Last week I had the pleasure to give you my impressions regarding my experience
about
hacking for b33r at Ghent,
that is, my participation at BruCON 2014 hacking
conference. As I said among else, the reason that I was there was to present
Chiron, my IPv6 penetration
testing/security assessment framework, which was supported by the
Brucon 5×5
program. The first version of Chiron had been presented at
Troopers 14,
during the
IPv6 Security Summit.
In the context of an internal evaluation, we recently had a look at most of the
burp plugins available from the BApp store. The following overview represents
our personal top 9 plugins, categorized in “Scanner Extensions”, “Manual
Testing” and “Misc” in alphabetic order:
my name is Antonios and I am an independent IT Security Researcher from Greece.
One of my latest “hobbies” is IPv6 and its potential insecurities so, please let
me talk to you about my latest experience on this.
This week, I had the opportunity to work together with the ERNW guys at their
premises. They had built an IPv6 lab that included several commercial IPv6
security devices (firewalls, IDS/IPS and some high-end switches) and they kindly
offered their lab to me to play with (thank you guys 🙂 – I always liked
…expensive toys). The goal of this co-operation was two-fold: First, to test my
new (not yet released) IPv6 pen-testing tool and secondly, to try to find out
any IPv6-related security or operational issues on these devices (after all,
they all claim that they are “IPv6-Ready”, right?).
So we got these shiny new BlackBerry Q10 and Z10 device laying on the desk one
morning. It’s my first BlackBerry, I have to admit, but never the less, the hole
wushy GUI and touchy glass stuff wasn’t my main concern, instead i
took a look at the stuff
going on while you connect the phone (do i have to call it blackberry? its a
phone, isn’t it?) to your computer.
Our new
workshop about mobile application testing,
held for the 1st time at the Troopers conference 2013, is coming closer. So I
would like to take the opportunity and post an appetizer for those who are still
undetermined if they should attend the workshop ;-).
While the topic of mobile application testing is a wide field that may contain
reverse engineering, secure storage analysis, vulnerability research, network
traffic analysis and so forth, in the end of the day you have to answer one
question: Can I trust this application and run it on my enterprise devices? So
first you have to define some criteria, which kind of behavior and
characteristics of an application you regard as trustworthy (or not). Let us
peek at malware … besides harming your devices and data, malware is typically:
2 AFFECTED PRODUCTS The following Products have been tested as vulnerable so far: Cisco Unified Meetingplace with the following modules: • MeetingPlace Agent 7.1.1.9 • MeetingPlace Audio Service 7.1.1.8 • MeetingPlace Gateway SIM 7.1.1.2 • MeetingPlace Replication Service 7.1.1.9 • MeetingPlace Master Service 7.1.1.8 • MeetingPlace Extension 7.1.1.8 • MeetingPlace Authentication Filter 7.1.1.8
3 DETAILS The following parameters are affected: http://$IP/mpweb/scripts/mpx.dll [POST Parameter wcRecurMtgID]
4 VULNERABILITY SCORING The severity rating based on CVSS Version 2: Base Vector: (AV:N / AC:L / Au:S / C:P / I:P / A:P) CVSS Version 2 Score: 6.5 Severity: Low
There are some database specifics, every pentester should be aware of, when
testing for and exploiting SQLi vulnerabilities. Besides the different string
concatenation variants already covered above, there are some other specifics
that have to be considered and might turn out useful in some circumstances. For
example with Oracle Databases, every SELECT statement needs a following FROM
statement even if the desired data is not stored within a database. So when
trying to extract e.g. the DB username using a UNION SELECT statement, the DUAL
table may be utilized, which should always be available. Another point, if
dealing with MySQL, is the possibility to simplify the classic payload
SQL injection attacks have been well known for a long time and many people think
that developers should have fixed these issues years ago, but doing web
application pentests almost all the time, we have a slightly different view.
Many SQL injection problems potentially remain undetecteddue to a lack of
proper test methodology, so we would like to share our approach and experience
and help others in identifying these issues.
One of our favorite tools for conducting penetration tests (especially, but not
only, web application tests) is
Portswiggers’s Burp Suite. Burp
allows to extend its features by writing own plugins. But because Burp is
written in Java, it only supports Java classes as plugins. Additionally, Burp
only allows to use one plugin at the same time which has to be loaded on
start-up.
Now we have written a Burp-Python proxy (called pyBurp) which adds some
features to the plugin system: