Build Your First Scanning Tool - Simple intro to Python & Sublime Editor

Intro

Hi,

In today's lab we will learn how to make a tiny scanning tool that will help us understand a little bit more about how the network works and how an attacker can utilize in-the-wild resources in order to gain useful information.

Before we start coding, let's remember that this usage is malicious and it is strictly forbidden outside the lab (not including homework testing).

What are we going to do?

Ok, so a hacker can gain information from the network by simply querying it. But what does querying means?

 

So as we can see, opening a socket is just like opening a phone call with a friend. One difference is that we're not noticing the amount of data that is being transferred while being concentrated on talking to each other.

For use humans its only 'chit-chat'. For the wire-hacker it is a chunk of useful information J

What is being streamed over the line?

We'll divide it into 2 main categories:

1.     Header

2.     Body or Message

The Header is every piece of information that is not being transferred as message, while message is… well… message is the content that both humans were interested in, before they picked up the phone.

Header information: Phone number for caller, Phone number on receiver, Service name (Service Provider), Language, Is the conversation still on, Hang-up method etc.

Message information: John: "Hello Gil, How are you?", Gil: "Hi John! I'm great. Thank you for asking."

By the way: when calling a friend, we as entities are also in charge of some Header values.

Example: Gil can end the call whenever she wants, by pressing the END button.

Now that we know we would like to start a conversation in order to get information, think of a situation where John doesn’t want to talk to Gil, but still knowing she's at home.

Trying to call, hearing her voice and immediately hang-up is one way. Can you think of other ways?

What if John wants to know if there are other phones in Gil's house?

What if through the phone, John could somehow call Gil's fax machine, or even her computer?

In order to get that information we have to query, remember?

We want to call and get the Header. Or we can look in the white-pages for more phone numbers related to Gil and start calling them, just to check if its ringing or not (just like a Ping).

ToolKit

First we will need to find a language that we can write our code in. 

I know that .NET and Java are very comfortable and can autocomplete stuff, so we're going to use Python.

Not just that. We're going to make it a little more interesting by using another open source tool.

Why? So we can write our Python code in it. Yes, we can use the Python Idle, but let's start with this one.

This tool is a Text Editor with abilities to read/write and execute scripts. Compiler is not an option for this lab.

Please download a very close friend of mine: SublimeText

That’s it. You're ready for action. J

Instructions

1.     Open Sublime Text

2.     Open a new label by going to File >> New File or simply hit Ctrl+N

3.     Write import socket (grey color)

4.     Save it as .py file (Python extension). It supposed to change the string to import socket

***if it doesn't work - download SublimeREPLit is an addon to get a Python Shell. (and a lot more!)

Goals

We are building a scanning tool, so we would like it to have the following abilities:

1.     Ping Sweep – scanning multiple remote machines using the "Ping" software.

2.     Port Scanner – Scanning a target for open ports.

3.     Banner Grabbing – Grabbing a banner (Header) from the conversation and investigating its content.

Let's see an example shall we?

Ping Sweep:

Scanning 1.1.1.1 should return:

1.1.1.0     Is UP!

1.1.1.1     Returned time out (means it is not answering, but could be open)

1.1.1.2     Is UP!

1.1.1.255 is UP!

Port Scanner:

Scanning 1.1.1.1 for ports [21, 22, 25, 80, 443, 3306] should return:

Port 21 (FTP) is open

Port 22 (SSH) is open

Port 25 (SMTP) is closed

Port 80 (HTTP) is open

Port 443 (HTTPS) is closed (no SSL connection, what an attacker will think about it?)

Port 3306 (MySQL) is open (juicy information)

Banner Grabbing:

Scanning 1.1.1.1 on port 80 with (GET / HTTP/1.1) should return:

HTTP/1.1 200 OK

Host: 1.1.1.1

Server: Apache/2.2.3

X-Powered-By: PHP/5.3.27

….

 ** 1.1.1.1 is not a real address. Use a Wi-Fi address at home and connect other devices to it.

You - 10.0.0.3

Rauter - 10.0.0.1

Printer - 10.0.0.2

Mobile - 10.0.0.4

Now that we know what we want to do. Let's start working.

Coding

Import the Socket and Subprocess modules:

import socket import subprocess

Socket is a built-in module for easy creation and connection to TCP/UDP and other sockets.

This module provides access to the BSD socket interface. It is available on all modern Unix systems, Windows, Mac OS X, BeOS, OS/2, and probably additional platforms.

Subprocess module allows you to spawn new processes, connect to their input/output/error pipes, and obtain their return codes.example - CMD

Now let's write the first function, follow my lead:

Ping Sweep

First line is the function. 

Blue for definition of public function,

Green for function name, Orange for stored variable and function variables and Yellow for strings.

To get the ping communication we have to use the Subprocess module. Subprocess has a common function called Popen() which receives 3 arguments: 1^st is an array with command and host and the other two is for piping the information from the process to 2 other arguments stdout, stderr

One takes the message and the other takes the error.

You can see the payload from subprocess.Popen is being imported into ping variable. ping will than receive an "extensions power-up" (i.e. inherit functions from subprocess) and will be able to use a function called communicate(). This function returns 2 values in correlation to the 2 arguments we set in Popen().

The out variable will return from the function, but not before we will parse some information from this big payload. We don't need all the information, so we will look for a pattern like IP:

[+] m = re.search | re stands for Regular Expressions and search is simply a search in content.

What is the content you ask? search receives 2 arguments: 1 is what to look for and 2 is the content. As for this example: 2 is out which is our ping payload, for example–

C:\>ping 1.1.1.1 Pinging 1.1.1.1 with 32 bytes of data: Request timed out. Request timed out.

So if we want the function to work, we need to add:

import re

Right under the other imports.

But what is this:

(\d+\.\d+\.\d+\.\d+)

Well [\d] is a digit placeholder in Regular Expression language. [\.] Is simply [.], because [.] means "every character".

Adding a [+] sign means we are looking for more than 1 digit. 1 or more to be exact.

So we have [\d+] (digits) [\.] (dot) repeated 3 times and ends with [\d+] (digits) – IPv4 representation!

*** 1234.1234.1234.1234 is also a valid output... Can you fix the Regex to receive only IPv4?

That’s it! We have a Ping command. Later we will create a loop to create the Ping Sweep

Moving forward:

Port Scanner

So what do we have here? 

First we have the function and name, but that you already know. The function takes 3 arguments.

We can't be sure that the protocol value will be in the same case (lower, upper) so we use the upper() function which will turn this "tcp" into this "TCP", because Python is case sensitive.

Then we will use the Socket module (import socket) as followed:

We've created a variable called "tcp" that receives socket with AF_INET (which means – I'm using IPv4) and the SOCK_STREAM (which means – I'm using TCP).

How can we represent IPv6? And UDP? Find out!

The socket.connect() function will create a TCP handshake using the tuple of 2 arguments (host, port) and internal variables which are being automatically loaded by the socket module.

Then, if the port is not 80, we will use a general "Hello" string and if it is 80, we will generate an HTTP request (GET/POST/HEAD…)
***Yes, other socket methods such as SSH, FTP over TCP has conventions and syntax, but I'll leave it to you to find out.

Finally we need to somehow capture the response from the communication we've created with the remote server. Using recv() with size of payload (200) (i.e. approximately the size of a header) we can capture the right information we need to return the header data.

If you want more data simply increase the value of recv().

That’s it! Port Scanner is done. Easy right J

Banner Grabbing

Hold on. Banner grabber is our longest function.

Ok, so we have a bit more code here. 

Let's dig it up.

First of all we have the same function declaration. This time the function name is bannerGrabbing.

Than we have a variable called header which will receive data coming from the portScanner() function.

Why, you ask? Because we need to open a TCP socket anyways, so instead of implementing the same code twice, we will just use our function.

Header will receive payload such as:

SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7

HTTP/1.0 200 OK 
Content-type: text/html 
Date: Wed, 12 Mar 2014 20:29:52 GMT 

Server: Apache/2.2.3
Connection: close 

X-Powered-By: PHP/5.3.27
Cache-Control: no-store 

220 FTP version 1.0 ready at Wed Mar 12 19:52:27 2014 
530 User anonymous cannot log in. 
Login failed.

And more.

What we need is to parse those banners and identify if we can extract valuable information.

Continuing with the code, if header has data in it, we will try to look for information.

If the port is 80, means HTTP, we're looking for the Server: banner using the Regular Expression re.search. This will give us information about the operating system. For instance – IIS is installed only on Microsoft Windows machines. Nginx and Apache could be a Linux web servers, but can also be installed on a Windows machine (not so common).

Plus, SSH utility is only supported on Linux, So we can gather information using multiple ports.

If port 80 has an Nginx server and port 22 is open (SSH), that means it's a Linux server, right?

We can also see it in the example above: Debian-3ubuntu7

We are also searching for X-Powered-By header which maybe result in disclosing the back-end language and its version.

Then we're simply looking for SSH, FTP and MySQL. We can extend it to look for more banners, but its enough for now.

service_name = re.search(re.compile('SSH', re.I|re.M), header)

As for lines like the above: when using re.compile we need to supply another argument along with the string we're looking for.

This argument re.I and re.M stands for Ignore case (case sensitivity) and Multi-line for multi-lined payload parse.

Service_name will not return as string so we are using group(0) to get the string representation.

Moving forward to our next block of code:
**notice that the if __name__=='__main__': line indicates the interpreter that it starts the script execution from that line down.
It means that the above lines are class/func/... and other pieces of code which are callable.

Help manual

This is very self-explanatory once you look at the menu: 

C:\proj>python portScanner.py Usage: portScanner.py [options] Options:   -h, --help          show this help message and exit   -t www.exemple.com  Enter target name or ip   -i TIME_INTERVAL    Time interval between each scan in milliseconds   -p [TCP/ICMP]       Returns the type of scan.   -b BANNER           Set to 1 for Banner Grabbing C:\proj>

The only thing that is not in the menu is dest, which stores the value of the argument.

If dest="banner" and the user supplied –b something

Then now options.banner = "something". The type is optional, but it is very good for input validation.

Ok so we have the manual. Now we need to write an else statement to that last if.

The last if states that if the user did not supply a targethost and/or a protocol (-t or -p), than the menu will pop again and the program won't start.

In the else statement we first like to make the options clearer, so it is recommended to transfer the values into shorter variables. 

From here on out, you're on your own!

Coding yourself

1.     For c:\>python Scanner.py –t example.com –p ICMP

a.     Call pingSweep with loop.

[Hint – if example.com translated to 12.15.75.53 you need to grab 12.15.75. and start appending range(1,254)]

b.     Use Regular Expression module to slice the IP string.

[Hint – parsed_ip = re.search(r'HERE_COMES_YOUR_RE', ip)

To switch from host to IP use: ip=socket.gethostbyname(host)]

c.     Figure out how to return if the host is UP or not. If UP return – [IP number] is UP!

Else: return the ICMP replay (time out, destination unreachable).

2.     For c:\>python Scanner.py –t example.com –p TCP

a.     Return portScanner for the list of ports in the above code snippet

b.     If port is open return "port %s is open" % (port)

Else: "port %s is closed" % (port)

**the % after the string is a reference for the %s place holder.

3.     For c:\>python Scanner.py –t example.com –p TCP –b 1

a.     Return bannerGrabbing + portScanner

[Hint – create a loop of port numbers from ports array that returns the banner payload]

b.     Use try: and except: to capture errors. Return "Error" on except

4.     For c:\>python Scanner.py –t localhost –p UDP

a.     Create a client in our code, where the if UDP comment is, that simulates a UDP client (sends data through UDP to a fixed port (say 5454)).

b.     Create another python file called server.py that will listen to the same port (on localhost).

[Hint – UDP does not use connect(), it uses bind() from socket module.]

*To send and receive data through UDP, both files should run simultaneously.

                

Good Luck!

WAMP2 HTTPS and SSL Setup Step-by-Step guide

****************
****Step1****** -> Create SSL Certificate and Key
****************

1a) Open the DOS command window and change directory to bin directory of wamp apache directory by using the DOS command without quotes: "cd /d c:\" and then "cd wamp\bin\apache\apache2.2.8\bin". apache2.2.8 should be changed to what apache folder your wamp server has.

After done, the DOS prompt should look like: C:\wamp\bin\apache\apache2.2.8\bin>

1b) Create a server private key with 1024 bits encryption. You should enter this command without quotes:
"openssl genrsa -des3 -out server.key 1024". It'll ask you a pass phrase (password), just enter any password you like '
1c) Remove the pass phrase from the RSA private key (while keeping a backup copy of the original file). Enter this command without quotes: "copy server.key server.key.org" and then "openssl rsa -in server.key.org -out server.key". It'll ask you the pass phrase, just type it.

1d) Create a self-signed Certificate (X509 structure) with the RSA key you just created. Enter the command without quotes: "openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out server.crt -config C:\wamp\bin\apache\apache2.2.8\conf\openssl.cnf".

You might combine step1b, 1c and 1d into one step by using this command, no quotes: "openssl req -new -x509 -nodes -out server.crt -keyout server.key" if you have trouble following through.

You'll fill in the information after entering this command. The correct location of config file, openssl.cnf may need to be changed. In windows, you won't see ".cnf" extension of the file openssl, but in DOS you'll see the full name openssl.cnf.

1e) Create a real SSL server certifcate (Optional): if you don't want step 1a to 1d
A. Create a server RSA private key for your Apache server (Triple-DES encrypted and PEM formatted):
Type command: openssl genrsa -des3 -out server.key 1024

You might keep the backup of server private key in a maximum secure place and guard it well (e.g
your digital wallet).

B. Create a Certificate Signing Request (CSR) for public (output will be PEM
formatted). A CSR is a file containing your certificate application information, including your Public
Key. Generate your CSR and then copy and paste the CSR file into the webform in the enrollment
process at your certificate authority website:

Type the command: openssl req -new -key server.key -out server.csr


You will now be asked to enter details to be entered into your CSR. What you are about to enter
is what is called a Distinguished Name or a DN. For some fields there will be a default value, If you
enter '.', the field will be left blank. Use the name of the webserver as Common Name (CN). If the
domain name (Common Name) is mydomain.com append the domain to the hostname (use the
fully qualified domain name).

Depending on a specific certifying authority (CA) you might have to enter the details as specified by
them. Normally, the CA authority will provide specific instructions for you.

C. Now all you have to do is sending this Certificate Signing Request (CSR) to a Certifying Authority
(CA) to be signed. A trusted CA means all major web browsers recognize it without giving you a
warning when you install your CA-signed SSL certificate on your webserver. Once the CSR has been
signed, you will have a REAL Certificate, which can be used by Apache. You can have a CSR signed
by a commercial CA (fees are required). Then they will send you the signed certificate which you
can store in a server.crt file
D. Once, your CSR certificate has been signed and returned to you, you can view the details by using
this command: openssl x509 -noout -text -in server.crt


****************
***** Step2***** -> Copy the server.key and server.crt files.
****************

2a) In the conf folder of apache2.2.8 folder, create two folders named as ssl.key and ssl.crt

2b) copy the server.key file to ssl.key folder and server.crt file to ssl.crt


****************
****Step3****** -> Edit the httpd.conf file and php.ini
****************

3a) In httpd.conf file, remove the comment '#' at the line which says: LoadModule ssl_module
modules/mod_ssl.so

3b) In httpd.conf, remove the comment '#' at the line which says: Include
conf/extra/httpd_ssl.conf
Then move that line after this block <IfModule ssl_module>.... </IfModule>

3c) open the php.ini file located in apache2.2....\bin folder, remove the comment ';' at the line
which says: extension=php_openssl.dll

***************
****Step4***** -> Edit the httpd_ssl.conf file in the folder name, extra
***************

4a) Find the line which says "SSLMutex ...." and change it to "SSLMutex default" without quotes

4b) Find the line which says: <VirtualHost _default_:443>. Right after it, change the line which says "DocumentRoot ..." to DocumentRoot "C:/wamp/www/" with quotes. Change the line "ErrorLog...." to Errorlog logs/sslerror_log. Change the line "TransferLog ...." to TransferLog logs/sslaccess_log


4c) SSL crt file: Change the line "SSLCertificateFile ...." to SSLCertificateFile "conf/ssl.crt/server.crt"


4d) SSL key file: Change the line "SSLCertificateKeyFile ...." to SSLCertificateKeyFile "conf/ssl.key/server.key"


4e) Change the line which says <Directory "C:/Program Files/Apache Software Foundation/Apache2.2/cgi-bin"> or something similar to <Directory "C:/wamp/www/"> and add the following lines inside those <Directory ... >...</Directory> tags:

Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all

4f) Make sure the line CustomLog "logs/ssl_request.log" \
is uncommented (remove the #). This step is suggested by wmorse1.

**************
****Step5**** In the previous DOS Command windows, enter httpd -t . If it displays Sysntax is OK, then
************** go to Step 6. If not, then correct the wrong syntax and redo step 5.

If you have any problem of restarting your Apache, check your logs. 

Try 1 of the following steps:

1. create a sslaccess.log in your logs directory

2. copy/paste the 'openssl.cnf' to /bin and /conf.

**************
****Step6***** -> Restart the Apache server
***************


**************
****Step7**** -> if restart is successful, then open the browser and enter "[localhost"]; without
************** quotes.

**[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)**

This SSL certificate is self-signed, your own Certificate Authoirty (CA). The log shows a warning but not error message. Consider buying a CA certificate from VeriSign if you want to make the warning msg disappear. Procedures will be slighly different at step 1d then.

*************************
****Step8 (Optional)**** -> If you want to allow world wide web access to your HTTPS secure server, then
************** ********** in the httpd_ssl.conf file, change the line which says 'ServerName localhost:443' to 'ServerName www.yourwebsitename.com:443' without quotes. yourwebsitename is your registered internet domain name. If you don't have it, then just use your WAN IP address. For example 'ServerName 99.238.53.105:443'. Make sure these setups are correct to allow outside access to secured www server.

8.a The DocumentRoot you modified in step 4b points to the correct website folder on your
computer.

8.b If your computer's connected to the router, setup the router to allow port 443 forwarding to your
computer.

8.c If your computer has a firewall enabled or behind a network firewall, set up the firewall to allow
incoming port 443 connection.

Oh....Just an FYI, close your security Hole for MySQL if you have not already done so. MySQL allows access to 443

8.d If you like to work with your localhost on port 443 without closing port 80, simply add a '.htaccess'

file to your /wamp/www/ directory and copy/paste this into the file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) []%{HTTP_HOST}%{REQUEST_URI}

Web Proxy [Burp] - Third Session

Last time we finished talking about the Web Proxy and it's features. 

We learned how to use some of the main functions, such as: Intercepting packets, Targeting them and Repeating requests.

Today we're gonna discuss about the Intruder.

although i'm not a big fan of the Burp's Intruder it is a nice tool to start with, for those who haven't experienced Brute Force attack yet.

So first thing first, Brute Force Attack - is a strategy that can, in theory, be used against any encrypted data. Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It involves systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire search space.

Now after we know what Brute Force attack is, let's try an understand the Intruder. 
After I promise to add a nice example  

Let's calibrate our Burp with our browser like i tought you, and step in to the Proxy label.

Now open your browser on this link: http://phone.ipkall.com/login.asp

IPKall phone number : aaaa
Password: admin

don't press submit yet!! double check that your proxy-->intercept label is ON.
Now after you'll press Submit, the form will be sent and stop on the Burp's Intercepter.
Is the Burp's icon blinks? Good, now move back to the Burp's intercept label.. do you see the code?

CODE: SELECT ALL

POST /process.asp?action=verify HTTP/1.1
Host: phone.ipkall.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Origin: http://phone.ipkall.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://phone.ipkall.com/login.asp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: he-IL,he;q=0.8,en-US;q=0.6,en;q=0.4
Accept-Charset: windows-1255,utf-8;q=0.7,*;q=0.3
Cookie: ASPSESSIONIDQQQBBSTR=BPPECJCBBONJIMBIPPKNGEHF
Content-Length: 40

txtDID=aaaa&txtPswd=admin&submit1=Submit

POST request is sent to our host containing this page: /process.asp?action=verify
But we don't have a phone number or a password related to this domain... Now What??

O.k. so press right click with your mouse and pick "Send to Intruder" (#3 from the top).
Now go to the Intruder label.. what do you see?
4 sub-labels - Target, Positions, Payloads and Options.

Target - easy... your host and port.. 80 means HTTP and the SSL option is for ports like 443 (HTTPS) - important to read more about Ports and SSL Protocol.

Positions - Here you can see that Burp identified the page and marked a few parameters with this S note - §verify§.

Payloads - This label used to configure the inputs that will be injected between the two §§ .. the attacker inputs a payload set, and gets an estimated amount of payloads and requests for his attack. This way he can verify rather he needs to pick less or more notes, depend on the time line he has for this attack.
an attacker can also input certain rules or deside whether he want to encode dangerous notes or not.

Options - Irrelevant at this point.

Go back to Positions:
This (§) strange note signals the place you want to inject your input. 
But where do we want to inject our input?!... well.. for Brute Force Attack we want to inject the form's Text Fields!
But where R they?.. in the browser it's easy to recognize them... but here it's all one big packet of code!!
Well guys... the trick is to mark them! just like last lesson when we marked the value's parameter with 123
than looking for that string on the respond page in order to inject malicious code. Same goes here..
We wrote some values before we clicked Submit. those values are familiar to us because we used values that unlikley to appear differentlly.
Let's look for 'aaaa' and 'admin'..

Here it is:
txtDID=§aaaa§&txtPswd=§admin§&submit1=§Submit§

Now we know we want to inject the code inside those parameters: txtDID, txtPswd.
There are multiple ways to inject:
1. I have a stolen DID but no Pswd.
2. I have a stolen Pswnd but no DID.
3. I Don't have neither one of them.
and maybe a few more, but those are the main ones.

So let's investigate those three so we will know how to use them:
1. If i have one DID and I want to find it's Password - 
at the Positions, leave the txtDID with the string you have, say 'Admin'.
Now empty the txtPswd so it will look like this §§ and erase all other § notes.
It should look like this: txtDID=Admin&txtPswd=§§&submit1=Submit
Now we'll go to Payloads and do the following changes:
a. pick 'Brute Forcer' from the roller bar.
b. select charachters to use. (if the form is case sensitive, add ABCD...XYZ).
c. edit Min. and Max. length.
d. go to the Burp's top bar ---> Intruder ---> start attack.

2. If you have one Pswd and you want to find the DID - 
Same as (1), but the code should look like this: txtDID=§§&txtPswd=Admin&submit1=Submit
take the same steps.

3. Same here, Code : txtDID=§§&txtPswd=§§&submit1=Submit 

Now when you press the 'Start Attack' option, a window will pop, opening a run-time chart
which is actually attacking this page right now. 
On the top bar of that window - press attack ---> pause.
Now look at the chart - the most important culomn you need to mind is the Length!
Most of the pages will appear at the same length, but the right values will change the size of the page
meaning they baypassed the authentication.

Repeat this action a few times on different forms. Later on I will teach you about a nice tool called Bruter. More, I'll show you a nice and easy brute furce attack that i did a few month ago.
It is far more usefull.

See ya next time when we discuss the Spider. 

Thank you for reading.
You're welcome to promote me with inboxing the uTest team.

Cheers,

Ce@ser