http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2010-05-26 19:11:16 - cktricky and Web Application Security : As of the release of Burp 135 the same methodology shown in a previous post video using Android SSL enforced apps with Burp is a bit different You still need to import Burp as a CA to Android using keytool BountyCastle tool but Burp will generate certificates on the fly correctly so you no longer need to configure your own CA Cert in Burp for each App Also, if you are running Ubuntu its likely you have multiple versions of Java jvm running This affects the keytool, actually it affects the classpath location for the jar file bcprov-jdk16-141jar For instance, I had both usr lib jvm java-6-sun-16020 usr lib jvm java-6-sun-16016 So a quick fix is to perform a sudo apt-get remove sun-java6-bin sun-java6-jre sun-java6-jdk and then sudo apt-get install sun-java6-bin sun-java6-jre sun-java6-jdk Then move the bcprov-jdk16-141jar file back into your newest jvm directory as of now 16020 Happy Hacking http://www.secuobs.com/revue/news/225910.shtmlhttp://www.secuobs.com/revue/news/225910.shtml Secuobs.com : 2010-05-20 00:30:03 - cktricky and Web Application Security - Thanks to a tip from a friend it turns out I've had the wrong version of DirSnatch posted all along Nobody complained so I had no clue My apologies, this was developed while on travel and well stuff happens To sum it all up, a working version of DirSnatch_v21 both source executable have been uploaded To recap The 21 version has the following mods 1 Added tab to export all directories sub-directories in URL format so that you can test each for PUT see DirChex or whatever else you may need this for 2 Progression bar so you can see the status 3 Better threading to keep the GUI functional Happy Hacking cktricky http://www.secuobs.com/revue/news/223767.shtmlhttp://www.secuobs.com/revue/news/223767.shtml Secuobs.com : 2010-05-06 03:46:34 - cktricky and Web Application Security - As a follow up to the post regarding intercepting Android applications on the emulator using Burp, I wanted to give a solution for intercepting applications on the Android that enforce SSL TLS correctly I ran into this problem with an app that enforced SSL TLS The app refused to communicate with Burp because of the certificate mismatch error Unlike a browser you don't have the option to make an exception Hence the app died and at the time I couldn't perform testing This video provides a solution I cooked up by reading some manuals and searching the web Enjoy Android SSL Enforced Apps Burp from cktricky on Vimeo Happy Hacking http://www.secuobs.com/revue/news/219311.shtmlhttp://www.secuobs.com/revue/news/219311.shtml Secuobs.com : 2010-04-29 22:23:40 - cktricky and Web Application Security - Quick post, I just wanted to give some instructions on using BurpSuite when attempting to proxy traffic coming from the Android Emulator In order to do this you will want to use Ubuntu I've got it working on both Ubuntu 904 910 Don't even try with Windowsits not worth the headache 1 Download the Android SDK Here 2 Extract it somewhere I chose home dojo Yes I'm giving the example on the web security dojo VM - 3 Navigate to the extracted folder For instance, home dojo android-sdk-linux_86 tools 4 Once in the tools directory DO NOT INSTALL AS ROOT type android to start up the SDK install 5 At this point you should see the following screen IMAGE 6 Navigate to 'Available Packages' on the left pane, click on the check box and select the following four packages as shown in the figure below IMAGE 7 Choose to 'Accept All' and then click install IMAGE 8 Now close the dialog box and close the android application 9 Now restart the android application and navigate to 'Virtual Devices' on the left pane IMAGE 10 Select 'new', give it a name, select 'Target' and choose 'Android 21- API Level 7' Click 'Create AVD' 11 Start up Burp this is assuming you have Java installed btw, make sure you do, just google installing java on Ubuntu Change Burp proxy from Listen on loopback interface only TO Support invisible proxying for non-aware clients IMAGE 12 Close out the android application In the same directory launch emulator Do so using the following switches as an example IMAGE emulator -avd my_avd -http-proxy http 127001 8001 My Burp instance is running on port 8001 13 If everything went smoothly, Android booted up and all web traffic is proxied via Burp You can test by opening the browser IMAGE Note If you'd like to see the responses coming back to the application ensure you modify your proxy options to intercept server responses if and add the line I've highlighted in the figure below IMAGE http://www.secuobs.com/revue/news/217419.shtmlhttp://www.secuobs.com/revue/news/217419.shtml Secuobs.com : 2010-04-12 08:37:44 - cktricky and Web Application Security - I've spent way too much time dealing with a challenging situation while using Ruby's OptionParser class and I wanted to give the solution that I found because maybe one day someone else who is beating their head against a desk will stumble on this I created a -u, --username switch for the CLI Code Snippet optson -u , --username , Enter your e-mail username do u options username uend and called it for purposes of testing by options OptparseExampleparse ARGV puts options username Now the problem is I wouldn't receive the actual string value that followed the -u or --username switch back So -u cktricky came back either nil or truenot much of a help After hours of confusion, literally hours, and although I feel pretty ignorant right about now I am going to tell you what the problem was highlighted the change optson -u , --username USERNAME , Enter your e-mail username do u options username uend So, the only change here was that I added USERNAME could be any string you wanted basically I thought the on method chose the parameters via comma separation like any normal array iteration Turns out I was wrong Total and utter weirdness With that I am going to go bandage my head - http://www.secuobs.com/revue/news/211000.shtmlhttp://www.secuobs.com/revue/news/211000.shtml Secuobs.com : 2010-03-20 09:08:55 - cktricky and Web Application Security - To the readers of this blog, This blog has been inactive for about a month but it has nothing to do w a standstill on my part I will post something useful relatively soon but please know I am co-authoring another AppSec specific tool and this takes up the majority of my time Hopefully when the software open source is released it won't disapoint - Cheers, cktricky http://www.secuobs.com/revue/news/203641.shtmlhttp://www.secuobs.com/revue/news/203641.shtml Secuobs.com : 2010-02-12 00:00:54 - cktricky and Web Application Security - Update DirChex_v13 has been created for BackTrack 4 should also work for most Debian distros This is the GUI version which also has can test an App for vulnerable PUT enabled directories So, two new releases two different programs Busy day Also, due to some requests for a Non-GUI Console based only version of DirChex this will be in the works along with some added features for path mutation Download Here Happy Hacking cktricky http://www.secuobs.com/revue/news/191130.shtmlhttp://www.secuobs.com/revue/news/191130.shtml Secuobs.com : 2010-02-11 18:49:23 - cktricky and Web Application Security - New Version of DirSnatch can be downloaded Here So briefly I wanted to describe the new version of DirSnatch Just as DirChex tool for automatically requesting a list of URLs from a text thru your proxy had a modification with the PUT tab so has DirSnatch RUNDOWN DirSnatch will allow you to save two different files One dumps a web directory list in the full URL format DirGet tab Sooo C inetpub public indexasp becomes http examplecom public indexasp so on and so forth The other DirPut will dump the web directory with only the directories sub-directories still with URL format so that we can automate the request of testing each directory for a vulnerable PUT permission issue Sooo C inetpub public indexasp becomes http examplecom public BENEFIT The benefit of the new tab is the following If you'd like to use Burp Suite or DirChex to test each directory for PUT the format that DirPut lists each directory in is suitable for simply concatenating the URL a test file MEANING When using the DirChex PUT tab you can provide a name of a file you would like to upload to the target Web App's directories, choose the the txt file containing URLs dumped with DirSnatch_v21 DirPut and it will do the concatenation and request for you Voila PIC OF NEW VERSION IMAGE Thoughts, comments, suggestions are welcome Happy Hacking cktricky http://www.secuobs.com/revue/news/190981.shtmlhttp://www.secuobs.com/revue/news/190981.shtml Secuobs.com : 2010-02-03 19:59:45 - cktricky and Web Application Security - After what seems to be the hundredth time of explaining to a developer that hidden form fields mean nothing, client-side JavaScript controls are great for optimization but not for security blah blah blah I started thinking that if developers performed one or two dynamic analysis tests with an experienced AppSec consultant we'd be in a lot better shape Consider that there is a large number of developers out there that have never actually viewed an HTTP request response sequence Developers that aren't familiar with what is actually being passed in the ViewState and have no idea just how easy and quickly numerical, seemingly random character sequences and other controls can be iterated through and stomped all over Good application security consultants are expected to have some development experience There are subtle nuances, coding decisions and framework protections that have to be taken into account and ultimately play into not just discovery of findings but considerations for mitigation To summarize, if it helps me the security consultant to build applications, utilize the latest and greatest whether it be Flash, HTML 5, or simply a newer framework in order to fully grasp my chosen professionshouldn't this mentality be the same for developers http://www.secuobs.com/revue/news/188259.shtmlhttp://www.secuobs.com/revue/news/188259.shtml Secuobs.com : 2010-01-18 23:39:37 - cktricky and Web Application Security - Quick Note There were some issues with DirChex on some machines after compilation relating to handling response code errors performing the PUT option This has been fixed by changing compilation options Feel free to Download again Apologies for the inconvenience Happy Hacking cktricky http://www.secuobs.com/revue/news/182920.shtmlhttp://www.secuobs.com/revue/news/182920.shtml Secuobs.com : 2010-01-10 22:18:23 - cktricky and Web Application Security - Background Recently I was having a discussion with some folks about Web Security and amongst some of the items discussed was Single Sign-On It reminded me of SiteMinder and some things that bothered me about how some organizations utilize the solution Especially the blind reliance upon the vendor to have written a secure solution rather than verifying if this technology is being employed correctly Sometimes its not the software created it is the folks that configure it that cause the headache Sometimes the biggest flaw is the inherent nature for which the software was intended to be used in the first place When you configure this incorrectly AND you do it at the Single Sign-On server level it can literally be an epic fail In a large organization it can potentially leave hundreds or even thousands of sites open for compromise So I first noticed the odd configuration and therefore the potentially insecure nature of SiteMinder approximately 1 year or so ago can't remember, could have been longer I thought I would share some of details with you the reader to give a better idea of where some of the pitfalls might exist and maybe this helps someone who is charged with installing configuring the SiteMinder solution in the future I really don't believe this could be ONLY a SiteMinder specific issue My personal belief is this can hold true for any Single Sign-On solution if improperly managed Now keep in mind I am not a full-time researcher That being said, this is simply what I've observed Also, I encourage anyone reading this to invest some time playing around with the technology Don't just take my word for it I will not detail the EXACT steps for correct configuration but more of a broader approach to where things I've seen things go wrong and some proactive steps to take First lets talk about the benefits of SiteMinder SSO 1 Can be used as a means of verifying and or restricting the user before ever viewing the application As an attacker I may not need to be logged in to cause damage So having anonymous access to the unprotected portion of your site could still be used as a launch platform for another attack such as XSS, SQLi, abuse of account registration, password recovery, default content discovery etc, etc 2 Can be configured to require two factor authentication 3 Has the ability to provide either two-factor authentication Common Access Cards OR if your users do not have access to CAC equipment this allows for form based authentication as well So it is convenient 4 A bit more difficult to brute force login credentials AND can enforce account lock-out while mitigating other security concerns like registration, etc However, this is a very general statement and in many cases isn't implemented correctly 5 Simple account management This doesn't requires a user to remember, or jot down on a sticky pad - , their user-name and password to a large number of applications Lets detail some of the drawbacks 1 The solution is not infallible but in the cases I've come across is treated as such 2 If one site fails at any number of things other sites can become targets of attack and possibly victims of a compromise 3 The user privacy issue ESPECIALLY when employing CAC PKI authentication The data held on a user's Common Access Card can be logged on the web application they are using and in some cases most certainly is for troubleshooting purposes The data within their CAC can hold valuable information about the individual that certainly wouldn't allow anyone to view, so why would a web app developer need this information to the purposes of troubleshooting the SiteMinder solution This basically boils down to trust I suppose and I'm sure can be argued in length about Details of the SiteMinder authentication what I've observed 1 A user requests target URL https examplebigcorpcom 2 User is then redirected to https ssoserverbigcorpcom 3 The user submits a request with https ssoserverbigcorpcom SmMakeCookie xxxxxx 4 The ssoserver site is checking to see if we already have a valid session 5 The normal response is to set a HTTP 302 method with a redirection to https examplebigcorpcom with a parameter SMSESSION NO This basically tells the applications that this user does not have a valid SiteMinder session and must authenticate 6 At this point https examplebigcorpcom provides a HTTP 401 authorization required message and sets the browser's cookie as SMCHALLENGE YES Now keep in mind, these are two different sites so the SSL stream is broken by default and because of this it will work even if one application does not employ SSL This is important when dealing with sites that have Forceful Browsing vulnerabilities or simply not using SSL 7 So now the user's browser sends a request to https examplebigcorpcom with basic authorization and a cookie - SMCHALLENGE YES 8 The response from https examplebigcorpcom is a redirection HTTP 302 to https ssoserverbigcorpcom with the session value in the query For example, https ssoserverbigcorpcom smmakecookieccc SMSESSION SM-ABC123 PERSIST No Target https examplebigcorpcom NOTE This is bad This value is sent in the header of the request and is now stored in three separate locations 1 Proxy logs 2 Server side logs 3 In the users browser Additionally, this value is your Master Key AND in may cases is not set to expire for some time for user friendly purposes 9 Simultaneous with Step 8, https examplebigcorpcom is now performing a set-cookie SMSESSION-ABC123 path secure and this is within the 302 redirection response So take note that the secure flag is set and the path is for the examplebigcorpcom BUT no HttpOnly flag This means that client side Javascript can interact with the cookie 10 So as stated previously in step 8 we are sending a GET request to https ssoserverbigcorpcom SMSESSION ABC123 PERSIST No Target https examplebigcorpcom NOTE The target value has special characters URL encoded 11 The response from https ssoserverbigcorpcom is a redirection HTTP 302 to https examplebigcorpcom with a set-cookie SMSESSION-ABC123 path domain bigcorpcom secure 12 The user's browser sends a request to https examplebigcorpcom loginaspx The referrer is set as examplebigcorpcom and now two SMSESSION cookie values are provided set In this initial request both SMSESSION values cookie are set as SMSESSION-ABC123 and passed to the application in the subsequent request 13 Now the user is redirected via a HTTP 302 to https examplebigcorpcom protected defaultaspx and the new SMSESSION value set following the first request is XYZ123 Remember the user will always pass two SMSESSION values One of those values is the Master Key SMSESSION-ABC123 and SMSESSION-XYZ For all subsequent requests to resources on examplebigcorpcom the SMSESSION value will be checked If you have this value then you are allowed into the site with the caveat being that your ssoserver account must have permissions to view this application Security Concerns 1 XSS will allow anything bigcorpcom to be taken, which of course includes the Master Key SMSESSION value which is stored as a bigcorpcom cookie value CAVEAT XSS must be performed on a bigcorpcom site otherwise the domain mismatch will not allow the cookie value to be stolen An attacker can replay this cookie query value to gain access to a list of bigcorpcom sites details - Number 6 2 The SMSESSION value is stored in the browser cache due to the fact that a GET request was sent with the value in the header 3 Usually this value does not expire for quite some time 4 If the application does not enforce SSL this value will be shown in clear-text across the wire 5 Due to the fact the HttpOnly flag is NOT set, Javascript can interact with the cookies 6 Any application the user has access to can become a potential target The applications which employ the SiteMinder agent will check to see if the user already has a valid SiteMinder session If the Master Key SMSESSION-ABC123 is employed, the ssoserverbigcorpcom will recognize this as a valid SMSESSION when the attacker s browser is redirected to the ssoserver for an active session validation Once the ssoserver determines the cookie value provided by the attacker is a valid session value the attacker is given the necessary SMSESSION cookie for accessing the target web application 7 The SMSESSION value, in all of the instances for which I ve observed, are not salted by IP nor limited by session This means simultaneously a user in Egypt can access an application utilizing the same SMSESSION value a user in Canada is currently using http://www.secuobs.com/revue/news/180059.shtmlhttp://www.secuobs.com/revue/news/180059.shtml Secuobs.com : 2010-01-06 21:51:35 - cktricky and Web Application Security - As an update I've just uploaded DirChex_v13 which will NOT freeze up while sending the requests you specify Also because the GET requests PUT Requests GUI all have separate threads you can basically do more at once without worrying about it Its just a nice enhancement Download 13 Here Happy Hacking http://www.secuobs.com/revue/news/178917.shtmlhttp://www.secuobs.com/revue/news/178917.shtml Secuobs.com : 2010-01-03 23:53:39 - cktricky and Web Application Security - The new version of DirChex is ready and available for download Download Here So k3r0s1n3 is on the hook for creating the visual layout of a BT4 specific version - BUT we do have a the exe version and source available for v12 In the meantime, the BT4 specific version of 11 will remain up on the downloads page Also, I'd love to hear from someone with a mac OSX and see how it goes running DirChex on this platform Moving along DirChex now has two tabs A 'GET' and a 'PUT' tab IMAGE We've already pointed at how the GET tab works in previous posts For the 'PUT' tab things get a bit different For one, the HTTP method is obviously PUT vice GET Secondly, you have more options Thirdly, the file you upload must have the list of URLs in the proper format otherwise the reason for using it is negated Correct http wwwexamplecom http wwwexamplecom example Incorrect http wwwexamplecom http wwwexamplecom example NOTICE THE FORWARD SLASHES ARE MISSING A file containing correctly formatted URLs IMAGE Now for the options The first options are obvious and the same as the GET tab You need to choose an input file like the one above Then select either the default proxy ip port options or enter your own The next couple of options require a bit of explanation OPTION Name of the file to PUT If I want to create a testtxt file on the remote application I would enter testtxt in this field OPTION Text within the field This is where you would enter the text you would like place in the testtxt file I've entered This is my example text OPTION Choose content-type MIME Property Here you would want to select the various available content-types MIME Media If you are unsure just choose the first available choice 'application x-www-form-urlencoded' OPTION Choose your user-agent This one is self explanatory When all options are correctly filled in it should look like this IMAGE This is what the request would look like in raw form using Burp Suite IMAGE If you have any questions comments let us know, suggestions are welcome Lastly, we are aware that the program freezes up until all requests are completed Apologies, we are working on this For now, some functionality was added and I hope you find it useful Happy Hacking cktricky k3r0s1n3 http://www.secuobs.com/revue/news/177700.shtmlhttp://www.secuobs.com/revue/news/177700.shtml Secuobs.com : 2009-12-18 19:25:14 - cktricky and Web Application Security - Today I was asked to give a proof-of-concept as a fun way of entering the holiday season The idea was to prove why file upload without extension file type checking can be dangerous The target client and web server were both using A V We already knew it was possible to upload whatever type of file you chose The question was, as the administrators demanded would be the case, would the A V stop such an attack The answer Using solely the technique gained Here , which is Mubix's sitesadlythe answer is NO Now a week ago this would have worked Recent A V updates have changed that So how to get around it Note I've been warned by carnal0wnage that this technique will most likely flag on some products because of the UPX packing That being said, it worked great against the A V and it turned out to be a fun day Instructions Create and encode the meterpreter payload as instructed on Mubix's site link above Download the UPX packer Here I chose the upx-304-i386_linuxtarbz2 for BT4 Now simply bunzip2 tar -xvf the file and cd into the upx directory Perform a upx and consider the file packed Happy Hacking http://www.secuobs.com/revue/news/173991.shtmlhttp://www.secuobs.com/revue/news/173991.shtml Secuobs.com : 2009-12-11 21:13:45 - cktricky and Web Application Security - I'm sure most folks have already used this feature but for those that haven't, I came across a situation recently where I was asked to test an Intranet application and found the 'do WWW Authentication' piece of functionality made life much easier for me So as you may know from my earlier post regarding extracting HTML comments using DirChex, Burp Suite and a Burp Suite Plugin this process is very quick and very simple DirChex is basically a dumb application It is fed a list of URIs like so http wwwexamplecom indexhtml http wwwexamplecom protected shouldn't_be_availablehtml http wwwexamplecom hidden mydatabasedumptxt http wwwexamplecom protected TheMetsSuckhtml That last line was for you Jack and it blindly requests each URI thru the proxy of your choice The whole idea is to view the request response as an unauthenticated user I provide no options for setting a cookie sessionID login creds Here is the problem I ran into I'm testing an Intranet application, the application uses NTLM which is tied to your Windows Domain account to receive access to the main page of the application Only after you've first authenticated via your domain account will you have access to the actual application which has a login form, technically your half authenticated So to test the unauthenticated portion you technically have to be authenticated - This is where you can save your self some time If you utilize the 'do WWW Authentication' option every request that is sent via Burp will automatically have the NTLM Basic Digest credentials included Navigate to the 'Comms' tab 'Options' tab in later version and fill in the following IMAGE Hope this helps someone Happy Hacking http://www.secuobs.com/revue/news/171103.shtmlhttp://www.secuobs.com/revue/news/171103.shtml Secuobs.com : 2009-12-10 04:22:26 - cktricky and Web Application Security - Hey folks, Just as an update, if you downloaded the Backtrack 4 DirChex_v11 tool and are having issues with the install relating to the apt-get install libXXXX portion, ensure you enter apt-get update FIRST so that the newest packages and their corresponding locations are up to date Happy Hacking http://www.secuobs.com/revue/news/170418.shtmlhttp://www.secuobs.com/revue/news/170418.shtml Secuobs.com : 2009-11-06 03:33:33 - cktricky and Web Application Security - Today's Burp Suite Tip of the Day is a video showing quite a few things 1 How to compile and package the Burp Extender utilizing BackTrack 4 2 We build the plug-in coded by Daniele Costa ref portswiggernet 3 How to install DirChex on BT4 4 How to utilize both DirChex and BurpSuite along with plug-in to extract all html comments from a web application You can download DirChex at DirChex Project Page Enjoy Happy Hacking cktricky BurpSuite Tip of the Day - Extracting HTML from cktricky on Vimeo IMAGE http://www.secuobs.com/revue/news/158085.shtmlhttp://www.secuobs.com/revue/news/158085.shtml Secuobs.com : 2009-11-04 21:58:51 - cktricky and Web Application Security - Hey folks, As promised k3r0s1n3 has delivered We now have a BT4 specific version of DirChex_v11 available If you navigate to the DirChex Project Page you can download the zip file containing the program and the install script Just unzip the file, 'cd DirChex_v11' and then 'bash installsh'that is about it Then fire up the program 'ruby DirChex_v11rb' Okay folks so here is a screenshot IMAGE k3r0s1n3 is the man for whipping this up in such short time You can visit his blog Here Also SPECIAL thanks to mubix for helping to troubleshoot various errors for the release Without his help the program wouldn't be a fully functioning stand-alone windows executable Happy Hacking IMAGE http://www.secuobs.com/revue/news/157432.shtmlhttp://www.secuobs.com/revue/news/157432.shtml Secuobs.com : 2009-11-04 02:19:05 - cktricky and Web Application Security - So, in case you were annoyed by the exe version of DirSnatch opening a console window along with the main programyou will be happy to know this has been removed I've uploaded a recompiled version which does not require the console window pop-up It can be downloaded at the same location as always which is the DirSnatch Project Page Cheers, cktricky Happy Hacking IMAGE http://www.secuobs.com/revue/news/156951.shtmlhttp://www.secuobs.com/revue/news/156951.shtml Secuobs.com : 2009-11-03 22:39:43 - cktricky and Web Application Security - Hey folks, for those of you who create wxruby apps and package them with OCRA but customers receive an error Windows about MSVCR or MCVCP missing or something along those lines here is what you do Simply copy over your DLL files the ones the app complains about to Ruby bin then run OCRA like so C ruby lib ruby gems 18 gems ocra bin ocra -dll MSVCR dll -dll MSVCP dll AND you will be in business Cheers, cktricky IMAGE http://www.secuobs.com/revue/news/156872.shtmlhttp://www.secuobs.com/revue/news/156872.shtml Secuobs.com : 2009-11-03 04:28:05 - cktricky and Web Application Security - As promised the follow-up program to DirSnatch 'DirChex' has been released You can download the tool Here The tool automates the task of requesting a list of URLs via an intercepting proxy with the User Agent of your choice Right now the layout suxx for BT4 so I wouldn't even bother trying BUT in case you wanted to the README offers up some instructions Lots of upgrades and different stuff to do so please let us know if you have problems, requests, etc they are all welcomed By us I mean k3r0s1n3 and I Here is a screenshot IMAGE One last thing, additional usage instructions for the tool are located on k3r0s1n3's blogs Happy Hacking IMAGE http://www.secuobs.com/revue/news/156446.shtmlhttp://www.secuobs.com/revue/news/156446.shtml Secuobs.com : 2009-10-29 16:57:53 - cktricky and Web Application Security - So I woke up this morning to this letter My favorite part you ask That this guy is faithfully mine No thanks Dr KwadoI'm good Anyways, please enjoy the letter as much as I did Dear Partner, I guess this letter may come to you as surprise since I had no previous correspondence with you I am the Chairman of the Electoral Commission Ghana EC I got your contact in my search for a reliable person to handle a very confidential transaction involving the transfer of the sum of 14500000 Dollars Fourteen Million Five Hundred Thousand United States Dollars the above fund is not connected with arms, drugs or money laundering It is the product of an over invoiced contract awarded in 2008 by EC to a foreign company for the supply of electoral materials that were used for conducting the 2008 elections The contract has long been executed and payment of the actual contract amount has been made to the foreign contractor leaving the balance of 145 million which my colleagues and I now want to transfer out of Ghana into a reliable foreign account for our personal use As civil servants we are not allowed to run foreign accounts Hence we have chosen to front and support you as the beneficiary to this funds If you are interested in the proposal kindly get back to me by sending me your letter of acceptance along with your direct telephone and fax numbers, we have decided to share the money in the following percentage, 60pourcents for us 30pourcents for you the account owner and 10pourcents for all local and international expenses that may arise in the course of this transaction Further details about this transaction will be discussed in subsequent correspondence Note also that the particular nature of your business is irrelevant to this transaction and this transaction is expected to be concluded within 5 working days since all local contacts and arrangements are in place for a smooth and successful conclusion of this transaction Contact me via email with your contact telephone and fax numbers, so that I can call you for a discussion Thank you as I await your response yours faithfully, DrKwadwo Afari IMAGE http://www.secuobs.com/revue/news/155267.shtmlhttp://www.secuobs.com/revue/news/155267.shtml Secuobs.com : 2009-10-25 07:06:18 - cktricky and Web Application Security - Hey guys, well my brother k3r0s1n3 and I decided to give an upgrade to DirSnatch before moving on to QwickR which is sort of like part 1 or 2 Feel free to download the app at the DirSnatch Project Page Anyway, here are some pics of the new version IMAGE Choosing directory to list IMAGE Choosing either http or https to prepend IMAGE Location to save the list to IMAGE This is what it will look like when all options are chosen IMAGE Beyond the obvious visual changes we've included error handling in this version Okay folks, next up, QwickR Happy Hacking IMAGE http://www.secuobs.com/revue/news/153854.shtmlhttp://www.secuobs.com/revue/news/153854.shtml Secuobs.com : 2009-10-23 09:29:52 - cktricky and Web Application Security - Hey all, as promised I have something coded up and it works well enough to release Still a lot of functionality to add so you can give your customers something nice to look at it and fairly dummy proof DirSnatch, the script I wrote with k3r0s1n3 was really something my customers liked due to expedited testing times but was basically really ugly It was ugly because it was a dreaded console app Okay, so using the ruby gems 'ocra' and 'wxruby' k3r0s1n3 and I were able to create a windows based stand-alone executable in GUI form Again, there is a TON to add to this tool and make it just cooler to work with Also, we are working on making Qwickr formerly qwick_request GUI Qwickr currently allows you to request URLs in a text file such as the output from DirSnatch in a threaded fashion thru the intercepting proxy of your choice This is also helpful if you intercepting proxy doesn't allow you to save the URLs you've spidered This creates a site map in no time The console version of Qwickr is finished but we don't want to release until its functioning as a GUI app So be on the look out for that Here is a screen shot of DirSnatch_v11 IMAGE This is what the outputtxt looks like IMAGE So the new version can be download Here The file annotated GUI_DirSnatchrb works on linux but you must perform a 'gem install wxruby' Happy Hacking IMAGE http://www.secuobs.com/revue/news/153391.shtmlhttp://www.secuobs.com/revue/news/153391.shtml Secuobs.com : 2009-10-20 22:58:05 - cktricky and Web Application Security - For those that follow this blogI'm working on building some utilities for folks who manually test When something works well enough to hand out I will post the code and or the link to download the code IMAGE http://www.secuobs.com/revue/news/152345.shtmlhttp://www.secuobs.com/revue/news/152345.shtml Secuobs.com : 2009-10-10 19:18:51 - cktricky and Web Application Security - Hey folks, mubix informed me that he has made a change to the DB export of Nikto If you would like to see the improved command for extraction of the Nikto db_tests for use with Intruder please visit his site at Room362 IMAGE http://www.secuobs.com/revue/news/149286.shtmlhttp://www.secuobs.com/revue/news/149286.shtml Secuobs.com : 2009-10-09 22:55:57 - cktricky and Web Application Security - Its Friday, oh how we love Friday Anyways, courtesy of mubix we have a command to export the Nikto DB into a format suitable for Intruder If you have any questions about how to load into intruder reference the other posts I take no credit for this, mubix came up with this command So in BackTrack3 you can use the command cat pentest web nikto plugins db_tests awk -F , ' print 4 ' sed 's s ' sed 's CGIDIRS s ADMIN s NUKE s POSTNUKE s PHPMYADMIN ' sed 's ' nikto_burptxt or in BackTrack4 cat var lib nikto plugins db_tests awk -F , ' print 4 ' sed 's s ' sed 's CGIDIRS s ADMIN s NUKE s POSTNUKE s PHPMYADMIN ' sed 's ' nikto_burptxt Like so IMAGE and this will export the contents of the nikto db_tests into a txt file and in the format Intruder prefers Should look like IMAGE There you have it Make sure you show mubix some love by visiting his site Room362 and remember that PortSwigger just released Burp Suite Pro v217 which has an xml export for the scanner findings suitable for Dradis import Happy Hacking IMAGE http://www.secuobs.com/revue/news/149138.shtmlhttp://www.secuobs.com/revue/news/149138.shtml Secuobs.com : 2009-09-27 03:57:37 - cktricky and Web Application Security - Last week I showed you a couple of Oracle payloads you could load up into the intruder preset payload list Here I'm sure at least one person thought to themselves, instead of loading the list from a file and keeping track of various files can't we just add this to our fuzzing list permanently The answer is yes and we will walk thru it together The first thing we need to do is unzip our burpsuite jar fileI'm using 7zip which you can obtain here IMAGE We now have a newly created folder containing the files that make up burpsuite IMAGE Open the newly created folder and navigate to burp PayloadStrings and open the file you would like to edit In our case, this file is 'fuzzing - fullpay' I am using SciTe to edit the file but you can also use something like notepad IMAGE So go ahead and make your changes, I've added the Oracle payloads as mentioned before IMAGE Save the file and exit Zip the the contents of the folder as a JAR file like so IMAGE Okay, well I moved this jar file back into the C burpsuite_v12_pro directory and deleted the C burpsuite_v12pro burpsuite_pro_v1216 folder Now lets start it up and check to see if it worked IMAGE Yep, it worked alright Okay, so if you have any questions feel free to ask Happy Hacking cktricky IMAGE http://www.secuobs.com/revue/news/144824.shtmlhttp://www.secuobs.com/revue/news/144824.shtml Secuobs.com : 2009-09-24 20:58:26 - cktricky and Web Application Security - Today I am just giving a cheat sheet for loading into Burp via the Intruder Preset List Payload Set This list contains known Oracle owa_utilcellsprint bypasses minus the first one This way you can detect whether or not you have a vulnerable stored procedure Probably not a good idea to have the PL SQL gateway out in the open but if it is now you can detect whether or not its easily exploited The preset list contains owa_utilcellsprint p_thequery select 1 from dual pourcents0Aowa_utilcellsprint p_thequery select 1 from dual SpourcentsFFSowa_utilcellsprint p_thequery select 1 from dual SYS owa_utilcellsprint p_thequery select 1 from dual owa_utilcellsprint p_thequery select 1 from dual NOTE STRIP THE QUOTATION MARKS OUT FROM ENCLOSING LBL SO IT IS ONLY LBL I just had to enclose them to bypass blogspot's filter So create a notepad file containing this list Send request for http serverexamplecom pls dad vulnerable_procedure into Intruder Navigate to Intruder Positions and add position markers around vulnerable_procedure like so IMAGE Navigate to Payload Preset List and click 'load' IMAGE Open the oracle payload file IMAGE Then start IMAGE If you have a 403 response you know you won't be able to access this Otherwise, game on Happy Hacking IMAGE http://www.secuobs.com/revue/news/144125.shtmlhttp://www.secuobs.com/revue/news/144125.shtml Secuobs.com : 2009-09-23 18:15:55 - cktricky and Web Application Security - Previously, we had discussed using Intruder to brute force authentication by utilizing the Intruder's 'preset list' payload set Now we will discuss using the ACTUAL Intruder brute force payload Now of course we are all aware of what comes to mind when you say Brute Force but what about another use What if crappy entropy produces a value that is say AJJDAJJDASDFHGHABC but only the last three characters ABC change This could be a session value and could be attacked as discussed in Sequencer Entropy OR it could be value such as 'resource ' which renders sensitive content Your profile and the resource it can access might be client-side controllable and it may be as simple as iterating thru all possible combinations of that value In our scenario we will say that our sequencer has informed us of the weak entropy and those last three characters iterate between different combinations of ABCDEF but not the rest of the alphabet and only use upper case characters By now I assume you know how to load a payload or 'request' into Intruder If not, reference any of the other BToDs for clarification Navigate to Burp Intruder Positions Tab Add position points around 'ABC' since this is what we will be iterating thru and collecting the responses Should look like this IMAGE Next, navigate to Intruder Payloads Drop down the payload set list and choose 'brute forcer' IMAGE In the picture below I show what the default settings are and the 4 settings we care about Remember we know we will only use the characters ABCDEF, they will only be three characters and finally they will always be uppercase IMAGE Character set - only include the characters we are interested in, the min and max length is 3 and case is Uppercase Should look like this IMAGE We are all set Now start attacking IMAGE Use the results to check for byte length if attacking a session or save the responses to prove to your customer you can view data that you should not be able to Either way, enjoy Happy Hacking IMAGE http://www.secuobs.com/revue/news/143601.shtmlhttp://www.secuobs.com/revue/news/143601.shtml Secuobs.com : 2009-09-22 21:20:17 - cktricky and Web Application Security - Been busy lately, haven't had much time to perform updates of the Burp Suite Tip of the Day Today I'd like to cover a couple significant utilities included with the Burp Suite Much of the appeal with this Suite, at least for me, comes not only with the functionality but also the aesthetics When you spend about 10-12 hours a day using this tool you begin to appreciate the subtle improvements that have occurred with every upgrade Even for the 'free' versions user base there is a noticeable difference between 11 and 12 Lastly before we start, I'd like to recommend as always that a Pro version upgrade be purchased at some point if you find the free version useful Its 202 so its not much You can do so Here Navigate to Target Site Map because this is where we will identify a few of the useful features here Mostly we use the filter options, or at least I do, to cut down on what I like to call noise Really all that means is sometimes the amount of data can be overwhelming and I am only looking for specific things Why not filter for those items Open the filter options by clicking here IMAGE Now out of all the sites listed in the site map tab we only need two We will focus on http twittercom and https twittercom http s is important disctinction to remember when testing a site One thing I remind folks of is to always add both the HTTP and HTTPS versions of the target application in the the Target Scope just in case the site requests resources such as image files over HTTP therefore potentially negating the reason for using SSL if session cookie values are sent in that request Easy way to add them at the Target Site Map tab is like so IMAGE Okay now that these are added to our scope, lets use the filter option to view only those two applications and cut down on the noise Open the filter again You will see four columns 1 'filter by request type' 2 'filter by MIME type' 3 'filter by status code' 4 'folders' Under the first collumn check 'show only in-scope items' This will allow you to view only the two applications we've just added to target scope IMAGE Afterwards, you will notice a more focused site map IMAGE The next option under this same collumn is 'show only requested items' This is shows pages requested either by the spider or you via browser or if you have a other programs going requesting thru Burp sayscreen scraping script nikto wikto etc No need for a demo here Simple Show only 'parameterised requests' is pretty cool If you've gone about the business of submitting every form or even if you haven't and spider has crawled pages with parameterized queries its great to show these points of input so you can logically step thru them and keep track of your attack The results render a gear to the left symbolizing them as parameterized queries I've highlighted the gears IMAGE Most of this stuff is self explanatory but just remember what I said about an HTTPS site requesting a resource such as images while including an important session value over HTTP This means you actually have to show the images So click on that option under 'filter by MIME type' IMAGE Navigate to the Proxy History tab The filter options are pretty much the same really However, what I'd like to show is in the actual history itself So I've chosen NOT to 'show only in-scope items' to show a distinction IMAGE Often times when testing I ask, okay, so when was the last time my cookie was set or where was it first set The 'cookies' section I've highlited actually shows which cookies were set by request number and the time Pretty cool stuff, keeps a lot of re-work down to a minimum when answering session related questions I've also highlighted the row we will double-click to show the response containing the 'set-cookie' IMAGE Finally, after we have opened up the request response which triggered the cookie value, we navigate to the response tab and here the set-cookie s were highlited IMAGE All of this is fairly basic but nonetheless useful if you are new to Burp Suite Happy Hacking IMAGE http://www.secuobs.com/revue/news/143322.shtmlhttp://www.secuobs.com/revue/news/143322.shtml Secuobs.com : 2009-09-21 20:01:20 - cktricky and Web Application Security - This morning, tried running nmap for the first time via VPN which means dual interfaces meaning dual routes to target etc etc and since this is a windows box the nmap -e wasn't working for me I received the failed to determine dst mac address for target error Anyway, the solution I found worked and it was simple Find your mac address, ipconfig all or arp -a and tie it to the current VPN IP From windows command line just enter arp -s vpn ip mac address When you run nmap it should work cktricky IMAGE http://www.secuobs.com/revue/news/142904.shtmlhttp://www.secuobs.com/revue/news/142904.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - So below you will find the source code of little tool my brother and I wrote one rainy Sunday afternoon This allows for export of the directory listing from a web root into a text file AND in the format that makes sense Mostly we got tired of customer's giving us a tree F garbage_outputtxt type outpute file You can use this along with an automated request tool I wrote one but error handling sucks, will be posted soon or you can remove not prepend the URL and use BurpSuite intruder Basically, Nikto Wikto DirBuster produces false positives and if you are lucky enough to have a greybox approach your customers should have no problem running this Obviously tools like Nikto still contribute better to some of the runtime checks like Directory Traversal Ruby 186 is required so I also created an exe version which does not Both the ruby and exe version can be downloaded here If you like the tool or have questions comments you can reach either of us at twittercom cktricky or twittercom k3r0s1n3enjoy require 'find' puts Please enter the full path to the Web directory you wish to list Allows user to input a search dir directory getschomp defines directory as users input path filetype puts Please enter your Website URL here including http or https URL getschomp puts Please enter the filename you wish to save the results to, include the full path Allows user to input path in which to save file as well as name the file file_name getschomp 'txt' defines appends txt file_name to ensure file remains readable outfile Fileopen file_name, w Writes results to file path and name user inputs Findfind directory do filename Enables DirectorySnatch to search specified folder filenameeach do f next unless f filetype outfilewrite URL f n end end outfileclose Closes opened file action Fileread file_name This defines action as reading the file_name parameter provided by the user result actiongsub directory, '' gsub , ' ' do each This will substitute certain annoying characters for non-annoying characters and clean up the code need to figure out how to do it in one shot end Fileopen file_name, w f fwrite result This opens the file to perform the action we defined above by the name of result IMAGE http://www.secuobs.com/revue/news/142534.shtmlhttp://www.secuobs.com/revue/news/142534.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Until I have another program qwick_requestrb correctly coded to properly handle certain errors when requesting the output of DirSnatch which is just a bunch of URIs thru the proxyI've been using BurpSuite v12 Intruder functionality instead to build an application map Note If you are using the professional version of BurpSuite you can build an entire site map very very quickly even if it has thousands of resources and 404 errors, 500, etc etc due to unauthed permissions Visually it can be easier and also you may have unexpected results when requesting a resource you shouldn't have permissions to This is why I do this Overview Basically I use the output of DirSnatch minus the URL as a payload for BurpSuite Intruder I start intruder running that payload and because it is forwarding to the second instance of Burp, you will see the target tab fill up very quickly if you are using the professional version Slower for the free version not threaded So, I've already spidered a site and created a payload file as an example Here is what a payload for something like sourceforgenet would look like IMAGE Then I send a request for simply http sourceforgenet and intercept that request with burp When the request is intercepted in the proxy tab Right click and choose Send to Intruder IMAGE Once the request is in the Intruder tab , go to the Intruder tab duh and clear the payload selector Add the variable you want to fuzz by clicking 'add' on either side of the forward slash on the first line You can leave the Sniper attack type in place IMAGE At this point you want to move out of the Intruder positions tab over to Intruder payloads tab Under payload set you will see load Once you click load you can load the payload file It should look like this when you are done Notice choose 'Do not URL encode these characters' This is important, by default it is enabled and this will cause issues with what we are doing IMAGE We are almost good to go So scroll over to the comms tab newer version called options Scroll down to 'use proxy server' Enter the IP address 127001 and enter the port number i'm using 8081, cant have two instances of Burp on the SAME machine and BOTH running on port 8080 due to ummmscience and then DO NOT 'CLICK USE PROXY SERVER' yet anyways IMAGE Fire up that second BurpSuite instance Under the Proxy tab options you will see Proxy Listeners Highlight the entry that shows port 8080 and click 'edit' When the local listener port is populated with 8080 change to 8081 If you want to run the second burpsuite instance on another machine - uncheck 'listen on loopback interface only' and CHECK 'support invisible proxying for non-proxy-aware-clients' and thenupdate Also, make sure the 'running' column is checked NOW you can go back to the first instance of BurpSuite and click 'use proxy server' Should look like this IMAGE Finally, we are ready to start Back at your first instance of BurpSuite, at the VERY TOP of the BurpSuite program you will see 'Intruder' not the tab, look even farther up So, now that you are at the intruder drop down, click start If you go back to your second burpsuite instance you will notice the target tab has filled up Great success IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/142533.shtmlhttp://www.secuobs.com/revue/news/142533.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Inspired by a little tweet I saw from carnal0wnage, I've decided to make today's Burp Tip of the Day about brute forcing a login with Burp Suite's Intruder As always, this goes a lot faster if you purchase the professional version of Burp here However, this also works for the free version but much slower So, lets get started First thing first, send a request to the target site entering a username and password combo I chose pma_username test and pma_password test Intercept that request, right click and send to intruder like so IMAGE Once you have the request sent to burp 'Intruder' you need to choose your targets for the intruder payload You can do this by clicking the 'add' button and putting the ' ' symbol around the username and password as shown in the example Also choose the 'cluster bomb' attack type circled in the example IMAGE Next step is to roll over to the Intruder Payloads tab You will have two separate payload sets Set 1 and Set 2 easy right So in payload Set 1 you choose preset list click 'load' and upload the user_name file containingya you guessed it It should look like so IMAGE Next, click payload set 1 and drop down to payload set 2 You remain using a preset list and click 'load' to upload the password file It should look like so IMAGE At this point you are ready to rock Just in case the password submission is using Basic Authorization aka Base64 you can choose to base64 encode the data by choosing the option in the Intruder payload section near the bottom So go to the very top, drop down intruder, and click start All in all the results should look something like this IMAGE Generally when the length differs greatly or the response code differs you have a pretty good sign that you've hit the mark Hope this helps someone IMAGE http://www.secuobs.com/revue/news/142532.shtmlhttp://www.secuobs.com/revue/news/142532.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - So I don't want to say the official name of the site but lets say it rhymes with Randora and plays music As of this morning, thanks to jack_mannino listening to my early morning grumblings and recommending a 'flash cookie delete' I took matters into my own hands If you like playing music for free thru Randora follow these steps Install better privacy add-on for firefox, remove either the Randora LSOs or all LSOs flash cookie stuff AND http cookies I used cookie safe I removed all LSOs Restart browser, go to Randora, you can create a new account and listen to another 40 hours of music Ahh, the room is alive with the sound of music IMAGE http://www.secuobs.com/revue/news/142531.shtmlhttp://www.secuobs.com/revue/news/142531.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Customers understand better when you actually show them the data that you can extract Time and again I've observed a simple numerical value used as your USER ID and time and again its client side controllable The easiest way to automate this attack and extract useful data, for me at least, has been to use the Burp Suite Intruder 'number' payload along with the Intruder 'grep' function all contained within the suite Lets go Step number one is to request the URI that points to your profile and intercept that request IMAGE Now that the payload has been sent to intruder lets go over to the Intruder positions tab Clear the the current positions by selecting 'clear' button on the right Then add the positions by selecting 'add' on either side of the numerical value Ensure the attack type selected is 'Sniper IMAGE After this has been accomplished move over to the Intruder payloads tab Scroll down at payload set to 'numbers' IMAGE We are now ready to configure the numbers payload We've selected from 0 to 1000 Numerical representation of USER IDs We've done this by adding 0 in the Intruder payloads range 'from' field and 1000 in the 'to' field Since 1000 is four digits I've entered the number 4 in the 'Max Integer Digits' field The 'Min Integer Digits' field is set at 1 since we need at least 1 integer The 'step' field is set at 1 because I only want to increment 1 digit at a time For example, 1 2 3 4, etc etc Lastly, the 'sequential' radio button has been highlighted as well as the 'decimal' radio button for obvious reasons These are decimal values incrementing sequentially IMAGE Now lets say we want to grep a field named dob for the results This represents a field named dob which contains customers dates of birth We will later use this output to fill an excel sheet or whatever you prefer Navigate to Intruder options and scroll down the page to 'grep' Click the extract tab So to extract the string in the response I added dob this is how it would look in the raw response and chose to stop capturing at this is where the field ends I also chose 'simple pattern match' for simplicity's sake NOTE If the response containing this field comes only after a 302 response or redirection choose to follow redirects If you follow redirects you probably want to process cookies All depends on the behavior of the application IMAGE So now that this is configured, its time to fire up intruder Go to the very top of burp, drop down intruder and click 'start' At this point you should see your intruder fill up with responses containing the dob value Note I'm not doing this on a real site, therfore you will see no results in my dob field You get the point IMAGE At this point you can save your results by choosing save attack results but I believe this functionality is limited to users of the professional version found Here I'm sure you can figure something out in the interim IMAGE http://www.secuobs.com/revue/news/142530.shtmlhttp://www.secuobs.com/revue/news/142530.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's post will be short Long day, lots of work Intercepting requests TO the server using the Intercepting proxy within Burp is just as important as intercepting server responses To intercept server responses, navigate to Burp Suite Proxy Options and scroll down to 'Intercept Server Responses' Ensure 'intercept if' is checked and choose 'add' and choose the following options AND - HTTP METHOD - DOES NOT MATCH - insert a string you wont see here I chose a bunch of 6s IMAGE Happy H4xx0r1ng IMAGE http://www.secuobs.com/revue/news/142529.shtmlhttp://www.secuobs.com/revue/news/142529.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - This post was inspired by both portswigger book entitled The Web Application Hacker's Handbook and reminded and reiterated to me by jack_mannino Portswigger is obviously a legend in the community and Jack is a just a really really experienced Appsec Pen-test SE so I encourage you to add follow both on twitter Anyways, accolades aside, lets begin shall we So it is pretty simple You have SQL Injection Its in the USER_ID field This value is actually a string value which equates to a user name So for instance, the value might be 'jdoe' first initial, last name Your SQLi looks like or 1 in select min username from users where user_id j -- and this returns Microsoft OLE DB Provider for ODBC Drivers error 80040e07 Microsoft ODBC SQL Server Driver SQL Server Syntax error converting the varchar value 'jdoe to a column of data type int Okay, so we know we can do this alphabetically Essentially the next command you would inject would be or 1 in select min username from users where user_id jdoe -- This returns Microsoft OLE DB Provider for ODBC Drivers error 80040e07 Microsoft ODBC SQL Server Driver SQL Server Syntax error converting the varchar value jdos to a column of data type int Alrighty, we don't want to continue this process manually do we It is like we want to extract all of the user names in a beautifully automated fashion right Okay, here we go Capture the SQLi request in the intercepting proxy of burp Right click on it and send to intruder IMAGE Now the next part is important We are actually using the server RESPONSES as input for the payload Pretty awesome right Navigate over to Intruder Options tab You need to select the portion of the response that gives you valuable information as the input So in our case, anything after the varchar value ' is what we will use This will be where the username is extracted We want to end the string at ' as well because the string is returned between two single quotations This is how it should look for your options IMAGE Now you just need to choose the payload Navigate to Intruder payloads Choose the payload 'recursive grep' from the drop down list I've created my first payload at 'j' It looks something like this IMAGE At this point you are almost ready Just choose your position I've shown you how in this pic clicked 'add' and placed j as the position to use the payload IMAGE Now you are set Go to the very top of Burp Suite, drop down from Intruder and click 'start' Comments and suggestions for the next post are welcome As always, enjoy and happy hacking IMAGE http://www.secuobs.com/revue/news/142528.shtmlhttp://www.secuobs.com/revue/news/142528.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's tip is just purely based on some experiences I've had during testing The gist is that some developers choose to render the application in such a way where obfuscation IS the security So I will explain the scenario and then how to modify proxy options to uncover the obfuscated data It is true that you will eventually, when performing manual dynamic analysis, review the source code of every response However, in my case, directly after building my site map I simply take a look and annotate the interesting finds and input that I may want to test To keep track of these annotations I prefer Dradis 23 and if you have any questions on using this tool might I suggest one of three routes The first is to join the community Here The second is to contact etd, the creator, on irc at ircfreenodenet on the dradis channel Lastly, etd is on twitter twittercom etdsoft and I highly suggest following him anyways Anyways, on with the tutorial So, both jack_mannino and I observed a situation, where a site loaded content from another site they managed via iFrame Now the trick is directly calling the site being loaded in the iFrame to try and gain unauthenticated access to MAYBE an exposed default directory We were in luck, there was in fact a default directory exposed When requesting this resource however we received a 200 but with a redirection occuring in the browser The page rendered fully in the response WTF Well what controls said redirection Ahhh, JavaScript So what happens if we strip javascript Fully functionality Sweet Okay, so on with viewing the site with JavaScript disabled Lets use burp to strip the JavaScript NOTE Personally, I recommend always viewing a site with JavaScript disabled AND cookies disabled Navigate to Burp Proxy Options Scroll down until you see 'html modifications' and check remove all JavaScript Its really that simple IMAGE The next scenario is where full administrative functionality was provided in the response BUT it was commented out Again, wtfseriously Obfuscation fail So if you want to just automatically remove the characters that control comments so that everything is rendered do the following On the same page, navigate down to 'match and replace' Choose 'response body in the drop down bar' like so IMAGE Now in the 'match' field enter in the 'match' field this time and in the 'replace' field just leave this blank When you are finished it should look like IMAGE Happy hacking IMAGE http://www.secuobs.com/revue/news/142527.shtmlhttp://www.secuobs.com/revue/news/142527.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Back with another tip As pointed out by rybolov's comment on twitter, Burp Suite may be somewhat difficult for folks new to the Suite of tools One thing that I find interesting is how folks that use the tool like myself can learn something new everyday Sequencer is one of the tools included in Burp Suite that I think requies a bit of an introduction Once understood, this tool along with Intruder can be a powerful session attack combination You will notice I define Burp Suite as a suite of tools and this is for good reason It is truly my belief that this tool is fast becoming a one-stop shop for dynamic analysis of an application The free version of the suite is excellent but for those who test professionally, tools such sequencer and intruder must be threaded otherwise valuable functionality might be lost I say this because when breaking a session token sequence to hijack a session timing is critical With that in mind, show portswigger and yourself some love by purchasing the product at portswiggernet On with the tutorial In our example, we have registered for access to the site We have also identified a login submission form After successful authentication with a limited access user account we are provided a cookie 'set-cookie' The idea is here is since we can log into the site and are provided only one session value the cookie we might be able to submit another user's cookie value and access the site with their account In other words, session hijacking For example, I'm given session value abcd1112 and using sequencer I've noticed that only the last four digits change The response would be abcd1113 abcd1114 up to abcd1212 So I've evaluated this session value and noticed it has extremely weak entropy My next step would be to request a resource just beyond the login form such as welcomephp and do this in a threaded fashion manipulating my cookie value using Intruder The responses might vary in byte length For instance I've noticed a large byte return in one instance indicating more functionality returned so this might be an administrative account So the first thing we would do is send the request that triggered a cookie value to be set to sequencer like so IMAGE At the Sequencer live capture tab we want to select the cookie to evaluate which would be the value immediately following 'set-cookie badentropy ' The selection drop down is highlighted in red IMAGE After we've clicked 'start capture' in the lower right hand corner in the Intruder live capture tab we've a screen will pop-up like so IMAGE By default, 100 session values will be evaulated and only after this is completed can you analyse the entropy Burp Suite analyzes this for you btw - So after the 100 session token values have been generated we've clicked the 'analyse now' button at this screen and determined that the site only increments the last four digits by 1 and sequentially by viewing the summary tab in this screen So this is extremely weak entropy Lets try to exploit it Send the request for http wwwexamplecom welcomephp to intruder like so IMAGE Now because the last value provided at the sequencer BY the application was badentropy abcd1212 we will start at abcd1213 when positioning our payload I've already provided a tutorial on my blog how to use Intruder numbers so the rest of this can be referenced at intruder numbers paylod The thing to remember here is that you are looking for items of interest like varying byte length and response code Obviously if you are given a 302 response when incorrect credentials are given and you've observed this in some of the responses and not others this might be a sign that the cookie submitted is not a valid If the 200 response received in the other cookie values are all approximately the same size in byte length except for one or two those might indicate privileged accounts Hope this tutorial helps someone and as always, happy hacking IMAGE http://www.secuobs.com/revue/news/142526.shtmlhttp://www.secuobs.com/revue/news/142526.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Tonight's Burp Suite tip is super basic You have a parameter that is clearly a date So you want to re-submit the same request iterating thru various dates ONLY For example, lets say a company is going to offer a special kind of like that pizza company a few months back but haven't released it yet Well you may want to submit various dates, FUTURE dates, to see if a response with a coupon pops-up In the example below, I found a date parameter which did not fit into Burp Suite's preset list of date formats In this case, its very easy to create your own custom date format Firstly, send the request containing the date parameter to fuzz over to the Intruder tab Catch the request in the proxy or use the proxy history , right click, and 'send to intruder' IMAGE You now need to select your target or where your payload is to be set Navigate to Intruder Positions and select your target Add the variable symbol on either side of the target the date by clicking the 'add' button Should look like this IMAGE At the Intruder Payloads tab you will notice the 'payload set' Use the drop down menu that says preset list by default and select 'dates' IMAGE Okay, here is where we want to do some customization So to keep it short, I will only fuzz 3 different days You can get the gist from the picture but the portion I want to touch on is 'format' Click the radio button format where it does NOT have a drop down This is where you can enter your date So our parameter was 2009_9_7 which we can safely assume is year, month and date So I will enter yyyy_M_d If I was to enter yyyy_M_dd then the day would switch to 07 vice 7 which would be incorrect according to the format So all in all it should look like this IMAGE You are done Now go to the very top, choose the drop down for Intruder and click start Note This is very customizable so ensure you play around a bit modifying the 'step' field from 1 day to 1 month, etc etc A lot of functionality to toy with here so try it out Happy Hacking IMAGE http://www.secuobs.com/revue/news/142525.shtmlhttp://www.secuobs.com/revue/news/142525.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Approximately a year or so ago jack_mannino and I were banging our heads against the desk trying to figure out a good way to obfuscate the source of our web traffic while maintaining the use of our intercepting proxy When we figured out a viable solution, we had some beer pizza, talked for a bit and realized we should share this with somebody Jack wrote a blog post about it Here Then Mubix suggested we should make a video I didn't have much time to go about editing the video so Mubix did that for me Thanks again Mubix Burp through Privoxy and Tor from mubix on Vimeo I hope somebody gets some use out of it Happy Hacking IMAGE http://www.secuobs.com/revue/news/142524.shtmlhttp://www.secuobs.com/revue/news/142524.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's tip is regarding the use of repeater Essentially, I've seen folks modify intercepted requests in their Burp proxy and then submit them to the application and view the response in the web-browser when this is certainly not needed I've certainly neeeever done this 0, mmm okay okay we are all human This technique is certainly beneficial in some instances but other times it is very much wasted energy One good example is waiting for time delays If you are probing for Blind SQL Injection and are using time delaysthe need to request and subsequently view the response in browser seems unnecessary So, just a quick intro to repeater and hopefully some time can be saved Lets get started shall we Throw your request into repeater by intercepting the request in your proxy or using proxy history To do so, right click on the request of interest and select 'send to repeater' like so IMAGE Navigate to the repeater tab and modify your request In this example I show every tick mark and space URL encoded because I want the point to get across that your repeater content must be modified in comparison to the web browser that performs any encoding for you So we are ready to fire IMAGE At this point simply click 'go' in the upper left hand corner You can modify the time accordingly and increment however you may choose Just make sure to have a stop watch to time the responses for variances in the response Three other repeater features to note 1 If you are testing for forceful browsing OR in our case we know using SSL encrypts and bypasses IDS IPS detection signatures and we would like to send this request in SSL you can check the 'use ssl' highlighted here IMAGE 2 If you notice that you are annoyed by the amount of Repeater tabs you have open you can always choose to delete a tab like so IMAGE 3 It may be necessary to follow a '302' redirect sequence all the way to hopefully a '200' response To do so, you can choose this option here IMAGE Happy Hacking IMAGE http://www.secuobs.com/revue/news/142523.shtmlhttp://www.secuobs.com/revue/news/142523.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's Burp Suite tip is a bit different and is based on some personal headaches I've had and what I've learned this week Burp comes with the ability to load PKCS12 Client SSL Certificate This is a great feature It is located under Burp Options recent versions of Professional or Burp Comms Free version outdated and looks like this IMAGE This relates to my situation I must test a web application using a Common Access Card I want Burp to establish this SSL relationship with the web application in the same way my browser would So some things I learned about PKCS12 this week and how to work with Burp 1 If you can export the certificate then go ahead and passphrase protect it Burp will ask for your passhphrase accordingly 2 If and ONLY if the certificate AND private key are marked as exportable will your middleware allow this to happen 3 Your middleware my case ActivClient does not allow the software that exports the cert private key such as IE, Outlook, etc to do so when the not exportable flag is set If this flag is set you will notice an attempt to export in IE will look like so IMAGE BTW, to get to this point in IE you would go ahead and navigate to tools internet options content certificates and choose your certificate and export 4 If this Yes, export private key option is greyed out you will only be able to export in the DER encoded binary x509, Base-64 encoded x509 and PKCS 7 format 5 Again, we need PKCS 12 If your yes, export private key is NOT greyed out you are luckier than I Enjoy and continue on 6 If not, then you need to ask the Issuing Authority for a copy of your cert private key with the not exportable flag turned off This can be in either p12 or pfx since pfx windows version of p12 can be renamed and work fine or so at least I am told Okay, hopefully anyone who has to test sites with CAC PKI enabled will find some use Happy Hacking IMAGE http://www.secuobs.com/revue/news/142522.shtmlhttp://www.secuobs.com/revue/news/142522.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Apologies in advance, this post is only helpful if you have the professional version of Burp Suite which can be purchased Here This post specifically is meant to help folks who test sites utilizing AJAX but the 'find references' function of Burp Suite Pro can be utilized for other reasons as well of course right When testing an application in which you've found a vulnerable AJAX function, it is beneficial to the customer and your report to note everywhere this function is used within the application To use this function it is quite simple Once you have COMPLETELY finished testing or at least this is how I do it and its reporting time, you locate the vulnerable function in your target listing, right click, and click 'find references' It looks like this IMAGE Then a results table will pop up with everywhere this function was referenced my shows none because this was not a real test IMAGE Ensure you check the responses section of where this function was referenced This is where JS is laid out so it makes sense this is where you will find the function Okay, so that is it Not much to it but something certainly, IMO, worth noting Happy Hacking IMAGE http://www.secuobs.com/revue/news/142521.shtmlhttp://www.secuobs.com/revue/news/142521.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - This morning's Burp Suite Tip of the Day BToD will be about the use of the tool 'Comparer' In this instance we are analyzing responses to our SQL Syntax via SQLi We are detecting SQL Injection but this technique can be used to modify your SQL Syntax to perform the attack correctly as well Today's tip is not completely about Comparer since we are also utilizing repeater as well which I've covered in the post Using Repeater So I've found my targets administrative login page Maybe I've used google via site examplecom filetype asp inurl admin search or simply had the directory listing up front Either way, we have a target Overview We've sent the Login submission page to the 'Repeater' tool already and are going to begin testing the individual parameters for SQLi The most basic test we are going to run is one tick two tick ie Login_username ' and Login_username '' We are interested in variances in the response based on this input As a baseline, we've entered known incorrect credentials to the application Login_username Bugs Bunny and reviewed the response This application uses the HTTP '302' Method redirection to throw users back to the main page in the case of invalid credentials This is important because if we were detecting Blind SQLi which is what folks usually use the One tick Two tick method for we'd most likely be submitting the value 'null' when submitting Login_username '' If SQLi is present, the null input should throw us back to the main page based on what we know of the application's behavior regarding invalid credentials To summarize, what I am showing you is not in any way shape or form a subtle difference in the application's response based on SQL Syntax This is obviously not Blind SQLi However, using 'Comparer' you most certainly would be able detect ANY difference s in the application's response Lets demonstrate this whole process and get familiar with the 'Comparer' tool We send the request to the application and await the response This shows the single tick mark request response IMAGE Next we take the response to this request and send to comparer by 'right-clicking' on the response and choosing 'send to comparer' like so IMAGE Repeat this previous steps only this time submitting the two tick marks IMAGE Sending to the 'Comparer' tool IMAGE Navigate to Burp Comparer Screen would look like this IMAGE Above you will notice I've highlighted 5 and 6 These are the numbers assigned to each piece of data you've sent to 'Comparer' This is simply a nice feature for keeping track Okay, so now we want to analyze the differences in these responses Now, obviously, we can see that a huge difference between these responses exist One response is 514 bytes and the other 16607 However, IF this was the case of an error handling page that was different from the normal response but only very slightly Blind SQLi we'd be in luck Anyway, for sake of providing an example, you'd click on 'compare' bottom right words bytes and the word compare screen will pop-up IMAGE Three areas have been highlighted well by me anyways You can analyze words or hex so those options exist individually on either side However, when both responses require scrolling and you'd like to compare side-by-sidecheck the 'sync views' box This is of great help Also, when this box is checked you will notice that you only have to click text hex on one side of the word compare tool and the other side will match up automatically Also a great feature Happy Hacking IMAGE http://www.secuobs.com/revue/news/142520.shtmlhttp://www.secuobs.com/revue/news/142520.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's BToD reminds me of a funny situation I once came across Okay, funny for me and only after some time had passed but nevertheless a good example of why we ask our customer's questions and why we use the Target 'exclude from scope' option Completely unknown to me, as I was testing, my spider was running Now the account I was testing with was an account of elevated prvileges The developers had decided it would make sense to harcode the URI, the stored procedure along with stored procedures parameters option included into the page via an HREF The link looked something like wwwexamplecom disable_profiles disable truewhich made for an interesting next few days this was a production app I admit I did not specifically ask the development team if functionality like this was hardcoded into the page via HREF Interesting to note, it actually took a while for some folks to understand that a pop-up, via JavaScript, warning this will disable all users profiles may not actually be 1 visible to an intercepting proxy or 2 be an effective enough deterrent Moral of the story, I now ask my customers if they code functionality like this into the pages or any other potentially disruptive functionality I may need to know about To exclude this type of functionality from being used by tools such as Spider and Scanner you should perform the following Navigate to Target Scope IMAGE Okay, now add your exclusion You can choose the 'any' protocol option but in my case I know two things Only port 80 is open and we will be using http You will see where highlighted we've added the protocol http the host wwwexamplecom the port 80 and finally the actual name of the page we dont want to touch with a ten foot pole disable_profiles IMAGE Okay, simple enough stuff but in my case a potential ' ss-saver' Happy SAFE Hacking IMAGE http://www.secuobs.com/revue/news/142519.shtmlhttp://www.secuobs.com/revue/news/142519.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - I opened my e-mail today and apparentely I need to update the Chase account that I dont have Fair enough I figured I will analyze the link I'm told to click on and get excited wondering what new and interesting javascript lies within the link or what interesting technique the attacker has sent my way Instead, I find a lame replica page The link brings you to mulheressaudaveiscom chase updatehtm I haven't clicked on the link to actually observe the site but just based off the lameness of this attack I thought it deserved some ridiculing and nothing more The one thing I can say for the e-mail is the grammar was much better than a lot of the other e-mails sent my way If the goal of the attacker is not to distribute malware but is actually to capture usernames and passwords from current Chase members please please give me your stats I'd like to say that nobody would fall for this but I believe otherwise cktricky IMAGE http://www.secuobs.com/revue/news/142518.shtmlhttp://www.secuobs.com/revue/news/142518.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's Burp Suite tip of the Day is about the Burp Suite web interface What makes it cool I can only tell you what I think it works well for Burp's 'Repeater' tool is awesome and in fact a HUGE time saver Drawback Well the response to your request doesn't render in the browser That is sort of not fantastic when you would like to prove to a customer via Visual stimulus that XSS is possible or something to that effect Often times you will find something like XSS in a parameter during form submission What happens when you would like to repeat this submission but the populated fields are not remembered Technically speaking you either use repeater which in our case isn't the optimum choice or you fill out all the fields again and resubmit testing your code once more, or you try to submit as is unpopulated forms but you take the request from proxy history and pully a copy paste All of this seems much more complicated then simply using the Burp Suite Web Interface How do you access the interface Well, when Burp Suite is up and running, go to the browser in which you are working, open a new tab and browse to http burp seriously its that easy Your screen will look like so IMAGE Note If you browser is not set to route traffic thru Burp this will not work Of course, I am not sure you will run into that situation if you are using this The requests are sequential from top to bottom so if you would like to view the last request you made you have to scroll to the bottom Once you've found the request for re-submission just click on the link and the following screen will appear IMAGE Once you click the link you can either choose to view the response or repeat the request Since are tinkering with our request we will choose that option Then the request is sent to Burp proxy IMAGE Well, its not the most known portion of Burp but it is certainly effective and another time saver which I think we all enjoy Happy Hacking IMAGE http://www.secuobs.com/revue/news/142517.shtmlhttp://www.secuobs.com/revue/news/142517.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Today's post is rather simple and is just meant to touch on one piece of functionality that you may or may not know about in Burp Suite Navigate to Burp Suite Comms Free version or Burp Suite Options Pro version and scroll down to x509 certificates IMAGE Highlight and click any of the certificates you wish to view and the following pop-up screen will appear IMAGE Okay so that is it Shows a whole bunch of information on the certificate Not much too it but I've found that some folks didn't know about this feature so I figured it would be worth mentioning Happy Hacking IMAGE http://www.secuobs.com/revue/news/142516.shtmlhttp://www.secuobs.com/revue/news/142516.shtml Secuobs.com : 2009-09-19 13:20:56 - cktricky and Web Application Security - Its Friday and I think we should finish the week strong So today we are talking about using Nikto thru Burp how to mask the default Nikto Header with another header of your choosing When pen-testing you could get cut off before even leaving the gates due to that signature Nikto User-Agent in the 'Request Header' Granted, you can modify the Nikto code directly to modify the header but where is the fun flexibility in this Also, this kind of serves a dual purpose If you are referencing the post Obfuscating your IP via Burp Tor Privoxy then you may wish to combine all this into one obfuscated and calculated attack So I'm using BackTrack 3 to operate Nikto Burp Lets get started In BackTrack3, navigate to the pentest web nikto directory If you enter 'ls' or 'dir' you will notice a file named configtxt IMAGE Now I used kedit to open the configtxt file and scrolled down in the config file of course to the line referencing proxy options like so IMAGE The trick here is simply to remove the symbol in front of the two lines that indicate proxy IP and port number Obviously if you need to change these settings you can do so as well rather than just un-commenting the options which makese them active Anyways, we just removed the symbol and saved the changes to our configtxt file Now if you'd like to run this and are not interested in changing the User Agent Header then simply append the -useproxy option to nikto as shown in this photo IMAGE Now if you would like to modify Nikto's User-Agent to bypass certain detection systems then follow the rest of this post So I have ruby installed AND the ruby gem mechanize which already has a list of User-Agents inside of it So, while there is probably a more comprehensive list this is what I chose IMAGE Out of this I made a list which I sent over to the BT3 VM The list was cleaned up just a bit so it could be a copy and paste sort of deal Looks like this IMAGE To set a match and replace Match Nikto's User-Agent Replace with another User-Agent , Navigate to Burp Proxy Options Scroll down to 'match and replace' Enter the following I chose the Linux Konqueror user-agent and click 'add' Just make sure that the box is checked next to the request header to indicate the option is in use IMAGE Okay, so now we simply run nikto again using the -useproxy Just to make sure it worked though, I actually had two instances of Burp running The first instance is the one Nikto is sending traffic to The second instance of Burp is receiving requests from the first instance of Burp This way I can watch the traffic and take a nice screen shot for you BTW, if you interested in doing that reference my post Here Anyway, lets have a look and see if the Nikto User-Agent in the header is replaced IMAGE It worked like a charm Happy Hacking IMAGE http://www.secuobs.com/revue/news/142515.shtmlhttp://www.secuobs.com/revue/news/142515.shtml