Archive | June, 2014

Dradis v2.9 – Information Sharing For Security Assessments

Use Netsparker


Dradis is an open source framework to enable effective information sharing, specially during security assessments. It’s a tool specifically to help in the process of penetration testing. Penetration testing is about information:

  1. Information discovery
  2. Exploit useful information
  3. Report the findings

But penetration testing is also about sharing the information you and your teammates gather. Not sharing the information available in an effective way will result in exploitation opportunities lost and the overlapping of efforts.

Dradis v2.9 - Information Sharing For Security Assessments

Dradis is a self-contained web application that provides a centralised repository of information to keep track of what has been done so far, and what is still ahead.

Features

  • Easy report generation.
  • Support for attachments.
  • Integration with existing systems and tools through server plugins.
  • Platform independent.



Traditional pentesting teams face different types of challenges regarding information sharing. Different tools provide output in different formats, different testers capture evidence in different ways, different companies report differently, etc.

If you do not use a tool to share the information, every tester will use their own notes file to keep track of their findings. Each will store this file locally, or on a shared resource, but the information will not arrive immediately to the rest of the team.

If you want to know what are the latest findings of your mate, you will need to look for the notes file. You also can try talking, but talking is not that effective when you need to know a specific cookie value or a sql query for an injection attack.

It seems reasonable that some effort must be put to increase the quality and efficiency of this process.

You can download Dradis Framework v2.9 here:

Windowsdradis-v2.9.0-setup.exe
Othersdradis-v2.9.0.tar.gz

Or read more here.

Posted in: Hacking News, Security Software

Topic: Hacking News, Security Software


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Hackers Recreate NSA Snooping Kit Using Off-the-shelf Parts

Use Netsparker


So some curious hardware hackers grabbed the leaked catalogue that detailed the hardware involved in the NSA Snooping Kit, and have recreated some of the ‘high-tech’ top secret tools with off-the-shelf parts and items that can be bought from Kickstarter.

I mean some of it seems pretty simplistic though, a monitor mirror and a hardware keystroke logger? Nothing ground-breaking there.

NSA Snooping

The Catalogue itself can be found here:

NSA ANT Catalog

The project itself is open, so if you’re into hardware hacking you could have a look and perhaps even contribute something.

Last year Edward Snowden leaked the NSA’s Advanced Network Technology catalog, a listing of the hardware and software tools the agency makes available to agents for spying. Now enterprising security experts are using the catalog to build similar tools using available electronics.

The team, led by Michael Ossmann of Great Scott Gadgets, examined the leaked catalog and found that a number of the devices the NSA developed can be very simple to recreate.

Ossmann was able to build a software-defined radio (SDR) system capable of recording and transmitting data from a target PC using a Kickstarter project, and reckons the hardware can be bought to market for $300 or less.

“SDR lets you engineer a radio system of any type you like really quickly so you can research wireless security in any radio format,” he told New Scientist.


It’s not often we get something interesting regarding hardware hacking, the last time something really interesting popped up was the story about the Researchers who Cracked 4096-bit RSA Encryption With a Microphone.

This project is in early days though, so I’m sure we’ll see some more interesting items coming out of it in the coming months.

Ossmann also said he was able to build two devices from the NSA’s catalog using little more than a few transistors and a two-inch length of wire as an antenna. These mimic the NSA products Ragemaster (a plug that sits on the monitor cable of a computer and broadcasts screen images) and the Surlyspawn keystroke logger, but at a fraction of the cost the government gets charged.

In a presentation at the Hack In The Box conference in Amsterdam this May, Ossmann detailed some of his creations and the methods he and his team used to build them using off-the-shelf components. These devices aren’t as small as the NSA’s hardware, but are just as effective, he said.

The team has now set up a website, NSAPlayset.org, detailing the different spying products they have reverse-engineered, and more details will be given out at presentations at the DEFCON hacking conference being hosted in Las Vegas in August.

Ossmann’s goal isn’t to help hackers conduct their own spying operations, nor to make it easier for the government to get low-cost surveillance hardware. While he has developed tools for the federal government, the goal of this project is to help the security industry understand the range of threats it should be protecting against.

It’s also possible they’ve already developed more devices, but are saving them for future stops on the infosec conference circuit. It does mention DEFCON and some more stuff will be released there in August.

I also find the chaps name pretty apt – Ossmann (Open Source Softare Man).

Source: The Register

Posted in: Hardware Hacking, Privacy

Topic: Hardware Hacking, Privacy


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Codesake::Dawn – Static Code Analysis Security Scanner For Ruby

The New Acunetix V12 Engine


Codesake::Dawn is a source code scanner designed to review your code for security issues. Basically a static analysis security scanner for ruby written web applications.

Codesake::Dawn is able to scan your ruby standalone programs but its main usage is to deal with web applications. It supports applications written using majors MVC (Model View Controller) frameworks, like Ruby on Rails, Sinatra & Padrino.

When you run Codesake::Dawn on your code it parses your project Gemfile.lock looking for the gems used and it tries to detect the ruby interpreter version you are using or you declared in your ruby version management tool you like most (RVM, rbenv, …).

Static Code Analysis Security Scanner For Ruby

Then the tool tries to detect the MVC framework your web application uses and it applies the security check accordingly. There checks designed to match rails application or checks that are appliable to any ruby code.

Codesake::Dawn can also understand the code in your views and to backtrack sinks to spot cross site scripting and sql injections introduced by the code you actually wrote. In the project roadmap this is the code most of the future development effort will be focused on.

Codesake::Dawn security scan result is a list of vulnerabilities with some mitigation actions you want to follow in order to build a stronger web application.

Options



Installation

codesake-dawn rubygem is cryptographically signed. To be sure the gem you install hasn’t been tampered, you must first add paolo@codesake.com public signing certificate as trusted to your gem specific keyring.

You can install latest Codesake::Dawn version, fetching it from Rubygems by typing:

Or read more here.

Posted in: Countermeasures, Security Software

Topic: Countermeasures, Security Software


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Source Code Hosting Service Code Spaces Deleted By Hacker

The New Acunetix V12 Engine


There’s been a LOT of noise about this incident in the past day or two, the very definition of a cloud nightmare. Git/SVN & Project Management SaaS Code Spaces has been hacked and completely deleted by a hacker.

It started off with a large scale DDoS attack (the likes of which Feedly and Evernote have also seen this month) – and in all cases the malicious parties have been asking for ransom money to stop the attacks.

Code Spaces Deleted By Hacker

This time however, with Code Spaces – somehow the malicious parties got access to their Amazon console..which gave them access to delete everything, including snapshots and backups. This has rendered Code Spaces totally inoperable, and unfortunately it looks like they won’t be able to recover from this.

Source code hosting provider Code Spaces has suffered the ultimate cloud nightmare, having been effectively forced out of business by the actions of an attacker who managed to gain access to its Amazon EC2 control panel.

The devastating incident began on June 17 when Code Spaces – a company that claimed to offer “Rock Solid, Secure and Affordable Svn Hosting, Git Hosting and Project Management” – became the target of a DDoS attack from an unknown party who demanded “a large fee” to make it stop.

This isn’t the first such incident in recent weeks. Evernote and Feedly were each knocked down on June 10, reportedly by criminals trying to extort money. Both managed to restore their services, albeit only after extended outages.

The difference this time is that in addition to having access to a formidable botnet, Code Spaces’ assailant had also gained access to the company’s Amazon EC2 control panel, giving him control over the data it had stored using Amazon’s Elastic Block Store (EBS) and S3 cloud services.

“We finally managed to get our panel access back but not before he had removed all EBS snapshots, S3 buckets, all AMI’s, some EBS instances and several machine instances,” the company wrote in a message posted to its homepage. “In summary, most of our data, backups, machine configurations and offsite backups were either partially or completely deleted.”


The ironic part is they make claims about having bulletproof ‘offsite’ backups, when all they seem to mean is they put some backups in a different Amazon region – not even on a different cloud platform – so anyone having access to their Amazon console..could nuke everything. You can see their claims on Archive.org here.

We have invested a great deal of time and effort in developing a real-time backup solution that allows us to keep off-site, fully functional backups of your data – at high performance. We literally backup everything you do, as soon as you do it.

Also why weren’t they using 2 Factor Authentication for such an important account? I’m really very interested in how the extortion DDoS gang got hold of their Amazon credentials.

The net effect was that, once the smoke cleared, Code Spaces no longer had any service to offer its customers.

“Code Spaces will not be able to operate beyond this point,” the company’s statement reads, “The cost of resolving this issue to date and the expected cost of refunding customers who have been left without the service they paid for will put Code Spaces in an irreversible position both financially and in terms of ongoing credibility.”

The source-sharing site said it is now working to export whatever data remains so that customers can regain access to their files. All Git repositories and some svn repositories are reportedly available for export, although their backups and snapshots have been erased, and some svn repositories have been destroyed altogether. All of Code Spaces’ EBS-hosted database files have also been wiped clean, along with their backups and snapshots.

The company said it is experiencing “massive demand” for support and has asked customers for patience as it struggles to get to everyone.

“On behalf of everyone at Code Spaces, please accept our sincere apologies for the inconvenience this has caused to you, and ask for your understanding during this time!” the statement reads. “We hope that one day we will be able to and reinstate the service and credibility that Code Spaces once had!”

In a way I’m glad this happened though, nothing against Code Spaces (never even heard of the service) – but it’s a lesson to be learnt – Cloud DOES not make you any more secure, in many ways it makes you less secure.

All your eggs in one basket? Then yeah, you are asking to get burnt. Set up pull only backups on an entirely different platform (the desktop in your office is fine, or on Linode/Rackspace/Softlayer etc).

It costs $5 to run up a Digital Ocean VPS and pull backups from your production servers – just do it.

There’s further discussion on Reddit here too – Hacker Puts Code Spaces Out of Business.

Source: The Register

Posted in: Password Cracking, Social Engineering

Topic: Password Cracking, Social Engineering


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Don’t Get Hacked – Have A Free Acunetix Security Scan

Use Netsparker


The recent Heartbleed vulnerability has highlighted the urgent need for more network level security scanning. In view of this, Acunetix has announced that it will be offering 10,000 users a Free Acunetix Security Scan with the Acunetix Online Vulnerability Scanner (OVS) in a bid to make it easier for businesses to take control of their network security.

Acunetix Online Vulnerability Scanner is a hosted security scanner that will scan a perimeter server for network level vulnerabilities and provide detailed reports so as to allow the security administrator to fix the vulnerabilities before a hacker finds them.

Acunetix Online Vulnerability Scanner (OVS)

All the Network Scanning capabilities available in Acunetix OVS will be available for free for fourteen days (From today June 18th 2014), allowing users to audit their internet (and hacker) facing servers.

Features

  • Scan your servers for over 35,000 network vulnerabilities
  • Audit your internet facing architecture and identify system and network weaknesses
  • Ensure that servers are not running any illegitimate services, such as a Bitcoin mining botnet
  • Identify any vulnerable versions of applications running on the servers
  • Discover the information that the systems are leaking using various techniques such as OS fingerprinting, port banner grabbing and service probing (like the information SHODAN archives)
  • Ensure that all the organisation’s services, including FTP and mail, do not suffer from Heartbleed
  • Get additional information about other vulnerabilities and network problems detected.

To make use of this offer, you can sign-up at www.acunetix.com/free-network-security-scan/ using a valid company email address. Once your scan target has been verified (it actually belongs to your company), you can then make use of the scanning features mentioned above.

Posted in: Advertorial, Countermeasures, Security Software

Topic: Advertorial, Countermeasures, Security Software


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


SHODAN – Expose Online Devices (Wind Turbines, Power Plants & More!)

The New Acunetix V12 Engine


SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

Web search engines, such as Google and Bing, are great for finding websites. But what if you’re interested in finding computers running a certain piece of software (such as Apache)? Or if you want to know which version of Microsoft IIS is the most popular? Or you want to see how many anonymous FTP servers there are? Maybe a new vulnerability came out and you want to see how many hosts it could infect? Traditional web search engines don’t let you answer those questions.

Shodan - Expose Online Devices

So what does SHODAN index then? Good question. The bulk of the data is taken from ‘banners’, which are meta-data the server sends back to the client. This can be information about the server software, what options the service supports, a welcome message or anything else that the client would like to know before interacting with the server. For example, following is a FTP banner:

This tells us a potential name of the server (kcg.cz), the type of FTP server (Solaris ftpd) and its version (6.00LS). For HTTP a banner looks like:

This can be used to find all sorts of interesting things like Webcams, routers, power plants, iPhones, wind turbines, refrigerators – basically anything connected to the internet that has a banner that identifies what it is.

There is an API service as well if you want to build an app around the data in the Shodan database at https://developer.shodan.io/. The Shodan API is the easiest way to provide users of your tool access to the Shodan data. The API provides access to all of the search features, allowing you to get exactly the information you want. There are libraries for Python, Ruby & NodeJS.

You can get started with Shodan here – http://www.shodanhq.com/

Posted in: Hacking Tools, Hardware Hacking, Privacy

Topic: Hacking Tools, Hardware Hacking, Privacy


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.