Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

09 April 2015 | 891 views

Security Vendor Trustwave Bought By Singtel For $810M

Don't let a Dragon into your website!

The big news today is an acquisition, “Trustwave bought by Singtel” is rocking all the headlines. The fairly well known security vendor Trustwave has been bought for a rather large amount (almost $1 Billion – but not quite).

We have mentioned Trustwave before, and not in a good light – they were sued as the security vendor for the Target hacks.

Security Vendor Trustwave Bought By Singtel For $810M

It seems not to have hurt them as the case was dropped a few days after being filed, and they weren’t listed so their value isn’t public knowledge (until now at least) – they are valued at $850 million.

Singapore Telecommunications Ltd. (Singtel) is acquiring privately held security vendor Trustwave in a deal valued at $810 million.

Under the agreement, Singtel will acquire a 98 percent share of Trustwave, which has an enterprise value of $850 million. Trustwave Chairman, President and CEO Robert J. McCullen will retain the remaining 2 percent share.

Singtel expects the transaction to close in the next three to six months pending regulatory approvals. After the deal closes, Trustwave will operate as a stand-alone business unit of Singtel. The current Trustwave management team is expected to stay in place, and Trustwave’s headquarters will remain in Chicago.

Singtel is a leading communications group that provides multiple services, including both fixed and wireless voice and data. The group extends into 25 countries across Asia, Australia, Africa, Europe and the United States. According to Singtel, it has more than 500 million mobile customers globally today.

“Singtel is the perfect partner for us as we continue to help businesses fight cyber-crime, protect data and reduce security risk, and the Trustwave team is thrilled to become a part of such a prestigious and innovative organization,” McCullen said in a statement.

Trustwave is a large company in the security space with more than 2.7 million business customers globally across 96 countries. Definitely one of the leaders in the managed security services market.

This will take Singtel (who already has a strong hold on the services market) to a whole new level in the infosec space.

The deal will help Singtel establishing itself as a global security player.

“Our extensive customer reach and strong suite of ICT [information and communication technology] services, together with Trustwave’s deep cyber-security capabilities, will create a powerful combination and allow Singtel to capture global opportunities in the cyber-security space,” Chua Sock Koong, Singtel Group CEO, said in a statement.

Trustwave is active in multiple areas of cyber-security and has more than 1,200 employees based in 26 countries and currently operates global security operations centers (SOCs) in Chicago, Denver, Minneapolis, Manila and Warsaw.

Trustwave has managed security offerings as well as stand-alone products. In 2010, Trustwave acquired Breach Security, the primary commercial sponsor behind the widely deployed mod_security Web application firewall (WAF).

Also part of Trustwave is the SpiderLabs ethical hacking and threat research team, which has helped discover a number of important security threats in recent years. In August 2014, the U.S. Secret Service credited Trustwave with helping discover the backoff point-of-sale (POS) malware. Initially, the U.S Secret Service warned that 600 U.S. retailers had been impacted by backoff and later upped that number to more than 1,000 retailers.

Trustwave has also acquired a whole slew of smaller companies which took them to the size they are and also contributed greatly to their software service offerings such as Finjan and MailMarshal which were bought by the acquisition of M86.

It’s good to see the little rock down South of Malaysia making such a bold move.

Source: eWeek

Advertisements



07 April 2015 | 3,274 views

Watcher – Passive Web Application Vulnerability Scanner

Ever find yourself looking for that show-stopper exploit in a Web-app, and forgetting to check out all the low-hanging fruit? That’s initially why the authors created Watcher – a passive web application vulnerability scanner.

For one thing, you don’t want to manually inspect a Web-app for many of these issues (cookie settings, SSL configuration, information leaks, etc), but you still want to find and fix them. Watcher provides this level of security analysis, plus provides hot-spot detection to help pen-testers focus in on the spots that will lead to that show-stopper exploit.

Watcher - Passive Web Application Vulnerability Scanner

Watcher is a Fiddler add-on which aims to assist penetration testers in passively finding Web-application vulnerabilities. The security field today has several good choices for HTTP proxies which assist auditors and pen-testers. The tool was implemented as a plugin for Fiddler which already provides the proxy framework for HTTP debugging.

Some reasons to use Watcher include:

  • Safe for the Cloud and hosting environments. Being passive gives Watcher several advantages – when applications live in the Cloud there’s often a risk that running security testing could damage the shared infrastructure. However, using a passive tool like Watcher ensures that there’s no chance of damaging Cloud-like infrastructure.
  • Safe for production environments. Watcher does not attack web-applications with loads of intrusive requests, it doesn’t modify inputs to your application. Unlike crawlers and web-application scanners, Watcher does not generate dangerous traffic. It quietly analyses normal user-interaction and makes educated reports on the security of an application.
  • Low overhead, no training. If you’re building web-applications you already have a development and test staff. Fiddler has been valuable to dev and test for years as a general-purpose HTTP debugging proxy. Watcher fits seamlessly into the picture, providing valuable security insight with no special training requirements, dedicated machines, or other resources.

Checks make up the most useful part of Watcher – they provide analysis of the HTTP traffic and reporting of security findings. As someone running the tool you can enable, disable, and configure checks independently. As a developer you can create custom and new checks for private use or to contribute to the public project.

Watcher currently ships with 38 standard checks. A check is defined as one set of logic usually stored in a single source code file. Checks can look for multiple issues, so a single check can end up reporting several separate findings.

The contents below are divided by the categories in which different checks operate. Within each category individual checks have been documented separately.

You can download Watcher here:

WatcherSetup.exe

Or read more here.


04 April 2015 | 2,026 views

Commix – Command Injection Attack Tool

Commix (short for [comm]and [i]njection e[x]ploiter) has a simple environment and it can be used by web developers, penetration testers or even security researchers to test web applications with the view to find bugs, errors or vulnerabilities related to command injection attacks.

Commix - Command Injection Attack Tool

By using this command injection attack tool, it is very easy to find and exploit a command injection vulnerability in a certain vulnerable parameter or string.

Commix is written in Python programming language.

Usage

You can download commix here by cloning the Github repo:

Or read more here.


02 April 2015 | 747 views

Google Revoking Trust In CNNIC Issued Certificates

So another digital certificate fiasco, once again involving China from CNNIC (no surprise there) – this time via Egypt. Google is going to remove all CNNIC and EV CAs from their products, probably with the next version of Chrome that gets pushed out.

Google Revoking Trust In CNNIC Issued Certificates

As of yet, no action has been taken by Firefox – or at least no release has been published.

Following the incident in which an Egypt-based company issued unauthorized digital certificates for several Google domains using an intermediate certificate from the China Internet Network Information Center (CNNIC), the search giant has decided to revoke trust in CNNIC certificates.

The change will take effect in a future Chrome release, Google noted on Wednesday in an update made to its initial blog post on the matter.

“As a result of a joint investigation of the events surrounding this incident by Google and CNNIC, we have decided that the CNNIC Root and EV CAs will no longer be recognized in Google products,” said Google security engineer Adam Langley. “To assist customers affected by this decision, for a limited time we will allow CNNIC’s existing certificates to continue to be marked as trusted in Chrome, through the use of a publicly disclosed whitelist.”

The incident came to light last week, when Google revealed that several unauthorized certificates had been issued by Egypt-based MCS Holdings and installed on an internal firewall device that acted as a man-in-the-middle (MitM) proxy.

CNNIC revoked the intermediate certificate used by MCS Holdings and pointed out that the Egyptian firm should have used it to issue only certificates for domains it had registered.

Proper certs being used for MITM attacks, pretty dodgy indeed. Especially when CNNIC is included in all major root stores this does constitute a fairly serious breach of the Certificate Authority system.

I’m pretty sure CNNIC will be ‘let back in’ at some point, meaning their certs will be reissued and reinstated, but for now – they are OUT!

CNNIC’s certificates are included in all major root stores and Google believes this was a “serious breach of the CA system.” After being alerted by Google, both Mozilla and Microsoft took steps to protect Firefox and Internet Explorer users.

Langley said that while there is no evidence to suggest that other fake certificates have been issued or that the ones from MCS Holdings were used outside of the company’s own network, CNNIC will have to take measures before it can earn Google’s trust again.

“CNNIC will implement Certificate Transparency for all of their certificates prior to any request for reinclusion. We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place,” Langley said.

In a brief statement issued on Thursday, CNNIC urged Google to reconsider its decision.

“The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration,” CNNIC stated. “For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected.”

Mozilla could also take action against CNNIC, but the company is still discussing options with members of its community.

You can read the full post from Google here: Maintaining digital certificate security

And the statement from CNNIC here: Declaration

Source: Security Week


31 March 2015 | 2,006 views

Pentoo – Gentoo Based Penetration Testing Linux LiveCD

Pentoo is a Gentoo based penetrating testing linux LiveCD. It’s basically a Gentoo install with lots of customized tools, customized kernel, and much more. Here is a non-exhaustive list of the features currently included:

  • Hardened Kernel with aufs patches
  • Backported Wifi stack from latest stable kernel release
  • Module loading support ala slax
  • Changes saving on usb stick
  • XFCE4 wm
  • Cuda/OPENCL cracking support with development tools
  • System updates if you got it finally installed

Pentoo - Gentoo Based Penetration Testing Linux LiveCD

Put simply, Pentoo is Gentoo with the Pentoo overlay. This overlay is available in layman so all you have to do is layman -L and layman -a pentoo. We have a pentoo/pentoo meta ebuild and multiple pentoo profiles, which will install all the pentoo tools based on USE flags.

Pentoo has been around for a LONG time, it even got a brief mention in our epic 2006 article 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) with over a million views. But it was pretty new back then, 9 years later it’s still around (unlike most of the other LiveCD distros which have disappeared).

It’s also still active and has a 2015 just released! It’s great to see such a dedicated team working on something for so many years.

Tool Categories

  • Analyzer
  • Bluetooth
  • Cracker
  • Database
  • Development
  • Exploit
  • Footprint
  • Forensics
  • Forging
  • Fuzzers
  • Misc
  • MitM
  • Pentoo
  • Proxy
  • RCE
  • Scanner
  • SIP-VOIP
  • Wireless

Notable Changes in 2015.0 RC3.7

  • Changes saving (including unetbooting support)
  • CUDA/OpenCL Enhanced cracking software
  • Kernel 3.15.5 and all needed patches for injection
  • XFCE 4.10

The full tool list is available here (it’s HUGE):

tools_list_x86_64_2014_0_RC3_5

You can download Pentoo 2015.0 RC3.7 here:

Direct – pentoo-amd64-hardened-2015.0_RC3.7.iso
Torrent – Pentoo_Linux_amd64_hardened_2015.0_RC3.7.torrent

Or read more here.


28 March 2015 | 1,848 views

Onapsis Bizploit v1.50 – SAP Penetration Testing Framework

Onapsis Bizploit is an SAP penetration testing framework to assist security professionals in the discovery, exploration, vulnerability assessment and exploitation phases of specialized SAP security assessment. The framework currently ships with many plugins to assess the security of SAP Business Platforms. Additional plugins are available for broader platform support including Oracle.

Onapsis Bizploit v1.50 - SAP Penetration Testing Framework

Nowadays, most organizations which use SAP are going beyond the simple definition of SAP roles and profiles. They have incorporated the technical layer of their SAP platform into their regular risk assessment processes, in order to address the increased threat of cyber-attacks to their business-critical systems.

With Bizploit, you can perform basic analysis of some of the existing technical vulnerabilities affecting your SAP systems, which often pose critical risks to the integrity of the entire platform.

New in v1.50

  • New exploits for Management Console.
  • New modules for SAProuter.
  • New modules for remote execution of RFC Functions.
  • Module to detect the CTC Verb Tampering vulnerability.
  • Several bug fixes.

You can download Bizploit here (requires registration):

Windows
Linux

Or read more here.


24 March 2015 | 1,459 views

Yasca – Multi-Language Static Analysis Toolset

Yasca is an open source program which looks for security vulnerabilities, code-quality, performance, and conformance to best practices in program source code. It’s basically a tool-kit for multi-language static analysis.

Yasca can scan source code written in Java, C/C++, HTML, JavaScript, ASP, ColdFusion, PHP, COBOL, .NET, and other languages

Yasca - Multi-Language Static Analysis Toolset

It leverages on external open source programs, such as:

Yasca can be used to scan specific file types, and also contains many custom scanners developed just for it. It is a command-line tool that generates reports in HTML, CSV, XML, SQLite, and other formats. Yasca is easily extensible via a plugin-based architecture, so scanning any particular file is as simple as coming up with the rules or integrating external tools. Yasca also features a simple regular-expression plugin that allows new rules to be written in less than a minute.

Yasca is written in command-line PHP and released under the BSD license.

Usage

You can download Yasca here:

yasca-2.1.zip

Or read more here.


21 March 2015 | 1,608 views

XSSYA v2.0 Released – XSS Vulnerability Confirmation Tool

We first published about XSSYA back in 2014, and it seemed to be pretty popular, there’s not a whole lot of tools in the XSS (Cross Site Scripting) space.

For those who are unfamiliar, XSSYA used to be Cross Site Scripting aka XSS Vulnerability Scanner & Confirmation tool – the scanning portion has been removed to reduce false positives and it now focuses on XSS Vulnerability Confirmation.

It uses two main methods:

  • Method number 1 for Confirmation Request and Response
  • Method number 2 for Confirmation Execute encoded payload and search for the same payload in web HTML code but decoded

XSSYA v2.0 Released - XSS Vulnerability Confirmation Tool

We have written about a couple of XSS related tools before:

XSS-Proxy – Cross Site Scripting Attack Tool
XSS Shell v0.3.9 – Cross Site Scripting Backdoor Tool

Features

  • Supports HTTPS
  • After Confirmation (execute payload to get cookies)
  • Identify 3 Types of WAF (Mod_Security – WebKnight – F5 BIG IP)
  • Can be run in Windows & Linux
  • XSSYA has a library of encoded payloads To bypass WAF (Web Application Firewall)
  • Supports saving the HTML before executing the payload

What’s new in v2.0?

  • More payloads; library contains 41 payloads to enhance detection level
  • XSS scanner is now removed from XSSYA to reduce false positive
  • URLs to be tested used to not allow any character at the end of the URL except (/ – = -?) but now this limitation has been removed
  • HTML5 Payloads
  • IP Address Conversion (Hex, DWORD, Octal etc)
  • XST (Cross Site Tracing) Detection

You can download XSSYA here:

master.zip

Or read more here.


19 March 2015 | 563 views

Pinterest Bug Bounty Program Starts Paying

There’s been a fair bit of news about bug bounty programs in the past year or so, with Twitter officially starting to pay bug bounties at the end of 2014 and Google recently removing the caps from their program and making Pwnium all year round.

Pinterest Bug Bounty Program Starts Paying

The latest news is Pinterest bug bounty program has started paying (finally), before this they just offered t-shirts and were sceptical about opening up paid bounties as they were exposed to multiple flaws because they hadn’t fully adopted HTTPS.

Pinterest’s journey toward becoming a fully HTTPS website opened a lot of doors, including a potentially profitable one for hackers.

The social networking site this week announced that it would begin paying cash rewards through its bug bounty program, upping the stakes from the T-shirt it originally offered last May when it kicked off the Bugcrowd-hosted initiative.

The news complements Pinterest’s full adoption of encrypted communication and traffic from its website.

“I feel HTTPS will soon be seen as a requirement for anyone doing business online,” said Paul Moreno, security engineering lead on Pinterest’s cloud team.

Pinterest spells out the scope of its bounty program on its Bugcrowd page. The company said it will start paying between $25 and $200 for vulnerabilities found on a number of Pinterest properties, including its developer site, iOS and Android mobile applications, API, and ads pages among others.

“We have a strong experimentation culture and we feel that HTTPS foundation provides the minimal baseline for us to get higher value bugs,” Moreno told Threatpost. “We are experimenting with the paid approach for these community sourced higher value bugs and will evaluate the program periodically.”

The bug bounty payout was discussed during the announcement of their full move to HTTPS and discusses some of the issues they faced and of course the good parts of moving to a full HTTPS site.

You can read the original full blog post here: Making Pinterest HTTPS

Many high-value Internet properties have moved to HTTPS in the wake of the Snowden revelations. The continuous flow of leaked documents demonstrating the breadth of government surveillance and collection of personal data has accelerated a number of tech companies’ migrations to HTTPS.

Moreno said that Pinterest’s move to HTTPS, however, was not without its challenges. Standing out among them was the site’s working relationships with content delivery networks (CDNs) that support HTTPS and Pinterest’s digital certificates. Other expected challenges, Moreno said, were some marginal performance issues, older browser support, mixed content warnings, and referral header removal from HTTPS to HTTP sites.

Once a test was rolled out to its large Pinner community in the U.K., Moreno said some unexpected issues cropped up including CDN content that broke the site’s Pin It functionality and some sitemap files that were not updated to point to HTTPS domains. Those were addressed respectively by orchestrating a DNS change to a new CDN provider, and the implementation of a meta referrer header to support HTTPS tracking to HTTP sites.

“In addition, having multiple CDN providers that supported HTTPS gave us options for performance as well as commercial leverage,” Moreno said in a blogpost announcing the move.

“In the end, we enhanced the privacy of Pinners by enabling encryption while also hindering exploitation by way of man-in-the-middle attacks, session hijacking, content injection, etc. This also paved the way for future products that may require HTTPS to launch,” Moreno said.

The bug bounty program with more details can be found here: Pinterest @ Bugcrowd with outlines for minimum rewards.

It basically covers all Pinterest domains, mobile apps and subdomains, and there’s been a 10x increase of bugs submitted – which is not surprising really. Money is WAY better than a t-shirt.

Source: ThreatPost


14 March 2015 | 1,639 views

wig – CMS Identification & Information Gathering Tool

wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. It’s strength is CMS identification, it can also attempt to do OS fingerprinting.

wig - CMS Identification & Information Gathering Tool

The application fingerprinting is based on checksums and string matching of known files for different versions of CMSes. This results in a score being calculated for each detected CMS and its versions. Each detected CMS is displayed along with the most probable version(s) of it. The score calculation is based on weights and the amount of “hits” for a given checksum.

wig also tries to guess the operating system on the server based on the ‘server’ and ‘x-powered-by’ headers. A database containing known header values for different operating systems is included in wig, which allows wig to guess Microsoft Windows versions and Linux distribution and version.

Version 0.5 has just been tagged/released on Github and there are a bunch of changes since our previous posting in 2014 – wig – WebApp Information Gatherer – Identify CMS

There are various other tools which perform similar functions such as CMS identification and issue detection:

CMSmap – Content Management System Security Scanner
Droopescan – Plugin Based CMS Security Scanner
WhatWeb – Identify CMS, Blogging Platform, Stats Packages & More
BlindElephant – Web Application Fingerprinter
Web-Sorrow v1.48 – Version Detection, CMS Identification & Enumeration
Wappalyzer – Web Technology Identifier (Identify CMS, JavaScript etc.)
WPScan – WordPress Security/Vulnerability Scanner

Features

  • CMS version detection by: check sums, string matching and extraction
  • Lists detected package and platform versions such as asp.net, php, openssl, apache
  • Detects JavaScript libraries
  • Operation system fingerprinting by matching php, apache and other packages against a values in wig’s database
  • Checks for files of interest such as administrative login pages, readmes, etc
  • Currently the wig’s databases include 28,000 fingerprints
  • Reuse information from previous runs (save the cache)
  • Implement a verbose option
  • Remove dependency on ‘requests’
  • Support for proxy
  • Proper threading support
  • Included check for known vulnerabilities

Changes Since wig v.01

  • Added fingerprints for more CMS, OS, platforms
  • Improved and updated old fingerprints
  • Proxy support
  • List vulnerabilies associated with detected software version
  • Added detection of JavaScript libs
  • General site information (currently title, cookie, ip)
  • Removed requirement for 3rd party python libs (requests). Now only requires Python3
  • Improved verbose output
  • Added a cache
  • Improved structure of the output
  • Detection of generally interesting files (readme, backups, etc)
  • Implemented proper threading via thread pool

Requirements

wig is built with Python 3, and is therefore not compatible with Python 2.

Usage

You can download wig v0.5 here:

0.5.1.zip

Or read more here.