Hacker's Dome - First Blood CTF

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhaIQZEqdjFlCJ0zWQCeGLI_m4ODTId1fIoSz19AsvAT0IDXHOSIdsrOsxyu7_BPQzyE2FD00Y3fuNzk0Rh26l80wTs42Vkg5fL4-PcDZlZfrSm_8hTVakF5bDEWo8U4DKfGonQ8x8Rr4/s1600/Untitled-1+copy.jpg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="417" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhaIQZEqdjFlCJ0zWQCeGLI_m4ODTId1fIoSz19AsvAT0IDXHOSIdsrOsxyu7_BPQzyE2FD00Y3fuNzk0Rh26l80wTs42Vkg5fL4-PcDZlZfrSm_8hTVakF5bDEWo8U4DKfGonQ8x8Rr4/s1600/Untitled-1+copy.jpg" width="577" /></a><br /><br />When it comes to Information Security, there's a great way to learn, train and keep sharp your skills. This can be done using gamification mechanics to speed up the learning curve and improve retention rate. Capture The Flag competitions use gamification mechanics and represent one of the best ways to learn security hands on.<br /><a name="more"></a><br />We've created Hacker's Dome as a place for CTF365  users to play weekend CTFs with great prizes. In order to get access to Hacker's Dome, the first thing you need is a registered and confirmed CTF365 account.<br /><br />Although we're at the start of our journey, the goal of Hacker's Dome is to become your weekend security training - where fun, entertainment and awesome prizes will be at its best.<br /><br />Hacker's Dome is a CTF Platform where you can deploy your own CTF and invite web developers, system administrators and security professionals to take your challenges. Think RackSpace, of CTF Competitions.<br /><br />We design the challenges with public vulnerabilities or known misconfigurations. Most of them can be found on exploit-db.com or other public sources. We don’t target 0-day vulnerabilities, so you won’t have to disclose your knowledge about arcane methods for getting access to a machine. We use Kali and the basic tools for the purpose of demonstrating the concept of a CTF challenge when we discuss the technical aspects of a competition.<br /><br /><h3 style="text-align: left;">Hacker's Dome - First Blood</h3>First Blood is our first CTF and will start on May 17 2014 15:00 UTC.<br /><b><br /></b><b>Difficulty Grade: Beginners/Intermediate</b><br /><h3 style="text-align: left;">The Prizes:</h3>We have awesome prizes packages worth > $ 6000 US<br /><br /><b>First Place Package:</b><br /><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Ultra Bundle (because you love to hack)</li><li>One year CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><br /><b>Second Place Package:</b><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Tactical Bundle (because you love to hack)</li><li>6 Months CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><br /><b>Third Place Package:</b><br /><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Travel Bundle (because you love to hack)</li><li>3 Months CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><h3 style="text-align: left;">The Raffle</h3>Yes! We have a raffle with a King Prize thanks to Rapid7 - Metasploit guys.<br /><br /><b>Raffle King Prize - Full Year Metasploit Pro Licence</b><br /><br />The fact that Metasploit gave us the opportunity to run a raffle off such great King Prize, makes us proud of what we've done and it encourages us to keep up our good work.<br /><br />Interested candidates - <b><a href="http://hackerdome.com/" rel="nofollow" target="_blank">Click here</a></b> to register.<br /><br /><a href="https://fbcdn-sphotos-b-a.akamaihd.net/hphotos-ak-prn1/t1.0-9/67786_559794774046636_1802551511_n.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="125" src="https://fbcdn-sphotos-b-a.akamaihd.net/hphotos-ak-prn1/t1.0-9/67786_559794774046636_1802551511_n.jpg" width="125" /></a><b>About Author - Marius Corici</b><br /><b><br /></b>Serial entrepreneur, in love with Artificial Intelligence. Never a quitter, always a perfectionist, looking for challenges that will change the world we live in. I believe in people and great teams and I do hate that I don’t manage to grab some time to start blogging.</div>

Hacker's Dome - First Blood CTF

When it comes to Information Security, there's a great way to learn, train and keep sharp your skills. This can be done using gamificati...

+ Read more »

A Tale Of A DOM Based XSS In Paypal

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" width="370" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Introduction </h4><div class="separator" style="clear: both; text-align: left;">We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Based XSS vulnerability i found long time back inside paypal. A DOM Based xss vulnerability also known as the third type of XSS vulnerability or type 0. This vulnerability occurs due to the fact that developers don't sanitize the input before it reaches a sink. A Sink is defined as anything that generates HTML, not every sink is considered as dangerous, however there are some common sinks that should be avoided and are mentioned at DOM Based XSS wiki .</div><div class="separator" style="clear: both; text-align: left;"></div><a name="more"></a><br /><h4>Current Situation </h4><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The situation with DOM Based xss is getting worse now a days, not only because of dynamic JS libraries such as YUI, Jquery, Jquery mobile etc, but also with programming languages such as PHP that are more natively supporting HTML 5 features. One of the aspects of a DOM Based XSS vulnerability that i discovered was with tracking scripts such as Eloqua, Sitestat, Omniture, etc as they often introduce dangerous sinks. Examples are<a href="http://www.rafayhackingarticles.net/2013/03/dom-based-xss-in-microsoft.html"> here</a> and <a href="http://www.rafayhackingarticles.net/2013/02/dom-based-xss-in-avg.html">here</a>. The same is the case with sharing buttons such as google plus, addthis etc. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>A Vulnerable Example from W3schools </h4><div class="separator" style="clear: both; text-align: left;">The worsed part about DOM Based xss apart from it's complexity is the fact that lots of learning references and guides teach developers to code things in an insecure way i.e. in a way that would introduce vulnerabilities automatically. The following screenshot is taken from the jquery learning section of w3schools. The website needs no introduction, it is the most commonly referred websites for beginners to learn various programming language.</div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">The code uses the html() function inside of jquery to output html, however the problem is that html() is not a safe jquery function and is represented as a dangerous sink as per <a href="https://code.google.com/p/domxsswiki/wiki/jQuery" rel="nofollow" target="_blank">DOM Based XSS Wiki</a>. In case, where a user controlled input outputted through html() sink without sanitization would lead to a DOM Based xss. The html() function inside of jquery is the equivalent to the innerHTML function inside of javascript. The fundamental problem is that the developers are not advised to use a safe function. Therefore, in my opinion w3schools shall be renamed to w3fools. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>The Tale Of Paypal DOM Based XSS</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The <b>financing.paypal.com</b> subdomain was a subject of DOM Based xss vulnerability. The subdomain had a feature which triggered my interest, which allowed the users to create ad units of different sizes. The size of the ad was being handled on the client side with the help of jquery.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>https://financing.paypal.com/ppfinportal/adGenerator/webCopy?460 * 80</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The above input would display "<b>460 * 80</b>" in front of the Selected Size Option, Changing the text with our own input would result in the same text being outputted on to the screen. This means that our input that is taken from a source is being passed through a sink to be displayed upon the screen. So, what happens if we change the input with our XSS payload, for example - <b><svg/onload=prompt(1)>.</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy?</span><b><svg/onload=prompt(1)></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="370" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Unfortunately, the results were returned URL encoded. Now there could be two possibilities, whether the javascript is encoding our input before rendering it on the screen or it's a general browser behaviour. Turns out that Google Chrome and Firefox browsers encode everything sent after ?, but what about Internet explorer?, Internet explorer returns the characters as URL unencoded and therefore, we inside of internet explorer we are able to render our javascript. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">With that being said, as per DOM Based XSS wiki google chrome does not encode certain characters when passed after a hash. Therefore, we could add an additional hash after the ? mark to get our payload executed. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b></div><div class="separator" style="clear: both; text-align: left;"><b><span style="color: red;"><br /></span></b></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerable Code</h4><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">With some debugging i was able to determine the exact cause of the vulnerability. The following screenshot highlights the line of code that was responsible for the cause of this vulnerability. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="375" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" width="577" /></a></div><br />The line 517 represents the source being <b>document.url,</b> a split function is called which splits everything being sent after the ? mark and saves it inside a variable called <b>url</b>.<br /><br /><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b><br /><div class="separator" style="clear: both; text-align: left;">The split function would return <b><svg/onload=prompt(1)> </b>from the url and then is saved inside a variable called <b>url.</b> Next inside the <b>521 line </b>we can see that html() function is used to output url variable, which in this case contains our xss paylaod. The payload would be outputted to the screen and hence would execute the javascript for us. </div><div class="separator" style="clear: both; text-align: left;"><h4>Conclusion</h4></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">DOM Based XSS are growing and would continue to grow as more and more people would start using dynamic javascript libraries and as more people more towards server side javascript i.e. node js, the impact would be much more high. This article demonstrates the importance of sanitizing the user supplied input not only on the server side but also on the client side. </div><div class="separator" style="clear: both; text-align: left;"><br /></div>Pass the comments!. </div>

A Tale Of A DOM Based XSS In Paypal

Introduction  We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Base...

+ Read more »

Introduction To SQLmap And Firewall Bypassing

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXp0hBjFIlNQhVoAcjABuX8_x_g3Ru3XMIrzBswLEx4K4IxmwXhfKgKADz1hwV4Jr5Kv2L9Xuw970DRrzbIy8Kt6c3zDhmngR71DRJ9T3eldRkBddd14XnvUYpmD2lCqXZ0qqAguSridY/s1600/sqlinjection+%25281%2529.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="309" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXp0hBjFIlNQhVoAcjABuX8_x_g3Ru3XMIrzBswLEx4K4IxmwXhfKgKADz1hwV4Jr5Kv2L9Xuw970DRrzbIy8Kt6c3zDhmngR71DRJ9T3eldRkBddd14XnvUYpmD2lCqXZ0qqAguSridY/s1600/sqlinjection+%25281%2529.jpg" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><b><br /></b><br /><h4>ABSTRACT</h4>Most cyber-attacks in the world that involve websites occurs due to lack of updates and the failure to validate the user input. Starting from buffer overflow vulnerability, which is a system level vulnerability up to the vulnerabilities that exist today, the fundamental problem has always been the input validation. One of the main threats is SQL Injection that left many worried about their application and databases. The problem is more then a decade old, but still is present inside lots of websites. SQL injection like all other major web application security problems fall in the category of input validation attacks.<br /><br /><a name="more"></a><br /><br /><h4 style="text-align: left;">CONTEXT</h4>Many web developers do not know how SQL queries can be handled and assume that an SQL query is a trusted command. This allows for SQL queries to circumvent access controls, thereby bypassing standard authentication and authorization checks. And sometimes SQL queries even may allow access to the command shell on the server operating system level.<br /><br />Direct injection of SQL commands is a technique where an attacker creates or alters existing SQL commands to expose hidden data or to override valuable data, and even to execute dangerous system level commands on the server.<br /><br /><h4 style="text-align: left;">INTRODUCTION</h4><br />Structured Query Language is the standard declarative language for relational databases. This allows for its simplicity and ease of use. SQL was originally developed in the early 70s at IBM labs. SQL Is used by applications communicate or speak with the database.<br /><br />SQL use the following four statements to communicate with the database.<br /><br /><b>SELECT – </b>Retrieve a record from the database.<br /><b>INSERT -</b>  Inserting a record inside the database.<br /><b>DELETE </b>– Deleting a record from database.<br /><b>UPDATE  </b>- Update or change a current record<br /><br />The  SQL Injection simply occurs when the user query is treated as the database query. Take an example of how a user is authenticated on a website. The user sends a "Username" and "Password", the username/password is checked against what is present inside the database. If that matches, the user is logged in, else the user is not logged. Here is an example of the basic SQL query that is constructed at the back end.<br /><b><br /></b><b>The Code:</b><br /><b><br /></b><b>SELECT * FROM user WHERE username = ‘<span style="color: red;">$username</span>’ AND password = ‘<span style="color: red;">$password</span>' </b><br /><br />The query simply says select all from the user table where the username is equal to what the user entered and the password being that the user entered. So, in case where the user supplies the username to be "admin" and password to be "12345". Here is how the SQL query is contructed.<br /><br /><b>SELECT * FROM user WHERE username = ‘<span style="color: red;">admin</span>’ AND password = ‘<span style="color: red;">12345</span>' </b><br /><b><br /></b><b>The Injection</b><br /><b><br /></b>So, what if a user enters something like ' or '1'='1, since the first quote would terminate the input string, the rest of the query would be executed as a SQL query and in a SQL query 1=1 is always a true statement. Which would enable us to bypass the login mechanism<br /><b><br /></b><b>SELECT * FROM user WHERE username = ‘<span style="color: red;">admin</span>’ AND password = ‘<span style="color: red;">’ or ‘1’=‘1</span>' – TRUE </b><br /><br /><br />The above demonstrates a simple example of SQL injection, however SQL injection in real world is really complicated sometimes and in our penetration tests, most of the times we have a very tight schedule. So therefore, we need an automated/context aware tool to perform the injection for us.<br />SQLMAP is a tool that can be used to exploit this type of vulnerability. It is Open source, and often is used for Penetration Testing that enable intrusions on fragile DBMS written in Python. It provides functions to detect and exploit vulnerabilities of SQLI. Let's use the example sqlmap.py, widely used in operating systems and databases.<br /><br /><h4 style="text-align: left;">STEP BY STEP</h4>Readers I will try to explain this in the simplest possible way.<br /><br />The most common way of testing a SQL injection vulnerability is by inputting a single quote (') inside the input and expect it to display an error. Some of the applications do not return an error. This is where we can utilize true/false statements to check if an application is vulnerable to a SQL injection attack or not.<br /><br />To find a random website vulnerable to SQL injection, you can utilize the following google dork Example: inurl: news.php id = 1?<br />There is a bank of google dorks data and several other possibilities that can be used to filter your search. So let's start with SQL map.<br /><br />Navigate to the following directory inside of backtrack:<br /><br /><b>cd /pentest/database/sqlmap</b><br /><br />We will now begin the game, to view the menu for sqlmap.py use the command ./sqlmap.py -h<br /><br />Let's run sqlmap.py, the parameter [--dbs], to search the all databases in DBMS.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirmPMfKwLLMuUSji2fA5p9CQmeUrSaO8B8davN_NC_VEdpD3nt7RazOvz6ZYdjRUDRdpncOq00k5KjZtD614VLwsqQrQZIxpQ04_hKzKI49o5Ccc8-XMs3wDOSLRmRZoWzwso7gyz0jno/s1600/untitled2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="340" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirmPMfKwLLMuUSji2fA5p9CQmeUrSaO8B8davN_NC_VEdpD3nt7RazOvz6ZYdjRUDRdpncOq00k5KjZtD614VLwsqQrQZIxpQ04_hKzKI49o5Ccc8-XMs3wDOSLRmRZoWzwso7gyz0jno/s1600/untitled2.JPG" width="577" /></span></a></div><br /><br />Or use the parameter --current-db to show the databases that are being used.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtctOLxgstzW2OaBCq8nmb_2yi2H7vstEaPGDw8Nvk5DzW2-T0wXqHbqkB58RX4cR5gWDaTCN7fpgyMu47tHBk-ITbPIY73QwUPCwkpL3IqxnXnV0O-x2CdRfHq_SjXiyVnvYJKKFffWQ/s1600/untitled3.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtctOLxgstzW2OaBCq8nmb_2yi2H7vstEaPGDw8Nvk5DzW2-T0wXqHbqkB58RX4cR5gWDaTCN7fpgyMu47tHBk-ITbPIY73QwUPCwkpL3IqxnXnV0O-x2CdRfHq_SjXiyVnvYJKKFffWQ/s1600/untitled3.JPG" width="577" /></span></a></div><br /><br />The parameter -D is for the target of database and --tables is tables list.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdTHTrejztVFQWE4P6ldt6-PMPEBhBR23k7dg2ZV__XQtC0k0rHPizIjr79utN-lxFGICdaEh4R-OGBrAQigFxo1VDO6Chyphenhyphen5RY6KzrOGTH54li6GvCSUw4f9jHYQRS0n__KuBnrnxnCo4/s1600/untitled4.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="212" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdTHTrejztVFQWE4P6ldt6-PMPEBhBR23k7dg2ZV__XQtC0k0rHPizIjr79utN-lxFGICdaEh4R-OGBrAQigFxo1VDO6Chyphenhyphen5RY6KzrOGTH54li6GvCSUw4f9jHYQRS0n__KuBnrnxnCo4/s1600/untitled4.JPG" width="577" /></span></a></div><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMBDy30LuZOMbE79E8M-U0f2qVt7CVIRUdoAWSwexIAYPEjPYpJ5tONIUST9E0yNs34dCkd8KuEy6ublMNZWKVksaa8fx2PdZT9QbYgsDXzjw7fqqm2fy-0KXbdNtyt7HErlnD6FW1VHw/s1600/untitled5.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMBDy30LuZOMbE79E8M-U0f2qVt7CVIRUdoAWSwexIAYPEjPYpJ5tONIUST9E0yNs34dCkd8KuEy6ublMNZWKVksaa8fx2PdZT9QbYgsDXzjw7fqqm2fy-0KXbdNtyt7HErlnD6FW1VHw/s1600/untitled5.JPG" width="577" /></span></a></div><br /><br />We will verify the existence of interesting information in the table (admin_users), time to list the columns. The parameter is –columns.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEig8ZRQecDHGFtUG7xgTrWcRmH6bfNjEzF1BfvDyOQA1kHJRsXZ4bVm16YLYLjXmpSAshvxvLxe9CC4uUvd1ahOWGM2pzx5LB1w7XwrWA2oJINnxrwYUFxA-sABf9mSo9KPzKQhwc_Kt0g/s1600/untitled6.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="65" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEig8ZRQecDHGFtUG7xgTrWcRmH6bfNjEzF1BfvDyOQA1kHJRsXZ4bVm16YLYLjXmpSAshvxvLxe9CC4uUvd1ahOWGM2pzx5LB1w7XwrWA2oJINnxrwYUFxA-sABf9mSo9KPzKQhwc_Kt0g/s1600/untitled6.JPG" width="577" /></span></a></div><br /><br />It is important to always indicate the target database (-D) data before listing the tables because if you do not do this (without the -D) it will list all tables in all databases.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb6N4iDmyJkw9hMWHAsbidS1CloSqvKg7ZqiPu1d1SBSpVuBVXVg06ZNpZ5MxZHEp0DwcBqR7Q9qxto_1oqqTwXjfFNhv69PN6q-pMRVAKLoBT85JJKSc9eEktQqsd-J2U0SmuI1u1v8o/s1600/untitled7.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="296" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb6N4iDmyJkw9hMWHAsbidS1CloSqvKg7ZqiPu1d1SBSpVuBVXVg06ZNpZ5MxZHEp0DwcBqR7Q9qxto_1oqqTwXjfFNhv69PN6q-pMRVAKLoBT85JJKSc9eEktQqsd-J2U0SmuI1u1v8o/s1600/untitled7.JPG" width="577" /></span></a></div><br /><br />-T = target table<br />-C = target columns, can be more than one column to be chosen. Example: username, password.<br />--dump = obtain, extract data.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEEmmUMLGSt3YrF6vI5iyb3SgYhjZq1KnhugAt3j9Q6B5DfzgkqCX57e8SfoQHrCtdwCcBHUgrOnjznksn_O5WnX24S2bRkfccvhKindnYEy0sBlRqyxbhJUlLRk_AV9pU8cs_8gIoKTA/s1600/untitled8.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="145" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEEmmUMLGSt3YrF6vI5iyb3SgYhjZq1KnhugAt3j9Q6B5DfzgkqCX57e8SfoQHrCtdwCcBHUgrOnjznksn_O5WnX24S2bRkfccvhKindnYEy0sBlRqyxbhJUlLRk_AV9pU8cs_8gIoKTA/s1600/untitled8.JPG" width="577" /></span></a></div><br /><br />Important to remember the parameter --proxy: enables use of proxy. <br />Example:     /sqlmap.py --url "http://testphp.vulnweb.com/listproducts.php?cat=1" --dbs --proxy=http://183.223.10.108:80<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4dUZhKSbjzjnwAjTIP4dAz1U3J_bIV3mjwnko28Igqh9-ebhal8yUzfKKBUXQm_DaGPmseiMc-JXkS-ywxSqZ90AK_j29ImuLphlf29-h8ALeWekbGtYt7fEcbchQZzz17i87CvAWwBc/s1600/untitled9.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4dUZhKSbjzjnwAjTIP4dAz1U3J_bIV3mjwnko28Igqh9-ebhal8yUzfKKBUXQm_DaGPmseiMc-JXkS-ywxSqZ90AK_j29ImuLphlf29-h8ALeWekbGtYt7fEcbchQZzz17i87CvAWwBc/s1600/untitled9.JPG" width="577" /></span></a></div><br /><br />Readers, I think that's the basics for beginners. sqlmap.py also has many interesting functions, I suggest researching about --prefix=PREFIX, --postfix=POSTFIX and takeover options.<br />More information about the program and videos of them in action on the official site.<br /><br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEGgVQysZHx-k9cPArx93VazNi6abEXiLjUsKE4FnL-B82fxSBVWqpcrxrOGiWB9kC771Qd6u7gjddEnzv8x4-chGtLjrrSouBOhH9IoqZdmAeorRf6D_O37ur4nvzYBbMmprdef7F7Qc/s1600/untitled10.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEGgVQysZHx-k9cPArx93VazNi6abEXiLjUsKE4FnL-B82fxSBVWqpcrxrOGiWB9kC771Qd6u7gjddEnzv8x4-chGtLjrrSouBOhH9IoqZdmAeorRf6D_O37ur4nvzYBbMmprdef7F7Qc/s1600/untitled10.JPG" width="577" /></span></a></div><br /><br />--dump is to extract the data from the site but is not given any, this must be within the selected column, and you have to choosen what to extract from the column, where I extracted the logins and passwords are saved within the column.<br /><br />Generally, the field of "passwords" DBMS are encrypted. Most common encryptions used are SHA-1, MD5 hashes and most of the time the hashes are not salted, making it easier to crack. We then need to decrypt the passwords in order to access the target system. We can utilize online hash databases such as  http://www.md5decrypt.org, https://crackstation.net/,http://www.onlinehashcrack.com/ to name a few. The second option is to manually try bruteforcing the password or utilize a commonly known technique rainbow tables for cracking the password hashes. Furthur more you can also try utilizing your GPU power to fasten the process, but unfortunately that's not the scope of this article. <br /><br /><h4 style="text-align: left;">BEYOND THE BASICS</h4><br />Readers, lucky for us, there are some awesome tamper scripts for sqlmap, which can be found in the latest development version from the Subversion repository.<br /><br />svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev<br /><br />In fact the function of the tamper scripts is to modify the request in a way that will escape detection rules WAF (Web Application Firewall). In some cases it may be necessary to combine some tamper scripts together in order to fool the WAF. For a complete list of scripts for tampering, you may find https://svn.sqlmap.org/sqlmap/trunk/sqlmap/tamper/<br /><br />Many enterprises often overlook the current vulnerabilities and rely only on the firewall for protection. Unfortunately, most, if not all firewalls can be bypassed by simply utilizing some of the encoding techniques that a sql server understands. So gentlemen, I want to demonstrate how to use some of the new features of sqlmap to bypass WAF’s/IDS.<br /><br />Well, I'll demonstrate some important scripts that are c<b>harencode.py</b> and c<b>harcodeencode.py</b> to work with MySQL. The scripts can be found inside of /<b>pentest/web/scanners/sqlmap</b> directory inside of backtrack 5. <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhREfGruVYv1VqK0OMQohT8VyUkEBZ6BjaVqAGypCbA0NvOvxDhxmVkdxJG-60tS8PMktQTt3u3PX1ll9Fzsy1XlzeuMM12t1SKMsQsZiDjM8tf0FGQoJA1HX4BclT84DTVmiZHy4fa-v0/s1600/untitled11.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="98" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhREfGruVYv1VqK0OMQohT8VyUkEBZ6BjaVqAGypCbA0NvOvxDhxmVkdxJG-60tS8PMktQTt3u3PX1ll9Fzsy1XlzeuMM12t1SKMsQsZiDjM8tf0FGQoJA1HX4BclT84DTVmiZHy4fa-v0/s1600/untitled11.JPG" width="577" /></span></a></div><br /><br />Hands-on: To begin using tamper scripts, you use the --tamper followed by the script name. Inside the screenshot, we have used the charencode command.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiilQx8DOaaoNBB1aX4Eto1gPHPEfX8PpjE3ExIOOgvqx70nGdM6AwNt2aNdywtpUccg2X2kkbn0rY4ccyv3iPwGdzpBJDxoKR1-6TEjn8W4Aj7ulAR0VQ5kF2uJLz3KWDnC57lV2_Zyf8/s1600/untitled12.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="235" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiilQx8DOaaoNBB1aX4Eto1gPHPEfX8PpjE3ExIOOgvqx70nGdM6AwNt2aNdywtpUccg2X2kkbn0rY4ccyv3iPwGdzpBJDxoKR1-6TEjn8W4Aj7ulAR0VQ5kF2uJLz3KWDnC57lV2_Zyf8/s1600/untitled12.JPG" width="577" /></span></a></div><br /><br /><b>Summary of charencode.py</b><br /><b><br /></b>Quite simply, this script is useful for ignoring very weak web application firewalls (WAF) …<br />Another interesting function url-decode the request before processing it through their set of rules (:<br />The web server will anyway go to url-decoded back version, concluding, it should work against any DBMS.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMBn8Idp8ftqzXuliAPgs62b9VbfDwroymkrGlvSHdSDuNPbLAWxXmo5C_vaaR5cVSWzPR5vqRep80tYTYsANb5eiLBfHCeFbKYjN0pu3M4By_3rJ3QfuJGEM9nZuviYe7L67HWMl5d9k/s1600/untitled13.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="203" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMBn8Idp8ftqzXuliAPgs62b9VbfDwroymkrGlvSHdSDuNPbLAWxXmo5C_vaaR5cVSWzPR5vqRep80tYTYsANb5eiLBfHCeFbKYjN0pu3M4By_3rJ3QfuJGEM9nZuviYe7L67HWMl5d9k/s1600/untitled13.JPG" width="577" /></span></a></div><br /><br />Example to use:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFYlZNWAm3MzszqdThd5Et-fO9n7lx4EAf7USO_I5RJtLtDEn4oPkef_R94xLB_rFUIUd20rTxkHFOqyTckysvWopauWGJQ9W1Z6DqZ-62AjDwIyh_SgXWSdaizRuK8qzOAY6HFr0YYik/s1600/untitled14.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="253" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFYlZNWAm3MzszqdThd5Et-fO9n7lx4EAf7USO_I5RJtLtDEn4oPkef_R94xLB_rFUIUd20rTxkHFOqyTckysvWopauWGJQ9W1Z6DqZ-62AjDwIyh_SgXWSdaizRuK8qzOAY6HFr0YYik/s1600/untitled14.JPG" width="577" /></span></a></div><br /><br />Another great script is the <b>charunicodeencode.py, </b>during my penetration tests this particular script has really helped me in bypassing lots of firewall restrictions.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifZligeOewjEtwsG5uz3NYOxEr1mMGpDKm6HEqNBgkoj2fNG-RNke54DQ1ItS22zhbvuvwIQaD6s1OVltUEPMnm_NCnYevJJ14vaFYpIBi4TSrokkZkzRNGksqMOU0-AR6jciP-aVzHbY/s1600/untitled15.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img border="0" height="273" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifZligeOewjEtwsG5uz3NYOxEr1mMGpDKm6HEqNBgkoj2fNG-RNke54DQ1ItS22zhbvuvwIQaD6s1OVltUEPMnm_NCnYevJJ14vaFYpIBi4TSrokkZkzRNGksqMOU0-AR6jciP-aVzHbY/s1600/untitled15.JPG" width="577" /></span></a></div><br /><br />Guys, I have demonstrated just a few of the many tamper scripts. We highly recommend testing them out as each one can be used in different situations.<br /><br /><b>Notes: That's not a tool for "script kiddies" it is of utmost importance to make use of such a powerful tool responsibly and maturely.</b><br /><br />Caution if used in the wrong way, sqlmap generates many queries and can affect the performance of the database target, moreover strange entries and changes to the database schema are possible if the tool is not controlled and used extensively.<br /><br /><h4 style="text-align: left;">PARTLY ANONYMOUS</h4><br />Gentlemen I will demonstrate to you how to use sqlmap with The Onion Router for the protection of IP, DNS, etc... In your Linux, in the terminal type:<br />$ sudo apt-get install tor tor-geoip<br /><br />After enter the sqlmap folder and type:<br /><b>./sqlmap.py -u "http://www.targetvuln.com/index.php?cata_id=1" -b -a –tor --check-tor--user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"</b><br /><br />The argument --tor invokes the Tor to be used and the --check-tor checks if Tor is being used properly, if not, you will receive an error message in red at the terminal. The User Agent is the googlebot, all your requests on the site will look like the Google bot doing a little visit.<br /><br />TOR at SQLMap, we can set your TOR proxy for hiding the source from where the traffic or request is generated.<br /><br /><b>–tor-port, –tor-type</b> :  the parameter can help you out to set the TOR proxy manually.<br />–check-tor : the parameter will check if the tor setup is appropriate and functional.<br /><br /><h4>CONCLUSION</h4><br />It is known that many targets have been explored through SQL Injection a few years ago when this threat was discovered, the injection form was "the nail". The pentester had to construct the SQL queries manually.<br /><br />Then came the development of programs that automated attack. Nowadays perhaps the best known of these programs is sqlmap.py. SQLMAP is a program of open source testing framework written in Python. It has full support for database systems: MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and also supports 6 types of SQL Injection techniques.<br /><br /><h4 style="text-align: left;">SOLUTION</h4><br /><b>1.</b><span class="Apple-tab-span" style="white-space: pre;"> </span>Correct the SQL server regularly.<br /><b>2.</b><span class="Apple-tab-span" style="white-space: pre;"> </span>Limit the use of dynamic queries.<br /><b>3.</b><span class="Apple-tab-span" style="white-space: pre;"> </span>Escape input data from users.<br /><b>4.</b><span class="Apple-tab-span" style="white-space: pre;"> </span>Stores the credentials of the database in a separate file.<br /><b>5.<span class="Apple-tab-span" style="white-space: pre;"> </span></b>Use the principle of least privilege.<br /><b>6. </b>Use prepared statements<br /><br />A Big hug for my dear brother Rafay Baloch and all followers of the RHA.<br /><br /></div><h4 style="text-align: left;">ABOUT THE AUTHOR:</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" /></a></div><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">This is a guest post written by , </span><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">RAFAEL FONTES SOUZA</b><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">. He is the maintainer of the “</span><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">Project Backtrack Team Brazilian</b><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">”, He works at </span><a href="http://services.rafayhackingarticles.net/" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">RHAinfosec </a><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">as a senior penetration tester. He is also the Founder of the "Wikileaks and Intelligence, Cypherpunks". Good communication in groups and the general public, attended college projects with a focus on business organization, he currently seeks work experience outside of brazil”. He frequently contributes at RHA and talks about various topics related to internet security. </span></div>

Introduction To SQLmap And Firewall Bypassing

ABSTRACT Most cyber-attacks in the world that involve websites occurs due to lack of updates and the failure to validate the user input. Sta...

+ Read more »

A Beginners Guide To Using IPTables

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijTJ3Cp3q38pmokVGO5SoGw-FEo0HOihKlFOXhEWy8NwTzPah9p2RFlh-ZXXTb5ao6sDw6K-i2qlKvNgB0R1HAttqgkqivFq8LVTq4HnbxDBOn_SHW1g4qqz_0vwK5jdVG8afmwzkDDw8/s1600/untitled.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="296" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijTJ3Cp3q38pmokVGO5SoGw-FEo0HOihKlFOXhEWy8NwTzPah9p2RFlh-ZXXTb5ao6sDw6K-i2qlKvNgB0R1HAttqgkqivFq8LVTq4HnbxDBOn_SHW1g4qqz_0vwK5jdVG8afmwzkDDw8/s1600/untitled.JPG" width="400" /></a></div><h4 style="text-align: left;">ABSTRACT</h4><span style="color: #666666;">Readers, there are numerous reasons ... It is well known that the Internet is an unmanaged an decentralized network, running under a set of protocols, which are not designed to ensure the integrity and confidentiality of information and access controls.</span><br /><span style="color: #666666;">There are several ways to breach a network, but these ways do nothing more than take advantage of flaws within network protocols and services.</span><br /><br /><a name="more"></a><br /><h4 style="text-align: left;">CONCEPTS</h4>IPTABLES is an editing tool for packet filtering, with it you can analyze the header and make decisions about the destinations of these packets, it is not the only existing solution to control this filtering. We still have the old ipfwadm and ipchains, etc.<br />It is important to note that in Gnu / Linux, packet filtering is built into the kernel. Why not configure your installation in accordance with this article, since most distributions come with it enabled as a module or compiled directly into the kernel.<br /><br /><h4 style="text-align: left;"><span style="color: #6aa84f;">STEP BY STEP</span></h4><br />case "$1" in<br />start)<br /><br /><span style="color: #6aa84f;">Clearing Rules</span><br />iptables -t filter -F<br />iptables -t filter -X<br /><br /><span style="color: #6aa84f;">Tips [ICMP ECHO-REQUEST] messages sent to broadcast or multicast</span><br />echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts<br /><br /><span style="color: #6aa84f;">Protection against ICMP redirect request</span><br />echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects<br /><br /><span style="color: #6aa84f;">Do not send messages, ICMP redirected.</span><br />echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects<br /><br /><span style="color: #6aa84f;">(Ping) ICMP </span><br />iptables -t filter -A INPUT -p icmp -j ACCEPT<br />iptables -t filter -A OUTPUT -p icmp -j ACCEPT<br /><br /><span style="color: #6aa84f;">Packages logs with nonexistent addresses (due to wrong routes) on your network</span><br />echo 1 > /proc/sys/net/ipv4/conf/all/log_martians<br /><br /><span style="color: #6aa84f;">Enabling forwarding packets (required for NAT)</span><br />echo "1" >/proc/sys/net/ipv4/ip_forward<br /><br /><span style="color: #6aa84f;">SSH accepted</span><br />iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT<br /><br /><span style="color: #6aa84f;">Do not break established connections</span><br />iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT<br />iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT<br /><br /><span style="color: #6aa84f;">Block all connections by default</span><br />iptables -t filter -P INPUT DROP<br />iptables -t filter -P FORWARD DROP<br />iptables -t filter -P OUTPUT DROP<br /><br /><span style="color: #6aa84f;">IP spoofing protection</span><br />echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter<br />echo - Subindo proteção contra ip spoofing : [OK]<br /><br /><span style="color: #6aa84f;">Disable sending the IPV4</span><br />echo 0 > /proc/sys/net/ipv4/ip_forward<br /><br /><span style="color: #6aa84f;">SYN-Flood Protection</span><br />iptables -N syn-flood<br />iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN<br />iptables -A syn-flood -j LOG --log-prefix "SYN FLOOD: "<br />iptables -A syn-flood -j DROP<br /><br /><span style="color: #6aa84f;"># Loopback</span><br />iptables -t filter -A INPUT -i lo -j ACCEPT<br />iptables -t filter -A OUTPUT -o lo -j ACCEPT<br /><span style="color: #6aa84f;"><br /></span><span style="color: #6aa84f;">Tips connections scans</span><br />iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j DROP<br />iptables -A INPUT -m recent --name scan --update --seconds 600 --rttl --hitcount 3 -j LOG --log-level info --log-prefix "Scan recent"<br /><br /><span style="color: #6aa84f;">Tips SYN packets invalid</span><br />iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP<br />iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP<br />iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP<br />iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"<br />iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"<br />iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-level info --log-prefix "Packages SYN Detected"<br /><span style="color: #6aa84f;"># Tips SYN packets invalid</span><br />iptables -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP<br />iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP<br />iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP<br />iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"<br />iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-level info --log-prefix "Packages SYN Detected"<br />iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-level info --log-prefix "Packages SYN Detected"<br /><br /><span style="color: #6aa84f;">Certifies that new packets are SYN, otherwise they Tips</span><br />iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP<br /><br /><span style="color: #6aa84f;">Discard packets with fragments of entry. Attack that can cause data loss</span><br />iptables -A INPUT -f -j DROP<br />iptables -A INPUT -f -j LOG --log-level info --log-prefix "Packages fragmented entries"<br /><br /><span style="color: #6aa84f;">Tips malformed XMAS packets</span><br />iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP<br />iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOG --log-level info --log-prefix "malformed XMAS packets"<br /><br /><span style="color: #6aa84f;">DNS In/Out</span><br />iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT<br />iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT<br />iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT<br />iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT<br /><br /><span style="color: #6aa84f;">NTP Out</span><br />iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT<br /><br /><span style="color: #6aa84f;">WHOIS Out</span><br />iptables -t filter -A OUTPUT -p tcp --dport 43 -j ACCEPT<br /><br /><span style="color: #6aa84f;">FTP Out</span><br />iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 30000:50000 -j ACCEPT<br /><br /><span style="color: #6aa84f;">FTP In</span><br />iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT<br />iptables -t filter -A INPUT -p tcp --dport 30000:50000 -j ACCEPT<br />iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br /><br /><span style="color: #6aa84f;">HTTP + HTTPS Out</span><br />iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT<br /><br /><span style="color: #6aa84f;">HTTP + HTTPS In</span><br />iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT<br />iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT<br /><br /><span style="color: #6aa84f;">Mail SMTP:25</span><br />iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT<br /><br /><span style="color: #6aa84f;">Mail POP3:110</span><br />iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT<br /><br /><span style="color: #6aa84f;">Mail IMAP:143</span><br />iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT<br /><br /><span style="color: #6aa84f;"># Reverse</span><br />iptables -t filter -A INPUT -p tcp --dport 77 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 77 -j ACCEPT<br /><br /><span style="color: #6aa84f;">MSF</span><br />iptables -t filter -A INPUT -p tcp --dport 7337 -j ACCEPT<br />iptables -t filter -A OUTPUT -p tcp --dport 7337 -j ACCEPT<br /><br />#######################################<br /><span style="color: #6aa84f;">WEB Management Firewall</span><br />touch /var/log/firewall<br />chmod +x /var/log/firewall<br />/var/log/firewall -A INPUT -p icmp -m limit --limit 1/s -j LOG --log-level info --log-prefix "ICMP Dropped "<br />/var/log/firewall -A INPUT -p tcp -m limit --limit 1/s -j LOG --log-level info --log-prefix "TCP Dropped "<br />/var/log/firewall -A INPUT -p udp -m limit --limit 1/s -j LOG --log-level info --log-prefix "UDP Dropped "<br />/var/log/firewall -A INPUT -f -m limit --limit 1/s -j LOG --log-level warning --log-prefix "FRAGMENT Dropped "<br />/var/log/firewall -A INPUT -m limit --limit 1/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "<br />/var/log/firewall -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "<br />exit 0<br />;;<br /><br />stop)<br />echo "turning off the firewall "<br />iptables -P INPUT ACCEPT<br />iptables -P OUTPUT ACCEPT<br />iptables -t filter -F<br />exit 0<br />;;<br /><br />restart)<br />/etc/init.d/firewall stop<br />/etc/init.d/firewall start<br />;;<br /><br /><span style="color: #6aa84f;">echo "Use: /etc/init.d/firewall {start|stop|restart}"</span><br />exit 1<br />;;<br />esac<br /><br /><span style="color: #6aa84f;">Logs available:</span> /var/log/firewall<br /><span style="color: #6aa84f;">COMMANDS TO MONITOR LOGS</span><span style="color: lime;">:</span> tail -f /var/log/messages<br /><span style="color: #6aa84f;">Save</span><span style="color: lime;">:</span> /etc/init.d/firewall<br /><br /><h4 style="text-align: left;">CONCLUSION</h4>Gentlemen, I hope to help you in configuring your network security and remind you to choose only the best options available.<br />Allow me to add a few Advantages of using your firewall. Be sure to Block unknown and unauthorized connections. You can specify what types of network protocols and services to be provided and you may control the packets from any untrusted services. Your firewall also allows blocking websites with URL filters, access control, access logs for reports by user, protecting the corporate network through proxies, and Automatic Address Conversion (NAT). Control services that can either be executed or not, on the network allowing for high performance in their duties with easy administration and reliability.<br /><u><br /></u><u>A hug to all who follow RHA and my sweet brother Rafay Baloch.</u></div><h4 style="text-align: left;">ABOUT THE AUTHOR:</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" /></a></div><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">This is a guest post written by , </span><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">RAFAEL FONTES SOUZA</b><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">. He is the maintainer of the “</span><b style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">Project Backtrack Team Brazilian</b><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">”, He works at </span><a href="http://services.rafayhackingarticles.net/" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">RHAinfosec </a><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 12px; line-height: 19.1875px;">as a senior penetration tester. He is also the Founder of the "Wikileaks and Intelligence, Cypherpunks". Good communication in groups and the general public, attended college projects with a focus on business organization, he currently seeks work experience outside of brazil”. He frequently contributes at RHA and talks about various topics related to internet security. </span> </div>

A Beginners Guide To Using IPTables

ABSTRACT Readers, there are numerous reasons ... It is well known that the Internet is an unmanaged an decentralized network, running under ...

+ Read more »

Certified Penetration Testing Consultant - C)PTC Review

<div dir="ltr" style="text-align: left;" trbidi="on"><html> <div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjO54ROaddAdxrRxtlEl05J4BN-5vaeEzFi0k1eyGHSnQYOX6US64CEPzpHvRq0OW4azMBtcxS-Pg2cGP_pg7BMLsMMVxia75uRgb5gZRGHhnoYh1jKuch_EOhMo1q8VCDkJoG0f5JtoC8/s1600/cptc.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjO54ROaddAdxrRxtlEl05J4BN-5vaeEzFi0k1eyGHSnQYOX6US64CEPzpHvRq0OW4azMBtcxS-Pg2cGP_pg7BMLsMMVxia75uRgb5gZRGHhnoYh1jKuch_EOhMo1q8VCDkJoG0f5JtoC8/s1600/cptc.png" /></a></div>Although most of the attacks have moved towards Web Application, but the most critical information resides upon the network and is not being exposed to the Web application, therefore a lot of the organizations are allocating a certain amount of budget to obtain a better security model. However, now a days network penetration testing is becoming a tedious job due to the fact that organizations are now implementing multiple layers of defenses. In such cases a better strategy and advanced attack strategies are required for conducting a better security assessment.<br /> <br /> Recently, I got a chance to take the C | PTC course which was focused primarily on testing huge network infrastructures. So, therefore I thought to write an unbiased review about the course contents and the examination.<br /> <a name="more"></a><b>CPTC (Certified Penetration Testing Consultant)</b> comes into two flavors, the practical and the theoretical exam. The theoretical exam costs about 300$ and comes in the form of multiple choice questions, whereas the CPTC practical exam costs 600$. The exam would consists of two IP addresses to pentest and 6 hours to exploit them and report the results to pass the examination. At the end of the engagement, you would need to submit full penetration testing report with all your technical findings under 90 days, the report would be evaluated by experts and based upon their decision, you'll be marked with a pass or fail.<br /> <br /> The overall course is based upon Network infrastructure based attacks i.e. mostly related to layer 2, layer 3, Layer 4 attacks. The course included in depth coverage of much less discussed topics such as Vlan hopping at layer 2, routing protocols attacks (OSPF, EIGRP), HSRP, VPN, IPV6 based attacks etc. The course kit ships up with a workbook, a Lab guide and lab access to follow practice the attacks you have learnt through out the course. The course is strongly recommended to any one who is interested in taking their skills to the next level.<br /> <h4> Course Content</h4>The course is divided into 8 different modules and each module comes up with a lab of it's own. So that after each module you would be able to practice the attacks you learned.<br /> <br /> <br /> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI6aDyy13dY_BzpJgNyozUoEMdnu6EO1R3otJm8j_WsV0tXr2t1yYgjrc8vOFOjGR6x2NUXPaYpSbKq2k5StppAjgSbNiPu-Z2IioGpYUmDM1UmrNuat3NBpbTDlJbUXRLud-ii4wlq8o/s1600/CPTC.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI6aDyy13dY_BzpJgNyozUoEMdnu6EO1R3otJm8j_WsV0tXr2t1yYgjrc8vOFOjGR6x2NUXPaYpSbKq2k5StppAjgSbNiPu-Z2IioGpYUmDM1UmrNuat3NBpbTDlJbUXRLud-ii4wlq8o/s1600/CPTC.png" width="577" /></a><br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC_6KOk1pq7AZx1vNPm2JT9Dga7shpwfG4UfbVaetHxgV6xbSTECeWWHGr81o_fbCxmF70vk5vU8SBnbHHX4rMx2-39He7n7gZ01l45xLSdqSiN5fW_xfOZErO-EWGifGKc1rwkozuhRU/s1600/CPTC+LAB2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="394" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC_6KOk1pq7AZx1vNPm2JT9Dga7shpwfG4UfbVaetHxgV6xbSTECeWWHGr81o_fbCxmF70vk5vU8SBnbHHX4rMx2-39He7n7gZ01l45xLSdqSiN5fW_xfOZErO-EWGifGKc1rwkozuhRU/s1600/CPTC+LAB2.png" width="577" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"> </div><br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigHCgaKHLCg0fYBtMEdKTSdLQxIcOKXwEW6DbuMH2q5xaXO0G6SaZDjg5wBhc2c7UNMfsyz7Cdi9pd-9pN4g9Rty7ONO8icBEM6ek2SU1EoSWwYhbD_wpAm7ww6B5K3A8wrgR71gvEU5s/s1600/CPTClab.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="526" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigHCgaKHLCg0fYBtMEdKTSdLQxIcOKXwEW6DbuMH2q5xaXO0G6SaZDjg5wBhc2c7UNMfsyz7Cdi9pd-9pN4g9Rty7ONO8icBEM6ek2SU1EoSWwYhbD_wpAm7ww6B5K3A8wrgR71gvEU5s/s1600/CPTClab.png" width="577" /></a></div><br /> <br /> According to mile2, the attendees of the course would be able to do the following things:<br /> <br /> <ul style="text-align: left;"><li>Perform a penetration test and submit a deliverable report</li><li>Capture and replay VoIP traffic</li><li>Learning Network Infrastructure advanced Attacks.</li><li>Find and exploit databases with SQL Injection vulnerabilities</li><li>Manipulate prices on e-commerce websites</li><li>Obtain and transfer information via Bluetooth enabled telephones</li><li>Tools and resources for picking simple and complex locks</li><li>Techniques for Wireless Site Surveying and Cracking WEP/WPA key</li><li>Each day ends with a Capture the Flag Competition to ensure that participants retain the daily objectives.</li><li>Additionally, attendees will be qualified to confidently undertake the CPT Consultant practical examination.</li></ul><h4> Pros</h4><ul style="text-align: left;"><li>The course offers wide varieties of topics for advanced penetration testing</li><li>The examination is based upon real world practical challenge.</li><li>Along with pentesting, they also teach you how to write reports, which is something that is often not taught in most of the penetration testing courses.</li><li>The course talks about complex network Infrastructure attacks specifically focused on cisco.</li><li>The cost for the exam and material is pretty reasonable when compared with other certifications such as eccouncil's CEH.</li></ul><h4> Cons</h4><ul style="text-align: left;"><li>Since the CPTE course covers much about webapplication penetration testing, the course being an advanced versions should also had contained a module on "WebApplication" security/pentesting. However, mile2 has specifically designed a course for webapplications known as CSWAE course, which we would review very soon here at RHA.</li><li>The workbook/labguide should be downloadable as the PDF, so that people can study offline.</li></ul><h4> Conclusion</h4>Overall, I found the course pretty fascinating and it's definitely recommended for individuals that want to dive inside the world of network infrastructure attacks and hack on lower layers.<br /> <h4> Questions and Comments</h4>If you have any questions feel free to contact: <b>BillNelson@Mile2.com.</b> Mile2 has been kind enough to offer a special discount rate of 14% specifically for <b>RHA readers</b>.<br /> <br /> <b>Discount Code</b>:<b> <u>BNSpcl14</u></b></div></html></div>

Certified Penetration Testing Consultant - C)PTC Review

Although most of the attacks have moved towards Web Application, but the most critical information resides upon the network and is not be...

+ Read more »

How to install and use Veil-Catapult in backtrack?

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">Today we are gonna talk about Veil-Catapult.Veil-Catapult is payload delivery for when metasploit’s psexec getting caught by AV.It utilizes Veil-Evasion to generate AV-evading binaries, impacket to upload/host the binaries, and the passing-the-hash toolkit to trigger execution.It officially supported on kali linux only.I`m going to show you how to install Veil-Catapult in backtrack? <br /><br />First if you have not already installed <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html">veil-evasion</a> framework then first install it as mentioned <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html">here</a>.After installing Veil-evasion follow steps. <br /><br />root@bt:~wget https://github.com/Veil-Framework/Veil-Catapult/archive/master.zip <br /><br />root@bt:~unzip master.zip  <br /><br />root@bt:~cd Veil-Catapult-master/ <br /><br />root@bt:~sh setup.sh <br /><br />Now veil-catapult require impacket library & passing the hash toolkit.So setup script try to install PTH suite but we got error.So we have to manually do it. </div><h3 style="text-align: left;">Install passing the hash. </h3><div style="text-align: left;"><br />root@bt:~wget https://passing-the-hash.googlecode.com/files/wmiPTH-1.0-1.deb <br /><br />root@bt:~wget https://passing-the-hash.googlecode.com/files/winexePTH1.1.0-1.deb <br /><br />root@bt:~dpkg -i winexePTH1.1.0-1.deb <br /><br />root@bt:~dpkg -i wmiPTH-1.0-1.deb <br /><br />If you are using other OS then you have to manually build it as mentioned <a href="http://passing-the-hash.blogspot.in/2012/07/building-pth-suite-post-install.html">here</a> . <br /><br />It installed into the /opt/pth/bin folder , we have to move it into /usr/bin. <br /><br />root@bt:~# ln -s /opt/pth/bin/wmis /usr/bin/pth-wmis <br /><br />root@bt:~# ln -s /opt/pth/bin/winexe /usr/bin/pth-winexe <br /><br />root@bt:~# ln -s /opt/pth/bin/wmic /usr/bin/pth-wmic </div><a name="more"></a><h3 style="text-align: left;">Installing impacket library </h3><div style="text-align: left;"><br />root@bt:~# wget http://corelabs.coresecurity.com/index.php?module=Wiki&action=attachment&type=tool&page=Impacket&file=impacket-0.9.11.tar.gz <br /><br />root@bt:~# tar -xvzf impacket-0.9.11.tar.gz  <br /><br />root@bt:~# cd impacket <br /><br />root@bt:~# python setup.py build  <br /><br />I know you have question that we can install it , but when we tried to install , it  installed succesfully ;but some of modules are missing.So we first gonna build it then copy it. Now copy folder impacket from build/lib.linux-i686-2.6/ and paste it into /usr/lib/pymodules/python2.6  <br /><br />Now everything is ready ,we can run it. Before that open /etc/veil/settings.py and checkout all path. <br /><br />root@bt:~/Veil-Catapult-master# python Veil-Catapult.py  <br /><br />Now select number according to your choice & fill out necessary option. </div><h3 style="text-align: left;">Powershell injector </h3><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0BDFHBpObRMq4opQzHFIeOG4vA5vCKKzyZ_gvbTwQ6dAWStCSKsDcehaGuomFCqwFbvrHJdkLVZ6v_GeKSdzz0pLOw-6KXPXTp5QCFos4MU2AYfNFhEhGHPT6afeJ5s1hdyzUcdyyLaeN/s1600/Screenshot-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="powershell-injector" border="0" height="43" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0BDFHBpObRMq4opQzHFIeOG4vA5vCKKzyZ_gvbTwQ6dAWStCSKsDcehaGuomFCqwFbvrHJdkLVZ6v_GeKSdzz0pLOw-6KXPXTp5QCFos4MU2AYfNFhEhGHPT6afeJ5s1hdyzUcdyyLaeN/s1600/Screenshot-1.png" title="powershell-injector" width="200" /></a></div><div style="text-align: left;"></div><h3 style="text-align: left;">Barebones python injector </h3><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQB2EDELvZHiRKe3nc9BrA2zgFffT8AwQ7x6B5nfpXcxInyP9Ot80XlEoXALSd5jluonMM4rcPeVcx-DcR4E0Q7y14ImF9SiCjOli9qTxisDsRDpLQa9pgX4zXegbLWnFZlOP2mxyq6f2R/s1600/Screenshot-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Barebones-Python-Injection" border="0" height="43" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQB2EDELvZHiRKe3nc9BrA2zgFffT8AwQ7x6B5nfpXcxInyP9Ot80XlEoXALSd5jluonMM4rcPeVcx-DcR4E0Q7y14ImF9SiCjOli9qTxisDsRDpLQa9pgX4zXegbLWnFZlOP2mxyq6f2R/s1600/Screenshot-2.png" title="Barebones-Python-Injection" width="200" /></a></div><h3 class="separator" style="clear: both; text-align: left;">Sethc backdoor</h3><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZC3tosDIr_tc3JRV7zWmWlm99zsvpRpFPkdcmKyYIlAt3KLCoezEyjCFTdhANOli2ePYIYHcFIAfXYJdSk0qpPH0_T_LOB_xv5VgWGziWfWdo5mvIbjNyUfogBXM4OdkYfzEnlWeyL389/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZC3tosDIr_tc3JRV7zWmWlm99zsvpRpFPkdcmKyYIlAt3KLCoezEyjCFTdhANOli2ePYIYHcFIAfXYJdSk0qpPH0_T_LOB_xv5VgWGziWfWdo5mvIbjNyUfogBXM4OdkYfzEnlWeyL389/s1600/Screenshot.png" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><div style="text-align: left;">Reboot, hit Shift key 5 times, SYSTEM shell will pop up. Also there is <a href="http://tipstrickshack.blogspot.com/2013/08/post-exploitation-swaparoo-backdoor.html">script</a> for it in metasploit.Check it out this awesome <a href="http://carnal0wnage.attackresearch.com/2012/04/privilege-escalation-via-sticky-keys.html">blog</a> for more details.<br /><h3 style="text-align: left;">EXE delivery upload  </h3></div></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj-vkoCmHU3efM5JZjKKTIcYP_JgK5cW1nFomDGbnN7LWgj57nRbfIvK27s9FWP7bb6H6-u62cNohb9Iygs83EnEYLQvdVdKo5ZqGpf0QjnjJ6Z9mA3rKL3qk3L2uWOZTTrb6mhM1Hm5B2/s1600/Screenshot-4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="exe-deliver" border="0" height="108" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj-vkoCmHU3efM5JZjKKTIcYP_JgK5cW1nFomDGbnN7LWgj57nRbfIvK27s9FWP7bb6H6-u62cNohb9Iygs83EnEYLQvdVdKo5ZqGpf0QjnjJ6Z9mA3rKL3qk3L2uWOZTTrb6mhM1Hm5B2/s1600/Screenshot-4.png" title="exe-deliver" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_6sOPz1MzJ-7FldzA1ncj2axmb8UI7wxr6bKgDXk2BdZPU-bWebY9J5IfqATpl8E3aeOAwEIBA5cCVndIQfdzPxa8W5Geb6rVzv-BR-IIVWU-0jFlEzVpl9ruPirX2lNMQpnwMkZMMqT/s1600/Screenshot-6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="veil-catapult-exe-upload" border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_6sOPz1MzJ-7FldzA1ncj2axmb8UI7wxr6bKgDXk2BdZPU-bWebY9J5IfqATpl8E3aeOAwEIBA5cCVndIQfdzPxa8W5Geb6rVzv-BR-IIVWU-0jFlEzVpl9ruPirX2lNMQpnwMkZMMqT/s1600/Screenshot-6.png" title="veil-catapult-exe-upload" width="320" /></a></div><br />Cleanup resource script is generated , you can use it after your work completed for kill process & remove exe.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQYJ4xpRPcERU19EdEBmIc-o3DpYrJpfaS7XHA0uuC1TB630LvYeDNd0rgvUZGAAwd7crJBjUbF35AGYucdhh2hNJ6_8aAiEKFHjvnB0AQgIRWyDgmfqoUuLIbH_f-fUw3I67mITUeSYkH/s1600/Screenshot-7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Veil-Catapult-cleanup-script" border="0" height="135" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQYJ4xpRPcERU19EdEBmIc-o3DpYrJpfaS7XHA0uuC1TB630LvYeDNd0rgvUZGAAwd7crJBjUbF35AGYucdhh2hNJ6_8aAiEKFHjvnB0AQgIRWyDgmfqoUuLIbH_f-fUw3I67mITUeSYkH/s1600/Screenshot-7.png" title="Veil-Catapult-cleanup-script" width="200" /></a></div><br />You can also host exe using temporary SMB server.This will load the payload executable into memory without touching disk, allowing otherwise disk-detectable executable to bypass detection<br /><div style="text-align: left;"><br />Alternatives of Veil-Catapult are <a href="http://www.pentestgeek.com/2013/10/23/smbexec-2-0-released">smbexec</a>  and <a href="http://bernardodamele.blogspot.in/2009/12/keimpx-in-action.html">keimpx</a>. </div></div>

How to install and use Veil-Catapult in backtrack?

Today we are gonna talk about Veil-Catapult.Veil-Catapult is payload delivery for when metasploit’s psexec getting caught by AV.It utilizes ...

+ Read more »

The Hacker's Manifesto

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhviqYkVy3ZaROKL1do9TdYXdZTvYbCSt_0Tri9NrA9lXU4kGO6otMYGUZciGdk_9WmcwbAinCnmYATVhQfnoNWMivIehxyTjLGm2SAOrtQCATlzZqH0crk-w6OhUepCwkt9EeyQE0Wffk/s1600/8c95bb3eff4d6b49e5782a27f994a7db_large.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhviqYkVy3ZaROKL1do9TdYXdZTvYbCSt_0Tri9NrA9lXU4kGO6otMYGUZciGdk_9WmcwbAinCnmYATVhQfnoNWMivIehxyTjLGm2SAOrtQCATlzZqH0crk-w6OhUepCwkt9EeyQE0Wffk/s1600/8c95bb3eff4d6b49e5782a27f994a7db_large.jpeg" width="577" /></a></div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;"><br /></div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Every hacker has his own manifesto, and this is what our team member "<b>Rafael Souza</b>" has sent to us as his manifesto. </div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">This is my manifest... I dedicated more than half of my life to studying the martial arts, and the study of “Hacking”;these two seemingly unrelated paths, found many common points that I would like to share.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">The first commonality is that normally people today are more interested in products "fast food", something that is fast, easy, with minimal effort and maximum results. Anyone who has really studied and practiced legitimate hacking knows that as in the Martial Arts Hacking is a way of life that never ends!</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">You see a simple example of this is to see the hundreds of self-defense academies that teach the individual how to defend against assaults, etc...When in fact they are just creating a false sense of security about the individual and therefore the individual will be more in danger.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;"></div><a name="more"></a><br /><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">This also happens in Hacking, there are thousands of books that say: "you’ll be e a hacker soon”, "Learn all the techniques of hackers”, "Maximum Security"... All sharing a minimum of knowledge and common sense, knowing that this is all nonsense!</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Martial arts are part of an ancient culture, a people that has a very rich history. The term Kung Fu was created over 4000 years and at first was not directly linked to the practice of Martial Arts. For KUNG refers to work, effort, dedication, Kung ideogram represents the figure of anAgricola instrument, denoting effort, sweat. The term semiotic FU "Mature Man", was generally associated with her ​​husband, a man of great culture and great influence in society or a great artist of great creativity.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">So Kung Fu was used to refer to a mature man who has achieved a high level of understanding and implementation in a particular area. Within this reasoning, you could have very Kung Fu for math,literature, cuisine...</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">The term Kung Fu only began to be associated with Chinese martial arts in the West in the 50's when the famous Bruce Lee came to America and made ​​a completely new method of struggle, and when questioned about what he did he just said“Kung Fu “. He started teaching Dai in the West and westerners began to associate the name “Kung Fu” exclusively with Chinese Martial Arts.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Centuries later when the monks began to employ the training Kung Fu in the Shaolin Monastery, WuShu(now has another connotation) Stop the violence through self-control, the monks developed the ability to hurt an individual or even kill him, but at the same time developed the self-control (i.e. retain within "themselves”), an ethic that had an emotional balance.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">This same spirit is found in the Hacking in which people develop a series of abilities through intense dedication to the study of Hacking. For hacking practiced in essence develops in the individual focus (large ability of the individual to focus and determined on a problem and stick to it forhours, even days without sleep often ate until finding the solution).</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Creativity: Many mistakenly think that the hacker is just a walking library that has accumulated much knowledge, but the real hacking begins at the starting point at which he learned by going beyond the point you have learned.  </div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">The ability of abstraction and get rid of all logic.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">The practical importance of these two pathways is essential: movement, action!</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">So you are not considered a hacker or legitimate martial artist why not develop your own discipline as mentioned earlier about the emotional control of warrior monks.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Inside there is a hacking ethic that must be cultivated, i.e.individuals have the ability to be able to do something destructive, but this does not have to be the larger goal. These principles which differentiate a Martial Artist fighter or an athlete.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Often the goal of the individual is in just winning competitions and win medals, while the Martial Artist focus on increasing levels of skill and self-discipline.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">The same scenario is found in the difference between the hacker and cracker, one aims to achieve excellence of knowledge, the other is only interested in stealing, destroying and perhaps achieve profit. There is a gulf of difference in these ways and I hope that most can see these differences.</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Another aspect that is worth to be mentioned, is about the relationship between man and machine. Or the ancient warriors, like the great samurai for example, had not his sword as a tool but as part of himself, such is the intimacy between a soldier and his gun. The samurai sword was simply an extension of his body, he reached such a high degree that the two were one!</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">I think we should have the same aim in hacking similar levels of self-discipline, know the system, the machine thoroughly so that you arrive at the level of running<a href="https://www.blogger.com/blogger.g?blogID=3121270199089759062" name="_GoBack"></a> anything you want, without limitations, and you are part of it!</div><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Another interesting feature in both paths that must be cultivated is malice: Because my master told me a phrase that I never forgot: "<b>The Martial Artist can be accused of anything, least of naive</b>". With malice does not mean doing something destructive, the individual's ability to see the good and bad of every possible situation.</div><br /><div class="MsoNormal" style="line-height: 115%; margin-bottom: 10.0pt;">Gentleman, I hope this clarifies some text for people who do not yet have a clear view on these paths, and the Martial Artists who see only as troublemakers and violent fighters and Hackers as virtual outcasts.</div></div>

The Hacker's Manifesto

Every hacker has his own manifesto, and this is what our team member " Rafael Souza " has sent to us as his manifesto.  This is my...

+ Read more »