How to encrypt sensitive data?

<div dir="ltr" style="text-align: left;" trbidi="on">Encryption Wizard (EW) is a simple, strong, Java file and folder encryptor for protection of sensitive information (FOUO, Privacy Act, CUI, etc.). EW encrypts all file types for data-at-rest and data-in-transit protection. Without installation or elevated privileges, EW runs on Windows, Mac, Linux, Solaris, and other computers with Sun Java. <br /><br />Backtrack 5 has already come with ewizard ; it `s located in the /pentest/misc/ewizard . But it`s not latest version so we have to download latest version<br /><br />Download Ew-public from <a href="http://spi.dod.mil/ewizard.htm" target="_blank">here</a><br /><br />Extract zip file where you can see one java file ; & ewizard user manual which contained all information about how to use it to encrypt & decrypt your private data.<br /><br />For linux user<br />java -jar EW-Public-3.3.5.jar<br /><br />For windows user double click on jar file & you can also install from tools & click on install<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgtsynPVOZd6sucvKn_EgpGMBxH-0O8EqM89m7iNLnNvHSaBl4WM5KF_SWkjv94TOd0yMP13nJIwZkFsONrABiTFTg05G_sX8-87jpWr2OqPvpWojD6XIyPZarooc0MFYBA6hrYwwlRgJn/s1600/ewizard.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="encrypt_data" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgtsynPVOZd6sucvKn_EgpGMBxH-0O8EqM89m7iNLnNvHSaBl4WM5KF_SWkjv94TOd0yMP13nJIwZkFsONrABiTFTg05G_sX8-87jpWr2OqPvpWojD6XIyPZarooc0MFYBA6hrYwwlRgJn/s320/ewizard.jpeg" title="Encryption wizard" width="318" /></a></div><div class="separator" style="clear: both; text-align: center;"></div>It open Encryption wizard.Now click on file menu & add folder or file to encrypt.<br /><br /><br /><br /><br /><span id="goog_354956284"></span> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjW8ioU0wPfnYMC1fhyLgP1wpFY4KVZ5jw3WZOpeLKgWFenE7GdRZsuYk-xoHzazMfcMjFmCAl4ToYVjIS4G_3gX2m5uUrlw_RELunTR7-zIv4gqvTezaA_djnIRCB07ZCDgO1s0dRTp4Pf/s1600/ewizard_1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="encrypt_data" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjW8ioU0wPfnYMC1fhyLgP1wpFY4KVZ5jw3WZOpeLKgWFenE7GdRZsuYk-xoHzazMfcMjFmCAl4ToYVjIS4G_3gX2m5uUrlw_RELunTR7-zIv4gqvTezaA_djnIRCB07ZCDgO1s0dRTp4Pf/s320/ewizard_1.jpeg" title="ewizard" width="314" /></a></div><span id="goog_354956285"></span><br /><a name="more"></a><br /><br />Now add file & enter passphrase . You can also enter certificates; metadata . You can also generate password which show in last tab.<br /><br />Now your file is encrypted.<br /><br />To decrypt, drag the .wzd / .wza file into Encryption Wizard and select ‘Decrypt’. & enter your passphrase.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHfRyrTeCXHzvzkTLb3wdm5Hdec4S7UebtM-p9LLFOVH3WEun0NDIU-h9w63dR4doc-9nRlvkAX5NlsRcJRQbxSIfmYrG4eSj24JokCgrIbgyzGlhkFytMvyMhLx0f_38trigSPnqpgM8W/s1600/ewizard_2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="encrypt_data" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHfRyrTeCXHzvzkTLb3wdm5Hdec4S7UebtM-p9LLFOVH3WEun0NDIU-h9w63dR4doc-9nRlvkAX5NlsRcJRQbxSIfmYrG4eSj24JokCgrIbgyzGlhkFytMvyMhLx0f_38trigSPnqpgM8W/s320/ewizard_2.jpeg" title="ewizard" width="313" /></a></div></div>

How to encrypt sensitive data?

Encryption Wizard (EW) is a simple, strong, Java file and folder encryptor for protection of sensitive information (FOUO, Privacy Act, CUI, ...

+ Read more »

Recon-ng Framework A Quick Intro

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXm8YcPHeAS57Y70pTXKZ4hh3Ews9FciBHFbTgwQuComiHyjucOalSAn74M9ngDjgrZ5c8sIzUuYhV3FE2Sqh4EBuXgPY8CpZ3DO49uqpN92Gp119pyH8SDc411QrdRPDcxXr8VFKACIM/s1600/1_0_440_http---i.haymarket.net.au-News-python.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXm8YcPHeAS57Y70pTXKZ4hh3Ews9FciBHFbTgwQuComiHyjucOalSAn74M9ngDjgrZ5c8sIzUuYhV3FE2Sqh4EBuXgPY8CpZ3DO49uqpN92Gp119pyH8SDc411QrdRPDcxXr8VFKACIM/s320/1_0_440_http---i.haymarket.net.au-News-python.jpg" width="320" /></a></div><span style="text-align: justify;"><span id="goog_1201155913"></span><span id="goog_1201155914"></span><br /></span><span style="text-align: justify;">Recon-ng is an open-source framework coded in python by Tim Tomes a.k.a LaNMaSteR53. Its interface is modeled after the look of the Metasploit Framework but it is not meant for exploitation or for spawning a meterpreter session or a shell, it is for web-based reconnaissance and information gathering. It comes with modules to support your web reconnaissance adventure and information gathering just like Metasploit's auxiliary and exploit modules. Modules are categorized into Discovery, Experimental, Recon and Reporting.</span><br /><a name="more"></a><span style="text-align: justify;">As of this writing here are the modules with its subcategories:</span><br /><div style="text-align: justify;"><br /></div><div style="text-align: justify;"></div><b>Discovery</b><br />---------<br />discovery/exploitable/http/<wbr></wbr>dnn_fcklinkgallery<br />discovery/exploitable/http/<wbr></wbr>generic_restaurantmenu<br />discovery/exploitable/http/<wbr></wbr>webwiz_rte<br />discovery/info_disclosure/dns/<wbr></wbr>cache_snoop<br />discovery/info_disclosure/<wbr></wbr>http/backup_finder<br />discovery/info_disclosure/<wbr></wbr>http/google_ids<br />discovery/info_disclosure/<wbr></wbr>http/interesting_files<br /><br /><b> Experimental</b><br />------------<br />experimental/rce<br /><br /><b>Recon</b><br />-----<br />recon/contacts/enum/http/web/<wbr></wbr>dev_diver<br />recon/contacts/enum/http/web/<wbr></wbr>namechk<br />recon/contacts/enum/http/web/<wbr></wbr>pwnedlist<br />recon/contacts/enum/http/web/<wbr></wbr>should_change_password<br />recon/contacts/gather/http/<wbr></wbr>api/jigsaw/point_usage<br />recon/contacts/gather/http/<wbr></wbr>api/jigsaw/purchase_contact<br />recon/contacts/gather/http/<wbr></wbr>api/jigsaw/search_contacts<br />recon/contacts/gather/http/<wbr></wbr>api/linkedin_auth<br />recon/contacts/gather/http/<wbr></wbr>api/twitter<br />recon/contacts/gather/http/<wbr></wbr>api/whois_pocs<br />recon/contacts/gather/http/<wbr></wbr>web/jigsaw<br />recon/contacts/gather/http/<wbr></wbr>web/pgp_search<br />recon/contacts/support/add_<wbr></wbr>contact<br />recon/contacts/support/mangle<br />recon/creds/enum/http/api/<wbr></wbr>leakdb<br />recon/creds/enum/http/api/<wbr></wbr>noisette<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/account_creds<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/api_usage<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/domain_creds<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/domain_ispwned<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/leak_lookup<br />recon/creds/gather/http/api/<wbr></wbr>pwnedlist/leaks_dump<br />recon/hosts/enum/dns/resolve<br />recon/hosts/enum/http/api/<wbr></wbr>builtwith<br />recon/hosts/enum/http/api/<wbr></wbr>punkspider<br />recon/hosts/enum/http/api/<wbr></wbr>wascompanyhacked<br />recon/hosts/enum/http/api/<wbr></wbr>whatweb<br />recon/hosts/enum/http/api/<wbr></wbr>whois_lookup<br />recon/hosts/enum/http/web/age_<wbr></wbr>analyzer<br />recon/hosts/enum/http/web/<wbr></wbr>asafaweb<br />recon/hosts/enum/http/web/<wbr></wbr>gender_analyzer<br />recon/hosts/enum/http/web/<wbr></wbr>ipvoid<br />recon/hosts/enum/http/web/<wbr></wbr>malwaredomain<br />recon/hosts/enum/http/web/<wbr></wbr>mywot<br />recon/hosts/enum/http/web/<wbr></wbr>netbios<br />recon/hosts/enum/http/web/<wbr></wbr>netcraft_history<br />recon/hosts/enum/http/web/<wbr></wbr>open_resolvers<br />recon/hosts/enum/http/web/<wbr></wbr>urlvoid<br />recon/hosts/enum/http/web/web_<wbr></wbr>archive<br />recon/hosts/enum/http/web/<wbr></wbr>xssed<br />recon/hosts/gather/dns/brute_<wbr></wbr>force<br />recon/hosts/gather/http/api/<wbr></wbr>bing_ip<br />recon/hosts/gather/http/api/<wbr></wbr>google_site<br />recon/hosts/gather/http/api/<wbr></wbr>shodan_hostname<br />recon/hosts/gather/http/web/<wbr></wbr>baidu_site<br />recon/hosts/gather/http/web/<wbr></wbr>bing_site<br />recon/hosts/gather/http/web/<wbr></wbr>census_2012<br />recon/hosts/gather/http/web/<wbr></wbr>google_site<br />recon/hosts/gather/http/web/<wbr></wbr>ip_neighbor<br />recon/hosts/gather/http/web/<wbr></wbr>mcafee/mcafee_affil<br />recon/hosts/gather/http/web/<wbr></wbr>mcafee/mcafee_dns<br />recon/hosts/gather/http/web/<wbr></wbr>mcafee/mcafee_mail<br />recon/hosts/gather/http/web/<wbr></wbr>netcraft<br />recon/hosts/gather/http/web/<wbr></wbr>yahoo_site<br />recon/hosts/geo/http/api/<wbr></wbr>hostip<br />recon/hosts/geo/http/api/<wbr></wbr>ipinfodb<br />recon/hosts/geo/http/api/<wbr></wbr>maxmind<br />recon/hosts/geo/http/api/<wbr></wbr>uniapple<br />recon/hosts/geo/http/web/wigle<br />recon/hosts/support/add_host<br /><br /><b>Reporting</b><br />---------<br />reporting/csv_file<br />reporting/html_report<br />reporting/list<br /><br /><div style="text-align: justify;">I am also one of the contributors for this framework and has contributed mostly to the Discovery modules.</div><div style="text-align: justify;"><br /></div><div style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-qSycOoCkoZ0/Uez9qigm23I/AAAAAAAAAss/f1_GJQr7TNg/s1600/recon-ng.png" style="margin-left: 1em; margin-right: 1em;" target="_blank"><img border="0" height="392" src="http://1.bp.blogspot.com/-qSycOoCkoZ0/Uez9qigm23I/AAAAAAAAAss/f1_GJQr7TNg/s640/recon-ng.png" width="577" /></a></div><div style="text-align: justify;"><br /></div>In this article I'm going to emphasize the Backup File Finder module which I authored together with Tim Tomes (the main developer of Recon-ng). This module can be used for checking specific hosts for exposed backup files. The default configuration searches for wp-config.php files which contain WordPress database configuration information.<br /><br />As a side note, this module is inspired by cmsploit.<br /><br /><b>Basic Usage:</b><br /><b><br /></b>load discovery/info_disclosure/<wbr></wbr>http/backup_finder (use the module)<br /><br />show options (shows the options that can be set for the module)<br /><br />set source <a href="http://target.com/" target="_blank">target.com</a> (the host you want to crawl)<br /><br />set uri config_file (configuration file you want to check, ex. wp-config.php)<br /><br />Here is the screenshot of the Backup File Finder's actual crawling.<br /><br /><div style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-2fVYb02icj8/UfSCMLGMNqI/AAAAAAAAAtA/wda3IzeYnuA/s1600/finder.jpg" style="margin-left: 1em; margin-right: 1em;" target="_blank"><img border="0" height="441" src="http://2.bp.blogspot.com/-2fVYb02icj8/UfSCMLGMNqI/AAAAAAAAAtA/wda3IzeYnuA/s640/finder.jpg" width="577" /></a></div><br />Now, here is what's inside in a typical configuration file:<br /><br /><br /><i>define('DB_NAME', 'wordpress');</i><br /><i><br /></i><i>/** MySQL database username */</i><br /><i>define('DB_USER', 'root');</i><br /><i><br /></i><i>/** MySQL database password */</i><br /><i>define('DB_PASSWORD', 'passwd');</i><br /><i><br /></i><i>/** MySQL hostname */</i><br /><i>define('DB_HOST', 'localhost');</i><br /><i><br /></i><i>/** Database Charset to use in creating database tables. */</i><br /><i>define('DB_CHARSET', 'utf8');</i><br /><i><br /></i><i>/** The Database Collate type. Don't change this if in doubt. */</i><br /><i>define('DB_COLLATE', '');</i><br /><i><br /></i>List of the various configuration files used by popular CMS' which can be set to the option <i>uri</i>:<br /><br /><i>wp-config.php >> WordPress</i><br /><i>config.php >> phpBB, ExpressionEngine</i><br /><i>configuration.php >> Joomla</i><br /><i>LocalSettings.php >>MediaWiki</i><br /><i>mt-config.cgi >> Movable Type</i><br /><i>settings.php >> Drupal</i><br /><b><br /></b> <iframe allowfullscreen="" frameborder="0" height="360" src="https://www.youtube.com/embed/PcWWsNgXtLg?feature=player_embedded" width="577"></iframe> <b>About The Author</b><br /><b><br /></b>This article has been written by Jay Turla, he is a security researcher at Infosec, along with security research he also performs vulnerability research too.<br /><br /><b>Resources:</b><br /><a href="https://bitbucket.org/LaNMaSteR53/recon-ng" rel="nofollow" target="_blank">https://bitbucket.org/<wbr></wbr>LaNMaSteR53/recon-ng</a><br /><a href="http://resources.infosecinstitute.com/the-recon-ng-framework-automated-information-gathering/" rel="nofollow" target="_blank">http://resources.<wbr></wbr>infosecinstitute.com/the-<wbr></wbr>recon-ng-framework-automated-<wbr></wbr>information-gathering/</a><br /><a href="http://feross.org/cmsploit/" rel="nofollow" target="_blank">http://feross.org/cmsploit/</a></div>

Recon-ng Framework A Quick Intro

Recon-ng is an open-source framework coded in python by Tim Tomes a.k.a LaNMaSteR53. Its interface is modeled after the look of the Metasplo...

+ Read more »

Extract metadata from file in Backtrack

<div dir="ltr" style="text-align: left;" trbidi="on">Metadata is stored in any document by authoring application which can be user-name ; comment ;creation date;modification date.Metadata is very important in computer Forensic ; well know hacker group Anonymous `s members are arrested due to metadata. Because they upload document without clearing metadata ; so by reading metadata we can find lots of juicy information.<br /><br /><br />Previous we saw how we can extract metadata using <a href="http://tipstrickshack.blogspot.com/2013/07/information-gathering-using-foca.html" target="_blank">FOCA</a> from website ; But we can also extract metadata from BACKTRACK using exiftool.<br /><br />If you want to write your own python script then visit our new section of blog <a href="http://pentesterscript.wordpress.com/2013/07/28/extract-metadat-from-pdf-file-using-python-script/" target="_blank">script</a> .<br /><br />Exiftool can extract metadata from images ;documents ,videos etc.Most of file format are supported in exiftool. EXIFTOOL can also write metadata into Documents. So before uploading document remove metadata from it <br /><br />How to use?<br />(1)If you are not using backtrack than you can download from git. For ubuntu user type following command in terminal.<br />git clone https://github.com/pandastream/libimage-exiftool-perl-9.27.git exiftool<br />sudo apt-get install libarchive-zip-perl<br /><br />(2)cd exiftool<br />(3)./exiftool /path of file.<br /><br />Extract metadata from pdf file:-<br /><br />./exiftool /path of pdf file<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWbFZTTkWvRttfdKXkiPTpK7woUNI9gljBGuRkARH1K-B0jM_PP17KCa5D_l5oLJwK_RIeccbD-sIK8m3vYviUahrMTLg505OFv9Ap4tTtONV10yTuTE34Pk0Pt6yXx-F9KPLE-eo3ew0x/s1600/metadata.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="exiftool-metadata" border="0" height="202" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWbFZTTkWvRttfdKXkiPTpK7woUNI9gljBGuRkARH1K-B0jM_PP17KCa5D_l5oLJwK_RIeccbD-sIK8m3vYviUahrMTLg505OFv9Ap4tTtONV10yTuTE34Pk0Pt6yXx-F9KPLE-eo3ew0x/s400/metadata.jpeg" title="metadata_exiftool" width="400" /></a></div><br /><a name="more"></a><br /></div>

Extract metadata from file in Backtrack

Metadata is stored in any document by authoring application which can be user-name ; comment ;creation date;modification date.Metadata is ve...

+ Read more »

Wordpress Pingback Port Scanner

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><h1 class="western"><span style="font-weight: normal;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">WordpressPingbackPortScanner</span></span></span></h1><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using multiple Wordpress Blogs exposing this API. This issue was fixed in Wordpress 3.5.1. Older versions are vulnerable, if the XML-RPC Interface is active.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(1)Download from <a href="https://github.com/FireFart/WordpressPingbackPortScanner/archive/master.zip" target="_blank">here</a></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(2)Extract it in folder</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(3)cd Downloads/WordpressPingbackPortScanner-master/ </span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(4)It does not work default ruby version which is 1.9.2 ; so by running update-alternatives we can change ruby version to 1.8.2</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">update-alternatives --config ruby </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">select 1</span></span></div><div style="margin-bottom: 0in;"><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">(5)</span></span><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">gem install bundler</span></span><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">bundle install </span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIbGv5RQfTSOXndYH8NUJ7tRdqS-YlL7qhF1RcNlIpc4x_cLH1QwdY1s95YFaDHMYkwjL18MRsilLty7tNofWJVjkEqkEmS9txlAZV0eueSZf7BBc28W_6CBuRjkuTmGA34XLUNhgO9UjA/s1600/ping_back_port_scanner.jpeg" imageanchor="1"><img alt="wordpress-pingback-port-scanner" border="0" height="322" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIbGv5RQfTSOXndYH8NUJ7tRdqS-YlL7qhF1RcNlIpc4x_cLH1QwdY1s95YFaDHMYkwjL18MRsilLty7tNofWJVjkEqkEmS9txlAZV0eueSZf7BBc28W_6CBuRjkuTmGA34XLUNhgO9UjA/s400/ping_back_port_scanner.jpeg" title="wordpress_pingback_port_scanner" width="400" /></a></div><pre class="western" style="margin-bottom: 0.2in;"><code class="western"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"> Use:-<br /><br />Quick-scan a target via a blog:<br /><br />ruby wppps.rb -t http://www.target.com http://www.myblog.com/<br /><br />Use multiple blogs to scan a single target:<br /><br />ruby wppps.rb -t http://www.target.com http://www.myblog1.com/ http://www.myblog2.com/ http://www.myblog3.com/<br /><br />Scan a free wordpress.com blog (all ports) from the internal network:<br /><br />ruby wppps.rb -a -t http://localhost http://myblog.wordpress.com/<br /></span></span></code></pre><div style="margin-bottom: 0in;"></div><a name="more"></a></div>

Wordpress Pingback Port Scanner

WordpressPingbackPortScanner Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other ho...

+ Read more »

List of vulnerability in wordpress 3.5.1.

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">Recently true-caller and Tango messenger is hacked by Syrian-Electronic-Army.</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">And large amount of Database has been stolen. Now what is common in these sites?</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">They have word-press 3.5.1 which is vulnerable to some attack.</span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><br /></div><span style="font-size: medium;">A weakness and multiple vulnerabilities have been reported in WordPress, which can be exploited by malicious users to disclose certain system information and bypass certain security restrictions and by malicious people to conduct spoofing and cross-site scripting attacks, bypass certain security restrictions, and cause a DoS (Denial of Service).<br /><br />1) An error when calculating the hash cycle count within the "crypt_private()" method in /wp-includes/class-phpass.php can be exploited to exhaust CPU and memory resources by sending HTTP requests with a specially crafted password cookie.<br /><br />Successful exploitation of this vulnerability requires knowledge of the URL for a password-protected post.<br /><br />This vulnerability is confirmed in version 3.5.1. Prior versions may also be affected.</span><br /><br /><br /><div style="margin-bottom: 0in;"><span style="font-size: medium;">Here is full details & exploitation is available ;visit this link.</span></div><div style="margin-bottom: 0in;"><span style="font-size: medium;"><a href="https://vndh.net/note:wordpress-351-denial-service">https://vndh.net/note:wordpress-351-denial-service</a></span></div><span style="font-size: medium;"><br />2) An unspecified error within the HTTP API related to server-side requests can be exploited to gain access to the site.</span><br /><div style="margin-bottom: 0in;"><span style="font-size: medium;">Here is full details.</span></div><span style="font-size: medium;"><a href="http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html">http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html</a></span><br /><span style="font-size: medium;"><br />3) An unspecified error can be exploited to bypass certain restrictions when publishing posts.<br /><br />Successful exploitation requires the "Contributor" role.<br /><br />4) An unspecified error can be exploited to reassign the post authorship.<br /><br />5) Certain input related to SWFUpload is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.</span><br /><a name="more"></a><span style="font-size: medium;"><br />6) Certain input related to Flash applet within TinyMCE Media Plugin is not properly verified before being used. This can be exploited to e.g. spoof unspecified content.<br /><br />7) Certain input related to media uploading is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.<br /><br />8) An error when handling failed uploads can be exploited to disclose the full installation path.</span></div>

List of vulnerability in wordpress 3.5.1.

Recently true-caller and Tango messenger is hacked by Syrian-Electronic-Army. And large amount of Database has been stolen. Now what is com...

+ Read more »

Bypassing Cloudflare - Attack-Secure Challenge Writeup!

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCTVf_barNY8WNvaMn7oiBFG9vL7f7RRM8Jy-QsEdwhJXf6jZhwPtdN3N_UwStGP9nBecL0Ua9C7lp-6oNNxQAzbMHvQh8Gkck5AB2aA67r2of2IO8i3U-JAx1ZQFrPfDuezuXpuECxPI/s1600/cfhome2.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCTVf_barNY8WNvaMn7oiBFG9vL7f7RRM8Jy-QsEdwhJXf6jZhwPtdN3N_UwStGP9nBecL0Ua9C7lp-6oNNxQAzbMHvQh8Gkck5AB2aA67r2of2IO8i3U-JAx1ZQFrPfDuezuXpuECxPI/s1600/cfhome2.gif" /></a></div><br />Few days back we setup a small and interesting challenge for RHA readers, the main goal of the challenge was to find the <u>hosting provider</u> and the <u>real iP address</u> of the attack-secure.com. Since attack-secure.com is running cloudflare which acts as a reverse proxy the nameservers and the target iP address would be replaced with the one of cloudflare when ever you try to communicate with the servers. So let's talk about some of the ways we can solve this challenge, we are disclosing some of the ways that could be used to solve this challenge.<br /><b><u></u></b><br /><a name="more"></a><b><u>Bypassing Cloudflare - Method 1</u></b><br /><br />The first method involves the using a website that maintain records of websites using cloudflare, it contains list of around 381,314 domains that have recently shifted to cloudflare and they are actively testing it. The website is called as <b><u>cloudflare-watch.org</u></b>. The guys are cloudflare watch believe that cloudflare was started for a purpose of helping bad guys such as hackers, ddosers, copyright pirates. Here is what they write on their homepage:<br /><br />"<u><i>CloudFlare is a venture-funded startup that routes around Internet abuse by acting as a reverse proxy. They also encourage illegality by allowing hackers, DDoSers, cyberbullies, and copyright pirates to hide behind their servers.</i></u>"   <br /><br />All you need to go to the url below and type your domain name and click on search:<br /><a href="http://www.cloudflare-watch.org/cfs.html">http://www.cloudflare-watch.org/cfs.html</a><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4c0vfd8CCMBhqgXJ8HVZMk08LTM1e7wbWIGG8QUUYA9AAKpyuVQ1-iX8qwL3CQtNsz0Adhmrwh90gsBalcr6faDS2zLvadCvMBuFr43R1f3f9rSWYKAV5ur6Smx_MJuS1uvP8wvMtKsg/s1600/asfsa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="105" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4c0vfd8CCMBhqgXJ8HVZMk08LTM1e7wbWIGG8QUUYA9AAKpyuVQ1-iX8qwL3CQtNsz0Adhmrwh90gsBalcr6faDS2zLvadCvMBuFr43R1f3f9rSWYKAV5ur6Smx_MJuS1uvP8wvMtKsg/s640/asfsa.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">A direct iP connect was found inside the database, if you compare this IP address with the ip address that we get while we ping the website, it's different. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLTnFr0Usph_4ngF0Z0KsTIUpzpBST9Mi9w-v1L_vYXqJpuvt7QoRKxMr5-3hJmtPo0_TUWjTZO2sAfAqzhrQtVjmr0WLYxmiwTBTtjE553td9SEuLrs8q5auhcGRlrJce7SYYW3iaRkA/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLTnFr0Usph_4ngF0Z0KsTIUpzpBST9Mi9w-v1L_vYXqJpuvt7QoRKxMr5-3hJmtPo0_TUWjTZO2sAfAqzhrQtVjmr0WLYxmiwTBTtjE553td9SEuLrs8q5auhcGRlrJce7SYYW3iaRkA/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div>On navigating to the following address "<b>http://199..47.222.125</b>", we find that this particular web server belongs to page.ly which is the real webhosting company for attack-secure.com<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQfyOtvRlODrQ2uFNKoIoJuofkgCNbtETuxDyeo8U5MrP8DanogMV4kTNjECRVBITb4Ddbbo6hyphenhyphenuJ7bGPS2Io7-JaHczhamk7z8c7gWqWafUZUMx-qm9-70E_iDGYy4prWV4HbsbKBnOw/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="347" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQfyOtvRlODrQ2uFNKoIoJuofkgCNbtETuxDyeo8U5MrP8DanogMV4kTNjECRVBITb4Ddbbo6hyphenhyphenuJ7bGPS2Io7-JaHczhamk7z8c7gWqWafUZUMx-qm9-70E_iDGYy4prWV4HbsbKBnOw/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>Bypassing Cloudflare Method 2</u></b></div><div class="separator" style="clear: both; text-align: left;"><b><u><br /></u></b></div><div class="separator" style="clear: both; text-align: left;">The second method is one of the best methods specially to figure out the real ip of forums who are using cloudflare. The idea behind this method to register on a forum or any where that allows registrations, since cloudflare does not handles mx records it is possible for us to find out the real iP by email headers. One of our winners have sent us a video on how he utilized this method to solve the challenge:</div><iframe allowfullscreen="" frameborder="0" height="300" mozallowfullscreen="" src="http://player.vimeo.com/video/70763112" webkitallowfullscreen="" width="577"></iframe> <br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Winners</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">We received hundred's of submission and most of the people were sending the cloudflare iP instead of the real one. We would like to congratulate the following people for solving our challenge:</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>1)</b> <u><b>Haider Qureshi</b> </u>(Solved first) (Utilized the second method)</div><div class="separator" style="clear: both; text-align: left;"><b>2)</b> <b><u>Aamir Rehman</u> </b>(Utilized the second method)</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">There are ofcourse other methods such as resolving real iP by subdomains and by using mx records, We might talk about them in upcoming articles. </div></div>

Bypassing Cloudflare - Attack-Secure Challenge Writeup!

Few days back we setup a small and interesting challenge for RHA readers, the main goal of the challenge was to find the hosting provider a...

+ Read more »

How to solve metasploit problem in SET?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">If you installed metasploit from git repository then you donot face any problem with SET. But If you have installed metasploit from its binary version then when you tried to running social engineering toolkit metasploit attack then might be you get error of some ruby bundle. Here is solution of that problem. I tested on SET <b>Version: 5.2.1</b> & metasploit <b>v4.6.2-1</b>.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">We are going to install Ruby 1.9.3 using RVM. Running all this command in msf3 folder</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">root@bt:~# <b>cd /opt/metasploit/apps/pro/msf3/</b></div><div style="margin-bottom: 0in;"><br /><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>bash -s stable < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer) </b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"><b> </b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>source /etc/profile.d/rvm.sh</b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"><b> </b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>rvm -v </b></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">Once RVM is up and running we need to get a couple of libraries that will be required by the Ruby installation: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>for package in zlib openssl libxslt libxml2; do rvm pkg install $package; done </b></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">And finally the Ruby 1.9.3 runtime: </span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>rvm install 1.9.3</b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>rvm 1.9.3 --default</b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>ruby -v</b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>gem install bundler </b></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">root@bt:/opt/metasploit/apps/pro/msf3# <b>bundle install </b></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">Now open set from its path ; before running set type command like below</span></span></div><div style="margin-bottom: 0in;"><b><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">cd /pentest/exploits/set </span></span></b></div><b></b><br /><div style="margin-bottom: 0in;"><b><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">source /etc/profile.d/rvm.sh </span></span></b></div><b></b><br /><div style="margin-bottom: 0in;"><b><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">rvm 1.9.3 –default </span></span></b></div><b></b><br /><div style="margin-bottom: 0in;"><b><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">./se-toolkit </span></span></b></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman, serif;"><span style="font-size: medium;">Now you can use any metasploit attack from SET .</span></span></div><a name="more"></a><br /></div>

How to solve metasploit problem in SET?

If you installed metasploit from git repository then you donot face any problem with SET. But If you have installed metasploit from its bina...

+ Read more »