Nmapsi: A NMAP GUI

Yet another nmap GUI – NmapSi is a complete Qt-based GUI with the design goals to provide a complete nmap interface for users. This is done for in order to provide easy management of all nmap options.

Features:

• Traceroute
• Dns Lookup
• Search Vulnerabilities
• Full Scan

Currently supports *nix operating systems. Other versions also support the Windows operating systems.

Download NMapSi4 v0.2.1 (nmapsi4-0.2.1.tar.gz/nmapsi4-0.2.1-win32.exe) here

Shodan Dorks or Queries

We wrote in brief about SHODAN here

searching on shodan is just like google

posting as per the dates

http://shodan.surtri.com/?q=cisco-IOS

http://shodan.surtri.com/?q=IIS+4.0

http://shodan.surtri.com/?q=Xerver (REF: http://www.exploit-db.com/exploits/9718)

- November 29th 2009

http://shodan.surtri.com/?q=Fuji+xerox
http://shodan.surtri.com/?q=JetDirect

November 30th 2009

http://shodan.surtri.com/?q=port:23+%22list+of+built-in+commands%22

http://shodan.surtri.com/?q=port%3A80+iisstart.html

- December 1st 2009

http://shodan.surtri.com/?q=Server:%20SQ-WEBCAM

http://shodan.surtri.com/?q=Netgear

http://shodan.surtri.com/?q=%22Anonymous+access+allowed%22

http://shodan.surtri.com/?q=Golden+FTP+Server 

(REF: http://www.exploit-db.com/exploits/10258)

- December 3rd 2009

http://shodan.surtri.com/?q=IIS+5.0 (REF: http://milw0rm.com/exploits/9541)

http://shodan.surtri.com/?q=IIS+6.0

- December 5th 2009

http://shodan.surtri.com/?q=%22Server%3A+iWeb%22+HTTP 

(REF: http://packetstormsecurity.org/0912-exploits/iweb-traversal.txt)

- December 8th 2009

http://shodan.surtri.com/?q=Wordpress

http://shodan.surtri.com/?q=Joomla

http://shodan.surtri.com/?q=Drupal

http://shodan.surtri.com/?q=iPhone+Web+Server

http://shodan.surtri.com/?q=FreeBSD

http://shodan.surtri.com/?q=IPCop

- December 23rd 2009

http://shodan.surtri.com/?q=IBM-HTTP-Server

http://shodan.surtri.com/?q=barra_counter_session

http://shodan.surtri.com/?q=BIGipServer

http://shodan.surtri.com/?q=F5-TrafficShield

http://shodan.surtri.com/?q=st8id

http://shodan.surtri.com/?q=profense

http://shodan.surtri.com/?q=X-dotDefender-denied

http://shodan.surtri.com/?q=X-Cnection

http://shodan.surtri.com/?q=nnCoection

http://shodan.surtri.com/?q=Cneonction

(- Thanks wafw00f!)

- December 24th 2009

http://shodan.surtri.com/?q=PowerDNS(REF: http://www.securityfocus.com/bid/37650)

- January 11th 2009

 http://shodan.surtri.com/?q=ADSL+port%3A80

- January 12th 2010

http://shodan.surtri.com/?q=Default+Password

- February 8th 2010

http://www.shodanhq.com/?q=%22X-Powered-By%3A+PHP%22
http://www.shodanhq.com/?q=%22Sagem%22 

(REF: http://www.exploit-db.com/exploits/11633)

- March 6th 2010

http://www.shodanhq.com/?q=vFTPd+1.31(REF: http://www.exploit-db.com/exploits/11293)

- March 21st 2010

http://www.shodanhq.com/?q=KM-MFP-http (Thanks to: http://www.twitter.com/Motoma)
http://www.shodanhq.com/?q=mod_antiloris 

(This does not work with PyLoris per Motoma.

- April 10th 2010

http://www.shodanhq.com/?q=X-Powered-By:W3%20Total%20Cache

- July 12th 2010

http://www.shodanhq.com/?q=port%3A161+simatic

http://www.shodanhq.com/?q=PLC

http://www.shodanhq.com/?q=scada

http://www.shodanhq.com/?q=bacnet

http://www.shodanhq.com/?q=telemetry+gateway

(aka – SHODAN SCADA)




More, coming soon!

Shodan -Search Engine For Hackers

We all were using Google dorks for long time for finding vulnerabilities but google and other search engines are designed for normal people.Here we have a advanced search engine for hackers SHODAN SUTRI

SHODAN stands for Sentient Hyper-Optimized Data Access Network it is a advnaced search engine which scans server,routers,webcams,ports,ip,load. Why is this dangerous? This is because Google looks at the web content only where as, Shodan can show you in plain text the network part of the host.

For example if we search for IIS4.0 with this query we get Results  about 1113033 for IIS 5.0
and one of the layout of a server

HTTP/1.0 200 OK
Server: Microsoft-IIS/5.0
Content-Location: http://194.170.210.81/pagemoved.htm
Date: Fri, 21 Jan 2011 21:39:14 GMT
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Sun, 07 Aug 2005 04:13:10 GMT
ETag: "e36295269bc51:d96"
Content-Length: 1059

certainly 1113033 results for IIS server is more than handy :)


For firefox users they already developed addon -https://addons.mozilla.org/en-US/firefox/addon/51503/.


Those who believe in learning by watching as we do here we have video presentation on shodan sutri from defcon 18


Shodan-Search Engine For Hackers from shobhit tiwari on Vimeo.


In the next post we will be posting dorks of shodan.Here is the link to SHODAN(click on shodan) website

SQL Data Thief

Here Its “SQL Data Thief” uses techniques Manipulating MS SQL Server using SQL injection, to retrieve information from databases of web applications vulnerable to SQL injection which use SQL Server as a backend database server and doesn’t filter well outbound connections.

Data Thief will extract tha data from tha databases of tha vulnerable web application & also it will display tha data after sending tha data to a SQL Server that you control..Here We Go..

Before using this tool you Guys Find tha Vulnerability in tha web application Or Any Site, And that is Tha Gate entry point to exploit SQL injection,hmmm hum,
Then,Try Using Havij SQL INJECTION TOOL,tat we Discussed Last Week Topic, ACUNETIX is also  Good To Scan Vulnerability..!!

Lemme Assume That U r Visiting something random Today..:)

“http://hackersbay.in/test.asp?search=random” And is vulnerable, than try to find an entry point in tha query string of tha vulnerable url to insert SQL like http://hackersbay.in/test.asp?search=random"’; select 1-- , after that you can start using Data Thief
.
After finding an entry point to exploit SQL injection in tha web application, tha only thing you have to do is to replace in tha SQL injection entry point in tha url query string or in tha Post Data if tha data is submited by HTTP POST method with <***>.
ie: http://hackersbay.in/test.asp?search=random’; <***>

1)
SQL Server : server name of a SQL Server that you control.
Login: login of a SQL Server that you control.
Pwd: login password of a SQL Server that you control.
Port: listening port of a SQL Server that you control.
Max. Rows: maximum number of rows returned in queries from tha victim.




2)
Url: complete url vulnerable to SQL injection.
Method: HTTP method used to submit tha data.
Post Data: data to be send when selected POST method.
Go: submit tha data and retrieve initial SQL Server information (linked servers, databases, version, user, etc.).

After clicking tha Go button tha main window will display :

1)
Linked Servers: displays tha linked servers in tha victim SQL Server.
Databases: displays tha databases in tha victim SQL Server.
2)
Results: displays version, login name, user name, etc. of tha victim SQL Server.


Once databases are displayed In tha Tool you can chose a database and click List Tables button to display tha database tables,And Guys you can set to tha option List system tables to display or not Show tha Fuckin sytem tables.

After displaying tha tables you can chose a table and click List Fields button to display tha table fields.
Than you can select tha fields to build a query that will be submited when clicking Run Query button, tha query will return as much rows you set in tha Max. Rows option.

1)
Tables: displays tha tables in tha selected database after clicking List Tables button.
Fields: displays tha fields in tha selected table after clicking List Fields buton. Tha fields names must b selected to build a query.

2)
Query: displays tha query build with tha selected fields.
Run Query: submits tha query.

3)
Results: displays tha result of tha query after clicking Run Query button. You can cut and paste tha results to import tham in MS Access, SQL Server, etc.

Data Thief also displays in a window tha HTML source code of every response of tha vulnerable Web application after submitions. You can look at tha HTML source code for error messages if Data Thief doesn’t work.

Tips:

-Look in tha HTML window for web application error messages when Data Thief doesn’t work, ie: if firewall is blocking outbound connections you will get : [DBNETLIB][ConnectionOpen (Connect()).]SQL Server does not exist or access denied. error message or a similar one.
-Change SQL Server port number to common outbound open ports at firewalls: 80, 53, 25, etc. if you think 1433 could be blocked.
-Decrease Max. Rows value if you or tha victim server have an slow connection.
-Edit Data Thief source code to fit your needs (or let me know so i can add tham)

Niggas You Kno Wat, Most Hackers Use tis retrieve tha Information, Like Emails ids, Passes, Credit Carders, And More Sensitive Information, And Posting it For Public Bulletin Boards, So If Some1 Posting Stuffs In Boards of Forums, Doesn’t Mean They Hacked Or Root Level Access Escalation, May Be Found Tha Vulnerabilty And they WILL Fetch tha Sensite Information From tha Security LoopHole In the Particular Website..!


TODO

1. -Encode urls, post data to avoid detection.
2. -Display more information.
3. -Add to execute exploits to elevate privileges in tha victim SQL Server depending on version.
4. -Execute OS commands on tha victim server and displays results.
5. -Option to save query results.
6. -Many things.
7. 
   

Offcial Website : http://datathief.org/ there is no more Information Or Tutorials u cant find there But only tha Tool..!!



LikeD it..!!! Drop yo Comments...Seee You :))

Hyenae: A Platform Independent Network Packet Generator

Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant.

Hyenae can be used to reveal potential security vulnerabilities of your network. Besides smart wildcard-based address randomization, a highly customizable packet generation control, and an interactive attack assistant, Hyenae comes with a clusterable remote daemon for setting up distributed attack networks.

Hyenae used by security experts to protect their own networks by attack our their networks before someone else does. This tool can be used to evaluate new security devices how it reacts on different types of attacks. For POC of different web applications , network application, database applications and other customized application of your environment.
In small words Hyenae ca be used for stress test of different applications and devices.

note:this tool might look like just another tool but dont go on looks its really powerful and elastic


Download Hyenae v0.36-1 (hyenae-0.36-1.tar.gz/hyenae-0.36-1_fe_0.1-1-win32.exe) here.

Droidmap: Nmap for Android Phones

Personally I am a android lover and i was very upset when SET and Metasploit were released for iphone and object neopwn :D But here is a good news for android lovers.Nmap is released for android also

 droidmap is an android application for root users that implements some functions of NMAP in a GUI in Android. This program comes with installer scripts for the installation of the required NMAP application that must be run to install the program to your phone. Please note that the installation process requires a Linux environment running the Android developer tools from the SDK and this program requires the Android Debug Bridge (adb) for installation.

This tool will be really handy for engineers who are on roaming profile and need to find quick result for their customers.
Download droidmap v0.0.1 (droidmap-0.01.tar.gz) here

Verisign and responsible disclosure

In a recent post on his company blog, Verisign's vice president of marketing Tim Callan commented on the disclosure of our MD5 collision attack:

Here is the Scene Follow,

VeriSign did not receive any of [the] information ahead of the actual presentation, rendering it impossible for us to begin work on mitigating this issue prior to this morning.

I feel that this statement is inaccurate. Not only did we contact Verisign before our presentation to let them know about our research, we also strongly advised them to stop using MD5 as soon as possible and were given a chance to review their mitigation plans. I hope that Tim Callan's post is a result of a simple miscommunication between the technical people at Verisign their marketing department.

To help clarify this issue, in this post I will provide some background information about the disclosure of our work, as well as the exact timeline of our communication with the affected certificate authorities.
Protecting Internet users

From the very beginning of this project, all members of our team agreed that we needed to disclose this vulnerability without putting any users at risk. There were two main goals we set out to achieve: first, to prevent our rogue CA certificate from being abused; and second, to ensure that nobody else can repeat this attack before the affected CAs get a chance to fix the problem.

We took the following steps to prevent abuse of our rogue CA certificate:

* We did not release the private key for our rogue CA.
* We set the expiration date of the rogue CA certificate to August 2004, ensuring that even if the private key falls into the wrong hands, it will be useless against people who have their system date set correctly.
* We contacted the major browser vendors (Microsoft and Mozilla) to offer them a chance to explicitly blacklist our certificate if they felt that the past expiration date is not effective enough.

To make sure that our work could not be repeated by malicious attackers, we did not release the MD5 collision finding software necessary to do the attack. In addition, we chose to delay the publication of the improved collision finding techniques we had to develop for this project. Our team was confident that the R&D investment required to repeat our attack without access to this information would be prohibitive and the affected CAs would have enough time to stop using MD5 before the attack could be repeated.
Notifying the affected certificate authorities

Since we had already taken steps to ensure that the attack could not be easily repeated, notifying the affected certificate authorities before our presentation was not required in order to protect Internet users. A more important consideration was to ensure that we could present our work at the Chaos Computer Congress without interference. In the last year we have seen multiple cases in which companies have used legal threats in an attempt to silence security researchers and prevent the release of information that exposes their security failures. The most prominent examples include the lawsuit against Dutch researchers who showed fatal security flaws in the MIFARE transit cards and the restraining order that led to the cancelation of a talk about vulnerabilities in the fare collection system of the Boston subway.

Since the affected CAs did not have a significant track record of responding to public security vulnerabiltiies in their systems, we could not be confident that they wouldn't overreact and attempt to stop or delay our presentation through legal or other means. It was this feeling of uncertainty that led to our decision to avoid direct contact with them and to obtain Non-Disclosure Agreements from the browser vendors we contacted.

Recognizing the significance of the issue, Microsoft offered to act as a intermediary and contact the affected CAs on our behalf without revealing our names or the date of our presentation. Their proposal was reviewed by our team as well as our lawyers and on Dec 23 we agreed to go ahead with it:

Date: Tue, 23 Dec 2008 05:21:07 -0500
From: Alexander Sotirov
To: Microsoft Security Response Center

All of the team members agreed with the proposed plan, you can go ahead and
contact Verisign. Thanks for the help with this issue.

Here are the details that you can reveal to Verisign:

1) point them to the 2007 paper that describes the generation of colliding x509
certificates: http://www.win.tue.nl/hashclash/TargetCollidingCertificates/

2) tell them that Microsoft has been made aware that this crypto attack has been
improved and some practical limitations have been worked out, allowing the
successful generation of colliding x509 certificates signed by real
certificate authorities which still use MD5

3) tell them that RapidSSL and FreeSSL (also owned by Geotrust) use MD5 and
are vulnerable to this attack

4) encourage them to move to SHA-1 for all new certificates asap

5) it is important to stress that this attack is a generic attack against
CAs that use MD5 and not specifically targeting Verisign. They have a
good PR opportunity to react quickly and fix the bug before other CAs
They don't want to be the _last_ CA that uses MD5 :-)

If they request additional information from us, please pass the request along
and we'll try to help with what we can. You can call me directly at
XXX-XXX-XXXX if rapid response is required. We would be happy to chat with
Verisign directly on Dec 30, but we'd like to avoid direct contact until then.

The same day Microsoft contacted Verisign and informed them about our research. Verisign understood the severity of the issue and began working on it:

From: Microsoft Security Response Center
To: Alexander Sotirov
Date: Tue, 23 Dec 2008 13:18:09 -0800

We spoke to Verisign this morning, and essentially used your last e-mail as
a script to introduce them to the issue. We also passed along the roots they
own which you identified as affected, and they are reviewing their next steps
right now. They understood the severity of the issue and are taking it
seriously. At this point in time they did not have any further requests for
information.

They were however surprised by the ssl123 certificate: they claim these are
all issued using sha1. The ip address you listed for that certificate is no
longer live, and the hostname in the CN is using another Verisign certificate.
Would you mind if I pass along the subject and issuer information for them to
progress their validation?

I was happy to help Verisign by providing extra information about the SSL123 certificate in question. I also gave Microsoft permission to contact the other affected CA:

Date: Tue, 23 Dec 2008 19:38:09 -0500
From: Alexander Sotirov
To: Microsoft Security Response Center

> They were however surprised by the ssl123 certificate: they claim these are
> all issued using sha1. The ip address you listed for that certificate is no
> longer live, and the hostname in the CN is using another Verisign
> certificate. Would you mind if I pass along the subject and issuer
> information for them to progress their validation?

I have the original cert from that website. I've attached a zip file with all 5
Thawte MD5 certs that I found in the wild, including the SSL123 one. It's a
bit disconcerning that the CAs themselves don't know what algorithms they are
using.

You can give Verisign these certs, I collected them from public websites so
they are not secret in any way.

> The RSA root you listed is in fact also owned by Verisign, so they are
> investigating that one as well. There is one other root which belongs to
> another company, being Chosen Security/TC TrustCenter AG. We tentatively have
> a call scheduled with them tomorrow morning at 8 AM PST. If you can confirm
> that we can communicate the same information to them, this would be
> excellent.

Yes, you can communicate the same information to them.

On Dec 24, Microsoft requested permission to release more information to the CAs:

From: Microsoft Security Response Center
To: Alexander Sotirov
Date: Wed, 24 Dec 2008 09:09:15 -0800

One of the two certificate authorities got back to us and stated they will be
changing their engineering efforts to SHA1 within a *very short* timeframe. We
are literally talking days/weeks here. This is still going to be after your
presentation date. However, they are asking us specifically whether this
timeframe will be acceptable.

We cannot answer any questions on this for now - we are only the "voice box" in
between here. I do feel you should be giving them at least some nod in the
direction that they will still not make it in time, but also that this is not
very critical.

Could I have your permission to release the following statement to them:

"Hi [name],

The finder informed us they will likely take this issue public prior to [your
proposed switch date]. However, he wanted us to convey to you that they will
only be demonstrating that the generation of an “evil twin” certificate is
possible. They will not disclose their collision seeking algorithm, nor will
they be releasing any Proof of Concept code. Given the significant amount of
cryptographic research involved, they feel that their results will not be
repeatable for at least some time. They do plan on releasing a full research
paper on their method, but this will definitely be released much later than
your proposed switch time.

As such they don't feel that making this change will directly affect your
customers. They do think the level of responsiveness you are showing would be a
positive PR opportunity for your organization."

As this statement essentially conveys your plans and opinion, please feel free
to propose any other one with your team or make changes where you deem
necessary.

I promptly agreed to the proposed statement, with some minor edits:

From: Alexander Sotirov
To: Microsoft Security Response Center
Date: Wed, 24 Dec 2008 14:04:40 -0500

> "Hi [name],
>
> The finder informed us they will likely take this issue public prior to [your
> proposed switch date]. However, he wanted us to convey to you that they will
> only be demonstrating that the generation of an “evil twin” certificate is
> possible. They will not disclose their collision seeking algorithm, nor will
> they be releasing any Proof of Concept code. Given the significant amount of

make this "...releasing the software that implements the collision generation."

> cryptographic research involved, they feel that their results will not be
> repeatable for at least some time. They do plan on releasing a full research
> paper on their method, but this will definitely be released much later than
> your proposed switch time.

add "They will wait until all CAs have completed the move to SHA-1 before publishing
the details necessary to repeat the attack."

> As such they don't feel that making this change will directly affect your
> customers. They do think the level of responsiveness you are showing would be
> a positive PR opportunity for your organization."

I agree with this statement. You can share it with all affected CAs.

Alex

On Dec 29, Verisign confirmed that they are planning to stop using MD5 by the end of January.

From: Microsoft Security Response Center
To: Alexander Sotirov
Date: Mon, 29 Dec 2008 13:45:25 -0800

Hi Alexander,

Here is more feedback and contact information from Verisign:

"The SSL123 certs using MD5 are through a legacy reseller platform we are in
the process of EOL'ing. We do still have resellers using it so will need to
make updates to that platform as well.

We are working on making system changes to stop using MD5. They won't all be in
place by January 5th, but will be by the end of January. From what I am reading
below, the key thing seems to be that we are taking measures to stop using MD5
in the short term - so our plan to have all system changes in place by the end
of January should be Ok. Would you agree?

As far as contacts, from a technical point of view they can contact me. My
information, including cell is below. From a PR standpoint, the best person to
contact is Tim Callan - his email address is xxxxxxxx@verisign.com and direct
line is XXX-XXX-XXXX and cell is XXX-XXX-XXXX. An alternative contact for PR if
you can't reach Tim is Tina Hou (xxxxxxxx@verisign.com). She reports directly
to Tim.

Jay Schiavo
xxxxxxxx@verisign.com
Direct: XXX.XXX.XXXX
Mobile: XXX.XXX.XXXX"

Only 5 hours after our presentation, Verisign stopped using MD5 for all new RapidSSL certificates, successfully eliminating this vulnerability.

Cryptographic algorithms can become broken overnight, so it is important for CAs to demonstrate the ability to react quickly to such issues. I'm happy with the reponse from Verisign and the other affected CAs. Based on our experience with them, I would not hesitate to work with them directly on any vulnerabilties I might discover in the future.


This Symbolically tells..!! "SECURITY IS ZERO"