The Power. Chema. of FOCA 3

Transcription

1 The Power of FOCA 3

2 What s a FOCA? 5/25/12 2

3 Al principio fue el Metadato 5/25/12 3

4 Metadata, hidden info Mala ges.ón Mala conversión Opciones inseguras & lost data Buscadores Arañas Bases de datos Mala ges.ón Formatos embebidos Conversión errónea Opciones Inseguras Ficheros embebidos Nuevas aplicaciones o nuevas versiones Ficheros embebidos 5/25/12 4

5 Printers 5/25/12 5

6 Malware Dirigido 5/25/12 6

7 Targeting Malware 5/25/12 7

8 Electing the entry point 5/25/12 8

9 Social Engineering Attack 5/25/12 9

10 Anonym0us case 5/25/12 10

11 Lost Data 5/25/12 11

12 Metadata Risks Relaciones Ocultas Historia de Acciones Entre empresas Entre personas Piratería de Software Información táctica Ataques 5/25/12 12

13 Drug Dealer 5/25/12 13

14 Forensic FOCA hjp:// 2012/02/forensic- foca- beta- 5/25/12 14

15 Show Me Your Metadata 5/25/12 15

16 Internal Fingerprinting with FOCA 5/25/12 16

17 Phase 1: Metadata

18 FOCA 2 5/25/12 18

19 FOCA 2.5: Exalead 5/25/12 19

20 Network Discovery 5/25/12 20

21 Búsqueda de URLS en buscadores 5/25/12 21

22 Bing IP 5/25/12 22

23 Shodan 5/25/12 23

24 Network Discovery: Well Known Records Zone Transfer DNS SOA, MX, SPF, DKIM, LDAP, VoIP, Active Directory. AXFR Diccionary Search Server1, Intranet, Private, DNS, etc. 5/25/12 24

25 PTR Scannig 5/25/12 25

26 Huge domains case 5/25/12 26

27 Network Discovery Algorithm 1) http -> Web server 2) GET Banner HTTP 3) domain.com is a domain 4) Search NS, MX, SPF records for domain.com 5) sub.domain.com is a subdomain 6) Search NS, MX, SPF records for sub.domain.com 7) Try all the non verified servers on all new domains 1) server01.domain.com 2) server01.sub.domain.com 8) Apple1.sub.domain.com is a hostname 9) Try DNS Prediction (apple1) on all domains 10) Try Google Sets(apple1) on all domains 5/25/12 27

28 Network Discovery Algorithm 11) Resolve IP Address 12) Get Certificate in 13) Search for domain names in it 14) Get HTTP Banner of 15) Use Bing Ip:IP to find all domains sharing it 16) Repeat for every new domain 17) Connect to the internal NS (1 or all) 18) Perform a PTR Scan searching for internal servers 19) For every new IP discovered try Bing IP recursively 20) ~chema -> chema is probably a user 5/25/12 28

29 Network Discovery Algorithm 21) /, /~chema/ and /~chema/dir/ are paths 22) Try directory listing in all the paths 23) Search for PUT, DELETE, TRACE methods in every path 24) Fingerprint software from 404 error messages 25) Fingerprint software from application error messages 26) Try common names on all domains (dictionary) 27) Try Zone Transfer on all NS 28) Search for any URL indexed by web engines related to the hostname 29) Download the file 30) Extract the metadata, hidden info and lost data 31) Sort all this information and present it nicely 32) For every new IP/URL start over again 5/25/12 29

30 Click & Go 5/25/12 30

31 Phase 2: Network

32 How Foca found a data 5/25/12 32

33 Role Oriented View 5/25/12 33

34 Fingerprinting 404 Not Found Options messages Domain names and software Aspx Error Messages HTTP Banner Hostname IP Addres SMTP Banner Digital Certificates Shodan 5/25/12 34

35 DNS Version.bind 5/25/12 35

36 Primary Master 5/25/12 36

37 Vulnerabilites View 5/25/12 37

38 Phase 3: Vulnerabilities

39 Customizable Search 5/25/12 39

40 FOCA + Spidering 5/25/12 40

41 FOCA + Spidering 5/25/12 41

42 Digital Certificates 5/25/12 42

43 FOCA 2.5 URL Analysis 5/25/12 43

44 .listing 5/25/12 44

45 Unsecure Http Methods 5/25/12 45

46 Search & Upload 5/25/12 46

47 Proxy 5/25/12 47

48 Fuzzing options 5/25/12 48

49 DNS Cache Snooping 5/25/12 49

50 DNS Cache Snooping 5/25/12 50

51 DNS Cache Snooping Internal Software Windows Update Gtalk Evilgrade Detecting vulnerable software to Evilgrade attacks AV evassion Detecting internal AV systems Malware driven by URL Hacking a web site ussually visited by internal users 5/25/12 51

52 DNS Cache detection 5/25/12 52

53 Log filter 5/25/12 53

54 FOCA Reporting Module 5/25/12 54

55 FOCA Reporting Module 5/25/12 55

56 Fear The FOCA 5/25/12 56

57 FOCA Online 5/25/12 57

58 Cleaning documents OOMetaExtractor hjp:// 5/25/12 58

59 IIS MetaShield Protector hjp:// 5/25/12 59

60 FOCA on Linux? 5/25/12 60

61 Buy a FOCA T-Shirt 5/25/12 And be «Sexy» }:)) 61

62 Questions? 5/25/12 62