Blogs

MagicTree Nessus version 2 XML parsing bug fix

Sébastien Damaye of aldeid.com has reported a bug in MagicTree data import from Nessus XML version 2. Build 1381 includes a corrected XSLT for Nessus XML version 2 and fixes this problem. Thanks to Sébastien for reporting it. The downloads page is updated to point to build 1381.

Tapping 802.1x Links with Marvin

While testing fat clients and appliances for resistance against man-in-the-middle attack I always had to mess with iptables/ebtables/socat to divert network connections. It is enough in most cases, but sometimes the setup gets too elaborate. To make my life easier, I have decided to write a tool, capable to divert and re-inject a network connections while preserving the original network addresses, including layer 2 ones. The tool is not complete yet, but it already can be used to tap into a wired network protected with 802.1x, so I've decided to publish it anyway.

Webmail XSS Tester - Excess2

Here is a script to automate testing of webmail systems for cross-site scripting. It uses XSS Cheat Sheet to generate the injection strings. Compared to the previous version this version downloads XSS cheat sheet on the fly (instead of having it hard-coded) and supports SMTP authentication.

NAME
       excess2 - A script for testing webmail systems for cross-site scripting
       problems

DESCRIPTION

MagicTree Beta Two Publicly Available

Here we go with the first public release of MagicTree, unimaginatively called Beta Two. MagicTree is a penetration tester productivity tool, it allows easy and straightforward data consolidation, querying, external command execution, and (yeah!) report generation. In case you wonder, “Tree” is because its stores all the data in a tree, and “Magic” because it is designed to magically do the most cumbersome and boring part of penetration testing – data management and reporting. See What is MagicTree for more details.

NAND Chip Reader/Writer Gadget

During a recent hardware hacking test I have used a very nice gadget -- NAND Reader sold by Russian company Soft Center. The tool is intended to be used to recover files from damaged thumb drives, but I have repurposed it to read and write the content NAND chips holding embedded OS of the appliance under test.

SSH Man-in-the-Middle Attack and Public-Key Authentication Method

SSH is a protocol for secure remote login and other secure network services over insecure networks. To detect man-in-the-middle attacks SSH clients are supposed to check the host key of the server, for example by comparing it with a known good key.

Windows vs Linux vs MacOS vs OpenBSD

Or Quality Vs. Quantity

It seems to be an unsolvable puzzle for programmers: why would users prefer a buggy and awkward operating system, like Windows, to an elegant and slim one, like Mac OS X? Or prefer a patchy and dirty Linux to clean and secure OpenBSD? Obviously a program that does a few tasks very well is better than a program that does a lot of things badly?

VMWare NATD Silent TTL Overwrite

Bloody (excuse my French) VMware NAT daemon silently overwrites TTL of DNS records! It sets TTL of 0-TTL records it proxies to 5 seconds. Right, normally it is not something to complain about. But it suddenly becomes a big deal if you are busy checking how different browsers respond to DNS rebinding attack... Uhhrr...

Apparently I'm not the first one who has noticed this, somebody else http://communities.vmware.com/thread/236511 had the same experience with Fusion.

DNS Rebinding Checklist

Recently I have done a couple of tests which made me consider DNS rebinding attack in details. Considering relatively large number of "moving parts" involved into the attack, I figured it worth making a checklist which can be used to do this kind of evaluation. Below is the draft which I am working on. In particular I intend to add references and explanations/testing guidelines to the checklist. Not sure about PoC exploits.

Build NetExpect on Ubuntu 10

I came across a nice tool, potentially useful for pen testing: TCP/IP-aware version of TCL expect. Written by Eloy Paris from Cisco Systems it is currently distributed in sources only. I didn't have much time to play with it yet, but it looks very promising. Tomorrow will try to use it for SIP REGISTER flooding, currently done with sipp. (In a way, SIPP is similar to NetExpect, can execute send-expect scenarios, but seems to be focused on SIP protocol.)

Pages

Subscribe to RSS - blogs