Skip to content

2024

  • 3 min read
Draft

SQLi Penetration Testing

Introduction to the SQLi

SQL Injection (SQLi) is an attack that allows execution of arbitrary SQL queries on a database through a vulnerable web application. Imagine a nightclub where the bouncer's job is to verify the age of each guest to ensure they're over 21. Instead of checking IDs properly, the bouncer just glances at whatever is shown and lets everyone in, assuming it's valid. This lack of scrutiny allows individuals who are underage and/or have fake IDs to enter the club, potentially causing trouble.

In the case of SQL injection, the web application (bouncer) is supposed to validate and sanitize user inputs (IDs) to ensure only safe and legitimate queries (guests) interact with the database (club). However, if the application fails to properly check and sanitize these inputs, malicious actors (underage individuals) can inject harmful SQL code (fake IDs) into the query, gaining unauthorized access to sensitive data (entering the club) and potentially causing damage.

laxBouncer-chacho

This walkthrough demonstrates using SQLMap to exploit a vulnerable URL parameter on a MySQL-based website. Steps include confirming the vulnerability, enumerating databases, and extracting data from the "wordpress" database. The scenario highlights the impact of SQLi vulnerabilities, such as unauthorized data access, and concludes with preparing a pentest report to document findings and recommendations.

SQLMap: SQLi Scenario
Step 1: Identify the Target

Assess the security of a website, http://example.com. The target URL is http://example.com/products.php?id=1.

Step 2: Initial Reconnaissance

Use basic browser testing and tools like Burp Suite to determine if the id parameter in the URL might be vulnerable to SQL injection.

Step 3: Running SQLMap for SQL Injection

Use SQLMap to test and exploit the SQL injection vulnerability.

sqlmap -u "http://example.com/products.php?id=1" --dbms=mysql --batch --banner
Command Explanation
  • -u "http://example.com/products.php?id=1": Specifies the URL with the potential SQL injection point.
  • --dbms=mysql: Forces the backend database type to MySQL.
  • --batch: Runs in non-interactive mode, using default options.
  • --banner: Retrieves the database server's banner to confirm the database type and version.
  • 4 min read
Draft

Understanding SSH Tunneling and Redirection

tunneling-chacho

Introduction

In penetration testing, gaining access to internal network resources often requires advanced techniques to bypass firewalls, NAT devices, and other security measures. SSH tunneling and redirection are powerful methods that allow penetration testers to navigate these obstacles. This article will explain these concepts, their real-world applications, and provide practical examples.

What is SSH Tunneling?

SSH tunneling, also known as SSH port forwarding, is a method of creating a secure, encrypted connection between a local and a remote computer through the SSH protocol. This technique can be used to forward traffic from one network port to another, effectively bypassing firewall restrictions and network segmentation.

Scenario

Imagine you are a penetration tester who has gained initial access to a target network through a compromised external server (Target1_IP). Your goal is to reach internal resources (Target2_IP and Target3_IP) and also provide a reverse connection back to your local machine for further exploitation. To achieve this, you will use an advanced SSH command that sets up multiple tunnels and optimizes connections.

The Command

ssh -o ControlMaster=yes -o ControlPath=/tmp/conn.sock -L 22222:Target2_IP:22 -L 8888:Target3_IP:80 -R 443:127.0.0.1:1234 root@Target1_IP
1. ControlMaster and ControlPath Options

-o ControlMaster=yes -o ControlPath=/tmp/conn.sock
  • 1 min read
Draft

Windows Privilege Escalation: Movin' on Up!

privEsc-chacho

Previously, I wrote a bit about the process of kerberoasting and utilizing Bloodhound and other tools for Windows penetration testing. Because those topics are covered elsewhere, this one will cover different tools and techniques that were not in the kerberoasting post.

For this post, I am continuing an exploit that began from a XSS vulnerability and was exploited through BeEF. It picks up where the BeEf post left off with having just exploited the Windows box with a very unstable Windows shell.

Migrating Processes

The first step we want to do is get ourselves out of an unstable shell by migrating to a process owned by the user we're impersonating.

  • 5 min read
Draft

Stored XSS

Imagine a library where anyone can write in a guestbook. A stored XSS attack is like someone writing a hidden, harmful message in the guestbook that, when read, causes the reader's pen to write down their personal details on a separate sheet that the attacker can access. The readers are unaware that their information is being stolen while they are simply interacting with what they believe to be a safe guestbook.

xss-chacho

Types of XSS

There are three main types of Cross-Site Scripting (XSS) vulnerabilities:

  1. Stored XSS: Also known as persistent XSS, this type occurs when malicious script is permanently stored on the target server, such as in a database, message forum, or comment field. The script is executed every time a user accesses the affected content.

  2. Reflected XSS: This type occurs when a malicious script is reflected off a web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. It is delivered to users via another route, such as an email or a web link.

  3. DOM-Based XSS: This type occurs when the vulnerability exists in the client-side code rather than the server-side code. The payload is executed as a result of modifying the DOM environment in the victim's browser, causing client-side script to run differently.

Walkthrough Focus

The walkthrough provided is covering Stored XSS. In this scenario, the payload is injected into the Name parameter on the Contact page of the WordPress site using the "Participants Database" plugin. When this data is stored and subsequently displayed to users or administrators, the malicious script executes, demonstrating the persistent nature of stored XSS vulnerabilities.

Step 1: Initial Reconnaissance

Pick one.

with WPScan 
wpscan --url https://targetwebdomain.com --enumerate p

Skip to Step 3.

with Metasploit WordPress Scanner

Start by opening up msfconsole and finding the WordPress Scanner.

msfconsole

search wordpress scanner

wordpress-scanner-searchResults

use auxiliary/scanner/http/wordpress_scanner

set rhosts www.targetwebdomain.com

run

Skip to Step 3.

with Burp Suite

Start by running the target domain, http://targetwebdomain.com, through Burp Suite to capture and analyze the traffic.

  1. Configure Browser to Use Burp Suite Proxy:

    • Set the browser's proxy settings to route traffic through Burp Suite (typically 127.0.0.1:8080). set_proxy
    • Scope the proxy to only be for the target domain. scope_proxy
  • 3 min read

Configure NordLynx on a Unifi Dream Machine

encrypted-chacho

VPN slowing you down? OpenVPN is fantastic for privacy, but if you need speed, it's not the best protocol option. Enter WireGuard: lightweight and fast. That's why NordVPN's NordLynx is built on WireGuard; it's a game-changer. Setting up a VPN client on an edge router, like the Unifi Dream Machine, allows the entire network traffic to benefit so great - let's do that! There's only one problem: NordVPN doesn't currently provide easy config files.

The solution: Generate the configuration on a Linux machine and use those details to set up NordLynx on your router. This guide will walk you through the process by first installing NordVPN on a debian-based Linux VM (Parrot Security OS) and then using that configuration to set up NordLynx on a Unifi Dream Machine.

Install NordVPN and WireGuard on a Linux Machine

sudo apt install wireguard curl
sh <(curl%20-sSf%20https://downloads.nordcdn.com/apps/linux/install.sh)

Initiate Login to NordVPN Account 

nordvpn login
  • 20 min read

Malicious Traffic Analysis

maltraffic-chacho

The following is a combination of notes, research, and knowledge acquired from a malicious traffic analysis course. The focus of this post is on identifying malicious activity in Wireshark. For basic Wireshark setup and tips for filtering, check here.

Note: A good rule of thumb in terms of physical requirements is that whatever the pcap size is, you should have four times that amount of RAM available.

Lifecycle: Reconnaissance

This includes discovery as well as scanning for hosts, fingerprinting, sevices, and network mapping.

TTL-OS Table

When you ping an ip address, the Operating System can sometimes be surmised by the TTL value. The table below is from this maintained website.

Device / OS Version Protocol TTL
AIX TCP 60
AIX UDP 30
BSDI 3.2, 4.1 ICMP 255
Compa BSD/OS 3.1 and 4.0 ICMP 255
Cisco ICMP 64
DEC Pathworks ICMP 254
Foundry V5 TCP and UDP 30
FreeBSD 2.1R ICMP 64
FreeBSD 3.4, 4.0 TCP and UDP 64
FreeBSD 5 ICMP 255
HP-UX 9.0x ICMP 64
HP-UX 10.01 TCP and UDP 30
HP-UX 10.2 TCP and UDP 64
HP-UX 11 ICMP 255
Irix 11 ICMP 255
Irix 5.3 TCP 64
juniper 6.x TCP and UDP 60
MPE/IX (HP) 6.5.3, 6.5.8 TCP and UDP 60
Linux ICMP 255
Linux ICMP 64
Linux 2.0.x kernel ICMP 200
Linux 2.2.14 kernel ICMP 64
Linux 2.4 kernel ICMP 255
Linux Red Hat 9 ICMP 255
MacOS/MacTCP 2.0.x ICMP and TCP 64
MacOS/MacTCP X (10.5.6) TCP and UDP 60
NetBSD ICMP 255
Netgear FVG318 ICMP and UDP 64
OpenBSD 2.6 & 2.7 ICMP 255
OpenVMS 07.01.2002 ICMP 255
OS/2 TCP/IP 3.0 ICMP 64
OSF/1 V3.2A TCP 60
OSF/1 V3.2A UDP 30
Solaris 2.5.1, 2.6, 2.7, 2.8 ICMP 255
Solaris 2.8 TCP 64
Stratus TCP_OS ICMP 255
Stratus TCP_OS (14.2-) TCP and UDP 30
Stratus TCP_OS (14.3+) TCP and UDP 64
SunOS STCP ICMP/TCP/UDP 60
SunOS 4.1.3/4.1.4 TCP and UDP 60
Ultrix 5.7 ICMP and TCP 255
VMS/Multinet V4.1/V4.2A TCP 60
VMS/TCPware V4.1/V4.2A UDP 30
VMS/Wollongong V4.2 – 4.5 ICMP 255
VMS/UCX TCP and UDP 64
Windows 1.1.1.1 TCP 128
Windows 1.1.1.1 UDP 30
Windows for Workgroups TCP and UDP 128
Windows 95 TCP and UDP 32
Windows 98 ICMP 32
Windows 98, 98 SE ICMP 128
Windows 98 TCP 128
Windows NT 3.51 TCP and UDP 32
Windows NT 4.0 TCP and UDP 128
Windows NT 4.0 SP5- 32
Windows NT 4.0 SP6+ 128
Windows NT 4 WRKS SP 3, SP 6a ICMP 128
Windows NT 4 Server SP4 ICMP 128
Windows ME ICMP 128
Windows 2000 pro ICMP/TCP/UDP 128
Windows 2000 family ICMP 128
Windows Server 2003 128
Windows XP ICMP/TCP/UDP 128
Windows Vista ICMP/TCP/UDP 128
Windows 7 ICMP/TCP/UDP 128
Windows Server 2008 ICMP/TCP/UDP 128
Windows 10 ICMP/TCP/UDP 128

Display Anomalous TCP Flags

By applying the filter below, you will display packets with TCP flag combinations not included in the normal set, helping to identify potential anomalous activity.

Detect unusual TCP flag combinations: 

tcp && (!(tcp.flags == 0x02 || tcp.flags == 0x12 || tcp.flags == 0x10 || tcp.flags == 0x01 || tcp.flags == 0x04 || tcp.flags == 0x18))

  • 4 min read

nmap Cheatsheet

nmap-chacho

Default Scanning as Non-root with no Flags/Options

nmap 192.168.1.0/24 = nmap -sT 192.168.1.0/24
(noisy)

Default Scanning as Root with no Flags/Options

nmap 192.168.1.0/24 = nmap -sS 192.168.1.0/24
(quiet)

Process

The Noisy Way

When to use: When you need detailed information quickly and stealth is not a concern.
Consideration: This method generates a lot of traffic and is likely to be detected by IDS/IPS systems. 

nmap -sT -vv -oA network-topology <ip.addr/24>
Grab our list of open IPs: 
grep open network-topology.gnmap | cut -d" " -f 2 > device_list.txt
Rescan network aggressively for additional IPs at the exclusion of our open IP list: 
nmap -A --excludefile device_list.txt <ip.addr/24>
Add any additional IPs found to the list: 
echo "<IP_ADDRESS>" >> device_list.txt
Now rerun scan of the found IPs aggressively, but remove the ping as we no longer need to discover hosts: 
nmap -Pn -A -iL device_list.txt
  • 13 min read

Solving for Silicon

help-chacho

During Apple's transition to ARM architecture, there were significant challenges with VM compatibility due to the differences between ARM and x86 architectures. While ARM Assembly has been prevalent in devices like Raspberry Pis and other IoT devices, its introduction to personal computers like desktops and laptops is relatively recent. This transition prompted many cybersecurity and IT educational institutions to adapt their VM labs. To address compatibility issues, some institutions shifted from using downloadable .ISO files to web-based environments, utilizing tools like Cockpit and KVM for easier management and deployment of virtual machines. However, not all institutions have made this shift, necessitating a different solution for this student. Switching to a PC was not an option so I decided to host my VMs on a server connected to my local network.

Initially, I tried using Cockpit and KVM, but the setup didn't meet my needs. I needed something more robust—a type 1 hypervisor.

I had loved using VMWare Fusion, but the Broadcom takeover turned me away from using ESXi. The customer experience for downloading any VMWare tools/products was frustratingly difficult. Thus, ESXi was not an option. Eventually, I landed on Proxmox, an open-source type 1 hypervisor that operates similarly to ESXi but without the headaches. Below is the process for installing the system and some examples (with links to each) of the VMs I chose to add to my lab environment with their individual setups.

Installing and Setting up Proxmox VE

Step 1: Download and Flash Proxmox VE

  • 3 min read
Draft

Web Server Setup

Nginx

web-chacho

The following guide provides a walkthrough for setting up a web server on a local network using Nginx. This guide assumes you are using Ubuntu or another debian-based flavor of Linux as your operating system.

Step 1: Install Nginx

Before we start, make sure to update your package manager:

sudo apt update

Next, install Nginx:

sudo apt install nginx

Once the installation is complete, check the status of Nginx:

sudo systemctl status nginx

Ensure Nginx is running. You should see output indicating that the service is active (running).

Verify that port 80 (the default HTTP port) is open:

netstat -ant
  • 7 min read
Draft

Airgeddon: Setup & Use Walkthrough

swissarmyknife-chacho

Airgeddon is essentially a Swiss Army knife for wireless network auditing, without the risk of nicking your fingers. It's a multi-use bash script that does everything from monitoring to cracking Wi-Fi networks, offering several tools wrapped in one streamlined interface. Trusting your network security to luck is like using a paper umbrella in a hurricane— optimistic, but impractical. This post will focus on the use of Airgeddon to poke at your Wi-Fi networks and then implement more secure practices that will harden your Wi-Fi, saving the paper umbrella for a mai tai.

This covers the setup of Airgeddon in a Docker container and the usage of various plugins to enhance your wireless network testing and auditing capabilities. Ensure to follow legal and ethical guidelines while using these tools.

Git Hub Repo

Essential Tools

1. Install Docker:

Ensure Docker is installed and running on your system.

2. Optional: Create a Custom Dockerfile (if you want to customize the image):

  • Create directory 

    mkdir airgeddon-docker && cd airgeddon-docker

  • Create Dockerfile: 

    FROM kalilinux/kali-rolling

RUN apt-get update && \
    apt-get install -y git iw net-tools wireless-tools aircrack-ng reaver macchanger mdk3 gpsd kismet

RUN git clone https://github.com/v1s1t0r1sh3r3/airgeddon.git /opt/airgeddon

WORKDIR /opt/airgeddon

ENTRYPOINT ["./airgeddon.sh"]