Pytbull

Today when I actually going to do practical  things on IDS/IPS on backtrack machine, and I got to know about PYTBULL. :)

Today I'm not writing anything about PYTBULL. because I'm not an expert. :p :-D right. :)
I'm giving you all things from an expert Sébastien Damaye who is auther of pytbull.
So here is all things which Damaye has been explained in detail . and yes hackers it's really useful.

pytbull is an Intrusion Detection/Prevention System (IDS/IPS) Testing Framework for Snort, Suricata and any IDS/IPS that generates an alert file. It can be used to test the detection and blocking capabilities of an IDS/IPS, to compare IDS/IPS, to compare configuration modifications and to check/validate configurations.

The framework is shipped with about 300 tests grouped in 9 testing modules:

- clientSideAttacks: this module uses a reverse shell to provide the server with instructions to download remote malicious files. This module tests the ability of the IDS/IPS to protect against client-side attacks.
- testRules: basic rules testing. These attacks are supposed to be detected by the rules sets shipped with the IDS/IPS.
- badTraffic: Non RFC compliant packets are sent to the server to test how packets are processed.
- fragmentedPackets: various fragmented payloads are sent to server to test its ability to recompose them and detect the attacks.
- multipleFailedLogins: tests the ability of the server to track multiple failed logins (e.g. FTP). Makes use of custom rules on Snort and Suricata.
- evasionTechniques: various evasion techniques are used to check if the IDS/IPS can detect them.
- shellCodes: send various shellcodes to the server on port 21/tcp to test the ability of the server to detect/reject shellcodes.
- denialOfService: tests the ability of the IDS/IPS to protect against DoS attempts
- pcapReplay: enables to replay pcap files
It is easily configurable and could integrate new modules in the future.

There are basically 6 types of tests:

- socket: open a socket on a given port and send the payloads to the remote target on that port.
- command: send command to the remote target with the subprocess.call() python function.
- scapy: send special crafted payloads based on the Scapy syntax
- multiple failed logins: open a socket on port 21/tcp (FTP) and attempt to login 5 times with bad credentials.
- client side attacks: use a reverse shell on the remote target and send commands to it to make them processed by the server (typically wget commands).
- pcap replay: enables to replay traffic based on pcap files


Tomorrow  we are going to see in practical way ok :) Smile plsssssss

How To Block Websties Without Software, block websites

 Steps:

1] Browse C:\WINDOWS\system32\drivers\etc
2] Find the file named "HOSTS"
3] Open it in notepad
4] Under "127.0.0.1 localhost" Add 127.0.0.2 www.sitenameyouwantblocked.com , and that site will no longer be accessable.
5] Done!

-So-

127.0.0.1 localhost
127.0.0.2 www.blockedsite.com

-->www.blockedsite.com is now unaccessable<--


For every site after that you want to add, just add "1" to the last number in the internal ip (127.0.0.2) and then the addy like before.

IE: 127.0.0.3 www.blablabla.com
127.0.0.4 www.blablabla.com
127.0.0.5 www.blablabla.com 

M-3 System Hacking Part 1

Look around your self . you will see the most of man are working on system only, You will realize soon the all country mechanisms are controlled by SYSTEMS. So hacker have only one power they will use that most of the time i.e Attack. They doesn't think so much after taking decision. We have seen lot of basic things before this. So after Information Gathering and Network scanning the next attack is System hacking.

They bypass the system after taking some information and scanning result. Finding the vulnerability is so much easy rather than network scanning. It's not worthy anymore. Now we are discussing basic things over here.so be ready with all the older stuff.

In this part we are looking to the given techniques.
1) Password Cracking
2) Password Cracking techniques
3) Types of password attacks 

Basically we are talking about only password which we are using before logging. 1st and last thing is that user should use case sensitive password, So no one crack it easily. So let's start. are you ready to gain access anybody account? :)

We have seen foot printing, Network scanning mechanisms etc. So before you start with practical things over you lappi and desktop you should have this things with you like.....

1) IP Address 
2) Services running on host
3)  Identify system flows

Now we can see the methodology this module
1) Using to collect enough information to gain access using brute force or password eavesdropping e.t.c 
2) Then scan the system or host 
3) Try to gain access of the host using cracking password method
4) After gain the access of host try to maintaining the access.
                                            In this step attacker can execute some important application & hiding some important files, After doing all this stuff final is the covering all tracks.Attacker did all the stuff smoothly so nobody knows whats happened before? 

Password Cracking
1) Password cracking is a technique which are used to remove password from host or system. 
2) Attackers use password cracking techniques to gain unauthorized access to the vulnerable system.
3) Most of the pwd cracking technique are successful due to weak or easily guessable password.
4) So for prevention of this methodology use complex password by which attacker can't access your system easily.

Types of password attack
1) Passive online attack 
An attacker don't contact with authorized party for staling password in other words he attempts password hacking but without communicating with victim or victim account. 
e.g Man in middle attack, wire sniffing

Let's something discuss regarding man in middle attack. 

An attack where a user gets between the sender and receiver of information and sniffs any information being sent. In some cases, users may be sending unencrypted data, which means the man-in-the-middle (MITM) can obtain any unencrypted information.

In other cases, a user may be able to obtain information from the attack, but have to unencrypt the information before it can be read. In the above picture is an example of how a man-in-the-middle attack works. The attacker intercepts some or all traffic coming from the computer, collects the data, 

and then forwards it to the destination the user was originally intending to visit.

2) Active Online attack 

It can be directly termed as password guessing, an attacker tries number of password one by one against victim to crack his/her password

e.g password guessing, Trojan/Spyware/Key loggers

Let's talk about something keylogger   

What is keylogger?

A keylogger is a device that tracks every key that has been typed on the computer that you need to monitor. 

Most keyloggers will not categorize the keystrokes and they can be very difficult to understand, 

especially when someone is multi-tasking

Related feature

Software keyloggers may be augmented with features that capture user information without

relying on keyboard key presses as the sole input. Some of these features include:

• Clipboard logging. Anything that has been copied to the clipboard can be captured by the program.

• Screen logging. Screenshots are taken in order to capture graphics-based information. Applications with screen logging abilities may take screenshots of the whole screen, just one application or even just around the mouse cursor.They may take these screenshots periodically or in response to user behaviors (for example, when a user has clicked the mouse). A practical application used by some keyloggers with this screen logging ability is to take small screenshots around where a mouse has just clicked; these defeat web-based keyboards (for example, the web-based screen keyboards that are often used by banks) 

and any web-based on-screen keyboard without screenshot protection.

• Programmatically capturing the text in a control. The Microsoft Windows API allows programs to request the text 'value' in some controls. This means that some passwords may be captured, even if they are hidden behind password masks (usually asterisks).

• The recording of every program/folder/window opened including a screenshot of each and every website visited, also including a screenshot of each.

• The recording of search engines queries, instant messenger conversations, FTP downloads and other Internet-based activities (including the bandwidth used).

Hardware-based keyloggers do not depend upon any software being installed as they exist at a hardware level in a computer system.

3)Offline attack  
                       It performed from a location other than the actual computer where the password reside or were used offline acrequires physical access to the computer which stores password file.The attacker copies the password file & then tries to break password in his own system 
e.g Dictionary attack, Brute force attack, syllable attack 

4)Non technical attack
Does not required technical knowledge hence it is called non technical attack.
e.g Social engineering, keyboard sniffing etc 

M-2 Network Scanning Part 3

We have seen the TCP Port Scanning methods. If you have any doubt ask me frankly. So now we are going to UDP Port Scanning section . but Before that you should know something about UDP. 
UDP (User Datagram Protocol) is a simple OSI transport layer protocol for client/server network applications based on Internet Protocol (IP). 
  
UDP network traffic is organized in the form of datagrams. A datagram comprises one message unit. The first eight (8) bytes of a datagram contain header information and the remaining bytes contain message data.
A UDP datagram header consists of four (4) fields of two bytes each:

1) source port number
2) destination port number
3) datagram size

4) checksum

--> In UDP there is no three way handshaking.
--> The system does not respond with a message when the port is open.
--> When it sent to the open port, The system responds with ICMP port unreachable message.
--> Spyware, Virus, Trojan horse & other malicious applications use UDP ports.

Attacker send TCP probe packets with various TCP flags ( FIN,URG,PSH) set or with no flags, If there is no response means port is open & RST/ACK means the port is closed.
We also called it as Inverse flag Scanning.

Now we will see about ACK flag scanning. In which firewall performs main role, i.e when attacker send an ACK probe packet with random sequence number attacker get no response message. It means port is filtered (i.e firewall is present) But when target host give RST response it means that the port is not filtered because of firewall is not present at that target host.

How could we perform IDS Evasion technique in scanning.
Rules to remember
1) Use fragment IP Packet
2) Spoof your IP address when launching attacks & Sniff response from server
3) Use source routing ( If Possible)
4) Connect to proxy servers or compromised trojaned machines to launch attacks

There is one thing I left in it. i.e Tools regarding IP Fragmentation. There is no need because you can search it from google. You have to practice Art of googling also. :) :p :-D 

Now we can proceed to next part i.e Scanning Tools.
1) NMAP 

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. 

Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. 

It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. 

In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping). For Info and get the software here http://nmap.org/.(Download link)

Now I will listed some software also for scanning purpose. 
1) Advanced Port Scanner 
2) AWSPS UDP Scanner
3) Netifera
4) Nscan
5) AWPTA

Now it's time to discuss Scanning countermeasure.

 1) A company wants to scan its own networks, but at the same time the company should take countermeasures to protect itself from being scanned by hackers. Here is a checklist of countermeasures to use when you’re considering technical modifications to networks and filtering devices to reduce the effectiveness of network scanning and probing undertaken by attackers:

2) Filter inbound Internet Control Message Protocol (ICMP) message types at border routers and firewalls. This forces attackers to use full-blown TCP port scans against all your IP addresses to map your network correctly.

3) Filter all outbound ICMP type 3 unreachable messages at border routers and firewalls to prevent UDP port scanning and firewalking from being effective.

4) Consider configuring Internet firewalls so that they can identify port scans and throttle the connections accordingly. You can configure commercial firewall appliances (such as those from Check Point, NetScreen, and WatchGuard) to prevent fast port scans and SYN floods being launched against your networks. On the open-source side, many tools such as port sentry can identify port scans and drop all packets from the source IP address for a given period of time.

5) Assess the way that your network firewall and IDS devices handle fragmented IP packets by using fragtest and fragroute when performing scanning and probing exercises. Some devices crash or fail under conditions in which high volumes of fragmented packets are being processed.

6) Ensure that your routing and filtering mechanisms (both firewalls and routers) can’t be bypassed using specific source ports or source-routing techniques.

7) If you house publicly accessible FTP services, ensure that your firewalls aren’t vulnerable to stateful circumvention attacks relating to malformed PORT and PASV commands.

8) If a commercial firewall is in use, ensure the following:

a)The latest service pack is installed.

b) Antispoofing rules have been correctly defined so that the device doesn’t accept packets with private spoofed source addresses on its external interfaces.

c) Fastmode services aren’t used in Check Point Firewall-1 environments.

9) Investigate using inbound proxy servers in your environment if you require a high level of security. A proxy server will not forward fragmented or malformed packets, so it isn’t possible to launch FIN scanning or other stealth methods.


10) Be aware of your own network configuration and its publicly accessible ports by launching TCP and UDP port scans along with ICMP probes against your own IP address space. It is surprising how many large companies still don’t properly undertake even simple port-scanning exercises.

So see you later guys . enough for today. being tired now . :p :-D  

If you have any doubt email me at dineshine@hotmail.com. 




   
   

M-2 Network scanning Part 2

Hello My dear friends,

How was my 1st part? I hope you like it. That was the theory stuff. when I was learning hacking past 2 year I always ignored theory part. Because i always wanted to be do practical things. I usually ask myself only why should I do waste my time for learning theory part rather than practical? But then I realize i was wrong.

without knowing theory part you can't understand practical things in hacking world. you have to go through that then you will be enjoy practical things.

Today we are learning about scanning mechanisms. how hacker's are going to be compromise your security?

and why this scanning mechanisms is so much more important? so here is we will discuss about different scanning part used in cyber security.

Ping Sweep

Ping sweep is used to determine the live host from a range of IP address by sending ICMP Echo request to multiple tools. If host is live, It will return an ICMP Echo reply.

Ping Sweep Tools

1) Angry IP Scanner

2) Utility Ping

3) Ping Scanner pro

4) Pinginfo View

So now generally all the scanning methods perform using TCP protocol. So TCP Set some Flags .So these flags are help to communicate over WAN/LAN/MAN Network.

URG (Urgent)

                     It States that the data contained in the packet should be processed immediately.

FIN (Finish)

                     It tells the remote system that there be no more transitions.

RST (Reset)

                     Used to reset a connection.

SYN (Synchronize)

                     Used to initiate a connection between hosts.

ACK (Acknowledgement)

                     Used to Acknowledgement the receipt of a packet.

PSH (Push)

                     Used  to instruct the sending system to send all buffered data immediately.

                     Standered  TCP communication are controled by flag in the TCP packet header.

So now we are looking forward to see the technique of scanning.

1) TCP Connect Scan

2) Stealth Scan 

3) Syn/Ack/Fin Scan

4) Null Scan 

5) Idle Scan

6) ICMP Echo Scanning

7) List Scan 

1) TCP Connect Scan

--> TCP Connect scan details when a port is open by completing the three- way handshake.

--> TCP Connect scan establishes full connection & tears it down by sending RST Packet.

2) Stealth Scan

--> Attackers use stealth scanning technique to bypass firewall rules, logging mechanisms & hide themselves as usual network traffic.

--> If the port is open then the server responds with a syn/ack packet.

--> If the server responds woth an RST packet then the remote port is in the closed state.

--> the client send the RST packet to close the initiation before a connection can ever be established.

 3) FIN Scan 

--> FIN Scan sends a TCP frame to a remote device with FIN flag set.

--> FIN Scan only with TCP/IP Developed according to RFC 793

--> It will not work against any current version of microsoft windows.

--> IN FIN Scan attacker send TCP frame to remote host with any FIN flags set.

4)  Null Scan 

--> NULL Scan only works if O.S TCP/IP implementation is developed according to RFC 793.

--> Not work against any current version of M.C.W.

--> In This scan attacker send a TCP frame to a remote host with no flags.

5) Idle Scan.

--> Port is considered open if can application is listening on the port.

--> one way to determine whether a port to open is to send a "SYN" (Session Establishment) Packet to the   port.

--> The target machine will send back a "Syn/Ack" (Session required acknowledge) packet it the port is open and an "RST(Reset)" packet if the port is closed.

 --> A machine which receives an unsolitted Syn/Ack Packet will respond with an RST an unsolicited RST will be ignored.

--> Every IP Packet on the internet has a fragment identification number.

--> It is a TCP port scan method that allows sending spoofed packet to a computer through software tools such as NMAP & HPing.

 

6) ICMP Echo Scanning 

--> This is not port scanning since ICMP  does not have a port abstraction.

--> But it is useful to determine which host in a network are up by pinging them all.

--> e.g nmap -P cert.org /all 192.168.0.0/16

7) List Scan

--> This type of scan simply generates and prints a list of IP's/Names with out actually pinging or port scanning them. A DNS name resolution will also be carried out.  

So we have seen different techniques from scanning .

but about piratical? so guys be ready for practical we very near to do some practical things after completing this portion. Don't forget to tell me how is this? and I'm also telling you most important thing belonging to this field. So just Wait And Watch.

M-2 Network scanning Part 1

Hello buddy's, How are you ? wanna know detail about network scanning? Don't worry so this our second part NETWORK SCANNING. :)

Network scanning task is very important & necessary in cyber security field. we gather three main things by using network scanning.
1) IP address & open port's of live hosts.
2) O.S (Operating System) & system architecture.
3) Service running on host

You can say it is procedure for finding information related to Host, Port & Services on a given network.
Scanning is one of the components of intelligence gathering for an attacker to create a profile of the target organization.

There are basically three type of scanner
1) Port Scanning
2) Network Scanning
3) Vulnerability Scanning

1) Port Scanning

--> It is a technique used to identify open ports & services available on a network host.
--> It is also utilized by security technicians to audit computers for vulnerabilities.
--> Also used by hacker's to target victim's.
--> It can be used to send request to connect to the targeted computer and then keep track of the ports        which appear to be opened or those that respond to the request.
--> Each individual computer runs on multiple ports.
--> Unfortunately, Criminals & computer hacker are always looking for new victims to exploit & port             scanning is one of the way's through which this can be accomplished.

2) Network Scanning

--> It is one type of procedure by which we cab identify active host on a network or for network security assessment.
--> Generally attacker use this for attacking to target host after identifying vulnerability on network.

3) Vulnerability Scanning

--> A process of pro actively identifying security vulnerability of computing system in a network in order to determine if & where a system can be exploited and/or threatened.
--> This Scanning procedure is refers to the scanning of system that are connected to the internet but also refer to that are not connected to the internet.

Now friends Tell me Do you know something about ICMP?
ICMP (Internet control management protocol )

here we are not discussing about what ICMP does? why ICMP need for scanning we already learn about this protocol in our graduation level. So we are here just see the main role of ICMP scanning used in network scanning.
--> Ping scan involves sending ICMP Echo request to the host if the host is live, it will return an ICMP Echo reply.
--> This perticular scan is for locating active device of determine if ICMP is passing through a firewall.

E.g Ping scan output using NMAP 

# nmap -sP -v 129.67.X.X

M-1 Footprinting Part 3

he guys .. how's it part 1, part 2. I hope you like it. If u wanna detail knowledge regarding footprinting pls use internet. in this field internet is our teacher, friend and all :). so be friendly and hungry about knowledge.
It's been very tough part to tell you this thing in deeply. And in this part I will finalize the footprinting section.
In part 2 we have seen only threats and it's type. In this section we can see the countermeasures and footprinting Pentest. But before we will see remaining portion of threat's. 

5) WEBSITE Footprinting

Web mirroring tools allows you to download a website to a local directory, building recursively all directories   HTML Images, Flash , Videos from the server to your computer.

Website Mirroring Tools  
1)HTTrack Website Copier (http://ww2.htttrack.com/) 
2)KEEPNI (http://www.keepni.com/)

Mirroring Entire Website tools 
1) Wget (http://www.gnu.org/)
2) teleport pro (http://www.tenmax.com/)

-> Extract website information from http://archive.org/index.php 
-> as well as you can monitor web updates using website watcher. 

6) EMAIL Footprinting

Email Tracking Tools
1) email tracker pro (http://www.emailtrackerpro.com/)
2) didtheyreadit (http://www.didtheyreadit.com/)
4)Trout(http://www.foundstone.com/)

Now we will see some footprinting tools....
1) Prefix
2) Netmask
3) Maltego

I'm not giving here that much tools sorry for that. except you guys can tell me those name. then I will know that you guys are actually reading my blog. :p :). not joking it's ur assignment


FOOTPRINTING COUNTERMEASURE

Now will discus about the countermeasure. what should we do for preventing this type attack. Yes this is also one type of attack . but sorry we can't get to know about this..here this methods.
-> Configure routers to restrict the footprinting request.
-> Configure web server to avoid information leakage & disable unwanted protocols.
-> Lock the ports with the suitable firewall configuration. 
-> Use an IDS.
-> Evaluate the information beofore publishing it on the website / Internet .
-> Remove any sensitive information found
-> Prevent search engine form caching a web pages & use anonymous registration services.

FOOTPRINTING PENTEST

It's always been toughest part in cyber security field. Pen testing gives you all details. 
In this footprinting determine organization's publicly available information on the internet such as network architecture , O.S , Applications e.t.c 

Te tester attempts to gather as much information as possible about the target organization from internet & other public accessible source.

Pen test usually get  proper authorization & then after declare the scope of work. Pen tester performs some footprinting technique to gather the information like internet footprinting using LINK EXTRACTOR e.t.c 
Or WHOIS footprinting using SMART WHOIS e.t.c or Competitive intelligence using tools such as SPAN e.t.c e.t.c e.t.c e.t.c at t  he end pen testing document all the file findings.

Here we complete ore first module Footprinting. SO how is this guys.. Fun na ? ust enjoy this section ..
One more thing pls this knowledge for EDUCATIONAL purpose .. Don't do any illegal thing..
Be a smart WHITE HAT HAKCER.. :) and BE HAPPY .