Thursday, April 24, 2014

How to fix Kali Linux apt-get slow update?

How to fix Kali Linux apt-get slow update?

This is a small guide on How to fix Kali Linux apt-get slow update.
Kali is relatively new and got fewer Mirrors than some other distro’s. That means less servers to download from and less servers means more people trying to download from them and using all bandwidth. So when you type in apt-get update, you see a slow download speed for packages. This just means you’re connected to a server that’s really busy. Some users complains that nothing happens or they are not getting any updates at all. Some got different issues like update stuck is header and doesn’t move any further.
To fix this, you need to check a few things:
  1. Check if you have the right repositories is your /etc/apt/sources.list
  2. Remove unwanted or unsupported repositories.
  3. Clean apt-get cache.
  4. Choose a fast DNS server.
To fix sources.list, follow this guide: How to add official Kali Linux Repositories?
To switch repositories to a different mirror of your choice, follow this guide: How to change repositories to a different mirror?

Clean apt-get cache:

apt-get clean

Choose a proper DNS server:

Edit resolv.conf file:
leafpad /etc/resolv.conf

Enter Google DNS nameservers

Following two are Google DNS, let’s face it, if Google is broken, we all think Internet is broken. Hence the reason of using Google DNS. You can choose other DNS Server if you want that are fast and reliable.
 
nameserver 8.8.8.8
nameserver 8.8.4.4

Now save and close the file.

Test your changes

Let put our changes to the test..

Do an apt-get update

 apt-get update

Do and upgrade

 apt-get upgrade

Finally do a distribution upgrade

 apt-get dist-upgrade
Your download speed should be a lot better than you were getting previously.

Another solution, changing from HTTP to REPO in sources.list file (14/02/2014)

One of the readers advised that by changing the repositories from HTTP to REPO, he gained significant speed up. See Sameer Barha’s comment below.
Use the following repositories (update your sources.list file)
 
## Kali Regular repositories
deb http://repo.kali.org/kali kali main non-free contrib
deb http://security.kali.org/kali-security kali/updates main contrib non-free
## Kali Source repositories
deb-src http://repo.kali.org/kali kali main non-free contrib
deb-src http://security.kali.org/kali-security kali/updates main contrib non-free

Instead of
 
## Kali Regular repositories
deb http://http.kali.org/kali kali main non-free contrib
deb http://security.kali.org/kali-security kali/updates main contrib non-free
## Kali Source repositories
deb-src http://http.kali.org/kali kali main non-free contrib
deb-src http://security.kali.org/kali-security kali/updates main contrib non-free

This change seems to boost speed as it uses slightly different repo than the usual HTTP servers which are overloaded. Let us know how this worked for you.In case your sources.list file is messed up or you’re just not sure, what to put on there, follow these instruction’s to add official Kali Linux Repositories.

(Note: The above mentioned repositories are a slightly variant of the official one, you can choose either as they are both from Kali.org) 

In case your DNS server is picking up (even Google’s DNS server) a repository from a different country(or avoid a specific country) and you would like to manually switch repositories to a different mirror of your choice(say in same country or just something you know working faster, follow these instruction to change repositories to a different mirror.


Happy hunting!!! 

Saturday, November 23, 2013

Starting Metasploit Framework

In keeping with the Kali Linux Network Services Policy, there are no network services, including database services, running on boot so there are a couple of steps that need to be taken in order to get Metasploit up and running with database support.

Start the Kali PostgreSQL Service

Metasploit uses PostgreSQL as its database so it needs to be launched first.

service postgresql start

You can verify that PostgreSQL is running by checking the output of ss -ant and making sure that port 5432 is listening.

State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:5432 *:*
LISTEN 0 128 ::1:5432 :::*

 

Start the Kali Metasploit Service

With PostgreSQL up and running, we next need to launch the metasploit service. The first time the service is launched, it will create a msf3 database user and a database called msf3. The service will also launch the Metasploit RPC and Web servers it requires.

service metasploit start

 

Launch msfconsole in Kali

Now that the PostgreSQL an Metasploit services are running, you can launch msfconsole and verify database connectivity with the db_status command as shown below.

msfconsole
msf > db_status
[*] postgresql connected to msf3
msf >

 

Configure Metasploit to Launch on Startup

If you would prefer to have PostgreSQL and Metasploit launch at startup, you can use update-rc.d to enable the services as follows.

update-rc.d postgresql enable
update-rc.d metasploit enable

tutorial from kali.org 

happy hunting...!!!

Install NVIDIA Drivers on Kali

This document explains how to make use of NVIDIA video hardware and install the drivers on a Kali Linux system. The first step is to fully update your Kali Linux system and make sure you have the kernel headers installed.
 
apt-get update
apt-get install -y linux-headers-$(uname -r)
Next, download the latest NVIDIA driver for your architecture and video card here. To locate your NVIDIA card model, execute the following command.


root@kali:~# lspci | grep -i vga
02:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce G210M] (rev a2)
03:00.0 VGA compatible controller: NVIDIA Corporation C79 [GeForce 9400M G] (rev b1)

The next step is to disable the nouveau driver. Nouveau is a open source NVIDIA driver project, however it lacks the 3D graphics acceleration needed to run Cuda pentest tools.

 sed 's/quiet/quiet nouveau.modeset=0/g' -i /etc/default/grub
update-grub
reboot


Once the system has rebooted and you are looking at the GDM login screen, press CRTL+ALT+F1 in order to get to a TTY, which will be a black screen with a login prompt. We need to login as root and stop the gdm3 service as follows.

 service gdm3 stop

If you are on a 64-bit Kali system, you may want to install the ia32-libs package in order to allow the NVIDIA installer to install the 32-bit libraries, although this is optional. If you choose not to do it, simply select no when the installer asks if you want to install the 32-bit libraries.

dpkg --add-architecture i386
apt-get update
apt-get install ia32-libs 


Assuming you downloaded the NVIDIA driver to your /root/ directory, we need to give it executable permissions and run it.

chmod 755 NVIDIA-Linux-x86_64-310.44.run
./NVIDIA-Linux-x86_64-310.44.run 


Once the installer finishes, you should reboot your machine. Once the system boots back up, you may see a NVIDIA splash screen, which will indicate that the drivers installed correctly, however, this is not always the case. In order to check if the drivers are working properly, execute the following command.

root@kali:~# glxinfo | grep -i "direct rendering"
direct rendering: Yes


Although utilizing the Cuda tools included in Kali is beyond the scope of this article, checking to make sure that they are working properly is always a good idea. The following command uses Oclhashcat-plus with some of the example files included in the package.

cd /usr/share/oclhashcat-plus/
./cudaHashcat-plus.bin -t 32 -a 7 example0.hash ?a?a?a?a example.dict
cudaHashcat-plus v0.14 by atom starting...

Hashes: 6494 total, 1 unique salts, 6494 unique digests
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes
Workload: 256 loops, 80 accel
Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 80c
Device #1: GeForce G210M, 511MB, 1468Mhz, 2MCU
Device #2: GeForce 9400M G, 253MB, 1100Mhz, 2MCU
Device #1: Kernel ./kernels/4318/m0000_a1.sm_12.64.ptx
Device #2: Kernel ./kernels/4318/m0000_a1.sm_11.64.ptx

Generated dictionary stats for example.dict: 1210228 bytes, 129988 words, 129988 keyspace

27b797965af03466041487f2a455fe52:mo0000
a48dd0f09abaf64324be83ce86414b5f:ap2300000
7becb9424f38abff581f6f2a82ff436a:sail00
1459ccf0940e63051d5a875a88acfaaf:pigi00
3baa3048651a65d1260eb521ab7c3bc0:ek110
7a7a8220266f71f54f85685969ce999f:davi0123456789
98c627ca129e64dfff3bf08fbaab6c86:fire01man


As you can see in the output above, the cards are recognized and the passwords are being recovered successfully.

thank to the kali.org for this tutorial. try to help my friend.

happy hunting!! 

Thursday, September 12, 2013

Improved SDR Support for Kali Linux

The blog at needsec.com brings us news that Kali Linux is soon to be updated to version 1.0.5 which will come with several software defined radio tools preinstalled. Kali is a Debian Linux based operating system that is popular with the security and penetration testing community as it comes with several relevant tools preinstalled. This new version adds several useful SDR software programs including
  • Kalibrate for RTLSDR
  • gr-air-modes
  • RTLSDR Scanner
  • pyrtlsdr
  • GNU Radio Signal Scanner
  • libosmocore 0.6.3
  • grextras
  • gr-baz
  • gr-osmosdr
  • gr-iqbal
  • rtl-sdr 0.5.0
  • HackRF for SDR
  • gr-fcdproplus for SDR
  • UHD Images
via needsec.com 

RTL-SDR Monitoring Radio Wave

RTL-SDR Dongle

What is RTL-SDR?
RTL-SDR is a very cheap software defined radio that uses a DVB-T TV tuner dongle based on the RTL2832U chipset. With the combined efforts of Antti Palosaari, Eric Fry and Osmocom it was found that the signal I/Q data could be accessed directly, which allowed the DVB-T TV tuner to be converted into a wideband software defined radio via a new software driver.
Essentially, this means that a cheap $20 TV tuner with the RTL2832U chip can be used as a computer based radio scanner. This sort of scanner capability would have cost hundreds or even thousands just a few years ago.
There are many other software defined radios similar to the RTL-SDR, but they all come at a much higher price. The FunCube PRO+ is a good receiver similar to the RTL-SDR, priced at around $190 USD. There is also the soon to be released HackRF (~$300USD) and BladeRF SDRs ($420 and $650), which can both transmit and receive.

What is Software Defined Radio?

Radio components such as modulators, demodulators and amplifiers are traditionally implemented in hardware components. The advent of modern computing allows these traditionally hardware based components to be implemented into software instead. Hence, the software defined radio. This enables easy signal processing and thus cheap wide band scanner radios to be produced.

What are some RTL-SDR Radio Scanner Applications?

The RTL-SDR can be used as a wide band radio scanner. Applications include
Furthermore, with an upconverter or direct sampling mod to receive HF signals the applications are expanded to
  • Listening to amateur radio hams on SSB with LSB/USB modulation.
  • Decoding digital amateur radio ham communications such as CW/PSK/RTTY/SSTV.
  • Receiving HF weatherfax.
  • Receiving digital radio monodial shortwave radio (DRM).
  • Listening to international shortwave radio.
  • Looking for RADAR signals like over the horizon (OTH) radar, and HAARP signals.
Note that not all the applications listed may be legal in your country. Please be responsible.

What is the RTL-SDR frequency range?

This is dependant on the particular tuner variant used in the dongle.
TunerFrequency range
Elonics E400052 – 2200 MHz with a gap from 1100 MHz to 1250 MHz (varies)
Rafael Micro R820T24 – 1766 MHz
Fitipower FC001322 – 1100 MHz
Fitipower FC001222 – 948.6 MHz
FCI FC2580146 – 308 MHz and 438 – 924 MHz (gap in between)
Table Source: Osmocom
As you can see from the table, the Elonics E4000 and Rafael Micro R820T dongles have the greatest frequency range.

What is the RTL-SDRs sample rate?

The maximum sample rate is 3.2 MS/s (mega samples per second). However, the rtl-sdr is unstable at this rate and may drop samples. The maximum sample rate that does not drop samples is 2.8 MS/s.

What is the RTL-SDR’s ADC resolution?

The resolution is 8 bits.

What is the RTL-SDR input impedance?

Input impedance is dependent on the tuner used in the dongle. Input impedance will always be either 50 or 75 ohms.
The R820T has an input impedance of 75 ohms according to the datasheet which can be downloaded here.

What dongle should I buy?

The cheapest and most common dongle at the moment is the Rafael Micro R820T. It can be bought for about $20 USD.
The Elonics E4000 used to be the most common, but Elonics has closed and ceased chip production, making the E4000 rarer and much more expensive these days.
The R820T also is generally regarded as having better performance and sensitivity. For ADSB, the R820T is much more sensitive at 1090MHz. For these reasons, the R820T is currently the recommended dongle, unless you need the greater frequencies the E4000 provides.
Be careful when buying a dongle as certain sellers tend to misrepresent their devices (knowingly or unknowingly) as having compatible tuners, when in fact they may send out a device with an incompatible tuner.
See the BUY RTL-SDR page for more information about where to obtain dongles from reputable sources.

I already have a USB TV Tuner, is it Compatible?

An up to date list on compatible and incompatible tuners can be found on this reddit wiki page.

Comparisons with other Wideband Commercial Software Defined Radios

SDRTune Low (MHz)Tune Max (MHz)RX Sample Rate (MHz)ADC Resolution (Bits)Transmit?(Yes/No)Price ($USD)
RTL-SDR (R820T)24 17663.28No~20
Funcube Pro6417000.09616No150
Funcube Pro+0.15
410
260
2050
0.19216No200
HackRF306000208Yes~300
BladeRF30038004012Yes400 & 650
USRP 1DC60006412Yes700
MatchStiq30038002812Yes4500


Useful Links

http://sdr.osmocom.org/trac/wiki/rtl-sdr - Official rtl-sdr osmocom website
http://www.reddit.com/r/RTLSDR – Reddit rtl-sdr forum

https://groups.google.com/forum/#!forum/ultra-cheap-sdr - Google groups forum
www.sdrsharp.com - SDRSharp official website
www.rtlsdr.org - RTL-SDR community Wiki
http://www.dxzone.com/ - A good ham related database useful for research
http://www.dangerousprototypes.com - A blog about open source hardware projects that often has SDR related posts.
http://www.hackaday.com – A blog about DIY hardware that also often has SDR related posts.
http://sdrformariners.blogspot.com/ - SDR for mariners. A new blog about marine related RTL-SDR applications.

Wednesday, July 31, 2013

Wifislax 4.6 - Security and Forensic Tools


Wifislax 4.6, an updated build of the Slackware-based live CD with a collection of security and forensics tools, has been released. This is mostly a maintenance release to fix a serious bug in Reaver, a WiFi passphrase brute-force attack utility, the use of which resulted in segmentation fault in the previous release of Wifislax. The Linux kernel has been updated to version 3.6.11 with a number of new drivers to support tablets, touchscreen devices, multi-function printers, etc. The KDE desktop has been upgraded to version 4.10.5 and an option to boot into a lighter Xfce desktop remains available. Other package upgrades include Firefox 22.0, OpenJDK 7u25 and Wireshark 1.10.0, as well as the latest version of the Flash browser plugin. A number of new programs, such as nano and texinfo, have been added. The release announcement which contains a full changelog is in Spanish only, but the distribution itself can boot into either Spanish or English localisation of the KDE or Xfce desktops.

download from here:

wifislax 


happy hunting !!!

Sunday, June 23, 2013

PentesterLab.com – Excercises To Learn Penetration Testing

PentesterLab is an easy and straight forwards way to learn the basics of penetration testing. It provides vulnerable systems in a virtual image, and accompanying exercises that can be used to test and understand vulnerabilities.
Just decide what course you want to follow, download the course and start learning. You can easily run the course using VMware, no Internet access is required.


 What will you learn?
  • Basics of Web
  • Basics of HTTP
  • Detection of common web vulnerabilities:
    • Cross-Site Scripting
    • SQL injections
    • Directory traversal
    • Command injection
    • Code injection
    • XML attacks
    • LDAP attacks
    • File upload
  • Basics of fingerprinting
Requirements
  • A computer with a virtualisation software
  • A basic understanding of HTTP
  • A basic understanding of PHP
  • Yes, that’s it!
You can download the materials and ISO images here:

web_for_pentester.pdf (2.4M)
web_for_pentester.iso (64-bit, 175M, MD5: f6e0df10de6d410293ba7a838d31f917)
web_for_pentester_i386.iso (32-bit, 172M, MD5: 5e6cdf5fa3356a4c08b34ccd076a63ae)

 
Or read more here.

 From Darknet

happy hunting!!

Thursday, May 30, 2013

BackTrack 5 R3 now transform to Kali Linux

Maybe not to late that i post this news to all BackTrack fan out there that the production of BT 5 will end then will be replace by Kali Linux here the news and try it you will be feel the BT inside Kali.

Offensive Security has announced the release of Kali Linux 1.0, a Debian-based distribution with a collection of security tools for forensic analysis and penetration testing. This is a major new update of the project's flagship distribution formerly known as BackTrack (based on Ubuntu). From the release announcement: "After a year of silent development, Offensive Security is proud to announce the release and public availability of 'Kali Linux', the most advanced, robust, and stable penetration-testing distribution to date. Kali is a more mature, secure, and enterprise-ready version of BackTrack. Trying to list all the new features and possibilities that are now available in Kali would be an impossible task on this single page. We therefore invite you to visit our new Kali Linux website and Kali Linux documentation site to experience the goodness of Kali for yourself."

Quick download link:

 kali-linux-1.0-amd64.iso (2,088MB, SHA1, torrent).

happy hunting!!!!

Sunday, April 14, 2013

Evil Foca (Alpha Version) is a tool for Pentesters and Security Auditors to perform security testing in IPv4/ IPv6 data networks.


Evil Foca (Alpha Version) is a tool for Pentesters and Security Auditors to perform security testing in IPv4/ IPv6 data networks. The tool is capable to do different attacks such as:
  • MITM on IPv4 networks using ARP Spoofing and DHCP ACK injection.
  • MITM on IPv6 networks using Neighbor Advertisement Spoofing, SLAAC Attack, fake DHCPv6.
  • DoS (Denial of Service) on IPv4 networks using ARP Spoofing.
  • DoS (Denial of Service) on IPv6 networks using SLAAC Attack.
  • DNS Hijacking.
Automatically takes care of network scan and identify all the devices and their respective network interfaces, specifying their IPv4 and IPv6 addresses and physical addresses.



Evil Foca is divided into 4 panels, the left panel shows the devices found on the network, where you can add them, and filter the result The second panel, arranged in the center with all the possible attacks to perform with the tool, and on the right a short description of each one.Under the previous panel, shows the attacks being made, its configuration and status, allowing on or off. Finally, the bottom panel where shows the event log of Evil Foca.

Download and test here: - Evil Foca

Happy Hunting!!!

Wednesday, April 10, 2013

Tools and Exploits

Here is a collection of coding samples, tools, and misc. other things that we have written over the past. All source code published on this website is considered copyrighted material and licensed under the FreeBSD licensing agreement found here: http://www.freebsd.org/copyright/freebsd-license.html. At the tail of of this page you can find the full copyright disclosure.
BypassUAC – Attack that allows you to bypass Windows UAC in Windows Vista and Windows 7 both on x86 and x64 operating systems. This issue has still not been patched to-date and can still be exploited on the most recent operating systems.
Download BypassUAC here.

EgressBuster – Simple port knocking tool that uses a client/server model for identifying open ports within a network. This is useful for finding egress points within the network.
Download EgressBuster here.
PowerShell_PoC – zip file containing a number of powershell samples including SAM database dumping, reverse shells, bind shells, all natively written in PowerShell
Download PowerShell_PoC here.

Metasploit_Modules – These are a mixture of Metasploit modules we have written in the past. Most of these have already been incorporated into the framework.
Download Metasploit_Modules here.
Encrypted_http_shell.zip – Contained source code and complied binaries of a server client reverse shell that communicates natively on HTTP channels. This shell also leverages a static AES encryption key for encrypted transport of the data.
Download Encrypted_http_shell here.
Simple_py_shell – This is a simple reverse shell written in Python.
Download Simple_py_shell here.
F5 BIG-IP Remote Root Authentication Bypass Vulnerability
F5 BIG-IP Remote Root Authentication Bypass Vulnerability Download
MySQL Remote Root Authentication Bypass
MySQL Remote Root Authentication Bypass Download
Egress Buster Reverse Shell – Brute force egress ports until one if found and execute a reverse shell
Download Egress Buster Reverse Shell
PyBuild is a tool for automating the pyinstaller method for compiling python code into an executable. This works on Windows, Linux, and OSX (pe and elf formats)
Download PyBuild
Another simple reverse shell written in Python (BSIDESLV and Defcon 20 Demo)
Download Simple Reverse Shell
SQL Brute force tool that brute forces MSSQL with wordlist. Second file adds local administrator on machine and re-enabled xp_cmdshell stored procedure
Download SQLBrute
PyInjector is a quick python script to inject shellcode straight into memory. This is often used as an AV evasion technique to circumvent security controls. Initial post found here and credit here: http://www.debasish.in/2012_04_01_archive.html
Download PyInjector
The Dell Drac and Chassis Scanner for Default Credentials v0.1a is a script that will scan CIDR notations looking for default installations of Dell DRAC and Chassis implementations. By default, dell DRAC and Chassis management servers ship with default credentials of root/calvin. By using this, you can interface with the console which has an operating system loaded on it. Mount a virtual media device remotely (an iso), reboot the server and compromise the underlying operating system. Step by step tutorial here:
Owning Dell DRAC for ONE AWESOME HACK! – Blog Post
Download Dell Drac and Chassis Scanner for Default Credentials v0.1a\

 for more news check this https://www.trustedsec.com

happy hunting!!!

Sunday, January 13, 2013

CERT Failure Observation Engine (FOE) – Mutational Fuzzing Tool

The CERT Failure Observation Engine (FOE) is a software testing tool that finds defects in applications that run on the Windows platform. FOE performs mutational fuzzing on software that consumes file input. (Mutational fuzzing is the act of taking well-formed input data and corrupting it in various ways, looking for cases that cause crashes.) The FOE automatically collects test cases that cause software to crash in unique ways, as well as debugging information associated with the crashes. The goal of FOE is to minimize the effort required for software vendors and security researchers to efficiently discover and analyze security vulnerabilities found via fuzzing.

Note: this software package contains both the source code for the distribution and a binary installer package for Windows. The installer package will attempt to install FOE and all of its dependent software packages on the system. If you wish to evaluate the binary installer, it is highly advisable to do so on a non-enterprise system devoted solely to testing. An ISO image is also available for convenient use within a Windows virtual machine instance.

At the CERT/CC, we have already used the FOE infrastructure to find a number of critical vulnerabilities in products such as Adobe Reader, Flash Player, and Shockwave player; Microsoft Office and Windows; Google Chrome; Oracle Outside In; Autonomy Keyview IDOL; Apple QuickTime; and many others.
Note: Because fuzzing can fill temporary directories, put the target application in an unusable state, or trigger other operating-system-level bugs, we recommend that FOE be used in a virtual machine.


You can download FOE here:
http://www.cert.org/vuls/discovery/foe.html

 Happy Hunting!!!!

Friday, November 16, 2012

Hack.me – Build, Host & Share Vulnerable Web Application Code

Hack.me is a FREE, community based project powered by eLearnSecurity. The community allows you to build, host and share vulnerable web application code for educational and research purposes.
It aims to be the largest collection of “runnable” vulnerable web applications, code samples and CMS’s online. The platform is available without any restriction to any party interested in Web Application Security: students, universities, researchers, penetration testers and web developers.


Features
  • Upload your own code
  • Online IDE for PHP & MySQL
  • Your code hosted in the cloud
  • FREE!!
  • Practice webapp security
  • Isolated enviroment
  • Online: nothing to download!
Safety
Every time you run a new Hackme the site will initiate a new sandbox for you. You will get isolated access to it so that you will always know that the application is safe for you to use. No other students can add malware or exploits in your sandbox. This ensures 99% safety.
What about the 1%? While the team makes the best effort to moderate every and each new web app uploaded on Hack.me, chances are that something can and will slip through. If you are not 100% comfortable to trust us or the Hackme developer, please just run new Hackmes from a virtual machine or from a non production OS.
We have written about a variety of web apps where you can practice your hack-fu such as:
you can try and feel it , up to you to decide the best:
https://hack.me/ 

Happy Hunting

Thursday, October 25, 2012

BackBox Linux 3.0 - penetration testing and forensic analysis tasks

Raffaele Forte has announced the release of BackBox Linux 3.0, a specialist Ubuntu-based live DVD designed for penetration testing and forensic analysis tasks: "The BackBox team is pleased to announce the major release of BackBox Linux, version 3.0. The major release include features such as Linux kernel 3.2 and Xfce 4.8. Apart from the system major upgrade, all auditing tools are up to date as well. What's new: system upgrade; bug corrections; performance boost; improved start menu; improved Wi-Fi drivers (compat-wireless aircrack patched); new and updated hacking tools. System requirements: 32-bit or 64-bit processor; 512 MB of system memory; 4.4 GB of disk space for installation; graphics card capable of 800x600 pixel resolution; DVD-ROM drive or USB port." Here is the brief release announcement.
 you can try download here:-

Download: backbox-3.0-i386.iso (1,099MB, MD5)
                  backbox-3.0-amd64.iso (1,100MB, MD5).


 

for more pictures click here http://www.backbox.org/gallery/backbox-linux-2

Sunday, September 30, 2012

CrowdRE – Crowdsourced Reverse Engineering Service From CrowdStrike

Reversing complex software quickly is challenging due to the lack of professional tools that support collaborative analysis. The CrowdRE project aims to fill this gap. Rather than using a live distribution of changes to all clients, which has proven to fail in the past, it leverages from the architecture that is being used with success to organize source code repositories: a system that manages a history of changesets as commit messages.

 There’s a great video here, which explains more about CrowdRE and how to get started:



The central component is a cloud based server that keeps track of commits in a database. Each commit covers one or more functions of an analyzed binary and contains information like annotations, comments, prototype, struct and enum definitions and the like. Clients can search the database for commits of functions by constructing a query of the analyzed binary’s hash and the function offset. Different concurring commits for a function are possible; in such cases it is up to the user to decide which commit is better.
This basic concept is sufficient for a collaborative workflow on a per-function basis for a shared binary. One exciting feature is a similarity hashing scheme that considers the basic block boundaries of a function. Each function is mapped on a similarity preserving hash of fixed size. A database query for such a functions similarity hash returns a set of functions sorted by their similarity value, and the analyst can choose amongst them. This is extremely helpful when analyzing variants based on the same code or generations of a malware family, for example.
The CrowdRE client is now freely available as an IDA Pro plugin. CrowdStrike maintains a central cloud for the community to share their commits amongst each other. It is our goal to help building a public database of known, well annotated functions to speed up the analysis of standard components, somewhat similar to what BinCrowd (which is offline nowadays) offered but with support for multiple co-existing commits for the same function. We also supports list-based commit visibility to give users control over who else can see and import their contributions.

You can check out the service here:
https://crowdre.crowdstrike.com/sign-in

Tuesday, September 4, 2012

Upgrade From BackTrack 5 R2 to BackTrack 5 R3

This is simple way to upgrade from BackTrack 5 R2 to BackTrack 5 R3:-

open your terminal and start typing the command:

1. apt-get update && apt-get dist-upgrade

With the dist-upgrade finished, all that remains is the install the new tools that have been added for R3. An important point to keep in mind is that there are slight differences between the 32-bit and 64-bit tools so make sure you choose the right one.

2.
32-bit install tools

apt-get install libcrafter blueranger dbd inundator intersect mercury cutycapt trixd00r artemisa rifiuti2 netgear-telnetenable jboss-autopwn deblaze sakis3g voiphoney apache-users phrasendrescher kautilya manglefizz rainbowcrack rainbowcrack-mt lynis-audit spooftooph wifihoney twofi truecrack uberharvest acccheck statsprocessor iphoneanalyzer jad javasnoop mitmproxy ewizard multimac netsniff-ng smbexec websploit dnmap johnny unix-privesc-check sslcaudit dhcpig intercepter-ng u3-pwn binwalk laudanum wifite tnscmd10g bluepot dotdotpwn subterfuge jigsaw urlcrazy creddump android-sdk apktool ded dex2jar droidbox smali termineter bbqsql htexploit smartphone-pentest-framework fern-wifi-cracker powersploit webhandler

64-bit install tools

apt-get install libcrafter blueranger dbd inundator intersect mercury cutycapt trixd00r rifiuti2 netgear-telnetenable jboss-autopwn deblaze sakis3g voiphoney apache-users phrasendrescher kautilya manglefizz rainbowcrack rainbowcrack-mt lynis-audit spooftooph wifihoney twofi truecrack acccheck statsprocessor iphoneanalyzer jad javasnoop mitmproxy ewizard multimac netsniff-ng smbexec websploit dnmap johnny unix-privesc-check sslcaudit dhcpig intercepter-ng u3-pwn binwalk laudanum wifite tnscmd10g bluepot dotdotpwn subterfuge jigsaw urlcrazy creddump android-sdk apktool ded dex2jar droidbox smali termineter multiforcer bbqsql htexploit smartphone-pentest-framework fern-wifi-cracker powersploit webhandler

That’s all there is to it! Once the new tools have been installed, you are up and running with BackTrack 5 R3. As always, if you come across any bugs or issues, please submit tickets via the BackTrack Redmine Tracker.

ok folks Happy hunting!!!

BackTrack 5 R3 adds tools for Arduino and Teensy attacks

The third release of version 5 of the BackTrack Linux security distribution fixes several bugs discovered since the R2 release in March and adds over 60 new tools. Several of the new tools were released as part of presentations at the recent Black Hat and DEFCON conferences. The distribution has also added a completely new category of software for "physical exploitation". This category includes libraries and an IDE for the Arduino and the Kautilya toolkit which provides payloads for the Teensy USB development board.
BackTrack can be run as a live CD for added security and flexibility or can be permanently installed on a system. The distribution is developed with security researchers and penetration testers in mind and offers one of the most comprehensive collections of Linux-based security software. Development of the distribution is sponsored by Offensive Security.
BackTrack 5 R3 is available with a choice of KDE and GNOME desktops for 32- and 64-bit machines and the project also provides a pre-built VMware image. ISO images can be downloaded directly from the distribution's mirrors or via BitTorrent. Information on how to install and use BackTrack is available from the project's wiki.

thanks to the H-Security for the news

BackTrack 5 R3 - Release

Hello there!! sorry because long time not update any new material in this blog, maybe not to late to tell the good news to all Backtrack lovers that the team has release the new Backtrack 5 R3 and ready to try..ok this is the story:-
------------------------------------------------------------------------------------------------------------


The time has come to refresh our security tool arsenal – BackTrack 5 R3 has been released. R3 focuses on bug-fixes as well as the addition of over 60 new tools – several of which were released in BlackHat and Defcon 2012. A whole new tool category was populated – “Physical Exploitation”, which now includes tools such as the Arduino IDE and libraries, as well as the Kautilya Teensy payload collection.
Building, testing and releasing a new BackTrack revision is never an easy task. Keeping up-to-date with all the latest tools, while balancing their requirements of dependencies, is akin to a magic show juggling act. Thankfully, active members of our redmine community such as backtracklover and JudasIscariot make our task that much easier by actively reporting bugs and suggesting new tools on a regular basis. Hats off to the both of you.

We would like to thank Offensive Security for providing the BackTrack dev team with the funding and resources to make all of this happen. Also, a very special thanks to dookie, our lead developer – for building, testing and packaging most of the new tools in this release.
Together with our usual KDE and GNOME, 32/64 bit ISOs, we have released a single VMware Image (Gnome, 32 bit). For those requiring other VM flavors of BackTrack – building your own VMWare image is easy – instructions can be found in the BackTrack Wiki.
Lastly, if you’re looking for intensive, real world, hands on Penetration Testing Training – make sure to drop by Offensive Security Training, and learn the meaning of “TRY HARDER“.
For the insanely impatient, you can download the BackTrack 5 R3 release via torrent right now. Direct ISO downloads will be available once all our HTTP mirrors have synched, which should take a couple more hours. Once this happens, we will update our BackTrack Download page with all links.

Saturday, July 14, 2012

Microsoft® EMET third-party GUI

Around this time last year I was working on a contract implementing a service running on a Microsoft® Embedded XP device that required a high level of security. Unfortunately I knew that Embedded XP did not have the SEHOP and ASLR protections of modern operating systems such as Windows® Vista and Microsoft Windows® 7. Because my service was communicating over the WAN it could potentially be vulnerable to zero-day exploits.

The Problem

    I really wanted to use the Enhanced Mitigation Experience Toolkit for providing SEHOP and pseudo-ASLR but unfortunately the EMET graphical interface was implemented with the .NET Framework. This imposed several problems; I had very limited drive space to work with... the operating system was installed on a 512 megabyte Secure Digital (SD) card. The operating system and other various tools consumed most of this space. Also because the device was designated as High-Security I did not want to increase the attack surface by installing the .NET framework. There have been many vulnerabilities found within the .NET framework over the last few years.

The Solution

    I began developing a custom graphical interface for the EMET package. But first there were a few hurdles I would need to overcome. The first problem I encountered was the archaic Application Compatibility Database engine that was being used. I began reverse engineering this beast and it appears to be similar to the old hash-bucket databases we used back in the old Unix days. Somewhat similar to the old ndbm, dbm and gdbm. The problem was that the AppHelp.dll that is distributed with Microsoft Windows® XP is missing many of the functions for creating and writing to the Application Compatibility Database.
    There were a few other issues such as figuring out how the mostly-undocumented Boot Configuration Data (BCD) store is implemented. On operating systems prior to Vista I could simply change a few registry keys and modify the boot.ini but to make my software future proof I would need to support the BCD. 


  I recently added the ability to install and configure EMET on ComputerA and export all of the settings and package all of the binaries into a redistributable package ready for installation on ComputerB. I also wanted to expose more of the EMET internals to the end-user such as heap pre-allocations.

Final Thoughts

    If you are interested in using the third-party graphical interface for the Enhanced Mitigation Experience Toolkit you may download it here.
Download: Native EMET graphical interface

MD5: B8FB870B831954EC6FB6580F72E4AF83
SHA1: 806E50C3A7BF38363E045BD1B5CA42351D40DB3B

    During my research I encountered some absolutely astonishing security issues related to the App Compat engine. I want to make a public call to other security researchers to focus some attention on this area.

thanks to the  David Delaune at www.scatternetwork.com

Tuesday, July 10, 2012

The Mole v0.3 – Automatic SQL Injection Exploitation Tool



The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

 

 

Features

  • Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
  • Command line interface. Different commands trigger different actions.
  • Auto-completion for commands, command arguments and database, table and columns names.
  • Support for filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
  • Exploits SQL Injections through GET/POST/Cookie parameters.
  • Developed in python 3.
  • Exploits SQL Injections that return binary data.
  • Powerful command interpreter to simplify its usage.
Disclaimer: Usage of The Mole for attacking web servers without mutual consent can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program.

download this tool here : Linux - Themole-0.3-lin-src.tar.gz
                                      Windows - Themole-0.3-win32.zip
for more info go here

Thursday, June 28, 2012

“Egress Buster” – Find outbound ports

A friend was recently on a penetration test and needed a port on the outside. I haven’t found any decent tools out there for finding what ports are allowed outbound to help with reverse shells and stuff like that so I wrote one real quick. Note that this was written in about 15 minutes and the code can absolutely be improved. I’ll probably go back and clean it up sometime. There are some limitations, for one, operating systems in general start to puke when you generate over a 1000 listeners, so you will need to test a 1000 at at time. Good news is the socket handlers are multi-threaded so you can cycle through about a 1000 ports in well under a minute. Here’s the general concept:
You are on the inside network somehow and need to find what ports are allowed out to the Internet. There’s two main files/components – egressbuster and egress_listener. Egressbuster connects out on whatever ports you specify and tries to connect to an Internet facing computer thats running egress_listener.
Very simple to run:
On victim:

egressbuster.exe  
example: egressbuster.exe 208.1.1.1 1-1000



In the above example, we specify a low port range and high port range, egressbuster will attempt to connect from port 1 to 1000 outbound to wherever the reverse_listener is.
The listener:

python egress_listener.py 
example: python egress_listener.py 1-1000


In the above example, we just specify what ranges we need to listen to. In the above example we listen from 1 to 1000 for incoming connections. When a connection is established, this is what you'll see on the listener side.

192.168.235.131 connected on port: 170
192.168.235.131 connected on port: 171
192.168.235.131 connected on port: 172
192.168.235.131 connected on port: 173
192.168.235.131 connected on port: 174
192.168.235.131 connected on port: 175
192.168.235.131 connected on port: 176
192.168.235.131 connected on port: 177
192.168.235.131 connected on port: 178

If your interested, download the byte compiled code and the python source here.