Update those ASA's guys..

To all of my past ASA students, and even those of you who aren't if you are running 5580's there were several ASA vulnerabilies posted last week. As you know the vulnerabilites have been there since the code shipped, but now the bad guys know about it and can DoS your firewalls with single malformed packets..

http://nvd.nist.gov/download/nvd-rss.xml


Also, some of the latest adobe exploits effect the Mac community now :(. When people tell me that Apple sucks, I generally just laugh internally and don't make an argument, the less people using it the better, as far as security through obscurity is concerned, looks like they are starting to become more of a target unfortunately.

My favorite con of the year is less than a Month away, as you should know Defcon is the premiere hacking conference. Not the best on the east coast, or west, not the best in the US, but the best in the world! It follows Blackhat Las Vegas which is held at Caesars Palace just before the Defcon weekend (July 30-August 1). It will certainly be a great time this year, there are some really great looking talks. If any of my past students make it out, I'd like to buy a round of drinks so contact me if you're going!

Is it metasploitable?

Good news to those of you who were looking for a "punching-bag" without the labors of building your own, the Metasploit crew has released Metasploitable which is a purpose-built virtual machine chock-full of vulnerabilities that can be exploited by MSF. It's built on Ubuntu 8.04 which is good news for those of you that have only been working against Windows servers this whole time, you can try out some different payloads.

Grab the torrent!

Looking for a big dict?

So it took me longer than it should have to lookup a massive dictionary file for running some WPA attacks. Some how I misplaced the one I was using when I cleaned up my massive collection of hacking files. Anyhow over at ARGON they have two that seem respectable.

Check here


Aircrack is multithreaded by the way, gets all 8CPUs going nicely

Shodan search engine

This is an absolutely phenominal search engine, where you can query for banners of various types of devices. For instance, say you wanted to know which routers on the internet had the HTTP service enabled, one quick query will tell you. A new vulnerability for your favorite mail platform? Again, its' all archived. Check out shodan today!

Here is an example query

144,000+ IOS routers with the web server enabled!

http://shodan.surtri.com/?q=%22cisco-ios%22+port%3A80

How about IIS 4.0 that we use in reference attacks?

7500 and counting!
http://shodan.surtri.com/?q=%22iis+4.0%22

Web-app punching bag

Chuck Willis over at Mandiant released a web application penetration testing Virtual Machine. This can be handy for learning the ropes, also an alternative to WebGoat (WebApp testing suite).

RIP milw0rm , new exploit repository at remote-exploit

It appears that the guys over at remote exploit have moved in to fill the space left behind after milw0rm quit updating. One of the nice things about the exploit site @ Offsec is that they will occasionally include a link to the vulnerable version of the application which is great for testing.

VIPER VAST

There is another linux STD (Security Tools Distro) that targets VoIP, which is interesting because recently I've emerged myself in voice technologies so for me this is the perfect mix. It has some of the most common tools from backtrack, such as nmap, metasploit, hping, hydra but also UCsniff, video snarf, SIPvicious and more!

http://vipervast.sourceforge.net/

Google for the soul..

Kind-of-sort-of, there is a new search engine that was developed for searching people specifically. Interesting things it finds includes past addresses, social networking sites, traffic citations, arrest records, business records, date of birth,etc. It found a ton of things that google couldn't. Give www.pipl.com a try!

Quick and dirty network sweeps.. Angry IP Now for MAC / Linux

As everyone already knows nmap is the scanner of choice, unless perhaps you are performing simple scans from a Windows environment. In my experience running nmap from Windows is painful if you are used the speed you get while running it from unix. I would often suggest that Windows users move to a real OS (*nix based) or switch to a different scanner. The scanner I enthusiastically recommend is Angry IP, it's lightweight, free, and quick. While discuss scanners with a peer today I became aware that Angry IP has been ported to OS X and Linux. While this will have a smaller audience (due to the fact that nmap does such a great job here) it's still nice to have. My wife is an entry-leven network tech and she's mac based, so while she can use nmap, she does not share my passion for the CLI (understandibly) and while the nmap GUI is really nice, it's more function than she needs. So for a slick easy scanner I can recommend Angry IP for all platforms now.

IKE Scan

When performing audits you can simply sweep for UDP 500, which may indicate that a remote device is listening for IPSec connections, but that's about it. If you were looking for a bit more information you could use ike-scan which will interrogate the remote device and disclose the policy set (aka security parameters). Like most tools I blog about it's free and compact :)

IKE scan can be found:
http://www.nta-monitor.com/tools/ike-scan/

Sample output:
67.78.31.242 Main Mode Handshake returned HDR=(CKY-R=6e69a811525dc72e) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)

DNS mining.. Fierce.pl

Ok, so you know those times when you discover that diamond in the rough, the extremely useful yet previously unheard of tool that makes you want to shout to tell the world about it, only to find out that your friends already know... you wonder to yourself, well why the heck didnt' they tell me?
This post is to save the people I know from the aforementioned scneario. Fierce.pl is a perl script (O rly?) that can be used to discover hosts of a target organization simply by performing DNS resolution against a dictionary file. The dictionary file included isn't bad, however I've extended mine by merging with other world lists and gotten better results.

Long story short, fierce is a super handy tool for discovery resources that is lightweight and easy to use. It's been around for a bit, I'm just making sure that you know about it :)

Fierce can be found here
http://ha.ckers.org/fierce/