growing up

This commit is contained in:
bt3gl 2024-03-14 18:06:10 +01:00
parent ef5077cd50
commit 9bb02f2ddf
25 changed files with 47 additions and 50 deletions

View File

@ -150,7 +150,7 @@ In addition, a crucial detail is to understand how the client encrypts the comma
### The PCAP File ### The PCAP File
The last file was a **pcap** dump. When opening it with [Wireshark](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html), I verified it was really short, and the content was simply a [TCP handshake](http://www.inetdaemon.com/tutorials/internet/tcp/3-way_handshake.shtml). Right-clicking some packet and selecting *Follow TCP Stream* returned the dump of the connection suggested by the **client.py** script: The last file was a **pcap** dump. When opening it with [Wireshark](http://go.github.io/wiresharking-for-fun-or-profit.html), I verified it was really short, and the content was simply a [TCP handshake](http://www.inetdaemon.com/tutorials/internet/tcp/3-way_handshake.shtml). Right-clicking some packet and selecting *Follow TCP Stream* returned the dump of the connection suggested by the **client.py** script:
![cyber](http://i.imgur.com/2Y6aaW1.png) ![cyber](http://i.imgur.com/2Y6aaW1.png)

View File

@ -387,9 +387,9 @@ ASIS_85c9febd4c15950ab1f19a6bd7a94f87
---- ----
[Paillier cryptosystem]: http://en.wikipedia.org/wiki/Paillier_cryptosystem [Paillier cryptosystem]: http://en.wikipedia.org/wiki/Paillier_cryptosystem
[here]: https://github.com/bt3gl/CTFs-Gray-Hacker-and-PenTesting/tree/master/CTFs_and_WarGames/2014-ASIS-CTF/crypto_paillier [here]: https://github.com/go-outside-labs/CTFs-Gray-Hacker-and-PenTesting/tree/master/CTFs_and_WarGames/2014-ASIS-CTF/crypto_paillier
[modulo]: http://en.wikipedia.org/wiki/Modulo_operation [modulo]: http://en.wikipedia.org/wiki/Modulo_operation
[oracle]: http://en.wikipedia.org/wiki/Oracle_machine [oracle]: http://en.wikipedia.org/wiki/Oracle_machine
[ASIS CTF]: http://asis-ctf.ir/home/ [ASIS CTF]: http://asis-ctf.ir/home/
[Binary search]:http://en.wikipedia.org/wiki/Binary_search_algorithm [Binary search]:http://en.wikipedia.org/wiki/Binary_search_algorithm
[my scripts]: https://github.com/bt3gl/Python-and-Algorithms-and-Data-Structures/tree/master/src/searching_and_sorting/searching [my scripts]: https://github.com/go-outside-labs/Python-and-Algorithms-and-Data-Structures/tree/master/src/searching_and_sorting/searching

View File

@ -276,12 +276,12 @@ If you like this solution, take a look at my [exploit for this problem].
**Hack all the things!** **Hack all the things!**
[his cryptographic scheme]: http://en.wikipedia.org/wiki/Caesar_cipher [his cryptographic scheme]: http://en.wikipedia.org/wiki/Caesar_cipher
[exploit for this problem]: https://github.com/bt3gl/CTFs-Gray-Hacker-and-PenTesting/tree/master/CTFs_and_WarGames/2014-CSAW-CTF/cryptography/crypto-200 [exploit for this problem]: https://github.com/go-outside-labs/CTFs-Gray-Hacker-and-PenTesting/tree/master/CTFs_and_WarGames/2014-CSAW-CTF/cryptography/crypto-200
[scripts from other authors]:https://github.com/bt3gl/CTFs-and-Hacking-Scripts-and-Tutorials/tree/master/2014-CSAW-CTF/cryptography/crypto-200/from_the_net [scripts from other authors]:https://github.com/go-outside-labs/CTFs-and-Hacking-Scripts-and-Tutorials/tree/master/2014-CSAW-CTF/cryptography/crypto-200/from_the_net
[well-known table of word frequency values]: http://en.wikipedia.org/wiki/Letter_frequency [well-known table of word frequency values]: http://en.wikipedia.org/wiki/Letter_frequency
[telnetlib]: https://docs.python.org/2/library/telnetlib.html [telnetlib]: https://docs.python.org/2/library/telnetlib.html
[socket]: https://docs.python.org/2/library/socket.html [socket]: https://docs.python.org/2/library/socket.html
[own netcat script]: https://github.com/bt3gl/CTFs-and-Hacking-Scripts-and-Tutorials/blob/master/Tutorials/Useful_Scripts/netcat.py [own netcat script]: https://github.com/go-outside-labs/CTFs-and-Hacking-Scripts-and-Tutorials/blob/master/Tutorials/Useful_Scripts/netcat.py
[pygenere]: http://smurfoncrack.com/pygenere/pygenere.php [pygenere]: http://smurfoncrack.com/pygenere/pygenere.php
[Vigenere Cipher]: http://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher [Vigenere Cipher]: http://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher
[online Vigenere cracker]: http://smurfoncrack.com/pygenere/ [online Vigenere cracker]: http://smurfoncrack.com/pygenere/

View File

@ -990,7 +990,7 @@ endobj
[MySQL database dump file]:http://dev.mysql.com/doc/refman/5.0/en/mysqldump-sql-format.html [MySQL database dump file]:http://dev.mysql.com/doc/refman/5.0/en/mysqldump-sql-format.html
[CSAW CTF 2014 Forensic -Obscurity]: http://bt3gl.github.io/forensics-200-obscurity.html [CSAW CTF 2014 Forensic -Obscurity]: http://https://singularity-sh.vercel.app/forensics-200-obscurity.html
[online hex-decode]: http://ddecode.com/hexdecoder/ [online hex-decode]: http://ddecode.com/hexdecoder/
[which we can just google]: http://phpxref.ftwr.co.uk/wordpress/wp-content/themes/twentythirteen/js/html5.js.source.html [which we can just google]: http://phpxref.ftwr.co.uk/wordpress/wp-content/themes/twentythirteen/js/html5.js.source.html
[Tailing]: http://en.wikipedia.org/wiki/Tail_(Unix) [Tailing]: http://en.wikipedia.org/wiki/Tail_(Unix)

View File

@ -547,7 +547,7 @@ endobj
[MySQL database dump file]:http://dev.mysql.com/doc/refman/5.0/en/mysqldump-sql-format.html [MySQL database dump file]:http://dev.mysql.com/doc/refman/5.0/en/mysqldump-sql-format.html
[CSAW CTF 2014 Forensic -Obscurity]: https://gist.github.com/bt3gl/4574e99fe0f0dbdb56a9 [CSAW CTF 2014 Forensic -Obscurity]: https://gist.github.com/Mia-Stein/4574e99fe0f0dbdb56a9
[online hex-decode]: http://ddecode.com/hexdecoder/ [online hex-decode]: http://ddecode.com/hexdecoder/
[which we can just google]: http://phpxref.ftwr.co.uk/wordpress/wp-content/themes/twentythirteen/js/html5.js.source.html [which we can just google]: http://phpxref.ftwr.co.uk/wordpress/wp-content/themes/twentythirteen/js/html5.js.source.html
[Tailing]: http://en.wikipedia.org/wiki/Tail_(Unix) [Tailing]: http://en.wikipedia.org/wiki/Tail_(Unix)

View File

@ -378,4 +378,4 @@ netsh firewall set opmode mode=DISABLE.
[Exif]: http://en.wikipedia.org/wiki/Exchangeable_image_file_format [Exif]: http://en.wikipedia.org/wiki/Exchangeable_image_file_format
[writeups]: https://github.com/ctfs/write-ups/tree/master/d-ctf-2014/misc-100 [writeups]: https://github.com/ctfs/write-ups/tree/master/d-ctf-2014/misc-100
[xxd]: http://linuxcommand.org/man_pages/xxd1.html [xxd]: http://linuxcommand.org/man_pages/xxd1.html
[Natas post]: http://bt3gl.github.io/exploiting-the-web-in-20-lessons-natas.html [Natas post]: http://https://singularity-sh.vercel.app/exploiting-the-web-in-20-lessons-natas.html

View File

@ -2,7 +2,7 @@
This post is about the first [Stripe](https://stripe.com/) CTF, which [happened at the beginning of 2012](https://stripe.com/blog/capture-the-flag-wrap-up). I was able to fully reproduce the game by using a [Live CD Image](http://www.janosgyerik.com/hacking-contest-on-a-live-cd/). Other options were [direct download and BitTorrent](https://stripe.com/blog/capture-the-flag-wrap-up). This post is about the first [Stripe](https://stripe.com/) CTF, which [happened at the beginning of 2012](https://stripe.com/blog/capture-the-flag-wrap-up). I was able to fully reproduce the game by using a [Live CD Image](http://www.janosgyerik.com/hacking-contest-on-a-live-cd/). Other options were [direct download and BitTorrent](https://stripe.com/blog/capture-the-flag-wrap-up).
This CTF was composed of 6 levels, and its style was very similar to other Wargames I've talked about before in this blog (for instance, check [OverTheWire's](http://overthewire.org/wargames/) [Natas](http://bt3gl.github.io/exploiting-the-web-in-20-lessons-natas.html), [Narnia](http://bt3gl.github.io/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html), and [Krypton](http://bt3gl.github.io/cryptography-war-beating-krypton.html)). This CTF was composed of 6 levels, and its style was very similar to other Wargames I've talked about before in this blog (for instance, check [OverTheWire's](http://overthewire.org/wargames/) [Natas](http://https://singularity-sh.vercel.app/exploiting-the-web-in-20-lessons-natas.html), [Narnia](http://https://singularity-sh.vercel.app/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html), and [Krypton](http://https://singularity-sh.vercel.app/cryptography-war-beating-krypton.html)).
@ -215,7 +215,7 @@ int run(const char *str)
### Description of the Exploit ### Description of the Exploit
To understand this problem we need to understand the [design of the stack frame](http://bt3gl.github.io/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html). With this in mind, the exploit is crafted as follows: To understand this problem we need to understand the [design of the stack frame](http://https://singularity-sh.vercel.app/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html). With this in mind, the exploit is crafted as follows:
1) We input a malicious index that is negative (so it pass the bound checking) to have a shell running ```system("/bin/sh");``` (which will be able to read password of level3 because it will have its [UID](http://en.wikipedia.org/wiki/User_identifier_(Unix))). 1) We input a malicious index that is negative (so it pass the bound checking) to have a shell running ```system("/bin/sh");``` (which will be able to read password of level3 because it will have its [UID](http://en.wikipedia.org/wiki/User_identifier_(Unix))).
@ -368,7 +368,7 @@ Finally, **execve** is executed:
### Writing the Shellcode in Assembly ### Writing the Shellcode in Assembly
Now we are able to reproduce the code in Assembly. This is important: Stripe's machine was 32-bit, and the Assembly instructions are different from 64-bit (for instance, check the 64-bit shellcode I showed [here](http://bt3gl.github.io/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html)). Now we are able to reproduce the code in Assembly. This is important: Stripe's machine was 32-bit, and the Assembly instructions are different from 64-bit (for instance, check the 64-bit shellcode I showed [here](http://https://singularity-sh.vercel.app/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html)).
With an **l** added to the words, the above shellcode in 32-bit machines is: With an **l** added to the words, the above shellcode in 32-bit machines is:

View File

@ -9,11 +9,11 @@ The problems are very straightforward and very similar to those from the last [C
[Cryptol]: http://www.cryptol.net/ [Cryptol]: http://www.cryptol.net/
[Continuing to talk about]: http://bt3gl.github.io/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html [Continuing to talk about]: http://https://singularity-sh.vercel.app/smashing-the-stack-for-fun-or-wargames-narnia-0-4.html
[Wargames]: http://overthewire.org/wargames/ [Wargames]: http://overthewire.org/wargames/
[Krypton]: http://overthewire.org/wargames/krypton/ [Krypton]: http://overthewire.org/wargames/krypton/
[CSAW CTF]: https://ctf.isis.poly.edu/ [CSAW CTF]: https://ctf.isis.poly.edu/
[see my post here]: http://bt3gl.github.io/csaw-ctf-2014-cryptography-200.html [see my post here]: http://https://singularity-sh.vercel.app/csaw-ctf-2014-cryptography-200.html
## Level 0: Base64 Transformation ## Level 0: Base64 Transformation

View File

@ -60,8 +60,8 @@ If you think about it, a Stack is a perfect object for a process: the process ca
[Python & Algorithms]: https://github.com/bt3gl/Python-and-Algorithms-and-Data-Structures/blob/master/book/book_second_edition.pdf [Python & Algorithms]: https://github.com/go-outside-labs/Python-and-Algorithms-and-Data-Structures/blob/master/book/book_second_edition.pdf
[here are some examples]: https://github.com/bt3gl/Python-and-Algorithms-and-Data-Structures/tree/master/src/abstract_structures/Stacks [here are some examples]: https://github.com/go-outside-labs/Python-and-Algorithms-and-Data-Structures/tree/master/src/abstract_structures/Stacks
@ -171,7 +171,7 @@ EGG=0X41414141
To understand more about environments variables in exploits, take a look into my [Shellshock guide]. To understand more about environments variables in exploits, take a look into my [Shellshock guide].
[Shellshock guide]: http://bt3gl.github.io/understanding-the-shellshock-vulnerability.html [Shellshock guide]: http://https://singularity-sh.vercel.app/understanding-the-shellshock-vulnerability.html
#### Shell Commands #### Shell Commands

View File

@ -1429,4 +1429,4 @@ That's it. The [source code is available] as usual.
Hack all the things! Hack all the things!
[source code is available]: https://github.com/bt3gl/CTFs-Gray-Hacker-and-PenTesting/tree/master/Web_Exploits [source code is available]: https://github.com/go-outside-labs/CTFs-Gray-Hacker-and-PenTesting/tree/master/Web_Exploits

View File

@ -1,7 +1,6 @@
# Bt3gl's ol'n'good Ultimate Linux Guide for Hackers # Mia Stein's ol'n'good Ultimate Linux Guide for Hackers
* I wrote this in 2013, but hey Linux is still Linux <3. * I wrote this in 2013, but hey Linux is still Linux <3.
* but if you want modern Linux, [check this out](https://github.com/ibraheemdev/modern-unix)
<br> <br>
@ -319,7 +318,7 @@ $ export PATH=$PATH:/<DIRECTORY>
* **~/.bashrc** contains scripts and variables that are executed when Bash is invoked. * **~/.bashrc** contains scripts and variables that are executed when Bash is invoked.
* It's a good experience to customize your **~/.bashrc**. Just google for samples, or take a look at this [site dedicated for sharing dot-files](http://dotfiles.org), or at [mine](https://github.com/bt3gl/Dotfiles-and-Bash-Examples/blob/master/configs/bashrc). Don't forget to ```source``` your **./bashrc** file every time you make a change (opening a new terminal has the same effect): * It's a good experience to customize your **~/.bashrc**. Just google for samples, or take a look at this [site dedicated for sharing dot-files](http://dotfiles.org), or at [mine](https://github.com/go-outside-labs/Dotfiles-and-Bash-Examples/blob/master/configs/bashrc). Don't forget to ```source``` your **./bashrc** file every time you make a change (opening a new terminal has the same effect):
``` ```
$ source ~/.bashrc $ source ~/.bashrc

View File

@ -96,7 +96,7 @@
## Useful Tools in General ## Useful Tools in General
- [Wireshark](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html) - [Wireshark](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html)
- tshark - tshark
- OpenVPN - OpenVPN
- OpenSSL - OpenSSL

View File

@ -40,7 +40,7 @@ The basic unit in network communication is the *packet*. So let's create one!
Scapy builds packets by the *layers* and then by the *fields* in each layer. Each layer is nested inside the parent layer, represented by the **<** and **>** brackets. Scapy builds packets by the *layers* and then by the *fields* in each layer. Each layer is nested inside the parent layer, represented by the **<** and **>** brackets.
Let's start by specifying the packet's source IP and then its destination IP. This type of information goes in the **IP header**, which is a *layer 3 protocol* in the [0SI model](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html): Let's start by specifying the packet's source IP and then its destination IP. This type of information goes in the **IP header**, which is a *layer 3 protocol* in the [0SI model](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html):
```python ```python
>>> ip = IP(src="192.168.1.114") >>> ip = IP(src="192.168.1.114")
@ -481,13 +481,13 @@ Running this script when loading load some mail client (such as [Thunderbird](ht
----------- -----------
## <a name="arp"></a> ARP Cache Poisoning ## <a name="arp"></a> ARP Cache Poisoning
I talked about [ARP cache poisoning using command line arpspoof](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html) in my guide about Wireshark. Here we are going to see how to implement a similar tool using Scapy. I talked about [ARP cache poisoning using command line arpspoof](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html) in my guide about Wireshark. Here we are going to see how to implement a similar tool using Scapy.
ARP cache poisoning works by convincing a target machine that we are the gateway and then convincing the gateway that all traffic should pass through our machine. ARP cache poisoning works by convincing a target machine that we are the gateway and then convincing the gateway that all traffic should pass through our machine.
Every machine in a network maintains an ARP cache that stores the recent MAC addresses that match to IP addresses on the local network. All we need to do is to poison this cache with controlled entries. Every machine in a network maintains an ARP cache that stores the recent MAC addresses that match to IP addresses on the local network. All we need to do is to poison this cache with controlled entries.
The best way to test this is by using a Windows virtual machine (take a look in [this guide I wrote](http://bt3gl.github.io/setting-up-a-playing-environment-with-virtual-machines.html)). The best way to test this is by using a Windows virtual machine (take a look in [this guide I wrote](http://https://singularity-sh.vercel.app/setting-up-a-playing-environment-with-virtual-machines.html)).
Before the attack, go to the Windows box, open the terminal (```cmd```) and check the IP and gateway IP address with```ipconfig```. Then check the associated ARP cache entry MAC address with ```arp -a```. We are going to use the former information and we will see the ARP data being changed: Before the attack, go to the Windows box, open the terminal (```cmd```) and check the IP and gateway IP address with```ipconfig```. Then check the associated ARP cache entry MAC address with ```arp -a```. We are going to use the former information and we will see the ARP data being changed:
@ -772,4 +772,4 @@ Detected: 16 faces
- [Wifitap: PoC for communication over WiFi networks using traffic injection](http://sid.rstack.org/static/articles/w/i/f/Wifitap_EN_9613.html). - [Wifitap: PoC for communication over WiFi networks using traffic injection](http://sid.rstack.org/static/articles/w/i/f/Wifitap_EN_9613.html).
- [SurfJack: hijack HTTP connections to steal cookies](https://code.google.com/p/surfjack/) - [SurfJack: hijack HTTP connections to steal cookies](https://code.google.com/p/surfjack/)
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).

View File

@ -369,4 +369,4 @@ Enter command:
- [Paramikos reverse SSH tunneling](https://github.com/paramiko/paramiko/blob/master/demos/rforward.py). - [Paramikos reverse SSH tunneling](https://github.com/paramiko/paramiko/blob/master/demos/rforward.py).
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).

View File

@ -2,7 +2,7 @@
When it comes to the reconnaissance of some target network, the start point is undoubtedly on host discovering. This task might come together with the ability to sniff and parse the packets flying in the network. When it comes to the reconnaissance of some target network, the start point is undoubtedly on host discovering. This task might come together with the ability to sniff and parse the packets flying in the network.
A few weeks ago, I talked about [how to use Wireshark](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html) for packet sniffing, but what if you don't have Wireshark available to monitor a network traffic? A few weeks ago, I talked about [how to use Wireshark](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html) for packet sniffing, but what if you don't have Wireshark available to monitor a network traffic?
Again, Python comes with several solutions and today I'm going through the steps to build a **UDP Host discovery tool**. First, we are going to see how we deal with [raw sockets](http://en.wikipedia.org/wiki/Raw_socket) to write a simple sniffer, which is able to view and decode network packets. Then we are going to multithread this process within a subnet, which will result in our scanner. Again, Python comes with several solutions and today I'm going through the steps to build a **UDP Host discovery tool**. First, we are going to see how we deal with [raw sockets](http://en.wikipedia.org/wiki/Raw_socket) to write a simple sniffer, which is able to view and decode network packets. Then we are going to multithread this process within a subnet, which will result in our scanner.
@ -15,7 +15,7 @@ The cool thing about using **UDP datagrams** is that, differently from TCP, they
## Writing a Packet Sniffing ## Writing a Packet Sniffing
We start with a very simple task: with Python's [socket](http://bt3gl.github.io/black-hat-python-networking-the-socket-module.html) library, we will write a very simple packet sniffer. We start with a very simple task: with Python's [socket](http://https://singularity-sh.vercel.app/black-hat-python-networking-the-socket-module.html) library, we will write a very simple packet sniffer.
In this sniffer we create a raw socket and then we bind it to the public interface. The interface should be in **promiscuous mode**, which means that every packet that the network card sees are captured, even those that are not destined to the host. In this sniffer we create a raw socket and then we bind it to the public interface. The interface should be in **promiscuous mode**, which means that every packet that the network card sees are captured, even those that are not destined to the host.

View File

@ -38,7 +38,7 @@ The basic unit in a network communication is the *packet*. So let's create one
Scapy builds packets by the *layers* and then by the *fields* in each layer. Each layer is nested inside the parent layer, represented by the **<** and **>** brackets. Scapy builds packets by the *layers* and then by the *fields* in each layer. Each layer is nested inside the parent layer, represented by the **<** and **>** brackets.
Let's start by specifying the packet's source IP and then its destination IP. This type of information goes in the **IP header**, which is a *layer 3 protocol* in the [0SI model](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html): Let's start by specifying the packet's source IP and then its destination IP. This type of information goes in the **IP header**, which is a *layer 3 protocol* in the [0SI model](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html):
```python ```python
>>> ip = IP(src="192.168.1.114") >>> ip = IP(src="192.168.1.114")
@ -295,7 +295,7 @@ We can check the output with:
res.summary() res.summary()
``` ```
For more advanced stuff, check out [my script for scanning subnet in selected ports](https://github.com/bt3gl/My-Gray-Hacker-Resources/blob/master/Network_and_802.11/scapy/super_scanner.py). For more advanced stuff, check out [my script for scanning subnet in selected ports](https://github.com/go-outside-labs/My-Gray-Hacker-Resources/blob/master/Network_and_802.11/scapy/super_scanner.py).
### The Sniff() Method ### The Sniff() Method
@ -568,13 +568,13 @@ Running this script when loading some mail client (such as [Thunderbird](https:
----------- -----------
## <a name="arp"></a> ARP Cache Poisoning ## <a name="arp"></a> ARP Cache Poisoning
I talked about [ARP cache poisoning using command line arpspoof](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html) in my guide about Wireshark. Here we are going to see how to implement similar tool using Scapy. I talked about [ARP cache poisoning using command line arpspoof](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html) in my guide about Wireshark. Here we are going to see how to implement similar tool using Scapy.
ARP cache poisoning works by convincing a target machine that we are the gateway, and then convincing the gateway that all traffic should pass through our machine. ARP cache poisoning works by convincing a target machine that we are the gateway, and then convincing the gateway that all traffic should pass through our machine.
Every machine in a network maintains an ARP cache that stores the recent MAC addresses that match to IP addresses on the local network. All we need to do is to poison this cache with controlled entries. Every machine in a network maintains an ARP cache that stores the recent MAC addresses that match to IP addresses on the local network. All we need to do is to poison this cache with controlled entries.
The best way to test this is using a Windows virtual machine (take a look at [this guide I wrote](http://bt3gl.github.io/setting-up-a-playing-environment-with-virtual-machines.html)). The best way to test this is using a Windows virtual machine (take a look at [this guide I wrote](http://https://singularity-sh.vercel.app/setting-up-a-playing-environment-with-virtual-machines.html)).
Before the attack, go to the Windows box, open the terminal (```cmd```) and check the IP and gateway IP address with```ipconfig```. Then check the associated ARP cache entry MAC address with ```arp -a```: Before the attack, go to the Windows box, open the terminal (```cmd```) and check the IP and gateway IP address with```ipconfig```. Then check the associated ARP cache entry MAC address with ```arp -a```:

View File

@ -498,7 +498,7 @@ Cool, huh?
## A TCP Proxy ## A TCP Proxy
A TCP proxy can be very useful for forwarding traffic and when assessing network-based softwares (for example, when you cannot run [Wireshark](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html) or you cannot load drivers or tools in the machine you are exploiting). A TCP proxy can be very useful for forwarding traffic and when assessing network-based softwares (for example, when you cannot run [Wireshark](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html) or you cannot load drivers or tools in the machine you are exploiting).
To create a proxy we need to verify if we need to *first initiate a connection* to the remote side. This will request data before going into our main loop and some server daemons expect you to do this first (for instance, FTP servers send a banner first). We call this information **receive_first**. To create a proxy we need to verify if we need to *first initiate a connection* to the remote side. This will request data before going into our main loop and some server daemons expect you to do this first (for instance, FTP servers send a banner first). We call this information **receive_first**.
@ -730,7 +730,7 @@ Additionally, let's take a quick look to all the methods available with the **s
- [Python's Socket Documentation](https://docs.python.org/2/library/socket.html) - [Python's Socket Documentation](https://docs.python.org/2/library/socket.html)
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).
- [A TCP Packet Injection tool](https://github.com/OffensivePython/Pinject/blob/master/pinject.py). - [A TCP Packet Injection tool](https://github.com/OffensivePython/Pinject/blob/master/pinject.py).
- [An asynchronous HTTP Proxy](https://github.com/OffensivePython/PyProxy/blob/master/PyProxy.py). - [An asynchronous HTTP Proxy](https://github.com/OffensivePython/PyProxy/blob/master/PyProxy.py).
- [A network sniffer at the Network Layer](https://github.com/OffensivePython/Sniffy/blob/master/Sniffy.py). - [A network sniffer at the Network Layer](https://github.com/OffensivePython/Sniffy/blob/master/Sniffy.py).

View File

@ -497,7 +497,7 @@ Cool, huh?
## A TCP Proxy ## A TCP Proxy
A TCP proxy can be very useful for forwarding traffic and when assessing network-based software (for example, when you cannot run [Wireshark](http://bt3gl.github.io/wiresharking-for-fun-or-profit.html), or you cannot load drivers or tools in the machine you are exploiting). A TCP proxy can be very useful for forwarding traffic and when assessing network-based software (for example, when you cannot run [Wireshark](http://https://singularity-sh.vercel.app/wiresharking-for-fun-or-profit.html), or you cannot load drivers or tools in the machine you are exploiting).
To create a proxy we need to verify if we need to *first initiate a connection* to the remote side. This will request data before going into our main loop, and some server daemons expect you to do this first (for instance, FTP servers send a banner first). We call this information **receive_first**. To create a proxy we need to verify if we need to *first initiate a connection* to the remote side. This will request data before going into our main loop, and some server daemons expect you to do this first (for instance, FTP servers send a banner first). We call this information **receive_first**.
@ -725,7 +725,7 @@ Additionally, let's take a quick look to all the methods available with the **so
- [Python's Socket Documentation](https://docs.python.org/2/library/socket.html) - [Python's Socket Documentation](https://docs.python.org/2/library/socket.html)
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).
- [A TCP Packet Injection tool](https://github.com/OffensivePython/Pinject/blob/master/pinject.py). - [A TCP Packet Injection tool](https://github.com/OffensivePython/Pinject/blob/master/pinject.py).
- [An asynchronous HTTP Proxy](https://github.com/OffensivePython/PyProxy/blob/master/PyProxy.py). - [An asynchronous HTTP Proxy](https://github.com/OffensivePython/PyProxy/blob/master/PyProxy.py).
- [A network sniffer at the Network Layer](https://github.com/OffensivePython/Sniffy/blob/master/Sniffy.py). - [A network sniffer at the Network Layer](https://github.com/OffensivePython/Sniffy/blob/master/Sniffy.py).

View File

@ -362,4 +362,4 @@ Enter command:
- [Paramikos reverse SSH tunneling](https://github.com/paramiko/paramiko/blob/master/demos/rforward.py). - [Paramikos reverse SSH tunneling](https://github.com/paramiko/paramiko/blob/master/demos/rforward.py).
- [Ogre: port scanner and brute-force tool (from a friend I met at Hacker School)](https://github.com/tristanfisher/ogre/blob/master/ogre) - [Ogre: port scanner and brute-force tool (from a friend I met at Hacker School)](https://github.com/tristanfisher/ogre/blob/master/ogre)
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).

View File

@ -14,7 +14,7 @@ Remember that ICMP is essentially a special control protocol that issues error r
## Writing a Packet Sniffer ## Writing a Packet Sniffer
We start with a very simple task: with Python's [socket](http://bt3gl.github.io/black-hat-python-networking-the-socket-module.html) library, we will write a very simple packet sniffer. We start with a very simple task: with Python's [socket](http://https://singularity-sh.vercel.app/black-hat-python-networking-the-socket-module.html) library, we will write a very simple packet sniffer.
In this sniffer, we create a raw socket and then we bind it to the public interface. The interface should be in **promiscuous mode**, which means that every packet that the network card sees is captured, even those that are not destined to the host. In this sniffer, we create a raw socket and then we bind it to the public interface. The interface should be in **promiscuous mode**, which means that every packet that the network card sees is captured, even those that are not destined to the host.
@ -316,4 +316,4 @@ Host up: 192.168.1.114
- [Tutorial to learn netaddr](https://netaddr.readthedocs.org/en/latest/tutorial_01.html). - [Tutorial to learn netaddr](https://netaddr.readthedocs.org/en/latest/tutorial_01.html).
- [Black Hat Python](http://www.nostarch.com/blackhatpython). - [Black Hat Python](http://www.nostarch.com/blackhatpython).
- [My Gray hat repo](https://github.com/bt3gl/My-Gray-Hacker-Resources). - [My Gray hat repo](https://github.com/go-outside-labs/My-Gray-Hacker-Resources).

View File

@ -3,7 +3,7 @@
[Wireshark](https://www.wireshark.org/) is an open source **network packet analyzer** that allows live traffic analysis, with support to several protocols. [Wireshark](https://www.wireshark.org/) is an open source **network packet analyzer** that allows live traffic analysis, with support to several protocols.
Wireshark also allows **network forensic**, being very useful for CTFs for example (check my writeups for the [D-CTF Quals 2014](http://bt3gl.github.io/exploring-d-ctf-quals-2014s-exploits.html) and for the CSAW Quals 2014 in [Networking](http://bt3gl.github.io/csaw-ctf-2014-networking-100-big-data.html) and [Forensics](http://bt3gl.github.io/csaw-ctf-2014-forensics-200-why-not-sftp.html)). Wireshark also allows **network forensic**, being very useful for CTFs for example (check my writeups for the [D-CTF Quals 2014](http://https://singularity-sh.vercel.app/exploring-d-ctf-quals-2014s-exploits.html) and for the CSAW Quals 2014 in [Networking](http://https://singularity-sh.vercel.app/csaw-ctf-2014-networking-100-big-data.html) and [Forensics](http://https://singularity-sh.vercel.app/csaw-ctf-2014-forensics-200-why-not-sftp.html)).

View File

@ -6,8 +6,6 @@ This is a repository with all the hacks I have created.
In the folder HAK I left the original repository from Hak5. In the folder HAK I left the original repository from Hak5.
In the folder bt3gl I left my hacks.
The Duck The Duck
--------- ---------

View File

@ -7,7 +7,7 @@
#### 👾 some context of those *good old days*: #### 👾 some context of those *good old days*:
- **👉🏽 my two teams in ctf times: [snatch the root](https://ctftime.org/team/7016) and [hacking for soju](https://ctftime.org/team/3208).** - **👉🏽 my two teams in ctf times: [snatch the root](https://ctftime.org/team/7016) and [hacking for soju](https://ctftime.org/team/3208).**
- **[👉🏽 my former blog, "chmod a+x singularity.sh", with several ctf writeups](https://singularity-sh.vercel.app/).** - **[👉🏽 my former blog, "chmod a+x singularity.sh", with several ctf writeups](https://singularity-sh.vercel.app/).**
- **[👉🏽 my coderwall page with several writeups on linux, security, python](https://coderwall.com/bt3gl).** - **[👉🏽 my 2014's coderwall page with several writeups on linux, security, python](https://coderwall.com/bt3gl).**
- **[👉🏽 some entertaining: my DEF CON 23 talk on hacking quantum computing](https://www.youtube.com/watch?v=1Fp6ibfOQ4Y).** - **[👉🏽 some entertaining: my DEF CON 23 talk on hacking quantum computing](https://www.youtube.com/watch?v=1Fp6ibfOQ4Y).**
- **[👉🏽 a proof that this repo used to have 1.2k stars and 500 forks before I had to make it private](FML.png).** - **[👉🏽 a proof that this repo used to have 1.2k stars and 500 forks before I had to make it private](FML.png).**
- **[👉🏽 threat-intel, i project i led while working at the security team at yelp](https://github.com/Yelp/threat_intel)**. - **[👉🏽 threat-intel, i project i led while working at the security team at yelp](https://github.com/Yelp/threat_intel)**.

View File

@ -62,8 +62,8 @@ If you think about it, a Stack is the perfect object for a process: the process
[Python & Algorithms]: https://github.com/bt3gl/Python-and-Algorithms-and-Data-Structures/blob/master/book/book_second_edition.pdf [Python & Algorithms]: https://github.com/go-outside-labs/Python-and-Algorithms-and-Data-Structures/blob/master/book/book_second_edition.pdf
[here are some examples]: https://github.com/bt3gl/Python-and-Algorithms-and-Data-Structures/tree/master/src/abstract_structures/Stacks [here are some examples]: https://github.com/go-outside-labs/Python-and-Algorithms-and-Data-Structures/tree/master/src/abstract_structures/Stacks
@ -171,7 +171,7 @@ EGG=0X41414141
To understand more about environments variables in exploits, take a look into my [Shellshock guide]. To understand more about environments variables in exploits, take a look into my [Shellshock guide].
[Shellshock guide]: http://bt3gl.github.io/understanding-the-shellshock-vulnerability.html [Shellshock guide]: http://https://singularity-sh.vercel.app/understanding-the-shellshock-vulnerability.html
#### Shell Commands #### Shell Commands

View File

@ -1,6 +1,6 @@
# Hacking the Web with Python's urllib2 (by bt3) # Hacking the Web with Python's urllib2 (by bt3)
Python's [urllib2](https://docs.python.org/2/library/urllib2.html) library is **the tool** to interact with web services, with several functions and classes to help handling URLs. **urllib2** is written in the top of [httplib](https://docs.python.org/2/library/httplib.html) library (which defines classes to implement the client side of HTTP and HTTPs). In turn, **httplib** uses the [socket](http://bt3gl.github.io/black-hat-python-networking-the-socket-module.html) library. Python's [urllib2](https://docs.python.org/2/library/urllib2.html) library is **the tool** to interact with web services, with several functions and classes to help handling URLs. **urllib2** is written in the top of [httplib](https://docs.python.org/2/library/httplib.html) library (which defines classes to implement the client side of HTTP and HTTPs). In turn, **httplib** uses the [socket](http://https://singularity-sh.vercel.app/black-hat-python-networking-the-socket-module.html) library.
In this post I [introduce urllib2](#intro) and then I work on two problems: [mapping webapps from their installation files](#map) and [brute-forcing the contents of webapps to find hidden resources](#brute1). In this post I [introduce urllib2](#intro) and then I work on two problems: [mapping webapps from their installation files](#map) and [brute-forcing the contents of webapps to find hidden resources](#brute1).
@ -25,7 +25,7 @@ Let's see how a simple [GET](http://www.w3schools.com/tags/ref_httpmethods.asp)
<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including (...) <!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including (...)
``` ```
Notice that, differently from modules such as [scapy](http://bt3gl.github.io/black-hat-python-infinite-possibilities-with-the-scapy-module.html) or [socket](http://bt3gl.github.io/black-hat-python-the-socket-module.html), we *need to specify the protocol* in the URL (HTTP). Notice that, differently from modules such as [scapy](http://https://singularity-sh.vercel.app/black-hat-python-infinite-possibilities-with-the-scapy-module.html) or [socket](http://https://singularity-sh.vercel.app/black-hat-python-the-socket-module.html), we *need to specify the protocol* in the URL (HTTP).
Now, let's be fancy and customize the output: Now, let's be fancy and customize the output:
@ -435,7 +435,7 @@ In the same way as before, we can achieve a reasonable speed by creating pool of
The steps of our script are: The steps of our script are:
1) We define the target, the number of threads, the path for the wordlist (which I made available [here](https://github.com/bt3gl/My-Gray-Hacker-Resources/tree/master/Other_Hackings/useful_lists/files_and_dir_lists)), a rogue User-Agent, and the filter list of extensions that we want to look at: 1) We define the target, the number of threads, the path for the wordlist (which I made available [here](https://github.com/go-outside-labs/My-Gray-Hacker-Resources/tree/master/Other_Hackings/useful_lists/files_and_dir_lists)), a rogue User-Agent, and the filter list of extensions that we want to look at:
```python ```python
import urllib2 import urllib2