Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

07 May 2014 | 2,121 views

MagicTree v1.3 Available For Download – Pentesting Productivity

Check For Vulnerabilities with Acunetix

Have you ever spent ages trying to find the results of a particular portscan you were sure you did? Or grepping through a bunch of files looking for data for a particular host or service? Or copy-pasting bits of output from a bunch of typescripts into a report? We certainly did, and that’s why we wrote MagicTree – so that it does such mind-numbing stuff for us, while we spend our time hacking.

MagicTree is a pentesting productivity tool. It is designed to allow easy and straightforward data consolidation, querying, external command execution and (yeah!) report generation. In case you wonder, “Tree” is because all the data is stored in a tree structure, and “Magic” is because it is designed to magically do the most cumbersome and boring part of penetration testing – data management and reporting.

MagicTree v1.3 - Pentesting Productivity

Changelog for v1.3

  • Fix for #307 “Cannot create a working report template in LibreOffice 3.5.4.2″.
  • Better parsing of Imperva Scuba XML
  • Fixed NullPointerException in FileFilter
  • Added debugging to idTracker and sanity checking to TreeController to catch the integrity bug
  • Fix for NullPointerException when handling MtSimpleObjects with no text
  • Fixes for data integrity bugs causing duplicated ids and broken xrefs
  • Added support for AppScan XML – contributed by VienHa Tran

Installation

No installation is required for MagicTree. The application is distrubuted as a single JAR file which has to be executed with JRE. Just save the file on your desktop. Double-click on it to execute it or, for less user-friendly OSes, issue “java -jar MagicTree.jar’ command.

Can’t get much better than that really, penetration testing report generation! Who wants to do that manually. IF you combined this with using something like Kvasir the Penetration Testing Data Management Tool, you’d be onto a pretty good process I reckon.

You can download MagicTree here:

MagicTree-build1814.jar

Or read more here.



06 May 2014 | 2,955 views

Teen Accused Of Hacking School To Change Grades

So an interested piece of news I spotted today is about Jose Bautista, an 18 year old from Miami-Data, USA who was arrested and charged with hacking school to change grades.

It seems he’s being dealt with fairly harshly, which is a trend with ‘hacking’ related crimes nowadays.

Jose Bautista - School Hacker

We did have a story similar to this way back in 2007 – Class President Hacks School Grades, he was also 18 and charged/arrested for what he did.

A South Florida teen was taken into custody after, authorities said, he illegally accessed the Miami-Dade Public Schools database and changed four students’ grades.

Eighteen-year-old Jose Bautista, a senior at Dr. Michael M. Krop Senior High School in Northeast Miami-Dade, faced Miami-Dade Circuit Judge Thomas J. Rebull, Friday. “You’ve been arrested on four counts of offenses against intellectual property, public records exemption and four counts of offenses against computer users,” Rebull told Bautista at the bond hearing.

Miami-Dade Schools Police arrested Bautista on Thursday. They said the teen took money, hacked into the school’s computer system and changed students’ grades. Police said each of the counts Bautista is charged with represents one of the students for whom he altered grades.

“It’s not fair to the people that really try,” said Mayan Dehry, a student at Bautista’s school. “Like, I know a lot of kids are in AP classes, and they try really hard to get the grades that they get. I don’t know, if you’re just going to be lazy and then change your grades, that’s not what learning is about.”

We ALWAYS get e-mails about this kind of stuff, there’s one here – Retarded E-mails – Brute Force, Change School Grades, Hack US Military & MORE.

So we know there’s a LOT of kids out there who want to do this kind of stuff, some to actually change their grades (but that’s unlikely, if they can hack the system they are probably smart enough to get high grades without much effort), some to prove a point to the school (Antiestablishmentarianism) and some for peer recognition (yo I hacked school I’m cool dawg).

Fellow student Brett Curtis said Bautista’s actions are not representative of the majority of his peers. “We have almost 3,000 kids here who come to school every single day, who work hard for every single grade that they earn,” he said.

News of Bautista’s arrest spread through the school Friday, even reaching the ears of faculty members. “I’m not surprised. The way that kids today are able to [use computers],” said teacher George Lesperance. “All I can say is, I’d have to get more information.”

Curtis said he is certain school officials will make sure the students involved will be brought to justice. “If it is true, it’s definitely not fair to the rest of the students,” he said. “It certainly makes me angry. Like I said, I can’t guarantee or tell you if it happened or not, but we have an amazing administration that will get to the bottom of it.”

When Bautista was booked into jail, his eyes were red and watery in his mug shot. In bond court Friday, a public defender spoke on the teen’s behalf. “There’s no legal basis for four counts of either of the charges,” said the attorney, “since there’s nothing specifically alleged as to the number of times this was allegedly done.”

Bautista’s bond has been set at $5,000.

The teen remained behind bars on Friday. Once released, he will be on house arrest and will be required to wear a GPS monitor.

I honestly don’t think he’s much of a flight risk, and his bail is fairly low – so it’s not too bad. At least they aren’t trying to pin some kind of bullshit terrorism charge on him like poor old Gary McKinnon.

It shows though school systems are pretty secure as we get to see this kind of news pretty rarely, and we know there are people trying to change their grades every day. Either that, or there are a lot of smart kids out there changing their grades without getting caught!

Source: WSVN.com


02 May 2014 | 1,378 views

Host-Extract – Enumerate All IP/Host Patterns In A Web Page

host-extract is a little ruby script that tries to extract all IP/Host patterns in page response of a given URL and JavaScript/CSS files of that URL.

With it, you can quickly identify internal IPs/Hostnames, development IPs/ports, cdn, load balancers, additional attack entries related to your target that are revealed in inline js, css, html comment areas and js/css files.

This is unlike a web crawler which looks for new links only in HTML anchor tags or the like. Using that method you might miss many additional targets if you ever use such web crawler or other GUI-based tools that shows you your main target and its relationship with its linked sub/off-site domains.

Host Extract

In some cases, host-extract may give you false positives when there are some words like – main-site_ver_10.2.1.3.swf. With the -v option, you can ask the tool to output html view-source snippets for each IP/Domain extracted. This will shorten your manual analysis time.

Usage

There are other tools that do similar things, some overlap, but nothing exactly like this. host-extract would be well combined with the following:

- wsScanner – Web Services Footprinting, Discovery, Enumeration, Scanning and Fuzzing tool
- theHarvester – Gather E-mail Accounts, Subdomains, Hosts, Employee Names – Information Gathering Tool
- Web-Sorrow v1.48 – Version Detection, CMS Identification, Enumeration & Server Scanning Tool

You can grab host-extract via SVN here:

Or read more here.


01 May 2014 | 755 views

Microsoft Confirms Internet Explorer 0-Day

So during the past weekend, Microsoft confirmed an Internet Explorer 0-day that is actually being used in targeted online attacks.

Vulnerability in Internet Explorer Could Allow Remote Code Execution

It will be interesting to see if they push an out of band patch for this one or just wait for the next Patch Tuesday.

Internet Explorer 0-Day

It’s pretty serious as it effects the whole family including Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.

On Saturday, late in the evening, Microsoft issued a public advisory confirming the existence of a new vulnerability in Internet Explorer that’s being used in targeted attacks online.

The vulnerability was disclosed by researchers at FireEye, who observed attacks against Internet Explorer versions 9 though 11. While criminals seem to be focused on the later releases, all versions of Internet Explorer are affected.

Exploits leveraging the use-after-free vulnerability will bypass protections in ASLR and DEP and gain code execution privileges.

In a blog post, FireEye explains:

“Threat actors are actively using this exploit in an ongoing campaign which we have named Operation Clandestine Fox. However, for many reasons, we will not provide campaign details. But we believe this is a significant zero day as the vulnerable versions represent about a quarter of the total browser market. We recommend applying a patch once available.”

The focus does seem to be on IE9 and 11 (which would be the most commonly used versions on newer operating systems (Windows 7 & 8).

EMET will help Microsoft says..

I would expect them to be pushing out a patch for this ASAP as it’s a pretty serious flaw.

In addition, FireEye researchers stated the group responsible for this exploit has had access to “a select number of browser-based 0-day exploits in the past.”

Moreover, the group is proficient at lateral movement, and have been difficult to track as they rarely reuse command and control infrastructure.

Until a patch is released, Microsoft has said that EMET will help mitigate attacks against this flaw.

Further, versions of Internet Explorer running with the default Enhanced Security Configuration are not at risk, provided that the malicious website used to target the vulnerability isn’t listed in the Trusted sites zone.

This is typically the case for Internet Explorer on Windows Server 2003, Windows Server 2008 (and 2008 R2), and Windows Server 2012 (and 2012 R2).

Microsoft hasn’t said if they will release an out-of-cycle patch for this flaw, only that they’ll take the “appropriate action” once the investigation is completed.

The next Patch Tuesday is due almost two weeks from now on Tuesday 13th May 2014, so that’s a fair bit of exposure if this exploit goes public.

We shall have to wait and see what happens, knowing Microsoft – not a lot.

Source: Network World


29 April 2014 | 1,171 views

BlindElephant – Web Application Fingerprinter

The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.

BlindElephant

BlindElephant can be used directly as a tool on the command line, or as a library to provide fingerprinting functionality to another program.

Features

  • Fast, low-resource approach (generally <6 seconds and < 400kb)
  • Support for 15 commonly deployed web apps (and hundreds of versions), and very easy to add support for more
  • Support for web app plugins (Drupal and WordPress currently, more with community input)

There are other similar projects such as:

- WAFP – Web Application Finger Printing Tool
- WhatWeb – Next Gen Web Scanner – Identify CMS (Content Management System)
- wig – WebApp Information Gatherer – Identify CMS
- Web-Sorrow v1.48 – Version Detection, CMS Identification & Enumeration
- Wappalyzer – Web Technology Identifier (Identify CMS, JavaScript etc.)

You can grab BlindElephant from the SVN repo here:

Or read more here.


24 April 2014 | 1,371 views

Viber Vulnerable To Man In The Middle Attack (MITM)

So this week, researchers at the University of New Haven have been focusing on Viber and have found that pretty much everything transferred and stored on the Viber service, except the messages themselves is not encrypted either in transit or at rest (doodles, images, location data & videos).

The implication of this is that the lack of encryption leaves Viber vulnerable to sniffing/snooping or MITM attacks via a rogue AP, a telco network or anyone else that can see the traffic in the pipe.

Viber Vulnerable to MITM

The same team published a similar WhatsApp location bug (the location image is sent unencrypted) last week on Youtube – WhatsApp Location Bug/Vulnerability.

Popular Whatsapp-like messaging service Viber is exposing users to man-in-the-middle and other attacks because it isn’t encrypting various data at rest and in transit, security researchers have warned.

The mobile app allows users to send each other messages, videos, images and “doodles”, share GPS location details and make voice calls.

However, researchers at the University of New Haven Cyber Forensics Research and Education Group (UNHcFREG) found a “serious security flaw” in the way Viber receives videos, images and doodle files; the way it sends and receives location data; and the way it stores data on its Amazon servers.

The team’s experimental network created a rogue access point utilising a Windows 7 PC’s Virtual Wi-Fi Miniport Adapter and a first smartphone connected to the same network. It then connected a second smartphone outside the network via GSM and used it to exchange data with the first smartphone over Viber.

It said that with tools such as NetworkMiner, Wireshark, and NetWitness it was able to capture traffic sent over the test network.

The 2nd worry here is that the data is stored on Amazon servers unencrypted, is not deleted immediately and can be accessed without any authentication! That means as long as you can capture the URLs of the videos/files, you can just put them into your browser and download them directly from Amazon.

You can view the video posted by the team here:

Viber Security Vulnerabilities: Images, Doodles, Location and Videos sent over Viber is unencrypted

Specifically, the team claimed that images, doodles and videos received are unencrypted; location data sent and received is unencrypted; and data is stored on the Viber Amazon servers in unencrypted format.

Further, it said user data stored on Viber’s Amazon servers is not deleted immediately and that it can be easily accessed without any authentication mechanism – “simply visiting the intercepted link on a web browser gives us complete access to the data”.

The researchers added the following:

Anyone, including the service providers will be able to collect this information – and anyone that sets up a rogue AP, or any man-in-the middle attacks such as ARP poisoning will be able to capture this unencrypted traffic and view the images and videos received as well as the locations being sent or received by a phone.

UNHcFREG said it had already informed Viber of the security flaws but received no word back at the time of publishing. A video of the test (h/t The Hacker News) can be found here.

It recommended Viber ensure all data in transit is sent over an encrypted tunnel, that data is encrypted properly when saved and that it access to it must require authentication.

The Israeli-backed messaging service, based in Cyprus, was recently acquired for $900 million by Japanese e-commerce giant Rakuten in a bid to take the firm “to a different level”.

I would imagine with the press/media coverage this flaw is getting, Viber will have to fix this pretty sharp. Honestly with the processing power of phones now, encryption at all stages should no longer be an option or an afterthought – it should be mandatory in everything.

Seen as though they’ve taken a look at Viber and WhatsApp – I wonder what will be next? LINE, Wechat? KakaoTalk?

Source: The Register


22 April 2014 | 1,410 views

RAWR – Rapid Assessment of Web Resources

Introducing RAWR (Rapid Assessment of Web Resources). There’s a lot packed in this tool that will help you get a better grasp of the threat landscape that is your client’s web resources. It has been tested from extremely large network environments, down to 5 node networks. It has been fine-tuned to promote fast, accurate, and applicable results in usable formats. RAWR will make the mapping phase of your next web assessment efficient and get you producing positive results faster!

RAWR - Rapid Assessment of Web Resources

Along the same line as tools like EyeWitness – A Rapid Web Application Triage Tool – and others which are useful for the Information Gathering stage of a pen-test or vulnerability assessment.

Features

  • A customizable CSV containing ordered information gathered for each host, with a field for making notes/etc.
  • An elegant, searchable, JQuery-driven HTML report that shows screenshots, diagrams, and other information.
  • a CSV Treat Matrix for an easy view of open ports across all provided hosts. (Use -a to show all ports.)
  • Default password suggestions using a list compiled from several online sources.
  • Supports the use of a proxy (Burp, Zap, W3aF)
  • Captures/stores SSL Certificates, Cookies, and Cross-domain.xml
  • Customizable crawl of links within the host’s domain.
  • PNG Diagram of all pages found during crawl
  • List of links crawled in tiered format.
  • List of documents seen for each site.
  • Automation-Friendly output (JSON strings)

Requirements

  • nmap – at least 6.00 – required for SSL strength assessment
  • graphviz – site diagram from crawl (optional)
  • python-lxml – parsing xml & html
  • python-pygraphviz – site layout from crawl (optional)
  • phantomJS – tested with 1.9.1, can be downloaded/installed in local folder during –check-install

You can download RAWR 1.1 here by checking it out from Bitbucket:

Or read more here.


17 April 2014 | 1,023 views

Royal Canadian Mounted Police Arrest Heartbleed Hacker

The Heartbleed Bug was the big thing last week and honestly pretty much the biggest thing this year so far.

And it turns out someone has been caught using the Heartbleed bug in a malicious way and in Canada no less. The young Heartbleed hacker goes is a 19 year old Stephen Arthuro Solis-Reyes and hails from London, Ontario.

It seems he was using Heartbleed against the tax system in Canada (CRA or the Canada Revenue Agency).

Hearbleed Hacker in Canada

Cops in Canada have arrested a teen they believe to be behind an attack on the country’s tax system using the Heartbleed bug.

The Royal Canadian Mounted Police (RCMP) said 19-year-old Stephen Arthuro Solis-Reyes of London, Ontario, was cuffed and charged with the unauthorized use of a computer and criminal mischief in relation to the theft of taxpayers’ personal records from the Canada Revenue Agency (CRA).

“The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible,” assistant commissioner Gilles Michaud said in a statement.

“Investigators from National Division, along with our counterparts in [Ontario] Division have been working tirelessly over the last four days analyzing data, following leads, conducting interviews, obtaining and executing legal authorizations and liaising with our partners.”

He must be pretty n00b tbh if he wasn’t proxying/bouncing his IP around/using TOR/VPNs etc and gets caught in 4 days. But the majority of people that get caught for ‘hacking’ are at that level – script kiddy level.

They get a tool like Heartbleed, and run it against a server without really understanding what is going on – and how easily they can be caught. And then boom – they are in prison trying not to drop the soap.

Solis-Reyes is alleged to have exploited the Heartbleed vulnerability, present in OpenSSL running on the CRA’s servers, to swipe 900 social insurance numbers. The CRA believes that whoever hacked the systems gathered the sensitive information during a six-hour window on April 9, which was after the first public reports of the flaw and before the computers were patched.

The attack marked one of the first known instances of hackers actively exploiting the Heartbleed condition in the wild to steal user data. Though if reports are to be believed, the NSA and (likely) other government organizations have been exploiting the flaw for years in order to gather intelligence info.

The RCMP reported that it arrested Solis-Reyes without incident on April 15. The Mounties also seized computer equipment from his home. He is scheduled to appear before a court in Ottawa on July 17 to begin trial.

The investigation is still ongoing, although the Mounties did not report of any other persons involved in the attack.

So far I haven’t seen anyone else getting arrested for exploiting Heartbleed, and by now Stephen is pretty much World famous. It’ll be interesting to see if any other cases come out, I’m not sure if social insurance numbers are valuable in Canada – or if you could do anything with them – or sell them?

Here’s the algorithm and analysis – Social Insurance Number Authentication

Source: The Register


15 April 2014 | 3,335 views

Kvasir – Penetration Testing Data Management Tool

Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools – they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to share all this data with your co-workers?

Kvasir - Penetration Testing Data Management Tool

Features

That’s what Kvasir is here to help you with. Here’s what you’ll need to get started:

  • The latest version of web2py
  • A database (PostgreSQL known to work)
  • A network vulnerability scanner (Nexpose/Nmap supported)
  • Additional python libraries
  • Kvasir is a web2py application and can be installed for each customer or task.

Tools Supported

At current release, Kvasir directly supports the following tools:

This design keeps data separated and from you accidentally attacking or reviewing other customers.

This tool was developed primarily for the Cisco Systems Advanced Services Security Posture Assessment (SPA) team. While not every method used by the SPA team may directly relate we hope that this tool is something that can be molded and adapted to fit almost any working scenario.

Installation

Kvasir was primarily designed for use on short customer-focused engagements. A directory ‘application’ for each customer would be used allowing for much stronger data separation.

For example lets assume two customers, Foo Widgets and Bar Napkins.

Data for each customer is stored in /opt/data/$CUSTOMERNAME

Install Kvasir in each customer’s directory:

Now symbolically link Kvasir to the web2py application directory:

Create unique databases:

Copy the kvasir.yaml.sample to kvasir.yaml and change the defaults:

Or read more here.


09 April 2014 | 4,221 views

Heartbleed Bug SSL Vulnerability – Everything You Need To Know

Introduction

So the Internet has been exploding this week due to the Heartbleed Bug in OpenSSL which effects a LOT of servers and websites and is being hailed by some as the worst vulnerability in the history of the Internet thus far.

Heartbleed Bug

The main info on the bug can be found at http://heartbleed.com/. In basic terms, it allows you to grab 64kb chunks of whatever is stored in RAM on the server as long as it’s using a vulnerable version of OpenSSL with Heartbeat enabled.

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

Who needs the NSA when we have this eh?

So ya this is really serious, a scanner was released before anyone had chance to patch it and huge sites like Yahoo! Mail were vulnerable and exposing user passwords to anyone who used Heartbleed against it.

Everyone scrambled to fix it fast though, which is good – as it’s a major vulnerability. As can be seen in this picture, the plain text user passwords for Yahoo! mail were being leaked.

Hashing is irrelevant in this case, as the hash and hash comparison are done on the server side, so the plain text password is stored in memory at some point.

Yahoo! Heartbleed

The bad part of it is that there’s no way to tell if it’s been exploited as there’s no crash, no damage, it just spits out the data to whoever runs the exploit.

There’s a good analysis of the actual code involved here:

Diagnosis of the OpenSSL Heartbleed Bug

What Should I Do?

Well you need to check if any of the servers you manage or run are using a vulnerable version of OpenSSL, from my experience if you are still on Ubuntu 10.04 LTS you are safe from this, as it uses OpenSSL 0.9.8 without heartbeat functionality.

If you are using Ubuntu 12.04 LTS (any subversion) then you ARE vulnerable and need to update ASAP.

IF you want to scan your servers you can grab the scanning script here:

heartbleed.py

There are also a couple of online scanners you can use (just beware of false positives).

- http://rehmann.co/projects/heartbeat/
- http://filippo.io/Heartbleed/

On the server side, you can check your OpenSSL version with:

openssl version -a

Don’t pay attention to the version or date, but look at the build date – it should be AFTER April 7th.

Something like this would be a vulnerable version:

OpenSSL 1.0.1 14 Mar 2012
built on: Wed Jan 8 20:45:51 UTC 2014

After updating it should look like:

OpenSSL 1.0.1 14 Mar 2012
built on: Mon Apr 7 20:33:29 UTC 2014

How Do I Fix It?

For the majority of people, someone else probably hosts your sites and infrastructure, so you don’t need to worry that much – just change your passwords if you’re paranoid and make sure you enable 2 factor auth for anything that supports it.

Services like the Linode Nodebalancer with SSL termination have been updated, but do bear in mind your secret key could have been leaked (although, logically that’s pretty unlikely).

Linode – Heartbleed

On Ubuntu 12.04 it’s as simple as doing aptitude update; aptitude safe-upgrade -y; and then restarting all relevant services, or simply rebooting.

Ensure the build date is at minimum 2014-04-07.

If you want to check what services are using OpenSSL you can do:

lsof -n | grep ssl | grep DEL

That fixes the bug, but remember it doesn’t change the fact that your secret keys/passwords could have been leaked, there has also been reports of 2FA session tokens being leaked among other stuff.

So to be secure, you really need to revoke all your SSL certificates, regenerate a new private key and csr, and regenerate your SSL certs.

And of course, change all your passwords.

More Reading

- Amazon Linux AMIs are updated.
- Why Heartbleed is the most dangerous security flaw on the web
- Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette-style
- Hacker News – The Heartbleed Bug
- Reddit – The Heartbleed Bug