Showing posts with label Hacking Tools. Show all posts
Showing posts with label Hacking Tools. Show all posts

Saturday, 14 September 2019

WebARX — A Defensive Core For Your Website

Cyber Attack , Cyber Security News
WebARX — A Defensive Core For Your Website
Estonian based web security startup WebARX, the company who is also behind open-source plugin vulnerability scanner WPBullet and soon-to-be-released bug bounty platform plugbounty.com, has a big vision for a safer web.

It built a defensive core for websites which is embedded deep inside the company's DNA as even ARX in their name refers to the citadel (the core fortified area of a town or city) in Latin.

WebARX—web application security platform—allows web developers and digital agencies to get advanced website security integrated with every site and makes it more effective and less time-consuming to manage security across multiple websites.

You can find reviews such as "WebARX - the Swiss army knife that secures my websites!", "The security software that I use every day," "Many Promise - WebARX Delivers" from their Trustpilot page, so where is all that coming from?

Serious Team With A Unique Focus


WebARX is solving a very specific problem—reducing the security risk from third-party components within web applications, or as its website states, "Protect websites from plugin vulnerabilities."

In fact, the latest studies show that 98% of security vulnerabilities within the WordPress ecosystem (running 35% of the websites online) are related to plugins, which are intended to expand the functionality and features of a website.

Additionally, by contributing to the open-source with WPBullet, the company is also planning to release the first open-source plugin bug bounty platform plugbounty.com, which is released in few weeks.

Advanced Protection For Any PHP App Made Simple and Accessible


Lately, WebARX has gained a lot of popularity for its security platform. According to many, it's one of the most advanced solutions for modern websites that are built on WordPress or any other PHP based content management system.
It takes less than a minute to add a site to the portal and activate monitoring and firewall.

WebARX protects sites from malicious traffic, unwanted bot requests, and prevents OWASP TOP 10 vulnerability exploitation.

As a managed service, WebARX is actively keeping its firewall up to date with the latest threats. Virtual patches are applied automatically to prevent software specific vulnerabilities mostly found within components such as plugins and themes.

The firewall has its benefits from running on the end-point and being component agnostic.

Since WebARX is running on the site, it can't be bypassed the way DNS firewalls are often bypassed (when the IP to the server is leaked by abusing DNS history or when the server is not configured correctly allowing traffic from sources other than what is coming through the firewall).

With WebARX you have the freedom to create an unlimited number of custom firewall rules (match anything within HTTP protocol).

You can analyze and control the firewall among all your sites from the central cloud-based dashboard.

WordPress In the Center of Attention


WordPress, as the most popular content management system, has clearly received a lot of attention. According to some statistics, it runs already more than 35% of the websites.

Attention is not always positive, and this has made WordPress a very attractive target for attackers.

Hundreds of thousands of websites are being abused to redirect traffic, host malware, send out spam and sites are even used as slaves in botnets.

Victims are not chosen; most of the attacks are automated, which targets the software, not the company or the people behind the website itself.

WordPress security is an active topic. Just a week ago, a critical 'Backdoor Attack' warning was issued for 60 million WordPress users via Forbes.


WebARX is the All-in-One Solution For WordPress Sites


"A must for WordPress sites!" as one of its Trustpilot review states, WebARX has already gone a long way to ultimately become the only WordPress security solution you need.

It's always good to keep the number of components/plugins low while having all the security and hardening options available for every site.

Some of the options WebARX includes:

  • WAF with virtual patches and an unlimited number of custom rules.
  • Advanced firewall management and analytics.
  • Central, easy to use cloud-based security portal.
  • Up-time, Blacklist, Domain/SSL expiration, and plugin vulnerability monitoring.
  • 2FA for any site and each user.
  • ReCAPTCHA implementation for forms.
  • Brute-force/XML-RPC protection.
  • Automatic off-site backups to Google Drive.
  • Customizable cookie notice bar.
  • User activity logging.
  • Cloud-based plugin management (remote updating).
  • Cloud-based hardening.
  • Multi-site support.
  • And much more…

WebARX is currently celebrating its birthday, and a 50% discount is offered for a limited time.


Read more »
By - No comments:
Labels: , , , ,

New SIM Card Flaw Lets Hackers Hijack Any Phone Just By Sending SMS

Cyber Security News , Hacker Challenges
New SIM Card Flaw Lets Hackers Hijack Any Phone Just By Sending SMS
Cybersecurity researchers today revealed the existence of a new and previously undetected critical vulnerability in SIM cards that could allow remote attackers to compromise targeted mobile phones and spy on victims just by sending an SMS.

Dubbed "SimJacker," the vulnerability resides in a particular piece of software, called the S@T Browser (a dynamic SIM toolkit), embedded on most SIM cards that is widely being used by mobile operators in at least 30 countries and can be exploited regardless of which handsets victims are using.

What's worrisome? A specific private company that works with governments is actively exploiting the SimJacker vulnerability from at least the last two years to conduct targeted surveillance on mobile phone users across several countries.

S@T Browser, short for SIMalliance Toolbox Browser, is an application that comes installed on a variety of SIM cards, including eSIM, as part of SIM Tool Kit (STK) and has been designed to let mobile carriers provide some basic services, subscriptions, and value-added services over-the-air to their customers.

Since S@T Browser contains a series of STK instructions—such as send short message, setup call, launch browser, provide local data, run at command, and send data—that can be triggered just by sending an SMS to a device, the software offers an execution environment to run malicious commands on mobile phones as well.


How Does Simjacker Vulnerability Work?


Disclosed by researchers at AdaptiveMobile Security in new research published today, the vulnerability can be exploited using a $10 GSM modem to perform several tasks, listed below, on a targeted device just by sending an SMS containing a specific type of spyware-like code.

  • Retrieving targeted device' location and IMEI information,
  • Spreading mis-information by sending fake messages on behalf of victims,
  • Performing premium-rate scams by dialing premium-rate numbers,
  • Spying on victims' surroundings by instructing the device to call the attacker's phone number,
  • Spreading malware by forcing victim's phone browser to open a malicious web page,
  • Performing denial of service attacks by disabling the SIM card, and
  • Retrieving other information like language, radio type, battery level, etc.

"During the attack, the user is completely unaware that they received the attack, that information was retrieved, and that it was successfully exfiltrated," researchers explain.

"The location information of thousands of devices was obtained over time without the knowledge or consent of the targeted mobile phone users. However the Simjacker attack can, and has been extended further to perform additional types of attacks."

"This attack is also unique, in that the Simjacker Attack Message could logically be classified as carrying a complete malware payload, specifically spyware. This is because it contains a list of instructions that the SIM card is to execute."

Though the technical details, detailed paper and proof-of-concept of the vulnerability are scheduled to be released publicly in October this year, the researchers said they had observed real-attacks against users with devices from nearly every manufacturer, including Apple, ZTE, Motorola, Samsung, Google, Huawei, and even IoT devices with SIM cards.

According to the researchers, all manufacturers and mobile phone models are vulnerable to the SimJacker attack as the vulnerability exploits a legacy technology embedded on SIM cards, whose specification has not been updated since 2009, potentially putting over a billion people at risk.


Simjacker Vulnerability Being Exploited in the Wild

Researchers says, the Simjacker attack worked so well and was being successfully exploited for years "because it took advantage of a combination of complex interfaces and obscure technologies, showing that mobile operators cannot rely on standard established defences."

"Simjacker represents a clear danger to the mobile operators and subscribers. This is potentially the most sophisticated attack ever seen over core mobile networks," said Cathal McDaid, CTO, AdaptiveMobile Security in a press release.

"It's a major wake-up call that shows hostile actors are investing heavily in increasingly complex and creative ways to undermine network security. This compromises the security and trust of customers, mobile operators, and impacts the national security of entire countries."

Moreover, now that this vulnerability has publicly been revealed, the researchers expect hackers and other malicious actors will try to "evolve these attacks into other areas."

 



Read more »
By - No comments:
Labels: , , , ,

Saturday, 13 April 2019

Altair – An Open Source Modular Web Vulnerability Scanner

Hacking Tools ,
Altair – An Open Source Modular Web Vulnerability Scanner
Altair is a Python tool that can be used to scan for web related vulnerabilities, some of which include database vulnerabilities (SQL), Cross Site Scripting (XSS), Local File Inclusion (LFI), Remote File Inclusion (RFI), potential sensitive files, and directories containing sensitive information.
The tool scans files and directories of the target host to find potential vulnerabilities. Altair can also make use of SQLMAP and Lfier tools to exploit the said vulnerabilities. SQLMAP is a handy tool that exploits database vulnerabilities. Lfier tool is capable of exploiting the LFI vulnerabilities.

Altair Installation

Altair is a Python based tool that does not require any specific packages to be installed as a pre-requisite. The SQLMAP and Lfier tools must be available on the disposal of the tool if the goal is to exploit the (LFI,SQL) vulnerabilities found during the scanning process. The tool can be cloned using the following command.
git clone https://github.com/evilsocket/altair

How Altair Works

Altair tool can find the vulnerabilities in the target host by running the following command.
python altair.py –u <target web host here>
The above command crawls all the links associated with the target web host. After completing the crawling process, the tool enumerates the target links to find vulnerabilities. If the target host is vulnerable to any of the aforementioned vulnerabilities, the tool displays the results as shown in the following screenshot.
We can also define the filters and modules in the command to refine the scanning process and exploit the vulnerabilities (if any). For instance, we can apply the sqli filter to scan the target web host for SQL vulnerabilities. The module (SQLMAP) can be defined to exploit the SQL vulnerabilities. The following command shows the filter and module inclusion in the scanning process.
python altair.py --filter=sqli --load-modules=sqlmap –url=<target web host here>
If the target web host is vulnerable to SQL vulnerabilities, the tool asks for permission to launch the module (sqlmap) to further exploit the discovered vulnerability.

What Bunny rating does it get?

Altair is handy web scanner that can also exploit the LFI and SQL vulnerabilities if required. The tool however often goes into idle mode while scanning large web applications. for that reason we are giving it 3.5/5 bunnies

Read more »
By - No comments:
Labels:

MassBleed – An Open Source SSL Vulnerability Scanner

Hacking Tools ,
MassBleed – An Open Source SSL Vulnerability Scanner
MassBleed is an open source tool used for scanning SSL vulnerabilities in web applications. The tool can scan Heartbleed, CCS, Poodle, Winshock, and DROWN attack vulnerabilities in target web applications.

MassBleed Installation

MassBleed requires the following scripts to perform its scan.
Heartbleed POC
OpenSSL CCS script
Winshock Script
Unicornscan
Nmap
sslscan
Heartbleed, OpenSSL, and Winshock scripts are available in the source code for MassBleed. The source code can be cloned from Github using the following command.
git clone https://github.com/1N3/MassBleed
Once MassBleed source code is downloaded, navigate to the tool’s directory (MassBleed) to change the file permissions of the scripts as shown below.
chmod +x massbleed
chmod +x heartbleed.py
chmod +x openssl_ccs.pl
chmod +x winshock.sh

How MassBleed Works

MassBleed can perform bulk scan of supported vulnerabilities by running the following command.
./ massbleed.sh [CIDR or IP here] [port] [port # here] [proxy]
MassBleed does not scan the domain names but requires IP addresses of the target web applications. We can define a single IP address as target or range of IPs through CIDR (Classless Inter Domain Routing). We can also define a specific port to scan the target web application using the [port] argument. The [proxy] argument requires the configuration of proxychains.conf file at /etc/proxychains.conf to work. The [port] and [proxy] are optional arguments. For instance, we can run the MassBleed scanner in the following format to test the target IP address (69.164.223.208) without specifying any proxy or port options.
./massbleed 69.164.223.208
MassBleed scans the target web application for all the vulnerabilities, such as DROWN, Heartbleed, OpenSSL CCS, Poodle, and Winshock. The tool also checks the supported Ciphers and OS version of the target web application.
We can also run the individual scripts available in the tool’s directory to scan specific vulnerability. For example, we can run heartbleed.py script from the tool’s directory to scan the target web application for the HeartBleed vulnerabilities.
python heartbleed.py 69.164.223.208

What Bunny Rating Does it Get?

MassBleed is a quick way of finding the SSL vulnerabilities in the web applications. Since the tool accepts IP addresses as input, more work is required to scan websites protected by services like Cloudflare IPs, as a result we are giving it three out of five bunnies

Read more »
By - No comments:
Labels:

Tuesday, 9 April 2019

Ghidra – NSA’s Reverse Engineering Tool Now Available For Free

Cyber Security News , Hacking News
Ghidra – NSA’s Reverse Engineering Tool Now Available For Free
Here comes some good news from the RSA Conference 2019. NSA has allegedly open sourced its robust reverse engineering tool Ghidra. It means anyone can now benefit from the pros of this powerful tool free. Certainly, this will be a pleasing move for bug hunters and cybersecurity enthusiasts alike.

NSA Open-Sourced Ghidra

This week, the National Security Agency (NSA) demonstrated one of their advanced hacking tools at the ongoing RSA Conference 2019. They opened up about their robust reverse engineering tool Ghidra. What’s more pleasing for the cybersecurity community is that NSA has decided to open source this tool.
As defined on the tool’s official web page, it benefited NSA for its cybersecurity mission. However, open-sourcing such a tool would definitely benefit the whole world.

Reportedly, Rob Joyce, NSA’s Senior Advisor, presented Ghidra at the RSA Conference 2019 going on in San Francisco, this Tuesday. Besides demonstrating the tool, he also announced that the tool will soon be available for free to the public. As already announced in the session description given on the Conference’s website,
“NSA has developed a software reverse engineering framework known as GHIDRA, which will be demonstrated for the first time at RSAC 2019… The GHIDRA platform includes all the features expected in high-end commercial tools, with new and expanded functionality NSA uniquely developed, and will be released for free public use at RSA.”
For now, all those interested in the tool may visit the Github repository placeholder to find more information about Ghidra. Soon, the code for this SRE app will also be available here.

Ghidra – A Powerful Reverse Engineering Tool

Ghidra is a robust software reverse engineering (SRE) tool. Although, there already are numerous reverse engineering tools available. Some of these are known for their outstanding features, such as IDA. This app also flaunts features benefitting the cybersecurity experts.



Read more »
By - No comments:
Labels: , ,

Tuesday, 2 April 2019

YAWAST – Open Source Web Application Information Gathering Toolkit

Hacking Tools ,
YAWAST – Open Source Web Application Information Gathering Toolkit
YAWAST is a web application penetration testing toolkit that can perform information gathering and basic vulnerabilities (misconfiguration) assessment tasks related to TLS/SSL, Files, directories, and application headers. Regarding SSL/TLS, the toolkit gathers information like certificate details, supported ciphers, and DNS CAA record. The SSL issues detected by YAWAST include expired certificates, self-signed certificates, MD5 signature issues, SHA1 signatures issues, weak cipher suites, and SWEET32. The information disclosure tests allow YAWAST to find out leaked headers’ information, server information, CMS data, OpenSSL modules information etc.  YAWAST checks if the security headers are enabled on the target web application. Some example headers include X-Powered-By header, X-Runtime header, X-Frame-Options header, Content-Security-Policy header, and X-XSS protection header. Certain DNS information like IP addresses, TXT record, MX record, NS record, CAA record, and subdomain information is also gathered by YAWAST toolkit.

YAWAST Installation

YAWAST toolkit requires Ruby 2.2+ package installation as a prerequisite. The toolkit supports Linux, Windows, and MAC OSX. On linux OS,YAWAST can be installed using the following command.
gem install yawast
All the required packages are auto installed to fulfill the toolkit’s dependencies.

How YAWAST Works

The following simple command runs the YAWAST tool into a scanner mode to find out all the information and vulnerabilities mentioned above.
yawast scan <target url here>
The above command performs information gathering and vulnerabilities assessment tasks in one go. The information is denoted by the “I” symbol and the vulnerabilities (and misconfigurations) by “W” symbol. For instance, the following screenshot shows header information of target web application along with misconfigurations identified by YAWAST toolkit.
Similarly, cookie information is presented in the following format.
Apart from standard scanning, we can apply custom parameters to refine the scanning process. For example, we can apply the dns parameter in the following format to look for only DNS information.
yawast dns <target url here>
Similarly, we can use head, ssl, and cms parameters to restrict the scanning process to Header, SSL, and CMS information respectively. The complete list of parameters and help material can be explored using the help command.

What Bunny Rating Does it Get?

YAWAST tool is capable of information gathering and finding basic configuration errors in web applications. The toolkit however could be expanded to find more critical based vulnerabilities, for that reason we are giving it 3/5 bunnies.

Read more »
By - No comments:
Labels:

Friday, 7 September 2018

Zeus Scanner – Dork Searching and Web Applications Vulnerability Assessment Tool

Hacking Tools ,
Zeus Scanner – Dork Searching and Web Applications Vulnerability Assessment Tool
Zeus scanner is an open source tool used for reconnaissance and vulnerability assessments of web applications. The tool is equipped with a powerful parsing engine to extract cached web pages from multiple search engines. During parsing, the robots.txt and sitemap.xml files information of target host is saved in a file on the local system.
The tool also has the ability to bypass the API calls, IP blocking, and captchas security while extracting data from search engines. Supported search engines include Google, Bing, AOL, and DuckDuckGo. Zeus supports Tor proxy and Tor browser emulation.
Besides the reconnaissance feature, Zeus also has the ability to assess various web vulnerabilities, such as SQLi, XSS, clickjacking, port scanning, admin panel information, and Whois lookup information. The vulnerability assessment can be performed either by running a default user-agent, personal user-agent, or one can select a random user-agent from an available pool of 4000 random user-agents scripts.
The record of the useful information obtained while scanning the target is saved in a log file. Zeus can also identify defensive strategies. This includes the identification of an intrusion detection system, intrusion prevention system, and web application firewalls.

How to Install Zeus Scanner

Zeus Scanner requires some libraries and packages to operate. The basic requirements include Firefox version 52-58, Sqlmap, libxml2-dev, libxslt1-dev, and python-dev. Firefox can be updated or installed using the following commands.
sudo apt-get update
sudo apt-get install firefox
Sqlmap can be installed from the github repository using the following command.
git clone https://github.com/sqlmapproject/sqlmap.git
libxml2-dev, libxslt1-dev,  and python-dev. can be installed as follows.
sudo apt-get install libxml2-dev libxslt1-dev python-dev
Besides dev, libxslt1-dev, python-dev, Zeus requires some python packages, such as selenium-webdriver, requests, python-nmap, whichcraft, lxml, beautifulsoup, psutil, and pyvirtualdisplay. Before installing these packages, clone the Zeus Scanner setup from github repository using the following command.
clone https://github.com/ekultek/zeus-scanner.git
The final step is to install the aforementioned python packages using the following commands.
cd zeus-scanner
sudo pip2 install -r requirements.txt

How Zeus Works

Run the Zeus tool by executing the zeus.py file in the following format.
sudo python zeus.py
The simplest way to scan a target is done by passing single dork scan argument (-d) to the following command.
python zeus.py –d
The tool starts extracting data from the search engines and saves the results in the root/zeus-scanner/log folder.
To run the dork list, the following command needs to be run in the terminal.
python zeus.py –l dork.txt
The dork.txt contains the urls to be scanned with the tool. The other arguments, e.g proxy setting, can also be appended with the commands in the following format.
python zeus.py –d  --proxy=”proxy address here”
Similarly, we can use Zeus to check if the target host is vulnerable to SQL injections by sending the request to the sqlmap tool.
python zeus.py –s –d  --sqlmap-args=”threads 5, level=3, risk=3, randomAgent true”
By running the above command, the tool validates the url and parameters required to proceed with the sql injection query.

What Bunny rating does it get?

The tool helps in finding certain client urls that are either blocked or hidden from public search forums. Such urls can be helpful in identifying possible hidden vulnerabilities that can be later exploited by the pen tester. The addition of tools like sqlmap in Zeus can verify the vulnerabilities and the false negatives, as a result we will be awarding this tool a rating of 4 out of 5 bunnies.
Read more »
By - No comments:
Labels: