JSinfosec

Your WiFi Could Betray Your Passwords, Pins & Keystrokes

2016-11-14T20:12:00.000-08:00

The way user moves his fingers across a phone's touchscreen alters the WiFi signals transmitted by a mobile phone, causing interruptions that an attacker can intercept, analyze, and reverse engineer to guess what the user has typed on his phone or in password input fields.

This type of attack, nicknamed WindTalker, is only possible when the attacker controls a rogue WiFi access point to collect WiFi signal disturbances .

The Details of the attack is explained in following Video & in the Research paper CSI Meets Public WiFi: Inferring Your Mobile Phone Password via WiFi Signals."

Google prompt makes Two-factor Authentication Easier

2016-06-23T22:31:00.000-07:00

Two-factor authentication is an effective way to secure online accounts, but many users avoid enabling this feature to save themselves from irritation of receiving and typing a 6-digit code that takes a few more seconds.

Now with Google Prompt, Google has made the Two-Factor Authentication process much easier with for its users, allowing you to login with just a single tap instead of typing codes.

How to Set Up Google Prompt

If you have an iPhone, you are required to download the Google Search app first and sign in before using Google Prompt. But, if you are an Android user, just update your Google Play Service.

Setting Up A Pentest Lab with Firewall in Virtual box

2016-06-22T21:32:00.000-07:00

Penetration testing requirements often force penetration testers to do both external as well as internal assessments. This article covers the concepts that are required to setup a pentest lab in virtual box, which looks like a real network for a small-scale organization. This can be used as a base for setting up more advanced labs to practice penetration testing concepts in a legal environment.
Before proceeding further, here is a quick note about licensing. Windows Operating Systems that we use in this article must be purchased from Microsoft or you can go with trial versions available.

Let’s begin:

Following is the network we are going to setup in this article.

I am using Mac as host machine (192.168.1.103) and connected to a wireless router (192.168.1.1).

Required Software:

Virtual box

Kali Linux

Windows Server 2003

pfSense

Windows 7

Virtual Box:

Install virtual box in your host machine. Virtual box can be downloaded from the link below.

Download Link: https://www.virtualbox.org/wiki/Downloads

Kali Linux:

Install Kali Linux in virtual box. Kali Linux can be downloaded from the link below.

Download Link: https://www.kali.org/downloads/

Windows Server 2003:

As mentioned in the beginning of the article, we need to get a licensed version of windows server from Microsoft.

Link: http://www.microsoft.com/en-us/download/details.aspx?id=41

The main focus of this lab is to show how we can set up the environment using pfSense. So we wont be covering how to configure windows server.

pfSense:

pfSense firewall can be downloaded from the link below.

Download Link: https://www.pfsense.org/download/

Introduction:

Note: If you want to setup a true DMZ environment in this lab, you need to setup back-to-back firewalls. To avoid this, web Server is kept in the private network.

Firewall – pfSense

Internal Pentest – Assuming that an attacker has access to the internal network, we can use Kali Linux with the IP address 10.0.0.5 to pentest the other machines in the private network.

External Pentest – Web Server is kept behind the firewall. Though firewalls cannot be used to stop web attacks since port 80/443 is opened for obvious reasons. Firewall and the private network can be assessed from users connected to the same network (Wi-Fi router) or from the host machine.

We can open ports for other vulnerable services such as FTP, SSH etc. to create more vulnerabilities for an external pentest.

Configuring pfSense:

Make sure that pfSense is installed in virtualbox.

Once after completing the installation process, we can proceed with pfSense configuration. The steps to configuring pfSense are shown in the next section. Before that, let us make changes to virtual box network settings for pfSense instance.

By default, Adapter 1 is attached to NAT in Virtual box. Change “Adapter 1” from “NAT” to “Bridged Adapter”. This is the public facing interface for pfSense.

This should look as shown in the figure below.

Now, we need to setup another interface for pfSense. This is going to be the interface for the private network protected by the firewall.

So choose “Adapter 2” and select “Internal Network”. This should look as shown in the figure below.

Now, we are done with the virtual box settings and we now need to configure pfSense. So, let us launch pfSense.

Leave it for Autoboot and you should see the following screen in a moment.

When it prompts for VLAN setup, just type “n” and hit enter.

Then, we will be asked to enter interface names for both adapters we set.

For the WAN interface, specify “le0” and for the LAN interface specify “le1” as shown in the above figure.

We can clearly observe in the note in the above figure that the internal network will be behind the NAT.

After filling the required details, hit enter.

We should see the following screen asking for the user confirmation to proceed. Just type “Y” and hit enter.

The above step creates an IP address for the WAN interface automatically. This is shown in the figure below.

As we can see in the above figure, pfSense is assigned with 192.168.1.106 on the interface le0.

This interface is publicly accessible in our lab. So, we can access this IP address from any computer connected to the same Wi-Fi network. You may look at the network diagram we have shown in the beginning to better understand this.

Now, we need to configure the other interface, which is private and not directly accessible to the public users.

To do this, we are going to setup an IP address for the interface le1.

In the above screen, just enter 2 in order to select “Assign Interfaces”. Then, we should see the available interfaces. Since we are going to configure the second interface, we will choose “2” again. This should allow us to configure the private interface, which is le1 (LAN).

We will then be prompted for the LAN IP address.

In my case, I am providing it 10.0.0.1.

All these steps explained so far are shown in the above screenshot.

Now, let us hit enter. We will be prompted for the subnet mask bit count.

Enter 24 as shown below.

Hit enter 3 times to get the screen to configure DHCP service for private LAN.

As we can see in the above figure, we need to enable DHCP server on LAN interface by typing “Y”.

Then, we need to enter the range of IP addresses. Since I am going to setup a network with only 3 systems connected to it, I am giving the range from 10.0.0.5 to 10.0.0.10

Once done, hit enter and type “Y” again to have webconfigurator for pfSense configuration from a GUI and then hit enter.

We should see the above screen with the URL where we can access the Graphical User Interface for pfSense configuration.

Finally, hit enter to go back to the command line configuration interface, which appears upon starting pfSense.

If we now observe, we should see everything set for both the interfaces.

Checking connectivity from pfSense to public users:

Now, let us see if we are able to ping the host machine.

Select “Ping host” by typing 7 in the command line as shown below.

Then enter the IP address of the host machine. We should see getting responses.

Configuring private network:

Setting up Kali Linux:

So far, we have installed and configured pfSense. Now, we are going to set up the hosts in the private network. The first host is Kali Linux. This is going to be the attacker’s machine if you want to have an internal pentesting environment.

Select kali Linux in virtual box and then network settings. “Adapter 1” is going to be “Internal Network” as shown in the following screen.

Now, boot Kali Linux.

Once it is up and running, launch a terminal and type “ifconfig” to see the IP address.

As expected, we have got 10.0.0.5 as our IP address. DHCP server at LAN interface on pfSense assigns this.

Now, we should be able to configure pfSense from this host using the URL http://10.0.0.1/

Let us open up a browser and type in http://10.0.0.1/ in the URL. We should see pfSense’s login screen as shown below.

The default username is “admin” and password is “pfsense”. Consider changing your password once after logging in for the first time.

We should see the dashboard as shown in the above figure. We can play around with various settings available in pfsense. We will see some of them in the next section.

Getting Internet in internal network:

By default, we wont get the Internet in our private network. Just to test, we can try pinging google.com as shown in the figure below.

As expected, it says “unknown host”.

Now, login to the pfSense web interface and navigate to Services -> DHCP Server.

Find out the section ‘DNS Servers” and type the following address as shown in the figure below.

8.8.8.8

Make sure that you save the changes in the configuration.

Now, type “dhclient” in the terminal and try pinging google.com as shown in the figure below.

As we can see, we are getting responses from google.com.

Let us also check the address of the default gateway for this host by typing the command “netstat –nr” as shown below.

As we expected, this is 10.0.0.1, which is the IP address we assigned to le1 interface on pfSense.

Setting up windows server:

Finally, install windows server 2003. As I mentioned in the beginning of this article, the main focus of this lab is to show how we can set up the environment using pfSense. So we wont be covering how to configure windows server and domains here.

Again, the network settings will remain same for this host.

Start this virtual machine instance and check the IP address as shown below.

I am running IIS webserver on this machine. But, unfortunately we can’t access this server from outside this network.

This is where we can port forward and allow users to access this webserver through the firewall.

Configuring pfSense to forward http traffic to internal network.

Log in to pfSense web interface using the browser. Navigate to

Port Forwarding –> NAT rule and make sure that you nave the same settings as I have here in the following screenshot.

The next step is to unblock connections to private network from public users. To do this, navigate to the following path.

Interfaces -> WAN -> Block Private networks.

Make sure that it is unchecked as shown below.

Save the changes.

Now, we should be able to access the internal web server just by typing the public interface IP address of pfSense as shown below.

Setting up windows 7:

Similar to how we set up Kali Linux, we need to setup Windows 7’s network settings to “Internal Network” and you are good to go.

This looks as shown in the figure below.

A quick note on setting up lab for pivoting:

If you want to practice pivoting in this pentest lab, you may change windows 7’s network settings from internal to “host only adapter” on “Adapter 1”. Then enable “Adapater 2” on server 2003 and make it “Host only Adapter”. You should now see an additional IP address on server 2003.

Compromise Server 2003 and use it as a pivot point to gain access to windows 7.

Conclusion:

This article has provided a step by step procedure to setup a lab for practicing/teaching penetration testing in a legal environment.

This article can be used as a base if you want to expand your lab to have more advanced setup such as installing Web Application Firewalls, Load Balancers etc.

HTML5 Security - Local Storage

2015-12-25T18:25:00.001-08:00

This article walks you through a HTML5 Security feature called Local Storage and it’s security.

Local Storage:

Local Storage is one of the new features added in HTML5. It was first introduced in Mozilla 1.5 and eventually embraced by the HTML5 specification. We can use Local Storage feature in HTML5 using the JavaScript objects localStorage, sessionStorage.

These objects allow us to store, retrieve and delete data based on name value pairs.The data processed using localStorage object persists through browser shutdowns. While data created using sessionStorage object will be cleared after the current browsing session.

One important point to note is, this storage is origin-specific. It means, a site from a different origin cannot access the data stored in application’s local database.

Let me make it clear with a simple example.

Below is a sample HTML5 application, which is capable of storing data using local storage feature. We can also retrieve the data stored in the database using “Show Data” button.

Let us first observer the origin of this site.

Let us assume that this is “Application A”.

http://localhost:8383/

So here are the details:

Name: Application A
Origin: http://localhost:8383/

Let us click Show Data button.

We are able to access the data stored by this application in the database. That is expected.

Now, let us try to access this data stored by application A from a different origin.

Let us assume that this is Application B

Here are the details:

Name: Application B
Origin: http://localhost/

Please note that, port number is different from Application A.

Let us click “Show Data” button.

When I clicked “Show Data”, there seems to be nothing displayed on the webpage. This is because; this application is running on a different origin.

Just to confirm, let us run a different application named “Application C” from the same origin as “Application A”.

Here are the details.

Name: Application C
Origin: http://localhost:8383/

Let us click “Show Data” as observe the result.

Nice! We are able to access the data from this application, since it is from the same origin as Application A.

To conclude I have used the same code in all the above examples but with different origins. We inserted data into the database using Application A. When tried accessing it from Application B it failed due to the same origin policy.

Let us now see some attacks possible with HTML5 local storage.

Storing Sensitive Data

Developers may store sensitive information in these databases. It is possible to find API keys or similar sensitive data when working with APIs due to their statelessness. We can exploit them using an XSS vulnerability if there is no physical access to the device.

Below is an example of how JavaScript’s localStorage object stores data.

We can use the function setItem with some name-value pairs as parameters.

localStorage.setItem("data", “mydata”);

As we can see in the figure below, chrome stores this data in the following path.

We can programmatically read this data using JavaScript as shown below.

localStorage.getItem("data");

We can now go ahead and read this data from the SQLite database as shown below.

Script Injection

SQLite data when not properly sanitized, may lead to script injection attacks. Let us see a simple example.

Below is the same form, which we saw in the beginning of the article.

Let us store some sample data and retrieve it back as shown below.

If this data is not properly sanitized, it will lead to stored XSS Vulnerability as shown below.

This time, let us enter the below piece of code into the message box.

<img src=’X’ onerror=alert(1);>

Let us click “Show Data” button and see the result.

As we can notice, it has popped up an alertbox due to the JavaScript we injected.

This article has discussed, how HTML5 local storage feature works and how Same Origin Policy restrictions are applied on the data being stored. Finally, we have had a look at some possible attacks on HTML5 local storage feature. We will see other HTML5 features and possible attacks in later articles.

Launching Our Pentesting MongoDB for absolute Beginners Course

2015-12-14T00:28:00.000-08:00

Are you a security freak looking to learn MongoDB penetration testing? If yes, our little video course “MongoDB Pentesting for Absolute Beginners” is the perfect way to pick up the basics. This course explains common misconfigurations seen in MongoDB and walks the readers through the basics. A lab is then setup followed by assessments which includes Identifying and fixing NoSQL Injection and automated assessments with NoSQLMAP. During the lab setup phase, readers will setup everything from scratch, which includes installing MongoDB and bringing it up, setting up a database for practicing MongoDB assessments, installing PHP drivers and setting up a vulnerable web application for practicing NoSQL Injection attacks with MongoDB.

Below is the high level overview of The Course:

Introduction and Lab setup
Vulnerability Assessments
Attacking Applications
Automated Assessments

Following are a some of the Free Preview videos from the course

1. Introduction To Pentesting MongoDB for Absolute Beginners

2. Fixing NoSQL Injection

The Course Currently costs 49$ and is available at Udemy, But for the first 50 signups we are giving a flat 25 % off . You can redeem the coupon by clicking following Link

Join Now

If you like our course, Kindly tweet about it or share it with your friends via Face book and other social networking sites

How To Setup A Lab For Penetration Testing and Hacking (Level-1 Beginners )

2015-11-25T22:00:00.000-08:00

Before We begin our hacking & pen-testing journey its very important for us to set up a lab, where we can try out all the testing in a very safe environment. I have seen many tutorials and videos on this topic at various blogs & channels on youtube. But what i found missing was most of these tutorials just explained the very basics such as how to install a pen testing distro like Kali Linux or backtrack on a Virtualization software such as virtual box, & how to attack a pre-configured vulnerable box or a vulnerable distro. Most of these tutorials failed to explain simple settings and tweaks that can be done to create various hacking scenarios like for example tweaking the network settings from bridged to NAT etc., Also there are not many articles or guides on setting up a lab for intermediate and Advanced Users. Due the above reasons i have decided to write a series of very detailed articles on this topic

Today we will start off with a very simple lab setup which can be used by beginners to get started in the field of Hacking and Pen-testing

Setting Up A Professional Hacking & Pentesing Lab for Beginners

The very first thing that you should do before beginning to setup a lab, Is to ask yourself what is the purpose of my Lab ?, what are the attacks that i am going to try out in my Lab ? What are things i am planning to learn ? etc. Once you jot down the answers for the above questions you can start building your lab according to your needs. Since we are building a lab for beginners we will keep things simple

Purpose Of Our Beginners LAB

To Learn how to use Metasploit
To Learn how to use Pre compiled Exploits
To Learn How to PWN routers
To Learn and carry out basics Network Pentests
To Learn how to attack web applications

Once we are clear with our purpose, we can proceed building a lab accordingly. Following are hardware & software requirements for our beginner lab

Hardware Requirements

PC / Laptop * running Windows or Mac or Linux
4 Gigs of RAM or more * (If not at least 2 to 3 Gigs of Ram )
100 Gb of Hard disk space
Good Internet Connection

Note :- If you just have 1 GB of ram do not proceed any further, you will not be able to run your Virtual machines efficiently

Software Requirements

Virtualization Software *

VMware Workstation or VMware Player ( Recommended If your using Windows)
Virtual Box (Recommended If your using Mac or Linux )

Pen-testing Distros

Kali Linux * (Recommended)

Black Box Linux (Optional)

Vulnerable Distros

Metasploitable 1 & 2 *
UltimateLAMP

Other Boxes To Pwn

Windows 2002 or 2003

Vyatta (Virtual Router )
Windows 2007 (optional)
Any Linux box (optional)

Building Our Beginner Lab

Once we have the required hardware & software, we can start building our beginner lab. First we will install the virtualization software, which will help us run multiple boxes (operating systems) on our host machine. You can choose between VMware Workstation and Virtual box, if your using windows i would highly recommend you to go with VMware, it handles memory very efficiently when running multiple boxes at the same time. If your using Linux such as Ubuntu it is highly recommend that you go with Virtual box, & if your using Mac your only option is to go with Virtual Box as VMware does not support Mac. Since there are new updates of the software almost every few months, For the Instillation guide, its a good practise to check the vendors website. I will give you the links for the official installation Guides of both VMware and Virtual box, which you can use to set VMware or Virtual box on your host machine

VMware Installation Guide

Virtual Box Installation Guide

Once you install the Virtualization software. Now lets start installing our Pen Testing Distors, Vulnerable Distros & other boxes mentioned above

Pentesting Distros & Vulnerable Boxes

Kali Linux *

Kali linux is a must have pentesting distro for every hacker/Pentester. Kali is the successor of backtrack pen testing distors, Kali is debain based Linux which is well maintained with regular updates by offensive security. It has all the tools for carrying out a penetration test .For more details about Kali linux please visit their official website

Installing Kali on VMware Guide

Installing Kali on Virtual Box Guide

Back Box (Optional )

BackBox is a Linux distribution based on Ubuntu. It has been developed to perform penetration tests and security assessments. Designed to be fast, easy to use and provide a minimal yet complete desktop environment, thanks to its own software repositories, always being updated to the latest stable version of the most used and best known ethical hacking tools.

Backbox Guide

Vulnerable Boxes

Note

When installing the above the boxes make sure you allot enough hardisk space, anything over 10gb (15 gb recommended )
Dedicate each box at least 1 gb ram (Metasploitable,Ultimate lamp 512 gb)
Make sure you install guest additions on each box if your using virtual box and vmware tools if your using Vmware, this will give you some additional functionality like resizing the size of your virtual machines screens, allowing you to copy from host machine to virtual boxes etc.

Tutorials , Guides & Walkthroughs

Now before i give you the links for various walkthroughs and guides, i will first talk about the network settings and how you can tweak them

Bridged Mode

When you set your virtual machine to bridged mode, Your virtual machine will get an IP address in the range of the host computer when you compare it in real world its more like a computer which is on your LAN (Local area Network ), These computers are easy to hack since they have the ip in the same rage, so you can attack them directly. It is highly advised to set your Network settings to Bridged Mode when trying out the guides and tutorials given below. Once your comfortable with it you can try other network settings like NAT etc

NAT Mode

When your Virtual machine is in NAT mode . The virtual machine will get an IP address in Private Ip address range (10.X.X.X). when you compare this to real world, its more like a computer which is sitting behind a router so basically you can not attack the system directly.

Tutorials, Guides and Walkthroughs
(Note :- Will be updated when i find some good tutorials and guides )

Google to Reward HTTPS Sites With Better Search Rankings

2014-08-10T19:42:00.001-07:00

Google will now give higher search rankings to websites which are encrypted (Using HTTPS). The new policy comes as part of an effort to push web developers towards establishing more secure practises .

Google has already taken steps to make its own services more secure in the last few years, such as introducing an encrypted search and setting an HTTPS connection as the default for Gmail.It is said that Google Inc wants to encourage this across the industry, and will attempt to boost the use by rewarding adopters

According to Google’s official blog, the new HTTPS ranking signal, will be relatively small, affecting less than one percent of global searches and carrying less weight than other signals such as content, but Google noted that it may strengthen the HTTPS ranking signal in the future.However, Google will also be providing resources to help developers secure their sites. It will be publishing a series of articles in the upcoming weeks on how to make the transition, and it has also provided tools to test security

With this new development, Google hopes to pressure other web developers to take this same approach.

Now Drones Can Hack Your Smart Phones

2014-06-09T19:24:00.002-07:00

A quad-copter developed by a British based company can now steal your smart phones private data such as User names, Application Passwords, Important credentials etc. The drones Power lies in the software "Snoopy" which is installed on the computer attached to the drone. Snoopy intercepts Wi-Fi signals.when mobile devices try to find a network connection Snoopy tries to impersonate as legitimate access point. Once the Phone is connected to snoopy's access point , the drone can access all the phone’s Internet activity.

The the drone was unveiled at the Black Hat Asia Cyber security conference this month

Launching Our Android Hacking and Penetration Testing Course

2014-05-31T08:49:00.000-07:00

We are happy to announce the launch of our second course "Android Hacking and Penetration Testing". This is a Highly technical and hands on course. The course does not require any prior knowledge or any programming skills This course is ideal for pen-testers , security enthusiast’s , network admin's , students and any one who is interested in Mobile Application Pen testing and development

About The Course

The course will focus on the tools and techniques for testing the Security of Android Mobile applications. During the course, you will learn various topics such as Android architecture,Android security model, Android Application Pen testing and Exploitation, Reversing Android applications,static and dynamic analysis of android malware etc. After finishing the course you will be able to carry out a Penetration Test on a Android device and its applications. To get more in depth details, Please download our course syllabus from the following link

Syllabus -Android Hacking & Penetration Testing

The course starts from the very basics and slowly takes you to more complicated topics, making it ideal for self paced learning. Following are a some of the Free Preview videos from the course

1. Setting Up a Pen-testing Environment

2. Android Architecture

3. APK Files in a Nutshell

The Course Currently costs 50$ and is available at Udemy, But for JSinfosec Readers we are giving the course for just 35 $. You can redeem the coupon by clicking following Link

Join Now

If you like our course, Kindly tweet about it or share it with your friends via Face book and other social networking sites

Android Hacking And Penetration Testing Course Promo

2014-05-26T07:50:00.001-07:00

Android Hacking and Penetration Testing course is a highly practical and hands on video course. The course will focus on the tools and techniques for testing the Security of Android Mobile applications. During the course, students will learn various topics such as Android architecture,Android security model, Android Application Pentesting and Exploitation, Reversing Android applications,static and dynamic analysis of android malware etc.

Course Release Date :- With in May end

Contact :- feedback@jsinfosec.com

Launching Our Wireless Hacking and Penetration Testing course

2014-01-31T07:45:00.000-08:00

We are happy to announce the launch of our first course "Wireless Hacking and Penetration Testing". This is an advanced Highly practical hands on Wireless Pentesting course. The course does not require any prior knowledge This course is ideal for pen-testers , network admin's security enthusiast’s , students and any one who is interested in Wireless Hacking And security

Topics Covered in this course

Basics of IEEE 802.11 WLAN Communication
WLAN Vulnerabilities
Attacking WLAN Infrastructure
Cracking (WEP, WPA/WPA2 personal and enterprise) Encryption
Real World Attacks (MITM , Spoofing , Honey pots, DOS etc.)
AP-less Hacking
War driving
Using Third Party Devices For Wi-Fi Pen testing (Android Phones)

And More ....

The Course is absolutely FREE !!. we are currently uploading all the course Contents at Udemy, Once we Launch our Youtube Channel we will also upload all the videos there

You can Join Our Course at Udemy From the Following Link

https://www.udemy.com/wireless-hacking-and-penetration-testing/

If you like our course Videos, Kindly tweet about it or share it with your friends via Face book and other social networking sites