Tool Population For Vulnerability Assessment

A vulnerability assessment tool or scanner is a tool using which we can automate the process of testing loopholes in a network and immunity of security system implemented by an organization.

They can be classified as :

a.     Host

b.    Service

c.     Application

Host based tools performs scanning on the system they resides on, i.e. they do not interact with any other system. Their advantage include having access to all system resources such as logs, etc. They also work a a faster rate as compared to other assessment tools. However they can also take large amount of host machine’s resources and if this was a important node in the network, this can raise worries on network admin’s face.

Service vulnerability scaners includes tools which scans a range of host or particular services which are running on them. These can include simple port scanners (Nmap, angryip, etc) and they can also include completely automated programs (Acunetix, Nessus, GFI Languard)  which can detect live hosts and try to fetch data from them. This automation can be in terms of banner grabbing or service identification as well. These automated tools also enable users to create a report on its own once it completes the assessment.

When we talk about current tool population in the industry, there are a number of tools ranging from scanners to automated ones. Some of them which are open source and available free of cost includes :

Ø Microsoft Baseline Security Analyser ( http://microsoft.com/technets/security/tools/mbsahome.mspx)

Ø Winfingerprint (http://winfingerprint.com)

Ø OpenVas (http:/wald.intevation.org/projects/openvas/)

Ø Paros (http://parosproxy.org)

Ø Win Vuln Scan (http://pspl.com/download/winvulnscan.htm)

Ø Nikto (http://www.cirt.net/code/nikto.shtml)

Ø Nessus 

Apart from these tools, you must be in touch with latest vlnerbilty informations. For this purpose you can use these advisories :

Ø http://cert.org

Ø http://cve.mitre.org/cve

Ø http://isc.sans.org

Ø http://owasp.org

Ø http://osvdb.org

Ø http://seclists.org

Ø http://secunia.com

Ø http://exploit-db.com

1:09 PM by Shubham Mittal · 0

Null Session Port Number 139 Vulnerability Of Windows Default Shares

The Server Message Block (SMB) protocol, also known as the Common Internet File System (CIFS), enables file sharing over networks. Improper configuration can expose critical system files or give full file system access to any hostile party connected to the Internet. Many computer owners unknowingly open their systems to hackers when they try to improve convenience for coworkers and outside researchers by making their drives readable and writeable by network users. Administrators of a government computer site used for software development for mission planning made their files world readable, so that people at a different government facility could get easy access. Within two days, attackers had discovered the open file shares and had stolen the mission planning software.

Enabling file sharing on Windows machines makes them vulnerable to both information theft and certain types of quick-moving viruses. Macintosh and Unix computers are also vulnerable to file sharing exploits if users enable file sharing.

The SMB mechanisms that permit Windows File Sharing may also be used by attackers to obtain sensitive system information from Windows systems. User and Group information (usernames, last logon dates, password policy, RAS information), system information, and certain Registry keys may all be accessed via a “null session” connection to the NetBIOS Session Service. This information is useful to hackers because it helps them mount a password guessing or brute force password attack against the Windows target.

Systems impacted:

Microsoft Windows NT and Windows 2000 systems

CVE entries:

CVE-1999-0366, CVE-2000-0222, CVE-2000-0979, CAN-1999-0518, CAN-1999-0519,
CAN-1999-0520, CAN-1999-0621, CAN-2000-1079

How to determine if you are vulnerable:

A quick, free, and secure test for the presence of SMB file sharing and its related vulnerabilities, effective for machines running any Windows operating system, is available at the Gibson Research Corporation web site at http://grc.com/. Click the “ShieldsUP” icon to receive a real-time appraisal of any system's SMB exposure. Detailed instructions are available to help Microsoft Windows users deal with SMB vulnerabilities. Note that if you are connected over a network where some intermediate device blocks SMB, the ShieldsUP tool will report that you are not vulnerable when, in fact, you are. This is the case, for example, for users on a cable modem where the provider is blocking SMB into the cable modem network. ShieldsUP will report that you are not vulnerable. However, the 4,000 or so other people on your cable modem link can still exploit this vulnerability.

The Microsoft Personal Security Advisor, will report whether you are vulnerable to SMB exploits, and can also fix the problem. Since it runs locally, its results will always be reliable. It is available at: http://www.microsoft.com/technet/security/tools/mpsa.asp

 How to protect against it:

Take the following steps to defend against unprotected shares:

1. When sharing data, ensure only required directories are shared.
   
2. For added security, allow sharing only to specific IP addresses because DNS names can be spoofed.
   
3. For Windows systems (both NT and 2000), use file system permission to ensure that the permissions on the shared directories allow access only to those people who require access.
   
4. For Windows systems, prevent anonymous enumeration of users, groups, system configuration and registry keys via the “null session” connection. See item W5 for more information
   
5. Block inbound connections to the NetBIOS Session Service (tcp 139) and Microsoft CIFS (TCP/UDP 445) at the router or the host.
   
6. Consider implementing the RestrictAnonymous registry key for Internet-connected hosts in standalone or non-trusted domain environments. For more information see the following web pages:
   
7. Windows NT 4.0: http://support.microsoft.com/support/kb/articles/Q143/4/74.asp
   
8. Windows 2000: http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP
   
   Hopes You guys enjoyed the article, Enjoy Hacking Enjoy Hackton.

9:22 AM by Shubham Mittal · 1

Easiest Example Of SQL Injection : Just For Beginners

As i worked a lot on SQL  Injection , n concluded that it is a vast technique or methodology or watever..Giving Rise to bore or hacticness....Thats y i m goin here to give a simple n breif overview of how to Intrude a Website With SQL INJECTION Attack.

Here is a sample basic HTML form with two inputs, login and password.

The easiest way for the login.asp to work is by building a database query that looks like this:


SELECT id
FROM login
WHERE username = '$username'
AND password = '$password’

If the variables $username and $password are requested directly from the user's input, this can easily be compromised. Suppose that we gave "Joe" as a username and that the following string was provided as a password: anything' OR 'x'='x


SELECT id
FROM login
WHERE username = 'Joe'
AND password = 'anything' OR 'x'='x'


As the inputs of the web application are not properly sanitised, the use of the single quotes has turned the WHERE SQL command into a two-component clause.

The 'x'='x' part guarantees to be true regardless of what the first part contains.

This will allow the attacker to bypass the login form without actually knowing a valid username / password combination!

Now this ws how to Make a simple web attack with sql injection....Bt for security Professionals.>> How To Protect it.

So here we go for that as well..




How To prevent SQL Injection attacks?
Firewalls and similar intrusion detection mechanisms provide little defense against full-scale web attacks. Since your website needs to be public, security mechanisms will allow public web traffic to communicate with your databases servers through web applications. Isn’t this what they have been designed to do?

Patching your servers, databases, programming languages and operating systems is critical but will in no way the best way to prevent SQL Injection Attacks.
 

Any queries or Suggestions , Do Contact The Admin..

Enjoy Hackton

8:40 AM by Shubham Mittal · 0

WordPress <= 2.8.3 Reset Admin Password Vulnerability

An exploit has been released for all current versions of WordPress including WordPress <= 2.8.3.
Laurent Gaffié who published the finding says:

          An attacker could exploit this vulnerability to compromise the admin
          account of any wordpress/wordpress-mu <= 2.8.3

From what I can tell the vulnerability allows an attacker to reset the admin user account without having a valid email address. This could certainly be used in a denial of service vulnerability, locking an admin out their site by continually changing the password.

You can change any admin password on any WordPress blog as follows (taken from exploit):

http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=

I’ve tested this and it does change the admin password, however, I haven’t looked at this for some time but I believe WordPress generates a fairly strong password after being reset, something an attacker would have difficulty brute forcing or guessing.

BlogSecurity has recommended before that the /wp-admin/* directory should be password protected or restricted to IP address. This would mitigate this problem.

8:10 AM by Shubham Mittal · 0