Sponsored By:

www.coresecurity.com


www.tenablesecurity.com


www.sans.org


www.whitehatworld.com




November 2008 Archives

Zen and The Art Of An Internal Penetration Testing Program - Part I

|

This webcast is Part I of a two part series I am doing in collaboration with Core Security Technologies. The presentation is full of tips, tricks, process, and practical knowledge about performing penetration testing within your own organization. Whether you are a third-party doing penetration tests or want to penetration test your internal network, this webcast is for you! In Part I I cover such topics as finding rogue access points, processes for creating a successful penetration testing program, identifying targets, and more! Information and resources are below:

zen.png

Audio: Zen and The Art Of An Internal Penetration Testing Program - Webcast (Registration Required)

Slides: Zen and The Art Of An Internal Penetration Testing Program - PDF Slides

Forum: Online forum discussion and other related information.

I released a new version of the Perl script that can be used to detect Rogue Access points in your environment:

Rogue AP Detect Script v0.02

Its a good example of some of the more powerful things you can do with Nmap, and if you're on a budget its a perfect technique for finding those pesky rogue APs. What does this have to do with internal penetration testing? You will just have to listen to the webcast to find out :)

Paul Asadoorian

PaulDotCom

By Paul Asadoorian

This is a nice, easy way, to build a custom dictionary for your target. I got some of the original code from SANS Security 560 by Ed Skoudis. With his permission, I've published some of my enhancements. The first step is to grap the entire web site:

wget -r -l 2 www.targetwebsite.com

terminalyellow.jpgI'm going two levels deep here, you can adjust that with the "-l" flag. How many levels deep depends on how big of a dictionary you want and how big your target site is. [Editors note: This can take you outside of the target website by following links to other sites. As Paul pointed out, this may be valuable. If the sites are linked, there is something in common and valuable between them] Next, we replace the spaces with new line characters and produce a uniq list:

grep -hr "" www.targetwebsite.com/ | tr '[:space:]' '\n' | sort | uniq > wordlist.lst

Next step is to remove the weird characters. Don't worry, we can put them back. This primarily removes the HTML tags and such:

egrep -v '('\,'|'\;'|'\}'|'\{'|'\<'|'\>'|'\:'|'\='|'\"'|'\/'|'\/'|'\['|'\]')' wordlist.lst | sort -u > wordlist.clean.lst

ripper.jpgNote: I do not remove the parentheses characters "()". We probably need to move to perl regex or something similar to do that. I get a syntax error when I try to remove the "(" or ")". Also, different versions of grep (and wget) will behave differently, so you might have to tweak. Below, we append the default John the ripper password list to our custom list:

cat password.lst >> wordlist.clean.lst

Now, we might have duplicates and since we removed all special characters (Well, most of them anyhow) we need to put them back. Below we run John to re-generate our unique wordlist, apply some rules, and output to standard out:

john --wordlist=wordlist.clean.lst --rules --stdout | uniq > final.wordlist.lst

For bonus points you can modify the rules so that it does a better job of adding in special characters (such as replacing all "i" with "1"). We'll leave this exercise up to the reader.

Passwords are just so easy to abuse...

- PaulDotCom

PaulDotCom Security Weekly - Episode 131 - November 20, 2008

|

Paul & Larry talk security with special guest John Strand!

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • SkullBeer.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds:

RI Linux Installfest - Winter Edition

|
PaulDotCom Enterprises in conjunction with the SNENUG (Southern New England Network Users Group) is proud to present the second Linux Installfest for 2008. An installfest allows you bring in your old computers (or anything that will run Linux) and get help from others in the community with the installation and configuration. Got an old PC hanging around? Bring it by! Got a dusty old ipod or wireless router? Get help from Paul & Larry, authors of the WRT54G Hacking book!
tuxwinter.png
Where: Care New England, Trowbridge Building, 10 Health Ln (or 455 Tollgate Rd for older GPSes) Warwick, RI (Right next to Kent Hospital), First floor rooms 102 & 103. When: Saturday, December 6, 2008 (9:00AM - 4:00 PM) Contact: Please email paul@pauldotcom.com for questions or more information Registration: Registration will be done at the door, so just show up! Directions Here We also need volunteers to assist people with installing Linux, so if you're already a Linux guru please come by to help. Internet access will be provided, however if your device requires a monitor please bring one (a small one if possible). PaulDotCom will be sponsoring the food and drink for the event. Below are some answers to some common questions: * What about MythTV? - By popular request this year we will be attempting some installs of MythTV with Mythbuntu. Please check the website for supported tuners to bring with you. There is no cable television service available in the facility, but we will provide a "local feed" for testing. * Do I need to bring my own installation media? - This depends, if you have a particular Linux distribution that you would like to install, please download it and burn it to CD beforehand. If you don't have a preference, we will have some installation media here and can even download and install it once you get here. * Do I need to bring a monitor and keyboard? - If you are bringing a computer (and not a laptop or other device that does not require a monitor or keyboard) please bring your own monitor and keyboard. It is highly recommended that you bring an LCD monitor to save space. We will have a few spare monitors on hand. * Will there be Internet access? - Yes, both wired and wireless Internet access will be available. Again, please try to download all of the neccessary software beforehand such that the network does not slow down due to multiple people trying to download Linux at once. * I've never installed Linux before, will people be there to help me? - Yes, there will be several experienced Linux users in attendence to help you install Linux. They will stick with you throughout the day until the installation is completed. * I am an experience Linux user, can I still attend? - Yes, please come by to help people install Linux, eat, drink, and be merry. This is a fun, social, event! * I want to do an advanced Linux installation, can I bring an embedded device and get help installing Linux on it? - Yes, I will actually be bringing 3 devices to try to install Linux on, a 2nd generation iPod, a Routerboard 532a, and a Soekris net5501. I may be asking for help too!

The live stream should be active about 6:30 EST, Thursday, November 20th. We should begin recording the live show at about 7:00 EST. Please keep in mind that these times are all estimates, but we will try to do the best that we can.

This week we have a special guest, Josh Wright wireless hacker extraordin"air"!

Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel! Find us on IRC at irc.freenode.net #pauldotcom.

When active, the live stream(s) can be found at:

Ustream: http://ustream.tv/channel/pauldotcom-security-weekly

Icecast: http://radio.oshean.org:8000

Please join us, and thanks for listening!

- Larry & Paul

willhackforsushi.jpg

This is just my advice, and is actually a very nebulous thing to answer. I'll tell you what has worked for me over the years. I'm just breaking the surface, and still learning from my own advice.

My (sage?) Advice

* Read all you can find! - the Internets have exploded with all sorts of information on electronics projects, kits, you name it. I'll have some stuff in the reading/websites section below with some specifics

* Find a mentor - One locally is great and is also a way to meet new people and get ideas. Consider your local 2600/Defcon/Maker group. At a minimum, stop in on the local HAM radio club. For what it was worth, my mentors ended up being my Dad, who was an EE and my grandfather who was a swamp yankee/inventor. mentat.gif

* Take something apart - Now certainly you might not want to take apart that nice $3000 flat panel TV, but find something appropriate. Check yard sales for cheap electronics, or even on trash day. For beginners, stay away from TVs and Microwave ovens (when you get some smarts they are full of good parts...). Don't discount kids toys; they can take you down the road of circuit bending! With these scenarios you won't feel bad if you break something that was broken, cheap or free. Explore! You own the hardware! Figure out what all those unknown little bits do by looking up spec sheets on the internet.

* Think of ways to make something better - You know all that crap, I mean valuable electronics, you just picked up? If something works, how would one of them be made better or how could it be made to do something else? For example, we picked up a "baby boom box" at a yard sale for a quarter. My daughter LOVES it, but it is loud, and doesn't have an off switch. See? Take it apart and add a (baby proof) switch to disconnect the positive battery lead, and add a potentiometer (variable resistor; sort of like a dimmer switch) in line with the positive speaker wire. When she's done with it in a few years, take another look at how you could have improved that design; instead of the potentiometer what about replacing an output resistor. This can get even more fun, as you can start circuit bending!

* Mind your voltages - ...and of course your positives and negatives. Don't swap them, and don't over power them (unless you read all about those power regulation chips). Making these mistakes is a great way to let the magic smoke out of your electronics. Double (even triple) check your wiring. With higher voltages (such as direct mains power), they can easily let the magic smoke out of you. Start small.

* Don't be afraid to follow in the footsteps of others - Read someone else's projects and recreate them, or in many lucky cases, build them from a kit. It is a great way to learn how to solder/desolder and learn the principles and about the parts. Learn from someone else's experience and mistakes and even improve on the design. Eventually your soldering iron.jpgpath will drift, and you'll be on your own road, even if it is just a slight deviation at first. Modify your kit!

* Learn to solder - Yeah, you had to figure that was coming. Also, learn to de-solder. Use all of those valuable electronics you picked up to practice both; you aren't learning on your project this way. Practice makes perfect! Yes, re-solder the pieces you just practiced removing. When you are done, you can even be left with a bunch of parts to use in another project, that are often worth more apart then the sum of the free/cheap whole. A great way to build an inventory of bits and wire.

* Start with the basics - Learn basic electronic principles; completing a circuit, switches, etc. Even though they are old, don't hesitate to use analog devices like 555 timers, transistors, capacitors, resistors and so on. Venture into microcontrollers such as Arudino and PICs as you get more comfortable. Learn how to read schematics - even the basics will take you along way.


Tools

You'll need a few things to get started of course. Start small. Go ahead and buy just what you need to work on your first project. See if you can borrow some from a friend (but return them!) for a bit. Certainly, try out the moderately priced soldering iron from Radio Shack to get started...

Here's what I find is most helpful:

* A multi-meter - I don't know how I missed this on the podcast, but this one is a must. Even a cheap digital one would be good. My Grandfather would suggest going analog to start in order to learn the basics and the tool itself.

* Dremel with grinding and cutoff wheels

vartools.jpg * Drill press and bits, in a pinch, a hand drill (electric or otherwise) will work.

* Soldering station - I like Weller, but I have a generic. Variable temperature is best. Note, don't file down new, modern tips. They are caoted and filing ruins them.

* De-soldering iron. A "solder sucker" is Ok, but tends to be frustrating. De-soldering wick is good too.

* Small screwdrivers, jewelers screwdrivers, torx, and any other security screw bits. It is all about having the right tool for the job. This coming from a guy who just upgraded the hard drive in his MacBook Pro with a jewelers flat head screwdriver for phillips screws, and a filed down jewelers flat head to remove #25 Torx screws.

* Set of small metal files (for sharpening your cheap soldering iron, and filing down flathead screwdrivers.)

* A pair of "extra hands". A magnifying glass or head mounted loupe (both in conjunction with a good light source) is also a huge plus.

* Pliers and wire cutters are also a great idea. As are a pair of wire strippers (your teeth get tired after a while).


Reading/Websites

There is tons of info out there. Here are some of the places I learn and take inspiration from:

schematic-symbols-resistor.png

* Make - This is the mecca of all things hack. A little of everything, and they've really blown the doors off this thing for the whole community, making this info and reporting available for everyone.

* Hackaday - A daily dose of hacking goodness on all sorts of topics. Good brain food and they've recently started a series about all the piece parts.

* LadyAda - Limor Fried's website. Kits (at AdaFruit Industries), and general blog about electronics goodies.

* Citizen Engineer - A new video series on hardware hacking how-tos

* Nuts and Volts Magazine - Pure electronics projects that you can adapt the concepts to your own projects.

* Instructables - All sorts of step by step tutorials on all types of hacks, crafts and electronics.

PaulDotCom Security Weekly - Episode 130 - November 13, 2008

|

Paul & Larry discuss security, hash, rubber chickens, religion, politics, and American history (Yes, I'm convinced no one reads what I type here ;)

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • 3027803297_829f507e9e.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds:

The live stream should be active about 6:30 EST, Thursday, November 13th. We should begin recording the live show at about 6:00 EST. Please keep in mind that these times are all estimates, but we will try to do the best that we can.

Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel! Find us on IRC at irc.freenode.net #pauldotcom.

When active, the live stream(s) can be found at:

Ustream: http://ustream.tv/channel/pauldotcom-security-weekly

Icecast: http://radio.oshean.org:8000

Please join us, and thanks for listening!

- Larry & Paul

larryeatswrt.jpg

PaulDotCom Security Weekly - Episode 129 Part II - November 6, 2008

|

In Part II we discuss stories and bring on none other than Josh Wright to talk about some of the latest attacks against TKIP.

We are still working on the sound quality problems, swapped out a few cables this week and it helped. The intro to the show is messed up and Larry and I are only on the left channel, this does NOT persist throughout the entire episode. Please bare with us while we work towards better sound quality.

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • SushiTime.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds:

PaulDotCom Security Weekly - Episode 129 Part I - November 6, 2008

|

In Part I of this week's episode we are joined by Bill Brenner, talking to us and the listeners about the best ways to sell security to upper management.

In Part II we discuss stories and bring on none other than Josh Wright to talk about some of the latest attacks against TKIP.

We are still working on the sound quality problems, swapped out a few cables this week and it helped. The intro to the show is messed up and Larry and I are only on the left channel, this does NOT persist throughout the entire episode. Please bare with us while we work towards better sound quality.

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • 3009128138_aedf946bc3.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds:

By Paul Asadoorian

There are lots of ways to skin this cat. This came up and piqued my interest because I was looking at the Nessus plugin to do this. This is a neat concept, but relies on some really old information from Nmap 3.50 OS fingerprints. I decided that using Nmap directly is probably best to perform this task. Luckily, my handy Nmap Book has a section devoted to this called "8.8 SOLUTION: Detect nns-cover-202x125.pngRogue Wireless Access Points on an Enterprise Network", which can be found in the OS Detection Chapter. Now, there is an example Nmap command in the book, but I came up with the following Nmap command on my own to do this on my home network:

nmap -PN -n -pT:80,443,23,21,22,U:161,1900,5353 -sU -sV -sS -oA osfinger -O -T4 192.168.69.0/24

The above Nmap command scans the network with no ping options set (-PN), and no name resolution (-n). It only scans selected TCP and UDP ports, which I find is a really neat feature to be able to specify independent lists of UDP and TCP ports using the syntax above. I chose the ports listed because they are most frequently found listening on embedded devices. I want to know if those ports are open (-sU and -sS), and I want to fingerprint them if they are open (-sV). I also want all of the result types (nmap, grepable, and xml) so I can work with the results on XML and if a scan dies, resume with the csv file. I also want an OS fingerprint and use aggressive timing.

This is great, but for use in an enterprise I want to run this on a cron job and have it email me the results every day. So I extended using Nmap Parser (a perl library for accessing Nmap results and running Nmap scans) and came up with:

RogueAPDetect, written in perl.

reload_nmap_c.jpgNmap Parser was also featured in PaulDotCom Security Weekly Episode 55 where I show you how to use it to find vulnerable hosts on the network in conjunction with nbtscan.

I installed the latest version of Nmap Parser, version 1.13. [Editors Note: Nmap Parser 1.18 is now available, but the compatibility with Nmap version 4.76.] I had to change the object names to be compatible with the new version, but it works like a champ. Example results look like this:

rogueapdetect.pl v0.001 - ( paul@pauldotcom.com )
--------------------------------------------------

Scan Information:
Number of services scanned: 7
Start Time: 1221793134
Scan Types: syn udp

Hosts scanned:

Address : 192.168.69.95
OS match : OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34)
Device Type: WAP
Address : 192.168.69.92
OS match : OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34)
Device Type: WAP

Oh look, a couple of devices running OpenWrt, go figure!

- Paul

[Editors note: I figured that this was a good idea to post after some of the discussion on the SANS Alumni mailing list. Paul also commented there (and I agree) that wired side detecting should be combined with wireless scanning as well. Just one of the reasons is that it can be difficult to accurately determine the device if only given a MAC address; Try figuring out if that Linksys MAC address is a client or router. Not to mention that MAC address changing is pretty trivial nowadays, adding a little more cloudiness to the situation. Using Paul's methods for correlating information on open ports, banner grabbing, and OS detection certainly makes more sense for the wired side portion of the discovery.

Paul has promised us a new tool with new features in the near future. I hear rumors that there is an NSE script (the Nmap Scripting Engine) in the works. Stay tuned! - Larry ]

PaulDotCom Security Weekly - Episode 128 Part II - October 31, 2008

|

We are still working on the sound quality problems and have yet even more equipment to replace, so next episode we should have it all worked out (I hope).

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • No_Zombies_Allowed.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds:

The live stream should be active about 6:30 EDT, Thursday, October 30th. We should begin recording the live show at about 7:00 EDT. Please keep in mind that these times are all estimates, but we will try to do the best that we can.

This week our featured guest is Bill Brenner from CSO Magazine to talk to us about selling penetration tests and security to upper management.


Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel! Find us on IRC at irc.freenode.net #pauldotcom.

When active, the live stream(s) can be found at:

Ustream: http://ustream.tv/channel/pauldotcom-security-weekly

Icecast: http://radio.oshean.org:8000

Please join us, and thanks for listening!

- Larry & Paul

bbrenner.jpg

PaulDotCom Security Weekly - Episode 128 Part I - October 31, 2008

|

New Audio Version Uploaded 11-18-08

We are joined this week by Jason Ostrom, author of voiphopper.

We are still working on the sound quality problems and have yet even more equipment to replace, so next episode we should have it all worked out (I hope).

  • Sponsored by Core Security, listen for the new customer discount code at the end of the show
  • Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
  • Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
  • Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
  • Be sure to check out "Maltego" from Paterva, try the community edition for free!
  • Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
  • Full Show Notes
  • 2986917419_d724ffd163.jpg

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

Email: psw@pauldotcom.com

Direct Audio Download

Audio Feeds: