Setting up Free VPN in Linux

Internet security enthusiasts and penetration testers all know how critical security protocols and privacy tools are. If you browse the Internet without them, your data could easily be intercepted by governmental institutions or common hackers. The good news is that the modern miracle of encryption technologies makes it possible to protect your data, and allows you to browse the web with the peace of mind that there isn’t anyone snooping through your data. This is even better when it is a free vpn product on linux. But there are a couple problems with common VPN services, as we’ll discuss next.

Shortfalls of Commercial VPN Services

The VPN industry is actually very competitive. In fact, there are at least tens of VPN service providers, if not hundreds. And they are a great solution for end users who just want to unlock geo-restricted content or ensure that the government isn’t tracking their online activities. Furthermore, they cheap, dirt cheap. I saw one service advertising their pricing for as little as $2.08 per month. Because they’re so affordable, secure, and convenient, a lot of people are tempted to sign up for their service. But there’s a few drawbacks, as we’ll soon discover.

First of all, a user doesn’t have any control over the service. Sure, some VPN providers allow users to select which VPN algorithm or protocol at their own discretion, but some providers only allow PPTP connections (especially the free services). The problem with PPTP is that it only offers weak security, and it has been proven to be crackable. Furthermore, the end users don’t have any visibility into the VPN service providers network, and they don’t know what goes on behind the scenes. While it is pretty common for these types of providers to have no-logging policies, but even with these policies in place, many providers still make provisions in the privacy policy to reserve the right to log metadata, IP addresses, and which servers a user connects to. Also, how do we truly know that they aren’t logging any of our data?

Secondly, you also need to take great caution when selecting a VPN provider, because many of them are based in the United States. Ever since Edward Snowden blew the whistle, most people are rightfully distrustful of US-based digital services because the NSA was found to be wiretapping legitimate corporations such as Microsoft, Apple, Google, and many others in their PRISM program. Now people just don’t want to risk their data ending up on a governmental database if their VPN service is coerced into forfeiting information by the federal government.

Thirdly, you need to understand that a commercial VPN service does nothing to protect data that your are hosting at your home. For example, a lot of us geeks like to setup our own mini-networks, complete with services like a file server, NAS device, and other local services. It’s great hosting your own file server because you don’t run the risk of a data leak, infringement of privacy, or data loss. The problem is that you can’t access your home file server securely when using a commercial VPN service.

After your data reaches the VPN server, it is decrypted and sent on to your home network. This leaves data vulnerable for an entire leg of the data’s path, and when it’s unencrypted, there’s no telling who might be able to snoop through your data. The good news is that you can easily create your own VPN server using Linux…for free! If you want to, you can even route your Internet data through your home’s VPN server when your on an unsecure network, such as the Wi-Fi at an airport or coffee shop.

Prerequisites

In order to setup your own home brewed VPN server, you’re going to need a few things. First of all, you’re going to need hardware capable of running Linux. Ideally, you’d like to have a desktop computer that you can leave running for long periods of time to provide round the clock access, but you could use a desktop or other device. Secondly, you’re going to need the latest version of Ubuntu, and you’ll also need a router (but most home networks already have a SOHO wireless router). Once you’ve gathered all the resources necessary, you can proceed to use the following guide to setup up your very own VPN server. Naturally, you will want to be the root user when running through this guide.

Step 1: Setting up OpenVPN

The first thing you’ll need to do is setup OpenVPN on your Ubuntu machine. But before we do, we’ll first need to update the repository data. Start by running the following command:

apt-get update

Next, we’ll want to go ahead and install Easy-RSA and OpenVPN with the following command:

apt-get install openvpn easy-rsa

Let’s go ahead and extract the example VPN server configuration file to /etc/openvpn using the following command:

gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz > /etc/openvpn/server.conf

After the data has been extracted, you’re going to need to open up the server.conf file in your text editor of choice. I’m partial to vim, but you can use any editor you wish. Use the following command:

```
vim /etc/openvpn/server.conf
```

We’re gong to make a few changes to this file. First, we’re going to double the RSA length to increase security. Look for the line with the text “dh1024.pem” and change it to say “dh2048.pem” and then look for the line that says “ redirect-gateway def1 bypass-dhcp.” Simply uncomment this line of text. Now we need to uncomment the following two lines of code:

```
push "dhcp-option DNS 208.67.222.222"
```
```
push "dhcp-option DNS 208.67.220.220"
```

Basically, this will help prevent DNS leaks. If you want, you can use DNS servers that aren’t the OpenVPN resources. Last but not least, uncomment the lines that say “user nobody” and “group nobody.” You see, OpenVPN defaults to using the root account, but we’ll want to restrict it to the user ‘nobody’ and the group ‘nogroup.’ Be sure to save your changes as you exit vim.

Setting Up Packet Forwarding

Now we’re going to edit a sysctl setting the changes IP forwarding rules. Enable packet forwarding with the following commands:

```
echo 1 > /proc/sys/net/ipv4/ip_forward
```
```
vim /etc/sysctl.conf
```

Now we simply need to remove the number sign to uncomment another line of code. Uncomment the line that says “net.ipv4.ip_forward=1.” Yet again, save your configurations and exit the text editor.
Firewall Configuration
First things first, let’s go ahead and make ufw use SSH for better security with the following commands:

```
ufw allow ssh
```
```
ufw allow 1194/udp
```
```
vim /etc/default/ufw 
```

Now find the line that is labeled DEFAULT FORWARD POLICY. It should already be set to DROP, but we need to change it to ACCEPT. Save your changes and exit, and edit the following file:

```
vim /etc/ufw/before.rules
```

Make sure the top of your file looks the same as the following lines of code:

#   ufw-before-input
#   ufw-before-output
#   ufw-before-forward

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0] 
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

# Don't delete these required lines, otherwise there will be errors

Now, simply enable the firewall with the following command:

ufw enable

It will ask if you want to continue, so enter a ‘y’ into the terminal. It should give you confirmation that the firewall is active and running.

Step 2: Creating the Keys and Certificate

Now we need to setup the keys and CA certificate. Start by copying the Easy-RSA keys as follows:

```
cp -r /usr/share/easy-rsa/ /etc/openvpn
```
```
mkdir /etc/openvpn/easy-rsa/keys
```
```
vim /etc/openvpn/easy-rsa/vars
```

You’ll want to edit this file and enter in credentials between the quotations as they pertain to you. The file should contain the following information.

export KEY_COUNTRY="___"
export KEY_PROVINCE="___"

export KEY_CITY="___"
export KEY_ORG="___"
export KEY_EMAIL="___"
export KEY_OU="___"

Also make sure that you name the key, but for the sake of keeping things simple, we’ll just call it ‘server.’

export KEY_NAME="server"
Now run the following commands:

openssl dhparam -out /etc/openvpn/dh2048.pem 2048

```
cd /etc/openvpn/easy-rsa
```
```
. ./vars
```
```
./clean-all
```
```
./build-ca
```

Creating the Server’s Certificate
Make sure that your current working directory is still /etc/openvpn/easy-rsa, and issue the following command:

```
./build-key-server server
```

If you named your key something different than ‘server,’ you’ll need to change the command appropriately. Keep pressing enter through the prompt and make sure you leave the challenge password blank. However, near the end, it will ask if you want to sign the certificate and commit the changes. Make sure you enter ‘y’ for both prompts. Next, we’ll copy the keys into the correct directory:

cp /etc/openvpn/easy-rsa/keys/[server.crt, server.key, ca.crt] /etc/openvpn

And now it’s finally time to start the OpenVPN service. Also, you’ll want to verify that it’s actually running with the second command:

```
service openvpn start
```
```
service openvpn status
```

Step 3: Making Keys for the Clients
By now your OpenVPN server should be up and running and our server should have its own CA certificate. But now we’ll need to build and copy the keys for the clients. The files we create will need to be installed on each device that wants to connect to the VPN tunnel. Also understand that you’ll need to reiterate these steps for each additional host you connect to the VPN. You should still be in the /etc/openvpn/easy-rsa directory, so run the following command

```
./build-key client1
```

Yet again, make sure you sign the certificate and commit the changes. Now we’re going to copy the RSA template and rename it. It was originally called client.conf, but we’ll give it a name of client.ovpn.

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/keys/client.ovpn

Note that you will need to copy both the certificate and the key contained in the /etc/openvpn/easy-rsa/keys/ directory to each client device. Also, copy over the following two files:

/etc/openvpn/easy-rsa/keys/client.ovpn
/etc/openvpn/ca.crt

In summary, each client that wants to connect to the VPN needs the following four files:

client1.crt
client1.key
client.ovpn
ca.crt

Step 4: Creating a Global OpenVPN Profile

The next thing we should do is to edit the client.ovpn template to add the CA certificate as well as they key. That way only a single, unified client.ovpn profile will need to be added to the client’s OpenVPN installation. You can name it anything you want, but the name does need to be changed. Henceforth, we’ll refer to our file as example.ovpn. The first thing we need to edit within the file is near the top, and simply substitute the IP address of your VPN server in the field in bold.

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote [IP ADDRESS OF YOUR VPN SERVER] 1194
Yet again, find the lines that say ‘user nobody’ and ‘group nogroup,’ and be sure that are uncommented. Conversely, make sure the following three lines of code are commented out:
#ca ca.crt
#cert client.crt
#key client.key

Now make sure that the xml at the end of the file reads as follows, remembering to insert the names of your certificates and keys:

<ca>
(put ca.crt here)
</ca>
<cert>
(put client1.crt here)
</cert>
<key>
(put client1.key here)
</key>

Save the changes you have made and exit your editor. Congratulations, your client profile has now been configured.

Step 5: Installing the Client Profile

All that remains is to install the client profile on your operating system of choice, but this can vary greatly between different operating systems like OS X, Windows, iOS, or Android. Fortunately, OpenVPN has very detailed documentation that will show you how to install client profiles on just about any operating system you can imagine. We won’t get into the details of how to setup a client profile for every single operating system, however, since it’s a bit outside the scope of our tutorial. However, after downloading your free vpn product on linux and following the instructions on the OpenVPN site, you should be able to connect securely to your home’s VPN tunnel.

SSH for Penetration Testing

SSH stands for Secure shell and works on Port 22 . As penetration testers we are aware of the uses and power of SSH on remote access of systems . During Penetration testing SSH might come handy as a powerful tool .

This post will explain some of the techniques that can be used during a penetration test .

Local Forwarding using SSH

Sometimes we come across scenarios where we need the services on the remote host accessible to the host via Local Network . Root is required .

ssh -L 127.0.0.1:10521:127.0.0.1:1521 user@192.168.1.10

~/.ssh/config:

LocalForward 127.0.0.1:10521 127.0.0.1:1521

Remote Forwarding using SSH

Well this technique is complete opposite of the previous one . Remote forwarding on using SSH comes to rescue in those penetration testing scenarios where we need the services on a local machine / Local Network accessible to remote host via a remote listener . This might sound odd … why would I want my machine accessible on a remote host , but lets face it , we all need to expose a service that lets us download our penetration testing tools.

For the practical information here is an example :

The SSH server will be able to access TCP port 80 on SSH client by connecting to 127.0.0.1:8000 on the SSH Server .

ssh -R 127.0.0.1:8000:127.0.0.1:80 192.168.1.10

~/.ssh/config:

RemoteForward 127.0.0.1:8000 127.0.0.1:80

SOCKS Proxy using SSH

Here we set up a SOCKS Proxy on 127.0.0.1:8000 that lets you pivot through the Remote Host 192.168.1.10

 ssh -D 127.0.0.1:8000 192.168.1.10

~/.ssh/config:

Host 192.168.1.10
DynamicForward 127.0.0.1:8000

X11 Forwarding using SSH

If your SSH client is also an X-Server then you can launch X-clients (e.g. Firefox) inside your SSH session and display them on your X-Server. This works well with from Linux X-Servers and from cygwin‘s X-server on Windows.

SSH -X 10.0.0.1
SSH -Y 10.0.0.1 # less secure alternative - but faster

~/.ssh/config:

ForwardX11 yes
ForwardX11Trusted yes # less secure alternative - but faster

SSH Authorized Keys :

SSH stands for Secure Shell … well to be secure , its always advisable to use Keys for encrypting the SSH communication . This helps to avoid unwanted hosts to take advantage of the penetration test and keep the penetration testing secure .

That being said , it is a good practice to add an authorized_keys file that will allow you to log in using an SSH key .

Authorized_keys File : This file is present in the User’s Home Directory on the SSH server . This file basically holds the public keys of the users allowed to login into that user account of SSH Server .

For this the first step is to Generate PUBLIC KEY / PRIVATE KEY pairs .

sh-keygen -f mysshkey
cat mykey.pub # to copy this to authorized_keys

To connect to the Remote host using the authorized key :

ssh -i mykey user@10.0.0.1

Some Cool SSH Configuration Tweeks

Finally here are some cool modifications you can do to your SSH Client system , this will make it easier to use other penetration testing tools that are using SSH .

Host 10.0.0.1
Port 2222
User ptm
ForwardX11 yes
DynamicForward 127.0.0.1:1080
RemoteForward 80 127.0.0.1:8000
LocalForward 1521 10.0.0.99:1521

#Please Share and Comment if you like this Post .

What are Rainbow Tables?

Rainbow Tables are a type of password hash tables that help simplify the process of cryptanalysis by applying a set of time-memory trade-offs to make the process be more efficient. They were proposed by Philippe Oechslin as a way to improve on the pre-existing concept of Time-Memory Trade-Offs that can be leveraged to run password attacks, reducing computation time, calculations and false alarms, compared to the original method.

To understand what they are, let’s first elaborate on a few concepts:

A hash function is a mathematical function that receives data on its input, and maps it to values of the same length on the output. There are many hash algorithms, with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 being among the most used in cryptography. Hash functions are a kind of one-way cipher function, because they allow enciphering plain text into cipher text, but they cannot decipher the plaintext
version of a given cipher text.

For example,

Where f is the hash function.

Cryptanalysis is explained by Martin Hellman’s A Cryptanalytic Time-Memory Trade-Off paper as the problem of going through a set of precomputed password hashes to find the plaintext version of a password that was hashed, prior to being stored on a system.

Original Method

Hellman’s original method is based on making a compromise between the amount of memory needed to crack a password, and the amount of operations needed to perform the attack. It focuses on leveraging T operations (time) and M words of memory to search through N possible keys; which have to be computed previously.

The process of precomputing these solutions consists of specifying a long-enough word list (preferably with many word combinations) as a starting point on the left column of the table.

For each row in the table, you take the original block (whether or not it’s plaintext), apply an encipherment function to it (such as a hashing algorithm); and then you apply a reduction function to the resulting cipher text.

Where R is a reduction function. – i.e. If the cipher text is 64-bits long, a reduction function could drop the last 8 bits to produce a 56-bit result.

After you’ve applied the cipher function(f) to the starting point (the plaintext), you apply f to the result of the first operation; then continue iterating for a total of t times. Thus, the chain will be of length t; and then you move on to the next chain, as illustrated by the following graph:

Once a chain has reached length t, we only store the value of the Starting Point and the End Point in the table.

Due to the iterative nature of chains, there is a chance that 2 or more chains merge, because a result of a computation (either or an end-point ) might have 2 or more inverse images, generating a false alarm.

This is supposing that we’re using the same reduction function (R) for all iterations of f, on all chains. However, since there are tons of possible reduction functions, and to improve the probability of success, you need to generate many tables (actually a total of t tables), each with a different choice of R.

All entries on the table are sorted by End Point; so when running an attack, you would search for the cipher text on the End Points column. Once you’re in the correct range of rows, you take the value at the Starting Point column and compute ) a total of N times to compute only that chain. If the ciphertext is found on the chain, you look at the previous iteration of the function to see if it is the key (i.e. check if it is the password you’re searching for). In case the cipher text is not found in the chain, you would either move to the next row and compute that chain, or move to another table to search there. For each line on a table, you will indeed need to compute the new chain. However, if it isn’t the key, then you go to the previous iteration, and again, and again, until you find the correct key.

Rainbow Tables

As explained previously, Rainbow Tables were proposed by Philippe Oechslin as an improvement to both the original method by Hellman and some others like Distinquished Points, as he references in his research paper. Instead of generating multiple tables, each with a different reduction function (), these implement a single table of dimensions mt*t, using a different reduction function for each iteration of the chain.

Knowing that each function is given by , therefore the table would be constructed
something like this:

The advantage of this method over the original is that, first, we get a lot less number of table look-ups, with the added benefit of getting a lot less false alarms, which means that we spend a lot less time doing cryptanalysis and also that we get an answer a lot quicker than with the orignal method.

There’s also the added benefit that using distinguished points, each chain would have a variable length, which leads to an increased overhead because, if 2 or more chains merge and cause a false alarm, we have to compute the entire length of each of the chains, so that we can detect the false alarm. Meanwhile, the constant length of rainbow table chains means we only need to compute a fraction of the chain, because we know exactly the position of the chain where we should locate the merging key, reducing the time cost of a false alarm.

According to Dr. Oechslin’s experimental results, by using 5 rainbow tables the number of hash computations was reduced by a factor of 12 compared to applying distinguished points to the original method, by analyzing all tables as well.

Mitigation Strategies

Over time, Rainbow Table attacks have become less popular, mainly because of the introduction of salts in encryption. A salt is a technique where, after computing the hash of the original password, you append a random number to the cipher text.

For example, with the password: p8c6uMTMVGgKjLoBG4p04xtTk, the generated SHA-512 hash would be . However, if we were to append the salt 13db61b6c98387, the plaintext would look like this:

Which would result in the following SHA-512 hash:

ac6b3367618ffa34bbedc0416aea644c598439ce3a696769a9ce5e4708ed02d95d2ae9f702f2a3e2d6d967ae9b0f2ef3cfba9e2422e5c8cbb764b56021e51e5e

Even though rainbow tables aren’t as popular as they were before, knowing about how they work is still useful, because, if you’re doing a pentest, you never know when you might run into an old server that uses Microsoft LAN Manager, which is in fact vulnerable to Rainbow Tables.

Fortunately, there are several tools that allow you to crack passwords using rainbow tables. For example, Kali Linux comes with OphCrack and RainbowCrack.

Secure Sockets Layer Tutorial | What is SSL | SSL Hackers Guide

Secure Sockets Layer or SSL Hackers Guide : You might have heard some times that not to give your password or credit card information or any other sensitive information on public computers or on Facebook, yahoo etc chats.The reason why you might have heard that the Hackers have some ways to you would have probably heard that hackers have a way to steal your your credit card numbers , passwords etc.

Secure Sockets Lock Tutorial | What is SSL | SSL Hackers Guide

A hacker can use different types of attacks such as Packet sniffing or ARP Poisoning to steal your sensitive information.

Secure Sockets Layer (SSL) is the most widely used technology for creating a secure communication between the web client and the web server. You must be familiar with http:// protocol and https:// protocol, You might be wondering what they mean. HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a secure communication.

Cryptography

If two users want to have a secure communication they can also use cryptography to accomplish it

For example:

TFDVSF=Encrypted Text

SECURE= Decrypted Text

You might be wondering how i Decrypted it, Here i have used Algorithm=+ for the communication and the key is “1“, What comes after S is T so as you can see that S is converted into T, What comes After E is F to letter E from the word secure if converted into F and so on, To help you understand this more better I am adding a Video –

So If the hacker starts sniffing from between he will get Encrypted text and as the Hacker does not know the keys so he cant decrypt it, but if the attacker or hacker is sniffing from the starting point so he will get the key and can easily Decrypt the data.

Standard Communication VS Secure communication

Suppose there exists two communication parties A (client) and B (server)

Standard communication(HTTP)

When A will send information to B it will be in unencrypted manner, this is acceptable if A is not sharing Confidential information, but if A is sending sensitive information say “Password” it will also be in unencrypted form, If a hacker starts sniffing the communication so he will get the password.

This scenario is illustrated using the following figure –

Standard Communications HTTP

Secure communication(HTTPS)

In a secure communication i.e. HTTPS the conversation between A and B happens to be in a safe tunnel, The information which a user A sends to B will be in encrypted form so even if a hacker gets unauthorized access to the conversion he will receive the encrypted password (“xz54p6kd“) and not the original password.
This scenario is illustrated using the following figure –

Secure communication(HTTPS)

How is HTTPS implemented?

A HTTPS protocol can be implemented by using Secure Sockets Layer (SSL), A website can implement HTTPS by purchasing SSL certificate.

Which websites need SSL Certificate?

The websites where a private conversation is occurred, Websites related to online transactions or other sensitive information needs to be protected needs to SSL Certificate.

How to identify a Secure Connection?

In Internet Explorer and google chrome, you will see a lock icon in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.
If you are making an online transaction through Credit card or any other means you should check if https:// secured communication is enabled.

Source: RHA InfoSec