Portbunny - Port scanning improvement

A new port scanner has been released by the Recurity Labs guys (FX), it has some improvements over the well known scanners (Nmap). It's was developed for the security professionals, with performance in mind. As stated in Portbunny webpage:



"PortBunny is a Linux-kernel-based port-scanner created by Recurity Labs. Its aim is to provide a reliable and fast TCP-SYN-port-scanner which performs sophisticated timing based on the use of so called "trigger"-packets. The port-scan is performed in 2 steps: First the scanner tries to find packets, to which the target responds ("triggers"). Second, the actual port-scan is performed. During the scan, the triggers, which were found in the first scanning-phase, are used to determine the optimal speed at which the target may be scanned."

Portbunny webpage

Enjoy.

Backtrack 3.0

Hi, the new Backtrack 3.0 Beta is out there, the new version includes some of my tools, im very happy :P

Right now the tools included are Metagoofil , Subdomainer, TheHarvester (goog mails)

The new version claims to have these improvements:

* We will be releasing a ~ 1 GB USB / DVD image, as well as a stripped down 700 MB iso.
* Dual core issues have been fixed.
* Wireless card compatibility has maximised, and injection patches applied wherever possible.
* Xorg configuration scripts have been improved.
* Updated exploit repositories, updated metasploit exploit framework and dependencies.
* PXE network boot feature finally added (USB Version)
* PwnSauce Instant John the Ripper Cluster feature finally added (USB version)
* Compiz with ATI/Intel Drivers (USB version)
* Linux bt 2 6 21 5 #2 SMP

Download

And more security tools, that is what we want!!



Enjoy

Fist Conference - Barcelona

The next week (26/10/2007) i will be speaking at the FIST Conference about "Information Gathering" the speak will be based on Metagoofil. I will release a new version, with some fixes and improvements.

If you are in Barcelona, come and join us!

http://www.fistconference.org/barna.php

Protocols, Data structures and File formats

Recently i discover the website Wotsit.org, is a place where you can find information of Data Structures, Protocols, File Formats, etc. It's a valuable resource for creating fuzzing tools, analyzing protocols, or develop a tool.
Really a must have in the security professional bookmarks!

Site: Wotsit

Enjoy

Wfuzz, proxys and webserver scanning

Yesterday i was performing a pentest on a very big network. After struggling a bit i managed to upload files to a web server, an antivirus was running so many known tools didn't work, so it's time for more creativity. I pulled the http-proxy, a python based proxy developed by Edge-security, and compiled it into binary with py2exe, created an self-extracting zip, and uploaded to the server. I configured the proxy to listen on the port 53, as they leave that port unfiltered, neat :P

Well, so far so good, now i needed to know which machines were running webservers. I could have programmed a python scanner and upload it, but i was running out of time, so i went for wfuzz, the swiss knife for application testing (every body says their tool is a swiss knife), i used this command line to scan for web servers in the internal LAN through the proxy:

me ----> Server w/proxy ---->LAN

wfuzz -x serverip:53 -c -z range -r 1-254 --hc XXX -t 5 http://10.10.1.FUZZ

Some wfuzz switchs:

-x set proxy
--hc is used to hide the XXX error code from the results, as machines w/o webserver will fail the request (this is added on the new version).

With this command line, i will get every web server on the segment 10.10.1.X, i had to repeat this line for every segment the compromised server could reach, just that easy, fast and fun.

The http-proxy i used is part of the next framework that is being baked at Edge-security, stay tuned..

See you soon