"onion-scraper"

Not the most creative of tool names but literal. Had a need to download evidences of data leaks from Ransomware blog posts so harnessed "Copilot" again to create said script to get work done.

VM for ransomware investigations

 My laundry list of tools/software useful when investigating ransomware cases.

 

Tor: Obviously need this to access Onion sites.

qBittorrent: Download leaked data from Torrent files.  

Peazip: Extract archives containing leaked data.  

unrar: Extract archives containing leaked data.  

LibreOffice: Read leaked documents. 

SSH: Transfer files from VM to host.  

 

Any suggestions what other tools you guys use? 

Simple session hijacking demo

Been a long time since I've had to demo "session hijacking". Picked DVWA as the vulnerable web application to demonstrate "cookie theft" and "session hijacking" using "Burp".

Scenario: A man-in-the-middle (MiTM) scenario is where a "Hacker" positions themselves between a client and server. In a successful MiTM situation, the "Hacker" can use a "web proxy" like "Burp" to intercept traffic between a victim and web application. The "Hacker" is able to capture the victim's post-authentication cookie to impersonate the authenticated victim.

Simple file carving demo

 Been awhile since I've done hands on "file carving". I was pleasantly surprised that it is so much easier now to "carve" files from "Wireshark". 

Scenario: A "Hacker" is at an open Wi-Fi operated by a Cafe. The "Hacker" uses "Wireshark" to capture network traffic traversing the wireless network. One user transfers an "Excel Spreadsheet" containing personal data onto an FTP server. The "Hacker" is able to successfully "carve" the transferred file from the network packets captured.

Log review

Wrote a simple script to aid with log review using keywords. You can use the below by substituting the keywords as well as log source.

#!/bin/bash
grep "Authentication fail" /mnt/c/monthly/app.log > /mnt/c/monthly/app-fail.txt
grep "Authentication fail" /mnt/c/monthly/os.log > /mnt/c/monthly/os-fail.txt

Insecure passwords

Was in the middle of a "Penetration Testing" exercise and came across an application that sends the users' credentials in cleartext. I was surprised as I rarely encounter this scenario.
This got me thinking if popular apps such as "Facebook" and "Gmail" send our credentials in cleartext too? Fired up "Paros" and the rest they say is history.

"Tamper Data"

My latest column explores the "Firefox" addon called "Tamper Data". Here is the excerpt.
"HTTP Proxies are a necessary tool in the arsenal of a penetration tester. Common HTTP Proxies harnessed for testing web applications for vulnerabilities include Paros, Burp and Webscarab. My personal favourite is Paros, which is written in Java and thus, platform independent. However, I recently discovered a comparable tool called Tamper Data."

"jhead"

My latest column explores a tool called "jhead". Here is the excerpt.
"Smartphones are feature packed and owned by nearly everyone in developed countries. We cannot get by with our daily lifes without them. They provide us with a pocket sized gadget to surf the World Wide Web, direct us to where we want to go via the built-in Global Positioning System (GPS)and even permit us to take videos as well as photographs on the go. The caveat of this device is that it records a lot of sensitive data about its owner by default."

"WebHTTrack"

My latest column on the "Linux" version of "HTTrack". Here is the excerpt.
"HTTrack Website Copier is aopen source tool to download an entire website from the Internet locally onto your desktop for offline browsing. It is a Windowssoftware that spawned WebHTTrack, its Linux/Unix/BSDrelease. The tool dumps and mirrors the complete contents of the source website you specify to a local directory by replicating the exact directory structure, files and links.
This is beneficial for a security practitioner who wants to perform offline security testing against a website without impacting the server hosting it ."

The latest issue of "Hakin9" also features an article by my friend, Remus Ho.

"Hb4most"

My latest column on a front-end GUI for "Foremost" and "Scalpel". Here is the excerpt.
"Scalpel and Foremost are the De facto tools harnessed to recover deleted files as evidence during Digital Forensic investigations."

"Windows Update" compromised

A lot of news recently about "Flame" and one method that the malware used to spread itself was via "Windows Update". Fascinating read.

"Digital Forensics Platform"

My latest column on the DEFT 7 forensics environment. Here is the excerpt.
"Digital Forensics is a niche domain within Information Security. It can be further divided into System and Network Forensics. System Forensics requires an indepth knowledge of Operating Systems (OS) and file systems whilst Network Forensics requires an extensive understanding of network protocols and discernment of application behaviour."

Common sense

Technology is never foolproof and here is an excellent example where common sense is overwhelmingly essential.
I received the highlighted link in my Gmail which wasn't marked as spam. A quick glance at the path and I knew this was obviously a ruse but I wondered why Gmail's spam detection didn't pick this up. I quickly ran the suspicious link against the scanners hosted on VirusTotal and was utterly disappointed that not a single engine was able to mark it as malicious.

"Wireshark: The Secrets of the Shark"

Rushed out 2 columns drafts ahead of schedule and Hakin9 decided to use them in consecutive issues. Here is the excerpt of the latest one.
"This column was inspired by the international screening of the Tintin movie by Steven Spielberg and Peter Jackson. Just like Tintin, Wireshark is an international icon too. It is primarily harnessed for network troubleshooting and packet analysis but did you know that there are other applications of this powerful tool?"

"Prey: From Praying to Preying"

My new column is out in Hakin9 magazine. It was 2 months overdue so it is a relief that it is finally published.
An excerpt of it in the "Tool Time" column this month.
"Since the issue 7/2010 article Prey: A new hope, there have been developments in the device tracking tool. It has been enhanced to now be able to monitor lost Android smartphones and tablets when activated. There was a reported case in May 2011 where a Californian harnessed evidence collected from a similar tool, Hidden, to recover his stolen Macbook."

My first column

Hakin9 asked me to be a bimonthly contributor to their new column entitled "Tool Time" and here is an excerpt of it.
"Hispasec Sistemas has managed the service, VirusTotal, since 1st June 2004. The website (http://www.virustotal.com) offers the public access to multiple Antivirus (AV) engines hosted by them to provision online scanning of individual files to uncover malware by harnessing a combination of signature-based and heuristic detection."

Ubuntu update error

When I ran "sudo-apt update" command in Terminal, I get the following error.

commandrine@bridge:~$ sudo apt-get update
[sudo] password for commandrine:
Hit http://sg.archive.ubuntu.com lucid Release.gpg
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid/main Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid/restricted Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid/universe Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid/multiverse Translation-en_SG
Hit http://sg.archive.ubuntu.com lucid-updates Release.gpg
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid-updates/main Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid-updates/restricted Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid-updates/universe Translation-en_SG
Ign http://sg.archive.ubuntu.com/ubuntu/ lucid-updates/multiverse Translation-en_SG
Hit http://sg.archive.ubuntu.com lucid Release
Hit http://sg.archive.ubuntu.com lucid-updates Release
Hit http://sg.archive.ubuntu.com lucid/main Packages
Hit http://sg.archive.ubuntu.com lucid/restricted Packages
Hit http://sg.archive.ubuntu.com lucid/main Sources
Hit http://sg.archive.ubuntu.com lucid/restricted Sources
Hit http://sg.archive.ubuntu.com lucid/universe Packages
Hit http://sg.archive.ubuntu.com lucid/universe Sources
Hit http://sg.archive.ubuntu.com lucid/multiverse Packages
Hit http://sg.archive.ubuntu.com lucid/multiverse Sources
Hit http://sg.archive.ubuntu.com lucid-updates/main Packages
Hit http://sg.archive.ubuntu.com lucid-updates/restricted Packages
Hit http://sg.archive.ubuntu.com lucid-updates/main Sources
Hit http://sg.archive.ubuntu.com lucid-updates/restricted Sources
Hit http://sg.archive.ubuntu.com lucid-updates/universe Packages
Hit http://sg.archive.ubuntu.com lucid-updates/universe Sources
Hit http://sg.archive.ubuntu.com lucid-updates/multiverse Packages
Hit http://sg.archive.ubuntu.com lucid-updates/multiverse Sources
Hit http://ppa.launchpad.net lucid Release.gpg
Hit http://security.ubuntu.com lucid-security Release.gpg
Ign http://ppa.launchpad.net/docky-core/ppa/ubuntu/ lucid/main Translation-en_SG
Ign http://security.ubuntu.com/ubuntu/ lucid-security/main Translation-en_SG
Hit http://ppa.launchpad.net lucid Release.gpg
Ign http://security.ubuntu.com/ubuntu/ lucid-security/restricted Translation-en_SG
Ign http://ppa.launchpad.net/docky-core/stable/ubuntu/ lucid/main Translation-en_SG
Ign http://security.ubuntu.com/ubuntu/ lucid-security/universe Translation-en_SG
Get:1 http://ppa.launchpad.net lucid Release.gpg [316B]
Ign http://ppa.launchpad.net/moonlight-team/pinta/ubuntu/ lucid/main Translation-en_SG
Ign http://security.ubuntu.com/ubuntu/ lucid-security/multiverse Translation-en_SG
Get:2 http://ppa.launchpad.net lucid Release.gpg [316B]
Get:3 http://security.ubuntu.com lucid-security Release [44.7kB]
Ign http://ppa.launchpad.net/mozillateam/firefox-stable/ubuntu/ lucid/main Translation-en_SG
Hit http://ppa.launchpad.net lucid Release.gpg
Ign http://ppa.launchpad.net/pidgin-developers/ppa/ubuntu/ lucid/main Translation-en_SG
Hit http://security.ubuntu.com lucid-security/main Packages
Get:4 http://ppa.launchpad.net lucid Release.gpg [316B]
Ign http://ppa.launchpad.net/ubuntu-mozilla-security/ppa/ubuntu/ lucid/main Translation-en_SG
Hit http://security.ubuntu.com lucid-security/restricted Packages
Hit http://ppa.launchpad.net lucid Release
Hit http://security.ubuntu.com lucid-security/main Sources
Get:5 http://security.ubuntu.com lucid-security/restricted Sources [14B]
Hit http://ppa.launchpad.net lucid Release
Hit http://security.ubuntu.com lucid-security/universe Packages
Get:6 http://ppa.launchpad.net lucid Release [57.3kB]
Ign http://ppa.launchpad.net lucid Release
Get:7 http://ppa.launchpad.net lucid Release [14.0kB]
Ign http://ppa.launchpad.net lucid Release
Hit http://security.ubuntu.com lucid-security/universe Sources
Get:8 http://ppa.launchpad.net lucid Release [14.0kB]
Hit http://security.ubuntu.com lucid-security/multiverse Packages
Hit http://security.ubuntu.com lucid-security/multiverse Sources
Get:9 http://ppa.launchpad.net lucid Release [14.0kB]
Ign http://ppa.launchpad.net lucid Release
Hit http://ppa.launchpad.net lucid/main Packages
Get:10 http://ppa.launchpad.net lucid/main Packages [1,506B]
Get:11 http://ppa.launchpad.net lucid/main Packages [752B]
Hit http://ppa.launchpad.net lucid/main Packages
Hit http://ppa.launchpad.net lucid/main Packages
Ign http://ppa.launchpad.net lucid/main Sources
Hit http://ppa.launchpad.net lucid/main Packages
Ign http://ppa.launchpad.net lucid/main Sources
Err http://ppa.launchpad.net lucid/main Sources
416 Requested Range Not Satisfiable 20003
Fetched 61.8kB in 22s (2,794B/s)
W: GPG error: http://ppa.launchpad.net lucid Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3AD52A40B98E84D3
W: GPG error: http://ppa.launchpad.net lucid Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9BDB3D89CE49EC21
W: GPG error: http://ppa.launchpad.net lucid Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY A6DCF7707EBC211F
W: Failed to fetch http://ppa.launchpad.net/pidgin-developers/ppa/ubuntu/dists/lucid/main/source/Sources.gz 416 Requested Range Not Satisfiable 20003

E: Some index files failed to download, they have been ignored, or old ones used instead.

Turning to the Ubuntu Forum, I get advise on running the following commands to rectify the missing keys issue.

gpg --keyserver keyserver.ubuntu.com --recv 3AD52A40B98E84D3

gpg --export --armor 3AD52A40B98E84D3 | sudo apt-key add -

gpg --keyserver keyserver.ubuntu.com --recv 9BDB3D89CE49EC21

gpg --export --armor 9BDB3D89CE49EC21 | sudo apt-key add -

gpg --keyserver keyserver.ubuntu.com --recv A6DCF7707EBC211F

gpg --export --armor A6DCF7707EBC211F | sudo apt-key add -

I encountered 2 keys that still generate update errors. Heading back to the Forum, I get the following steps to rectify the issue.

sudo -i

apt-get clean

cd /var/lib/apt

mv lists lists.old

mkdir -p lists/partial

apt-get clean

apt-get update

Problem solved.

“aspydrv.asp;.jpg”

Was reading this article about an alleged Anonymous hacker uploading a file “aspydrv.asp;.jpg” onto servers to compromise them.
This piqued my interest. I Googled the above file and found numerous sites hosting this file. Further research educated me that using the ";.jpg" at the end of the ASP file can fool insecure IIS servers.

Accessing one of the vulnerable sites, I try uploading a test ASP page written by my buddy, Simon, and the file successfully bypasses the file type check. I click on the uploaded ASP page and the "Hello World" message is published on my browser.
It is a simple trick to gain control of a vulnerable webserver but timely patching and hardening will thwart this threat.

The seedy underworld of fake AV

Interesting research done on the fake AV industry and eye-popping statistics.

"Firestarter: Starter for your Firewall"

My new article is out this month in Hakin9 magazine. It is for paid subscribers only and here is an excerpt of it.
"The firewall is the first line of defense on the network perimeter and end points. Firewalls are susceptible to targeted attacks (eg. social engineering, application vulnerabilities) but they are still the foundation upon which access control is built upon."