SEC-SEE

How to generate malicious network traffic and help security teams to evaluate security controls and network visibility

2018-02-24T15:24:00.002+02:00

See below some open source tools and frameworks

https://github.com/alphasoc/flightsim

https://www.kitploit.com/2018/02/aptsimulator-toolset-to-make-system.html

More docker security tools to review

2017-08-01T05:43:00.000+03:00

Takenfrom the the morning paper :

https://blog.acolyer.org/2017/04/03/a-study-of-security-vulnerabilities-on-docker-hub/

Tools

Docker’s Security Scanning Service (for private repository customers)
Clair
Banyan collector
OpenSCAP
Twistlock

To this list we can also add the following (and maybe others I’m not aware of or have forgotten too):

Anchore
Tenable
Aqua (formerly Scalock)

See also Docker’s ‘Benchmark for Security‘ recommendations. Be careful out there!

dockerscan - Docker Security Analysis and Hacking Tools

2017-06-01T22:25:00.000+03:00

Interesting tool to test ( from KitPloit - PenTest Tools!)

dockerscan - Docker Security Analysis and Hacking Tools

10:57 AM | POST SPONSORED BY FARADAYSEC | MULTIUSER PENTEST ENVIRONMENT LYDECKER BLACK

What's dockerscan

A Docker analysis tools

Very quick install

> python3.5 -m pip install -U pip
> python3.5 -m pip install dockerscan

Show options:

> dockerscan -h

Available actions
Currently Docker Scan support these actions:

Scan: Scan a network trying to locate Docker Registries
Registry
- Delete: Delete remote image / tag
- Info: Show info from remote registry
- Push: Push an image (like Docker client)
- Upload: Upload a random file
Image
- Analyze: Looking for sensitive information in a Docker image.
  - Looking for passwords in environment vars.
  - Try to find any URL / IP in the environment vars.
  - Try to deduce the user used internally to run the software. This is not trivial. If the entry point is a .sh file. Read the file and try to find call to sudo-like: “sudo”, “gosu”, “sh -u”… And report the user found.
- Extract: extract a docker image
- Info: Get a image meta information
- Modify:
  - entrypoint: change the entrypoint in a docker
  - trojanize: inject a reverser shell into a docker image
  - user: change running user in a docker image

What's the difference from Clair or Docker Cloud?
The purpose of Dockerscan is different. It's foccussed in the attack phase.
Although Dockescan has some functionalities to detect vulnerabilities in Docker images and Docker registries, the objective is the attack.

Documentation
Documentation is still in progress...

For the moment we only have the slides presented at RootedCON Spain, the conference where Docker Scan was presented:
https://www.slideshare.net/secret/fxVqD2iXqanOCX

Or you can watch it in video format (recommended):

Also, you can watch a dockerscan usage demo:

Download dockerscan

Nmap 7 Realesed

2015-11-21T07:37:00.003+02:00

Nmap 7.00 comes after more than three years of development, and it's the biggest release of the open-source network discovery and security auditing software appreciated by hundreds of thousands of system administrators and security professionals around the globe. The latest release includes a great number of new features and fixes numerous issues reported by users since Nmap 6.00.

"It is the product of three and a half years of work, nearly 3200 code commits, and more than a dozen point releases since the big Nmap 6 release in May 2012. Nmap turned 18 years old in September this year and celebrates its birthday with 171 new NSE scripts, expanded IPv6 support, world-class SSL/TLS analysis, and more user-requested features than ever," reads the announcement.

Highlights of Nmap 7.00 include excellent SSL (Secure Sockets Layer) and TLS (Transport Layer Security) analysis, the addition of over 170 new NSE (Nmap Scripting Engine) scripts, better support for the next-generation IPv6 network protocol, faster synchronous network scanning, Ncat enhancements, and support for the Windows 10 and Mac OS X 10.11 El Capitan operating systems.

Download Nmap 7.00 for GNU/Linux, Mac OS X, and Microsoft Windows operating systems right now from Softpedia. New to network security? Don't hesitate to check out the project's official website for tutorials and other information regarding the Nmap software.

Wireshark 2.0 releasd

2015-11-21T07:36:00.000+02:00

After being in development for a few months, Wireshark 2.0, the world's most popular open-source network protocol analyzer software, has been released today for all supported operating systems, including GNU/Linux, Mac OS X, and Microsoft Windows.

Prominent features of Wireshark 2.0 include a revamped graphical user interface (GUI) that has been rewritten in Qt 5 and designed from the ground up to provide users with a smoother and much faster network protocol analyzing experience. The new user interface also offers a faster workflow for multiple operations.

"The Windows installer provides the option of installing either the new interface ('Wireshark') or the old interface ('Wireshark Legacy'). Both are installed by default. Note that the legacy interface will be removed in Wireshark 2.2. The OS X installer only provides the new interface. If you need the old interface you can install it via Homebrew or MacPorts," reads the announcement.

Among other new features implemented in Wireshark 2.0, we can mention the addition of multiple dialogs, such as MTP3 statistics and summary, WAP-WSP statistics, UDP multicast statistics, WLAN statistics, display filter macros, as well as capture file properties. There are also numerous bugfixes and improvements in Wireshark 2.0.

Still the world's most popular network protocol analyzer

Wireshark 2.0 is a massive release that includes numerous, hundreds of changes, so it is recommended that you read the official release notes if you're interested in every little thing that has been implemented in the application, which remains the world's most popular network protocol analyzer.

Defcon 22 ( 2015 ) Youtube Video Channel

2015-11-21T07:03:00.002+02:00

wach it here :

https://www.youtube.com/playlist?list=PL9fPq3eQfaaBCdjbKFYjosh1s1EkaYdsQ

goes without words..

Windows images for sandbox or other use

2015-06-27T08:09:00.000+03:00

Catch this quick LINK for ISO file for windows operating system for your sandbox \virtual machine installation

Exploit kit roundup - early June 2015

2015-06-06T01:10:00.000+03:00

taken from SANS internet storm center :

Introduction

Security Operation Center (SOC) analysts investigate alerts on suspicious network activity. However, these analysts might not run across exploit kit (EK) traffic that often. An organization's web gateway can stop a great deal of bad traffic before you see a full infection chain. Investigating other types of suspicious activity will likely take up the majority of an analyst's workday.

Some of us are lucky enough to review EK traffic on a routine basis. What that in mind, I want to share examples of the most common exploit kits I've noticed so far this year.

In order, the EK traffic I've seen most often in 2015 has been:

Angler
Fiesta
Nuclear
Neutrino
Magnitude
Rig

This isn't a comprehensive list. Other exploit kits are out there, but these are most common that I've seen this year. I don't have any hard numbers, and the last four (Nuclear, Neutrino, Magnitude, and Rig) are more of an educated guess for the ranking. The EK scene can evolve fairly quick. The list will likely change within a few months, and my observations are only one person's view.

Angler EK

Angler is the most common exploit kit I run across. It's also the most advanced. Angler changes URL patterns frequently, and these changes have recently happened on a near-daily basis. Angler started using "fileless" infection techniques in 2014 [1], and it now sends its payload in a fairly sophisticated encrypted manner (meaning it doesn't use a straight-forward ASCII string to XOR the payload when it's sent over HTTP). In recent months, I've had a hard time obtaining the payload from Angler EK. In the example for this diary, I wasn't able to obtain or decrypt the payload.

Previously, I've seen Angler sending some form of ransomware like the TeslaCrypt/Alpha Crypt variants [2] or CrytoWall 3.0 [3]. In the past few days, I've mainly seen Bedep and related payloads sent by Angler.

An example of Angler EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Angler EK traffic and post-infection activity on Wednesday 2015-06-03.

Fiesta EK

Fiesta is probably the next-most common exploit kit I've run across, most of it related to the BizCN actor that I described in a previous diary [4]. Other actors certainly use this exploit kit. Like Angler EK, Fiesta also uses a more sophisticated type of encryption when sending the malware payload. Fortunately, I can usually grab a copy of the payload from an infected host in my lab or decrypt the payload when necessary.

Example 1 of Fiesta EK traffic on 2015-06-03: click here for the pcap file.
Example 2 of Fiesta EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Fiesta EK traffic on Wednesday 2015-06-03.

Magnitude EK

Magnitude EK often sends several payloads, sometimes 6 or more. It's a very noisy exploit kit. I'll often see CryptoWall 3.0 as one of the payloads. In the example for this diary, Magnitude only sent one payload, and that was CryptoWall 3.0. I've usually seen Magnitude EK send the malware payloads unencrypted, at least when using IE 8 as a web browser in the vulnerable host. I don't see Magnitude now as much as I did last year.

An example of Magnitude EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Magnitude EK traffic and post-infection activity on Wednesday 2015-06-03.

Neutrino EK

In 2014, this exploit kit disappeared for about six months then came back in a much different form [5]. Traffic patterns have remained relatively unchanged since it reappeared in late 2014. Neutrino EK uses a more sophisticated style of encryption when sending the malware payload (not merely a straight-forward XOR using an ASCII string).

Neutrino's current URL patterns remind people of Sweet Orange EK; however, Sweet Orange seems to have disappeared from the scene back in February of 2015. I haven't found any Sweet Orange after February, but I've seen plenty of Neutrino since then. If you see recent traffic you think is Sweet Orange, double check it. It's probably Neutrino EK.

Neutrino has been relatively consistent over the past few months. Haven't seen a lot of it, but it's never gone away.

An example of Neutrino EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Neutrino EK traffic on Wednesday 2015-06-03.

Nuclear EK

Last year, this exploit kit seemed much more common than it is today. Operation Windigo still uses Nuclear EK [6], but in recent weeks, I've rarely seen Nuclear outside of that. Nuclear EK obfuscates its payload by XOR-ing it with an ASCII string.

An example of Nuclear EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Nuclear EK traffic and post-infection activity associated with Operation Windigo on Wednesday 2015-06-03.

Rig EK

When Rig first appeared in 2014, it looked remarkably similar to Infinity EK [7] (which was first identified as Goon EK). Rig EK apparently borrowed a great deal from Infinity. While I haven't seen Infinity this year, I've definitely run across Rig every once in a while.

In April 2015, Rig EK changed the encryption it uses for sending the malware payload. Now, it uses the same method as Nuclear EK, obfuscating its payload by XOR-ing it with an ASCII string [8].

An example of Rig EK traffic on 2015-06-03: click here for the pcap file.

Shown above: Rig EK traffic on Wednesday 2015-06-03.

Final words

As mentioned earlier, this is merely one person's view into the current state of exploit kits. It's not comprehensive, and there are other exploit kits I don't have visibility on. Here's a list of pcap files from the previous paragraphs:

I've also collected the exploits and malware payloads where I could. A zip file with this collection is available at:

http://malware-traffic-analysis.net/2015/06/03/2015-06-03-malware-samples.zip

The zip file is password-protected with the standard password. If you don't know it, email admin@malware-traffic-analysis.net and ask.

---
Brad Duncan
ISC Handler and Security Researcher at Rackspace
Blog: www.malware-traffic-analysis.net - Twitter: @malware_traffic

References:

[1] http://malware.dontneedcoffee.com/2014/08/angler-ek-now-capable-of-fileless.html
[2] https://isc.sans.edu/diary/Angler+exploit+kit+pushes+new+variant+of+ransomware/19681
[3] https://isc.sans.edu/diary/Angler+exploit+kit+pushing+CryptoWall+30/19737
[4] https://isc.sans.edu/diary/Actor+using+Fiesta+exploit+kit/19631
[5] https://isc.sans.edu/diary/Exploit+Kit+Evolution+Neutrino/19283
[6] http://www.rackspace.com/blog/in-2015-operation-windigo-is-still-going-strong/
[7] http://www.kahusecurity.com/2014/rig-exploit-pack/
[8] http://malware-traffic-analysis.net/2015/05/06/index2.html

Nmap 6.49BETA1 released

2015-06-06T01:02:00.001+03:00

Fyodor has announced the release of Nmap 6.49BETA1.This version will have hundreds of improvement, including:

Integrated all of the latest OS detection and version/service detection submissions (including IPv6)
Infrastructure improvements: an official bug tracker
Added options --data and --data-string to send custom payloads in scan packet data.
25 new NSE scripts (total is now 494):

o bacnet-info gets device information from SCADA/ICS devices via BACnet (Building Automation and Control Networks)

  o   docker-version detects and fingerprints Docker
  o   enip-info gets device information from SCADA/ICS devices via EtherNet/IP
  o   fcrdns performs a Forward-confirmed Reverse DNS lookup and reports anomalous results
o   http-avaya-ipoffice-users enumerates users in Avaya IP Office 7.x systems.
o   http-cisco-anyconnect gets version and tunnel information from Cisco SSL VPNs
o   http-crossdomainxml detects overly permissive crossdomain policies and finds trusted domain names available for purchase
o   http-shellshock detects web applications vulnerable to Shellshock (CVE-2014-6271).
o   http-vuln-cve2006-3392 exploits a file disclosure vulnerability in Webmin.
o   http-vuln-cve2014-2126, http-vuln-cve2014-2127, http-vuln-cve2014-2128 and http-vuln-cve2014-2129 detect specific vulnerabilities in Cisco AnyConnect SSL VPNs
  o   http-vuln-cve2015-1427 detects Elasticsearch servers vulnerable to remote code execution.
  o   http-vuln-cve2015-1635 detects Microsoft Windows systems vulnerable to MS15-034
  o   http-vuln-misfortune-cookie detects the "Misfortune Cookie"    vulnerability in Allegro RomPager 4.07, commonly used in SOHO routers for TR-069 access.
o   http-wordpress-plugins was renamed http-wordpress-enum and extended to enumerate both plugins and themes of Wordpress installations and their versions. http-wordpress-enum is now http-wordpress-users.
o   mikrotik-routeros-brute performs password auditing attacks against Mikrotik's RouterOS API.
o   omron-info gets device information from Omron PLCs via the FINS service.
o   s7-info gets device information from Siemens PLCs via the S7 service, tunneled over ISO-TSAP on TCP port 102.
o   snmp-info gets the enterprise number and other information from the snmpEngineID in an SNMPv3 response packet.
o   ssl-ccs-injection detects whether a server is vulnerable to the SSL/TLS CCS Injection vulnerability (CVE-2014-0224)
o   ssl-poodle detects the POODLE bug in SSLv3 (CVE-2014-3566)
o   supermicro-ipmi-conf exploits Supermicro IPMI/BMC controllers.
o   targets-ipv6-map4to6 generates target IPv6 addresses which correspond to IPv4 addresses mapped within a particular IPv6 subnet.
o   targets-ipv6-wordlist generates target IPv6 addresses from a wordlist made of hexadecimal characters

Microsoft Plans to Add Secure Shell (SSH) to Windows

2015-06-04T17:38:00.001+03:00

Until now Unix and Linux system administrators have to download a third-party SSH client software like Putty on their Windows machines to securely manage their machines and servers remotely through Secure Shell protocol or Shell Session (better known as SSH).

This might have always been an awkward feature of Windows platform, as it lacks both – a native SSH client software for connecting to Linux machines, and an SSH server to support inbound connections from Linux machines. But…

Believe it or not:

You don't need to deal with any third-party SSH client now, as Microsoft is working on supporting OpenSSH.

- See more at: http://thehackernews.com/2015/06/windows-secure-shell.html#sthash.40ZCfuy1.dpuf

Yes, Microsoft has finally decided to bring OpenSSH client and server to Windows.

The PowerShell team at Microsoft has announced that the company is going to support and contribute to OpenSSH community in an effort to deliver better SSH support in the PowerShell and Windows SSH software solutions.

So, the upcoming version of Windows PowerShell – the command-line shell and scripting language – will allow users to manage Windows and Linux computers through SSH

For those who are unaware, SSH is basically designed to offer the best security when accessing another computer remotely. It not only encrypts the remote session, but also provides better authentication facilities, with features like secure file transferring and network port forwarding.

This is not first time Microsoft has planned to adopt SSH for its Windows platform, the company had tried to allow the secure shell protocol to be used within Windows twice but was unable to implement it.

However, developers who are eager to use this new functionality in PowerShell still have to wait for some time, as the project is still in the early planning phase. So far, there isn’t any definite release date.

The PowerShell team will update more information on when users can expect SSH support shortly.

Ransomware Response Kit

2015-05-26T07:42:00.000+03:00

A security researcher has made a ransomware removal kit available online with the hope that it will help security professionals and system administrators alike in responding to instances of ransomware infection.

Researcher Jada Cyrus has published the kit on Atlassian Bitbucket. The kit itself consists of removal tools for common ransomware variants, as well as guides on how to perform the necessary removal tasks.

download from here

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable

2015-04-26T06:43:00.001+03:00

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple’s App Store via man-in-the-middle (MITM) attacks.

AFNetworking is a popular open-source code library that lets developers drop networking capabilities into their iOS and OS X products. But, it fails to check the domain name for which the SSL certificate has been issued.

Any Apple iOS application that uses AFNetworking version prior to the latest version 2.5.3 may be vulnerable to the flaw that could allow hackers to steal or tamper data, even if the app protected by the SSL (secure sockets layer)

protocol

online application check tool as scanned by SourceDna code scanning start-up vendor .

MS15-034 - Vulnerability in HTTP.sys Could Allow Remote Code Execution Nmap script check

2015-04-22T14:04:00.001+03:00

http://seclists.org/nmap-dev/2015/q2/37

add the below text to a .nse file and add in to nmap plugin folder

usage example included in the code

FYI

local shortport = require "shortport"

local http = require "http"

local stdnse = require "stdnse"

local string = require "string"

local vulns = require "vulns"

description = [[

Checks for a remote code execution vulnerability (MS15-034) in Microsoft Windows systems (CVE2015-2015-1635).

The script sends a specially crafted HTTP request with no impact on the system to detect this vulnerability.

The affected versions are Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1,

and Windows Server 2012 R2.

References:

* https://technet.microsoft.com/library/security/MS15-034

]]

---

-- @usage nmap -sV --script vuln <target>

-- @usage nmap -p80 --script http-vuln-cve2015-1635.nse <target>

-- @usage nmap -sV --script http-vuln-cve2015-1635 --script-args uri='/anotheruri/' <target>

-- @output

-- PORT STATE SERVICE REASON

-- 80/tcp open http syn-ack

-- | http-vuln-cve2015-1635:

-- | VULNERABLE:

-- | Remote Code Execution in HTTP.sys (MS15-034)

-- | State: VULNERABLE (Exploitable)

-- | IDs: CVE:CVE-2015-1635

-- | A remote code execution vulnerability exists in the HTTP protocol stack (HTTP.sys) that is

-- | caused when HTTP.sys improperly parses specially crafted HTTP requests. An attacker who

-- | successfully exploited this vulnerability could execute arbitrary code in the context of the System account.

-- |

-- | Disclosure date: 2015-04-14

-- | References:

-- | https://technet.microsoft.com/en-us/library/security/ms15-034.aspx

-- |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1635

-- @args http-vuln-cve2015-1635.uri URI to use in request. Default: /

---

author = {"Kl0nEz", "Paulino <calderon()websec.mx>"}

license = "Same as Nmap--See http://nmap.org/book/man-legal.html"

categories = {"vuln", "safe"}

portrule = shortport.http

action = function(host, port)

local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or "/"

local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)

local vuln = {

title = 'Remote Code Execution in HTTP.sys (MS15-034)',

state = vulns.STATE.NOT_VULN,

description = [[

A remote code execution vulnerability exists in the HTTP protocol stack (HTTP.sys) that is

caused when HTTP.sys improperly parses specially crafted HTTP requests. An attacker who

successfully exploited this vulnerability could execute arbitrary code in the context of the System account.

]],

IDS = {CVE = 'CVE-2015-1635'},

references = {

'https://technet.microsoft.com/en-us/library/security/ms15-034.aspx'

dates = {

disclosure = {year = '2015', month = '04', day = '14'},

}

local options = {header={}}

options['header']['Host'] = stdnse.generate_random_string(8)

options['header']['Range'] = "bytes=0-18446744073709551615"

local response = http.get(host, port, uri, options)

if response.body then

local title = string.match(response.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>([^<]*)</[Tt][Ii][Tt][Ll][Ee]>")

if title == "Requested Range Not Satisfiable" then

vuln.state = vulns.STATE.EXPLOIT

end

return vuln_report:make_output(vuln)

end

Some PRISM post mortal conclusions

2013-09-06T21:09:00.001+03:00

Following the understanding of NSA ways of intercepting our digital communication, and the shutting down of services like LavaBit email encryption services,here our some quick conclusions

Never trust a third party in holding your encryption keys ,so if Google will start encrypt your email on their hard disks (like they recently published ) , they will still hold the keys and some day will hand them to the NSA or another agencies.
try to use open source as much as we can ,you don't know what or when a commercial company will put a backdoor for NSA or alike.
make our "followers " life harder using software and services like: GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit

OSFOOLER - an upcoming tool for OS fingerprinting evasion

2013-07-13T00:33:00.001+03:00

Using commercial tools to secure your network is recommended, but it is necessary to be one step further to keep the system secure. With this technique you can give that step in order defend your servers against the first phase of all attacks Fingerprinting. This is done by intercepting all traffic that your box is sending in order to camouflage and modify in real time the flags in TCP/IP packets that discover your system.

This tool is a practical approach for detecting and defeating:

Active remote OS fingerprinting: like Nmap or Xprobe
Passive remote OS fingeprinting: like p0f or pfsense
Commercial engines like Sourcefire's FireSiGHT OS fingerprinting

Some features are:

No need for kernel modification or patches
Highly portable
Will emulate any OS
Capable of handling nmap and p0f fingerprint database (beta phase)
Transparent for the user
Undetectable for the attacker
Available for your Linux laptop, server and mobile device

Sorry guys, remote OS fingerprinting is over...

tools that anonymous uses and more..

2013-04-22T08:12:00.000+03:00

TOOLZ VERIFIED BY N4M3LE55 CR3W
--------------------------------------
Our j.s. l.o.i.c
http://goo.gl/90uxY
JS LOIC
http://goo.gl/VGK6c
http://goo.gl/eb9jR
http://goo.gl/uV9VZ
http://goo.gl/3MAz3
Any Password is 123123
**AnonGun : https://rapidshare.com/files/1746996499/anonguns__1_.rar
**HOIC : http://www.mediafire.com/?5su5vuj90cirm4p
**LOIC : http://sourceforge.net/projects/loic/
**Ddos notepad : http://www.mediafire.com/?76advu6rdckmuyv
**LOWC : http://www.lowc.do.am/script.html
**hoic : http://www.4shared.com/folder/HIoc7FE4/_online.html
**ByteDOS V3.2 : http://www.mediafire.com/?pxv4pbxjg3a2vqa
**Loic : http://www.mediafire.com/?4exm4kghdcz316u
**Hoic V2.1 : http://www.mediafire.com/?ddp9d5znwmgsasr
**Turbinas V1.0 : http://www.mediafire.com/?wo4sh527nf7wais
**Slowloris : http://www.mediafire.com/?6wbee516qfx6zok
**SYN Flood DOS : http://www.mediafire.com/?ja4x2odlxn7xcq3
**CYBERGHOST : http://cyberghost-classic-vpn.softonic.com/
**Tunnelbear 1.0 : http://tunnelbear.softonic.com/
**HOIC : http://www40.zippyshare.com/v/22430419/file.html
**ByteDos : http://www40.zippyshare.com/v/79297507/file.html
**Jays Booter : http://www40.zippyshare.com/v/76913295/file.html
**HTTPFlooder : http://www40.zippyshare.com/v/57080337/file.html
**HULK DDoSser : http://www.mediafire.com/?tb7d9t203v7twdy
**TORSHAMMER : http://pastebin.com/Vq90V9yn
**AnonymousDoSer : http://www.mediafire.com/?cth0qrycw4segok
**ByteDOS v3.2 : http://www.mediafire.com/?cv3cdj5n5zsxzad
**R.U.D.Y : http://hybridsec.com/resource.html
**OWASP HTTP Tool: http://bit.ly/i0N6AY
**LOIC: http://sourceforge.net/projects/loic/
**HOIC: http://www.mediafire.com/? t1kejryfrtc8sqs
**HOIC Torrent: http://bit.ly/LdAeDc
**HOIC Booster Pack: http://pastebin.com/K13k40hC
**Booster Guide: http://pastebin.com/5ZCcJ71u
**Booster with Apache Exploit: pastebin.com/tca6fb49
**Webhive with directions: http://pastebin.com/q8eBqitn
**XerXes STRONG DDoSser : http://pastebin.com/aWZMbjSU
**FireFlood : http://www.2shared.com/file/2CGUUHtB/Fireflood_12.html
**Anonymous DoSer : http://www.2shared.com/file/UOZbt7I0/Anonymous_DoSer.html
**Denial-of-service attack & Deface Programs : http://www.mediafire.com/?3j9lp4avc1tjplt
**R-U-Dead-Yet : http://packetstormsecurity.org/files/95882/R-U-Dead-Yet-Denial-Of-Service-Tool.html
**LOIC 1.0.7.42 : http://www20.zippyshare.com/v/36755757/file.html
**LOIC 1.1.1.25 : http://www40.zippyshare.com/v/1539355/file.html
----------------------
OTHER TOOLZ AND LINKS
----------------------
**Backtrack 5 : http://www.backtrack-linux.org/downloads/
**Net Tools : http://users.telenet.be/ahmadi/nettools.htm
**Hash Cracker : http://www.hash-cracker.com/
**Cloud Cracker : www.cloudcracker.net/
**Hash Checker : http://www.hashchecker.de/find.html
**AnonDEF : http://www.mediafire.com/?y772aargktqal8h
**Ethical Hacking Forum : http://www.dl4hacks.net/
**Cythisia Botnet v2 : http://www.mediafire.com/?ude4m1f00j9654p
**SumRando : https://www.sumrando.com/
**Real Hide IP : http://www.mediafire.com/?o454kp9q44d9h0w
**Hotspot Shield : http://hotspotshield.com/
**Expat Shield : http://expatshield.com/
**SecurityKISS : http://www.securitykiss.com/
**CyberGhost : http://cyberghostvpn.com/
**Hack Clarify : http://www.hackclarify.blogspot.com/
**Pack Del Hacker V.1.0 : http://www.mediafire.com/?bacx2g8w5ciy53b
**Windows_DNS_ATTACK_TOOL : http://www.4shared.com/folder/Z8j1fcmx/Windows_DNS_ATTACK_TOOL.html
**CpanelBruteReiluke : http://www.4shared.com/rar/mCX9cUj8/CpanelBruteReiluke.html
**CyberShark : http://www.4shared.com/rar/-KWbHT6Z/CyberShark.html
**EmailScraperWizardv06b : http://www.4shared.com/rar/37fAEEk2/EmailScraperWizardv06b.html
**Gmail_Hacker : http://www.4shared.com/rar/HVPWkugE/Gmail_Hacker.html
**firefox password stealer : http://www.4shared.com/rar/mc6O2CeP/firefox_password_stealer.html
**ICQ Steal0r : http://www.4shared.com/rar/VEKkKGMx/ICQ_Steal0r.html
**IP Port Scanner : http://www.4shared.com/file/tSUugyaD/IP_Port_Scanner.html
**IP Scanner : http://www.4shared.com/file/LCRDLMmb/IPScanner.html
**spoofer-linux-0.8.tar.gz : http://www.4shared.com/archive/6SrD1gYi/spoofer-linux-08tar.html
**Sql Poison v1.0 - The Exploit Scanner.rar : http://www.4shared.com/rar/5rmyxFFr/Sql_Poison_v10_-_The_Exploit_S.html
**Codesoft PW Stealer 0.50 : http://www.4shared.com/rar/7tKO7hEn/Codesoft_PW_Stealer_050.html
**DHCP_IP_Forcer : http://www.4shared.com/rar/FatXftW_/DHCP_IP_Forcer.html
**EasyLogger2.1 : http://www.4shared.com/rar/ugM6KMI3/EasyLogger21_Public.html
**Fast_Yahoo!_ID_Controller : http://www.4shared.com/rar/3VOV8eUD/Fast_Yahoo_ID_Controller.html
**HSS-2.78-install-hss-417 : http://www.4shared.com/file/9RC339FS/HSS-278-install-hss-417-condui.html
**Pro Facebook Hack v 2.0 By Anonymouse : http://www.4shared.com/rar/cWC7jXWG/Pro_Facebook_Hack_v_20_By_Anon.html
**WinRAR Full Version : http://www.4shared.com/zip/U_gKAYk1/WinRAR_Full_Version.html
**Worm Creator : http://www.4shared.com/rar/I_DKX36k/Worm_Creator.html
**firefox password stealer : http://www.4shared.com/rar/aBe1gFpa/firefox_password_stealer_-_ste.html
**hackbase steam phisher 1.2 : http://www.4shared.com/rar/RYesyUM0/hackbase_steam_phisher_12_beta.html
**(over 100 more tools are on here https://www.dropbox.com/sh/d8df3ry31ijbqkf/PZBrMBFkKT )**
WE ARE #N4M3LE55 CR3W 2.0
Expect US!
https://www.facebook.com/TheN4m3le55Cr3w
n4m3le55cr3w@hush.ai

Obama's visit to Israel leads to Another DDoS campaign against Israel sites

2013-03-22T13:33:00.002+02:00

22.03.2013 -president Obama first visit to Israel leads to an call to attack and take down Israelis sites ,mainly banks.

When investigating the Israel's bank attack:

The attackers communicates on twitter .

They publish links that instruct what site to attack

They are using an DDOS attack which include a special application for SYN FLOOD or ICMP FLOOD on port 80,443

So if you are working for an Israelis vendor ,you should be looking for large sync tcp packets or icmp packets traffic on port 80 or 443

I will keep watching the osint chennels ....

here are some recent details :

The tool they recommend to use :

Twitter communication and instructions

Site attacking instructions:

Online tool

Pcap finger print of the SYN PACKET

security tools tracking site -FYI

2013-03-11T10:26:00.000+02:00

.A nice site that follows new security tools

http://www.toolswatch.org

Online free security school

2013-01-28T23:13:00.001+02:00

On my endless search for new InfoSec ideas , I have stumbled upon the Open security training web site.

With tons of recorded lectures on various InfoSec topics.

I am going try one of their online free online courses. Will let you know….

Check it out:

http://opensecuritytraining.info/Welcome.html

YouTube page with all their lectures.

http://www.youtube.com/user/OpenSecurityTraining?feature=watch

Centralized Management of Java SE Environment Using GPO (Redux)

2013-01-14T06:05:00.000+02:00

Taken from darkoperator blog:

My Adventures helping a friend secure his Java environment where fun, in my original blog post I used GPO to reduce the risk in his environment by crudely pushing a configuration file to his environment. After 24 hours the fun started because we got insight from the support team, developer and users and came with a game plan.

The requirements:

Solution must provide the ability to configure Java 7 and Java 6.
Users must still be able to look at the settings in the Java control panel so they can relay information to helpdesk for troubleshooting.
The configuration files must be in a place where the can be replicated to Domain Controllers in other locations.
Solution must work on Windows Versions 5.x and 6.x
Policy Should only apply and create the files for machines with Java installed.
Policy should be robust enough to adapt is Java 6 or 7 are installed on the target in the case a computer is moved from one OU (Organizational Unit) to another.

Thankfully we worked and came with a much simple and easier to manage solution that made everyone happy (And me never volunteering to help).

Creating WMI Filter

When it comes to applying Group Policy Objects I find that WMI filters is one of the best ways to determining to what machines to apply a policy and to witch not. We start by creating 2 WMI filters one for Java 6 and another for Java 7. We first go in to Group Policy Management Console, and go in to WMI Filters:

We Right-Click on it and select New

We give it a name of Java SE 7 is Installed and a description of “For Policies that will only apply for hosts running Java SE 7” and we Click on Add to include our WMI WQL Query and we add the query

Select * From win32_Directory where (name="c:\\Program Files\\Java\\jre7" or name="c:\\Program Files (x86)\\Java\\jre7")

This WMI Query will look for bot X64 and X86 locations of the JRE7 Folder on the System and if found it will apply the policy.

We click on Save to save the query.

We would do the same for Java SE 6 if we want to cover it.

Creating Policy Files

Next we create policy files for Java in our domains \\FQDN\SYSVOL\FQDN\JavaPolicy folder where FQDN is the full path of your domain name. In my example I will create to folders one called JRE7Strict that will have restrictive settings and another called JRE7Block that will have the files to block Java on all web browsers.:

In Jave SE a deployment.config file is used for specifying the System-Level deployment.properties for use by all users of the system and it is located in %windir%\Sun\Java\Deployment\deployment.config. By default no deployment.config or folder structure exists. The deployment.config file needs the option of deployment.system.config and it can point to a URL(HTTP or HTTPS) or a File Path that points to the deployment.properties to load, to ensure that the properties file in the user %APDATA% location is not loaded we set the deployment.system.config.mandatory option with a value of true. Our config file for the restricted settings would be:

deployment.system.config=file\://acmelabs.com/SYSVOL/acmelabs.com/JavaPolicy/JRE7Strict/deployment.properties
deployment.system.config.mandatory=true

and we would place the file in the JRE7Strict folder and we would create our Properties file with the options we want and to lock the options so they still show in the control panel but would be greyed out so they can not be modified we would also add a .locked line. A sample restricted properties file would look like:


deployment.security.level=VERY_HIGH
deployment.security.level.locked
deployment.security.askgrantdialog.notinca=false
deployment.security.askgrantdialog.notinca.locked
deployment.security.notinca.warning=true
deployment.security.notinca.warning.locked

In the example I set the Security Level to Very High and locked it as well as other options. As domain admins we would save the files in the folder:

for a policy that would block Java on all the web browser we would only add to the properties file:

deployment.webjava.enabled=false
deployment.webjava.enabled.locked

Creating the Policy

The use of the centralized files it makes creating a policy file it is more simple. We just create a new GPO and we start by setting the creation of the folder where the config file will be placed so in the Policy we would go in toComputer Configuration –> Preferences –> Windows Settings –> Folders:

We create a new entry for the creation of the folder %WinDir%\Sun\Java\Deployment

Now we can create an entry for copying the config file to the folde we go to Computer Configuration –> Preferences –> Windows Settings –> Files:

We now create a new file policy and set it to replace so updating only takes modifying the file it self we set the Action to Replace so when the file is updated it will be sent to all the machines in the domain when they update their policy, we set the Source to \\FQDN\SYSVOL\FQDN\JavaPolicy\JRE7Strict\deployment.config and the Destination to%windir%\Sun\Java\Deployment\deployment.config:

Before we link the policy to any OU we must set the WMI filter we created so it will only create the folder and file on machines running the correct version of JRE

Once it is done we can link it to the OU we want the policy to apply to. Once a hosts update it’s policy via schedule or it is forced.

If you are running a Windows 2012 DC I recommend you go in to the Starter GPO’s and have the 2012 DC create them if they have not yet, if they have been already created and they where in a Windows 2008 or Windows 2008 R2 back the Starter GPOs, Delete the starter GPO folder from \\FQDN\SYSVOL\FQDN\, go back to the Group Policy Management Console on Windows 2012 and have it generate them, you should have 2 additional GPO templates for Firewall and Management configuration. From PowerShell (Had to sneak some PowerShell in ) run:

New-GPO –Name "Configure firewall rules for remote gpupdate" –StarterGpoName "Group Policy Remote Update Firewall Ports" | New-GPLink –target "dc=acmelabs,dc=com" –LinkEnabled yes

This will create a New Group Policy and link it to the Domain (Make sure you modify the DC values to the ones of your domain) that will allow you to force GPO updates against the host in the domain once the policy is applied.

To force a update of the policy from your Windows 2012 DC run Invoke-GPUpdate against the machines you want to update, in this example I’m running it against the HR OU where my test VM’s are in my lab:

  Get-ADComputer –filter * -Searchbase "ou=HR, dc=acmelabs,dc=com" | foreach{ Invoke-GPUpdate –computer $_.name -force}

Once the policy has been updated we can just open the Java Control Panel and confirm the options have been set and that they are greyed out.

If the user tries to load a self-signed applet or one not in your trusted signature file he will get:

If the Applet is validly signed he will get a popup giving him a warning and allowing him to run run the applet:

This method can be used to set other policies like the path for the trusted signatures and PKI files plus settings. So make sure your applets are properly signed with valid certificate and modify your trusted CA file to only trust your vendor to reduce the risk of the attacker using a valid provider or even better use your own CA and signed your applets with your own cert.

For Java 7 properties reference usehttp://docs.oracle.com/javase/7/docs/technotes/guides/deployment/deployment-guide/properties.html

For Java 6 properties reference usehttp://docs.oracle.com/javase/6/docs/technotes/guides/deployment/deployment-guide/properties.html

Hope you find this useful and allow you to secure your Java environment in Windows.

Security predictions for 2013

2013-01-04T22:45:00.000+02:00

taken from: http://hackmageddon.com:

The period between November and December is particularly interesting for the Infosec community, since nearly all the main security vendors use to unveil their predictions for the next year, trying to anticipate the trends and the issues that will trouble the system administrators’ sleeps.

Exactly as I did last year, I analyzed the predictions of 7 vendors, choosing the ones that I consider particularly meaningful for the presence of the vendor in the market and for the coverage of their respective solution portfolio. In comparison with the last year, I was not able to find any prediction from Cisco (at least so far). However I was able to include the ones issued by Symantec, that were missing from my initial version. Hence the list of the vendors taken into consideration is the following:

Nearly all the analyzed vendors went through deep transformations during the past year, reflecting the changing trends in the market. Fortinet is considered a vendor focused on UTM Technologies, although it offers a wide portfolio of solutions ranging from endpoint to WAFs. After the acquisition of Astaro, Sophos is expanding its offering from the endpoints to the UTM segment. McAfee covers a wide area: historically focused on the endpoints, the long trail of acquisitions allows the company to be present in all the segments of the security market. Websense went through its historical flagship, the URL filtering, moving its security model to the endpoint. Symantec and Trend Micro have their foundation on the endpoints, but are more and more concentrated on securing the cloud. Kaspersky is still concentrated on the endpoints, although the company has been very active in the last year in the analysis of the cyberwar events, most of all in Middle East.

Yes, the rise of the malware on mobile platforms seems unstoppable, not only it reached unprecedented levels in 2012, but apparently it will be the protagonist even for 2013, at least for 5 vendors on 7. Indeed the vendors are 6 if one considers also the cross-platform malware which is equally a threat for mobile platforms. Furthermore one vendor (Fortinet), considers the role of mobile threats also as a threat vector for APTs in 2013.

Politically motivated attacks rank at number 2, even if with different connotations: Kaspersky and Websense mention explicitly state-sponsored attacks, while Symantec and Trend Micro include also attacks motivated by hacktivism in this category. It is not a coincidence that Kaspersky and Websense include Hacktivism into an explicit prediction.

It is also interesting to notice the ransomware at number 3 with just 3 preferences. Particularly interesting the indication of Sophos that speaks of “Irreversible” malware, since this class of threats is increasingly using encryption to make the compromised content unrecoverable.

The trend is even more visible from the distribution chart, that also emphasizes the role of the cloud, in the double shape of source and target of the cyber attacks.

Two vendors (McAfee and Trend Micro) include the proliferation of embedded systems (for instance Smart TV equipped with Android) as one of the main security issues for 2013. Honestly speaking I would have expected a major impact for this threat.

Last but not least, two vendors (Kaspersky and McAfee) believe that Targeted Attacks and Signed Malware will experience a major rise in 2013.

השוואת מוצרי AV ע"י הארגון הבלתי תלוי av-comparatives.org

2012-12-17T13:00:00.000+02:00

עתיקה בערך כמו ה talk back : " רק לינוקס" בהשוואה חלונות ,היא השאלה איזה AV עדיף לשים בבית , בחברה ,בענן וכו..
כנראה שהצורך לענות על שאלה זו הצדיק יצירת גורם בילתי תלוי המבצע בדיקות סדורות ומדרג את הפירמות בקטגוריות השונות.
תתפלאו , אבל הנתונים די מפתיעים!
המידע נגיש לכולם ( ניתן להוריד דוחות) .
לעיונכם
בחרתי להציג תוצאות מיבחן "עולם אמיתי" שנערך לאחרונה. התוצאות מיוחסות לחדשים אוגוסט - נובמבר 2012
לדעתי מדובר בגרסאות ביתיות אך יש גם דוחות לcorp's
FYI

סקירת מוצרי AV לMOBILE:

אתרים מותרים לסריקה ומציאת פגיעויות

2012-11-23T20:49:00.001+02:00

כמו שדי ברור וידוע -להאקרי הכובע הלבן ( צריך למצא לזה ביטוי יותר ראוי בשפה העברית..) בכדי לסרוק או לבדוק אפשריות פריצה לאתרים , יש לקבל את רשות האתר אותו רוצים לבדוק . כמובן ש3ללא זאת הדבר יהיה עברה על החוק
למרבה הפלא - קיימים מספר אתרים המסכימים כי נחפור בקרביים שלהם למציאת פגיעויות וחלקם אף ישלמו לכם פר פגיעות..
על פי הבלוג של דן קמניסקי , איש אבטחה ידוע ומהולל , להלן שמות האתרים:

Paypal
Salesforce
Microsoft
Twitter
eBay
Adobe
Reddit
GitHub
Constant Contact
37 Signals
Zeggio
Simplify, LLC
Team Unify
Skoodat
Relaso
Modus CSR
CloudNetz
EMPTrust
Apriva

happy hunting!

HTTPS? או SMTP-טריק שהשתמש בו ראש ה CIA הפורש בעקבות הרומן

2012-11-15T08:03:00.001+02:00

טריק שהשתמש בו ראש ה CIA הפורש בעקבות הרומן...

http://www.schneier.com/blog/archives/2012/11/webmail_as_dead.html

בגדול- למניעת ייורט תעבורת SMTP (מייל) ע"י ה FBI שלו ושל המאהבת – הוא פתח חשבון GMAIL ונתן לה גם את הססמה

שניהם התכתבו על אותו מייל שנישמר ב תקיית ה DRAFT ומעולם לא נישלח.

דבר נוסף – הוא עריכת מסמך בתוך DROPBOX על אותו חשבון מ2 משתמשים

כמובן שזה מקשה על היירוט ומצריך ניטור HTTPS במקום SMTP שפחות מאובטח .

בכל מקרה זה לא עזר להם מכיוון ש"כנראה" ה FBI מקבל ססמאות לחשבונות ושאר גישות לאינדוקס "פנים" תיבה בשירותים כמו GMAIL DROPBOX YAHOO וכו...

אז ת י ז ה ר ו ...-)

SEC-SEE

How to generate malicious network traffic and help security teams to evaluate security controls and network visibility

More docker security tools to review

Tools

dockerscan - Docker Security Analysis and Hacking Tools

dockerscan - Docker Security Analysis and Hacking Tools

Nmap 7 Realesed

Wireshark 2.0 releasd

Still the world's most popular network protocol analyzer

Defcon 22 ( 2015 ) Youtube Video Channel

Windows images for sandbox or other use

Exploit kit roundup - early June 2015

Nmap 6.49BETA1 released

Microsoft Plans to Add Secure Shell (SSH) to Windows

Believe it or not:

Ransomware Response Kit

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable

MS15-034 - Vulnerability in HTTP.sys Could Allow Remote Code Execution Nmap script check

more security links and tools

Some PRISM post mortal conclusions

OSFOOLER - an upcoming tool for OS fingerprinting evasion

tools that anonymous uses and more..

Obama's visit to Israel leads to Another DDoS campaign against Israel sites

security tools tracking site -FYI

Online free security school

Centralized Management of Java SE Environment Using GPO (Redux)

Creating WMI Filter

Creating Policy Files

Creating the Policy

Security predictions for 2013

השוואת מוצרי AV ע"י הארגון הבלתי תלוי av-comparatives.org

אתרים מותרים לסריקה ומציאת פגיעויות

HTTPS? או SMTP-טריק שהשתמש בו ראש ה CIA הפורש בעקבות הרומן