Been awhile since I've performed a brute force attack. In this demo, I use "Hydra" from "Kali" to attack my test "Virtual Machine" (VM) running "File Transfer Protocol" (FTP).
Showing posts with label Videos. Show all posts
Showing posts with label Videos. Show all posts
Brute force
Simple session hijacking demo
Been a long time since I've had to demo "session hijacking". Picked DVWA as the vulnerable web application to demonstrate "cookie theft" and "session hijacking" using "Burp".
Scenario: A man-in-the-middle (MiTM) scenario is where a "Hacker" positions themselves between a client and server. In a successful MiTM situation, the "Hacker" can use a "web proxy" like "Burp" to intercept traffic between a victim and web application. The "Hacker" is able to capture the victim's post-authentication cookie to impersonate the authenticated victim.
Simple file carving demo
Been awhile since I've done hands on "file carving". I was pleasantly surprised that it is so much easier now to "carve" files from "Wireshark".
Scenario: A "Hacker" is at an open Wi-Fi operated by a Cafe. The "Hacker" uses "Wireshark" to capture network traffic traversing the wireless network. One user transfers an "Excel Spreadsheet" containing personal data onto an FTP server. The "Hacker" is able to successfully "carve" the transferred file from the network packets captured.
"Armitage"
"Armitage" was a tool that I discovered from the cover of "Linux Journal" in "Page One" today. It shows how outdated I am with the latest fancy security tools available out there.
Visiting the website hosting the tool, I came across this demo video of the tool in action.
This video is easy to follow and comprehend. It saves me the effort of making a similar video. From the demo, the tool proves to be intuitive and logical. The learning curve is pretty gentle as it assists users through the logical flow of discovering vulnerable machines to identifying the applicable exploits that can be launched against the target in order to successfully compromise that system.
Definitely a must-have interface to enhance the capabilities of "Metasploit".
Visiting the website hosting the tool, I came across this demo video of the tool in action.
Definitely a must-have interface to enhance the capabilities of "Metasploit".
Kon-Boot
I have demonstrated password reset and cracking of Windows passwords before. I won't even bother demonstrating resetting of Mac OS X passwords because it is so trivial. Lame Apple ships a password reset utility with their Mac OS X installer DVD. DUH!!!
Kon-Boot is a powerful tool that gives you root privileges on Linux and administrator rights on Windows without needing to crack or know the admin password.
In my demo, I burnt Kon-Boot as a bootable disc and booted up my Linux system with it. Kon-Boot modifies my Linux kernel and permits me to gain root access just by entering "kon-usr". I run the "whoami" command to prove that I am logged in as root without entering the root password.
The high res version of this demo can be downloaded here.
Kon-Boot is a powerful tool that gives you root privileges on Linux and administrator rights on Windows without needing to crack or know the admin password.
In my demo, I burnt Kon-Boot as a bootable disc and booted up my Linux system with it. Kon-Boot modifies my Linux kernel and permits me to gain root access just by entering "kon-usr". I run the "whoami" command to prove that I am logged in as root without entering the root password.
The high res version of this demo can be downloaded here.
Cookie manipulation
I demonstrated cookie hijacking previously but never elaborated about how the stolen cookie can be used.
To make use of stolen cookie information, the session must still be active for cookie manipulation to be successful. Here I manually add cookies using the "Web Developer" Firefox addon to successfully access an active Gmail session.
The high res version of this demo can be downloaded here.
To make use of stolen cookie information, the session must still be active for cookie manipulation to be successful. Here I manually add cookies using the "Web Developer" Firefox addon to successfully access an active Gmail session.
Clickjacking mitigated
Previously blogged about Clickjacking. Came across this new plugin called RequestPolicy that protects users against CSRF attacks. Decided to try it against the Zscaler Clickjacking demo. It works like a charm!!!
The high res version of this demo can be downloaded here.
NoScript is another tool to secure against Clickjacking. Neither are for n00bs though... it requires some knowledge to know what to configure.
The high res version of this demo can be downloaded here.
NoScript is another tool to secure against Clickjacking. Neither are for n00bs though... it requires some knowledge to know what to configure.
Session cookie hijacking
I posted about XSS previously. XSS is commonly used by malicious parties to steal session cookies in order to hijack a victim's active session and impersonate them.
For session cookie hijacking to be successful, the victim must already be logged into the application. Next, the victim must be tricked into clicking on a link to invoke the Javascript to compromise their cookie. In my video, I first display the session cookie using a Javascript pop-up by exploiting the lack of input validation on the third party's webserver. I set up a webserver on my local machine and I trigger another Javascript to request a resource that doesn't exist on my webserver. The session cookie is recorded in my webserver log as a result.
The high res version of this demo can be downloaded here.
For session cookie hijacking to be successful, the victim must already be logged into the application. Next, the victim must be tricked into clicking on a link to invoke the Javascript to compromise their cookie. In my video, I first display the session cookie using a Javascript pop-up by exploiting the lack of input validation on the third party's webserver. I set up a webserver on my local machine and I trigger another Javascript to request a resource that doesn't exist on my webserver. The session cookie is recorded in my webserver log as a result.
The high res version of this demo can be downloaded here.
Clickjacking
Clickjacking is a social engineering technique where a hacker fools a victim into performing seemingly innocuous click(s) but ends up being compromised as a result of their actions.
Attended Zscaler's seminar today and was pretty impressed by the speaker's presentation and demo. He demonstrated Clickjacking and I decided to make a video of their demo page instead of building my own.
In this specific demo, I use the common tactic of inciting victims to visit a malicious page via email. The victim enters the webpage and are encouraged to click on an "innocent" button. This "innocent" button is just an image* that hides a Google "Create Alert" button underneath. Imagine the damage an actual malicious page containing hidden malicious scripts, code or actions can cause.
* Alignment of the fake button varies from browser to browser.
The high res version of this demo can be downloaded here.
Attended Zscaler's seminar today and was pretty impressed by the speaker's presentation and demo. He demonstrated Clickjacking and I decided to make a video of their demo page instead of building my own.
In this specific demo, I use the common tactic of inciting victims to visit a malicious page via email. The victim enters the webpage and are encouraged to click on an "innocent" button. This "innocent" button is just an image* that hides a Google "Create Alert" button underneath. Imagine the damage an actual malicious page containing hidden malicious scripts, code or actions can cause.
* Alignment of the fake button varies from browser to browser.
The high res version of this demo can be downloaded here.
Password reset vs cracking
I previously demonstrated Ophcrack which is a Windows password cracker that uses pre-computed hashes to match the password hash from the target machine's dumped SAM table. Password reset is as the name suggests substituting the password hash from the target machine's dumped SAM table so that you can stipulate the password that you wish to use.
My weapon of choice for password reset is Offline NT Password & Registry Editor. The tool's name is misleading as it supports newer OSs like XP and Vista. You can burn it into a bootable CD or utilize a boot disk. In my demo, I boot the target machine off a CD. I follow the tool's instructions before specifying a blank password. Once the new password is saved, I am able to enter the target system using a blank password.
The high res version of this demo can be downloaded here.
Each method has its pros and cons. Password cracking is time consuming but does not alert the adminstrator as the system password remains unchanged. Password reset is fast but is too obvious when the administrator cannot log into his system.
My weapon of choice for password reset is Offline NT Password & Registry Editor. The tool's name is misleading as it supports newer OSs like XP and Vista. You can burn it into a bootable CD or utilize a boot disk. In my demo, I boot the target machine off a CD. I follow the tool's instructions before specifying a blank password. Once the new password is saved, I am able to enter the target system using a blank password.
The high res version of this demo can be downloaded here.
Each method has its pros and cons. Password cracking is time consuming but does not alert the adminstrator as the system password remains unchanged. Password reset is fast but is too obvious when the administrator cannot log into his system.
Web application hacking
Perimeter defenses (eg. firewalls) do little to protect vulnerable applications from compromise. IPSs may block attacks against your apps but it doesn't address the root problem... the flaws that reside in your apps. Web application firewalls are complex to configure and are currently not commonly deployed.
SQL injection is the use of SQL statements and logic to expose or steal sensitive information stored within the corporate DB. In the demo, I utilise SQL logic to log into the portal without needing to know the admin's password thus gaining full access as the administrator.
SQL injection is the use of SQL statements and logic to expose or steal sensitive information stored within the corporate DB. In the demo, I utilise SQL logic to log into the portal without needing to know the admin's password thus gaining full access as the administrator.
' or 1=1--
I was also able to dump usernames and their respective passwords stored in the DB using the following statement.
1/1/2010 union select userid, 'username: ' + username , 'password: ' + password,null from users--
The high res version of this demo can be downloaded here.
Cross Site Scripting (XSS) is the injection of malicious code into applications to compromise visitors to the website. I enter Javascript pop up code into the vulnerable search box. I am able to successfully inject the Javascript code though it is not persistent. However, hackers overcome this limitation using social engineering. They can trick their victims into clicking on links containing malicious XSS code sent via email or Instant Messenging.
The high res version of this demo can be downloaded here.
Filtering special characters at the server end will mitigate the threat posed by SQL injection and XSS. Do not implement client side filtering as this can easily be overcome with the use of web proxies!!!
1/1/2010 union select userid, 'username: ' + username , 'password: ' + password,null from users--
The high res version of this demo can be downloaded here.
Cross Site Scripting (XSS) is the injection of malicious code into applications to compromise visitors to the website. I enter Javascript pop up code into the vulnerable search box. I am able to successfully inject the Javascript code though it is not persistent. However, hackers overcome this limitation using social engineering. They can trick their victims into clicking on links containing malicious XSS code sent via email or Instant Messenging.
The high res version of this demo can be downloaded here.
Anti keylogging
Came across a Firefox add-on called Keyscrambler Personal. It is a free software that secures keystrokes entered into IE, Firefox and Flock browsers. Like my SANS forensic trainer said, this "warrants further investigation". Never take the vendor's/author's word until you verify it for yourself.
I installed a keylogger on my virtual machine. I capture my keystrokes entered into Firefox with Keyscrambler turned off. The Gmail URL I typed as well as my credentials are captured in the keylogger log. I enable Keyscrambler and enter my credentials at the Gmail login page again. This time, Keyscrambler prevents the keylogger from recording my keystrokes.The high res version of this demo can be downloaded here.
I installed a keylogger on my virtual machine. I capture my keystrokes entered into Firefox with Keyscrambler turned off. The Gmail URL I typed as well as my credentials are captured in the keylogger log. I enable Keyscrambler and enter my credentials at the Gmail login page again. This time, Keyscrambler prevents the keylogger from recording my keystrokes.The high res version of this demo can be downloaded here.
RAT brute forcing dead?
Is Remote Administration Tool (RAT) brute forcing dead? I tried brute forcing RDP and VNC recently to no avail. Rdesktop and Medusa were rendered useless against security mechanisms built into Remote Desktop and VNC.
The high res version of this demo can be downloaded here.
Brute forcing (in 2006) used to be so easy. Tsgrinder was the tool of choice against systems with RDP enabled.
The high res version of this demo can be downloaded here.
Have M$ and VNC added mechanisms to make RAT logins more secure? Or is brute forcing no longer in vogue with hackers and pentesters to release updated versions of their tools?
The high res version of this demo can be downloaded here.
Brute forcing (in 2006) used to be so easy. Tsgrinder was the tool of choice against systems with RDP enabled.
The high res version of this demo can be downloaded here.
Have M$ and VNC added mechanisms to make RAT logins more secure? Or is brute forcing no longer in vogue with hackers and pentesters to release updated versions of their tools?
File carving
File carving (aka carving) is defined as "the practice of searching an input for files or other kinds of objects based on content, rather than on metadata... for recovering files and fragments of files". The input from a digital forensic perspective is either an image of a disk or packet dumps.
Foremost is the tool of choice for forensic analyst wanting to recover evidence from disk images. tcpxtract is a tool designed for extracting files from captured network traffic. I installed tcpxtract onto my Ubuntu 8.10 system. I captured the packets of an FTP session where I transferred an image from one host to another. I ran tcpxtract against the pcap file to extract the said transferred image. Viola!!!
The high res version of this demo can be downloaded here.
Foremost is the tool of choice for forensic analyst wanting to recover evidence from disk images. tcpxtract is a tool designed for extracting files from captured network traffic. I installed tcpxtract onto my Ubuntu 8.10 system. I captured the packets of an FTP session where I transferred an image from one host to another. I ran tcpxtract against the pcap file to extract the said transferred image. Viola!!!
The high res version of this demo can be downloaded here.
Infected?
I've encountered systems that were so badly infected that the OS could not boot up properly. In most cases, I would recommend a full wipe before reinstalling the OS but there may be critical data still resident on that drive. That is where a rescue CD might be useful. F-Secure and Avira are 2 AV vendors that offer free rescue CDs for that purpose.
I tested the F-Secure rescue CD. You basically download their ISO file from their website, burn the ISO into a bootable CD and boot up the infected system from the CD. The bootable Linux OS has a built-in F-Secure AV engine that will prompt you to update its virus detection signatures*. Next, you choose the drive/partition to scan. It will start scanning the selected drive/partition and rename files detected as malware (by adding .virus).
* You need to have Internet connectivity to obtain the latest virus detection signatures.
The high res version of this demo can be downloaded here.
I tested the F-Secure rescue CD. You basically download their ISO file from their website, burn the ISO into a bootable CD and boot up the infected system from the CD. The bootable Linux OS has a built-in F-Secure AV engine that will prompt you to update its virus detection signatures*. Next, you choose the drive/partition to scan. It will start scanning the selected drive/partition and rename files detected as malware (by adding .virus).
* You need to have Internet connectivity to obtain the latest virus detection signatures.The high res version of this demo can be downloaded here.
Ophcrack
Windows stores user passwords in hashes. Hashing is a one way transformation of text and thus Windows passwords can be cracked by matching hashed passwords with rainbow tables.
Ophcrack is an open source program that cracks Windows passwords. Burn Ophcrack into a bootable CD and boot up your target system with the CD. Ophcrack will dump the Windows hashes and start matching the dumped hashes against its rainbow tables.
In this specific scenario, the caveat is that you need physical access. There are tools that perform offline cracking. Cracking passwords can be time consuming but it doesn't alert the admin or user as you do not change the original password. Did you know that all it takes to change the user password in Mac OS X is to boot up using the installation CD???
The high res version of this demo can be downloaded here.
Ophcrack is an open source program that cracks Windows passwords. Burn Ophcrack into a bootable CD and boot up your target system with the CD. Ophcrack will dump the Windows hashes and start matching the dumped hashes against its rainbow tables.
In this specific scenario, the caveat is that you need physical access. There are tools that perform offline cracking. Cracking passwords can be time consuming but it doesn't alert the admin or user as you do not change the original password. Did you know that all it takes to change the user password in Mac OS X is to boot up using the installation CD???
The high res version of this demo can be downloaded here.
Session hijacking
Imperva defines session hijacking as "the act of taking control of a user session after successfully obtaining or generating an authentication session ID... involves an attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's Web application session while that session is still in progress".
I demonstrate session hijacking using a combination of tools called Ferret and Hamster as well as my own private wireless network. No neighbours or wireless users were harmed during this recording. The use of Internet Explorer is to simulate another party (ie. the "victim") sharing the same open wireless network (eg. free wireless at Starbucks). Ferret sniffs the unencrypted traffic in the air and collects useful information into a text file. From Firefox, I access Gmail to show the login page and verify that I did not cheat by logging in earlier. Hamster is then utilised to present web session-related information in the form of hyperlinks which I click to present me (ie. the "attacker") with easy access to active sessions. Viola! You have been hijacked!
The higher res version of this demo can be downloaded here.
To avoid being hijacked, avoid logging into websites that do not support HTTPS on open wireless networks. If you don't want to be snooped on, don't use public networks period.
I demonstrate session hijacking using a combination of tools called Ferret and Hamster as well as my own private wireless network. No neighbours or wireless users were harmed during this recording. The use of Internet Explorer is to simulate another party (ie. the "victim") sharing the same open wireless network (eg. free wireless at Starbucks). Ferret sniffs the unencrypted traffic in the air and collects useful information into a text file. From Firefox, I access Gmail to show the login page and verify that I did not cheat by logging in earlier. Hamster is then utilised to present web session-related information in the form of hyperlinks which I click to present me (ie. the "attacker") with easy access to active sessions. Viola! You have been hijacked!
The higher res version of this demo can be downloaded here.
To avoid being hijacked, avoid logging into websites that do not support HTTPS on open wireless networks. If you don't want to be snooped on, don't use public networks period.
Subscribe to:
Posts (Atom)
-
This annoying message popped up after I ran the update in avast! in Ubuntu yesterday. avast! crashes every time I attempt to launch it after...
-
I decided to install a digital certificate for my Gmail account. This is simple and free to set up. Apply for a free certificate from Comod...