medium or high network security vulnerability. It’s worrying that in the current cybersecurity climate, network devices remain vulnerable to attack. The repercussions of a vulnerable network are catastrophic as seen in some recent, well publicised Lizard Squad attacks, the black hat hacking group, mainly known for their claims of DoS attacks.

“Acunetix secure the websites of some of the biggest global enterprises, and with our online vulnerability scanner we are not only bringing this technology within reach of many more businesses but we are also providing free network security scanning technology to aid smaller companies secure their network,” said Nick Galea, CEO of Acunetix.

How Acunetix keeps perimeter servers secure

A network security scan checks the perimeter servers, locating any vulnerabilities in the operating system, server software, network services and protocols. Acunetix network security scan uses the OpenVAS database of network vulnerabilities and scans for more than 35,000 network level vulnerabilities. A network scan is where vulnerabilities such as Shellshock, Heartbleed and POODLE are detected, vulnerabilities which continue to plague not only web servers but also a large percentage of other network servers.

You can find our review here:

Acunetix OVS Review (Online Vulnerability Scanner)

A network scan will also:

  • Detect misconfigurations and vulnerabilities in OS, server applications, network services, and protocols
  • Assess security of detected devices (routers, hardware firewalls, switches and printers)
  • Scan for trojans, backdoors, rootkits, and other malware that can be detected remotely
  • Test for weak passwords on FTP, IMAP, SQL servers, POP3, Socks, SSH & Telnet
  • Check for DNS server vulnerabilities such as Open Zone Transfer, Open Recursion and Cache Poisoning
  • Test FTP access such as anonymous access potential and a list of writable FTP directories
  • Check for badly configured Proxy Servers, weak SNMP Community Strings, weak SSL ciphers and many other security weaknesses.

About Acunetix

Acunetix is the market leader in web application security technology, founded to combat the alarming rise in web attacks. Its products and technologies are the result of a decade of work by a team of highly experienced security developers. Acunetix’ customers include the U.S. Army, KPMG, Adidas and Fujitsu. More information can be found at www.acunetix.com.

Register for a free trial and start scanning here:

http://www.acunetix.com/free-network-security-scanner/