Vulnerability Scanning With Nessus

Basic Vulnerability Scanning With Nessus

"Chennai Hackers connect" would like to preface this entry by stating that vulnerability scanning is not a penetration test. It is merely one part of a test and should be combined with other forms of activity to result in a thorough examination of all vulnerabilities, whether they be human, policy or technical.


About Nessus
Nessus is the worlds most popular open source vulnerability scanner. Nessus is available for Windows or Linux. The version we will be using throughout this blog entry will Nessus 3 running in Ubuntu. Nessus uses a Client Server model.

Nessus Server
The Nessus server is called nessusd. The server does not have to be on the same computer as the Nessus Client and communications between the server and client can be encrypted.


Nessus Client
The Nessus Client we will be using is called NessusClient. Below is a screenshot of the NessusClient interface.



Nessus consists of the following:

Plugins
plugins are checks for vulerabilities that Nessus performs. The plugins database can be updated using the following command.
/opt/nessus/sbin/nessus-update-plugins

Unless you have a paid subscription to Nessus you will only recieve plugins that are older than 7 days. Plugins can be written using the Nessus scripting language NASL. Update the plugins before starting the nessusd server.

Tasks
A task is created to hold duties. a task can be something such as Weekly Checks or Unauthorised Program Scan etc....

Scopes
Scopes represent connections to the Nessus Server (nessusd) are part of a task. Scopes contain lists of hosts (Targets) to scan and tasks can hold many scopes such as Web Servers, File Servers or VNC Hosts etc...

Targets
Targets are hosts or lists of hosts. These can be entered in as fully qualified domain names, IP addresses or IP ranges.


Getting Nessus Up and Running

Installation
1. Download and install Nessus 3. you will need the NessusClient package also. The packages are available at www.nessus.org
2. Once installed update the plugins using /opt/nessus/sbin/nessus-update-plugins

Setting Up
1. Start nessusd from /opt/nessus/sbin/nessusd
2. Start NessusClient from /usr/bin/NessusClient
3. Log into the Nessus Client with the account credentials created during the installation.


Using Nessus
In the example below We will perform a targeted audit of web Servers in my home lab.

We first used NMAP to find alive hosts using:

nmap -sL 192.168.1.1/24

This turned up 2 hosts (shown below).




we then use NMAP to determine if any of the 2 hosts found are listening on port 80 using:

nmap -sV -p80 192.168.1.10,20




In a pentest we would look for Web Servers on non-standard ports such as 8080 8008 or 81 also.

Now we have found a web server and from looking at the version we see it's IIS 6.0 we turn to Nessus.

After firing up Nessus we configure the following options.

1. Select Global Settings and click the connect icon. This will allow me to alter the global configuration and give me access to the plugins. These global settings can be changed and will form the default settings for new tasks.

2. We create a new Task called "Web Servers" and a scope called "IIS Servers"

3. Within the scope i set my target as 192.168.1.10

3. As in this example I'm only going to scan for IIS Vulnerabilities i set my filter for "IIS" on Name and Description and then select Enable All Plugins. This just enables the plugins related to IIS. details of plugins can be viewed by double clicking on a particular plugin.



4. After executing the Scan within Nessus Client, Nessus will perform a portscan of my target and then scan for vulnerabilities.

5. Following the scan i check out the report that Nessus produces and look for any vulnerabilities that may have been found.



The test above is a basic description of a vulnerability scan of a IIS web server to familierise you with Nessus. If you are serious about scanning for vulnerabities you will need to explore the Interface and adjust the various option for your scan

In another example rather than targeting a particular service i have opted to scan use all vulnerability checks (plugins). Although this is particularly noisy and has a better chance of finding a vulnerability it may crash services so use with caution.



This scan found a few vulnerabilities, one being a vulnerability in the server service that has not been patched (ms06-035). If i wanted to exploit this vulnerability the next step i would perform would be to find a working exploit for this platform. After a few minutes of searching i find an exploit at www.milw0rm.com/exploits/2057


Addition Options

When setting the options, either globally or for a particular scan, you can set the following:

• Provide a username and password for the target.
• Not to scan fragile devices (printers)
• Global variables (CGI Scanning, network types, reports, logs, debugging)
• Http login credentials
• Login configurations (FTP, NNTP, HTTP, POP2, POP3, IMAP, SMB)
• Nessus scanner options
• Oracle settings
• Ping options
• Services (SSL options, number of connections, timouts)
• SMB Enumeration options
• SNMP options

Nessus Knowledge Base

by using the Nessus Knowledge Base Nessus will provide various options to remember previous findings from scans and utilise that information in future scans


Further Reading

• http://www.nessus.org/documentation/

Read more

Advance Hacking Syllabus

ETHICAL HACKING SYLLABUS

The Advance Level Hacking Syllabus is as follows:-

Network Security Expert Syllabus

• Security testing methodologies

• The Ethical Hacking Profession

• Passive Intelligence Gathering – 2007 Version

• Network Sweeps

• Stealthily Network Recon

• Passive traffic identification

• Identifying system vulnerabilities

• Abusing Domain Name System (DNS)

• Abusing Simple Network Management Protocol(SNMP)

Exploit Writing Syllabus

• Introduction to Remote Exploits

• Engineering remote exploits

• Running shellcode in RAM vs. on disk

• Heap Buffer Overflows

• Compromising Windows 2003 Server Systems

• Compromising Solaris Unix and Linux Systems

• Attacking RDP (Remote Desktop Protocol) in

Windows XP, 2003 & Vista

• Windows password weaknesses & Rainbow Tables

• Unix password weaknesses

• Attacking Cisco’s IOS password weaknesses

Trojan genres

• Windows, Unix and Linux Trojans

• Kernel Mode Windows Rootkits – System Call

Hijacking and Direct Kernel Object Modification

• Kernel Mode Linux Rootkits

• Covert communication channels

• Spoofing endpoints of communication tunnels

• Tunneling through IPSec VPNs by abusing ESP

• Steganographic Tunnels

• Remote command execution

• Sniffing and hijacking SSL encrypted sessions

• Installing sniffers on low privilege account in

Windows 2003 Server

• Stealthy Remote keylogger installation

• Circumventing Antivirus

Cyber Forensics Expert 

• Raw binary editing to prevent forensic

investigations

• Editing the Windows Event Log

• Abusing Windows Named Pipes for Domain

Impersonation

• Impersonation of other Users- Hijacking kernel tokens

• Disguising network connections

• Attacking Cisco IOS

• Attacking STP & BGP protocols

• Wireless Insecurity

• Breaking Wireless Security – WEP, WPA, WPA2

• Blinding IDS & IPS

• Attacking IDS & IPS

Read more

HACKING GMAIL

HACKING HUNDRED'S OF GMAIL ACCOUNTS

I found a bug in the security of google accounts. I reported this to google but according to their policy it didn't qualify as a security issue from their side so I thought of sharing the Vulnerability with Hacking Tweaks family.

Whom Does this Vulnerability Target ?

The users affected are ones who give their alternative e-mail address from some sites which provide temporary e-mail addresses such as www.yopmail.com, https://www.guerrillamail.com/,http://10minutemail.com/10MinuteMail/index.html , http://getairmail.com/ ,http://www.mailinator.com/ 


How to Check for the Vulnerability ?

The following steps can be followed to check the entire process:
1.Go to https://mail.google.com .

2.Click on "Can't access my account".

3.Click on "I don't know my username".

4.Now type any username like recovery e-mail address like "xx@yopmail.com","lol@yopmail.com","haha@yopmail.com").

5.Now go to yopmail.com(or any of the above mentioned sites) and and fill in the same above typed name like xx, haha,lol in the box on the left side and click "check for mails".

6.There you will see a mail from google with the username of the person whose account was associated with the xx@yopmail.com. If there was no associated mail, then it would show that no username found in database.

7.Now that you have the username, go again to gmail.com and click on "i forgot my password"and enter the username and then enter the recovery mail which is xx@yopmail.com.

8.Now check for new mail in yopmail.com from gmail which contains password recovery mail.

9.Reset the password and vulnerability is exploited !

p.s. not all accounts of gmail are vulnerable to it, but many of them surely are as thousands of people use these temporary sites to give recovery mail.

Patching : I think google should make these temporary mail sites as exceptions in their database when user is entering the recovery mail.

Read more

HTTrack web site copier

Download all website contents/files with HTTrack web site copier!

Httrack is a free program (freeware) used to copy all contents of a website ranging from directory, files, pictures, videos and all the files into a local file (your hard drive) in the same directory as link from web site that you downloaded , All the parts that you have downloaded will be able to be opened offline.

HTTrack Website Copier, is an Offline Browser runs on Windows and Unix Copyright (C) Xavier Roche and other contributors
The HTTrack web tool is free software, we can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation.
Download , install, and go to the "Help" menu for the instructions, how to use HTTrack..

HTTrack! is a free [GPL-libre-freesoftware] and easy-to-use offline browser utility.
The program allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online. Hatrack can also update an existing mirrored site, and resume interrupted downloads. HTTrack is fully configurable, and has an integrated help system.

 Download here

Read more

Hacking Windows 8

Hacking Windows 8 User Account

Hacking windows 8 admin account or any account!” 

So…open up windows 8 box and be ready to fool around!!!! 

Let’s go…

1. Your logon screen looks like this…

2.  Insert any Linux Distro media and restart your PC.. (I will be using Ubuntu..)

3. Boot your Linux Distro media…

3. Navigate to “C:\Windows\System32″  folder  via Filesystem

4. Search for “Utilman.exe” file and rename it to “Utilman1.exe”

5. Search for “cmd.exe” file and rename it to “Utilman.exe”

6.  Now remove the linux distro media and restart your PC…

7. Again you have logon screen in front of you..

8. Click on the icon shown in the figure..

9. Whoilaaaaa! You will get a command prompt with administrator privileges…  AWESOME…

10. Type “net user add dummy password” (without quotes) in the prompt

11. Next.. type “net localgroup administrators dummy /add”(without quotes) in the prompt

12.Restart your pc, and login with your new user here its “dummy” (without quotes) with password as  “password”(without quotes).

13.  You can delete the old account(“admin” here..) from the control panel as you are the user with administrator privileges…

So…. What did we just do?????????

Now…utilman.exe is the Windows Utility manager giving you access to useful UI settings within Windows…it can be launched by clicking the icon  as we see in step 8.

It is located at “C:\Windows\System32\utilman.exe”

In step.4 and step.5… we renamed original “utilman.exe” to other name say “utilman1.exe” and  renamed command prompt file i.e “cmd.exe” to  “utilman.exe”..

So when we click the icon..utilman.exe is executed which is nothing but the command prompt( remember we are just renaming cmd.exe) 

So we get the command prompt with administrator privileges…

Next..we create an account with name as “dummy” and password as “password” in step.10 and made it an administrator account in step.11

After restarting your PC, We can now login with username as “dummy” and password as “password” and delete the old account…

Congrats you are now the administrator… 

Hope you enjoyed it..  

THANK YOU

Read more

SMS BOMBING

SMS BOMBING - FLOOD INBOX OF YOUR FRIEND WITH MESSAGES

SMS Bombing is a prank which is often played in which we send continuous text messages to the victim. The number of texts may vary from 15-20 to even 1000 ! So, I'll be sharing a method of sms bombing here and this method does not use any software to bomb, rather a bit of innovation with a plug-in.

Requirements : 

 1.Mozilla Firefox. It can be downloaded here.

 2.A Mozilla plug-in named Imacros. Add it to firefox from here.

 3.A site which allow you to send text messages with no captcha challenge and no adds between to successive messages you send.

Make sure you have installed imacros correctly and to get an icon like shown in the pic below.

        Method :  
1.Go to the site you are using to send texts.Log in there.

2.Now click on the icon of imacros from there click on "rec" and then "record".Please make sure that all tabs are closed before you click on record button.

                                 

   3.Now type the phone number of the victim and then the message.

   4.Click on "send" button.

   5.As the delivery report comes,click on "send another message".

   6.After clicking on send another message click on "stop" button in imacros.

                               

  7.Now click on "play" option in imacros.

                          
 8.You will see an option Repeat Macros.There,let the"current" be one and in "max"column write the              number of messages you want to bomb.

 9.Now click on "play(loop)".

 10.Messages will be bombed ! Happy bombing

Read more

Samurai Web Testing Framework

Samurai Web Testing Framework LiveCD !

The Samurai Web Testing Framework is a LiveCD focused on web application testing. We have collected the top testing tools and pre-installed them to build the perfect environment for testing applications.

 Download here

Read more

Origami Pdf manipulation framework

Origami 1.0 released - Pdf manipulation framework !

Origami is a framework for PDF documents manipulation written in pure Ruby. It can be used to analyze or create malicious PDF documents. Being written in Ruby, the core engine of Origami is totally scriptable and can be used for automated tasks on large sets of documents. A GTK graphical interface is also available for manually browsing through the inner objects of a PDF document.

The philosophy behind Origami is the following:
Support for both reading and writing to PDF documents. Origami is able to create documents from scratch, read existing documents and modify them. Each new feature added must be compatible with reading and writing.

Handling a large subset of the PDF specification. Origami focuses on features from the PDF specification which can be used to obfuscate documents or provide offensive capabilities. Being flexible and extensible. Origami can be used in many ways, even if you are new to the Ruby language.


Origami supports many advanced features of the PDF specification, such as:

1. Compression filters and predictor functions
2. Encryption
3. Digital signatures
4. Object streams
5. File attachments
6. AcroForms and XFA forms
7. PDF actions and annotations (including Flash)
8. Origami is open-source and distributed under the LGPL license.

New features
Here is the list of new features added in this version:

1. Support for AES256 encryption/decryption of documents.
2. Support for G3 unidimensional encoding/decoding of CCITTFax streams.
3. Support for TIFF predictor functions.
4. Enhanced support for Ruby 1.9.
5. Can now be installed as a gem.
6. Added methods for browsing pages and name trees.
7. Added a Ruby shell for quick document analysis.
8. Added a set of useful tools built upon Origami (pdfdecrypt, pdfencrypt, pdfdecompress, pdfextract, pdfmetadata, pdfcocoon, pdfcop, pdf2graph, pdf2ruby...)
9. Lots of bug fixes.

Usage Guide : http://esec-lab.sogeti.com/dotclear/index.php?post/2011/05/24/Origami-1.0-released%21

Download here:

Read more

BRUTEFORCING & PASSWORD CRACKING TOOLS

BRUTEFORCING TOOLS AND LISTS FOR PASSWORD CRACKING TOOLS

Brute Force attack is an attack which is used to get username and passwords.As the name suggests,in this attack a software forces a list of words into the username and password column and as the correct field is filled correctly,you are able to login .


Brute-force attack needs dictionary of all words or a listing of commonly used passwords. To gain access to an account using a brute-force attack, a program tries all available words it has to gain access to the account. Another type of brute-force attack is a program that runs through all letters or letters and numbers until it gets a match.

 We always search for a “Good” Word List for cracking passwords. Sometimes the word lists are able to crack the password but sometimes they fail as users are also becoming more aware and prefer keeping passwords which are more secure and consist of combination of words, numbers, shift keys etc.

So here I give you some sites which have a good amount of word lists and get updated regularly.

http://packetstormsecurity.org/Crackers/wordlists/

http://www.openwall.com/wordlists/

http://www.outpost9.com/files/WordLists.html

An old yet very reliable word list generator in “Perl’’ can be found here

http://www.securiteam.com/tools/5ZP0N20GAW.html

Some other tools which you can use for Brute forcing :

Medusa 1.5.2  - This tool is speedy, modular ,login brute forcer. It supports protocols like AFP,FTP,HTTP,VNC and many more.

http://mac.softpedia.com/get/Math-Scientific/Medusa.shtml

Thc Hydra – It is most of the times used to brute force a remote authentication service. It performs dictionary attacks against more than 30 protocols !

http://www.thc.org/thc-hydra/

Cain and Abell – This tool can recover passwords using dictionary attacks, brute force , cryptanalysis attacks , decoding scrambled passwords etc.

http://www.oxid.it/cain.html

Download 5 more tools for brute force :

http://www.ziddu.com/download/19155597/BruteForceTools.rar.html

Read more