INT DB TWiki Update

Hey guys,

INT DB has it's first update, here is the changelog:

• Fixes configure script error.
• Includes ExitPlugin to take care of the referrer problem.
• Cleans up previous session log files on start up.
• Includes security notes in regards to document attachment.
• Includes POI, Enumeration and alphabetically sorted list templates. 

Besides fixing some bugs, the new INT DB TWiki will clean up the log files when you start it and also solves the issue of referrer leakages, using the ExitPlugin it will automatically redirect to any link using anonym.to, you can configure another link anonymizer if you wish.

The screenshot in this post is from the Person Of Interest Template, when you create a new page you'll be asked what template to use, there you can select it or also one of the other two included templates, one is a table to enumerate stuff, like your Intelligence requirements, and the other is an alphabetically sorted table to store links to your POI dossiers for instance.

I'm working on a file so you can install easily the INT DB in an already running TWiki installation, so you can use it in other OSs just installing Apache by yourself, soon there will be news about it.

FULL DOCUMENTATION AND DOWNLOAD LINK HERE

INT DB Portable TWiki

While doing the IPB course at culperinstitute.org I discovered that the amount of information you have to handle to be able to satisfy your intelligence requirements is huge and will require to be updated often.

I didn't find an already existing tool, and that's why I thought that a wiki page could help, because it's easy to update, can include media files and also keeps track of the changes you made, bad thing about a wiki is that it needs a webserver to run, and not tech-savvy guys will find really hard to set up one. INT DB solves that problem because with just one click you'll have a running wiki that leaves no trace of use in your computer.

INT DB is based on TWiki for Windows Personal but it includes the latest version of TWiki 6.0 with WYSIWYG editor, Tinyweb webserver, Perl and GNU Grep, all of it ready to use, no installation is required and it won't create entries in your registry.

You'll see that the INT DB home page is a plain wiki page for you to start working on, if you can create templates, cheat sheets or whatever may be helpful for our purposes, please contact me and I'll include it in a new version.

FULL DOCUMENTATION AND DOWNLOAD LINK HERE

PHD - Portable HTTP Debugger

.
Last year I coded this Java HTTP Debugger mainly to use it both in my win and linux boxes. Some
time after that I discovered I could use HAS under wine and it worked like charm so I discontinued
this project.
Anyway... If you don't have wine or the permission to install it in your box, maybe PHD can help
you.

http://sites.google.com/site/apx808/Home/phd.jar

P.H.D. Portable HTTP Debugger
Coded by APX, Buenos Aires 2008

Contents:

1 - Intro
2 - Use
3 - Thanks
4 - Version history


[1 - Intro]

I needed a HTTP Debugger for my Linux box, and I couldn't find one,
I hate not being able to use the same tools both in my Win and Linux
boxes, so I decided to create a new HTTP Debugger based on Triton's
one.
The main idea was to create a simple to use, multiple platform HTTP
Debugger, and this is the result.

[2 - Use]

I wont explain how to use a HTTP Debugger, but I want to explain some
options you can find in the app.

* Remove response headers: Activating this checkbox, only the response
body will be shown.

* Log: You can save all the responses you get to a file.

* Save Selected: Select a text in the response and press this button to
save the selection to a file.

* View: This will create a temp file with the response body and will
open it in the default browser.

* Clean: Use it to clean the responses.

* Auto Clean: If selected the previous responses will be cleaned on each
request.

[3 - Thanks]

I should thanks a lot of people, but I would like to thanks specially
Rhino for his great tools and inspiration, Ex0rphine my fellow fooking
cowboy for his help with the code and beta testing, and to the beta testing
team, for helping me to polish this app, Falk0n, Lausbub, Zyrrox, thanks
a lot guys.

[4 - Version History]

28-04-2008 - Project starts.

01-05-2008 - v1.0 starts being beta tested

11-05-2008 - v1.1 released.

* Remembers last urls and posted data used.
* Auto Clean option added.
* Patched chunked replies.
* Started using non blocking socks.

14-05-2008 - v1.2 released.

* Patched problem handling normal responses.
* Patched post data encoding.
* Now auto fixes bad formatted requests.

20-05-2008 - v1.21 realeased.

* Patched post data encoder encoding already encoded by the user data.

EOF

.

Scylla v1.0b

.
Sometimes when you are exploiting a path traversal, you can't find a file, that could be frustrating.
Scylla will let you generate Triton exploit paths to scan for a target file in multiple locations.

You'll need java 1.6 to use it, so it will work in any box except for MacOS 10.4.9... Shit happens
when you depend of a monopoly

If you have any suggestion, bug reports, money, girlz or whatever PM me or send me a mail.

I hope you find this tool useful guys.

md5sum: 8cbf46a3a563bce13226dbba661fb551
sha1sum: ac4a0faad310658cd3dc603abe26a0bb391d2801

Download:

http://sites.google.com/site/apx808/Home/scylla.jar

Scylla - Triton paths generator
Coded by APX, Buenos Aires 2008
th4 f00k1ng c0wb0ys c0d1ng t3am
apx.808 [@] gmail.com

Contents:

1 - Intro
2 - Use
3 - Thanks
4 - Version history


[1 - Intro]

It's common in path traversal exploits to have problems
finding a file, httpd.conf anyone?
Well, the aim of this app it's to solve this issue.
Scylla will create a Triton exploit paths list to scan with
the different locations to search that you specify.

[2 - Use]

-Load the xploit data manually or using the "import" option
to import from a Triton exploit file.

-Add the tag "<PATH>" to the place you want Scylla to add
the posible locations. Also, don't forget that Scylla won't make
the traversal, so you'll need to provide the ../ be it in your
locations file or in the xploit path field, the same happens with
the poison byte. YOU are the one who exploits, Scylla just will
make easier a repetitive task.

Example:

Xploit path: /cgi-bin/vuln.php?file=../../..<PATH>

-Load a file with the posible locations of the file you are
looking for.

-Select a destination file.

-Push "generate".

-Now load the file with Triton and start scanning.


NOTE: Be careful how you use this because can be
VERY NOISY FOR THE LOGS.

Keep your simultaneos bots count low and
scan multiple sites if possible.

[3 - Thanks]

I would like to thanks Ange, Rudelgurke and my
fellow fooking cowboy Ex0rphine for your testing help.

[4 - Version History]

25-07-2008 - Project starts.

29-07-2008 - v1.0b starts being beta tested.

01-08-2008 - v1.0b Released to public.

Backdoor Port Scanner

.
1 - Intro

Scanning heavily filtered networks its a slow process because when
the target host drop the packages and don't send any reply Nmap
should wait the time out and then retry 10 times before marking the
port as filtered.

Calculating correctly RTT (Round Time Trip) and ABW (Available bandwidth)
values can improve Nmap timming considerabily, but a port scan fast or
slow still will be noisy.

So the idea is to do a port scan without doing it.

2 - The technique

The basic idea is using a traversal exploit or a web shell to get the files

/proc/net/tcp
/proc/net/udp

and then feed them to the tool bpscan that will parse the results and show
them in a human readable way.

The same can be done with tcp6, udp6 and raw files for IPv6 and raw sockets.

3 - What info can we get doing it

What a better way than seeing some examples

We can use it as a normal port scanner, as you will see bpscan will resolve
the service name.

Port	Service
21	ftp
25	smtp
80	http
3306	mysql
5560	Unknown
37237	Unknown
37297	Unknown

Or we can use the "a" flag to see all the results from the dump without removing
the duplicates.

80	http	93.129.xxx.xxx	3514
3306	mysql	0.0.0.0	0
3306	mysql	72.232.xxx.xxx	40140
5560	Unknown	0.0.0.0	0
37237	Unknown	72.232.xxx.xxx	3306

This last example its resumed or it will be too long.

We can see the IP and port of the remote end.
If we have filtered ports we will be able to know what IPs are allowed to bypass
the firewall, spoof anyone?
The 0.0.0.0:0 are the TCP_LISTEN state ports.

But wait, lets see the same but with remote service resolution...

80	http	93.129.xxx.xxx	3514	must-p2p
3306	mysql	0.0.0.0	0	Unknown
3306	mysql	72.232.xxx.xxx	40140	Unknown
5560	Unknown	0.0.0.0	0	Unknown
37237	Unknown	72.232.xxx.xxx	3306	mysql

The first one haves a high port that resolves to must-p2p, it is the random
assigned port to connect to the 80 for sure, same with the IP connecting to the
mysql.
But... the last one is interesting, we can see our target is connecting to a
remote mysql... nice
This is useful to get a better understanding of our target and its network map.

4 - The tool

The tool its coded in Perl, I made it for personal use but decided to share it.

It's use is easy, check the manual.

Options:
-h Shows this really useful help
-i Defines the input file, if isn't defined, bpscan will use stdin
-f Sets the flags

Valid Flags:
a Shows all the entries, including the remote ip and port where the socket connects
r Resolve remote service

Examples:
bpscan -i=tcp.txt -f=ar
cat /proc/net/tcp | bpscan

5 - Conclusion

Ok guys I hope you find it useful.
I would like to thanks to Rudelgurke for his helpful info on Linux and BSD inner workings.
Please any comment, suggestion or idea, contact me at apx[dot]808[at]gmail[dot]com

6 - Download

http://sites.google.com/site/apx808/Home/bpscan.zip

7 - Extra

For a few comments I received I think there are some guys who don't really understand what is the tool for.
So, this is like 5 great reasons to use bpscan.

1 - If you only have a traversal xploit, you can search for open ports to discover new attack
vectors.
2 - If you have a web shell, you can get the same results using netstat, but you'll need to parse
the info by yourself and you cant get only once each open port like a "select distinct".
3 - bpscan will see the ports from behind, so if you have an open port behind a firewall you'll see
it too.
4 - If you see an incoming connection to a port you can't connect, seeing its IP can allow you to
guess the firewall rule, or discover a trusted host.
5 - You can see your target outgoing connections, and for what service are those for, so you can
gain a better understanding of your target's network map, other targets or new attack vectors.

.