HTTP Security Considerations – An Introduction To HTTP Basics

The New Acunetix V12 Engine


HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.

HTTP Security Considerations - An Introduction To HTTP Basics

HTTP is the protocol that powers the web and to penetrate via a web service it pays to have a good solid foundational understanding of HTTP, how it works and the common response codes – many of which can lead to some kind of vulnerability which is exploitable.

The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, and hypermedia information systems.[1] HTTP is the foundation of data communication for the World Wide Web.

Hypertext is structured text that uses logical links (hyperlinks) between nodes containing text. HTTP is the protocol to exchange or transfer hypertext.

Development of HTTP was initiated by Tim Berners-Lee at CERN in 1989. Standards development of HTTP was coordinated by the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), culminating in the publication of a series of Requests for Comments (RFCs). The first definition of HTTP/1.1, the version of HTTP in common use, occurred in RFC 2068 in 1997, although this was made obsolete by RFC 2616 in 1999 and then again by the RFC 7230 family of RFCs in 2014.

Source: Wikipedia

From a security perspective it’s important to understand:

– Requests
– Request methods
– Responses
– Response status codes

All of which are covered in the Security-focused HTTP article by Acunetix.

You can find the article with the full details here:

HTTP Security: A Security-focused Introduction to HTTP, Part 1


Topic: Countermeasures

Cangibrina – Admin Dashboard Finder Tool

Use Netsparker


Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists, Google, Nmap and robots.txt.

Cangibrina - Admin Dashboard Finder Tool


It is multi-threaded, supports modifying your user agent, using a TOR proxy, custom dorks, Nmap integration and can use both DuckDuckGo and Google.

Cangibrina Admin Dashboard Finder Requirements

  • Python 2.7
  • mechanize
  • PySocks
  • beautifulsoup4
  • html5lib
  • Nmap
  • TOR

Cangibrina Usage to Find Admin Dashboards

There are other specific tools in this area like WPScan for WordPress and DruPwn for Drupal – and in those cases the dashboard URLs are already known.

You can download Cangibrina here:

cangibrina-master.zip

Or read more here.


Topic: Hacking Tools

Enumall – Subdomain Discovery Using Recon-ng & AltDNS

The New Acunetix V12 Engine


Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.

Enumall - Subdomain Discovery Using Recon-ng & AltDNS


This gives you the ability to run multiple domains within the same session. The tool only has one module that needs an API key (/api/google_site) find instructions for that on the recon-ng wiki.

Setting up Enumall for Subdomain Discovery

Install recon-ng from Source, clone the Recon-ng repository:

Change into the Recon-ng directory:

Install dependencies:

Link the installation directory to /usr/share/recon-ng

Optionally (highly recommended) download:

AltDNS
– A good subdomain bruteforce list (example here)

Create the config.py file and specify the path to Recon-ng and AltDNS as it showed in config_sample.py.


Basic Usage for Subdomain Enumeration

Also supports:

You can download Enumall here:

enumall-amster.zip

Or read more here.


Topic: Networking Hacking

RidRelay – SMB Relay Attack For Username Enumeration

Use Netsparker


RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.

RidRelay - SMB Relay Attack For Username Enumeration


How RidRelay SMB Relay Attack Works

RidRelay combines the SMB Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps:

  1. Spins up an SMB server and waits for an incoming SMB connection
  2. The incoming credentials are relayed to a specified target, creating a connection with the context of the relayed user
  3. Queries are made down the SMB connection to the lsarpc pipe to get the list of domain usernames. This is done by cycling up to 50000 RIDs

For best results, use with Responder.


Using RidRelay to Enumerate Usernames

First, find a target host to relay to. The target must be a member of the domain and MUST have SMB Signin off. CrackMapExec can get this info for you very quick!

Start RidRelay pointing to the target:

OR

Also output usernames to file

You can download RidRelay here:

ridrelay-master.zip

Or read more here.


Topic: Hacking Tools
NetBScanner - NetBIOS Network Scanner

NetBScanner – NetBIOS Network Scanner

NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol. For every computer located by this NetBIOS scanner, the following information is displayed: IP Address Computer Name Workgroup or Domain MAC Address Network adapter manufacturer (from MAC address). NetBScanner also shows whether a […]

Topic: Hacking Tools
Metta - Information Security Adversarial Simulation Tool

Metta – Information Security Adversarial Simulation Tool

Metta is an information security preparedness tool in Python to help with adversarial simulation, this can help you check various detection and control capabilities within your organisation. This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test (mostly) your host based instrumentation but may also allow you […]

Topic: Countermeasures