Call to Web APP Pentesters

OWASP Hackademic Challenges

This is an open source project that helps us test our knowledge on web applications security. This can actually be used to attack web applications in a realistic but controllable safe env.

You can download the current version here. Don't feel like setting up the env. yourself. Try the live hosted version. Kudos to the OWASP team.

Least frequently occuring strings

Dave Hull has this nice blog article describing the use of the concept of "Least Frequency of Occurence" principle that Peter Silberman spoke about at SANS Forensics Summit. Please keep in mind that it is a hypothetical scenario based on an actual case. So there possibly are better ways of "finding the evil", in the hypothetical case, but its meant to show how this concept works.

Read more here.

MPLS and security

As part of my work, I'm trying to figure out the security concerns of MPLS and here are my brain droppings on the same.

My networks guys insist that MPLS is private and therefore secure, but is it really. It is true that in general MPLS networks are considered private networks and do not require encryption. But this relies heavily on provider's configuration and implementation of the MPLS networks. If the provider MPLS network provides exposure to the internet either through the LSR or any other device, then it has to be deemed "untrusted".  MPLS relies heavily on label switching and is just another specialized form of IP network. So how "private" the MPLS is completely dependent on how "private" has it been engineered to be. Though private addressing is used on the MPLS network, this is just private to the carrier and may not be private to the customer. And also, solely because private addressing is used, by no means warrants that this traffic does not come into contact with Internet or Internet traffic. It seems to be a fairly common practice to use carrier core routers using VRFs to forward both MPLS and Internet traffic on the same equipment. As a matter of fact, it is a fairly common practice to route ATM and Frame Relay networks over MPLS backbones.

Taking this into consideration, it would be prudent of a security engineer to look into the MPLS configs more closely and work with the carriers, in trying to understand how the carrier implements MPLs, and see if you can peer into their LSR configs. Its only a matter of time, before someone figures out a way to attack MPLS successfully via the public Internet, and then everyone will rush to respond to the situation. Ensuring encryption of your MPLs circuits will go a long way in keeping your company showing up on the front page.

Growly notes

Have been using a Mac for a while now. Missed Microsoft OneNote that I use extensively on my work machine. Today I came across a gem in Mac called Growly Notes. Growly notes bring a lot of OneNote-like interface and lsot of features to Mac for free. Growly Notes lacks many of the robust features of OneNote, but works good for me. Being an active OneNote user, getting comfortable using Growly did not take a lot. Almost everything works the same way. Interface feels very familiar.

Kudos to Growly bird software guys. Please give a shout out to those guyz.

 

 

FileInfo

FileInfo is an opensource GUI forensic tool designed to extract information from files. A text version has been available for a while.

This Beta version allows you to do the following:

- Meta Data Information

- String ASCII and Unicode

- Hash MD5 and SHA1

- Detect and Show PE32 Information

- Detect and Extract Thumbnail from JPEG file

More information can be found here.

 

Splitcap - the PCAP file splitter

SplitCap is an opensource pcap file splitter. It splits one big PCAP file into multiple files based on TCP and UDP sessions, one PCAP file per host-pair instead of a session. TCP and UDP sessions concept in SplitCap is defined as bi-directional flows, ie., all frames / packets with the same 5-touple (source host, destination host, source port, destination port, transport protocol) regardless of packet direction are considered part of the same session.

SplitCap is writtern C# using .NET framework 2.0.

Usage: SplitCap [OPTIONS]…

OPTIONS:

-r <input_file> : Set the pcap file to read from

-o <output_directory> : Manually specify output directory

-d : Delete previous output data

-p <nr_parallel_sessions> : Set the number of parallel sessions
to keep in memory (default = 10000). More sessions might be needed to
split pcap files from busy links such as an Internet backbone link, this
will however require more memory

-b <file_buffer_bytes> : Set the number of bytes to buffer for
each session/output file (default = 10000). Larger buffers will speed up
the process due to fewer disk write operations, but will occupy more
memory.

-s <GROUP> : Split traffic and group packets to pcap files based on <GROUP>. Possible values for <GROUP> are:

flow : Each flow, i.e. unidirectional traffic for a 5-tuple, is grouped

host : Traffic grouped to one file per host. Most packets will end up in two files.

hostpair : Traffic grouped based on host-pairs communicating

nosplit : Do not split traffic. Only create ONE output pcap.

(default) session : Packets for each session (bi-directional flow) are grouped

-ip <IP address to filter on>

-port <port number to filter on>

-y <FILETYPE> : Output file type for extracted data. Possible values for <FILETYPE> are:

L7 : Only store application layer data

(default) pcap : Store complete pcap frames

Example 1: SplitCap -r dumpfile.pcap

Example 2: SplitCap -r dumpfile.pcap -o session_directory

Example 3: SplitCap -r dumpfile.pcap -s hostpair

Example 4: SplitCap -r dumpfile.pcap -s flow -y L7

Example 5: SplitCap -r dumpfile.pcap -ip 1.2.3.4 -port 80 -port 443 -s nosplit

SplitCap is created as part of the Statistical Protocol IDentification research project carried out by Erik Hjelmvik with fundings from .SE (The Swedish Internet Infrastructure Foundation).

SplitCap can since version 1.5 also be used in order to efficiently
filter a large PCAP file based on one or several IP addresses or TCP/UDP
port numbers. Simply use the “-s nosplit” option together with one
or several “-port” or “-ip” switches to specify what traffic to keep
from the large pcap file. SplitCap performs this type of filtering
much faster and with way less memory usage compared to tshark.

More details about SplitCAP here.

Mozilla Firefox Internals & Attack Strategies

This paper aims to detail some of the techniques and methods that exist to subvert a fully patched and functioning browser Firefox. This aims to provide insight to developers and end users on some methodologies which could be used by malicious users. We will understand some of the basic important components that make up the Mozilla platform and various attacks that can be targeted against it.

Firefox is a trusted browsing platform used by millions across the globe. It is a platform that is used by experts and novices. One of the biggest advantages and reason for massive success of Mozilla is an extensible plug-in model which allows the developers add additional features to the Mozilla Firefox environment than what was perceived by the original writers. Our topic of discussion is focused around these extension modules and how a malicious developer can use some of these powerful features to subvert a Firefox and the underlying systems. The Code of extension runs with the same privilege that the browser enjoys.

More Details here.