Archive | April, 2010

DAVTest – WebDAV Vulnerability Scanning (Scanner) Tool

Keep on Guard!


When facing off against a WebDAV enabled server, there are two things to find out quickly: can you upload files, and if so, can you execute code?

DAVTest attempts help answer those questions, as well as enable the pentester to quickly gain access to the host. DAVTest tries to upload test files of various extension types (e.g., “.php” or “.txt”), checks if those files were uploaded successfully, and then if they can execute on the server. It also allows for uploading of the files as plain text files and then trying to use the MOVE command to rename them to an executable.

Assuming you can upload an executable, a test file does you no good–so DAVTest can automatically upload a fully functional shell. It ships with shells for PHP, ASP, ASPX, CFM, JSP, CGI, and PL, and dropping a file in the right directory will let you upload any back-door you like.

Features


  • Upload with executable extension or .txt
  • Checks for successful upload and execution
  • Supports MOVE and MKCOL
  • Can upload backdoor/shell or arbitrary files
  • Basic authentication

DAVTest is written in PERL and licensed under the GPLv3.

You can download DAVTest v1.0 here:

davtest-1.0.zip

Or read more here.

Posted in: Exploits/Vulnerabilities, Hacking Tools, Web Hacking

Topic: Exploits/Vulnerabilities, Hacking Tools, Web Hacking


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


Texas Man Pleads Guilty To Bot Network For Hire

Keep on Guard!


Another botnet herder bites the dust, the latest news in the malware arena is about David Anthony Edwards from Texas who has admitted he and his accomplice had offered tailor made malware and DDoS attacks for rent.

22,000 zombies is a reasonable number of bots for a herder to control on their own, and assuming they are all on broadband connections, could generate enough network noise to saturate most connections.

A Texas man has agreed to plead guilty to charges he trained a botnet on a popular internet service provider so he could demonstrate custom-made malware to a potential customer.

David Anthony Edwards of Mesquite, Texas admitted that in August 2006 he and alleged accomplice Thomas James Frederick Smith unleashed a flood of data on ThePlanet.com to demonstrate the effectiveness of bot software they called Nettick, according to court documents. The men allegedly told one purchaser they had 22,000 zombie machines under their control and would sell them for 15 cents apiece in minimum batches of 5,000.

Smith, most recently of Parris Island, South Carolina, has pleaded not guilty to the charges. A trial is scheduled to begin May 17.

Even though he has admitted to wrong-doing he has pleaded not guilty to the charges, I guess we’ll have to wait for the trial in May to see what actually happens and if he is sentenced. Seen as though it’s not a trumped up terrorism charge I personally think he’ll get off without a huge sentence.

Perhaps a hefty fine and a couple of years ‘suspended sentence’.

In a plea agreement signed by Edwards, he also said that he and Smith breached servers operated by webhost, T35.net. They then extracted password files and made hundreds of thousands of user IDs and access codes available online, the document, filed in US District Court in Dallas, stated. The pair went on to deface the website, Edwards added.

According to an indictment, they also rebuked T35 admins with the words “How are all the users going to be compensated?”

Edwards, who went by the online handle Z00k, said the costs to T35.net were between $5,000 and $10,000. He is scheduled to enter his plea in court on Thursday. He faces a maximum of five years in prison, a $250,000 fine, and he will be required to pay restitution to the victims. ®

It seems like they got up to some other dodgy business too hacking and defacing a webhost – that’s not really a great way to keep yourself low-profile. They should take some lessons from the Eastern European bot herders who stay completely off the grid.

Anyway it seems like the legal system is starting to catch up with these kind of ‘underground’ business schemes and slowly but surely shutting them down.

Sadly the fact remains, the bad guys are always one step ahead of the good guys.

Source: The Register

Posted in: Legal Issues, Malware

Topic: Legal Issues, Malware


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


fuzzdb – Comprehensive Set Of Known Attack Sequences

Keep on Guard!


fuzzdb is a comprehensive set of known attack pattern sequences, predictable locations, and error messages for intelligent brute force testing and exploit condition identification of web applications.

Many mechanisms of attack used to exploit different web server platforms and applications are triggered by particular meta-characters that are observed in more than one product security advisory. fuzzdb is a database attack patterns known to have caused exploit conditions in the past, categorized by attack type, platform, and application.

Because of the popularity of a small number of server types, platforms, and package formats, resources such as logfiles and administrative directories are typically located in a small number of predictable locations. A comprehensive database of these, sorted by platform type, makes brute force fuzz testing a scalpel-like approach.

Since system errors contain predictable strings, fuzzdb contains lists of error messages to be pattern matched against server output in order to aid detection software security defects.

Primary sources used for attack pattern research:

  • researching old web exploits for repeatable attack strings
  • scraping scanner patterns from http logs
  • various books, articles, blog posts, mailing list threads
  • patterns gleaned from other open source fuzzers and pentest tools
  • analysis of default app installs
  • system and application documentation
  • error messages

It’s like a non-automated open source scanner without the scanner. You can download fuzzdb v1.06 here:

fuzzdb-1.06.tgz

It’s recommended to sync via SVN though as the contents will be a lot fresher as compared to the files in the tar.

Or read more here.

Posted in: Hacking Tools, Secure Coding

Topic: Hacking Tools, Secure Coding


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


Seattle Computer Security Expert Turns Tables On The Police

Outsmart Malicious Hackers


Honestly there’s been nothing much going on for the past few days or over the weekend, Microsoft retracted some patches citing ‘quality issues’ and there was announcement about Metasploit Express version.

But well that was about it! This was the only story I found vaguely interesting, because well we all love to flip the bird to ‘The Man‘ don’t we? That’s why we do what we do.

A ‘cyber PI’ in Seattle turned the tables on the police when they tried to give him the run around when he was arrested after refusing to identify himself.

A computer security expert used his elite skills to turn the tables on Seattle Police who arrested him for doing nothing more than refusing to identify himself during a drunken street golf game in 2008.

Eric Rachner, identified by The Seattle PI as a cyber security expert, fought the charges for obstructing a police officer, and as part of his defense, he demanded access to the video and audio recordings of his arrest. The recordings are automatically made using cameras mounted to squad car dashboards and microphones on police uniforms.

Seattle Police refused and prosecutors eventually dropped the charges, but that wasn’t good enough for Rachner. He filed a request under a Washington state public disclosure law demanding access to the recordings and was again turned down.

“These recordings are both past our retention period and can no longer be obtained,” Seattle Police Department officials responded in writing. “Please note that the majority of 911 calls and videos are retained for a period of ninety (90) days.”

The whole story is quite laughable and extremely indicative to how government organizations generally act – trying to brush people off. It’s good to see a citizen standing up for his rights and calling them out when actually he’s done nothing wrong and he was punished for non-compliance.

It turns out he wasn’t even the one that prompted the 911 call in the first place, one of the street golfers accidentally sliced the foam ball and hit a passerby in the face. He wasn’t injured but after being heckled by the golfers he called the police.


So Rachner researched the video and audio recording system used by the department and discovered that permanent logs index every recording and show when it is uploaded, flagged for retention, played, copied, or deleted.

Armed with this new information, Rachner filed a public records request for the log, and that’s when he hit pay dirt. It showed that the recordings had been flagged for retention after his arrest and still existed. Soon enough, he had them, and they backed his contention that he was arrested solely for refusing to provide identification to police. (Officers claimed otherwise but never elaborated).

Police now say their earlier claim that the videos couldn’t be obtained was the result of a server error, which sounds like the modern-day equivalent of the dog-ate-my-homework excuse.

It’s a good result and I hope it prompts more people to stand up for their civil rights and stop the US becoming a totalitarian state “Papers please”.

You can read the full report from the Seattle PI here including a quote from Dan Kaminsky:

Local computer security expert investigates police practices

Source: The Register

Posted in: Hacking News

Topic: Hacking News


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


ReFrameworker – General Purpose Framework Modifier

Outsmart Malicious Hackers


ReFrameworker is a general purpose Framework modifier, used to reconstruct framework Runtimes by creating modified versions from the original implementation that was provided by the framework vendor. ReFrameworker performs the required steps of runtime manipulation by tampering with the binaries containing the framework’s classes, in order to produce modified binaries that can replace the original ones.

It was developed to experiment with and demonstrate deployment of MCR (Managed Code Rootkits) code into a given framework.

Features

  • Performs all the required steps needed for modifying framework binaries (disassemble, code injection, reassemble, precompiled images cleaning, etc.)
  • Fast development and deployment of a modified behavior into a given framework
  • Auto generated deployers
  • Modules: a separation between general purpose “building blocks” that can be injected into any given binary, allowing the users to create small pieces of code that can be later combined to form a specific injection task.
  • Can be easily adapted to support multiple frameworks by minimal configuration (currently comes preconfigured for the .NET framework)
  • Comes with many “preconfigured” proof-of-concept attacks (implemented as modules) that demonstrate its usage that can be easily extended to perform many other things.

ReFrameworker, as a general purpose framework modification tool, can be used in other contexts besides security such as customizing frameworks for performance tuning, Runtime tweaking, virtual patching, hardening, and probably other usages – It all depends on what it is instructed to do.

You can download ReFrameworker v1.1 here:

Software – ReFrameworker_V1.1.zip
Source Code: ReFrameworker_V1.1_Source_Code.zip

Or read more here.

Posted in: Hacking Tools, Malware, Secure Coding

Topic: Hacking Tools, Malware, Secure Coding


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


PayPal Patches Critical Security Vulnerabilities

Outsmart Malicious Hackers


PayPal in the news again for a series of fairly high-profile vulnerabilities discovered by the same guy that found the XSS bugs in Google Calendar and Twitter (Nir Goldshlager).

I’m glad people are looking at PayPal as I’m sure the volume of monetary transactions that pass through their site on a daily basis is huge. It’s still the leading payment processing solution, especially for International transactions.

Seems to be more on the business side rather than effecting users, but exposing so much customer is never a good thing.

A security researcher has uncovered multiple vulnerabilities affecting PayPal, the most critical of which could have enabled attackers to access PayPal’s business and premier reports back-end system.

The vulnerabilities were patched recently by PayPal after security researcher Nir Goldshlager of Avnet Technologies brought the vulnerabilities to the site’s attention. The most critical bug was a permission flow problem in business.paypal.com, and could have potentially exposed a massive amount of customer data.

“An attacker was able to access and watch any other user’s financial, orders and report information with unauthorized access to the report backend application,” Goldshlager explained. “When users have a premier account or business account the transaction details of their orders are saved in the reports application … an attacker can look at any finance reports of premier or business accounts in the PayPal reports application and get a full month [and] day summary of the orders reports.”

That includes information such as the PayPal buyer’s full shipping address, the PayPal transaction ID of the buyer and the date and amount of transaction.

It’s good to see responsible disclosure by the researcher and swift action on behalf of PayPal fixing the flaws. It seems pretty rare these days with the walls of bullshit companies push our via their PR/comms channels try to create enough smoke and mirrors to distract everyone from the real issues.

Hijacking a users account on PayPal is a pretty serious issue as the attacker could simply transfer all the persons funds to their own account, if they weren’t very active they wouldn’t even notice. Even more dangerous if their account is linked to a Credit or Debit card.

The other vulnerabilities Goldshlager found included an XSS (cross-site scripting) vulnerability affecting the paypal.com and business.paypal.com sites that an attacker could use to steal session IDs and hijack user accounts, as well as a CSRF (cross-site request forgery) bug that exposed user account information. The CSRF vulnerability impacts the IPN (Instant Payment Notification) system, a PayPal service that sends a message once a transaction has taken place.

Once IPN is integrated, sellers can automate their back offices so they don’t have to wait for payments to come in to fulfill orders, Goldshlager explained.

“This CSRF exploit method exposes the same information from the buyer as the first vulnerability … to exploit a CSRF attack that adds a Instant Payment Notification access, the attacker will make an attack that adds his own Website address to the victim account IPN settings, and when there is transaction on PayPal the victim’s transaction details will be sent to the attacker’s Website,” he said.

The IPN issue is dangerous too as you could develop some software to place bogus orders on ecommerce sites then generate a fake IPN back to the site to get the goods for free without any actual payment taking place.

Some other minor CSRF flaws were also discovered, but according to Paypal ‘nearly all‘ have been fixed.

Source: eWeek (Thanks to Nir Goldshlager himself for e-mailing me the article)

Posted in: Exploits/Vulnerabilities, Privacy, Web Hacking

Topic: Exploits/Vulnerabilities, Privacy, Web Hacking


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.