HOWTO Using USB Devices on VirtualBox 4 1 8

Using USB devices on VirtualBox 4.1.8, which is installed on Ubuntu 12.04 LTS, is easy.



sudo usermod -a samiux -G vboxusers



*where samiux is the user name



Then, logout and re-login. Or, reboot your system.



Now, you can use USB devices on VirtualBox without any problem. However, some devices do not work properly on USB 2.0 enabled on VirtualBox.



Thats all! See you.

Read More..

HOWTO OpenVAS on Ubuntu Desktop 12 04 LTS

OpenVAS is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution.



Step 1 :



At the time of this writing, the "stable" is version 5 while the "nightly builds" is version 6.



sudo add-apt-repository ppa:openvas/stable



or



sudo add-apt-repository ppa:openvas/nightly



sudo apt-get update

sudo apt-get install openvas-scanner openvas-manager openvas-administrator greenbone-security-assistant openvas-cli openvas-check-setup gsd



sudo apt-get install xsltproc sqlite3



Step 2 :



sudo openvas-mkcert



It will generate the following :



- Certification authority:

  Certificate = /var/lib/openvas/CA/cacert.pem

  Private key = /var/lib/openvas/private/CA/cakey.pem



- OpenVAS Server :

  Certificate = /var/lib/openvas/CA/servercert.pem

  Private key = /var/lib/openvas/private/CA/serverkey.pem



To sync the Network Vulnerability Tests (NVT) feed :



sudo openvas-nvt-sync



If you are using OpenVAS 6, you also need to sync the SCAP data :



sudo openvas-scapdata-sync



After that you have to create a client certificate using the openvas-mkcert-client tool. If -n is specified the tool doesn’t ask any questions and creates a certificate for the user "om". The -i parameter installs the certificate to be used with the OpenVAS manager.



sudo openvas-mkcert-client -n om -i



Before going further, stop the following services :



sudo /etc/init.d/openvas-scanner stop

sudo /etc/init.d/openvas-manager stop

sudo /etc/init.d/openvas-administrator stop

sudo /etc/init.d/greenbone-security-assistant stop



It needs some time to fully start it, please be patient :



sudo openvassd



Migrate and rebuild the databases. It needs some time to finish :



sudo openvasmd --migrate

sudo openvasmd --rebuild



sudo killall openvassd



To start it again but wait for some seconds before doing so as it need some time to shut down for the previous command :



sudo /etc/init.d/openvas-scanner start

sudo /etc/init.d/openvas-manager start

sudo /etc/init.d/openvas-administrator restart

sudo /etc/init.d/greenbone-security-assistant restart



To create a user "admin" with the role of "Admin" :



sudo openvasad -c add_user -n admin -r Admin



You will be asked for the password. You need to use this username and password to login to the OpenVAS.



Step 3 :



Check if your setup is correct or not.



Stable builds -

sudo openvas-check-setup



or



Nightly builds -

sudo openvas-check-setup --v6



Step 4 :



To run it. Point the Firefox to :



https://localhost:9392/



Step 5 :



To update it.



sudo openvas-nvt-sync



Step 6 (Optional) :



To start it manually instead of auto-run.



Start script -

sudo -sH

nano /etc/init.d/openvas-start



Append the following to the file :



sudo /etc/init.d/openvas-scanner start

sudo /etc/init.d/openvas-manager start

sudo /etc/init.d/openvas-administrator restart

sudo /etc/init.d/greenbone-security-assistant restart



chmod +x /etc/init.d/openvas-start



Stop script -



sudo -sH

nano /etc/init.d/openvas-stop



Append the following to the file :



sudo /etc/init.d/openvas-scanner stop

sudo /etc/init.d/openvas-manager stop

sudo /etc/init.d/openvas-administrator stop

sudo /etc/init.d/greenbone-security-assistant stop



chmod +x /etc/init.d/openvas-stop



sudo update-rc.d openvas-scanner disable

sudo update-rc.d openvas-manager disable

sudo update-rc.d openvas-administrator disable

sudo update-rc.d greenbone-security-assistant disable



To start the services :



sudo /etc/init.d/openvas-start



To stop the services :



sudo /etc/init.d/openvas-stop



Thats all! See you.

Read More..

HOWTO Offical SQLMap video demonstration 2

*** Do NOT attack any computer or network without authorization or you may put into jail. ***



Credit to : Bernardo



This is Bernardos work but not mine. I re-post here for educational purpose only. It is because I enjoy his videos very much and I am afraid of losing them.



Original link is here.







Demonstration of sqlmap enumeration features with verbose output: sqlmap is launched against a PHP test page hosted on a Debian GNU/Linux 5.0 server with back-end database management system being Oracle 10.2 Enterprise Edition.



The tool is instructed to identify possible SQL injections, check if they are also exploitable via UNION query SQL injection technique, then enumerate the banner and the session users password hash(es).



The technique used to dump this data from the back-end database software is specified by the user as UNION query SQL injection. If the parameter was not affected by UNION query SQL injection, sqlmap would have fallen back to the default technique, boolean-based blind SQL injection.



Command



python sqlmap.py -u http://172.16.213.131/sqlmap/oracle/get_init.php?id=1 -b --passwords -U CU --union-use -v 2



Thats all! See you.

Read More..

HOWTO NoCloudAllowed on Kali Linux

Cloudflare is designed to protect the websites from being Denial of Service (DoS) or Distributed Denial of Service (DDoS). It is acting a proxy and the real IP address of the websites are hidden. She also acts as a Web Application Firewall (WAF) to the websites that behind her services.



However, there is a number of ways to bypass this protection. Since FTP services cannot be protected by Cloudflare, the ftp sub-domain of the websites will be disclosed by using penetration testing tool - Fierce Domain Scan (fierce.pl). There may be some other services that cannot be protected by Cloudflare too.



Another way is using NetCraft.com to find the IP address history of the websites. Why it works? It is because some websites have been published for a while before using Cloudflare service. The IP address of the websites are being archived by NetCraft.com. However, the IP address of those websites cannot be changed or the SysAdmin overlooked it.



The captioned methods had been mentioned at my previous article.



How about there is no FTP service and no IP address history at NetCraft.com? So, we are panic? Be patient! Allison Nixon found a way to overcome this problem. She did a presentation at BlackHat 2013 in the title of Denying Service to DDoS Protection Services.



She (or with her team) developed a tool - NoCloudAllowed. How it works? The tool compare a range of IP addresses with the content of the origin website in order to find the real IP address of the origin website. The tool is written in Perl.



Now, I will show you how to install it on Kali Linux.



Step 1 :



Install of String::Compare.



perl -MCPAN -e shell

install ExtUtils::MakeMaker

install String::Compare

exit



Step 2 :



Download nocloudallowed.pl.



wget http://nocloudallowed.com/nocloudallowed.pl







Type the following for “help” :



perl nocloudallowed.pl --help



Step 3 :



Refer to the BlackHat 2013 video, the website NoCloudAllowed.com is protected by Cloudflare and there is no previous IP address history at NetCraft.com.



Let’s us ping the website to see the IP address :



ping nocloudallowed.com

PING nocloudallowed.com (199.83.134.211) 56(84) bytes of data.

64 bytes from 199.83.134.211.ip.incapdns.net (199.83.134.211): icmp_req=1 ttl=128 time=818 ms

64 bytes from 199.83.134.211.ip.incapdns.net (199.83.134.211): icmp_req=2 ttl=128 time=262 ms

64 bytes from 199.83.134.211.ip.incapdns.net (199.83.134.211): icmp_req=3 ttl=128 time=274 ms

64 bytes from 199.83.134.211.ip.incapdns.net (199.83.134.211): icmp_req=4 ttl=128 time=502 ms

64 bytes from 199.83.134.211.ip.incapdns.net (199.83.134.211): icmp_req=5 ttl=128 time=264 ms

^C

--- nocloudallowed.com ping statistics ---

6 packets transmitted, 5 received, 16% packet loss, time 6209ms rtt min/avg/max/mdev = 262.464/424.601/818.947/217.222 ms



ping www.nocloudallowed.com

PING 2ruek.x.incapdns.net (103.28.248.171) 56(84) bytes of data.

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=1 ttl=128 time=1433 ms

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=2 ttl=128 time=450 ms

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=3 ttl=128 time=278 ms

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=4 ttl=128 time=472 ms

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=5 ttl=128 time=495 ms

64 bytes from 103.28.248.171.ip.incapdns.net (103.28.248.171): icmp_req=6 ttl=128 time=519 ms

^C

--- 2ruek.x.incapdns.net ping statistics ---

7 packets transmitted, 6 received, 14% packet loss, time 6009ms
rtt min/avg/max/mdev = 278.957/608.262/1433.255/377.086 ms, pipe 2



The result is that we got 2 different IP addresses - 199.83.134.211 and 103.28.248.171.



Step 4 :



There are two ways to use the nocloudallowed.pl. By "string matching" and "page percentage matching". Since the real IP address of nocloudallowed.com is 54.226.206.170, we limited the IP range from between 54.226.206.0 and 54.226.206.255 for the demo.



For realistic cases, the IP range may be from between 1.0.0.1 to 255.255.255.255. It will take a longer time to the result as predicted.



String matching :



perl nocloudallowed.pl -u http://www.nocloudallowed.com/ -i 54.226.206.0-54.226.206.255 -s @nixonnixoff



54.226.206.170 matched string



*** We select an unique string - @nixonnixoff at the front page of www.nocloudallowed.com for the matching purpose.



Page percentage matching :



perl nocloudallowed.pl -u http://www.nocloudallowed.com/ -i 54.226.206.0-54.226.206.255



54.226.206.46 is a 4.28008963583708% match 54.226.206.8 is a 4.97538454727825% match

54.226.206.96 is a 6.4580555778227% match 54.226.206.170 is a 76.6947984574021% match
54.226.206.178 is a 2.6906293003467% match 54.226.206.153 is a 13.6152088933292% match

54.226.206.196 is a 5.90278413052861% match 54.226.206.219 is a 6.97554375390092% match

54.226.206.149 is a 1.88944750445606% match 54.226.206.254 is a 3.71636207826023% match

54.226.206.252 is a 5.23038802551876% match 54.226.206.248 is a 9.19859919167773% match



The conclusion is that Cloudflare cannot protect your website as expected.



That’s all! See you.

Read More..