DenyAccess.org

anonymity is a fake.

[denyaccess-org]

Cookie Cadger

[Cookie Cadger](https://www.cookiecadger.com/) helps identify information leakage from applications that utilize insecure HTTP GET requests. Web providers have started stepping up to the plate since Firesheep was released in 2010. Today, most major websites can provide SSL/TLS during all transactions, preventing cookie data from leaking over wired Ethernet or insecure Wi-Fi. But the fact remains that Firesheep was more of a toy than a tool. Cookie Cadger is the first open-source pen-testing tool ever made for intercepting and replaying specific insecure HTTP GET requests into a browser. [Download](https://www.cookiecadger.com/?page_id=19)

[denyaccess-org]

Evil Maid CHKDSK

This is s simple 512-byte MBR program that pretends to be Windows CHKDSK. It asks the user for a password, writes that password back to the media it booted from, renders that media unbootable, and reboots.

NOTE: Windows helpfully prompts the user to format the drive when its inserted, or when they first log in after the password has been captured. I don't think this can be considered a serious tool until that's fixed, but I've used literally every byte of the MBR - the next version stable version probably won't be 512 bytes :)

Terminal capture of using it with QEMU: http://ascii.io/a/1201

To assemble

nasm -f bin bootloader.asm -o bootme

To install on a disk

dd if=./bootme of=/dev/<device>

To extract the saved password

dd if=/dev/<device> count=1 bs=512 > dump.hex ; xxd dump.hex

Easy peasy.

Compatibility

I've tested this under QEMU with floppies and IDE hard disks, on an Atom (32-bit) netbook using an SD card, and a Core i5 (64-bit) laptop using an SD card.

[denyaccess-org]

How to print out all saved passwords – OSX

Here’s a reason why you shouldn’t let anyone use your computer.

In your terminal, type:

security dump-keychain -d ~/Library/Keychains/login.keychain

If your passwords starts printing out right away, that means anyone using your computer can see all your passwords. You need to do this:

1. Open Up Keychain Access (Using SpotLight, Alfred, or Quicksilver)

2. Click on the lock Button:

If your computer asks you to input your computer password, then now you know how IMPORTANT your computer password is. Never share it.

If you’ve seen enough passwords, type Control+C in your terminal to stop it.

Happy Coding!

Song

Discuss this with amazing hackers on Hacker News

[denyaccess-org]

Ghost Phisher - WiFi honeypot with all in one

Ghost Phisher is a computer security application that comes inbuilt with a Fake DNS Server, Fake DHCP Server, Fake HTTP server and also has an integrated area for automatic capture and logging of HTTP form method credentials to a database. The program could be used as an honeypot,could be used to service DHCP request  DNS requests or phishing attacks

Ghost Phisher 1.5 includes the following new features

1. Session Hijacking 2. ARP Cache Posisoning 3. DOS Attacks using ARP Poisoning 4. MITM Attacks using ARP Poisoning

Requirements:

python python-qt4 xterm subversion python-scapy

To install simply run the following command in terminal after changing directory to the path were the downloaded package is:

Download

Install:

root@bt:~# dpkg -i ghost-phisher_1.3_all.deb

Then you can find it in Applications > Other > Ghost Phisher

[denyaccess-org]

Enabling Nessus on BackTrack 5 - The Official Guide

Nessus is the world’s most widely-deployed vulnerability and configuration assessment product with more than five million downloads to date.

Preparing Your Backtrack 5 Installation

Nessus 4.4.1 now comes pre-installed on BackTrack 5 and requires that the user activate the installation. Before you activate Nessus on your BackTrack 5 installation, be certain you have installed Nessus either to the hard drive on the computer you plan to use or inside of a virtual machine that you plan to keep on the same host system. If you activate Nessus on a bootable USB thumb drive, DVD or a virtual machine and move it to a new host system, the Nessus activation code will no longer be valid. The Nessus activation ties itself to the physical system on which it is installed. If you do decide to move the virtual machine to a new system, or jump around to different systems using a bootable USB thumb drive or DVD, you will have to re-activate Nessus. If you are using a Nessus ProfessionalFeed, you are allowed to reset your activation by clearing the current connection between a host and an activation code. By logging into the Tenable Customer Support Portal and going to "Activation Codes", you can reset the activation code-to-host pairing. ProfessionalFeed users are currently limited to one reset every 30 days. HomeFeed users will need to re-register Nessus when moving between physical hosts.

Step 1 - Obtaining An Activation Code

Once you have Nessus installed on BackTrack 5, you will need to obtain a Nessus activation code. If you wish to purchase a ProfessionalFeed, you can visit the Tenable Store. If you are using Nessus at home or wish to evaluate Nessus, you can register a HomeFeed. It’s important to note that the HomeFeed is limited to 16 IP addresses per scan (whereas the ProfessionalFeed allows you to scan an unlimited number of IP addresses). The ProfessionalFeed also gives you access to features such as Configuration and Sensitive Data Auditing, SCADA plugins, Nessus Technical Support and access to the Tenable Customer Portal.

But if you don't have installed Nessus just do it:

root@bt:~# apt-get install nessus

Step 2 - Activating Nessus

Be certain that your BackTrack 5 installation has access to the Internet and activate Nessus using your newly obtained activation code as follows:

Click for larger image

As shown above, this will also initially download the appropriate plugins based on which feed you've chosen.

Step 3 - Creating A User Account

Next, you will create the initial user account that will be used to login to the Nessus Web Interface:

Click for larger image

After you've entered a username, the nessus-adduser program asks you if the user account should have admin privileges or not. It is recommended that the initial user account have admin privileges so you can use the Nessus Web Interface to create subsequent accounts. The only difference between a Nessus admin user and a regular user is the ability to create user accounts.

Step 4 - Starting Nessus

Using the supplied startup script, start the Nessus server:

Step 5 - Accessing the Nessus Web Interface

Once Nessus has been initially started, it will begin to index and compile all of the plugins. This can take some time, depending on the speed of your system. If Nessus is still processing plugins, you may see the following screen when accessing the web interface:

Click for larger image

The web interface can be accessed with your browser by making an HTTPS connection to TCP port 8834 (e.g. https://localhost:8834/). If you are using a browser local to the BackTrack 5 distribution, such as the supplied version of Firefox, be certain that you enable Flash and JavaScript for this site (Flash is required to access the Nessus Web Interface, and JavaScript is required to view some of the reports). You can also access the Nessus Web Interface remotely by using the IP address assigned to BackTrack 5 (e.g. https://192.168.1.250:8834/).

[denyaccess-org]

WiFi Pineapple Mark IV

The Hot-Spot Honeypot Pen-Testing Platform

Since 2008 the WiFi Pineapple has been a favorite among penetration testers and security enthusiasts. With a talented community of developers this open-source wireless auditing tool brings ease-of-use to man-in-the-middle. Now in its fourth hardware version the WiFi Pineapple boasts unmatched performance, simplicity and value.

At a glance

Stealth Access Point for Man-in-the-Middle attacks

Mobile Broadband (3G USB) and Android Tethering

Manage from afar with persistent SSH tunnels

Relay or Deauth attack with auxiliary WiFi adapter

Web-based management simplify MITM attacks

Easily concealed and battery powered *international restriction below

Expandable with community modules

50 page full color booklet included

Pineapple Core

Most wireless devices including laptops, tablets and smartphones have network software that automatically connects to access points they remember. This convenient feature is what gets you online without effort when you turn on your computer at home, the office, coffee shops or airports you frequent. Simply put, when your computer turns on, the wireless radio sends out probe requests. These requests say “Is such-and-such wireless network around?” The WiFi Pineapple Mark IV, powered by Jasager -- German for “The Yes Man” -- replies to these requests to say “Sure, I’m such-and-such wireless access point – let’s get you online!”

Simple

Focused on ease-of-use, the WiFi Pineapple's web interface makes launching man-in-the-middle attacks as simple as setting up your typical home wireless router.

Simple web interface modeled after consumer routers means less time in the terminal

At a glance see connected clients, perform site surveys and generate reports

Run reports, start services, customize attacks and capture data in a few clicks

Worry-free operation with built-in clean-up scripts that maintain persistent SSH and 3G connections, free memory, and keep your WiFi Pineapple happily humming along

Basically unbrickable: Hold the Reset button to restore all factory defaults

Skinnable

Effective

Our Jasager firmware, based on openwrt with the latest Linux 3.2 kernel, implements a highly efficient kernel mode wireless "Karma" driver and support for loads of packages.

Six common stealth deployment scenarios for secure remote target monitoring

MITM attack tools: Karma, DNS Spoof, SSL Strip, URL Snarf, Ngrep and more

Wireless cracking and deauth attacks with the Aircrack-NG suite

Autostart service like karma and reverse ssh for instant attack on power-up

Simple Mobile Broadband, Android Tethering, and Reverse SSH setups

Hands-off deployment of locally hosted payloads in standalone mode

Powerful

The WiFi Pineapple Mark IV is unmatched in performance, simplicity, value.

Built on the Atheros AR9331 SoC running at 400 MHz (2x speed of previous models)

802.11 b/g/n 150 Mbps wireless

2x Ethernet, one with PoE (Power-Over-Ethernet)

USB 2.0 for expanded storage, WiFi Interfaces and Mobile Broadband

Fast Linux Kernel 3.2-based Jasager firmware (built on OpenWRT)

Expandable

With active firmware development, community based modules and a line of accessories.

Check for new firmware and update with ease, straight from the web interface

Configurable hardware button to perform common functions

Schedule tasks with editable user-scripts

Community built modules add functionality with web interfaces for additional tools:

nmap, tcpdump, java attacks, WiFi Jammer, bandwidth monitor, sslstrip, dynamic dns, site survey and many more

A whole line of accessories are available for the WiFi Pineapple

Community

The WiFi Pineapple is more than just a fruit-infused auditing tool -- it's a community of passionate developers, pen-testers and security enthusiasts who make the platform rock. Find support, firmware development and testing, the latest news and modules, how-to articles and an active forum at WiFiPineapple.com

[denyaccess-org]

Identifying hidden SSIDs without clients.

In this video [albatr0ss] show you how to use a little python script he created to attempt to "brute force" the (E)SSID name of Access Points that are configured to hide its SSID. The script can be downloaded at http://www.albatr0ss.it/en/wp-content/uploads/2011/03/hidden_ssid.tar.gz and the blog post can be found at http://www.albatr0ss.it/en/2011/10/identifying-hidden-ssids/

[denyaccess-org]

Hacking WPA 2 Key – Evil Twin (No Bruteforce)

[denyaccess-org]

BackTrack Linux – Penetration Testing Distribution

BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date.

Download

[denyaccess-org]

ESSPEE - Penetration Testing & Forensics

As you can see at ESSPEE - Penetration Testing & Forensics Web Site:

ESSPEE is a derivetive of Back | Track 5, based on Ubuntu 12.04. Designed for users who wish to use only free software. It is packed with featured security tools with stable configurations. This version consolidates the Unity desktop interface; a brand new way to find and manage your applications.

Download