Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

09 May 2015 | 2,873 views

Wapiti – Web Application Vulnerability Scanner v2.3.0

Cyber Raptors Hunting Your Data?

Wapiti is a web application vulnerability scanner, it allows you to audit the security of your web applications. It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the web pages of the deployed web application, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti - Web Application Vulnerability Scanner v2.3.0

We first wrote about Wapiti WAYYY back in 2006 – Wapiti – Web Application Scanner / Black-box testing. It’s come a long way since then, but there doesn’t seem to be much active development since 2013 – which is a shame as it’s a good tool.

Wapiti can detect the following vulnerabilities :

  • File disclosure (Local and remote include/require, fopen, readfile…)
  • Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
  • XSS (Cross Site Scripting) injection (reflected and permanent)
  • Command Execution detection (eval(), system(), passtru()…)
  • CRLF Injection (HTTP Response Splitting, session fixation…)
  • XXE (XmleXternal Entity) injection
  • Use of know potentially dangerous files (thanks to the Nikto database)
  • Weak .htaccess configurations that can be bypassed
  • Presence of backup files giving sensitive information (source code disclosure)

Features

  • Generates vulnerability reports in various formats (HTML, XML, JSON, TXT…)
  • Can suspend and resume a scan or an attack
  • Can give you colors in the terminal to highlight vulnerabilities
  • Different levels of verbosity
  • Fast and easy way to activate/deactivate attack modules
  • Adding a payload can be as easy as adding a line to a text file
  • Supports both GET and POST HTTP methods for attacks
  • It also supports multipart and can inject payloads in filenames (upload)
  • Display a warning when an anomaly is found (for example 500 errors and timeouts)
  • Makes the difference beetween permanent and reflected XSS vulnerabilities.

You can download Wapiti v2.3.0 here:

Windowswapiti-2.3.0-win32-standalone.zip
Linuxwapiti-2.3.0.tar.gz

Or read more here.

Advertisements



08 May 2015 | 1,104 views

Double For Your Money With Acunetix Vulnerability Scanner

Acunetix have announced that they are extending their current free offering of the network security scan, part of their cloud-based web and network vulnerability scanner. Those signing up for a trial of the online version of Acunetix vulnerability scanner will now be able to scan their perimeter servers for network security issues on up to 3 targets with no expiry.

In addition, existing Acunetix customers will also be able to double up on their current license-based quota of scan targets by adding the same amount of network scans. i.e a 25 scan target license can now make use of an extra 25 network-only scan targets for free.

Double For your Money With Acunetix Vulnerability Scanner

An analysis of scans performed over the past year following the launch of Acunetix Vulnerability Scanner (online version) show that on average 50% of the targets scanned have a medium or high network security vulnerability. It’s worrying that in the current cybersecurity climate, network devices remain vulnerable to attack. The repercussions of a vulnerable network are catastrophic as seen in some recent, well publicised Lizard Squad attacks, the black hat hacking group, mainly known for their claims of DoS attacks.

“Acunetix secure the websites of some of the biggest global enterprises, and with our online vulnerability scanner we are not only bringing this technology within reach of many more businesses but we are also providing free network security scanning technology to aid smaller companies secure their network,” said Nick Galea, CEO of Acunetix.

How Acunetix keeps perimeter servers secure

A network security scan checks the perimeter servers, locating any vulnerabilities in the operating system, server software, network services and protocols. Acunetix network security scan uses the OpenVAS database of network vulnerabilities and scans for more than 35,000 network level vulnerabilities. A network scan is where vulnerabilities such as Shellshock, Heartbleed and POODLE are detected, vulnerabilities which continue to plague not only web servers but also a large percentage of other network servers.

You can find our review here:

Acunetix OVS Review (Online Vulnerability Scanner)

A network scan will also:

  • Detect misconfigurations and vulnerabilities in OS, server applications, network services, and protocols
  • Assess security of detected devices (routers, hardware firewalls, switches and printers)
  • Scan for trojans, backdoors, rootkits, and other malware that can be detected remotely
  • Test for weak passwords on FTP, IMAP, SQL servers, POP3, Socks, SSH & Telnet
  • Check for DNS server vulnerabilities such as Open Zone Transfer, Open Recursion and Cache Poisoning
  • Test FTP access such as anonymous access potential and a list of writable FTP directories
  • Check for badly configured Proxy Servers, weak SNMP Community Strings, weak SSL ciphers and many other security weaknesses.

About Acunetix

Acunetix is the market leader in web application security technology, founded to combat the alarming rise in web attacks. Its products and technologies are the result of a decade of work by a team of highly experienced security developers. Acunetix’ customers include the U.S. Army, KPMG, Adidas and Fujitsu. More information can be found at www.acunetix.com.

Register for a free trial and start scanning here:

http://www.acunetix.com/free-network-security-scanner/


05 May 2015 | 3,926 views

The Dude – Automatic Network Discovery & Layout Tool

The Dude network monitor is a (not so) new application by MikroTik which can dramatically improve the way you manage your network environment. It will automatically scan all devices within specified subnets, draw and layout a map of your networks, monitor services of your devices and alert you in case some service has problems.

The Dude - Automatic Network Discovery & Layout Tool

A great tool for automatic network discovery and mapping.

The Dude demo system: Our RouterOS demo routers are viewable from within the Dude, install The Dude and connect to our Demo dude system with the Dude Secure connection to 159.148.147.209.

Features

  • The Dude is free of charge!
  • Auto network discovery and layout
  • Discovers any type or brand of device
  • Device, Link monitoring, and notifications
  • Includes SVG icons for devices, and supports custom icons and backgrounds
  • Easy installation and usage
  • Allows you to draw your own maps and add custom devices
  • Supports SNMP, ICMP, DNS and TCP monitoring for devices that support it
  • Individual Link usage monitoring and graphs
  • Direct access to remote control tools for device management
  • Supports remote Dude server and local client
  • Runs in Linux Wine environment, MacOS Darwine, and Windows
  • Best price/value ratio compared to other products (free of charge)

You can download The Dude here:

dude-install-3.6.exe

Or read more here.


02 May 2015 | 1,840 views

Graudit v1.9 Download – Grep Source Code Auditing Tool

Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It’s comparable to other static analysis applications and source code auditing tool sets like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.

Graudit v1.9 Download - Grep Source Coding Auditing Tool

You can find a full selection of code auditing tools here.

Usage

Graudit supports several options and tries to follow good shell practices. For a list of the options you can run graudit -h or see below. The simplest way to use graudit is;

The following options are available:

Databases

Graudit uses extended regular expressions (POSIX) as it’s signatures and comes with several databases ready for use. You can extend the existing databases or make your own if you require additional signatures.

  • All is a combined database of all the databases listed below
  • ASP offers basic auditing support for the Active Server Pages languages
  • C offers support for the C programming language
  • Default is aimed at finding low hanging fruit. It contains generic rules that should match common vulnerabilites in several languages. However, in order to find additional vulnerabilities for a specific language you should use the language specific databases.
  • Dotnet offers basic dot net support
  • JSP basic JSP support.
  • Other looks for source comments that could indicate problems
  • Perl basic support for perl
  • PHP tracks user input and function calls
  • Python basic python support

You can download Graudit v1.9 here:

graudit-1.9.tar.gz

Or read more here.


30 April 2015 | 1,190 views

WordPress Critical Zero-Day Vulnerability Fixed In A Hurry

So this is an interesting announcement due to the discussion points it brings up about responsible disclosure, it seems like in this case a researcher published his findings about a WordPress critical zero-day vulnerability without informing WordPress before hand.

WordPress Critical Zero-Day Vulnerability Fixed In A Hurry

And they got it fixed REAL quickly, where as in a previous (pretty similar) case – they took 14 months to fix it, leaving their users at risk for that period.

WordPress 4.2.1 was released on Monday to address a critical zero-day vulnerability disclosed on Sunday by Finnish researcher Jouko Pynnönen of Klikki Oy. The expert published the details of the security bug without notifying WordPress because he was displeased with the way developers handled his recent vulnerability reports.

The stored cross-site scripting (XSS) vulnerability disclosed by Pynnonen is similar to a flaw discovered by Belgian researcher Cedric Van Bockhaven, which WordPress fixed last week with the release of version 4.1.2, more than a year after it was reported. The bug, which affects WordPress 4.2 and earlier, can be exploited by an unauthenticated attacker to execute arbitrary code via very long comments that get truncated when they’re saved into the database.

“The attacker is sending fragments of HTML code to the server that contains JavaScript in it. WordPress tries to verify the content, but misses the embedded script. This specific exploit is because the attacker sends very long content – over 64Kb, which is truncated in the database,” Jeff Williams, CTO of Contrast Security, explained via email. “[When] WordPress sends that data back to the browser as part of a webpage, the script executes.”

“That would be enough for an interesting attack, but this particular exploit goes further. When the attack is executed on an administrator, it uses the administrative privilege to install plugins and execute content directly on the server. Most XSS problems are not exploitable in a way that allows a complete remote host takeover,” Williams added.

This is a pretty clever bug, and pretty dangerous too as when a comment is viewed by someone logged in as admin – the site can basically be hijacked totally.

For an XSS attack – this is pretty serious.

The comment truncation flaw reported by Van Bockhaven was addressed by WordPress only after 14 months. However, Pynnonen’s approach forced the WordPress team to release a patch within hours.

Before the fix was released, website owners running a self-hosted version of WordPress were advised to install the Askimet anti-spam plugin in order to protect themselves against potential attacks.

Pynnonen said he decided not to notify WordPress before making the vulnerability public because a different stored XSS flaw that he reported in November is still unpatched. His attempts to obtain information from WordPress on the status of a patch were unsuccessful, even after he tried contacting developers via HackerOne and CERT Finland (CERT-FI).

Furthermore, WordPress last year promised the researcher a minimum bounty of $2,000 for responsibly disclosing a critical bug affecting WordPress versions prior to 4.0, but they only awarded him $100.

“I don’t think it’s my job to spend months begging for the security team to communicate with me about security vulnerabilities. It’s their job and responsibility to communicate with researchers who try to help them and their customers. And if they ‘pro-actively’ and spontaneously offer me a bug bounty, I think it would be appropriate for them to keep their word,” Pynnonen told SecurityWeek. “I’m sure many people think the disclosure was irresponsible. But instead of months or years, the fix was produced in a few hours. During this time users were aware of the threat and could take precautions.”

Williams believes WordPress is to blame for incidents like this one.

Their Bug Bounty payouts seem pretty lame too, which doesn’t really encourage researchers and vulnerability developers to follow the path of responsible disclosure.

Compound that with their tardy reaction to serious bugs, and you get frustrated bug-hunters – like Jouko Pynnönen in this case.

Source: SecurityWeek


28 April 2015 | 2,967 views

CeWL v5.1 – Password Cracking Custom Word List Generator

CeWL is a Custom Word List generator which spiders a given site to create a word list of all words it finds on that site. It can also grab email addresses and usernames found in the HTML and in some document types including Office and PDF.

Useful for targeted penetration testing which involves brute force password cracking.

We first wrote about CeWL way back in 2009 not long after it first came out – it’s been updated plenty since then and is now at version 5.1.

CeWL v5.1 - Password Cracking Custom Word List Generator

There are also a bunch of other similar tools out there (some older some newer):

Crunch – Password Cracking Wordlist Generator
The Associative Word List Generator (AWLG) – Create Related Wordlists
Wyd – Automated Password Profiling Tool
CUPP – Common User Passwords Profiler – Automated Password Profiling Tool
RSMangler – Keyword Based Wordlist Generator For Bruteforcing

If you combine the wordlists from the above tools with the commonly found standard password cracking wordlists, you should have a pretty comprehensive, targeted set of lists for bruteforcing with something like John the Ripper, thc-hydra or hashcat.

Usage

You can download CeWL v5.1 here:

cewl_5.1.tar.bz2

Or read more here.


25 April 2015 | 687 views

OAT – Microsoft OCS Assessment Tool (Office Communication Server)

OAT is an Open Source Microsoft OCS Assessment Tool designed to check the password strength of Lync and Microsoft Office Communication Server users. After a password is compromised, OAT demonstrates potential UC attacks that can be performed by legitimate users if proper security controls are not in place.

OAT - Microsoft OCS Assessment Tool (Office Communication Server)

We first wrote about OAT when it was v1.0 and just came out in 2009.

OAT has a user friendly tabbed interface that begins with a password strength test feature. Once the OAT user has successfully elicited the password, attack modules from subsequent tabs can be used for launching UC attacks against valid, registered Lync and OCS users.

New in OAT v3.0

  • Lync Support
  • Improved speed of the online dictionary attack
  • Fixed issues with play spam audio for call walking
  • Minor graphical enhancements
  • New Active Directory Options

Features

  • Online Dictionary Attack
  • Presence Stealing
  • Contact List Stealing
  • Targeted IM Flood
  • Targeted Call Walk
  • Communicator DoS
  • Audio Call Spam
  • Report Generation
  • OCS 2007 & OCS 2007 R2

You can download OAT v3.0 here:

OAT-inst-3.05.zip

Or read more here.


21 April 2015 | 2,202 views

sptoolkit Rebirth – Simple Phishing Toolkit

The sptoolkit (rebirth) or Simple Phishing Toolkit project is an open source phishing education toolkit that aims to help in securing the mind as opposed to securing computers. Organizations spend billions of dollars annually in an effort to safeguard information systems, but spend little to nothing on the under trained and susceptible minds that operate these systems, thus rendering most technical protections instantly ineffective. A simple, targeted link is all it takes to bypass the most advanced security protections. The link is clicked, the deed is done.

sptoolkit Rebirth - Simple Phishing Toolkit

spt was developed from the ground up to provide a simple and easy to use framework to identify your weakest links so that you can patch the human vulnerability.

sptoolkit hasn’t been actively developed for two years. As it stands, it’s a brilliant peice of software, and the original developers are pretty damn awesome for creating it. But a new team would like to go further, and bring sptoolkit up to date – they’ve started active development again on Github just last month.

Requirements

  • Apache
  • PHP
  • MySQL

Features

  • Templates & Visual editor
  • Education completion tracking
  • Support for URL shorterners
  • Support for sending SMTP via SSL
  • Forms display inline errors for correction
  • Accurate e-mail tracking times
  • Browser Detection

You can download the new sptoolkit 0.80.1 here:

v0.80.1.zip

Or read more here.


18 April 2015 | 2,070 views

EvilAP Defender – Detect Evil Twin Attacks

EvilAP_Defender is an application that helps wireless network administrators to discover and prevent Evil Access Points (AP) from attacking wireless users. The application can be run in regular intervals to protect your wireless network and detect Evil Twin attacks.

EvilAP Defender - Detect Evil Twin Attacks

By configuring the tool you can get notifications sent to your email whenever an evil access point is discovered. Additionally you can configure the tool to perform DoS on discovered evil AP in order to give the administrator more time to react. However, notice that the DoS will only be performed for evil APs which have the same SSID but different BSSID (AP’s MAC address) or running on a different channel. This to avoid DoS your legitimate network.

The tool is able to discover evil APs using one of the following characteristics:

  • Evil AP with a different BSSID address
  • Evil AP with the same BSSID as the legitimate AP but a different attribute (including: channel, cipher, privacy protocol, and authentication)
  • Evil AP with the same BSSID and attributes as the legitimate AP but different tagged parameter – mainly different OUI (tagged parameters are additional values sent along with the beacon frame.

Currently no software based AP gives the ability to change these values. Generally software based APs are so poor in this area).

Whenever an Evil AP is discovered the tool will alert the admin through email (SMS will be supported soon). Additionally the tool will enter into preventive mode in which the tool will DoS the discovered Evil AP. The tool can be configured easily by starting in what we call “Learning Mode”. In this mode you can whitelist your legitimate network. This can be done by following the wizards during the Learning Mode. You can also configure the preventive mode and admin notification from there as well.

Finally, you need to change into Normal Mode or re-run the tool in this mode in order to start discovering Evil APs.

Requirements

Learning Mode:

This Mode can be invoked with the “-L” switch. When running the tool in this mode the tool will start by scanning for the available wireless networks. Then it lists all the found wireless networks with whitelisted APs colored with green. It also lists the whitelist APs and OUIs (tagged parameters).

The tool also provides several options which allow you to add/remove SSIDs into/from whitelist. You need to whitelist your SSID first before running the tool in the Normal Mode. Moreover, you can configure Preventive Mode from “Update options -> Configure Preventive Mode”. First you need to set the Deauthentication time (in seconds) into a number bigger than 0 (setting the value to 0 will disable this mode). Then you need to set the number of time to repeat the attack. This is so important for attacking more than Evil AP because the tool cannot attack all of them in the same time (how can you attack several APs on different channels? Later on we will improve the tool and allow it to attack (in the same time) several APs in the same channel).

The tool will attack the first Evil AP for specified deauthentication time then it will stop and attack the second one and so on. Be careful from increasing the Deatuth time so much because this may attack only one AP and leaving the others running. My recommendation is to set the Deauth time to something suitable such as 10 seconds and increasing the repeat time. Finally, you can configure admin notification by setting admin email, SMPT server address, SMTP username (complete email address) for authentication purpose, and SMTP password. You can use any account on Gmail or your internal SMTP server account.

Normal Mode:

This is the mode in which the tool starts to discover Evil APs and notify the administrator whenever one is discovered. This mode can be invoked by “-N” switch.

You can download EvilAP Defender here:

master.zip

Or read more here.


16 April 2015 | 1,322 views

Google Chrome 42 Stomps A LOT Of Bugs & Disables Java By Default

Ah finally, the end of NPAPI is coming – a relic from the Netscape era the Netscape Plugin API causes a lot of instability in Chrome and security issues. It means Java is now disabled by default along with other NPAPI based plugins in Google Chrome 42.

Chrome will be removing support for NPAPI totally in Chrome 45.

Google Chrome 42 Stomps A LOT Of Bugs & Disables Java By Default

Other than that, they have also squashed 45 security issues and vulnerabilities, including some quite serious ones. And many, a product of their Bug Bounty program.

Google announced on Tuesday the availability of Chrome 42 for Windows, Mac and Linux. The latest release addresses a total of 45 security issues and removes NPAPI support.

Judging by the bug bounties paid out by Google, the most serious vulnerability fixed in Chrome 42 is a cross-origin bypass flaw in the HTML parser (CVE-2015-1235). The discovery of this high severity bug earned an anonymous researcher $7,500.

The list of high severity vulnerabilities also includes a type confusion in V8 (CVE-2015-1242) reported by Cole Forrester of Onshape, a use-after-free in IPC (CVE-2015-1237) reported by Khalil Zhani, and an out-of-bounds write bug in the Skia graphics engine (CVE-2015-1238) identified by cloudfuzzer.

The medium severity security issues reported by external researchers are a cross-origin-bypass in the Blink web browser engine, an out-of-bounds read in WebGL, a use-after-free in PDFium, a tap-jacking flaw, an HSTS bypass in WebSockets, an out-of-bounds read in Blink, scheme issues in OpenSearch, and a SafeBrowsing bypass.

The researchers who contributed to making Chrome more secure have been awarded a total of $21,500, according to a blog post published by Google. However, the total amount could be higher since there are some vulnerability reports that haven’t gone through the search giant’s reward panel.

The actual details of the bugs are not public right now, as the policy for Google is keep access to the details restricted until the majority of users are patched. It will be further restricted if the bug is in a third party library that other projects depend on and haven’t yet fixed.

Feature wise, they’ve also launched their implementation of the Push API for notifications.

“We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel,” wrote Alex Mineer of the Google Chrome team.

In September 2013, Google announced plans to phase out support for the Netscape Plugin API (NPAPI). The company noted at the time that the API’s 90s-era architecture was causing crashes, security issues and other problems.

In January 2014, Google blocked web page-instantiated NPAPI plugins by default, but whitelisted some of the most popular applications, such as Silverlight, Unity, Google Earth, Google Talk, and Facebook Video. Java was also on the list of most popular plugins using NPAPI, but it had been disabled earlier for security reasons.

Now, NPAPI support has been disabled by default in Chrome and extensions requiring NPAPI plugins will be removed from the Chrome Web Store. Advanced users and enterprises can temporarily re-enable NPAPI until the plugins they use transition to alternative technologies.

There’s more details from Google here: Stable Channel Update

I wish Firefox would keep up..

Source: Security Week