Indispensible Need of National CERT in Pakistan

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikFxd9qW2R_wtst6bP0hffY9M12m80swMu3Qa4GCINZUdahVAnpbQqgMOn1qf1JVCMtEeo976uv4m6IXbAQuFYiJxIh2eTDIkwcoyF20K7p0qNo-kSBgQjaCEIekOHZYXHfDcl3NwIqD0/s1600/CyberSecurity.jpeg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikFxd9qW2R_wtst6bP0hffY9M12m80swMu3Qa4GCINZUdahVAnpbQqgMOn1qf1JVCMtEeo976uv4m6IXbAQuFYiJxIh2eTDIkwcoyF20K7p0qNo-kSBgQjaCEIekOHZYXHfDcl3NwIqD0/s1600/CyberSecurity.jpeg" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>In this advanced era where science and technology have become quite advanced, it leave not be incorrect to state that technology has become an essential component of our life whether it is about communication, medication, or something else. Information technology has earned a great deal of popularity in every developed country of modern age and it can be witnessed everywhere from traffic signs to power stations, from air ticketing to shopping deals, etc. Hence, it can be said that technology has become a basic ingredient of every facilitation available to the world in this high tech era. <br /><a name="more"></a>In Pakistan, online sale purchase and other types of online jobs are gaining huge popularity with the passing of time. Now people prefer to do online transactions via using their credit cards and bank accounts online facility. Similarly, the recently announced 3G and 4G technology will also give a boost to the use of information technology.<br /><br />Nevertheless, it is thus unfortunate that whatever has been discovered that is practised against the humankind in one or other form. The worst is now information technology is also being utilized as a weapon against humanity. Applying information technology as an abysmal weapon, the confidential information of the countries is being stolen, which can be applied.<br /><br />A long list of evidences related to cyber-attacks is present when it comes to Pakistan. For example, various fiscal, educational, and diplomatic institutions of Pakistan Government and Pakistan Army were attacked by Indian Government Backed Hackers, back in 2010. Apart from this, various attacks were being prepared to steal secret information of the country. Almost 50-100 cyber-attacks are reported on Pakistani sites. The news concerned to these cyber-attacks made by international offices is not veiled from anyone, especially when it arrives to steal information via any virus or American NSA's cyber surveillance.<br /><br />Modern countries of the current era are focusing extensively on cyber war and establishing cyber security research centers for the ultimate prevention of the cyber-attacks. Apart from this, the establishment of computer emergency response units is also in progress. Both of these cyber security research centers and computer emergency response units are of outstanding importance for their nation. The authorities cannot only keep an eye on their country’s Banking sector, but can also communicate with other countries to inform them about new cyber-attacks via these computer emergency response units. Moreover, these units will also become able to send the information related to cyber-attacks to different institutions of the country, especially to the commercial data center to bring these attacks to an end. This is the reason, which is why the secret information about the government and the banking sector of the countries having their computer emergency response units, is quite safe as compare to others, who do not own such units. Moreover, with these units, the effective and efficient cyber-attacks prevention strategies can also be implemented on time.<br /><br />Everyone is concerned about the information technology and its security. However, its importance in Pakistan is still quite questionable where no one pays attention to the news related to hacking of seven banks in a week. The story does not end here. As per recent estimates, four government websites are receiving cyber-attacks on a daily basis, but no prevention technique is being adopted to stop these attacks. The authorities must understand that by hacking their official websites, the hackers can access to internal network system by infecting administration with their malware which can steal and forward all the significant files from C&C servers. In case of banking sector, they can get access to important credentials, including bank accounts, email passwords, and credit card details. Thus, being aware of the importance of cyber warfare is quite essential for our government and officials, especially in the current age of advance technology.<br /><br />To avoid these cyber-attacks, the government of Pakistan must focus on the establishment of a computer emergency response unit of high excellence. It has been estimated that till 2020, Pakistan will go one of the secured high tech countries only if the government will establish computer emergency response unit till 2015. With this approach, Pakistan will not only become eligible to safeguard its industry, but will also become capable of protecting other nations from unauthorized access.<br /><br />Hence, the essential requirement of this advanced era is to have computer emergency response units to eliminate the menace of cyber warfare and to enjoy cyber security. The expectations from PML-N government is quite high that the way they disseminate the network of optical fiber in the country, they introduced 3G and 4G in Pakistan, they will certainly work on the effective and efficient organization of quality computer emergency response units in the nation.<br /><br /><b>About The Author</b><br /><br />This article has been written by "<b><u>Mansab Chaudry</u></b>", Chaudry is the founder of a Security company called Refluxes and the lead author at Whogothacked.com, A news blog covering Ethical hacking and Security news. In his free time he actively contributes to RHA with topics related to Cyber Security. </div>

Indispensible Need of National CERT in Pakistan

In this advanced era where science and technology have become quite advanced, it leave not be incorrect to state that technology has become ...

+ Read more »

An Introduction To iOS Forensics - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdNl2LabiJTaXDa-e7IYrALrGHLhTSkyhuqpXVmMg1LisEj-6_apdelhHH4s5HxtNsMUv3LWmvVmfpjaYEhe82eZxZLEYUXUEcnRT2KVSgb1Yi49xtNu4_ZsdoCdnioEsyDFhZEkfQrHg/s1600/iOS.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdNl2LabiJTaXDa-e7IYrALrGHLhTSkyhuqpXVmMg1LisEj-6_apdelhHH4s5HxtNsMUv3LWmvVmfpjaYEhe82eZxZLEYUXUEcnRT2KVSgb1Yi49xtNu4_ZsdoCdnioEsyDFhZEkfQrHg/s1600/iOS.jpg" /></a></div><h4 style="text-align: left;">ABSTRACT</h4>It is known that with the increased use of mobile devices, cyber-crimes in these types of applications have multiplied, forensic science has evolved so that the techniques and tools have become more specific to certain types of platform.<br /><br />The use of scientific methods for preserving, collecting, restoration, identification, documentation and presentation of digital evidence is what we call computer forensics.<br /><br /><a name="more"></a><br /><h4 style="text-align: left;">What you should know:</h4><ul style="text-align: left;"><li>Readers, for you to understand these items, you just need to have a little knowledge about the rationale behind the technique and analysis of forensic.</li><li>Knowledge of iOS.</li><li>Concepts of "Forensic Investigation".</li><li>Information about the device on which you will apply the method.</li></ul><h4 style="text-align: left;">What you will learn:</h4><ul style="text-align: left;"><li>Dear readers, you will increase your knowledge in the area of preparation and effective methods for applying forensic peripheral.</li><li>Know the best tools for iOS devices.</li><li>Standardized technique to avoid errors.</li><li>Compare software to know which is best for each case.</li><li>Learn the key concepts in a simple manner.</li><li>At the end of the reading, you will understand how to iOS forensic analysis works.</li></ul><h4 style="text-align: left;">INTRODUCTION</h4>One of the fundamental principles of forensics is the Locard Exchange Principle. According to this principle , anyone or anything that enters a crime scene, carries something of the place and leaves something behind after parting. In the virtual world of computers , the Principle of Exchange of Locard is still mostly valid: wherever the attacker has been, he leaves traces. These traces can be extremely difficult or virtually impossible to be identified and followed, but they exist. In such cases, the process of forensic analysis can become extremely complex and time consuming, requiring the development of new technologies for searching for evidence.<br /><br />Any digital information able to determine that there was an intrusion or that indicates any link between the attacker and the victim, between the invasion and the attacker, could be considered as evidence.<br />The researcher must be able to identify the evidence from the information he has previously collected.<br /><h4 style="text-align: left;">DIGITAL EVIDENCE, INTRODUCTION</h4><ul style="text-align: left;"><li>Digital evidence is information in digital format, capable of determining if a computer system has suffered a violation, or that provide a connection to the victim or with the attacker.</li><li>Evidence of this nature can be duplicated exactly.</li><li>You can verify that change with the right methods.</li><li>They are highly volatile and may be modified during the analysis if the proper precautions are not taken.</li></ul><h4 style="text-align: left;">PRINCIPLE OF EXCHANGE OF “LOCARD”</h4>Every person who goes through a crime scene leaves something of himself and takes something with him.<br /><br />Similarly, any person who commits a digital crime, leaves traces on the compromised system. The tracks can be difficult to follow, but they are still there.<br /><h4 style="text-align: left;">METHODS AND PROCEDURES STANDARDS</h4><ul style="text-align: left;"><li> Simplify the process of collecting, storing and analyzing evidence.</li><li> Minimize the panic and negative reactions in circumstances in which expertise is conducted on high levels of stress, avoiding a possible involvement of the evidence.</li><li>Contribute to the validation of the evidence collected, in a criminal prosecution</li><li> Requiring a planning phase for its correct implementation.</li></ul><h4 style="text-align: left;">METHODOLOGY FOR THE TECHNICAL INVESTIGATION</h4><ul style="text-align: left;"><li>Collection of information.</li><li>Recognition of the evidence.</li><li>Restoration, documentation and preservation of evidence found.</li><li>Correlation of the evidence.</li><li>Reconstruction of events.</li></ul><h4 style="text-align: left;">PREPARATION</h4><ul style="text-align: left;"><li>Definitions of policies to be followed and actions to be taken during the expert.</li><li>Preventive measures to avoid compromising the computer system.</li><li>Monitoring to detect incidents when they occur.</li><li>Choose the most appropriate tools for data collection and analysis evidence.</li></ul><h4 style="text-align: left;">TOP iOS Forensics</h4><ul style="text-align: left;"><li>There are other tools that help us in the task of performing a forensic analysis on iOS devices, so I will quote the best:</li><li>AccessData MPE+, iXAM, XRY, Neutrino AccessData Forensic Toolkit, iXAMiner, Lantern,iPhone Backup Analyzer, Neutrino,SecureView,SD Flash Doctor.</li></ul><h4 style="text-align: left;">TOOLS FOR IOS FORENSICS</h4>Readers, these tools are for better efficacy in forensic computer expertise. I will quote some of the most known and used analysis software and techniques for collecting digital artifacts.<br /><b><br /></b><b>Forensic Toolkit® (FTK®):</b> “Recognized around the World as the Standard in Computer Forensics Software<br />FTK is a court-accepted digital investigations platform that is built for speed, analytics and enterprise-class scalability. Known for its intuitive interface, email analysis, customizable data views and stability, FTK lays the framework for seamless expansion, so your computer forensics solution can grow with your organization’s needs”.<br /><br /><b>More information: http://www.accessdata.com/products/digital-forensics/ftk</b><br /><b><br /></b><b>“BlackLight</b> is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, iOS devices (iPhone, iPad, iPod Touch) and Windows computers. It is compatible with all leading logical and physical forensic image formats”. BlackBag Technologies<br />More: https://www.blackbagtech.com/blog/category/blacklight-forensic-software-blackbag-technologies<br /><br /><b>“Elcomsoft iOS Forensic Toolkit </b>(Enhanced Forensic Access to iPhone/iPad/iPod Devices running Apple iOS). Perform the complete forensic acquisition of user data stored in iPhone/iPad/iPod devices running any version of iOS. Elcomsoft iOS Forensic Toolkit allows eligible customers acquiring bit-to-bit images of devices’ file systems, extracting device secrets (passcodes, passwords, and encryption keys) and decrypting the file system image. Access to most information is provided instantly”.<br /><b><br /></b><b>Cellebrite: </b>“The complete solution for Apple devices running any version of iOS! The Cellebrite UFED Series allows extraction of appropriate data for forensic decryption and technical research and analysis for current and deleted data from these devices.<br />IOS devices: iPhone 2G, iPhone 3G, iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPod Touch 1G, iPod Touch 2G, iPod Touch 3G, iPod Touch 4G, iPod Touch 5G, iPad Mini, iPad 1, iPad 2, iPad3, iPad 4, others.<br /><br /><b>Different ways to perform data extraction:</b><br /><b><br /></b>Logical and file system extraction (for jailbroken devices) enabled the UFED Touch.<br />Physical extraction and file system (for locked devices) enabled the UFED Physical Analyzer”. More: http://www.elcomsoft.com/eift.html<br /><b><br /></b><b>Oxygen Forensic®</b> “<i>is a mobile forensic software that goes beyond standard logical analysis of cell phones, smartphones and tablets. Using advanced proprietary protocols permits Oxygen Forensic® Suite 2013 to extract much more data than usually extracted by logical forensic tools, especially for smartphones</i>”.<br /><br /><b>More: http://www.oxygen-forensic.com/en/</b><br /><br /><b>MPE+ Mobile Forensics</b> “Software Supports 7000+ Devices, Including iOS®, Android™ and Blackberry® Devices, as well as Devices with Chinese Chipsets.<br /><br />Mobile Forensic Examiner PLUS (R) is AccessData’s market leading stand-alone mobile forensics software solution that delivers an intuitive interface, data visualization and smart device support in a single forensic interface. MPE+ supports even the most challenging mobile device profiles and features advanced carving, deleted data recovery, SQLite database browsing and filtering options. Furthermore, MPE+® images integrate seamlessly with Forensic Toolkit ® (FTK ®) computer forensics software, allowing you to correlate evidence from multiple mobile devices with evidence from multiple computers within a single interface”.<br />More:http://www.cellebrite.com/mobileforensics?gclid=CIGazMmImL0CFWxp7AodmREAvA<br /><h4 style="text-align: left;"><b>Analysis on mobile devices</b></h4><br /><ul style="text-align: left;"><li><i>The analysis should be performed on a copy of the original data. the original data must be properly protected. The copy should be bitwise with the aim of preserving and removed files other information.</i></li><li><i>The information collected copies thereof shall be certified using cryptographic signatures.</i></li><li><i>The analysis of raw data from disk and memory is too slow. The use of tools for recovering files and dump process can streamline the analysis.</i></li><li><i> A testing environment may be prepared to assist in the procedure analysis.</i></li></ul><br /><i>The entire process should be documented.</i><br /><h4 style="text-align: left;">CONCLUSION</h4><i>Forensics on mobile devices is one of the aspects of Information Security that draws enough attention from corporations, common users and members of the scientific community. Despite the various tools available that greatly facilitate the action of the expert, the final conclusion still hangs on experience and integrity of the professional who conducted the investigation.</i><br /><i><br /></i><b>About the Author</b><br /><b><br /></b>This article has been written by Rafael Souza, who is a senior security researcher at Rhainfosec. </div>

An Introduction To iOS Forensics - Part 1

ABSTRACT It is known that with the increased use of mobile devices, cyber-crimes in these types of applications have multiplied, forensic sc...

+ Read more »

eLearnSecurity Advanced Reverse Engineering Of Software - Review

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihtpxtTtlg-zSAU7-OE6mz_exY5-4MCtyHrtVVElr913-IrVSiGzn5dcJOhp9JE-1sPLiEDJCx32c_wqPBdXylJ-_ABuxiQXhUeDyQRF8xTnMmbAwMwaBKkDIIil0ejpnZ_RXKvjlVOYg/s1600/RE_box_medium.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihtpxtTtlg-zSAU7-OE6mz_exY5-4MCtyHrtVVElr913-IrVSiGzn5dcJOhp9JE-1sPLiEDJCx32c_wqPBdXylJ-_ABuxiQXhUeDyQRF8xTnMmbAwMwaBKkDIIil0ejpnZ_RXKvjlVOYg/s1600/RE_box_medium.png" /></a>There is a saying "<b>To understand how something works, you must take it apart and unravel its secrets</b>" that's exactly what reverse engineering is all about i.e. breaking down things apart to figure out how they work from inside. If you have a keen interest in software reverse engineering and are curious on how the bad guys really go about cracking the softwares and developing keygens/patches for it, if you are interested in how security professionals go about analyzing complex malwares, then the "<b>ARES Course</b>" is for you.<br /><br />Straight from the horse's mouth,  "<i>This advanced reverse engineering training course is highly practical, meaning you will learn things by yourself and not just listen to some instructors and watch. If you like the "learning-by-doing" approach, then this is for you. This is NOT a "learn - repeat - forget" type of training. The course guidance ensures that you will get all the necessary knowledge along the way.</i>"<br /><a name="more"></a><br /><h4>Pre-requisites</h4>Before you enroll into this course, the following are the pre-requisites mentioned by the author.<br /><br /><b>1)</b> You don't need to already be a reverse engineer to attempt this course, this course takes you from a very beginner level up to an advanced level.<br /><br /><b>2) </b>Knowledge of assembly language would certainly be helpful, however the author covers important instructions along while demonstrations. In the written part, the author also provides several references assembly guiders and reference books. So, in case if you are unaware what particular assembly instruction does you can quickly look through the references.<br /><br /><b>3) </b>Basic knowledge of programming concepts (Variables, Strings, functions, pointers etc) is required, however you don't need to be a hardcore programmer to be enrolled into this course.<br /><br />The course is divided into three parts<br /><br /><b>1)</b> Foundations<br /><b>2)</b> Technical Part 1<br /><b>3)</b> Technical Part 2<br /><br /><h4>Foundations</h4>The "Foundation" part talks about the necessary theory you need to understand how understand before you dive into the technical parts. The course focuses specifically upon the intel 32 bit architecture, memory segments such as stack heap, flags, registers and popularly used windows API's and tools in the trade for reversing.<br /><br />The author points out that it's not necessary to be a<b> master at assembly language</b> in order to become a successful reverse engineer and which started making sense to me as soon as i finished the technical parts of the course, however as mentioned before the knowledge about certain programming concepts will surely be a great help for you.  Here is what the author states:<br /><br /><i>Probably, you've heard that if you want to become a reverse engineer you have to master assembly language first, which is far from truth. Of course, being a programmer, especially in not a very high level language like C/C++ can be very helpful in some concepts like points, etc.. but in regards to reversing and assembly language, what you really need is to be able to understand what you see. There's no need to write complex programs using assembly.</i><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><h4>Technical Part I - Learning how to reverse</h4>The "<b>technical part 1" </b>goes from very basic software patching up-to in depth analysis of algorithms and windows API's. The very first module of this section is  "<b>String References & Basic Patching</b>", in this module the authors explains several methods of patching an executable such as manipulating, noping out the jumps etc to change the program flow. The next module focuses on using the "<b>Stack</b>" for tracing back algorithm, this comes handy when we are up against a binary, where the strings are encrypted and decrypted on the runtime and therefore we are unable to locate the algorithm with static analysis.<br /><br />In the next module "<b>Algorithm Reversing</b>" the author digs deeper into the world of reverse engineering by analyzing the algorithms in detail to find a solution that would really validate the given algorithm and this is where the real fun starts. The next module, "<b>Windows Registry Manipulation</b>" is more related to reversing malware rather than cracking softwares, the author analyses an application that is trying to read specific piece of information from the registry, in this module the author also explains the use of "<b>Hardware breakpoints</b>" for monitoring access into specific memory areas. In the next module "<b>File Manipulation</b>", the author dives into more practical reverse engineering methods, where he examines an application that is trying to read contents of a specific file inside the system.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5nGOjsWayiEGwUUlbxe0vIEITPgWOIjFQ5nW9TzahrQh21p1voLWhhgqaF0Ztfsa0cBCPCWhg2_HdJuraq19hpir5RKUSMjRhUjU3iEwJPzAvDikLMV8jaauESI5ilq2Kv_8z8Cixq-M/s1600/intro_1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5nGOjsWayiEGwUUlbxe0vIEITPgWOIjFQ5nW9TzahrQh21p1voLWhhgqaF0Ztfsa0cBCPCWhg2_HdJuraq19hpir5RKUSMjRhUjU3iEwJPzAvDikLMV8jaauESI5ilq2Kv_8z8Cixq-M/s1600/intro_1.png" /></a></div><br /><h4>Technical Part II - Anti-reversing tricks</h4>In real world, the binary analysis is not as easy as you might think, you might encounter different obstacles and protections when doing professional reverse engineering. Developers have came up with several tricks for making the binary analysis process much harder by using anti-debugging api's, code obfuscation, packers etc.<br /><br />The modules gives insights into bypassing most commonly used anti-reversing tricks such as bypassing anti-debugging mechanisms, de-obfuscating code obfuscation and the process of manually unpacking a binary. Last but not least, the author explains about reversing multi-threaded applications, the author points out that analyzing these applications can be bit tricky for beginners, however after understanding the concepts of creations of multi-threads on run-time, this process becomes much more easy.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgJgrsNoXkCkznUUhNt-xz_jo4ioLcILb0oZ5sV81M4bz-zb607V50v6x69hTFAKpj3belsYrs09nL_U9dJ6YSZfSjqJRiYXNxE_8Cp1R6EqGi2yQoOFKJpAnQXouD6bQ1HgQCsyXOiH4/s1600/intro_2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgJgrsNoXkCkznUUhNt-xz_jo4ioLcILb0oZ5sV81M4bz-zb607V50v6x69hTFAKpj3belsYrs09nL_U9dJ6YSZfSjqJRiYXNxE_8Cp1R6EqGi2yQoOFKJpAnQXouD6bQ1HgQCsyXOiH4/s1600/intro_2.png" /></a></div><br /><h4>Challenges</h4>Each module comes with a unique challenge which contains a binary which would allow you to practically perform the techniques you have learnt in the video section of the course. In case if you are unable to solve it, just don't panic, in the video parts the author walks you through solving the challenge.<br /><br /><h4>Exam And Certification</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFGsceDPgqaUmEcE49LPQjuBsLATfeJNTQUSpqitviB-2qFcm1dwgNebLDFVRXuizHeg23333t7S5rnkd26EOxqtjt-R1SfPL-EW6Vu4ILsAPZabqp8LSy5_e3U-ZNCD9fGgx_s6bv3BU/s1600/eRE_certificate.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFGsceDPgqaUmEcE49LPQjuBsLATfeJNTQUSpqitviB-2qFcm1dwgNebLDFVRXuizHeg23333t7S5rnkd26EOxqtjt-R1SfPL-EW6Vu4ILsAPZabqp8LSy5_e3U-ZNCD9fGgx_s6bv3BU/s1600/eRE_certificate.png" /></a></div><b><br /></b>Once you have mastered all the techniques taught in the course, you can appear in the eCRE examination, the exam is divided in to two different parts i.e. theory and practical. You must score at-least 88% in theory part which is a multiple choice question and answers.<br /><br /> Once you have passed the <b>eCRE Stage 1 (Theory part)</b> you would be allowed to attempt the eCRE Stage 2 in which you dive in to the practical part of the examination, you would be given binaries and would have 7 days to analyse them and write a formal report about it. A examiner will formally analyse your report and if you pass you are titled as "<b>eLearnSecurity Certified Reverse Engineer</b>"<br /><h4>Launch Webinar</h4>If you would like to see this course in action, I would recommend you to take a look at the launch webinar, in which the author shows live demonstration of analysing obfuscated binary.<br /><iframe allowfullscreen="" autoplay="false" frameborder="0" height="400" mozallowfullscreen="" scrolling="no" src="https://www.elearnsecurity.com/collateral/webinar/ares/ares2_player.html" webkitallowfullscreen="" width="577"></iframe><br /><br /><h4>Conclusion</h4><br />If you are passionate about reverse engineering or have a dream persuading your career as a reverse engineer, then this course is definitely for you. Overall, I would rate the course to be <b>9/10 </b>as this one of the most technical and informative courses I have ever taken.<br /><b><br /></b><b>For further information about the course, Please refer the following link - <a href="https://www.elearnsecurity.com/course/advanced_reverse_engineering_of_software/" rel="nofollow" target="_blank">https://www.elearnsecurity.com/course/advanced_reverse_engineering_of_software/</a></b></div>

eLearnSecurity Advanced Reverse Engineering Of Software - Review

There is a saying " To understand how something works, you must take it apart and unravel its secrets " that's exactly what re...

+ Read more »

What is the .htaccess file and what do I use it for?

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdCLU3N9Pfzff7I1IfhFXGZu11ZH0KB9SSAnxnCbIssBxavT83f_mMOc6S92A6CQslV7Jnbmm1QnbVZcEOZHWegIESHLn3prXspee3CdPRV3_ZKNmhr_VkbENOces04V_-qwlZVmf5uvM/s1600/htaccess.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdCLU3N9Pfzff7I1IfhFXGZu11ZH0KB9SSAnxnCbIssBxavT83f_mMOc6S92A6CQslV7Jnbmm1QnbVZcEOZHWegIESHLn3prXspee3CdPRV3_ZKNmhr_VkbENOces04V_-qwlZVmf5uvM/s1600/htaccess.jpg" width="577" /></a></div><br />.htaccess - The Point of Discussion<b>HT(Hyper Text) access </b>file is actually a directory level configuration file which supports handsome number of servers and those webservers allow administrators for decentralized management of Web Server Configuration. The original purpose of .htaccess ” is reflected inside its name was to allow per-directory access control, for example: requiring a password to access the a directory or file. Nowadays it is used for various other purposes, as .htaccess files can override many other configuration settings including content type and character set, CGI handlers, etc it could very useful for penetration testers as well as webmasters.<br /><a name="more"></a><br /><h3 style="text-align: left;">Why .htaccess??</h3>The WebServer reads these files every time when the website is loaded. So the changes to the .htaccess file can immediately effect the Server with respect to main Configuration file of server. .htaccess can also be used to authorization/authentication i.e. permitting or denying a user to access a certain content.<br /><b><br /></b><br /><h4>1.Authorization & Authentication</h4><br />A .htaccess file is often used  for both authentication and authorization i.e. to specify security restrictions for a certain resource. The .htaccess file is often accompanied by a <strong>.htpassword </strong>file which stores valid usernames and their passwords for authentication purposes. We will see examples of both of them (Authorization and Authentication) in later part of this article.<br /><h4 style="text-align: left;"><b>2.Rewriting Urls</b></h4>Rewriting is sometimes used as conditional operator to add filter to block a specific word or string in a statement.<br /><h4 style="text-align: left;"><b>3.SSI</b></h4>SSI can be actually helpful to maintain a website dynamically using input parameters specified by the administrators. SSI directories can be defined within the .htaccess itself.<br /><h4 style="text-align: left;"><b>4.Customizing the Error Responses</b></h4><br />A .htaccess file can also be used to customize error messages. For example -  What to do if a 404 error occur?, Shall it be redirected to the homepage?, we can also control other things such as Mime types, cache control etc.<br /><h3 style="text-align: left;">Where .htaccess Should Be Placed?</h3>So, we have already discussed about various uses of  .htaccess, now its time to know where .htaccess file should be placed for optimal performance. .htaccess should be placed inside root web directory of the webserver,  so that it could have same effect on all the content within the website but sometimes, it could be placed in a specific directory to perform a task.<br /><br /><b>For example </b>- <i>A hosting company has described the maximum upload limit of 100mb per image, however in case if one of the customers wanted to upload a picture that is of 110mb what should he do?, He would contact the hosting company ofcourse, now instead of allowing the upload of 110mb from the server for all users, the company would ask the user to place a .htaccess file inside the directory and set the upload limit to 110mb.</i><br /><br /><b>Note:This files needs to handled with utmost care because of its sensitiveness. Even a single mistake can lead you to some serious security concerns, So if you don't know what you are doing, we would recommend not to play with it.</b><br /><b><br /></b><b>Advantages</b><br /><br />One of the main advantages of a .htaccess file is that the changes made to this file would take immediate effect on the webserver as opposed to making changes in the main configuration file which often requires the server to be restarted and hence a downtime might occur.  Also, as we explained from the above example that .htaccess allows unprivileged user to perform a privileged action without need to change the main configuration file.<br /><br /><b>Disadvantages</b><br /><br />There are two main disadvantages of .htaccess, one it creates performance loss, second it raises security concerns as you are allowing an unprivileged users to modify the configuration changes. For example - System administrator has disabled the use of the "Symbolic links", however the overrides are allowed, in case if an attacker compromises a single website on the server, he could create a custom .htaccess which would allow symlinks if they are not enabled by default and hence it would allow an attacker to read files outside the user's home directory. The folllowing .htaccess file would allow an attacker to enable and follow symlinks:<br /><br /><blockquote class="tr_bq"><b>OPTIONS  Indexes Includes ExecCGI FollowSymLinks</b><b>AddHandler txt .php</b><b>AddHandler cgi-script .cgi</b><b>AddHandler cgi-script .pl</b><b>OPTIONS  Indexes Includes ExecCGI FollowSymLinks</b><b>Options Indexes FollowSymLinks</b><b>AddType txt .php</b><b>AddType text/html .shtml</b><b>Options All</b><b>Options All</b></blockquote><br />As regards with the performance impact, guys at drupal groups have provided a great explanation. "Here are some excerpts from Wrox's 'Professional Apache' in the chapter on improving Apache's performance:"<br /><br /><i>"If AllowOverride is set to anything other than 'None', Apache will check for directives in .htaccess files for each directory from the root all the way down to the directory in which the requested resource resides, after aliasing has been taken into account. This can be extremely time consuming since Apache does this check every time a URL is requested, so unless absolutely needed, always (set AllowOverride to 'None')</i>"<br /><br /><b>Source - https://groups.drupal.org/node/22864</b><br /><h3 style="text-align: left;">How .htaccess can help in improving security? </h3><b>Preventing Common Attacks (But not fully). </b>.htacess can be used to define a blacklist of keywords that you would like to block when it arrives the server. Take a look at the following example<br /><br /><b>"RewriteEngine on"</b> is responsible for starting the filtering process followed by the specific keyword word you would like to block, which in this case is "<b>order".</b> In this way .htaccess can be used to create a blacklist to filter out malicious inputs for attacks such as SQLi, XSS, LFI, RFI etc. However, <b>this approach is not recommended as blacklist has never been the solution for any security related problem</b>, instead the best option is to fix the vulnerabilities from within the code, the vulnerabilities can be detected via static or dynamic code analysis.<br /><br /><br />The following screenshots give examples on creating a blacklist with the help of .htaccess:<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHQ_vtyRayq11bi1fOyl9sBWzoTrA-0yW9mv1F_2sc7V2rBmVYC05-FN62mwnOFa44lBQlC5KFZ833UMrlouBsdleamaw62xGVPpGlmoM4L1eBeV36dhyphenhyphenPOVtzfLEsv6WwQW4miPlhUyY/s1600/1.JPG" imageanchor="1" style="clear: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHQ_vtyRayq11bi1fOyl9sBWzoTrA-0yW9mv1F_2sc7V2rBmVYC05-FN62mwnOFa44lBQlC5KFZ833UMrlouBsdleamaw62xGVPpGlmoM4L1eBeV36dhyphenhyphenPOVtzfLEsv6WwQW4miPlhUyY/s1600/1.JPG" width="400" /></a><br /><br /> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKm3ri5YK0Z8jLUKO-R2yPvfEMyxhyphenhyphenIH4OA6MOgZ_7dY7s2ew_NqEZWLZXQnNJd8U5a8bjg_aj4fAVoBjY8bAQbzNiqy_ze31CBTvTK7ZczRdJMlrFDCkA2E3APx0uqTt9FTCvxuMMR8k/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKm3ri5YK0Z8jLUKO-R2yPvfEMyxhyphenhyphenIH4OA6MOgZ_7dY7s2ew_NqEZWLZXQnNJd8U5a8bjg_aj4fAVoBjY8bAQbzNiqy_ze31CBTvTK7ZczRdJMlrFDCkA2E3APx0uqTt9FTCvxuMMR8k/s1600/2.JPG" /></a><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><h4 align=left>Authorization</h4> As discussed before .htaccess could be very helpful for "Authorization" i.e. we can define who is authorized to access the content, in simpler words we can permit or deny a specific Person(s) based upon his IP address .<br /><br />All we have to do is to simply use allow and deny keywords with in the .htaccess. This feature could be used as a security for admins to only allow their IP to access the administrator page .<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtWljMBOuKw7VzJv4hsongS6mirJINjwOJV7DQzM10sOqf7ZY-RiLK8IFRk8Tauu8AMZblYE5f6ktAwkVCwzqgY7Ny3OUUPhEz10hOUGsKdmDFvFm4-liPAmzfCoLYzTYurhs6aqsvNSk/s1600/3.JPG" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtWljMBOuKw7VzJv4hsongS6mirJINjwOJV7DQzM10sOqf7ZY-RiLK8IFRk8Tauu8AMZblYE5f6ktAwkVCwzqgY7Ny3OUUPhEz10hOUGsKdmDFvFm4-liPAmzfCoLYzTYurhs6aqsvNSk/s1600/3.JPG" width="400" /></a></div><h4>Authentication</h4>.htaccess can also be used to password protect a directory, for that we would also need an .htpasswd file. A .htpasswd contains the username and password for basic authentication of users. The following is a great website that could be used to generate .htpasswd files:<br /><br /><ul style="text-align: left;"><li><b>http://www.htaccesstools.com/htpasswd-generator/</b></li></ul><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwnj-ReNhRIjCpfX-vf14k2T4yh6sZSfxTNQuoFzDQlHSTvWyiQcZ_yTcKgOOcNquXBB0Rg1gU7S7vNQA5qYut6Vf0hyWkMMrxdPdCzFVVjAxyplZH2dtqMCuvrujwtOMRrdWCCOUERD0/s1600/htpass.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="258" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwnj-ReNhRIjCpfX-vf14k2T4yh6sZSfxTNQuoFzDQlHSTvWyiQcZ_yTcKgOOcNquXBB0Rg1gU7S7vNQA5qYut6Vf0hyWkMMrxdPdCzFVVjAxyplZH2dtqMCuvrujwtOMRrdWCCOUERD0/s1600/htpass.png" width="577" /></a></div>The Protected content could be accessed as follows: <b>http://username:password@www.website.com/directory/</b><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6hn4dau6GXGaMzT0FxTpoX3lm4BG9MYXhTsgKbr6UWxp0JpnSsL2AhrklpLxGRT5Y-jo_8evZwoRiZKGhWJrGGtmrpuNnnR1V48bEeA58N7HDO-LqviH4VZ-p_lkd8gI6SKUYBEzkm9Q/s1600/4.JPG" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6hn4dau6GXGaMzT0FxTpoX3lm4BG9MYXhTsgKbr6UWxp0JpnSsL2AhrklpLxGRT5Y-jo_8evZwoRiZKGhWJrGGtmrpuNnnR1V48bEeA58N7HDO-LqviH4VZ-p_lkd8gI6SKUYBEzkm9Q/s1600/4.JPG" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>The following screenshot demonstrates the usage of .htaccess by etsy.com to protect wp-admin page for wordpress.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisj7rGzydMAU_WgEDBkAAVUDsyAXcfmgxRooOaaspRTh9h_zB1zt-Tx2pi-BMmdNtbRBd2MzwQZyKXVtZ5Wf1vYVq0CYCCe4bHVJkl6Q9oRm0Nh8umkcNbfyGrad80uOeyQK6tZ_H5lcc/s1600/ht.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisj7rGzydMAU_WgEDBkAAVUDsyAXcfmgxRooOaaspRTh9h_zB1zt-Tx2pi-BMmdNtbRBd2MzwQZyKXVtZ5Wf1vYVq0CYCCe4bHVJkl6Q9oRm0Nh8umkcNbfyGrad80uOeyQK6tZ_H5lcc/s1600/ht.png" width="577" /></a></div><br /><h4>Hiding Errors</h4>This approach is also not recommended and it's called as security through obsecurity, which means that if an attacker cannot find something he is less likely to exploit it.  The idea behind this technique is to turn of php errors, which would not return errors for common vulnerabilities such as SQLi, FPD, LFI etc. However, this approach would only prevent script kiddies not real penetration testers.<br /><br /><b>Switches Used while working with Php Flag are : php_flag display_errors no/yes [on/off]</b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgGQsEBC205yHaJI9tO2S3x0o1aZEW9NbUUzrX9DhIocKN7S8-mIhzOrFnuKJCcl72ZjDtGfnqWbqU23C9dOIpCtzx42AomKsoLWwQRNjic1GkA-R_p12bXYhbsPDrooL7QuubMoW-raE/s1600/5.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgGQsEBC205yHaJI9tO2S3x0o1aZEW9NbUUzrX9DhIocKN7S8-mIhzOrFnuKJCcl72ZjDtGfnqWbqU23C9dOIpCtzx42AomKsoLWwQRNjic1GkA-R_p12bXYhbsPDrooL7QuubMoW-raE/s1600/5.JPG" /></a></div></br></br></br></br></br></br></br></br></br>Last but not least, we would recommend following video, in case you are really interested in learning more about this topic.<br /><video poster="" preload="" src="http://pdl.vimeocdn.com/19237/249/230532508.mp4?token2=1397589341_8f3506df33698becd3a74dea21c5ce05&aksessionid=0f55b06d300b51ba" width="577" x-webkit-airplay="allow"></video> <br /><h4>Conclusion</h4> In this article, we precisely tried to cover various aspects of the .htaccess file, however this topic is far from over, based upon your comments and feedback we might come up with it's part 2.<br /><h3 style="text-align: left;">About Author</h3>This article was original written by <b>Muhammad Adeel (independent Security researcher), however it was later modified by "<a href="http://rafayhackingarticles.net">Rafay Baloch</a>" to make it more clear and understandable.</b></div>

What is the .htaccess file and what do I use it for?

.htaccess - The Point of Discussion HT(Hyper Text) access file is actually a directory level configuration file which supports handsome numb...

+ Read more »

DOM XSS Explained - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: center;">         <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" width="370" /></a></div><br />Cross Site scripting (XSS) has been a problem for well over a decade now, XSS just like other well known security issues such as SQL, XPATH, LDAP Injection etc fells inside the category of input validation attacks. An xss vulnerability occurs when an input taken from the user is not filtered/santized before it's returned back to the user. The XSS can be divided into the following three categories:<br /><br /><a name="more"></a><br /><br /><b>1) Reflected XSS</b><br /><b>2) Stored XSS </b><br /><b>3) DOM Based XSS </b><br /><br />As time has passed by the security community has came up with lots of solutions to mitigate XSS attacks such as encoding libraries, Web Application filters based upon blacklists, Browser based XSS filters, Content security policy etc, however all of them have had some limitation either not being able to mitigate xss attacks in a certain context. For example - We have a well known PHP based protection library called HTML purifier, it offers great protection against XSS attacks in lots of different context, however currently it has no support for HTML 5, talking about content security policy which dubbed as the best solution for mitigating xss attacks has no support for inline JS as well as no support for mobile browsers.<br /><br />However, traditional XSS has been mitigated to some extent where the input is sent to the server and when is returned without any sanitation. However what happens in case where the user input is never sent to the server side and get's executed on the client side?. In that case all the server side defenses would fail as the payload never arrives the server. This is what is referred as DOM based XSS when the payload is never sent to the server and is executed on the client side, in order to understand DOM based XSS better, we would need to understand, what's DOM.<br /><h4 style="text-align: left;">What is DOM?    </h4>DOM stands for document object model and all it is a javascript's way of accessing page. Each and every HTML element has a correspoding entity inside of DOM.<br /><h4 style="text-align: left;">What is DOM Based XSS? </h4>A DOM based XSS vulnerability occurs when a source get's executed as a sink without any sanitization. A source is commonly refered as any thing that takes input, which apparentely in javascript is "Everything taken from a URL". Common sources inside javascript are document.url, location.hash, location.href, document.referer. A more detailed list is available at the DOM based XSS Wiki.<br /><br />A sink is refered to anything that creates HTML in an insecure way. There are wide variety of different sinks depending upon the javascript libraray you use. For example: In javascript document.write, innerHTML, eval are the most commonly found sinks, where as in jquery we have .html(), .appendto() etc. We can find a list of commonly used sinks at DOM based XSS wiki.<br /><h4 style="text-align: left;">How to find DOM Based XSS?</h4>There are couple of different approaches to detecting DOM based XSS such as black box fuzzing, static analysis and Dynamic analysis. We will discuss all three of them.<br /><br /><b>Black Box Fuzzing</b><br /><br />In black box fuzzing approach, we try injecting different XSS vectors inside different javascript sources and hoping for  javascript to be executed. A tool called Ra-2 is an example of blackbox fuzzing approach towards DOM based XSS. The Fundamental problem with this approach is that it's not context aware and contains several false negatives.<br /><br /><b>Static Analysis</b><br /><br />Another approach is to detecting DOM based XSS is by performing a static source code analysis, where by we try finding out the sources/sinks and we trace if a source is being executed as a sink.DOM based XSS wiki contains a list of regular expressions which would help you find out the sources/sinks:<br /><br />The following regular expressions would help you determine all the sources and sinks in a javascript file:<br /><br /><h4 style="text-align: left;">Finding Sources: </h4><br />/(location\s*[\[.])|([.\[]\s*["']?\s*(arguments|dialogArguments|innerHTML|write(ln)?|open(Dialog)?|showModalDialog|<br />cookie|URL|documentURI|baseURI|referrer|name|opener|parent|top|content|self|frames)\W)|(localStorage|sessionStorage|<br />Database)/<br /><br /><h4 style="text-align: left;">Finding Javascript Sinks:</h4><br />/((src|href|data|location|code|value|action)\s*["'\]]*\s*\+?\s*=)|((replace|assign|navigate|getResponseHeader|open<br /><br />(Dialog)?|showModalDialog|eval|evaluate|execCommand|execScript|setTimeout|setInterval)\s*["'\]]*\s*\()/<br /><br /><b>Finding Jquery based sinks</b><br /><br />/after\(|\.append\(|\.before\(|\.html\(|\.prepend\(|\.replaceWith\(|\.wrap\(|\.wrapAll\(|\$\(|\.globalEval\(|\.add\(|<br /><br />jQUery\(|\$\(|\.parseHTML\(/<br /><br /><br /><b>JSprime</b> and <b>IBM appscan </b>apply this particular approach to detecting DOM based XSS. The fundamental problem with this approach is that javascript code may be compressed, packed or Obfuscated, in that scenario Static analysis won't help us. Also in case where the code is encoded and is decsoded and executed at runtime a static code analyzer won't be able to detect it. An example of this would be the following statement:<br /><br /><b>eval('var a'+'=loc'+'ation'+'.hash');</b><br /><br />The strings would are spilitted and would be joined together in memory at runtime and would be executed by using the eval function.<br /><h4 style="text-align: left;">Dynamic Analysis </h4>As mentioned above, a static code analyzer won't be able to detect obfuscated and code which would execute at the run-time. In that case, we have another approach called as Dynamic taint tracking. The taint flag is added to the source and it's tracked until it is executed via a source at run-time. Dominator is currently the only tool in the market that utilizes this methodology, however there are several places where dominator is not effective<br /><br /><b>1)</b> Human interaction is necessary for the analysis to be performed.<br /><b>2)</b> If a human misses to test a feature dominator would also miss.<br /><b>3) </b>A better dynamic taint tracking is required.<br /><br />Let's now talk about few examples:<br /><br /><b>Example:</b><br /><br /><HTML><br /><TITLE>Welcome!</TITLE><br />Hi<br /><SCRIPT><br />var pos=document.URL.indexOf("name=")+5;<br />document.write(document.URL.substring(pos,document.URL.length));<br /></SCRIPT><br /><BR><br />Welcome to our system<br />…<br /></HTML><br /><br />The following code is taken from Amiet klien's paper on "DOM based XSS", In the above script we see a javascript source <b>document.url </b>that takes input from a url, The indexof property searches for the name parameter inside the url and is saved into the "pos" variable, later the user input stored inside the pos variable is being directly written to the DOM without any sanitization.<br /><br />By inserting the following payload, javascript would be executed and hence would finalize the DOM based XSS attack:<br /><br /><b>http://www.target.com/page?name=<script>alert(1);</script></b><br /><br />In the above case one might argue that the payload would be sent to the server in initial requests, but in the following scenario where we specify a hash before the name variable, the payload would not be sent to the server.<br /><b><br /></b><b>http://www.target.com/page?#name=<script>alert(1);</script></b><br /><br />Let's take a look at another example:<br /><br /><html><br /><body><br /><h2>POC for settimeout DOMXSS</h2><br /><body><br /><script><br />var i=location.hash.split('#')[1];<br />(function () {<br />setTimeout(i,3000);<br />})();<br /></script><br /></body><br /></html><br /><br />In this case, the source is location.hash, the split function is used which would split up everything after hash, the user input is being stored under variable "i" which is later executed via setTimeout() function which is a known javascript sink.<br /><br />The following would trigger an alert after three seconds:<br /><br /><b>http://www.target.com/page.html#alert(1)</b><br /><br /><b>Example 3 </b><br /><br /><script><br />var redir = location.hash.split("#")[1];<br />x = document.getElementById('anchor');<br />x.setAttribute('href',redir);<br /></script><br /><br />The following is another very simple example of DOM based XSS, the input is taken from location.hash and is stored inside redir variable. Next, we use getElementByID method to  search for anchor element with id "<b>anchor</b>". next the value of redir is assigned to the href attribute via the setAttribute API. The sink in this case is the href. You may try replacing href with src and it would still result in the javascript being executed.<br /><h4 style="text-align: left;">Cross Browser Detection</h4>Some browsers encode special characters when taken from a particular before displaying it back to the DOM and due to this reason a DOM based XSS vulnerability might trigger in one browser, but does not trigger in another browser. For example: Firefox encodes every thing sent after ?, where as internet explorer doesn't. A list of these characters is already compiled up on DOM based XSS wiki.  Consider, Spending some time reviewing it.<br /><ul style="text-align: left;"><li><a href="https://code.google.com/p/domxsswiki/wiki/LocationSources" rel="nofollow" target="_blank">https://code.google.com/p/domxsswiki/wiki/LocationSources</a></li></ul><br /><h4 style="text-align: left;">Defending Against DOM Based XSS</h4>The following steps shall be taken to mitigate DOM based XSS attacks<br /><br /><b>1) </b>Unsafe sinks shall not be used. They shall be replaced with safe methods. For example: innerHTML is classified as a dangerous sink, however innertext could be used in place of innerHTML, which is a safe DOM method. Similarly in jquery, .html() (equivalent to innerHTMLof javascript) is classified as a dangerous method, alternatively we have .text() method to safely write things to the DOM.<br /><br /><b>2) </b>As there are several different javascript libraries, community should make effort in classifying all the dangerous sinks in that particular libraray and introduce safe methods<br /><br /><br />This concludes the introductory post on DOM based XSS, Stay tuned for the part 2. </div>

DOM XSS Explained - Part 1

          Cross Site scripting (XSS) has been a problem for well over a decade now, XSS just like other well known security issues such as S...

+ Read more »

Hacker's Dome - First Blood CTF

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhaIQZEqdjFlCJ0zWQCeGLI_m4ODTId1fIoSz19AsvAT0IDXHOSIdsrOsxyu7_BPQzyE2FD00Y3fuNzk0Rh26l80wTs42Vkg5fL4-PcDZlZfrSm_8hTVakF5bDEWo8U4DKfGonQ8x8Rr4/s1600/Untitled-1+copy.jpg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="417" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhaIQZEqdjFlCJ0zWQCeGLI_m4ODTId1fIoSz19AsvAT0IDXHOSIdsrOsxyu7_BPQzyE2FD00Y3fuNzk0Rh26l80wTs42Vkg5fL4-PcDZlZfrSm_8hTVakF5bDEWo8U4DKfGonQ8x8Rr4/s1600/Untitled-1+copy.jpg" width="577" /></a><br /><br />When it comes to Information Security, there's a great way to learn, train and keep sharp your skills. This can be done using gamification mechanics to speed up the learning curve and improve retention rate. Capture The Flag competitions use gamification mechanics and represent one of the best ways to learn security hands on.<br /><a name="more"></a><br />We've created Hacker's Dome as a place for CTF365  users to play weekend CTFs with great prizes. In order to get access to Hacker's Dome, the first thing you need is a registered and confirmed CTF365 account.<br /><br />Although we're at the start of our journey, the goal of Hacker's Dome is to become your weekend security training - where fun, entertainment and awesome prizes will be at its best.<br /><br />Hacker's Dome is a CTF Platform where you can deploy your own CTF and invite web developers, system administrators and security professionals to take your challenges. Think RackSpace, of CTF Competitions.<br /><br />We design the challenges with public vulnerabilities or known misconfigurations. Most of them can be found on exploit-db.com or other public sources. We don’t target 0-day vulnerabilities, so you won’t have to disclose your knowledge about arcane methods for getting access to a machine. We use Kali and the basic tools for the purpose of demonstrating the concept of a CTF challenge when we discuss the technical aspects of a competition.<br /><br /><h3 style="text-align: left;">Hacker's Dome - First Blood</h3>First Blood is our first CTF and will start on May 17 2014 15:00 UTC.<br /><b><br /></b><b>Difficulty Grade: Beginners/Intermediate</b><br /><h3 style="text-align: left;">The Prizes:</h3>We have awesome prizes packages worth > $ 6000 US<br /><br /><b>First Place Package:</b><br /><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Ultra Bundle (because you love to hack)</li><li>One year CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><br /><b>Second Place Package:</b><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Tactical Bundle (because you love to hack)</li><li>6 Months CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><br /><b>Third Place Package:</b><br /><br /><ul style="text-align: left;"><li>WiFi Pineapple Mark V Travel Bundle (because you love to hack)</li><li>3 Months CTF365 Premium Access (because you love to train your skills)</li><li>Personalized T-shirt and Hat with your CodeName on it. (because you deserve to show off)</li><li>"Hacker's Dome" + "Hacker's Dome - First Blood" stickers</li></ul><h3 style="text-align: left;">The Raffle</h3>Yes! We have a raffle with a King Prize thanks to Rapid7 - Metasploit guys.<br /><br /><b>Raffle King Prize - Full Year Metasploit Pro Licence</b><br /><br />The fact that Metasploit gave us the opportunity to run a raffle off such great King Prize, makes us proud of what we've done and it encourages us to keep up our good work.<br /><br />Interested candidates - <b><a href="http://hackerdome.com/" rel="nofollow" target="_blank">Click here</a></b> to register.<br /><br /><a href="https://fbcdn-sphotos-b-a.akamaihd.net/hphotos-ak-prn1/t1.0-9/67786_559794774046636_1802551511_n.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="125" src="https://fbcdn-sphotos-b-a.akamaihd.net/hphotos-ak-prn1/t1.0-9/67786_559794774046636_1802551511_n.jpg" width="125" /></a><b>About Author - Marius Corici</b><br /><b><br /></b>Serial entrepreneur, in love with Artificial Intelligence. Never a quitter, always a perfectionist, looking for challenges that will change the world we live in. I believe in people and great teams and I do hate that I don’t manage to grab some time to start blogging.</div>

Hacker's Dome - First Blood CTF

When it comes to Information Security, there's a great way to learn, train and keep sharp your skills. This can be done using gamificati...

+ Read more »

A Tale Of A DOM Based XSS In Paypal

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" width="370" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Introduction </h4><div class="separator" style="clear: both; text-align: left;">We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Based XSS vulnerability i found long time back inside paypal. A DOM Based xss vulnerability also known as the third type of XSS vulnerability or type 0. This vulnerability occurs due to the fact that developers don't sanitize the input before it reaches a sink. A Sink is defined as anything that generates HTML, not every sink is considered as dangerous, however there are some common sinks that should be avoided and are mentioned at DOM Based XSS wiki .</div><div class="separator" style="clear: both; text-align: left;"></div><a name="more"></a><br /><h4>Current Situation </h4><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The situation with DOM Based xss is getting worse now a days, not only because of dynamic JS libraries such as YUI, Jquery, Jquery mobile etc, but also with programming languages such as PHP that are more natively supporting HTML 5 features. One of the aspects of a DOM Based XSS vulnerability that i discovered was with tracking scripts such as Eloqua, Sitestat, Omniture, etc as they often introduce dangerous sinks. Examples are<a href="http://www.rafayhackingarticles.net/2013/03/dom-based-xss-in-microsoft.html"> here</a> and <a href="http://www.rafayhackingarticles.net/2013/02/dom-based-xss-in-avg.html">here</a>. The same is the case with sharing buttons such as google plus, addthis etc. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>A Vulnerable Example from W3schools </h4><div class="separator" style="clear: both; text-align: left;">The worsed part about DOM Based xss apart from it's complexity is the fact that lots of learning references and guides teach developers to code things in an insecure way i.e. in a way that would introduce vulnerabilities automatically. The following screenshot is taken from the jquery learning section of w3schools. The website needs no introduction, it is the most commonly referred websites for beginners to learn various programming language.</div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">The code uses the html() function inside of jquery to output html, however the problem is that html() is not a safe jquery function and is represented as a dangerous sink as per <a href="https://code.google.com/p/domxsswiki/wiki/jQuery" rel="nofollow" target="_blank">DOM Based XSS Wiki</a>. In case, where a user controlled input outputted through html() sink without sanitization would lead to a DOM Based xss. The html() function inside of jquery is the equivalent to the innerHTML function inside of javascript. The fundamental problem is that the developers are not advised to use a safe function. Therefore, in my opinion w3schools shall be renamed to w3fools. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>The Tale Of Paypal DOM Based XSS</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The <b>financing.paypal.com</b> subdomain was a subject of DOM Based xss vulnerability. The subdomain had a feature which triggered my interest, which allowed the users to create ad units of different sizes. The size of the ad was being handled on the client side with the help of jquery.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>https://financing.paypal.com/ppfinportal/adGenerator/webCopy?460 * 80</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The above input would display "<b>460 * 80</b>" in front of the Selected Size Option, Changing the text with our own input would result in the same text being outputted on to the screen. This means that our input that is taken from a source is being passed through a sink to be displayed upon the screen. So, what happens if we change the input with our XSS payload, for example - <b><svg/onload=prompt(1)>.</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy?</span><b><svg/onload=prompt(1)></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="370" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Unfortunately, the results were returned URL encoded. Now there could be two possibilities, whether the javascript is encoding our input before rendering it on the screen or it's a general browser behaviour. Turns out that Google Chrome and Firefox browsers encode everything sent after ?, but what about Internet explorer?, Internet explorer returns the characters as URL unencoded and therefore, we inside of internet explorer we are able to render our javascript. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">With that being said, as per DOM Based XSS wiki google chrome does not encode certain characters when passed after a hash. Therefore, we could add an additional hash after the ? mark to get our payload executed. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b></div><div class="separator" style="clear: both; text-align: left;"><b><span style="color: red;"><br /></span></b></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerable Code</h4><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">With some debugging i was able to determine the exact cause of the vulnerability. The following screenshot highlights the line of code that was responsible for the cause of this vulnerability. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="375" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" width="577" /></a></div><br />The line 517 represents the source being <b>document.url,</b> a split function is called which splits everything being sent after the ? mark and saves it inside a variable called <b>url</b>.<br /><br /><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b><br /><div class="separator" style="clear: both; text-align: left;">The split function would return <b><svg/onload=prompt(1)> </b>from the url and then is saved inside a variable called <b>url.</b> Next inside the <b>521 line </b>we can see that html() function is used to output url variable, which in this case contains our xss paylaod. The payload would be outputted to the screen and hence would execute the javascript for us. </div><div class="separator" style="clear: both; text-align: left;"><h4>Conclusion</h4></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">DOM Based XSS are growing and would continue to grow as more and more people would start using dynamic javascript libraries and as more people more towards server side javascript i.e. node js, the impact would be much more high. This article demonstrates the importance of sanitizing the user supplied input not only on the server side but also on the client side. </div><div class="separator" style="clear: both; text-align: left;"><br /></div>Pass the comments!. </div>

A Tale Of A DOM Based XSS In Paypal

Introduction  We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Base...

+ Read more »