Published Article: AV Evasion

Another article published by PenTest magazine! 

In this article, i demonstrate an end to end process on how to create a malware using open source tools and used it to avoid being detected by Anti Virus applications. However, besides demonstrating on how to evade them, i also described on how to prevent against such things using additional features from AV vendors.

The Cover Page

The First Page

The Last Page

The full article/magazine can be downloaded for free at

http://pentestmag.com/pentest-open-062013-everybody-backtrack-free-backtrack-tutorials/

Published Article in Pentestmag.com - Pentesting: The Open Source and Manual Way

Second security article related to penetration testing/hacking published in Pentestmag.com. Due to author-magazine agreement, i could not upload the whole content of my published article. Only subscribed users can download the whole magazine.

Links to the magazine: 

http://pentestmag.com/special-starterkit-pack/

http://pentestmag.com/become-well-known-pentester-today-pentest-starterkit-032013/

The focus of this article is to demonstrate on how to perform a pentest using open source and manual methods rather than using automated tools such as Qualys or Nessus. It also elaborates on the reason why performing the manual way provides a better and deeper understanding of the system and vulnerabilities associated with the services/applications found during the recon and scanning phase.

The Cover Page

The Table of Contents

The First Page of my Article

The Final Page of my Article

BT's Advertisement

Installing ARACHNI - Web Application Security Scanner

Free, Open Source, Simple, Distributed, Intelligent, Powerful, Friendly.

"Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. 

It is smart, it trains itself by learning from the HTTP responses it receives during the audit process and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness of results and intelligently identify false-positives. 

It is versatile enough to cover a great deal of use cases, ranging from a simple command line scanner utility, to a global high performance grid of scanners, to a Ruby library allowing for scripted audits, to a multi-user multi-scan web collaboration platform".- http://www.arachni-scanner.com/

By default, BackTrack does not come with Arachni. So first things first, we will need to download the package first to install.

#wget http://downloads.arachni-scanner.com/arachni-0.4.3-0.4.1-linux-x86_64.tar.gz

Extract the package by doing a 

#tar xvzf arachni-0.4.3-0.4.1-linux-x86_64.tar.gz

Once extracted, go into the folder

#cd arachni-0.4.3-0.4.1/bin/

Doing a #ls will list down the files inside the folder

To start the Arachni Web service, do a 

#./arachni_web

Fire up your Firefox and do a 

http://localhost:9292

*Note: There are some instance where arachni will provide a different port. Look at the output

>>>Listening on 0.0.0.0:9292 (this is where it will show what port it is using)

You need to sign in and by default, the user name and password are inside the 'README' file

Read the 'README' file by doing a 

#less README

Input the credentials and you are now ready to use Arachni!

MSSQL Enumeration - Using Open Source/Freeware Tools

In this article, we will demonstrate on how to find available M$ SQL servers within a network range and enumerate or get information about them.

Using Metasploit

msf > use auxiliary/scanner/mssql/mssql_ping

msf auxiliary(mssql_ping) > set RHOSTS <IP Address/range>

msf auxiliary(mssql_ping) > set THREADS 10

msf auxiliary(mssql_ping) > run

Website: http://www.metasploit.com/modules/auxiliary/scanner/mssql/mssql_ping

Using Nessus Cmd

#nessuscmd -i 10674 <IP range> --max-hosts 25

Website: http://pauldotcom.com/2009/11/attacking-mssql-with-metasploi.html

Using Nmap

#nmap -p 1434 --script ms-sql-info --script-args mssql.instance-port=1434 <IP range>

Using SQLRecon

Result of the Scan

SQLRecon: http://www.4shared.com/get/VmkLFFCW/SQLRecon_Setup.html

Website: http://www.specialopssecurity.com/labs/sqlrecon/

Using SQL Ping v3

SQL Ping v3 and SQL Recon has the same interface. The difference is that SQL Ping v3 has additional option for Brute Forcing Passwords with the ability to input the User and Password list.

Result of the Scan

Website: http://www.sqlsecurity.com/downloads

I will find more tools that can be used to gather information for SQL servers and will list them down here in future. If there's anything out there you readers are aware of, do share!