Wapiti –Web Applications Security Auditing Framework

Wapiti is a vulnerability assessment framework that performs black box security auditing of the web applications. The vulnerabilities that can be assessed with Wapiti include database injections, Local File Inclusion (LFI), Remote File Inclusion (RFI), command execution, CRLF injection, Server Side Request Forgery (SSRF), XML External Entity (XXE) injection, Shellshock bugs, .htaccess attacks, and source code disclosure vulnerabilities. The database injection includes SQL, XPATH, PHP, ASP, and JSP injection attacks. Command execution attack analysis includes detection of eval(), system(), and pastru() vulnerabilities. Wapiti makes use of the pre-installed modules to perform these assessments.

Wapiti Installation

Wapiti is a Python based framework. Clone Wapiti using the following Github path.

git clone https://github.com/IFGHou/wapiti

Navigate to the wapiti directory to install the framework using the following commands.

cd wapiti
python3 setup.py install

Wapiti Working

The framework can be launched by running the wapiti executable from bin folder in Wapiti directory. The help command loads all the mandatory and optional parameters of Wapiti.

python3 wapiti -h

The following basic command executes Wapiti framework to scan vulnerabilities in target web application.

python3 wapiti –u <target web application>

Let’s assume a web application (testphp.vunweb.com). The following command loads all Wapiti modules to scan the application for the aforesaid vulnerabilities.

python3 wapiti –u http://testphp.vulbweb.com

Wapiti finds all the available links on the target web application and runs each module one by one against each file (link). If any file (link) is found vulnerable, Wapiti mentions it in Command Line Interface (CLI) along with the attack path and potential injection parameters.

Since Wapiti basic command loads all the modules, the process can take some time to scan web applications with too many directories and pages. The CTRL+C command halts the current scan process with few options, such as skipping the active module and executing the next, generating report without performing further analysis, and stopping the whole scanning process without generating any reports.

Besides launching all modules, Wapiti allows using a specific module. The –lists-modules argument lists all the available modules in Wapiti framework.

Python3 wapiti --list-modules

The –m parameter in the following format executes desired module for specific vulnerabilities assessment.

python3 wapiti –u <target web application> -m <module name>

For instance, we can limit the vulnerability search scope to SQL injections by using the sql module in the following format.

python3 wapiti –u http://testphp.vulnweb.com –m sql

The above command loads all the modules, however executes only sql module to find out SQL related vulnerabilities in the target web application.

The module goes through each directory and page to find out the SQL vulnerabilities. We can define depth level to limit the scanning process to desired number of links or files. The –max-links-per-page argument is used to define the maximum links to be scanned one each page of the target web application. Similarly, –max-files-per-dir argument is used to define maximum number of files per directory. Wapiti supports many other arguments that can be used along with the search command. All these options can be explored in the help section. Besides displaying individual findings in CLI, Wapiti generates a detailed report of detected vulnerabilities in the root directory. The report is in HTML format that can be viewed in preferred web browser.

Conclusion

Wapiti is an automated way of searching top level web application vulnerabilities. The framework does not rely on the provided url path. Rather, it scans all the directories and pages in the target to find out the potential vulnerabilities.

Python SMTP User Enumeration for Penetration Testing

Welcome back my fellow hackers! I was thinking recently, and came to the realization that we haven’t really been cooking up any homemade tools here at HackingLoops, so I’ve decided to change that. Today we’re going to be learning about SMTP user enumeration, as well as building an enumeration tool of our very own and taking things further than just using the python smtplib to send emails.

First, we’ll discuss the SMTP protocol, then we’ll follow it with the purposes and potential of this enumeration. Once we’ve covered that, we’ll discuss the methods that we can use to enumerate these users and test smtp. After all that is said and done, we’ll start constructing our own script. So, let’s get started!

The SMTP Protocol and User Enumeration

What is SMTP?

SMTP, short for Simple Mail Transfer Protocol, defines the standards used to transmit e-mail between systems. SMTP is not only used by mail servers for relaying messages to one-another, it is also used by the e-mail client of the end-user in order to transmit a message to the mail server for further relaying.

What is SMTP User Enumeration?

These SMTP servers have users registered on them, and these users have e-mail addresses. By sending probes to the server in the form of certain commands, we can tell if a given user exists. By repeating this process again and again with a list of varying usernames we may be able to identify a multitude of users or e-mail address on the target server. By verifying the existence of these users, we can then proceed to send out phishing attacks directly targeted at them.

How Does SMTP User Enumeration Work?

There are 3 commands in the SMTP protocol that we can use to enumerate a user: VRFY, EXPN, and RCPT TO. The VRFY command is short for verify, and is actually mean’t to validate usernames and addresses. Because of its innate purpose, many administrators disable the VRFY command to stop spammers. The EXPN is very similar to the VRFY command and doesn’t really require extra explaining.

The RCPT TO method is different however. First, we need to discuss the MAIL FROM command. This command identifies the source address of an e-mail being sent. Once we send a MAIL FROM command, we use RCPT TO method to identify the recipients of the e-mail. By repeating RCPT TO commands after the MAIL FROM command, and never actually finishing the started e-mail, we can identify the existence of any user we’d like. Now that we understand SMTP and SMTP user enumeration, let’s get started on building our script!

(Note: the script can be found here on Pastebin. The screenshots here do not have comments, but the Pastebin post does, so I suggest you keep it open and reference it while we go through it here.)

Building the Enumeration Script

Step 1: Beginning the Script and Initializing Class

In order to keep this simple, all our functions will be housed under a single class. Once we’ve completed these functions, we will be able to create an instance of this class and execute the functions as we need. In this step we are first going to set our interpreter path, import a module we’ll need, and initialize our class:

As you can see, we only need a single module at this point, socket. The socket module will allow us to create and utilize network connections. Our class also takes a number of arguments, these being: the target IP address, the file containing usernames to try, the port number to connect to on the target, a scan type, and an address to use if a MAIL FROM command is required (RCPT method). Also, two empty self attributes are created, self.sock will later contain the socket object that connects to the target and self.targetBanner will store the banner from the target server when we connect for the first time.

Step 2: Function to Read List of Users

Next up, we’ll be creating the function that will read the file containing the list of usernames supplied when the object was created. In our init function, we stored the path to the file in self.userlist. Using this, we can read and parse the file, after which we can store the new list in self.userlist, replacing the file path:

Since this function won’t be executed till later, our list of users will remain un-read until we call it. Once it’s called however, the list will be read and stored.

Step 3: Function for Constructing and Handling Sockets

Naturally with a script like this, we’ll be using sockets in order to make and use the connection(s) to the target server. In order to ease the implementation of these sockets, we’ll be building a pair of functions to handle their creation:

Our first function, buildSock(), follows these steps: create the socket object, connect the socket to the target IP address on the target port number, store this connected socket object in self.sock, receive the server banner, and store the server banner in self.targetBanner (if it hasn’t already been stored there). The closeSock() function is simple and not really necessary, but it does save us from repeating some lines of code later. It simply closes the socket object in self.sock and resets its value to None.

Step 4: Function for Checking Vulnerability to Scan

This function will read the type of scan that was chosen and test the target server to make sure that it’s vulnerable before the enumeration begins. We can do this by attempting to use these commands:

The first test is the VRFY test, which will send an empty VRFY command to the target. If the target responds with 501 (the SMTP reply code for a syntax error), then the VRFY command is available to be used. The second test will check for vulnerability to the EXPN method. This can be accomplished by sending an empty EXPN command, and if the target responds with a 502 (command not recognized) then the EXPN command will not work. The final test is for the RCPT command. We start by sending our MAIL FROM command containing the given/default username. We then send an RCPT TO command targeted at the same user. If the target responds with 250 or 550 (OK or user unknown) then the RCPT TO method is available for use.

Step 5: Functions to Probe Target for Username

These next four functions will all be related to probing the target for a given username. I’ll go ahead and throw up the screenshots, then we’ll discuss them:

These three functions all behave similarly to each-other and to the function for checking the targets vulnerability to the scan type. The commands are repeated as they were before, but this time we add the username we’d like to enumerate to the command. If the target responds to this with 250 (OK) then this means that user exists (252 is also an acceptable value for the VRFY method). Finally, we have this function:

This function simply parses the string that was supplied as the scan type when the class is created and probes the target for a given username using that probe method. This will allow us to supply usernames to a single function while still probing the target using the proper method.

Step 6: Taking and Parsing Arguments

Now that all of our functions are complete, we can start putting together the body of our script. First, we’ll import some other modules and then we’ll set up and parse the arguments for the script:

Here we can see that we have seven arguments available when using this script. Firstly, we have the target IP address and port number, then there’s the file path to the word-list containing the usernames to probe for. There is also a switch for each scan type (one of which must be supplied) and finally there is an optional flag to specify the username/e-mail address to use with the RCPT TO method.

Step 7: Detecting and Reporting Bad Input

A big problem in scripting is that invalid user input can really gum up the works. The easiest way I’ve found to combat invalid input, is to make sure you never get invalid input. We can do this by running a series of checks to make sure everything is in order before we continue. First, we’ll validate the target IP address:

We start by checking to see if a target has even been supplied. If it hasn’t, we can raise an error through the parser to tell the user that one is required. If an address is given, we can run it through the socket.inet_aton function, which will raise an error if the IP address is invalid. Now that we’ve handled the validation of the target IP, we should move on to validating the port number:

This block of the code will check that the given port number is in the correct range of integers, if it is not, an exception is raised, and the port number is reported as invalid. The try/except block will also give this report if the int() function raises an error (a non-integer value being given). Next up we’ll check that the path for the word list is in order:

First, we make sure that a file path was given. If a file path was given, we use the os.path.isfile function to evaluate whether or not the file actually exists. If an existent file path was given and the checks are passed, nothing happens. Next up, we will be verifying the chosen scan type:

First, we pull all the scan type values out of the arguments and put them in a list. We then use an if statement to say this: if there is more than one true value or zero true values, return an error. This will allow us to filter out invalid scan type input. Now that all our checks have been completed, we can move on to executing the enumeration.

Step 8: Performing Enumeration

Now that we’re starting our enumeration, we need to create an instance of our SMTPUserEnumerator and pass all the arguments we received:

The if/elif block simply identifies the type of scan that was chosen and stores that value in scantype. Also, before we construct the enumerator object, we print back to the user: the chosen scan type, the target IP, and the target port number. Now that we have our enumerator object, we can run the testScanType() function in order to validate the targets vulnerability before we continue:

As you can see here there are three possible responses to the vulnerability check: good, bad, and fail. A good result means that the checking function returned true, a bad result is returned for false. Also, if an error is generated, the check is reported as a failure and the script exits. Now that we’ve checked the target, we can parse the list of usernames:

This is fairly self explanatory; we print that we’re parsing the list of users, then call the readUsers() function on our enumerator object. Should this process fail, the script will say so and exit. Once the usernames are read we can move on to the actual enumeration:

We start our final code block by printing how many usernames we need to try. Once we’ve done that, we use datetime.now() to start the clock for tracking the duration of the scan. We then call buildSock() to re-connect to the target and print the targets SMTP server banner. We then loop through the list of usernames and call the probeTarget() function for each of them. If a username is reported as good, we print it and move on.

Once the enumeration is complete, we call the closeSock() function and stop the clock for the duration. We then print that the scan is complete and print the difference between the two time values we took (resulting in the elapsed time from start to stop). Now that our script is complete, there’s only one thing left to do!

Step 9: Test the Script

We’ll be testing our script against a Postfix ESMTP server running on an Ubuntu Server 16.04 LTS VM. We’ll start by using the –help flag in order to print the help page for our script (it is automatically generated with argparse):

Our help page is looking good! Before we continue with this enumeration however we’ll need to build a small list of usernames. I’ll be using the cat command in the Kali CLI for this purpose:

Alright, now we’ve got our list of usernames stored under a file named users. Now that we’ve got that squared away, we can begin testing our different scan types, of which we’ll be starting with the VRFY method:

There we go! Our script works! Now let’s move on and test the EXPN scan method:

Our script tells us here that this target is not vulnerable to this type of scan method, which is true (I tried it manually with a telnet session and the command is unrecognized). Finally, we have our RCPT TO method:

There it is, two of our three scan methods work on this target. Hopefully this helped you learn more about SMTP user enumeration (it definitely helped me), and you can expect to see more home-cooked scripts in the near future!

(Note: just in case you missed the link earlier, the script can be found here.)

How to Hack a Gmail Account

Every day there are many people searching to find out how to hack a Gmail account. As I’m sure you know, this is Google’s free email solution, coupled with other free services like Google Docs and Google Drive. And as we all expect from a Google service, it is incredibly secure. In fact, to even setup an account, there are several verification steps designed to weed out bots, fake accounts, and hackers. Not only do you need to link another email account to Gmail, but you also have to use phone verification to identify yourself before your account is activated.

With so many security features, it may seem that Gmail is an impenetrable iron fortress that hackers can’t ever hope to break into. Unfortunately, that is not the case. There are a variety of methods that hackers can use to hack these accounts, and you need to be aware of them if you have any hope of avoiding becoming a victim.

Disclaimer

It can’t be said enough: no one should abuse this knowledge and actually attempt to break into a Gmail account. Doing so is illegal and it could land you in a boatload of trouble, not to mention violating moral principles, such as the right to privacy. We are looking at this purely from an academic perspective; knowing how black hat hackers operate will increase your skills and knowledge as a white hat hacker.

Method 1: The Keylogger

A keylogger is probably one of the most effective and popular ways to hack information. Though some services are so strong that even the most talented hacker would have trouble finding vulnerabilities, more often than not, all of these security features can be undone with a keylogger.

A keylogger is a type of software (or hardware) that runs in the background of the target’s computer, recording every single keystroke they enter. Though many advanced hackers employ complex methods of installing keyloggers remotely, such as embedding the program in a P2P file download or other type of software, even novices can install these programs if they have access to the target’s computer. However, some keylogger programs have tools that help the attacker complete the installation remotely, such as Realtime-Spy.

And hardware keyloggers are even easier to install, because they typically look like a PS2 jack of USB flash drive that can easily be inserted into the back of a desktop computer – without the target being any wiser. Many of them are even undetectable by the latest anti-virus and anti-spyware software.

Method 2: Phishing

Phishing still remains to be an extremely effective way for hackers to steal login credentials, payment card information, and a multitude of other types of data. Essentially, the hacker tries to setup a website (with a bogus URL) that looks and behaves exactly like another website – which, in this scenario, is Gmail. All the attacker really needs to do is copy the web code from the login screen, add a small amount of PHP code, and then harvest usernames and passwords.

After the false phishing site has been setup, the hacker then sends links of the bogus site to all of their victims. A careless user won’t see that the URL is slightly different and will consequently send their username and password straight into the hands of the attacker. Then the phishing site typically redirects the user to the genuine site to avoid suspicion. Though there are a lot of phishing filters and web URL blacklists that attempt to stamp out phishing, there are always new phishing sites popping up, and there is nothing we can do to eliminate them completely.

Method 3: Social Engineering

Social engineering has remained another effective alternative for hackers to steal users’ login credentials. The idea is to impersonate another individual or to dupe the target into willingly forfeiting their login credentials, and there are several ways to do this.

The first way is to create a false account that has an address that looks like it belongs to a friend, acquaintance, or colleague of the victim. Then there are a variety of lies a hacker can tell, like they need your login information to recover their account, etc. In addition, hackers often mimic administrators or Google employees in an effort to garner more trust from their victims.

Some spam emails claim that Google was recently hacked and that they need your username and password to check if your account has been compromised. But Google employees will never ask you for your account information, so remember that you should never hand over your login credentials to a third party – even if they seem to be legitimate.

Method 4: Stealing Cookies

There are a number of ways to steal cookies from other users’ sessions and to inject the into your own web browser. Tools like Firecookie, Wireshark Cookie Injector, GreasMonkey for Firefox, and a myriad of other tools will allow you to sniff out a cookie on the local LAN and then use that cookie to hijack the user’s session.

The easiest place for a hacker to perform this attack is on public Wi-Fi networks like those found at cafes, but some hackers engage in war driving to find weak or exposed wireless networks. The bottom line is that once the cookie has been stolen, the attacker can then login to the account and read emails, send emails, and change account settings to block the original user.

Final Thoughts

Though an average user typically doesn’t stand a fighting chance against a skilled hacker, there are certainly a variety of measures that can be taken to minimize the chance of being hacked. First and foremost, make sure you never give your password out to another individual – even if they’re your friend. Secondly, always make sure that you log out of Gmail when you are finished perusing your email to avoid becoming the victim of session hijacking. And last but not least, everyone should be regularly scanning their computer with antivirus and antispyware software to help decrease the chance of becoming infected with a keylogger and other similar types of dubious programs that lead to someone hacking your Gmail account.

WEAK PASSWORDS : How hackers exploit this Loophole

Users are the weakest connect between any security policy . The users are fooled into clicking on the phishing links and running the malware .

How Hackers Target Easy passwords

But even to this day , the most crucial security loophole remains to to be a weak password . Password that do not follow the required security measure in them can be defined as weak or easy passwords . The most common examples of weak password is the password that is too short (vulnerable to bruteforce attack) or that can be guessed easily (vulnerable to dictionary attack)

Everybody knows better, but our lousy memories somehow convince us it is okay to choose a password that will be easy to remember.

Turns out, your easy-to-remember password may also be incredibly common–and thus easy for hackers to guess. According to an annual listing created by password management security firm SplashData, many people

“continue to put themselves at risk for hacking and identity theft by using weak passwords, easily guessable passwords.”

After analyzing over 2 million passwords scraped from various password dumps, SplashData ranked the top 25 worst offenders, starting with ‘123456,’ and followed closely by ‘password.’

The ridiculous obviousness of many users’ passwords won’t come as a surprise to most security pros. And indeed, some sites do try to force users into selecting stronger passwords, enforcing a minimum length (as evidenced by the third worst password, ‘12345678’) or requiring that numbers and letters both be included (enter ‘abc123’ and ‘passw0rd’ in 13th and 24th places respectively).

The weak passwords list does suggest that in a few cases, users are actually trying with slightly less obvious-seeming choices while using keyboard patterns as memory triggers. This wouldn’t be a bad strategy if it weren’t also entirely too common, with ‘qwerty’ showing up in 4th place, ‘1qazwsx’ (the left two columns on the keyboard) in the 15th spot, and ‘qwertyuiop’ sitting a little lower in 22nd position.

Rounding out the list are a variety of common words, like football, baseball, princess, and starwars. Your own social circle likely inspires a few individuals in your mind that are likely offenders with those credentials.

Passwords: ‘123456’ and ‘password’ are too short, so some users switch to ‘12345678’

It isn’t just individuals who should be concerned. Good quality passwords reduce the hackability of websites and other systems. To assist organizations with buttoning up this common weakness, the National Institute of Standards and Technology provides recommendations for developing and enforcing policies for password length and complexity.

As for individual recommendations, SplashData suggests three simple actions:

Use passwords or pass-phrases with a
minimum of twelve mixed types of characters
avoid reusing passwords on different websites
and consider using a password manager to organize and protect your passwords.

Oh, and don’t worry… when you forget your new bullet-proof password it can generally be retrieved with a “super-secure” query for your mother’s maiden name or the city where you were born. (And yes, we’re being sarcastic, because anybody with a Facebook account could find those details for many of us in a matter of minutes.).

I hope now you all understand what the real danger of using weak passwords.