Extract metadata from file in Backtrack

Metadata is stored in any document by authoring application which can be user-name ; comment ;creation date;modification date.Metadata is very important in computer Forensic ; well know hacker group Anonymous `s members are arrested due to metadata. Because they upload document without clearing metadata ; so by reading metadata we can find lots of juicy information.


Previous we saw how we can extract metadata using FOCA from website ; But we can also extract metadata from BACKTRACK using exiftool.

If you want to write your own python script then visit our new section of blog script .

Exiftool can extract metadata from images ;documents ,videos etc.Most of file format are supported in exiftool. EXIFTOOL can also write metadata into Documents. So before uploading document remove metadata from it

How to use?
(1)If you are not using backtrack than you can download from git. For ubuntu user type following command in terminal.
git clone https://github.com/pandastream/libimage-exiftool-perl-9.27.git exiftool
sudo apt-get install libarchive-zip-perl

(2)cd exiftool
(3)./exiftool /path of file.

Extract metadata from pdf file:-

./exiftool /path of pdf file

Read More

WordpressPingbackPortScanner

Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using multiple Wordpress Blogs exposing this API. This issue was fixed in Wordpress 3.5.1. Older versions are vulnerable, if the XML-RPC Interface is active.

(1)Download from here

(2)Extract it in folder

(3)cd Downloads/WordpressPingbackPortScanner-master/

(4)It does not work default ruby version which is 1.9.2 ; so by running update-alternatives we can change ruby version to 1.8.2

update-alternatives --config ruby

select 1

(5)
gem install bundler
bundle install

 Use:-

Quick-scan a target via a blog:

ruby wppps.rb -t http://www.target.com http://www.myblog.com/

Use multiple blogs to scan a single target:

ruby wppps.rb -t http://www.target.com http://www.myblog1.com/ http://www.myblog2.com/ http://www.myblog3.com/

Scan a free wordpress.com blog (all ports) from the internal network:

ruby wppps.rb -a -t http://localhost http://myblog.wordpress.com/

Read More

List of vulnerability in wordpress 3.5.1.

Recently true-caller and Tango messenger is hacked by Syrian-Electronic-Army.

And large amount of Database has been stolen. Now what is common in these sites?

They have word-press 3.5.1 which is vulnerable to some attack.

A weakness and multiple vulnerabilities have been reported in WordPress, which can be exploited by malicious users to disclose certain system information and bypass certain security restrictions and by malicious people to conduct spoofing and cross-site scripting attacks, bypass certain security restrictions, and cause a DoS (Denial of Service).

1) An error when calculating the hash cycle count within the "crypt_private()" method in /wp-includes/class-phpass.php can be exploited to exhaust CPU and memory resources by sending HTTP requests with a specially crafted password cookie.

Successful exploitation of this vulnerability requires knowledge of the URL for a password-protected post.

This vulnerability is confirmed in version 3.5.1. Prior versions may also be affected.

Here is full details & exploitation is available ;visit this link.

https://vndh.net/note:wordpress-351-denial-service

2) An unspecified error within the HTTP API related to server-side requests can be exploited to gain access to the site.

Here is full details.

http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html

3) An unspecified error can be exploited to bypass certain restrictions when publishing posts.

Successful exploitation requires the "Contributor" role.

4) An unspecified error can be exploited to reassign the post authorship.

5) Certain input related to SWFUpload is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

6) Certain input related to Flash applet within TinyMCE Media Plugin is not properly verified before being used. This can be exploited to e.g. spoof unspecified content.

7) Certain input related to media uploading is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

8) An error when handling failed uploads can be exploited to disclose the full installation path.

Read More

How to solve metasploit problem in SET?

If you installed metasploit from git repository then you donot face any problem with SET. But If you have installed metasploit from its binary version then when you tried to running social engineering toolkit metasploit attack then might be you get error of some ruby bundle. Here is solution of that problem. I tested on SET Version: 5.2.1 & metasploit v4.6.2-1.

We are going to install Ruby 1.9.3 using RVM. Running all this command in msf3 folder

root@bt:~# cd /opt/metasploit/apps/pro/msf3/

root@bt:/opt/metasploit/apps/pro/msf3# bash -s stable < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer) 

 

root@bt:/opt/metasploit/apps/pro/msf3# source /etc/profile.d/rvm.sh

 

root@bt:/opt/metasploit/apps/pro/msf3# rvm -v 

Once RVM is up and running we need to get a couple of libraries that will be required by the Ruby installation:

root@bt:/opt/metasploit/apps/pro/msf3# for package in zlib openssl libxslt libxml2; do rvm pkg install $package; done 

And finally the Ruby 1.9.3 runtime: 

root@bt:/opt/metasploit/apps/pro/msf3# rvm install 1.9.3

root@bt:/opt/metasploit/apps/pro/msf3# rvm 1.9.3 --default

root@bt:/opt/metasploit/apps/pro/msf3# ruby -v

root@bt:/opt/metasploit/apps/pro/msf3# gem install bundler

root@bt:/opt/metasploit/apps/pro/msf3# bundle install

Now open set from its path ; before running set type command like below

cd /pentest/exploits/set

source /etc/profile.d/rvm.sh

rvm 1.9.3 –default

./se-toolkit

Now you can use any metasploit attack from SET .

Read More

Information Gathering Using FOCA

Last month I put some of tutorial on Information gathering which is first step of penetration testing  , & today we will go ahead in this series . As you know Backtrack has all tools for penetration testing , but this tool is not come with backtrack ; It`s very powerful  tool for information gathering and its name is FOCA (Fingerprinting Organizations with Collected Ar­chieves). It is windows based  tool ; you can install it in linux with help of wine. But i used it in windows  , you can find here “how to install foca inbacktrack?”

What kind of data can be found? 

•Metadata:

–Information stored to give information about the document.

•For example: Creator, Organization, etc..

•Hidden information:

–Information internally stored by programs and not editable.

•For example: Template paths, Printers, db structure, etc…

•Lost data:

–Information which is in documents due to human mistakes or negligence, because it was not intended to be there.

•For example: Links to internal servers, data hidden by format, etc…

Download:-

(1)Go to official website here.

(2)Enter your valid email address at end of page & you will receive email which contain Download link.

(3)Install Foca by running setup.

Sample Example of FOCA:-

(1)Open foca click on create new project.

(2)Enter project name & domain name & click on create.

(3)On right side you can see different file types which will be searching in given domain. Select which file type you want to search &  click on search.

(4)As you can see in above image ; it will find different files from domain using google & bing search engine.

(5)Then right click on file & download it &then again right click on file & extract metadata from file.

(6)On left side click on metadata summary ;there you can find different information which are extracted from document like username ;software; creation date ;modification date.

It can also find different DNS of related domain & server details.

(7)It can also find some juicy info ; known vulnerability; backup; directory listing ; sqli ; svn; GHDB and much more.

It`s just simple tutorial.So download it & enjoy it & gather some critical information. J

Read More

Firefox Add-ons for penetration testers

In this brief post, we are listing a few popular and interesting Firefox add-ons that are useful for penetration testers. These add-ons vary from information gathering tools to attacking tools. If you are using BACKTRACK than use OWASP Mantra which has lots of useful Add-ons.

(1)Firebug
Firebug is a nice add-on that integrates a web development tool inside the browser. With this tool, you can edit and debug HTML, CSS and JavaScript live in any webpage to see the effect of changes. It helps in analyzing JS files to find XSS vulnerabilities. It’s an really helpful add-on in finding DOM based XSS for security testing professionals.Add Firebugin your Browser from this link: https://addons.mozilla.org/en-US/firefox/addon/firebug/

(2)Web Developer
Web Developer is another nice add-on that adds various web development tools in the browser. It helps in web application penetration testing.Add Web Developerin your browser from this link: https://addons.mozilla.org/de/firefox/addon/web-developer/

(3)Live HTTP Headers
Live HTTP Headers is a really helpful penetration testing add-on for Firefox. It displays live headers of each http request and response. You can also save header information by clicking on the button in the lower left corner. I don’t think that there is any kind of need to tell how important this add-on is for the security testing process.Add Live HTTP Headersto Firefox with this link: https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/

(4)Tamper Data
Tamper Data is similar to the Live HTTP Header add-on but, has header editing capabilities. With the tamper data add-on, you can view and modify HTTP/HTTPS headers and post parameters. Thus it helps in security testing web application by modifying POST parameters. It can be used in performing XSS and SQL Injection attacks by modifying header data.Add the Tamper dataadd-on to Firefox browser with this link: https://addons.mozilla.org/en-US/firefox/addon/tamper-data/)

(5)Hackbar
Hackbar is a simple penetration tool for Firefox. It helps in testing simple SQL injection and XSS holes. You cannot execute standard exploits but you can easily use it to test whether vulnerability exists or not. You can also manually submit form data with GET or POST requests. It also has encryption and encoding tools. Most of the times, this tool helps in testing XSS vulnerability with encoded XSS payloads. It also supports keyboard shortcuts to perform various tasks.I am sure, most of the persons in the security field already know about this tool. This tool is mostly used in finding POST XSS vulnerabilities because it can send POST data manually to any page you like. With the ability of manually sending POST form data, you can easily bypass client side validations of the page. If your payload is being encoded at client side, you can use an encoding tool to encode your payload and then perform the attack. If the application is vulnerable to the XSS, I am sure you will find the vulnerability with the help of the Hackbar add-on on Firefox browser.Add Hackbaradd-on to Firefox browser with this link: https://addons.mozilla.org/en-US/firefox/addon/hackbar/ 

(6)Websecurify
Websecurify is a nice penetration testing tool that is also available as add-on for Firefox. We have already covered WebSecurify in detail in previous article. WebSecurify can detect most common vulnerabilities in web applications. This tool can easily detect XSS, SQL injection and other web application vulnerability. Unlike other listed tools, it is a complete penetration testing tool in itself available as a browser add-on. It gives most of the features available in standalone tool.Add WebSecurifyto Firefox browser with this link: https://addons.mozilla.org/en-us/firefox/addon/websecurify/

(7)XSS Me
Cross Site Scripting is the most found web application vulnerability. For detecting XSS vulnerabilities in web applications, this add-on can be a useful tool. XSS-Me is used to find reflected XSS vulnerabilities from a browser. It scans all forms of the page, and then performs an attack on the selected pages with pre-defined XSS payloads. After the scan is complete, it lists all the pages that renders a payload on the page, and may be vulnerable to XSS attack. Now, you can manually test the web page to find whether the vulnerability exists or not.Add XSS Me
to your Firefox browser: https://addons.mozilla.org/en-us/firefox/addon/xss-me/

(8)SQL Inject Me
SQL Inject Me is another nice Firefox add-on used to find SQL injection vulnerabilities in web applications. This tool does not exploit the vulnerability but display that it exists. SQL injection is one of the most harmful web application vulnerabilities, it can allow attackers to view, modify, edit, add or delete records in a database.The tool sends escape strings through form fields, and tries to search database error messages. If it finds a database error message, it marks the page as vulnerable. QA testers can use this tool for SQL injection testing.Add SQL Inject Me
add-on to your browser: https://addons.mozilla.org/en-us/firefox/addon/sql-inject-me/

(9)CryptoFoxCryptoFox is an encryption or decryption tool for Mozilla Firefox. It supports most of the available encryption algorithm. So, you can easily encrypt or decrypt data with supported encryption algorithm. This add-on comes with dictionary attack support, to crack MD5 cracking passwords. Although, it hasn’t have good reviews, it works satisfactorily.Add CryptoFox add-on to your browser: https://addons.mozilla.org/en-US/firefox/addon/cryptofox/

Read More

Open source Information Gathering tool-Maltgo

Maltego is an open source intelligence and forensics application. It allows you to mine and gather information, and represent the information in a meaningful way. The word "open source" in Maltego means that it gathers information from the open source resources; it does not mean that Maltego is open source software.

Maltego allows you to enumerate Internet infrastructure information, such as: 

• Domain names

• DNS names

• Whois information

• Network blocks

• IP addresses

It can also be used to gather information about people, such as: 

• Companies and organizations related to the person

• E-mail address related to the person

• Websites related to the person

• Social networks related to the person

• Phone numbers related to the person 

There are more than 70 transforms available in Maltego. The word "transform" refers to the information gathering phase done by Maltego. 
 

Read More