Understanding Bash STDOUT / STDERR using Hping3

Commands run on bash prompt can output content to standard output (STDOUT) and standard error (STDERR)

If you wish to suppress some data, it can be done by redirecting content from either sources to /dev/null. Alternate notations for the above are :

STDOUT = 1

STDERR = 2

/dev/null refer to the Null Device File that discards all data written to it (http://en.wikipedia.org/wiki/Null_device)

Taking the example of hping3, we can see different outputs as below

The default output of hping3 is sent to both STDOUT and STDERR. The ping responses are sent to the STDOUT, whereas the packet summary/statics is sent to STDERR

Default Output

When we send the output from hping3 to /dev/null, only the STDOUT is sent to /dev/null. The other part of the output is not sent to /dev/null as it is actually sent to STDERR

STDOUT to /dev/null

If we want to send the STDERR to /dev/null, we can do the same using the notation 2> . As mentioned earlier the integer notation for STDERR is ‘2’. Thus ‘2>’ represents redirecting STDERR to non-standard location.

STDERR to /dev/null

If you don’t want any output from a command, you can simply redirect STDERR to STDOUT which in-turn is redirected to /dev/null

Both STDERR and STDOUT to /dev/null

If in some weird use-case you wish to push everything to STDERR, it can be done using 1>&2

STDOUT to STDERR

Knowing how to redirect STDOUT and STDERR is very useful when scripting in bash.

Hacking Guest Wifi Networks

(Cross-posting from my organization’s blog – http://niiconsulting.com/checkmate/2014/03/insecure-implementation-guest-wireless-networks/)

Most large organizations provide wireless facilities for their guest, which may include vendors, consultants, business associates, employees from other regions etc.

Certain points should be considered while implementing a guest wireless network.

1. Encryption in use
2. Captive Portals or Guest Authentication
3. Network Segregation

Finding the SSID of a Hidden wireless network

To simplify the connectivity for guest devices some organizations configure their networks without encryption i.e. ‘OPEN’. To prevent un-authorized entities from connecting to their networks most of these networks are configured as HIDDEN. As is well known, this configuration does not really provide any security. It is simply a method of obfuscation (Non-Broadcast Wireless SSIDs Why hidden wireless networks are a bad idea).

To identify the SSID of a hidden network you would need:

1. Wireless adapter which supports packet injection (http://www.aircrack-ng.org/doku.php?id=compatible_cards)
2. Aircrack-ng wireless suite (http://www.aircrack-ng.org/)

I will be using an Alfa AWUS036H adapter. This card is well supported by Aircrack-ng.

Does Your DLP/IRM Implementation Keep You Awake At Night?

With the fragmented manner of work culture in the 21^st century, organizations have started to wake up to a fact that they cannot withhold information within the confines of their heavily guarded data-centers. Clients, employees and vendors need the information to continue smooth functioning of their businesses.

Information usually falls into anyone of the below categories:

Classification	Legitimate Users	Examples
Public	Visible to everyone in the world	Tender documents
Internal	Only for employees	Memos, newsletters
Restricted	Only for certain people/teams	Contracts, Invoices, PO, Network Diagrams
Confidential	Sensitive information – for very specific people	Financial proposal
Private	personal information of people	Salaries, Employee HR Information

How-to: Modify Apache-Coyote/1.1 Banner

If you’ve ever done a penetration test or got one done, you may have come across the following scenario:

HTTP Service running on port 8080, revealing the version information of the product in it banner.
The banner  revealed is Apache-Coyote/1.1.
This is the banner of the Apache Tomcat Web Server which runs on port 8080 by default.

Apache-Coyote/1.1 Version Disclosure

Now, as per good security practice, the banner should be removed or modified, so that it no longer reveals the version number.
This can be achieved by editing your server.xml configuration file found at the below location:

CATALINA_HOME/conf/server.xml

Original server.xml reveals version information

Modified server.xml

You may need to restart your server for the changes to reflect.
Once the Tomcat server is up, test the server to see if it shows the custom header.

 

> telnet localhost 8080
HEAD / HTTP/1.0
<CRLF>
<CRLF>

Web Server with Custom HTTP Banner

 

Hope this helps others who are looking for a solution to the banner version disclosure

Check out OWASP’s article on Securing Tomcat for more details.

—

Wasim

Vulnerable Web Applications for learning

Update: 08/08/2010: Created a tabled output of the listing. Platforms for most applications added. More applications added to list thanks to comments.

Just a quick post. Someone on the ‘NULL’ mailing asked for WebGoat alternatives to learning Web Application penetration testing. The reponse was amazing, with many applications being listed as vulnerable web applications designed for learning web-app pentest. I have collected  all vulnerable web applications and listed them below for reference:

[Tool] Unique Pattern Generator for Exploit Development

CAUTION: I have realised, that this script gives wrong results after a certain length of characters. It’s not recommended for use. The intention for this script was for me to learn some coding – which I have. But I haven’ got the time at the moment to fix the errors. Hopefully, sometime in the future, I’ll be able to re-write the code. You can use corelanc0d3r’s pvefindaddr.py, which is an excellent script for Immunity Debugger.

Update: Thanks to corelanc0d3r for pointing out that my script does not generate an output same as the metasploit and pvefindaddr scripts. This is useful, as pointed by him, to anyone wishing to mix the outputs/offsets between the tools. I have made relevant changes to the code and also fixed another bug which prevented all offsets from being calculated.

While developing exploits, at times you require a unique string for which any 4 consecutive characters selected at an instance are unique across the string(or may be repeated only after a large gap of characters). This is mostly used to find the ‘offset’ of the characters which have over-written the EIP register.

Metasploit (version 3.0+) has a tool for both:
1) to generate the string pattern (tools/pattern_create.rb)
2) to find the offset of the required pattern (tools/pattern_offset.rb)

Rediffmail XSS vulnerability disclosed

A member of the ‘NULL’ mailing-list today announced a ‘Persistent XSS’ vulnerability in the ‘subject’ parameter of RediffMail’s email application.
This Vulnerability was discovered and reported by w4rl0ck.d0wn and Rockey Killer of h4ck3r crew
Check out their PoC video at:
Rediffmail PoC

Windows (Trusted) Authentication Vs SQL (Mixed-Mode) Authentication

Just a quick post for my future reference on the differences between Trusted authentication and Mixed-mode Authentication used by SQL Server

Windows Authentication

• When a user connects through a Windows user account, SQL Server validates the account name and password using the Windows principal token in the operating system. This means that the user identity is confirmed by Windows.
• SQL Server does not ask for the password, and does not perform the identity validation.
• Windows Authentication is the default authentication mode, and is much more secure than SQL Server Authentication.
• Windows Authentication
  • uses Kerberos security protocol,
  • provides password policy enforcement with regard to complexity validation for strong passwords,
  • provides support for account lockout,
  • and supports password expiration.
• A connection made using Windows Authentication is sometimes called a trusted connection, because SQL Server trusts the credentials provided by Windows.

SQL Authentication

• When using SQL Server Authentication, logins are created in SQL Server that are not based on Windows user accounts.
• Both the user name and the password are created by using SQL Server and stored in SQL Server.
• Users connecting using SQL Server Authentication must provide their credentials (login and password) every time that they connect.
• When using SQL Server Authentication, you must set strong passwords for all SQL Server accounts.
• Three optional password policies are available for SQL Server logins.
  • User must change password at next login
  • Enforce password expiration
  • Enforce password policy
• SQL Server Authentication cannot use Kerberos security protocol.
• Supports environments with mixed operating systems, where all users are not authenticated by a Windows domain.

Source: http://msdn.microsoft.com/en-us/library/ms144284.aspx

Exploiting ActiveX

I’ve been reading a very interesting paper over the weekend. It’s about exploiting ActiveX controls implemented in the Microsoft Windows OS (mostly IE).
The article is very lucid and easy to understand even for beginners. The paper is titled “ActiveX – Active Exploitation” and it’s written by ‘warlord’

Highly recommended. You can find the article here. I’m also adding it to my Reading Room for future reference.

Deobfuscating Javascript Malware

An edited version of this post has been added to my company blog at Checkmate

Some days back I was greeted by a Google Safe browsing warning when I tried visiting a ‘known’ site. As I was sure it was supposed to be clean and harmless site, I thought it would be good to dig further into this problem. The trail led to interesting amounts of codes, concepts and techniques.

Malware writers are very smart nowadays (haven’t they always been ?). They know that once their code is understood it most likely to be detected by anti-malware applications. To delay detection by such applications, they resort to a wide range of techniques. In this blog post I’ll be discussing the most potent and easily created malware.

Javascript has become the boon and bane of the Internet. It provides greater interactivity with the user but can also be used by malware writers to infect innocent users. Javascript is a client-side scripting technology which means the processing of the script is handled by the user’s browser.

Obfuscation is the concealment of intended meaning in communication, making communication confusing, intentionally ambiguous, and more difficult to interpret.

JavaScript is sometimes obfuscated to prevent users from easily understanding their functionality. ( Legitimate uses are to prevent stealing of code)