Penetration Tests With Nessus (Chapter 1) Nessus İle Sızma Testleri

Penetration Tests With Nessus (Chapter 1) Nessus İle Sızma Testleri

   Aralık 28, 2017       Berk Düşünür

---

Hello  everyone. Today I will write to you about "Nessus Vulnerability Scanner"

This is the first part of my wiriting about nessus  in this section I will talk about simple scans and setup 

You can follow us on twitter @berkdusunur

Okay let's start :)

Nessus Linux Installation

You should first download the appropriate for your system.

You can view the packages in this;

https://www.tenable.com/products/nessus/select-your-operating-system 

I downloaded the debian package.  Let's go to setup :)


dpkg  -i Nessus-7.0.0-debian6_amd64.deb 

We got the activation code after opening Tenable membership. I then connected with the 8834 port scanner and entered the necessary information

Meanwhile I downloaded the "metasploitable 2" virtual machine.  Then started broadcasting with VirtualBox

FOr a short time IP Address for vulnerability researcher
Now right click on the new scan option

I will choose a simple network scan to be an example

after...

We enter the target name and ip address 212.83.175.136

This part asks if you want to do the scanning at the widespread ports or not

This section asks how to perform a scan on the web application.

We started scanning

Continues to scan I will have a coffee :) Nessus gives  more healthier result than its competitors.

I am using nessus with remote server because  I do not have to wait for slow scans

Many security vulnerabilities have been achieved.

In the second part we will explain how to exploit these vulnerabilities.

Thank you for reading.

E-Mail for your questions berkdusunurx@gmail.com

Read More

What is fail2ban? İnstallation and Usage

What is fail2ban? İnstallation and Usage

   Aralık 01, 2017       Berk Düşünür

---

What is Fail2Ban? İnstallation and Usage

Hello  everyone. Today I will write to you about Fail2Ban systems

You can follow us on twitter @berkdusunur

Okay let's start :)

What is fail2ban?

As technology advances, methods of attack, as well as protection methods, are developing. 

Fail2ban is a nice python application that allows you to reject your server's log files for a period of time that you determine again the IP address of a failed login attempt on a number you specify.

How To İnstall Fail2Ban

I am remotely connected to a linux hosting server

First I update packages

"apt-get update"      "apt-get upgrade"

 Then install the required package with "apt-get install fail2ban"

Usage

I have not upgraded any packages I have already installed

Bckup Fail2Ban Main Configuration File

All configuration files are found under /etc/fail2ban directory. The main configuration file is /etc/fail2ban/jail.conf. Its a good idea to take backup of main config file to avoid merges during upgrades. Take local copy of /etc/fail2ban/jail.conf file as shown below:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Once the Fail2ban configuration file is copied, you need to make changes and additions to the jail.local file. Open the "jail.local" file with any text editor (vim, vi, nano etc.) and make the changes as follows.

Ok folks. There are many settings here. ignoreip, bantime, findtime, maxretry,

For now I will only configure the maxretry setting

This default is five

I have no other setup to do. I will do brute force on my ssh service

Ok this is the attacker's ip address = 80.211.160.46

"proxychains hydra -s 2222 -l admin -P user_pass.txt 217.182.38.175 ssh"

and view the blocks that come with the server

"cat /var/log/fail2ban.log | grep Found"

Today we have implemented the fail2ban systems as your applications. Thank you for reading. Leave me an e-mail for your requests and suggestions berkdusunurx@gmail.com

Read More

Web Application Penetration Testing With WFuzz (Wfuzz İle Web Uygulama Güvenliği Testleri)

Web Application Penetration Testing With WFuzz (Wfuzz İle Web Uygulama Güvenliği Testleri)

   Kasım 28, 2017       Berk Düşünür

---

What İs WFuzz?

WFuzz is a powerful tool for general web security testing where we can perform security tests on web applications, perform XSS and SQL injection tests on our web pages with their own wordlists, and perform page and page directory browsing (BruteForce). In addition to these, Encode (Encryption) is also capable of doing.

How To İnstall Wfuzz?

We download the wfuzz-2.1.3.tar.gz file located in the Downloads section at https://github.com/xmendez/wfuzz/releases/tag/v2.1.3 and open the console. We go to the Downloads folder and open our file and go there:

1) $ cd Downloads
2) $ tar -xvf wfuzz-2.1.3.tar.gz
3) $ cd wfuzz-2.1.3

Wfuzz Parameters

-c = Http allows status codes to output in color.
-z = We will not use wordlist when we are doing Fuzz operation.
-hc xxx = xxx The status code can not be shown on the status code screen.

The number of answers like 404 (Page Not Found) is quite high because some sites have a long scan. So it might make sense to use it.

-d: post request

FUZZ: I want to make a fuzz section

The most commonly used HTTP Status Codes are as follows;

     • 100 = Continue
     • 200 = OK (Successful)
     • 201 = Created.
     • 202 = Accepted.
     • 204 = No Content
     • 301 = Permanently Redirected or Moved
     • 302 = Temporarily Redirected or Moved
     • 400 = Bad Request
     • 401 = Authorization Required.
     • 403 = Prohibited
     • 404 = Not Found
     • 500 = Critical Server Error

    Wfuzz is more than a web content browser:

 • Wfuzz can help you secure your web applications by finding and exploiting web application security vulnerabilities. Wfuzz's web application is supported by security vulnerable browser plugins.

• Wfuzz is a completely modular framework and makes it even easier for the newest Python developers to contribute. The building inserts are simple and take a little more than a few minutes.
     
 • Offers a simple language interface to previous HTTP requests / responses using other tools such as Wfuzz, Wfuzz or Burp. This allows you to do manual and semi-automated tests with the full content and understanding of your actions and context without relying on a web application browser based on the application.

OK. It's so good here. Let's go to practice :)

• Now, when I do content management, we scan the admin panes
   


       wfuzz -c -z file, / usr / share / wfuzz / worldlist / general / admin-panels.txt - hc 404 http://harranbilisim.com/FUZZ
 


       The first time I use this command directory, the -c parameter,
       We wanted it to be colored so the codes could be recognized.
        We will use it with -z file
     
       We made the WordList selection.
       The 404 status code for 137 keywords scanned with -hc 404
       We got a big part back.
       Then we used http://www.agamakala.com/FUZZ.
     
       If you want to make an experiment by putting each keyword in the Wordlist
       we are writing the key word "FUZZ" in capital letters.

   200 returning answers admin user login page 

   Ok we found the panel with the necessary parameters
    Okay Now Scan Sql Vulnerability

wfuzz -c -z file,/usr/share/wfuzz/worldlist/Injections/SQL.txt – hc 404 www.blablablabla.com/index.php?id=51/FUZZ

   Many successful responses have returned

We Can XSS Scanning

wfuzz -c -z file,XSS.txt --hc 404 http://blablablabla.bla/inc/takvim/index.php?month=3&year=2017/FUZZ

   

   Many successful answers have returned now let's check manually

Finding Sensitive Files

WFUZZ with the apache.txt file located under usr / share / wfuzz / wordlist / vulns directory

.htaccess

.htpasswd

.meta

.webm

access_log

cgi

cgi-bin

cgi-pub

cgi-script

Let's test it looking for sensitive files like

wfuzz -c -z file, apache.txt -hc 404 http://blablabla.bla/FUZZ

   We can download the logs and htaccess file and view the contents.

   We are still trying to read server-side etc / passwd with dirTraversal-nix.txt file located under the         

same directory

Did not get any successful results

looking for a windows server-side sensitive file with dirTraversal-win.txt in the same directory

I can with stress testing / usr / share / wfuzz / wordlist / stress / test_ext

Thank you for reading. You can follow me on twitter https://twitter.com/berkdusunur

Read More

MuCyber 2017 CTF Çözümleri

MuCyber 2017 CTF Çözümleri

   Kasım 26, 2017       Berk Düşünür

---

Herkese selamlar çok çok değerli blog takipçilerim :)

25-26 Kasım Tarihleri arasında MUCyber Tarafından düzenlenen CTF yarışmasının çözümlerini hatırladığım kadarıyla aşşağıda paylaşacağım

Öncelikle 1000 puanlık olan Nişasta sorusundan başlamak istiyorum

Joy kategorisinde olan bu soruda bize  8 adet tarih verilmişti. Öncelikle bu tarihlerde gerçekleşen önemli olaylara baktım. Ardından ipucuda paylaşıldıktan sonra (2011 Erzurum)

Bu sorunun üniversiteler arası kış olimpiyatları ile alakalı olduğuna karar verdim bu tarihleri kontrol ettiğim zaman çoğunda yaz ve kış olmak üzere olimpiyat düzenlenmişti 

Bu şehirlerin baş harfleri ile anlamlı birşeyler bulmaya çalışırken "dekstrin" adında Nişastanın içerisinde bulunan maddelerden birini buldum 

Flag değeri ise mucyb3r_{dekstrin} di

Read More

What İs Honeypot ? - Trap Systems - Hacker Hunt (Honeypot - Hacker Avı )

What İs Honeypot ? - Trap Systems - Hacker Hunt (Honeypot - Hacker Avı )

   Kasım 14, 2017       Berk Düşünür

---

What İs Honeypot ? - Trap Systems - Hacker Hunt (Honeypot - Hacker Avı )

Trap computer systems that detect attacks that may come in advance, mislead the attacker against unauthorized access, and time out the attacker

(Gelebilecek saldırıları önceden tespit edip yetkisiz erişimlere karşı saldırganı yanıltan saptıran ve saldırgana vakit kaybettiren tuzak bilgisayar sistemleridir)

It is usually the fragments of a trap that mimic the real system that appears to be part of a computer application or a service that contains a vulnerability

(Genellikle zaafiyet içeren bir bilgisayarın uygulamanın veya bir servisin parçası gibi görünen gerçek sistemin taklidini yapan tuzak parçalarıdır )

Access to honeypots is considered an enemy because there is no reason for the end user to communicate with the imitated trap system. After the Honeypot is examined, the necessary defenses are made

(Son kullanıcının taklit edilen tuzak sistem ile iletişime geçmesi için herhangi bir sebebi bulunmadığı için honeypotlara yapılan erişimler düşman olarak kabul edilir. Honeypot incelendikten sonra gerekli defans yapılır)

What Does Honeypot Do? (Honeypot Ne İşe Yarar?)

Protecting real systems helps to collect data so that the necessary defensive security can be established. It is important in terms of attracting the attacker's attention and saving time.

(Gerçek sistemlerin korunması ve gerekli defansif güvenliğin oluşturulabilmesi için veri toplanmasına yarar. Saldırganın dikkatinin başka yöne çekilip zaman kazanılması için büyük önem taşır)

The Advantages Of Using Honeypots (Honeypot Sistemlerin Avantajları) 

Actual Data Collection (Gerçek Veri Toplama) 

The data collected reflects the truts of more

False Alerts (Yanlış Uyarılar)

Intrusion detection systems and fırewalls mostly gives false alerts. Collects data from honeypot systems but completely accurate 

(Saldırı tespit sistemleri ve güvenlik duvarları genellikle yanlış uyarılar verir fakat honeypot sistemler herzaman doğru veriler getirir)

Usually Free Software (Genellikle Ücretsiz Yazılımlar)

Honeypot systems are usually free and open software. The cost is there most of the time 

(Honeypot Sistemler genellikle ücretsiz ve özgür yazılımlardır. Bu da çoğu zaman maliyeti düşürür)

Basic Systems (Basit Sistemler)

Realistic systems on the user side, and indispensible security

(Gerçekçi sistemleri kullanıcı taraflı arayüz ve güvenlik için vazgeçilmezdir)

Kippo SSH Hacker Hunt Fake Service

https://github.com/desaster/kippo/wiki/Running-Kippo

FTP Hacker Hunt Fake Service

https://github.com/alexbredo/honeypot-ftp

MySQL Hacker Hunt Fake Service

https://github.com/schmalle/MysqlPot

Thank You For Reading

Read More

DNS Amplification DDoS Attack

DNS Amplification DDoS Attack

   Kasım 08, 2017       Berk Düşünür

---

WHAT İS DNS ?

The Domain Name System (DNS) is a hierarchical decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It associates various information with domain namesassigned to each of the participating entities. Most prominently, it translates more readily memorized domain names to the numerical IP addresses needed for locating and identifying computer services and devices with the underlying network protocols. By providing a worldwide, distributed directory service, the Domain Name System is an essential component of the functionality on the Internet, that has been in use since 1985

(Wikipedia)

When I want to go to berkdusunur.net with Browser, the browser first asks me if i can translate berkdusunur.net address to me

The system looks in the / etc / hosts directory. If there is an ip address on the berkdusunur.net domain it will use it.

Otherwise it goes to the DNS resolver provided by DHCP. If not, it goes to the root server.

The root servers in Turkey are called ODTU. From there it is directed to the domain name.

DNS INQUIRIES

By leaving the DNS recursion query on, you allow an attacker to use your DNS on your behalf.

DNS Amplification attacks, a professional attack technique, attack by sending packets to you via a DNS server that is in your domain

(If 1 DNS packet is 50 bytes, this packet will be returned in response to 10x ie 500 bytes).

Thus, the attacker will not only use your bandwidth, but at the same time will also provide his / her own privacy, creating the perception that the attacker is like you.

How do we know if our DNS server is open for the recursion query?

You can learn in two shapes

1. If you want to check the settings of your DNS server

2. From the outside DNS server will do DNS Recursion query.

NMAP RECURSIVE INQUIRY

Using a script located in Nmap it helps to detect the weakness of the dns server 1 to get 10

Let's first scan the DNS server list that we found using this script of NMAP.

Command

nmap -sU -p 53 --script=dns-recursion -iL /home/ceh/Masaüstü/recursive-amp4.txt 

TSUNAMI - DNS AMPLIFICATION ATTACK

Tsunami is making DNS requests to the servers in the DNS list that I specify.In the answer, the changed source leads to ip address as well as to the victim

I have displayed help parameters

After downloading the tool and installing the necessary packages

Attacks

./tsunami -s 192.168.1.80 -p 100 -f recursive_dns.txt

-s = destination address

-p = request to be made by each DNS server (default 1)

-f = command to open the server list

After launching the attack, we listen to the packages coming through the wireshark in the virtual system that we attacked

give me one take ten :) 

www.berkdusunur.net

berkdusunurx@gmail.com

Read More

Wi-Fi DE-authentication Attack (Ağdan Düşürme Saldırıları)

Wi-Fi DE-authentication Attack (Ağdan Düşürme Saldırıları)

   Kasım 08, 2017       Berk Düşünür

---

     This article is broadcasting in turkish and english

Disconnecting can be done by sending De-authentication packets to a device connected to a network.

Bir ağa bağlı cihaza De-authentication paketleri göndererek bağlantı kesilebilir.

ATTACK | SALDIRI

Let's first find the networks that broadcast on the web

Öncelikle çevremizde yayın yapan ağları bulalım

Command  " airodump-ng wlan0  " 

My Target turktelekom_bd63

Benim Hedefim turktelekom_bd63

Let's first expthat broadcast in this address lore the mac addresses
(Bu acces pointe bağlı cihazların MAC adreslerini bulalım)

Command

airodump-ng -c 1 --bssid 98:DE:D0:47:B5:76 wlan0

sddsds

Target Mac Address 3C:A0:67:61:16:B7 

Destination MAC address belongs to Windows device

Hedef MAC adresi 3C:A0:67:61:16:B7

Hedef MAC adresi Windows cihaza ait 

Deauthentication Attacks

Command

aireplay-ng --deauth 2000 -a 98:DE:D0:47:B5:76 -c 3C:A0:67:61:16:B7 wlan0

--deauth number of packages

-a BSSID

-c Client  MAC

İnterface wlan0mon

At the same time, we can create  a loop with the parameter -0 0 

Aynı zamanda -0 0 parametresi ile döngü oluşturabiliriz.

Also, without using the -c parameter we can make a drop-off attack for all devices, not just for a device

Ayrıca -c parametresini kullanmadan yanlızca bir cihaza yönelik değil,tüm cihazlara yönelik bir ağdan düşürme saldırısı yapabiliriz.

İn monitor mode, let's look at the status of MAC addresses at these acces points

Monitor modda bu acces point deki MAC adreslerinin durumlarına bakalım. 

As you can see, the device with the target MAC address is trying to be dropped from the network.

       Görüldüğü gibi hedef MAC adresine sahip cihaz ağdan düşürülmeye                                                             çalışılıyor.

This assures that we have a handshake package that we will use to grab the handshake once the device is reconnected and to infiltrate the acces pointe.

        Bu saldırı cihaz tekrar bağlanınca handshake yakalayıp acces pointe sızmak için kullanacağımız bir handshake paketine sahip olmamızı sağlar.

Thank you for reading

www.berkdusunur.net

berkdusunurx@gmail.com

Read More