Online Ethical Hacking Class

Penetration testing of VoIP : How Hackers Spoof Caller ID

Today we will learn how to conduct Penetration testing of VoIP (Voice over IP) against a Private Branch Exchange as it’s must to perform pen tests for all type of attacks. For VoIP security assessment, most important pen test is Caller ID Spoofing and how hackers spoof caller ID to make fake calls on behalf of someone else without disclosing his/her information. Before starting pen test we have to understand what is Caller ID Spoofing? Caller ID spoofing is a type of attack where a malicious attacker will impersonate a legitimate SIP user to call other legitimate users on the voice network. So let’s learn how hackers spoof caller ID. Penetration testing of Caller ID Spoofing will require certain pre-requisties to perform complete VoIP pen test.

Requirements for Caller ID Spoofing Pen test:

Metasploit
Viproy
InviteFlood

Now Consider an attack scenario where a malicious attacker calling some customer by pretending that he is an CEO of some organization and he wish to verify some information from customer or want to transfer ABC amount to customer’s account like we see spam emails of huge money transfers and lottery winnings. The attacker is changing the header of the SIP INVITE request in order to spoof his caller ID to CEO. Customer accepts the call as the caller ID seems to be from CEO which is considered trusted and initiates the phone conversation with the attacker.

Spoof Caller ID

The crafted malformed SIP INVITE message can be seen below:

Spoofed Caller ID header packet

Now let’s see how this type of attack can be conducted with the use of various tools.

Penetration testing of VoIP Using VIPROY for Caller ID Spoofing :

Now lets see how we can use Viproy tool for VoIP penetration tests. Viproy is penetration testing toolkit for VoIP assessments and it works with MetaSpoilt framework. There is a specific module that can be used for Caller ID spoofing and in the image below you can see the configuration of the module:

Penetration testing of VoIP using Viproy Spoofed Caller ID

This will cause the phone device to ring with the custom message of our choice even from phone extensions that are not valid.

Penetration testing of VoIP Using InviteFlood for Spoofing Caller ID :

There is another tool for Spoofing caller ID’s known by name InviteFlood. InvitedFlood is part of the Kali Linux. The main purpose of inviteflood is to be used for DoS (Denial of Service) attacks against SIP devices by sending multiple INVITE requests but it can accommodate our need to spoof our ID with the following command:

Caller ID Spoofing Inviteflood

Penetration testing of VoIP Using MetaSploit for Spoofing Caller ID :

Metasploit framework contains an existing module which can send a fake SIP INVITE message to an existing extension which can be used for Spoofing Caller ID :

Using Metasploit for Invite Spoof

The device will ring with showing caller ID as The Metasploit has you.

In order for the attack to be successful the Private Branch Exchange needs to allow anonymous inbound SIP calls. It is very easy to be implemented even from people with limited knowledge about VoIP and hacking. That’s why systems owners need to ensure that their Private Branch Exchange’s prevent anonymous inbound calls to reach their legitimate users in order to mitigate the risk of this attack.

How to remove traces : Hacker’s Guide for Anti-Forensics

Removing or Hiding traces is most important thing that every hacker should know otherwise you will be busted in less than 5 minutes. In our previous article we have learned about how to remove traces over Network. Today we will learn how to make your computer almost untraceable, so that you cannot be tracked or monitored by anyone basically learn how hacker’s remove traces from their computer. This will not only help you in hiding your identity during hacking attempts but also make you anonymous over the network. Hiding or removing traces sometimes also referred as Anti-forensics.

Let’s get started… How to make your computer untraceable i.e. Leaving no traces behind any hack attempt. Hackingloops presents you complete Anti-Forensics hacker’s step by step guide to hide traces or logs.

How to remove traces - Make your computer Untraceable - Hackers AntiForensics Guide

How Hacker’s remove traces from their computers

How to remove traces : Anti-Forensics Guide for Hacker’s :

1. Encrypt Your Keystrokes

You need to protect yourself from keyloggers/Rats. As strange as it may sound even the government/ security agencies/ windows/Hackers all has keyloggers, which records the users IP address, Mac address, open ports, operating system, installed applications, default web browser, visited URLs, logged in user, etc…

In order to protect yourself from keyloggers, you should encrypt your keystrokes. You can do this using a software called ‘Keyscrambler’.

2. Making Encryption Secure

Encryption is pointless if it can be easily bypassed or overcome. You need to make sure that the encryption is secure too.

Step 1 – Make Sure Your Password Is Strong
Even with your computer encrypted, it is still vulnerable. Make sure your password is good (for optimal security, your password should be twenty or more characters, with symbols, numbers, and random capitals, and a special symbol (like ALT+1456) really increase security). Norton password generator is great for this.

Step 2 – Create A Locked Screen Saver
Encryption is pointless if the Forensic Team get to your computer while its running. They can use live forensic tools that don’t require the movement or shutdown of a computer.
A very simple technique to overcome this is to create a locked screen saver. To create a locked screen saver in Windows Vista or Windows 7; Right click your desktop and click on ‘Personalize’. In the bottom left or right hand corner you should see ‘Screen Saver’, click that. Now, check ‘On Resume, Display Logon Screen’, and set ‘Wait’ to 5. Now, underneath that you may set what you want your screen saver to be.

Now you must go to your Control Panel. Click on System and Security now click on ‘Power Options’ find your selected plan and click ‘Change plan settings.’ Now, set ‘Turn Off Display’ to 5 minutes. That’s it! You have now created a locked screen saver.

Step 3 – Get Some Good Antivirus
This may seem obvious, but all this is pointless if you get infected with a keylogger that takes screen shots. Having a good anti-virus is one of the most important things you can do. Now, listen up. AVG, Avast, McCafe, Norton? They all SUCK. The only Anti-Virus you should even consider are BitDefender, ESET, Nod32 and Kaspersky is also pretty good. Advance System Care Ultimate is Good To it uses BitDefender Anti virus engine but is also a utility tool i.e Registry fix/defrag disk defrag privacy sweep security fix etc.

You rarely even need anti-virus software when using Linux, as most viruses are built to infect Windows systems, given these make up the majority of computers, but it’s best to be safe.

3. Disabling Windows Hibernation

You may as well hand your computer over to the feds if they raid your house and your computer is in hibernation. Also, putting your computer into hibernation is pretty much just taking a screen shot of your RAM that gets saved to your hard drive. So how to remove traces by disabling hibernation?

To disable hibernation in Windows Vista/7/10:
a. Open your Control Panel.

b. Click System and Security, then click ‘Power Options’.

c. Click ‘Change plan settings’ for you current power plan.

d. Now click ‘Change advanced power settings’. Expand ‘Sleep’, then expand ‘Hibernate After’. Enter “0″ for ‘Setting:’ to set hibernate to ‘Never’. Hibernation is now disabled.

4. Disable and Remove USB Logs

Next on the list of Anti-Forensics in to disable logs of USB activity, flash drives, etc…
This can be valuable if you have a flash drive with sensitive data and you don’t want any logs of it ever being plugged it to your computer. How to remove traces by disabling or removing usb logs.

Step 1 – Delete the USBSTOR Registry Setting
The USBSTOR setting contains history of plugged in USB devices.
To delete it, hit the WINDOWS Home Button + R at the same time. This will open up ‘Run’; type: “Regedit” (without quotes). Browse to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR
Now, right click ‘USBSTOR’ and hit ‘Delete’, then confirm that you want to delete the key. Now, the key has been deleted.

Step 2 – Delete The Setupapi.log File
The Setuppapi.log is a plain-text file that stores the list of installed USB devices and their drivers. We will delete it with a program called CCleaner.
CCleaner is actually one of the best anti-forensic tools out there, and its free.

5. Disabling Time Stamps

Using Time Stamps, forensic experts can build a ‘digital time-line’, this can be very compelling evidence when cross-referenced with other known evidence. In order to strengthen security, we must disable these logs. How to remove traces by disabling time stamps.

Step 1- User Assist File
There is a registry setting that keeps logs and dates of all launch programs, forensic experts can use this to build a digital timeline, we must disable this for computer security. Navigate to HKEY_Current_UserSoftwareMicrosoftWindowsCurrentversionExplorerUser assist. Do this by hitting the Windows button on your keyboard and R at the same time and typing regedit in). You should see two subkeys called Count, delete both these keys. Now right-click the UserAssist key and create a new key named ‘Settings’. In this key (right clicking on it) create DWORD value named NoLog, set the value to 1.

Windows will no longer store hidden logs of the exact times you have been accesing files, therefore forensics experts can no longer use these hidden logs to create a digital timeline.
Step 2 – Last Access Logs

Next we will disable the last access in Windows. What last access is is a setting on Windows that allows you to see when you opened, modified, and/or created files on your computer and is similar to the UserAssist registry key. By disabling this forensic
experts won’t as easily be able to tell when you’ve been accessing programs or files on your computer.

To disable last access open command prompt on your computer, if on Vista or Windows 7 make sure to run as administrator. In command prompt type the following:
fsutil behavior set disablelastaccess 1

Last access has now been disabled, in order for it to take effect you must restart your computer. (You have to have admin rights to do this).

6. Windows Security Miscellaneous

This is for the shit that has to do with windows anti-forensic security, but wasn’t big enough to have its own section. That does NOT mean this section isn’t important, the stuff in here may actually be the most important in the whole guide. Below are some other ways to remove traces from your machine.

Step 1 – Disable System Restore Points
System Restore points can be used to bring your computer back to a date when it wasn’t secure and can also be used to restore overwritten files.
To disable System Restore points, right click ‘Computer’ and click ‘Properties’. Now click ‘Advanced System Settings’. Under ‘System Protection’ click ‘Configure’.
Now, select ‘Turn Of System Protection’ and apply it.

Step 2 – Disable ‘Send Error Report to Microsoft
This is self-explanatory, we obviously don’t want Microsoft having logs of all our crashed programs. To do this, go to your start menu and search ‘problem reporting settings’ and then click on ‘Choose How To Report Problems’. Click ‘Change Report Settings For All
Users’ and then set it to ‘Never check for solutions’.

Step 3 – Wipe With CCleaner
This is the heart of Anti-Forensics right here. CCleaner is actually one of the most powerful Anti-Forensic tools, -IF- used correctly.
As it turns out, when deleting files, you DO NOT need to do multiple overwrites. With modern hard-drives, one overwrite really is enough to delete a file beyond repair, even though it is popular belief that you need several overwrites to be secure.
With CCleaner, I would recommend three overwrites, just in-case it misses something the first time around (remember, it is a free software).

Once you have CCleaner installed, run it (AS ADMIN), go to ‘Settings’ and make sure you have it set to overwrite deleted data with three passes. Go back to ‘Cleaner’ and check EVERYTHING. I mean EVERYTHING, and hit ‘Run Cleaner’. You might want to leave this on overnight.

Do this every time you are done with a major hacking job. When using normally (what should be every time you are done with your computer), uncheck ‘Wipe Free Space’, this will cut down the time from hours to a few minutes.

Step 4 – Disable Debugging Upon Failure
This keeps logs of your computers failures and blue screen info.
To disable it, right click ‘Computer’ and go to ‘Advanced System Settings’, now go to ‘Start Up and Recovery’. Now, set ‘Debugging Information’ to ‘None’.

Step 5 – Disable Windows Event Logging
Windows keeps logs of all events on the computer. First, before we disable, we must clear all the logs.
To disable it, go to Control Panel then System and Security. Now, click Administrative Tools, and then Event Viewer. In either pane of the Event Viewer window, right-click System and then select Clear All Events, you will get a window that says: “Do you want to save ‘System’ before clearing it?”, click ‘No’.

Now we must disable Windows Event Logging. Go to ‘Run’ and type in ‘msconfig’, then go to ‘Services’ and make sure ‘Hide all Microsoft Services’ is UNCHECKED. Now scroll down until you find ‘Windows Event Logging’, and UNCHECK it.

Now restart your computer right away.

7. Online Anonymity Guide

Hiding online identity and anonymity is essential; because it prevents you from getting traced or tracked down.

Proxies : Proxies are used mainly for security purposes and IP Address, it may be also used to speed up the loading of resources by caching, bypass parental controls and open blocked sites.

Web Proxies : Web Proxies are services that provides proxy access using a website, the function is, when you request a webpage, the server will contact the website indirectly and will server the resource to your web browser.

VPNs : VPNs are similar to proxies, it hides your IP address but the advantage is, it encrypts your traffic so that it would not be intercepted by data sniffing tools, it is useful for public wifi hotspots and for home/office use.

User-Agent Switcher : Spoofs and mimics a user-agent to hide the browsers’ identification.
IPFuck/IPFlood : Used for hiding IP address by using multiple proxies simultaneously, which obfuscates the user’s IP address.

8. Anonymity Tips

a. Do not post private information in the web, including your address, birth date and contact info, including on your registration details, if the authorities found one, they will use it to track you.
b. Do not engage private activities while on public places, other people might see you.
c. Always use anonymity tools so your IP address is masked, if in case they found it out, the IP is fake.
d. Do not brag or talk about hacking, obviously, if you brag/talk about it with your friends, they might report you to the police.
e. Hide your files in an encrypted container, encrypting data on the USB is better.
f. Always use SSL when its available; it encrypts your details so that it would be safe.
g. Use SSH (Secure Shell) when connecting to a remote system, one good example is PuTTy.
h. Never trust anyone; and rely on your instincts.
i. Try “proxy chaining”, or using of multiple proxies.
j. Use a VPN together with a high-anonymity proxy so that there would be an increased privacy advantage.

That’s all friends!! This is must for all Hackers. Keep Learning !! Keep Connected!!

Covering Tracks over Network – Hacker’s Guide

Covering Tracks over Network – Most important step of a Hack attack. Most Hackers know how to hack into networks as lots of tutorials are available over the internet regarding how to do information gathering, scanning or networks and vulnerability database. But you will hardly find anything like covering your tracks over network.. that means most people know how to get into system but don’t know how to remove their tracks, so that they remain undetected. And if you are detectable then you are finished. You will be until and unless you don’t remove your tracks. So friends, lets learn how to cover your tracks over Network to remain undetectable in Hacker’s Guide.

How to cover tracks over Network :

Covering Tracks over Network Using Reverse HTTP Shells :

In this type of attack, the attacker installs a reverse HTTP shell on the victim computer. This reverse HTTP shell is coded is such a way that it ask the commands from an external moderator who controls this reverse shell at regular intervals. So it looks like a normal traffic to an organization network perimeter security device like a firewall, as port 80 is usually opened.

Once the attacker receives the request from the reverse HTTP shell, commands will be issued back that will be executed locally by the victim. This all is seen as HTTP request /response to the network devices. Once the commands get executed, results will be sent out in the next web request. These HTTP reverse shells can also be programmed to bypass any static authentication required by perimeter devices, like a firewall.

Covering Tracks over Network using ICMP Tunnels :

Because HTTP reverse shells are so famous, some organizations keep a check on what is leaving their network in response to the client’s GET request. Some also check what comes as a reply to a GET request and most probably the attacker commands can be detected there. In lieu of this, some carry traffic via covert channels using ICMP packets. This is usually successful because organizations block only incoming ICMP packets and forgot about outgoing ICMP packets. Because of this configuration, an attacker uses ICMP packets to transfer TCP payloads.

First the attacker configures the local client to connect with the victim client. The victim in turn encapsulates the TCP payload in an ICMP ECHO packet and forwards it to the proxy server. The proxy server in turn de-encapsulates the packet and extracts the TCP payload and send to attacker. To the network devices, it seems like a simple ICMP packet.

Various tools are available to do this. Some of them are given below:

Ptunnel
Loki
ICMPShell
PingChat
ICMPCmd

Covering Tracks over Network using TCP Parameters :

How about distributing the attacker’s payload via the normal TCP packet instead of the encapsulating protocol? This method is well known and even today can be used to bypass IDS/IPS. The attacker can distribute the payload via the unset parameters of the TCP packet.

Some of the interesting fields in TCP packet that can be used to transfer the content are:

IP Identification: This attack is very simple to conduct. It requires an established session between the two sides. From one side the payload is transferred bitwise in the IPID field.
TCP initial acknowledgement sequence number: This is a tricky method. This method uses a bounce server whose whole purpose is to receives the packet from the client and send it to the attacker machine. Below are the steps that are used in this method
- Client generates a TCP SYN packet with a spoofed source address of the receiving server and destination address of the bounce server. Let’s say the initial sequence number is ISNA, which holds the character to be transmitted.
- Bounce server receives the packet and responds SYN-ACK OR RESET, based on whether the port is closed or not. An interesting point is that it does send a reply, but to where? Yes, it sends the reply to the receiving server because it receives a spoofed source address. It replies with a SYNB, ACK(ISNA+1).
- Receiving server receives this and recovers the character from sequence number field.
TCP initial sequence number: This method does not even require am established connection as is required in the IP identification method. A SYN packet is sent with an ISNa (initial sequence number) containing the payload (bit). Even though if it gets a RESET in reply, the content is already been extracted by the other side.

Broken Authentication and Session Management Tutorial – Part 1

Broken Authentication and Session Management Vulnerability is one the Top 10 Owasp vulnerabilities. Broken authentication and Session Management this year jumps to #2 in the list. Normally developers doesn’t concentrate much on How users session is being managed. This negligence results into inducing Broken Authentication and Session Management vulnerabilities in the web applications which is quite a bit hard for developers to detect by themselves.

User authentication on the web typically involves the use of a userid and password. Stronger methods of authentication are commercially available such as software and hardware based cryptographic tokens or biometrics, but such mechanisms are not present on most web applications. Web-based applications frequently use sessions to provide a friendly environment to their users. HTTP is a stateless protocol, which means that it provides no integrated way for a web server to maintain states throughout user’s subsequent requests. In order to overcome this problem, web servers – or sometimes web applications – implement various kinds of session management. The basic idea behind web session management is that the server generates a session ID at some early point in user interaction, sends this session ID to the user’s browser and makes sure that this same session ID will be sent back by the browser along with each subsequent request. Session IDs thereby become identification tokens for users, and servers can use them to maintain session data (e.g., variables) and create a session-like experience to the users.

There are three widely used methods for maintaining sessions in web environment: URL Parameters, Hidden form fields and cookies. Each of them has its own benefits and shortcomings, cookies have proven to be the most convenient and also the least insecure of the three. From security perspective, most known attacks against cookie-based session maintenance schemes can also be used against URL parameters or hidden form fields, while the reverse is not true. This makes cookies the best choice security-wise.

Very often, session IDs are not only identification tokens, but also authenticators. This means that upon login, users are authenticated based on their credentials (e.g., usernames/passwords or digital certificates) and issued session IDs that will effectively serve as temporary static passwords for accessing their sessions. This makes session IDs a very appealing target for hackers. In many cases, an hacker who manages to obtain a valid Session ID of user’s session can use it to directly enter that session – often without arising user’s suspicion. Interestingly, most cross-site scripting exploits focus on obtaining the session ID stored in browser’s cookie storage. This class of attacks, where the attacker gains access to the user’s session by obtaining his session ID, is called session hijacking.

Broken Authentication and Session Management Attacks which are quite common among hackers are listed below:

1. Brute Force Attacks

2. Session Spotting Attacks

3. Replay Attack

4. Session Fixation Attack

5. Session Hijacking

6. Session Expiration Attack

We will discuss these attacks in our later tutorials one by one and methods to prevent these attacks. So keep connected and Keep Learning.