Hacking
KSAJ Web Inc. www.PENETRATIONTEST.com
HaX0rz Toolkit
Complicated sploits that need a Bachelors degree to understand and use Scripts in various languages and syntaxes like C, PERL, gtk and bash Automated scanning tools like nmap and nessus A web browser
A Web Browser?
Web surfing:
Is easy to do, Is Operating System independent, Doesnt require intimate knowledge of the system, Provides access to vast amounts of data and information, and topped off with all kinds of data mining tools
Web Features
Reverse phone number searches Detailed address topological maps Satellite photography of target area Resumes Phone and Email lists Likely targets described in detail Exploit information easy to obtain Data aggregation makes it more serious
What Well Learn
Methods of Reconnaissance The level of sensitive detail companies and organizations leave exposed to the Internet The level of detail about specific people on the Internet The effect of data aggregation on privacy
Where to start?
Search Engines are one of the first things people learn to use on the Internet Most use highly effective search algorithms to mine the Internet Most provide equally advanced search abilities to the user
allintitle:Index of /admin
Here is a Google hit from MIT, pulled from the cache
allintitle:Index of / site:mil
Sometimes it works when broken
From an allintitle:Index of /admin search Admin account had been patched But the error information was pretty interesting, too
Within the full page error report was:
Full paths to libraries /home/faraway/opt/cancat/lib /usr/local/share/perl/5.6.1/Apache/ASP.pm /usr/local/lib/perl/5.6.1/DBD/mysql.pm
Search Engines
allintitle:Index of / site:gov site:mil site:ztarget.com filetype:doc filetype:pdf filetype:xls [cached] [view as html] intitle:, inurl:, allinurl: Filetypes include: pdf, ps, wk[12345], wki, wks, wku, lwp, mw, xls, ppt, doc, wps, wdb, wri, rtf, ans and txt
Other Interesting Searches
Far too many password files to bother counting anymore Access and error logs from a hotel chain
Included booking information and how long customers were staying Some very well-known people had their full vacation schedules made available to the public
Military Procedures and Practices
Other Interesting Searches
allintitle:Index of / +confidential filetype:doc A regulatory matters postal letter to an executive at a telecommunications commission, which contained competitor and specific revenue information, and made the following declaration:
The release of such information on the public record would allow current and potential competitors to develop more effective business and strategies
Other marketing Interesting Searches
Searches for WS_FTP.LOG give a rather detailed list of files that are updated regularly, and often provides internal network IP information normally hidden from the Internet Name, job title, phone number, and email address of mailroom staff at major military sites Inter-department electronic funds transfers
Other Interesting Searches
robots.txt files tell search engines dont look here World-readable and in a known location so the search engines will find it easily, and ignore confidential or private directories What do you find when you do look in those directories?
Other Interesting Searches
Passive scanning for vulnerable targets Where to find targets:
Search for phrases commonly found on web-based application interfaces (and especially their error messages) Sites like http://www.securityfocus.com provide information that can be used to create search criteria
Unreported Vulnerabilities
Many vulnerabilities go unreported and unfixed, despite how obvious they are Example:
HAMWeather is a weather software package that allows websites to provide accurate weather information. Geared towards news sites. Does not require authentication for any of its administrative processes Lets search for that administrative program
More Web Hacking
Search engines are a treasure trove of information Weve looked at general web search engines, but lets now look at more information specific sites
Administrative web servers Reconnaissance from the sky Proxies
Administrative Web Servers
Many devices come with web servers ...