Wireless and Wired Network Interceptor - the Interceptor

The Interceptor is a wireless wired network tap. Basically, a network tap is a way to listen in to network traffic as it flows past. I haven’t done extensive research but all the ones I found when looking passed the copy of the traffic onto a specified wired interface which was then plugged into a machine to allow a user to monitor the traffic. The problem with this is that you have to be able to route the data from that wired port to your monitoring machine either through a direct cable or through an existing network. The direct cable method means your monitor has to be near by the location you want to tap, the network routing means you have to somehow encapsulate the data to get it across the network without it being affected on route.

The Interceptor does away with the wired monitor port and instead spits out the traffic over wireless meaning the listener can be anywhere they can make a wireless connection to the device. As the data is encrypted (actually, double encrypted, see how it works) the person placing the tap doesn’t have to worry about unauthorized users seeing the traffic.


What Hardware Is Required


This project has been built and tested on a Fon+ but should in theory work on any device which will run OpenWrt and has at least a pair of wired interfaces and a wireless one.


Wireless and Wired Network Interceptor: the Interceptor


This isn’t intended to be a permanent, in-situ device. It is designed for short term trouble shooting or information gathering on low usage networks, as such, it will work well between a printer and a switch but not between a switch and a router. Here are some possible situations for use:

ºPenetration testing – If you can gain physical access to a targets office drop the device between the office printer and switch then sit in the carpark and collect a copy of all documents printed. Or, get an appointment to see a boss and when he leaves the room to get you a drink, drop it on his computer. The relative low cost of the Fon+ means the device can almost be considered disposable and if branded with the right stickers most users wouldn’t think about an extra small box on the network.

ºTroubleshooting – For sys-admins who want to monitor an area of network from the comfort of their desks, just put it in place and fire up your wireless.


ºIDS – If you want to see what traffic is being generated from a PC without interfering with the PC simply add the Interceptor and sit back and watch. As the traffic is cloned to a virtual interface on your monitoring machine you can use any existing tools to scan the data.

Install Notes

There are two sets of install notes, a basic set and a detailed walk-through set. The basic set is the standard set of notes that comes with most packages, the detailed set is a full walk through from flashing the Fon+, installing dependencies, installing Interceptor, starting up and monitoring traffic and finally shutting it down. Most people should find the basic set sufficient but the detailed set are useful if you have any problems.


Limitations

Wireless and Wired Network InterceptorThe main limitation is bandwidth, the wired network can get up to 100Mb/s but the top speed of the wireless is 54Mb/s, add on to that the overhead of encryption and that rate drops down further. This is why the Interceptor won’t work well on high traffic parts of the network.

From tests I’ve done, under high load the network seems to stay up and stable but not all traffic ends up on the monitor interface. I haven’t done any research to find out where the traffic is being dropped, it could be DaemonLogger, the AP or at the VPN. This is good as it means the device doesn’t affect the smooth running of the network but obviously means you may miss some important data. Be aware of this when working with the device.

The software has no fail safe in case of problems. If the hardware or software fails the network connection being tapped will probably be lost. Don’t use the Interceptor in situations where uptime is critical without knowing what you are doing.

Download the Interceptor

Read More

Encrypted UDP based FTP - UFTP

Encrypted UDP based FTP with multicast

UPDATE: Version 4 of UFTP is now available! The protocol has been heavily altered to support a number of new features:

ºThe ability to send multiple files in a single session
ºAn SSL/TLS derived encryption layer to protect your data
ºMulticast tunneling
ºNAT traversal
ºAggregation of client responses, providing scalability
ºSupport for variable packet sizes, including jumbo frames
ºMore fine grained control of network timing/retransmission parameters

The code has also been completely restructured to be more readable and easier to update/support.

UFTP is an encrypted multicast file transfer program, designed to securely, reliably, and efficiently transfer files to multiple receivers simultaneously. This is useful for distributing large files to a large number of receivers, and is especially useful for data distribution over a satellite link (with two way communication), where the inherent delay makes any TCP based communication highly inefficient. The multicast encryption scheme is based on TLS with extensions to allow multiple receivers to share a common key. UFTP also has the capability to communicate over disjoint networks separated by one or more firewalls (NAT traversal) and without full end-to-end multicast capability (multicast tunneling) through the use of a UFTP proxy server. These proxies also provide scalability by aggregating responses from a group of receivers. UFTP has been used in the production process of The Wall Street Journal to send WSJ pages over satellite to their remote printing plants, and other users have used it to send to over 1000 receivers.


Encrypted UDP based FTP: UFTP Protocol Summary

A UFTP session consists of 3 main phases: The Announce/Register phase, the File Transfer phase, and the Completion/Confirmation phase. The File Transfer phase additionally consists of the File Info phase and the Data Transfer phase for each file sent.

The Announce/Register phase sets up the multicast file transfer session and negotiates all encryption parameters. The server sends out an announcement over a public multicast address which the clients are expected to be listening on. All subsequent messages from the server go over a private multicast address specified in the announcement. Allowed clients send a registration to respond to the announcement. The server will then send either a confirmation message if encryption is disabled, or the encryption keys for the session if encryption is enabled. If the client receives the encryption keys, it sends an acknowledgment back to the server.

Encrypted UDP based FTP UFTP DocumentationThe File Transfer phase starts with the File Info phase for the first file to send. The server sends a message describing the file in question. Besides the name and size of the file, this message describes how the file will be broken down. A file is divided into a number of blocks, and these blocks are grouped into sections. A block is a piece of the file that is sent in a single packet, and a section is a grouping of blocks. The total number of blocks and sections is included in this message.

Continuing the File Transfer phase is the Data Transfer phase for the first file. Data packets, each of which is a block, are sent by the server at a rate specified by the user. Because UDP does not guarantee that packets will arrive in order, each block is numbered so the client can properly reassemble the file. When the server has finished sending all data packets, it sends a message to the clients indicating this.

When a client detects the end of a section or receives an end of file message from the server, and the client has detected one or more missing blocks, the client will send back a message containing a list of NAKs (negative acknowledgments). When the server receives NAKs from one or more clients, it goes back and retransmits any blocks that were NAKed, then continues on sending any untransmitted blocks. When a client has received the entire file, it sends a completion message in response to the server’s end of file message. This continues until all clients have either send a completion message or have timed out after the server sent its end of file message.

The File Info phase and the Data Transfer phase are then repeated for each file to be sent during the session.


The Completion/Confirmation phase shuts down the session between the server and clients. It starts with a message from the server indication the end of the session. The clients then respond with a completion message, and the server responds to each completion with a confirmation message.

Download UFTP

Read More

IDS evasion - Inundator

IDS/IPS/WAF Evasion & Flooding Tool

inundator is a multi-threaded, queue-driven, IDS evasion tool. Its purpose is to anonymously flood intrusion detection systems (specifically Snort) with traffic designed to trigger false positives via a SOCKS proxy in order to obfuscate a real attack.

inundator would be used whenever you feel there is a significant chance the attack you’re about to perform may be detected by the target’s intrusion detection system. You would launch inundator prior to starting the attack, and continue running it well after you have finished the attack. The hope is that if your attack is detected by the IDS, the alert will be buried among several thousand false positives, thus minimizing the chance of an IDS analyst detecting the real attack.

inundator is full featured, multi-threaded, queue-based, supports multiple targets, and requires the use of a SOCKS proxy for anonymization. Via Tor, inundator is capable of generating around 1000 false positives per minute. Via a high-bandwidth SOCKS proxy, you might be able to generate ten times that amount.

IDS evasion: Inundator Features

ºParses Snort rules files to generate false positive attacks
ºSupport for multiple targets (FQDN, ip addr range, subnet in CIDR format)
ºMulti-threaded
ºQueue-based
ºSOCKS support

Dependencies:

ºNmap
ºPerl (>= 5.10)
ºNet::SOCKS (>=0.03)
ºNet::CIDR (>= 0.11)
ºSnort’s rules files
ºOinkmaster (for keeping Snort rules up to date)
ºTor (If you don’t have a remote SOCKS proxy to exploit.)


When would I use Inundator?

Whenever you feel like it. Seriously. It’s anonymous, so why not watch the world burn?

Example Scenarios:

ºBefore, during, and after a real attack to bury any potential alerts among a flood of false positives.

ºSeriously mess with an IDS analyst and keep an InfoSec department busy for days investigating false positives.

ºTest the effectiveness of an intrusion detection or prevention system. Less alerts means a better product; more alerts means a horrible product.


How does Inundator work?

At a high level, Inundator builds an attack queue, organized by destination port, by parsing the content: and uricontent: fields from Snort’s poorly written pattern-matching rules. Inundator then builds a target queue by peforming a port scan to identify open TCP ports on each target provided by the user. Once the queues have been built, Inundator will launch the requested number of worker threads. Each worker thread will select a random target from the target queue, as well as a random open port on the selected target. A random attack for the selected port will then be selected from the attack queue, and this information is used to build a completely innocent packet or request that contains patterns matching typical intrusion detection rules. The crafted attack will then be sent to the target via a SOCKS proxy (we default to Tor’s local proxy.) This procedure is repeated in an infinite loop by each worker thread until the user aborts.

Quite obviously, the actual ruleset used by the target intrusion detection system will play a very large part in whether our crafted attacks trigger a false positive. Inundator will generate an overwhelming number of false positives on systems which use extremely poor pattern matching rules, and little to no false positives on systems which use well written rules, heuristic-based detection, or anomaly-based detection mechanisms.


Downloading and Installing Inundator.

The preferred method of installation for all other .deb-based distributions is via our software repository. This is by far the best and simplest way of installing Inundator and its dependencies.

Add our repository to /etc/apt/sources.list:

deb http://inundator.sourceforge.net/repo/ all/

Next, download and install our GPG key:

wget http://inundator.sourceforge.net/inundator.asc
apt-key add inundator.asc

Then you can automatically pull in Inundator and all its dependencies:

aptitude update
aptitude install inundator

Download Inundator

Read More

Standardized Security - OpenSCAP

The OpenSCAP Project was created to provide an open-source framework to the community which enables integration with the Security Content Automation Protocol (SCAP) suite of standards and capabilities. It is the goal of OpenSCAP to provide a simple, easy to use set of interfaces to serve as the framework for community use of SCAP.

SCAP is a line of standards managed by NIST. It was created to provide a standardized approach to maintaining the security of enterprise systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.


The SCAP suite contains multiple complex data exchange formats that are to be used to transmit important vulnerability, configuration, and other security data. Historically, there have been few tools that provide a way to query this data in the needed format. This lack of tools makes the barrier to entry very high and discourages adoption of these protocols by the community. It’s our goal to create a framework of libraries to improve the accessibility of SCAP and enhance the usability of the information it represents. Tools for parsing SCAP documents and querying content must be created to achieve this. This requires common set of interfaces to be defined and implemented to meet this need. It is the intent of this project to provide these interfaces and functional examples that would allow others in the open-source and vendor communities to make use of SCAP while minimizing the effort needed to gain value from it.

Standardized Security: OpenSCAP:

ºLibrary – OpenSCAP library provides API to SCAP document processing.
ºToolkit – oscap is a command line tool that provides various SCAP capabilities; for instance: configuration scanner, vulnerability scanner, SCAP content validation and transformation etc.
ºData – We also produce SCAP content samples that can be used mainly for experimental testing purposes.


Specifications supported by OpenSCAP:

ºXCCDF: The Extensible Configuration Checklist Description Format (ver. 1.2)
ºOVAL®: Open Vulnerability and Assessment Language (ver. 5.10.1)
ºAsset Identification (ver. 1.1)
ºARF: Asset Reporting Format (ver. 1.1)
ºCCE™: Common Configuration Enumeration (ver. 5.0)
ºCPE™: Common Platform Enumeration (ver. 2.3)
ºCVE®: Common Vulnerabilities and Exposures
ºCVSS: Common Vulnerability Scoring System (ver. 2.0)
ºStandardized Security: OpenSCAP Standardized Security

Furthermore, OpenSCAP also implements technology that is not included in SCAP standards:


ºSCE – the alternative check engine. Allows you to use familiar scripting language of your choice instead of OVAL for checks.


Related Projects

ºscap-workbench – a tool with nice graphical user interface that provides scanning(both local and remote machine), content customization and machine remediation functionality.

ºSCAP addon for Anaconda installer, which is used in Fedora and Red Hat Enterprise Linux, for applying SCAP content in the installation process.

ºSCE Community Content – set of various security configuration settings (security controls) expressed in standardized format. Each security control can be evaluated by a small shell script which is executed via SCE.

ºSCC – a compiler used for SC. SC is a small language intended to make the creation of OVAL content easier. The SC language is more “human readable” than the XML of OVAL.

ºsecstate – a tool that attempts to streamline the Certification and Accreditation (C&A) process of Linux systems by providing a mechanism to verify, validate, and provideremediation to security relevant configuration items.


Security Compliance Communities

ºSCAP Security Guide
ºAqueduct

Download OpenSCAP

Read More

Web Application Security Scanner - w3af

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

Identify and exploit a SQL injection

One of the most difficult parts of securing your application is to identify the vulnerable parameters and define the real risk. This video shows how to easily identify and exploit SQL injection vulnerabilities. As bonus the video shows how to extract information using web application payloads.

Batteries included

Want to know more about the low-level features provided by our framework? Go through our features page in order to understand what’s under the hood.

Plugin architecture

Vulnerabilities are identified using plugins, which are short and sweet pieces of Python code that send specially crafted HTTP requests to forms and query string parameters to identify errors and mis-configurations.

Flexible

Easy to use for novice users, fully customizable for hackers and developers. We’ve built it that way.

Expert tools


Besides the automated scanning features w3af’s GUI provides expert tools which allow the advanced users to manually craft and send custom HTTP requests, generate requests in an automated manner, cluster HTTP responses and more!


Introduction

w3af is a simple tool to use once you understand the basic concepts behind it, our FAQ and the framework’s feature list will introduce you to the overall idea, but this document will dive into w3af and explain all you need to know before running a scan.

Web Application Scanning

Black-box web application scanning, if we abstract from the details, is a simple process:

1. Identify all links, forms, query string parameters.
2. Send specially crafted strings to each input and analyze the output
3. Generate a report with the findings

Due to various reasons that won’t be discussed in this document, this process is actually very complex and false positive/negative prone if done without the right tools.

w3af’s architecture

The w3af framework is divided into three main sections:

1. The core, which coordinates the whole process and provides libraries for using in plugins.
2. The user interfaces, which allow the user to configure and start scans
3. The plugins, which find links and vulnerabilities


w3af’s phases

w3af follows the steps you would perfom in a web application penetration test, see “Web Application Scanning” above. In order to do so it defines different types of plugins which are going to be called by the core in a specific order.

Starting with a target URL provided by the user, w3af will first try to identify all URLs, forms and query string parameters in the application by the means of crawl plugins. A very good example of this type of plugin is the web_spider which will extract URLs from a page, follow those links and once again extract URLs from it. Following that process it will create a complete application link and form map.

Once the application has been mapped, audit plugins will send specially crafted strings to each parameter in order to trigger bugs in the application’s code. When a bug is found it will be reported to the user. The most used audit plugin is sqli which will find error-based SQL injections.

Identified vulnerabilities, debug and error messages, all are reported to the user with output plugins. These plugins will write the messages in different formats to suit your needs. In most cases a text file is what users need, but for integration into other tools XML file format is also available.

Configuration

The framework can be configured using two very different settings: plugin configuration and global configuration.

Plugin configuration

Plugins might have configuration parameters, in all cases where the plugin has a setting a default value has been set. We recommend you read the setting help and in some cases the plugin source code in order to understand exactly what will happen if you change the configuration.

Global configuration

The framework-wide configuration settings change the core’s behavior and are split in two: http-settings and misc-settings. As with the plugin configuration, all settings in the global configuration have a default value and should be changed with care. Changing a setting here might reduce the scanner’s performance, have the framework generate thousands of unnecessary HTTP requests, etc.

Saving your settings


All user defined settings can be saved using profiles, this helps users run their scans multiple times and in some cases run them with slightly different configurations. Creating, saving and loading profiles is an easy task that’s done from within the user interface.

If you’re a Linux, BSD or Mac user we recommend you download the source from our GitHub repository:


$ git clone https://github.com/andresriancho/w3af.git
$ cd w3af
$ ./w3af_gui

Download w3af

Read More

Log Monitoring Daemon - agentsmith

agentsmith is a daemon that continuously monitors a log file for
break-in attempts by remote hosts.


Upon detection of a break-in attempt, it launches a user defined script or application, which can do virtually anything from sending mails to whatever you might think of, e.g: monitor

ºmail logs and block spammers right away
ºfirewall logs and block malicious hosts
ºlogs for brute-force login attempts using ssh and block them

The criteria what is considered a break-in attempt can be configured by means of a regular expression.


As of version 0.2, agentsmith is able to exchange host information with other agentsmith instances running on remote hosts and thus trigger actions on remote hosts. It uses OpenSSL to accomplish this in a secure manner. It runs on Solaris, *BSD, and Linux and requires the PCRE library and OpenSSL as external dependencies.


Log Monitoring Daemon: agentsmith Installation


The build and installation is pretty straight forward. First, call

$ ./configure
$ make
$ make install

By default, the pid file used by the daemon will live in $LOCALSTATEDIR/agentsmith/agentsmith.pid

The default location of the configuration file is $SYSCONFDIR/agentsmith/agentsmith.conf

Those location can be changed by either specifying –localstatedir=<PATH>, –sysconfdir=<PATH>, –with-pid=<FILEPATH>, or –with-config=<FILEPATH>.


If the PCRE or OpenSSL library cannot be found, make sure you set the proper CPPFLAGS, and LDFLAGS environment variable before calling configure, e.g.

$ export CPPFLAGS='-I/usr/local/include'
$ export LDFLAGS='-L/usr/local/lib'

Further, ensure that the development packages for PCRE and OpenSSL are installed, this is especially important if you build agentsmith on a Linux distribution.

Download  agentsmith

Read More

Blind SQL Injections - BSQL Hacker

BSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database.

BSQL Hacker aims for experienced users as well as beginners who want to automate SQL Injections (especially Blind SQL Injections).It allows metasploit alike exploit repository to share and update exploits.

Blind SQL Hacker Key Features


ºEasy Mode
ºSQL Injection Wizard
ºAutomated Attack Support (database dump)
ºORACLE
ºMSSQL
ºMySQL (experimental)

ºGeneral
ºFast and Multithreaded
º4 Different SQL Injection Support
ºBlind SQL Injection
ºTime Based Blind SQL Injection
ºDeep Blind (based on advanced time delays) SQL Injection
ºError Based SQL Injection
ºCan automate most of the new SQL Injection methods those relies on Blind SQL Injection
ºRegEx Signature support
ºConsole and GUI Support
ºLoad / Save Support
ºToken / Nonce / ViewState etc. Support
ºSession Sharing Support
ºAdvanced Configuration Support
ºAutomated Attack mode, Automatically extract all database schema and data mode

ºUpdate / Exploit Repository Features
ºMetasploit alike but exploit repository support
ºAllows to save and share SQL Injection exploits
ºSupports auto-update
ºCustom GUI support for exploits (cookie input, URL input etc.)

ºGUI Features
ºLoad and Save
ºTemplate and Attack File Support (Users can save sessions and share them. Some sections like username, password or cookie in the templates can be show to the user in a     GUI)
ºVisually view true and false responses as well as full HTML response, including time and stats

ºConnection Related
ºProxy Support (Authenticated Proxy Support)
ºNTLM, Basic Auth Support, use default credentials of current user/application
ºSSL (also invalid certificates) Support
ºCustom Header Support

ºInjection Points (only one of them or combination)
ºQuery String
ºPost
ºHTTP Headers
ºCookies

ºOther
ºPost Injection data can be stored in a separated file
ºXML Output (not stable)
ºCSRF protection support

Download BSQL Hacker

Read More

Final Released - Bruter v1.0

Bruter is a parallel network login brute-forcer on Win32. This tool is intended to demonstrate the importance of choosing strong passwords. The goal  is to support a variety of services that allow remote authentication.


It currently supports following services:

º FTP
º HTTP (Basic)
º HTTP (Form)
º IMAP
º MSSQL
º MySQL
º POP3
º SMB-NT
º SMTP
º SNMP
º SSH2
º Telnet
º VNC

Bruter Recent Changes

º Re-licensed to new-BSD license
º Added proxy support (CONNECT, SOCKS4, SOCKS5)
º Allowed more delimiter in combo file
º Added password length filtered in combo and dictionary mode
º Fixed miscellaneous bugs
º Updated openssl library to 0.9.8n

Download Bruter

Read More

V For Vendetta

The story begins after the end of political conflict with the disabled concentration camps and compliant population with the situation until it comes "V" - an Anarchist wearing a stylized Guy Fawkes mask and is possessed of a wide range of skills and resources. He then begins an elaborate and theatrical campaign to overthrow the state .

In the process, you know Evey , girl who lost her parents during the war. Evey is handled by V as an apprentice , always being presented to the remnants of a culture lost because of the war and degradation of society.






 Source: topfilmesonlinehd 

 By OffensiveSec

Read More