Search Results For ""

Smbexec 2.0 released

We released smbexec version 2.0 a few days ago and it comes with some rather large differences from previous versions. For one thing it was completely rewritten in Ruby, for another it now supports multi-threading.

When performing email phishing engagements my clients often ask or want to know what users actually clicked on the phishing email. There are many ways to accomplish this task, but I’m going to discuss the method I use to track each unique visitor to my phishing website.

I prefaced this article in one of my previous blog posts “How do I phish” where I discuss using a ruby script I call sendmail.rb. There is nothing special or magical about the script, it just offers an alternative way to send phishing emails that will assist in tracking each unique visit to your phishing website. There is also value in knowing the CIO or some other C-level executive was just phished.

How do I phish? - Advanced Email Phishing Tactics

I’m often times asked how I perform email email phishing attacks. Email phishing attacks are very compelling, and unique to each situation. The process of creating a successful email phishing campaign is very methodical, and most of the time and effort goes up front into the planning phase.

Understanding that good security is a multilayer approach and we will have many layers of security that could potentially destroy our email phishing campaign. Some of these layers may include Email Gateway Spam Filters, Outlook ‘Junk Email’ Filters, Host based Antivirus, Intrusion Prevention Systems, Web Proxy Servers, Egress filtering, and the list goes on and on.

Using Nmap to Screenshot Web Services Troubleshooting

Recently a member from the Trustwave SpiderLabs team created an nmap NSE script that could be used to take a screenshot of webpages as it scanned the network. Working for a top 10 accounting firm, I conduct a lot of internal penetration tests for clients that operate on very large networks, and sometimes I’m required to audit entire counties. Having the ability to view all the webpages on the internal network without being required to manually type in each addresses into the browser sounded amazing. This was very exciting news now that there was a way to automate this process and have the ability to scale. I dove in right away to get started by installing the script based on the instructions in the link listed below:

http://blog.spiderlabs.com/2012/06/using-nmap-to-screenshot-web-services.html

I highly suggest you look over the article above as I wrote this article in hopes that it would help assist anyone when having issues getting the http-screenshot NSE script to function properly with the latest version of nmap.

Stealing Servers Through Directory Traversal

Recently I was conducting an internal penetration test for a client that is part of the financial industry. Since this client is a financial institution they are required to have an independent 3rd party company audit their security once a year per NCUA and FDIC requirements. That’s where I come in, I get paid to hack companies like banks and credit unions. Internal penetration testing is probably one of my favorite engagements to conduct because of the wealth of information you can obtain on an internal network. Devices on the internal network typically do not have firewalls so you have unrestricted access to every port a network device will serve up. There are so many devices on the internal network, and each one tells a story.

During this recent assessment I had brought out my typical attack vectors but was striking out. I typically run Nessus as my primary vulnerability scanner, but like every tool I don’t trust it to be the holy grail. Understanding how a tool works is the best way to get a better understanding of how to find more vulnerabilities in the case that your tools don’t find anything, or malfunction. I’ve met penetration testers that will see zero high risk findings in Nessus and throw up their hands thinking there is no way to penetrate this network. When I see a scan that comes back clean with zero high risk findings, I get excited thinking this one’s gonna be a challenge.

Sitting on this internal network the Nessus scan had completed and came up pretty clean. I brought out my typical arsenal of attacks including but not limited to brute forcing mssql accounts, searching for Apache Tomcat servers that had weak or easily guessable password, sending medusa after the built-in local Administrator account since I enumerated it via null sessions along with the fact this account cannot be locked out by default, nbns_spoofing harvested network hashes but the netLM was disabled leaving me only with netNTLM which is difficult to crack, numerous metasploit auxiliary modules were run along with various other scripts and tools.

Sometimes when you fill the role of a consultant you never know what type of engagements will be thrown your way. How can you train someone to expect the unexpected with computer security. The topic is so huge, and there is so much to learn in this gigantic sea of knowledge.

Recently I was sent on an engagement in Trinidad while it’s country was in a state of emergency. I had never traveled international before so I was required to get a passport. I had to expedite my passport since I was supposed to be in Trinidad in less than a week. Once the passport arrived, I was smooth sailing; so I thought.

I missed my flight to Trinidad which was supposed to leave Minnesota around 9am CST. I panicked and thought I would never find a flight to Trinidad in time. I called my travel agent and was very surprised to find there was an afternoon flight heading to Trinidad. The only catch was that it had a six hour layover in Newark, New Jersey and the connecting flight to Trinidad was between 12am – 6am EST. I didn’t have any other options at this point, so I took it.
Read More