SandCat v3.8 Released

About

Sandcat allows web administrators to perform aggressive and comprehensive scans of an organization’s web server to isolate vulnerabilities and identify security holes. The Sandcat scanner requires basic inputs such as host names, start URLs and port numbers to scan a complete web site and test all the web applications for security vulnerabilities

New features in version 3.8

Improved JavaScript/AJAX Support - Sandcat’s JavaScript emulator makes Sandcat behave as both Firefox and IE, simulating user interaction (such as key press and mouse click), AJAX calls and more. This feature complements the JavaScript analysis feature available since Sandcat 3.0

Multi-Layer Defense Evasion - Sandcat 3.8 attempts to detect and evate intrusion detection systems, web application firewalls, web honeypots and anti-XSS filters.

Multi-Thread Sessions (Pro version only) - Sandcat Session Launcher adds concurrent sessions support in Sandcat. Multiple host threads per session are also supported.

And more - A new, improved HTML parser, improved link detection, faster and more robust report generation, and many other enhancements greatly expand the Sandcat’s capabilities and make your life as a penetration tester a lot easier.

Download Free Release

Sandcat v3.8

MonkeyFist v0.4 Released

Hexagon Security Group releases MonkeyFist, a dynamic Request Forgery attack tool. (http://hexsec.com/)

About

MonkeyFist is a tool that creates dynamic request forgeries based on cross-domain data leakage. The tool then constructs a payload based on data in the payloads.xml file and sends it to the user's browser. This may include session data bypassing protection mechanisms for Cross-Site Request Forgery.

Written in

It is written in Python which means it is cross platform. Many operating systems already come with Python installed. The only dependency as of now is that lxml be installed. Currently this is just being used for the fixation payload type.

Read the Dynamic CSRF paper here

http://hexsec.com/docs/Dynamic_CSRF_rev1.pdf/view

More Information

For usage or practical examples, check out the Neohaxor blog.

Best Regards.

Presentation: Botnets

Delivered the session today. It was an interesting discussion and after some initial hiccups in the bot demo, it went fine.

Attaching the presentation in here.

Botnets: The Silent Threat

Hope it would be helpful.

Best Regards.

RainbowCrack 1.4

RainbowCrack 1.4 is released

http://project-rainbowcrack.com/

This version focus on more effective rainbow table file format. New features:

- New compact rainbow table file format (.rtc) reduce rainbow table size by 50% to 56.25%

- New rt2rtc utility convert rainbow table from raw file format (.rt) to compact file format (.rtc)

- New rtc2rt utility convert rainbow table from compact file format (.rtc) to raw file format (.rt)

- The rcrack/rcrack_cuda program support both .rt and .rtc rainbow table file format

- Conversion from non-perfect to perfect rainbow table is supported by rt2rtc utility

Smaller rainbow table significantly improve table lookup performance!

Best Regards..

Hacking CSRF Tokens using CSS History Hack

Detailed write up on new CSRF Token hack using CSS History:

http://securethoughts.com/2009/07/hacking-csrf-tokens-using-css-history-hack/

Proof of Concept here:

http://www.securethoughts.com/security/csrfcsshistory/csrfscan.html

Best Regards.

Anatomy of a Twitter Attack.

A Good write up on the recent Twitter attack:

http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/

Best Regards.

Quick update: Botnet lab test

It took quite a time to get this src up and kickin', and finally this seems to be working just fine, if not great. I had been planning to take up the botnet session, upon which I posted earlier here Botnet: The Silent Threat I and Botnet: The Silent Threat II. As most of us are already aware of the theory, it made little sense to me for just going ahead only with plain words and pics.

So I started setting up a test lab. And little had I known, this is going to be interesting; spent several nights up, and surrounded by dozens of bot sources. I checked out every source one by one. Public sources are usually broken, modules missing and need to be checked carefully. well, most of the src will compile smooth; but either they didn't connect back to the ircd, or start behaving undefined and in some cases, reached out to their respective mother ship.

As of now, I've been able to fix rx src, ago src runs fine but is backdoored. Some variants of rx, ago, phat etc n other private src absurdly starts up port scan of the ircd!!

I know rx is quite old, but I believe it is good enough for the lab test n video tutorial (rx variants are still out even today).

Anyways, this is what I have been able to test on rx 7.6 src:

1. DDoS - icmpflood, synflood, tcpflood, udpflood etc.

2. Spreader - dcom135 hitting a windows 2k box

3. Misc funcns - Keylogging, screen/webcam capture, remote shell etc.

I am using unrealircd for the irc server, wireshark/tcpview on the hosts for watching connections as they open and xchat client for attacker. I am hoping to add some new exploits to the rx src if I can get some time this week.

There's few other src here which I will focus on now that rx is up. These src have aim/msn and several other spreader functions besides common windows sploits. Hope to get these up before weekend.

Ok, I guess I'll take a break off for few hours now. The morning sun is about to rise and shine.

Best Regards.