FireKeeper: Firefox acts like an IDS June 30, 2008
Posted by y2h4ck in Uncategorized.Tags: browser attacks, Ethical Hacking, firefox addons, firefox hacking, firefox ids, firefox plugin, firefox security, firekeeper, Pentest, y2h4ck
add a comment
FireKeeper é um Intrusion Detection and Prevention System para Firefox. Ele consegue detector, bloquear e avisar o usuário sobre sites maliciosos. Firekeeper utiliza regras flexíveis muito similares as do Snort para descrever tentativas de ataques à Browsers.
As regras podem facilmente serem modificadas para filtrar diferentes tipos de conteúdo não desejado.
É uma extenssão muito boa e durante alguns testes foi muito eficiente contra ataques de Stored XSS attacks, Reflective XSS attacks e contra JavaScripts que tentavam acessar conteúdos privados no sistema.
Entre algumas das principais features do Firekeeper podemos citar:
- Consegue varrer tráfego que chega ao Firefox – HTTP(s) responde headers, body e URL e assim cancelar o processamento de responses suspeitos.
- HTTPS responses são varridas após a descompressão/decrypt.
- O algoritmo de detecção é muito rápido (tirado diretamente do snort).
- Alertas interativos permitem que diferentes respostas sejam tomadas para diferentes tipos de tentativas de ataque.
- Pode utilizar arquivos contendo regras e também automaticamente carregar arquivos em hosts remotos.
Realmente vale a pena para administradores que tentam melhorar a segurança dos usuários utilizando firefox criando um repositório de regras atualizadas na rede e configurando os browsers para atualizarem automaticamente estas regras.
Abaixo seguem alguns links que devem ser visitados para maiores informações sobre o Firekeeper:
http://blues.ath.cx/firekeeper/
FireKeeper Project Weblog
Site do Projeto onde pode ser baixado e instalado o Firekeeper
Good Hacking 4 All.
Linksys WRT54G Security Bypass Vulnerability June 25, 2008
Posted by y2h4ck in General Hacking, Network Security.Tags: 802.11g, bonus, Ethical Hacking, Hacking, linksys hacking, linksys wrt54g, megabonus, Pentest, ultrabonus, wireless router, y2h4ck
add a comment
A interface web no Linksys WRT54g router com firmware
1.00.9 não solicita credenciais quando requisitados
scripts que permite que atacantes acessem features
de administração usando requisições diretas à:
- Advanced.tri
- AdvRoute.tri
- Basic.tri
E muito mais. Recomendo a todos a leitura
to material completo em:
http://www.milw0rm.com/exploits/5926
E recomendo a atualização do Firmware ;-)
Good Hacking 4 All.
BackTrack 3 – Final Release June 20, 2008
Posted by y2h4ck in Pentesting.Tags: backtrack, Ethical Hacking, Hacking, pen-test, Pentest
add a comment
Max Moser to BugTraq:
BackTrack 3 Final – Release Information
Released yesterday exclusively on pauldotcom.com
Muts, Martin and I have slaved for weeks and months, together with the help of many remote-exploit’ers to bring you this fine release. As usual, this version overshadows the previous ones with extra cool things.
SAINT
SAINT has provided BackTrack users with a functional version of SAINT, pending a free request for an IP range license through the SAINT website, valid for 1 year.
Maltego
The guys over at Paterva have created a special version of Maltego v2.0 with a community license especially for BackTrack users. We would like to thank Paterva for co-operating with us and allowing us to feature this amazing tool in BackTrack.
Nessus
Tenable would not allow for redistribution of Nessus on BackTrack 3.
Kernel
2.6.21.5. Yes, yes, stop whining….We had serious deliberations concerning the BT3 kernel. We decided not to upgrade to a newer kernel as wireless injection patches were not fully tested and verified. We did not want to jeopardize the awesome wireless capabilities of BT3 for the sake of sexiness or slightly increased hardware compatibilities. All relevant security patches have been applied.
Tools
As usual, updated, sharpened, SVN’ed and armed to the teeth. This release we have some special features such as spoonwep, fastrack and other cool additions.
Availability
For the first time we distribute three different version of Backtrack 3
- CD version
- USB version
- VMWare version
BackTrack 3 final download page is here:
http://remote-exploit.org/backtrack_download.html
Final Requests
We request the community to not mirror or torrent this release, or otherwise distribute it online without our knowledge.
We are trying to gather statistics about bt3 downloads. If you would like to mirror BT3 then please:
1) Think again! Traffic generated by BT3 downloads is CRAZY.
2) Please contact us before doing so.
3) Send us monthly statistics of downloads for the iso.
If you would like to add a link to BackTrack downloads to your website, please use:
http://www.remote-exploit.org/backtrack_download.html as the download link.
Rants
Problems, fixes, bugs, opinions – should all end up in our Remote Exploit community forums, and our wiki:
http://forums.remote-exploit.org
http://wiki.remote-exploit.org
Over and out,
Max, Muts, MjM
Hack in The Box Conference 2007 June 19, 2008
Posted by y2h4ck in General Hacking, General Security.Tags: Ethical Hacking, hack in the box conference, Hacking, hacking material, HITB, penetration testing, y2h4ck
add a comment
Pessoal, segue mais um post contendo o link para o material da HITBConf (HackintheBox) que acontece todos os anos em Outubro em Dubai. Seguem os Mainstream Medias e blogs contendo informações do evento.
http://conference.hitb.org/hitbsecconf2007kl/
Good Hacking 4 All.
Windows Vista – Login Bypass June 13, 2008
Posted by y2h4ck in Ethical Hacking, Fun Stuff, General Security.Tags: Ethical Hacking, General Hacking, General Security, Hacking, login bypass, pen-test, Pentesting, Windows Hacking, windows vista hacking, y2h4ck
1 comment so far
No Vídeo abaixo, o atacante com acesso físico à uma estação executando Windows Vista utiliza um Live-CD com a distribuição BackTrack-3. Montando a partição do sistema, ele acessa o c:\windows\system32\> e modifica o binário Utilman.exe pelo cmd.exe, assim quando o sistema iniciar e o Utilman.exe for solicitado, seja executado um shell para o atacante com privilégios de <SYSTEM>.
Good Hacking 4 All.
ShmooCon 2008 – Presentation Videos June 12, 2008
Posted by y2h4ck in General Hacking.Tags: Ethical Hacking, Hacking, pen-test, penetration testing, Pentesting, shmoocon, shmoocon 2008, shmoocon videos, y2h4ck
add a comment
Seguem os videos da ShmooCon 2008. O evento foi muito bom e todos os vídeos são de excelente qualidade. Recomendo a todos.
Apresentações & Tools:
http://www.shmoocon.org/2008/presentations/
Videos:
http://www.shmoocon.org/2008/videos
Good Hacking 4 All
sqlninja – Blind SQL Injection Exploit Framework June 10, 2008
Posted by y2h4ck in Ethical Hacking, General Hacking, Pentesting, Web Hacking.Tags: Ethical Hacking, exploits, General Hacking, Hacking, mssql hacking, pen-test, penetration testing, Pentesting, sql, sql injection, sqlninja, Web Hacking
add a comment
Sqlninja é uma ferramenta criada para explorar vulnerabilidades de SQL injection em aplicações web que utilizam-se do Microsoft SQL Server em seu back-end.
Seu principal objetivo é prover acesso remoto no servidor Database vulnerável. Pode ser utilizado por penetration testers para ajudar automatizar o processo de intrusão em um servidor DB quando uma vulnerabilidade de SQL Injection é localizada.
A ferramenta é distribuida sob a GPLv2 e classificada no SecurityHacks’ Top 15 Free SQL Injection Scanners, e pode trazer bons resultados durante um pen-test :)
Features
A documentação completa pode ser encontrada no Tarball e também aqui. Abaixo segue uma pequena lista das principais funcionalidades do Sqlninja:
- Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)
- Bruteforce of ’sa’ password (in 2 flavors: dictionary-based and incremental)
- Privilege escalation to sysadmin group if ’sa’ password has been found
- Creation of a custom xp_cmdshell if the original one has been removed
- Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed)
- TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell
- Direct and reverse bindshell, both TCP and UDP
- DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames (check the documentation for details about how this works)
- Evasion techniques to confuse a few IDS/IPS/WAF
- Integration with Metasploit3, to obtain a graphical access to the remote DB server through a VNC server injection
Sqlninja é escrito em perl e pode ser executado em qualquer Unix com o interpretador perl e foi testado com sucesso em:
- Linux
- FreeBSD
- Mac OS X
Segue abaixo um DEMO de um pen-test em uma aplicação vulnerável, usando o sqlninja para obter acesso ao DB Server.
http://sqlninja.sourceforge.net/sqlninjademo1.html
Good Hacking 4 All.
Book of Month: June June 2, 2008
Posted by y2h4ck in security books.Tags: Book of Month, Hacking, hacking book, pentest book, Pentesting, security, security book
add a comment
| The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws |
| Author: Dafydd Stuttard, Marcus Pinto |
| Publisher: Wiley |
| Year: 2007 |
| Pages: 736 |
| Amazon’s book description: This book is a practical guide to discovering and exploiting security flaws in web applications. The authors explain each category of vulnerability using real-world examples, screen shots and code extracts. The book is extremely practical in focus, and describes in detail the steps involved in detecting and exploiting each kind of security weakness found within a variety of applications such as online banking, e-commerce and other web applications. The topics covered include bypassing login mechanisms, injecting code, exploiting logic flaws and compromising other users. Because every web application is different, attacking them entails bringing to bear various general principles, techniques and experience in an imaginative way. The most successful hackers go beyond this, and find ways to automate their bespoke attacks. This handbook describes a proven methodology that combines the virtues of human intelligence and computerized brute force, often with devastating results. |
