BurpSuite : Web Application Penetration Testing

Penetration Testing has been an Important field in Information Security . Over time it has evolved and expanded from just standalone computers to networks and now to Web Applications .Web Applications are an important part of an organisations Infrastructure as well as seen as E-commerce websites by the commons . In this artical , we will be talking about a very important and widely used web application penetration testing tool , The BurpSuite .

Penetration Testing

Penetration testing [also referred to as pen testing] is a methodology for testing a computer system, network or Web application to find vulnerabilities[the loopholes] that an attacker could exploit.The objective of a penetration test is to find the security loopholes and the vulnerabilities . Penetration testing tools are used as part of a penetration test to automate certain tasks, improve testing efficiency and discover issues that might be difficult to find using manual analysis techniques alone.

Web Application Penetration Testing

BurpSuite

Burp Suite is lots of web application tools bundled into one and the best of available tools for web application testing.This wide variety of features in one tool (that has a user friendly interface)helps to perform various penetration testing tasks within one tool Window .

The Burp comes with the following features :
Intercepting a Request
Modifying Request on the fly
Scanning a web application for vulnerabilities
Brute forcing login forms
Perform a check for the randomness of session tokens and what not . You think of a strategy of web application pentest

In this post we will discuss the features of Burp and how they will be helpful during a web application penetration test .

1) Proxy –Proxy is the most useful feature of the Burpsuite and must be understood before proceeding to any other feature . Burp Suite comes with an inbuilt proxy, which is configured and run on port 8080 by default(however we can always change the port number as per the requirements of the penetration test). Using this proxy, we can intercept and modify the traffic as it flows from the client system to the web application. To use this proxy, all we need to do is to configure our browser for using this proxy. The proxy feature allows us to intercept and modify the HTTP requests and responses shared between the Burp Client and the Server. Not only you can change the port of the proxy , but also set up a new proxy altogether .

2) Spider – The spider feature of Burp Suite is used to crawl web applications and look for new links, content, etc. It automatically submits login forms (through user defined input) in case it finds any, and looks for new content from the responses. This information can then be sent to the Burp Scanner to perform a detailed scan on all the links and content provided by the spider.Burp Spider is used for mapping web application. It will automatically crawl the web application looking for links and will submit any login forms it finds and hence provide a detailed analysis of the whole application. These links can then be passed over to Burp Scanner to perform a detailed scan using the information provided by the scanner.

3) Scanner – It is used to scan web applications for vulnerabilities. The type of scanning can be passive, active or user-directed. Some false positives might occur during the tests. It is important to remember that no automated scanner is 100 percent accurate in its results. Unfortunately Burp Scanner is not available with the free edition that is included in Backtrack 5.Burp Scanner is one of the most powerful web application scanners. Though, like any other web application scanner, it is not perfect and some false positives may occur. Burp Scanner is not available with the free edition. You can find more information about Burp Scanner

4) Intruder – This feature can be used for various purposes like exploiting vulnerabilities, fuzzing web applications, carrying out brute force attacks etc.Burp Intruder can be used for exploiting vulnerabilities, fuzzing, carrying out brute force attacks and many other purposes. In this case we will be using the Intruder feature in Burp Suite to carry out a brute force attack against DVWA. Browse over to DVWA and click on Brute Force. Enter any username/password, make sure Intercept is on in Burp Suite, and click on Login.The request will be intercepted by Burp Suite, right click on it and click on send to intruder.

5) Repeater – This feature is used to modify and send the same request a number of times and analyze the responses in all those different cases.With Burp Repeater, we can manually modify a request, and resend it to analyze the response. We need to send a request to Burp Repeater for this. The request can be sent to it from various places like Intruder, proxy, etc.

6) Sequencer – This feature is mainly used to check the randomness of session tokens provided by the web application. It performs various advanced tests to figure this out.Burp Suite Sequencer is used to figure out the randomness of the session tokens generated by a web application. This is because session tokens are usually used to authenticate a user, and hence should not be compromised. It is important for a web application to have a high degree of randomness for session tokens, so that brute force attacks are not successful against it. We need to send a request which returns a session token to the sequencer, the Sequencer then repeatedly sends the request, thus obtaining a high number of session IDs. It then passes these session IDs through various statistical tests to determine the randomness.

7) Decoder – Decoder feature is utilized to decode data to get back the original form, or to encode and encrypt the data.Burp Suite Decoder can be used to decode encoded data and get it back into its canonical form. It can also be used to encode and encrypt data to get the encoded and encrypted forms. We can manually paste data into the decoder or send an encoded request to it. In this case I will be sending an HTML Basic authentication request that contains the username and password in base64 encoded form to the decoder. Right click on the request and click on Send to Decoder

8) Comparer – Comparer feature of the Burp Suite is used to perform a comparison between any two requests, responses or any other form of data. This feature could be useful when comparing the responses with different inputs.

Nmap Cheat Sheet – Port Scanning Basics for Ethical Hackers

Network mapper, also known as nmap, is an open-source network reconnaissance, port scanning, and security auditing tool. It is one of the most basic and widely used cybersecurity tools that has evolved from a simple port scanner to a multifunctional toolset. It is an ideal tool for security practitioners, network, IT, and system administrators to customize the open source code for specialized environments. Hence, it’s a Swiss Army knife for cybersecurity and IT professionals.

The article is a basic-intermediate level guide on analyzing networks using the Nmap utility. You will understand Nmap functionality to scan entire networks and check for available services and unpatched vulnerabilities to help you advance in the cyber kill chain process.

Types of Nmap Scan

Nmap offers multiple scanning techniques such that each method significantly contributes to the results after a port scan. However, it only allows one scan type at a time with a format of -s<scan_type>. Some of the most common nmap scan types are:

nmap -s<scan_type> <target_host>

Ping Sweep (-sn): This type of nmap scan sends ICMP packets to discover the number of devices that respond to it. Ping sweep helps determine the number of available or active devices on the network. It is fast and hard to detect.
TCP (-sT): TCP connect scan completes the three-way handshake between the scanning machine and the target host, such that it’s noisy and triggers the packet filtering platforms like firewalls and intrusion detection systems.
UDP (-sU): The -sU option in nmap looks for the active UDP protocol ports listening for a connection. Nmap combines this scan with the TCP connect scan to check open ports for both protocols. However, its results can be falsely positive, and the response is slow as a precautionary measure by target machines to such packets.
SYN (-sS): Also known as the half-open or stealth scan because the scanner immediately responds with the RST packet after receiving the SYN-ACK packet from the target host. Hence, it closes the connection before completing the handshake.
FIN (-sF): It’s the same as the SYN scan except that Nmap sends the FIN flag instead of an RST in a packet for closing the connection.
NULL (-sN): The target systems do not know how to respond to a Null scan as all the flags inside the TCP header are off or set to null.
XMAS (-sX): XMAS is the same as the null scan, except that nmap turns on all the flags in the TCP header.

Specifying Targets for Nmap Scan

Anything that isn’t an option or a flag in nmap is dealt with as a target host. It allows us to specify a range of hosts in a single command. The most simple among them is the specification of a single hostname or the target host address.

sudo nmap <www.hostname.com>

On providing the hostname as a target, nmap uses DNS resolution to resolve the hostname to an IP address and perform the target discovery process to confirm its availability. The hostname may resolve to more than one IP address, in which case, by default, it considers the first one. You can use the –all-resolve option for nmap to scan all addresses.

sudo nmap --all-resolve <www.hostname.com>

Nmap allows you to specify targets in three various ways:

Multiple Specifications: Nmap allows to specify multiple IP addresses at a time as follows:

sudo nmap X.X.X.21, X.X.X.28, X.X.X.45

CIDR notation: The CIDR notation-based addressing allows scanning of a whole network or a range of adjacent IP addresses. All it requires is to append the IP address/hostname with the network suffix/bits as follows:

sudo nmap <X.X.X.0/24>

sudo nmap <www.hostname.com/24>

Hence, nmap will scan all the IP addresses from X.X.X.0 to X.X.X.255. Nmap also allows you to exclude an IP address with the help of the –exclude option as follows:

sudo nmap <X.X.X.0/24> --exclude X.X.X.25, X.X.X.35

However, it’s not flexible in a scenario when you want to exclude IPs including .0 and .255 for subnetworks and broadcast addresses, as in the case of X.X.0.0/16. Nmap resolves this issue by introducing octet-based addressing.

Octet range: It allows you to use wild cards * and – for a comma-separated range of numbers for each octet. For instance, for the target address, X.X.0-255,1-254 nmap will skip all addresses that end in .0 and .255.

Similarly for the address range X.X.2-5,8.1 nmap will scan addresses X.X.2.1, X.X.3.1, X.X.4.1, X.X.5.1, and X.X.8.1.

nmap X.X.2-5,8.1

Lastly, given the ip address of X.X.X.* nmap will scan all addresses from 0 to 255.

Input Target Address List to Nmap

Even though Nmap provides multiple ways to specify target host addresses, it’s infeasible to write down all of them in a single command. Specifically, in a scenario when a DHCP leases around 100 IPs that you wish to scan.

Use the -iL argument to pass Nmap the .txt file containing a list of hosts for scan, such that each entry can be in any of the formats (discussed above) supported by the utility.

sudo nmap -iL <target_hosts.txt>

Specifying Ports for Nmap Scan

Port scanning is the heart of nmap as it helps to identify ports state and running services. Port scanning in nmap works by specifying targets to find information, but it isn’t necessary as mostly we don’t have a complete picture of the network. Nmap recognizes ports state based on six types:

Open: the application or service is listening for tcp or udp connections.
Filtered: nmap cannot determine the port state due to packet filtering via firewall or routing rules.
Closed: the probes were successful, but no service is listening for a connection on this port.
Unfiltered: the probes were successfully received, but nmap can not determine their state. In this scenario, the SYN and FIN scans may help determine if the port is open or not.
Open|Filtered: nmap can not establish if the port state is listening for connections or filtered. It happens when the open port does not respond to the probe. It also occurs when a packet filter drops the nmap probes or any response sent by the target.
Closed|Filtered: it is a state when it is unclear if the port is closed or filtered.

Nmap provides a list of essential options to perform a port scan. To begin with, the bare minimum, specify the target IP address, hostname, or network range as follows:

nmap <IP_address>/<www.hostname.com>

The above command performs a default scan that will probe 1000 TCP ports and provide all the host-related information, their states, and the services running. However, it takes a lot of time and may invoke firewall or intrusion detection systems. To avoid firewall or IDS detection, you can use the following nmap options:

To scan a single port:

sudo nmap -p 80 <hostname>

To scan a single port:

sudo nmap -p 1-100 <hostname>

To perform a fast scan on the 100 most common ports:

sudo nmap -F <hostname>

To scan port based on service:

sudo nmap -p smtp,https <hostname>

To find more about all available port scanning options via the nmap -h command.

Service and Host Discovery

Nmap offers various options to grab information about the operating system and the running services to determine open ports.

To detect the operating system alone:

nmap -O <target_host>

To detect the service and host machine:

nmap -A <target_host>

Service Version Discovery

Nmap allows you to find more details about the services running on the target machine ports. Add the -sV option to the nmap scan for a standard service version discovery:

nmap -sS -sV <target_host>

It also enables us to set the intensity of the scan with the help of a –version-intensity option for an aggressive and light service detection scan. High version intensity for service scanning provides more accurate results however, it takes more time, creates noise, and has high chances of detection.

nmap -sV --version-intensity 5 <target_host>

While the banner grabbing lightweight detection has more advantages in terms of staying undetected during services enumeration.

nmap -sV --version-intensity 0 <target_host>

Saving Nmap Output

Nmap offers various file formats to save its output. By default, nmap stores the scan output in .txt format with a simple redirect >.

nmap -sS -p 80,443 <target_host> > nmap_outputfile

Whereas the nmap -oN option stores the scan results and displays the output at the same time.

nmap -oN nmap_outputfile.txt <target_host>

For XML and grep formats use -oX and-oG options as follows:

nmap -sS -sV --version-intensity 5 -oX nmap_outputfile.xml <target_host>

nmap -sS -sV --version-intensity 5 -oX nmap_outputfile.txt <target_host>

To save the results in all formats:

nmap -oA nmap_outputfile <target_host>

Nmap Scripting Engine (NSE)

NSE is a powerful nmap functionality that expands its features considerably. The NSE scripts are written in Lua language and help perform various tasks such as scanning for vulnerabilities (vuln), brute forcing credentials (brute), and bypassing authentication (auth) of running services. Use the –script option to activate the script as follows:

nmap -sV -p 80 --script=vuln <target_host>

To find more about the available database of NSE scripts, cd into the /usr/share/nmap/scripts/ directory:

cd /usr/share/nmap/scripts

head scripts.db

Or grep all the available scripts for a particle protocol as follows:

grep "ftp" /usr/share/nmap/scripts/scripts.db

Conclusion

Nmap is a command-line utility with versions for both Windows and Linux. It’s a versatile tool for network administrators and security practitioners to resolve issues and find flaws. The article is a beginner’s guide for getting started with the Nmap tool, analyzing network services and their vulnerabilities.

DNS Poisoning Explained and Remediation

DNS Poisoning is also known as DNS MITM , is an advanced form of Man in the Middle Attack .

In DNS Poisoning attack , when a client on the network tries to visit a website , we will redirect the traffic to our desired IP Address . This is done by ARP Cache Poisioning .

This technique is sometimes reffered to DNS Spoofing also .

Further taking an example of DNS Poisoning attack , all the traffic that is mean to be sent to www.example.com which has an IP address of A.A.A.A , will be sent to a fake www.example.com residing at an IP address of B.B.B.B

What is DNS ?

Domain Name Servers (DNS) are responsible for maintaining a Directory of Domain names and Translate them to Internet Protocol (IP) Addresses . This is important because the Domain names are easy for the humans to remember but the computers / Servers only understand IP’s . A computer will access the website based on IP Addresses.

How to DNS Poisoning Done ?

In DNS Poisoning attack , When a client on the network says it wants to access www.example.com , we will redirect the traffic to our fake copy of the same website , but at a different IP address i.e. our Kali Linux Machine which is running a ARP Poisoning Server.

For the DNS Poisoning to work we will need to route the packets of other computers through the Kali Linux machine . For this , run the following command on the Terminal .

echo “1” > /proc/sys/net/ipv4/ip_forward

Now we prepare for configuring the machine for DNS Poisoning Attack .

First edit the file : /usr/local/share/ettercap/etter.dns (for Backtrack 5 )

/usr/share/ettercap/etter.dns (for Kali Linux)

*.example.com A <your_attacker_machine_ip>

Use command ifconfig to find your machines IP .

ettercap -T -q -M arp:remote -P dns_spoof //

This is all an attacker needs to Sniff over your private traffic and do a DNS poisoning on your network and redirect the traffic from the legitimate website to the fake website .

How to Prevent DNS Poisoning on your Network ?

Following are the tips to defend Against DNS Poisoning :
Secure the Internal Infrastructure as this attack is only possible from the inside of the network .
Use Intrusion Detection Systems (IDS) as they are capable to detecting ARP Poisoning .
Use of DNSSEC , which is a new alternative of DNS , as it uses digitally signed DNS records .

DNS Poisoning is difficult to prevent due to its passive nature . Hence hard to detect and very important type of internal network based attack

DNSMAP Tutorial | DNS Network Mapper Information Gathering | KYB Tutorial 3

Hackingloops is back with another Know Your Backtrack Tutorial. In this tutorial, we will be learning DNSMAP Tool for DNS information gathering. DNSMAP, as the name suggests, is DNS Network Mapper, which is used for multiple purposes. Basically, DNSMAP is an passive Network Mapper, often called a sub domain brute force tool. This tool is mainly used by penetration testers and hackers for DNS and sub domain information gathering. It is similar to most other DNS information gathering tools except for a significant feature.

DNSMAP Tutorial KYB 3 Hackingloops

Key Features of DNSMAP Tool on Backtrack:

Obtain all A records (i.e. IP addresses) associated to each successfully brute forced sub domain, rather than just one IP address per sub domain.
Abort the brute forcing process in case the target domain uses wildcards.
Ability to run the tool without providing a word list by using a built-in list of keywords.
Brute forcing by using a user-supplied word list (as opposed to the built-in word list).
Saving the results in human-readable and CSV format for easy processing.
Improved built-in subdomains wordlist.
New bash script (dnsmap-bulk.sh) included which allows running Dnsmap against a list of domains from a user-supplied file. i.e.: brute forcing several domains in a bulk fashion.
Bypassing of signature-based Dnsmap detection by generating a proper pseudo-random sub domain when checking for wildcards (Unique Feature).

Why to use DNSMAP Tool ?

1. Find interesting remote access servers.

2. Find badly configured and/or unpatched servers.

3. Find new domain names which will allow you to map non-obvious/hard-to-find net blocks.

4. Occasionally you find that some brute forced sub domains resolve to internal IP addresses (RFC 1918). This is great as sometimes they have very up-to-date “A” records, which means that it *is* possible to enumerate internal servers of a target organization from the internet by only using standard DNS resolving (as opposed to zone transfers for instance).

5. Discover embedded devices configured using Dynamic DNS services.

How to use DNSMAP tool on Backtrack Linux ?

Step 1: Open the DNSMAP Tool on Backtrack

There are multiple ways to open the DNSMAP tool over the Backtrack:

a. Using GUI Menu: Go to Menu Bar and Click on Applications –> Backtrack –> Information Gathering –> Network Analysis –> DNS Analysis –> DNSMAP

b. Using Terminal: Run the below command in terminal

cd /pentest/enumeration/dns/dnsmap/

Step 2: Select the Target and Start the Scan

Say we want to gather information regarding Google. In order to run the DNSMAP we have to run the below command @ DNSMAP:

./dnsmap google.com

When you press the enter button you will see results similar to these screenshots:

DNSMAP Tutorial – 1

DNSMAP Tutorial – 2

DNSMAP Tutorial – 3

You can see above that DNSMAP has scanned all the sub domains of Google along with all A records i.e. IP address of Google sub domains.

Now the above was the simplest way of using DNSMAP. In order to perform deeper searches there are several advanced options available in DNSMAP tool which are listed below :

-w <wordlist-file>
Input file to use for brute force

-r <regular-results-file>
Export results as text format

-c <csv-results-file>
Save files as csv format

-d <delay-millisecs>
Maximum delay (in ms) between 2 DNS lookups(default: 10 ms)

-i <ips-to-ignore>
Useful if you’re obtaining false positives

Examples for using advanced options:

If you have a custom wordlist of subdomains, you can use that as well simply by specifying the -w argument and then the path to the wordlist.

./dnsmap google.com -w yourwordlist.txt -r /tmp/domainbf_results.txt

./dnsmap google.com -r /tmp/ -d 3000

./dnsmap google.com -r ./subdomainbruteforce_results.txt