Archive | July, 2010

inundator v0.5 Released – IDS/IPS/WAF Evasion & Flooding Tool


What is inundator?

inundator is a multi-threaded, queue-driven, IDS evasion tool. Its purpose is to anonymously flood intrusion detection systems (specifically Snort) with traffic designed to trigger false positives via a SOCKS proxy in order to obfuscate a real attack.

When would I use inundator?

inundator would be used whenever you feel there is a significant chance the attack you’re about to perform may be detected by the target’s intrusion detection system. You would launch inundator prior to starting the attack, and continue running it well after you have finished the attack. The hope is that if your attack is detected by the IDS, the alert will be buried among several thousand false positives, thus minimizing the chance of an IDS analyst detecting the real attack.

Tell me more

inundator is a modern twist on an old concept — it’s an IDS/IPS/WAF evasion tool, used to anonymously flood intrusion detection systems with false positives in order to obfuscate a real
attack. inundator leverages the vagueness and poor quality of Snort’s rules files to generate completely harmless packets / HTTP requests that contain just enough keywords to trigger a false positive. We thought this was an original idea, but it looks like Snot, fwsnort’s snortspoof, and possibly others beat us to the punch. However, these tools were developed around the turn of the century, are quite dated and well-forgotten, and overall quite inferior to inundator.

inundator is full featured, multi-threaded, queue-based, supports multiple targets, and requires the use of a SOCKS proxy for anonymization. Via Tor, inundator is capable of generating around 1000 false positives per minute. Via a high-bandwidth SOCKS proxy, you might be able to generate ten times that amount.

The general idea is one would launch inundator prior to starting an attack, allow it to run during the attack, and continue to run it a while longer after you’ve accomplished the attack. The goal, of course, is to generate an overwhelming number of false positives so that your real attack is essentially buried within the other alerts, minimizing the chance of your attack being detected. It
could also be used to ruin an IDS analyst’s day, or keep an organization’s infosec department busy for a while. I suppose it could also be used to test the effectiveness of an IDS, but no, not
really.

Requirements/Compatibility

inundator is implemented in Perl (version >= 5.10 is recommended due to ithreads bugs in previous versions), and has been tested on Debian Lenny, Debian Squeeze, Ubuntu Jaunty, BackTrack4, and Mac OS X against Snort v2.8.5.2. It is presumed to work on all POSIX operating systems. Hell, it might even work on Windows.

You can download inundator v0.5 here:

inundator_0.5.tar.gz

Or read more here.

Posted in: Hacking Tools, Networking Hacking

Topic: Hacking Tools, Networking Hacking


Latest Posts:


Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network
OWASP Amass - DNS Enumeration, Attack Surface Mapping & External Asset Discovery OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces.
Cameradar - Hack RTSP Video Surveillance CCTV Cameras Cameradar – Hack RTSP Video Surveillance CCTV Cameras
Cameradar is a Go-based tool to hack RTSP Video Surveillance CCTV Cameras, it can detect open RTSP hosts, detect device models and launch automated attacks.
dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).


Adobe Patches PDF Vulnerabilities Being Exploited In The Wild


At least! Adobe has sorted itself out and released patches for 17 critical vulnerabilities in their Reader and Acrobat applications. We reported back in January about Active Exploitation Of Unpatched PDF Vulnerabilities.

The latest slew of vulnerabilities has been actively exploited by hackers for at least the past month as detected in the wild by anti-virus companies. Many of the vulnerabilities were critical and could lead to remote code execution, especially combined with the recent flash exploits.

They had to step up as well and get the patches out fast because the code went public in June.

Adobe on Tuesday patched 17 critical vulnerabilities in Reader and Acrobat, including one that hackers have been using for nearly a month to commandeer PCs.

Another patch fixed a design flaw in the PDF format that attackers have been exploiting since April to dupe users into downloading a Trojan horse.

Adobe rushed the security update, which was originally slated to ship July 13, because exploit code went public and attacks using rigged PDF documents started showing on antivirus vendors’ reporting systems four weeks ago. The company patched Flash — hackers were tricking people into visiting malicious sites, then using the same bug to launch drive-by attacks — on June 10.

Sixteen of the 17 fixed flaws were labeled with the phrase “could lead to code execution” in Adobe’s advisory , the company’s way of saying that the bug was critical and could be used to hijack machines. Like Apple , and unlike Microsoft , Adobe doesn’t rate the severity of the vulnerabilities it patches. The seventeenth patch was also likely critical: “Arbitrary code execution has not been demonstrated, but may be possible,” the advisory read.

Looks like they’ve been having some serious problems, not just run of the mill exploits but problems with the very architecture and design of the Adobe software. Some of the biggest malware vectors for distribution last year came from Adobe Reader flaws.

And it has been happening in the wild, these flaws allowed malicious bot-net herders to peddle their wares and infect thousands of people.

Another fix addressed a design problem in the PDF document format that could be leveraged to con users into downloading malware. The bug, which was not strictly a security vulnerability, was first disclosed by Belgium researcher Didier Stevens in late March. Stevens demonstrated how a multi-stage attack using the PDF specification’s “/Launch” function could successfully exploit a fully-patched copy of Adobe Reader. Stevens also showed how a Reader warning could be changed to further fool users.

Hackers have been using Stevens’ technique in mass attacks to infect Windows PCs with bot Trojans.

With the updates to versions 9.3.3 and 8.2.3, Adobe changed Reader and Acrobat so that the /Launch function was disabled by default — in earlier editions it had been turned on — and fixed the bug in the warning dialog so hackers couldn’t modify it. “Today’s update includes changes to resolve the misuse of this command,” said Steve Gottwals, an Adobe group product manager, on a company blog . “We added functionality to block any attempts to launch an executable or other harmful objects by default. We also altered the way the existing warning dialog works to thwart the known social engineering attacks.”

Stevens confirmed the fixes in a post to his blog Tuesday. “Not only is the dialog box fixed, but the /Launch action is also disabled by default,” he said.

Five of the 17 bugs Adobe patched Tuesday were reported by Tavis Ormandy, the Google security engineer who was at the center of a brouhaha earlier this month after he publicly disclosed a vulnerability in Windows when Microsoft wouldn’t commit to a patching deadline.

Thankfully they’ve disabled the /Launch function by default now and fixed other bugs which were classified as critical. Incidentally 5 of the 17 bugs were reported by Tavis Ormandy the Google engineer.

That guy has quite a record for uncovering software based vulnerabilities.

Source: Network World

Posted in: Exploits/Vulnerabilities, Hacking News

Topic: Exploits/Vulnerabilities, Hacking News


Latest Posts:


Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network
OWASP Amass - DNS Enumeration, Attack Surface Mapping & External Asset Discovery OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces.
Cameradar - Hack RTSP Video Surveillance CCTV Cameras Cameradar – Hack RTSP Video Surveillance CCTV Cameras
Cameradar is a Go-based tool to hack RTSP Video Surveillance CCTV Cameras, it can detect open RTSP hosts, detect device models and launch automated attacks.
dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).


FxCop – .NET Framework Security Analysis Tool


FxCop is an application that analyzes managed code assemblies (code that targets the .NET Framework common language runtime) and reports information about the assemblies, such as possible design, localization, performance, and security improvements. Many of the issues concern violations of the programming and design rules set forth in the Design Guidelines, which are the Microsoft guidelines for writing robust and easily maintainable code by using the .NET Framework.

FxCop is intended for class library developers. However, anyone creating applications that should comply with the .NET Framework best practices will benefit. FxCop is also useful as an educational tool for people who are new to the .NET Framework or who are unfamiliar with the .NET Framework Design Guidelines.

FxCop is designed to be fully integrated into the software development cycle and is distributed as both a fully featured application that has a graphical user interface (FxCop.exe) for interactive work, and a command-line tool (FxCopCmd.exe) suited for use as part of automated build processes or integrated with Microsoft Visual Studio® .NET as an external tool.

To get FxCop you need to install “Windows SDK for Windows 7.1“. In the release notes you will find this message:

6.3.6 FXCop Setup is Now Located Under the Window SDK “\Bin” Directory.
The installer for FXCop, fxcopsetup.exe, is now located in Program Files\Microsoft SDKs\Windows\v7.1\Bin\FXCop.

Or read more here.

Posted in: Countermeasures, Secure Coding, Security Software

Topic: Countermeasures, Secure Coding, Security Software


Latest Posts:


Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network
OWASP Amass - DNS Enumeration, Attack Surface Mapping & External Asset Discovery OWASP Amass – DNS Enumeration, Attack Surface Mapping & External Asset Discovery
The OWASP Amass Project is a DNS Enumeration, Attack Surface Mapping & External Asset Discovery tool to help information security professionals perform network mapping of attack surfaces.
Cameradar - Hack RTSP Video Surveillance CCTV Cameras Cameradar – Hack RTSP Video Surveillance CCTV Cameras
Cameradar is a Go-based tool to hack RTSP Video Surveillance CCTV Cameras, it can detect open RTSP hosts, detect device models and launch automated attacks.
dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).