Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

19 December 2014 | 1,312 views

Acunetix OVS Review (Online Vulnerability Scanner)

Check For Vulnerabilities with Acunetix

Introduction

It’s been a while since we’ve looked at any Acunetix products in depth, they’ve always had a solid Web Vulnerability Scanner as we found in our reviews of Acunetix WVS 6 and Acunetix WVS 7. Version 9.5 of the Web Vulnerability Scanner was released earlier this year and late last year Acunetix also announced their Online Vulnerability Scanner or OVS.

OVS is built leveraging the same state-of-the-art and proprietary Acunetix crawling and scanning technologies available in its on-premise solution.

Acunetix OVS Review (Online Vulnerability Scanner)

Acunetix Online Vulnerability Scanner was officially launched in March this year and is responsive, scalable and centralised with unmatched deep crawling and scanning capabilities.

If you compare it to the on-premise solution, it’s simple to use, there’s no maintenance (as it’s cloud based) and it’s very competitively priced (the on-premise offering is understandably a fairly costly enterprise solution).

I’ve spent a few days checking out OVS and it’s features/flow, including both the web scanning functionality and the network scan. So here is our Acunetix OVS review – enjoy.

Features

OVS is accessible via the web at https://ovs.acunetix.com/ – which for me is already a MAJOR benefit as I can easily log-in and check the status from anywhere. Previously with something like Acunetix WVS, you are limited to using the machine that has the software installed and the licence activated – which sometimes limits your mobility.

Feature wise it has:

  • Complete vulnerability management through one holistic dashboard
  • Perimeter server scanning
  • Recurring and scheduled scans
  • Over 35,000 network and 600 web vulnerability checks
  • Easy to interpret and prioritised vulnerability alerts with further information to make remediation easier
  • Complete set of compliance reports including OWASP Top 10, PCI DSS, ISO 27001 and HIPPAA
  • Fully supports HTML5, JavaScript, and thus the detection of DOM based XSS

Useful stuff if you are following any compliance regimes (PCI DSS is a pretty common one if you have anything to do with any kind of payment processing).

Also recently added to OVS are AcuSensor and AcuMonitor.

Acunetix AcuSensor Technology is a new security technology that allows you to identify more vulnerabilities than a traditional Web Application Scanner, whilst generating less false positives. In addition it indicates exactly where in your code the vulnerability is and reports also debug information.

There’s AcuSensor support for both .NET and PHP and you basically add it into your app to also scan from the inside and indicate exactly where in your code the vulnerabilities occur, install info can be found here.

Using OVS

Actually using OVS is pretty straight forward, after signing up you’ll have to do some basic account verification for a web scan. The domain you are scanning also has to be verified by means of a file in the web root (to prove it’s legitimately yours or at least you have access to it).

OVS Verification

You also have various options when adding a target including form based authentication details, you can add a login sequence file, download the AcuSensor file and add SSH credentials.

OVS Target Options

To do the network scan takes a little deeper verification requiring a phone call from Acunetix to confirm your contact number and some other details.

The interface isn’t the prettiest (it’s quite obviously Bootstrap), but it works just fine – starting a scan is easy as long as you’ve verified your domain. You can choose the type of Web Vulnerabilities you want to focus on and the type of Network scan (including if you want to run a safe or invasive network scan).

OVS Scan Options

It’s already really easy to set up scheduled and repeating scans, especially useful for compliance stuff like PCI DSS which requires quarterly scans.

OVS Scheduled Scans

When the scan has completed, you will get a notification via e-mail and you can check it out in the web app. The results are displayed in a fairly regular expanding tree format with the highest risk/impact vulnerabilities shown first. Each one has a title, and it expands to show what it affects, a description, attack details, impact, how to fix it and some web references if available.

OVS Scan Results

A feature I found really useful is the ability to generate reports from scan results in certain formats, the app can generate reports for you in terms of PCI 3.0 Compliance, Sarbanes-Oxley, HIPAA and so on. If that’s part of your job it’s a great value add.

Report Generation

Conclusion

Overall I think it’s a great tool and I’m glad to see a company like Acunetix, who has a great software scanner moving more into a SaaS (Software-as-a-Service) style offering. It suits the mobile pen-testing consultant a lot more, especially with agile teams working together the old methods of generating reports with software on each engineer laptop was cumbersome and hard to scale.

Hence tools were developed just to do report management like Kvasir and MagicTree. With a tool like Acunetix OVS, such issues are a thing of the past.

I do hope they keep developing and improving it, adding more features and making it a more user friendly experience.

If you want to check it out you can do so here:

http://www.acunetix.com/online-vulnerability-scanner/

Remember that there’s a 14 day free trial, which offers 2 full network scans with full results and 2 web scans with overview reports on 2 targets.

Advertisements



18 December 2014 | 7,678 views

ICANN Hacked Including Root DNS Systems

So another hack has been exposed, this time on ICANN – which is pretty bad. They are the database of the Internet basically, including the root zone system which is the highest authority for DNS requests.

The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit organization that is responsible for the coordination of maintenance and methodology of several databases of unique identifiers related to the namespaces of the Internet, and ensuring the network’s stable and secure operation.

ICANN Hacked

Pretty serious business, and this time nothing high-tech went on at all – just some very targeted ‘spear-phishing‘ against employees of ICANN which did eventually yield valid credentials.

Domain-name overseer ICANN has been hacked and its root zone system compromised, the organization has announced.

Attackers sent staff spoofed emails appearing to coming from icann.org. The organization notes it was a “spear phishing” attack, suggesting employees clicked on a link in the messages, and then typed their usernames and passwords into a bogus webpage, providing hackers with the keys to their accounts.

“The attack resulted in the compromise of the email credentials of several ICANN staff members,” the announcement reads, noting that the attack happened in late November and was discovered a week later.

With those details, the hackers then managed to access a number of systems within ICANN, including the Centralized Zone Data System (CZDS), the wiki pages of the Governmental Advisory Committee (GAC), the domain registration Whois portal, and the organization’s blog.

The CZDS provides authorized parties with access to all the zone files of the world’s generic top-level domains. It is not possible to alter those zone files from within the system, but the hackers did manage to obtain all the information of those who are registered with the system, which include many of the administrators of the world’s registries and registrars.

In an email sent to every CZDS user, ICANN has warned that “the attacker obtained administrative access to all files in the CZDS including copies of the zone files in the system. The information you provided as a CZDS user might have been downloaded by the attacker. This may have included your name, postal address, email address, fax and telephone numbers, and your username and password.”

This is by no means a Sony level hack, but well honestly – nothing else is and probably will be for quite some time.

A compromise to ICANN is serious in a different way though as it’s a backbone of the Internet and thankfully the attackers couldn’t alter the root zone files or it could have been chaos. It’s mostly a case of information disclosure in terms of users of the Centralized Zone Data System.

While the hack is nowhere near the same level as the hack on, say, Sony that has seen gigabytes of information leaked onto the internet, it will prove extremely embarrassing to ICANN, which hopes to be handed control of the critical IANA contract next year.

It also comes as the US government revealed yesterday the process by which updates to the internet’s root zone files are done through ICANN. When changing the network addresses for the world’s top-level nameservers, the process relies on a secure email from ICANN, or a request sent through a secure web portal, a standard format change request and self-certification that ICANN has followed its own processes.

With the email addresses of staff with access to root zone records having been compromised and the hack only noticed a week later, there will be significant concern that had the hackers been luckier or if an IANA staffer – who also use icann.org email addresses – had logged in to the fake site the hackers may have gained access to the system used to make changes at the very top of the internet.

ICANN seeks to assure people that it is on top of the situation: “Earlier this year, ICANN began a program of security enhancements in order to strengthen information security for all ICANN systems. We believe these enhancements helped limit the unauthorized access obtained in the attack. Since discovering the attack, we have implemented additional security measures.”

That security program began when ICANN suffered a problem with CZDS system in April. In that case a number of users were wrongly given admin access to the system.

It’s good to see ICANN being a bit more grown up about this as well, disclosing that it happened, what was leaked and how they think the intruders got access to the system – a definite move in the right direction.

ICANN has also stated that disclosed passwords were stored as salted hash values, rather than in plaintext, although the algorithm used is not known. They also confirmed that this hadn’t effected any IANA-related systems and that no other systems have been impacted.

Source: The Register


16 December 2014 | 1,440 views

BlueMaho Project – Bluetooth Security Testing Suite

BlueMaho is GUI-shell (interface) for a suite of tools best used for Bluetooth security testing. It is freeware, opensource, written on python, uses wxPython. It can be used for testing BT-devices for known vulnerabilities and major thing to do – testing to find unknown vulns. Also it can form nice statistics.

I did get interested in Bluetooth for a while and the security implications of a personal area network protocol which includes discovery/broadcast etc. I ended up only posting one article at the time though which was about Haraldscan – BlueTooth Discovery Scanner.

BlueMaho Project - Bluetooth Security Testing Suite

I have a bunch more Bluetooth related resources to share though, so I’ll be putting them out from time to time. Some (like this) aren’t particularly up to date, but give you a great base to start with and play around.

Features

  • Scan for devices, show advanced info, SDP records, vendor etc
  • Track devices – show where and how much times device was seen, its name changes
  • Loop scan – it can scan all time, showing you online devices
  • Alerts with sound if new device found
  • on_new_device – you can spacify what command should it run when it founds new device
  • It can use separate dongles – one for scaning (loop scan) and one for running tools or exploits
  • Send files
  • Change name, class, mode, BD_ADDR of local HCI devices
  • Save results in database
  • Form nice statistics (uniq devices by day/hour, vendors, services etc)
  • Test remote device for known vulnerabilities (see exploits for more details)
  • Test remote device for unknown vulnerabilities (see tools for more details)
  • Themes! you can customize it

Requirements

The main requirements are:

  • OS (tested with Debian 4.0 Etch / 2.6.18)
  • Python 2.4
  • wxPython
  • BlueZ

You can download BlueMaho here:

bluemaho_v090417.tgz

Or read more here.


13 December 2014 | 3,051 views

Oryon C Portable – Open Source Intelligence (OSINT) Framework

Oryon C Portable is a web browser designed to assist researchers in conducting Open Source Intelligence investigations. Oryon comes with dozens of pre-installed tools and a select set of links catalogued by category – including those that can be found in the OI Shared Resources.

Oryon C Portable - Open Source Intelligence Framework

  • Based on SRWare Iron version 31.0.1700.0 (Chromium)
  • More than 70 pre-installed tools to support investigators in their everyday work
  • More than 600 links to specialized sources of information and online investigative tools
  • Additional privacy protection features
  • A ready to use opml file containing a sorted collection of information sources in the fields such as: OSINT, Intelligence, online research, InfoSec, defense, and more.

You can download Oryon C Portable here:

Oryon C Portable.exe

Or read more here.


11 December 2014 | 1,365 views

Sony Digital Certs Being Used To Sign Malware

So at the end of November, Sony got owned, owned REAL bad – we wrote about it here: Sony Pictures Hacked – Employee Details & Movies Leaked. It seems in as a part of the massive haul of documents, the digital certificates used to sign software were also stolen.

Which is bad, as you can imagine. Not SSL certs, but software crypto-certs that verify the executable comes from a trustworthy source (in this case Sony).

Sony Digital Certs Being Used To Sign Malware

It’s something of a malware-ception too, as the software that is thought to have been used in the Sony Pictures compromise is the very software being signed with the Sony cert to boost it’s effectiveness.

Miscreants were quick to capitalize on the theft of Sony’s cryptographic certificates – used to sign software to make it look legit.

An analysis of malware dubbed Destover was published by Kaspersky Lab on Tuesday, and shows the code was signed using a private certificate belonging to Sony to evade malware filters.

These certificate were apparently taken from Sony Pictures servers, which were comprehensively ransacked by hackers at the end of November, and leaked online.

It’s believed the infiltrators used a version of Destover to attack Sony’s network. And it appears the stolen digital certs were used to sign another build of Destover on Friday, which then ended up in the wild over the weekend.

When Windows examines an executable, it looks to see if the program has been signed by a recognized, trusted developer before running the code. As far as the operating system was concerned, the signed Destover was legit.

It’s a pretty nifty trick, but it wouldn’t work for long (the beauty of cert schemes) is that the issuer can also revoke the cert. Which apparently, in this case, happened pretty fast. So if you try and run the Sony signed malware on Windows now – it should reject it.

I’m not exactly sure the message Windows gives and if it’s any different between a revoked cert and and running something with no cert.

“The stolen Sony certificates (which were also leaked by the attackers) can be used to sign other malicious samples,” Kaspersky warned on Tuesday.

“In turn, these can be further used in other attacks. Because the Sony digital certificates are trusted by security solutions, this makes attacks more effective. We’ve seen attackers leverage trusted certificates in the past, as a means of bypassing whitelisting software and default-deny policies.”

Sounds pretty scary, right? But before anyone panics, it’s worth pointing out that malware writers can no longer use the code-signing keys.

The certificates were issued by DigiCert, a US biz that sells security certs. Kaspersky said it warned DigiCert about the issue, so El Reg checked with the crypto-company to find out what the situation was.

“This certificate is already revoked,” a spokeswoman for DigiCert told The Register on Tuesday, meaning Windows systems should reject the Destover build when its cryptographic signature is checked by the operating system.

“We received a report about the malware last week and immediately revoked the certificate,” she added.

I imagine they managed to get the malware deeper into a few places with the signed version, maybe only for a day or two – but a crack team of people with bad intentions could really capitalise on that.

There’s some good info about certs and certificate revokation here: DIGGING INTO CERTIFICATE REVOCATION LISTS

I honestly don’t think this will have caused a massive amount of damage, but it sure is interesting reading. We’ll have to see if any more news about this crops up.

Source: The Register


09 December 2014 | 1,588 views

InsomniaShell – ASP.NET Reverse Shell Or Bind Shell

InsomniaShell is a tool for use during penetration tests, when you have ability to upload or create an arbitrary .aspx page. This .aspx page is an example of using native calls through pinvoke to provide either an ASP.NET reverse shell or a bind shell.

ASP.NET is an open source server-side Web application framework designed for Web development to produce dynamic Web pages. It was developed by Microsoft to allow programmers to build dynamic web sites, web applications and web services.

It was first released in January 2002 with version 1.0 of the .NET Framework, and is the successor to Microsoft’s Active Server Pages (ASP) technology. ASP.NET is built on the Common Language Runtime (CLR), allowing programmers to write ASP.NET code using any supported .NET language.

InsomniaShell - ASP Reverse Shell Or Bind Shell

A bind shell is basically binding the command prompt to a listening port on the compromised machine, a reverse shell is sending a command prompt to a listening port on the attackers machine (used when the hacked server doesn’t have a public IP).

InsomniaShell has the added advantage of searching through all accessible processes looking for a SYSTEM or Administrator token to use for impersonation.

If the provider page is running on a server with a local SQL Server instance, the shell includes functionality for a named pipe impersonation attack. This requires knowledge of the sa password, and results in the theft of the token that the SQL server is executing under.

You can download InsomniaShell here:

InsomniaShell.zip


06 December 2014 | 1,674 views

WhatWeb – Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1500 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb - Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called ‘stealthy’, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. meta name="generator" content="WordPress 2.6.5", but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for “/wp-content/” within relative links.

We wrote about WhatWeb way back in 2010, and there actually hasn’t been a release since 2011 (v0.4.7). I was glad to find however it still is under active development and there is work being done on what is going to become 0.4.8 at some point, it has many changes (as listed below) but hasn’t yet been released.

But due to the wonders of technology, you can grab the unreleased development version from Github now (link also below).

Features

  • Over 1500 plugins
  • Control the trade off between speed/stealth and reliability
  • Performance tuning. Control how many websites to scan concurrently.
  • Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.
  • Proxy support including TOR
  • Custom HTTP headers
  • Basic HTTP authentication
  • Control over webpage redirection
  • Nmap-style IP ranges
  • Fuzzy matching
  • Result certainty awareness
  • Custom plugins defined on the command line

Sample Output

Changes in 0.4.8-dev

  • Added over 700 new plugins
  • Added aggressive version detection using md5 static file matches to several plugins
  • Added support for raw HTTP headers when scanning local files
  • Added –dorks to return google dorks for the selected plugin
  • Added google dorks to more than 500 plugins
  • Added ./addons/hunter
  • Added ./addons/gggooglescan
  • Added ./addons/country-scanner
  • Added SQL logging with --log-sql and --log-sql-create arguments.
  • Added raw header support by monkey patching the net/http library
  • Added context searching for plugin matches[].
  • Added the matches keyword, :search.
  • Added methods for aggressive plugins to send HEAD and POST requests
  • Added –grep, -g option to be easier than –custom-plugin.

You can download the latest ‘stable’ dev version (if such a thing exists) here:

master.zip

Or read more here.


04 December 2014 | 4,309 views

Sony Pictures Hacked – Employee Details & Movies Leaked

Sony hasn’t always had the best of times when it comes to being hacked, back in 2011 Sony basically had to rebuild the PlayStation Network (PSN) because of a hack which rendered the service off-line for almost a whole week.

Plus the fact the PSN hack could have leaked up to 10 million user accounts which included credit card details. And again in 2011 they lost 25 Million Customer Account Details Through SOE (Sony Online Entertainment).

Sony Pictures Hacked - Employee Details Leaked

The hack was so bad, it basically shut down Sony Pictures – the above picture is a photo of a desktop in the Sony Pictures office and apparently all computers were showing this. Similar images came from various sources in different offices showing that this is indeed a seriously pervasive attack.

If you downloaded the archive from the URLs in the pictures, it contains text files which are basically HUGE lists of filenames, files that have leaked from Sony servers. And there’s some serious stuff in there including Hollywood stars passport scans, ppk files (SSH private keys), password lists and much much more.

There’s some discussion on the contents and analyse on Reddit here: I used to work for Sony Pictures.

The password lists/SSH keys also led to the compromise of many more related services and accounts (many film related Twitter accounts were hacked).

Sony Pictures is investigating a breach that has seen hackers supposedly steal reams of internal data and splash defacements across staff computers. The company is now in lock-down as it wrestles with the problem.

The beleaguered company, writes Variety, has requested staff disconnect their computers and personal devices from the Sony network and shut down virtual private networks.

Cracking group Guardians of Peace claimed responsibility for a defacement appearing on staff machines that it stole internal corporate data. The group says it will leak more details to the public web depending on what Sony ‘decided’ in what appeared to be a reference to demands quietly sent to the company earlier.

Source: The Register

Sony Pictures e-mail servers were still totally off-line the day after the attack and they made a statement saying it could take between 1-3 weeks to rectify the matter.

It seems like the attackers are really leaking the files they stole too as details of Sony employees were leaked including personal details and salaries.

It’s getting worse for Sony: the latest dump from the raid that’s brought the company to an IT standstill include the personal detas of staff.

Documents leaked through BitTorrent show the names, home addresses, salaries (and bonuses), and social security numbers of thousands of staff, including executives.

Sony Pictures Entertainment could not be reached for comment by the time of writing.

Some 17 executives, from programming to advertising, were listed as having salaries over US$1 million. Severance pays also appeared to be listed.

Source: The Register

It’s 8 days since the attack and Sony Pictures is still struggling to recover, it also seems like some unreleased movies might (including Annie) have been leaked during the compromise.

Sony, the studio behind “The Amazing Spider-Man” films and the “Breaking Bad” television series, restarted many of its computer systems on Monday after a Nov. 24 breach by a group calling itself #GOP, for Guardians of Peace. Executives at the entertainment company said they were also making progress in fighting the apparently related Internet pirating of five complete films, including the unreleased “Annie.”

Source: New York Times

The virus was pretty nasty and wiped all the machines + removed the master boot record rendering most of Sony’s Microsoft based desktops useless. There are some suspicions North Korea could be involved due to the malware used.

Back in August Sony was under attack by a massive DDoS attack aimed at PSN, and then just as they recovered – this.

The latest details to pop-up are that the leaked data dump is being seeded by a bunch of Amazon EC2 servers that host Sony PlayStation websites..which is odd, as the Sony Pictures network and the Sony PlayStation network should be totally separate.

Sony PlayStation website servers were used to distribute a 27.78GB archive potentially containing sensitive data swiped from Sony Pictures computers, it’s claimed.

Until early on Tuesday afternoon, San Francisco time, more than 60 systems seeding the archive on the BitTorrent network appeared to be virtual servers in the Amazon EC2 cloud, according to security researcher Dan Tentler.

A number of those fingered server instances – eg, 54.77.62.39 – are also serving websites for Sony Computer Entertainment. The EC2 instances serving up the data were checked by another researcher, who found some had SSL certificates signed by Sony.

Source: The Register

This is quite possibly the worst hack of a major US company ever perpetrated, especially in terms of business disruption and data loss – the financial implications of this could be HUGE. Especially for their biggest Christmas movie Annie.

I’m sure we’re going to see more data dumps dropping in the next week or so, it’s certainly an interesting case and it’s definitely not over yet.


02 December 2014 | 1,918 views

Gruyere – Learn Web Application Exploits & Defenses

This codelab is built around Gruyere – a small, cheesy web application that allows its users to publish snippets of text and store assorted files. “Unfortunately,” Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The goal of this codelab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general, it’s a great way to learn web application exploits & defenses.

Gruyere - Learn Web Application Exploits & Defenses

The codelab is organized by types of vulnerabilities. In each section, you’ll find a brief description of a vulnerability and a task to find an instance of that vulnerability in Gruyere. Your job is to play the role of a malicious hacker and find and exploit the security bugs. In this codelab, you’ll use both black-box hacking and white-box hacking. In black box hacking, you try to find security bugs by experimenting with the application and manipulating input fields and URL parameters, trying to cause application errors, and looking at the HTTP requests and responses to guess server behavior. You do not have access to the source code, although understanding how to view source and being able to view http headers (as you can in Chrome or LiveHTTPHeaders for Firefox) is valuable.

Using a web proxy like Burp or WebScarab may be helpful in creating or modifying requests. In white-box hacking, you have access to the source code and can use automated or manual analysis to identify bugs. You can treat Gruyere as if it’s open source: you can read through the source code to try to find bugs.

Gruyere is written in Python, so some familiarity with Python can be helpful. However, the security vulnerabilities covered are not Python-specific and you can do most of the lab without even looking at the code. You can run a local instance of Gruyere to assist in your hacking: for example, you can create an administrator account on your local instance to learn how administrative features work and then apply that knowledge to the instance you want to hack. Security researchers use both hacking techniques, often in combination, in real life.

If you want to find more similar apps, you can do so here: Vulnerable Web Applications.

Exploits Available

There is a good variety of stuff to learn in Gruyere including:

  • Cross-Site Scripting (XSS)
  • Client-state Manipulation
  • Cross-Site Request Forgery (XSRF)
  • Cross Site Script Inclusion (XSSI)
  • Path Traversal
  • Denial of Service (DoS)
  • Code Execution
  • Configuration Vulnerabilities
  • AJAX Vulnerabilites

It doesn’t cover SQL Injection as it doesn’t use SQL.

Or you can download Gruyere here:

gruyere-code.zip

Or read more here.

Was previously known as Jarlsberg.


29 November 2014 | 3,754 views

isowall – Completely Isolate A Device From The Local Network

Isowall is a mini-firewall that allows you to completely isolate a device from the local network. This is for allowing infected machines Internet access, but without endangering the local network.

isowall - Completely Isolate A Device From The Local Network

Building

This project depends upon libpcap, and of course a C compiler.

On Debian, the following should work:

This will put the binary isowall in the local isowall/bin directory.

This should also work on Windows, Mac OS X, xBSD, and pretty much any operating system that supports libpcap.

Running

First, setup a machine with three network interfaces.

The first network interface (like eth0) will be configured as normal, with a TCP/IP stack, so that you can SSH to it.

The other two network interfaces should have no TCP/IP stack, no IP address, no anything. This is the most important configuration step, and the most common thing you’ll get wrong. For example, the DHCP software on the box may be configured to automatically send out DHCP requests on these additional interfaces. You have to go fix that so nothing is bound to these interfaces.

To run, simply type:

Configuration

The following shows a typical configuration file

You can download isowall here:

master.zip

Or read more here – the author can be found on Twitter here @erratarob.