Posts Tagged Wireshark
Sniffing/MITM Attacks on Tor network
Posted by Mourad Ben Lakhoua in Internet, hacking on January 1, 2010
Tor is wonderful tool to ensure your privacy on the Internet ,Tor software is a program that you can run on your computer to helps keep you safe on the Internet.Tor prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. but if you think that this is the only role than you are wrong, since this is just one function of the main purposes of Tor, because another good role of Tor is to create a server and make it available for other users to pass through it.
By installing a sniffer on the server you will be able to see all non encrypted traffic, and you will be able to gather data and sensitive information…
To start you have to get Linux distribution like Backtrack or Ubuntu on a virtual machine it is free and available online. Next download the latest Tor version (currently O.2.1.20). After installing the packages it is better to create a new user on the system trouser: uid=111(toruser) gid=10(wheel) groups=0(wheel),10(wheel). Now Tor use to store the config file .tor in the home directory (/home/toruser) so you need to open this file on the text editor.
In the setting we customize the following:
ControlPort – this is the port used for the remote management of Tor server. Most use the value of 9051.
DirPort – Advertise the directory service on this port. The value is 9030.
ControlPort 9051
DirPort 9030
ExitPolicy – determines what traffic we will receive and forward. By default the policy is as follows:
reject *: 25 , reject *: 119 ,reject * :135-139 , reject *: 445, reject *: 563, reject *: 1214
reject * :4661-4666 ,reject * :6346-6429 ,reject *: 6699 ,reject * :6881-6999 ,accept *: *
here we need to choose the services that we need to receive on our Node and forward (HTTP,HTTPS,POP3,IMAP,IMAPS, POP3S) .so it will be as follows:
ExitPolicy
accept *: 80, accept *: 443, accept *: 110, accept *: 143,accept *: 993, accept *: 995, reject *: *
HashedControlPassword – this to configure the password for remote Tor server configuration and to not allow a malicious user control the server.
Nickname – the server name.
ORPort – port to connect with other nodes 9001.
SocksListenAddress – this will be the localhost (127.0.0.1)
Save the changes and close the file. Now the server is ready to lunch:
$ Tor-f /home/toruser/.tor/torrc
You will take approximately 20 minutes to check the system and ports. Than you can go to http://moria.seul.org:9032/tor/status/authority and you will find our server among other server names.
So Excellent our server is working and it’s time to choose the favorite sniffer Wireshark , Wireshark is already exists in the Backtrack4 select the interface and enable packets capturing. Wireshark will give you all non encrypted traffic like website browsing and other HTTP navigation while it’s in clear. Not bad so far.
Now what about the encrypted traffic, here it’s time to use SSLStrip to get it you go to the official Moxie Marlinspike website and download the last version there is already an update released 2 days ago.
Run the command:
$ Python sslstrip.py-a-l 8080-w today.log
If we are not the last node the traffic will be transmitted in an encrypted form so to decrypt this traffic before it goes to the final destination we need to pass it over the sslstrip by adding this rule to iptable:
$ Iptables-t nat-I OUTPUT-p tcp-m owner-uid-owner 111 – dport 80-j DNAT – to-destination 127.0.0.1:8080
This will make all outdoing HTTP-traffic from user toruser pass through sslstrip automatically, and at this point we need just to wait till that we collect some logs and check the log file.
On next post we will explain the way to perform scanning for Blackbox peneteration testing behind a Tor Proxy.
It is important to note that all programs are used just for educational purposes.
make sure you subscribe to my RSS feed!
Ways for Effective Network Penetration Testing
Posted by Mourad Ben Lakhoua in Pentesting on September 27, 2009
Any security professional has his own way in conducting a penetration testing mission but the whole plan and method for performing the pentest should be in accordance with the security standards recommendations and regulations.
The first thing is to start with defining a framework for the several part of pentest this will involve obtaining comprehensive information about the Internal system that can help to map the infrastructure. The required information includes:
- Network segmentation.
- Firewall rules (Access list… ).
- Web based applications and databases if exist.
- Wireless network if exist.
- Any other security details that should be taken into account during the mission (for example login lockdown when Number of authentication attempt fails that helps to prevent brute force password discovery).
To start the network pentest you will need a good tool for packet analyzing this can be Wireshark or Commview. You just need to implement the sniffer for a period of 2 hours to intercept the needed traffic and analyze them.
We will need to care about the following protocols:
- Switching protocols (STP, DTP …)
- routing protocols (RIP, EIGRP…)
- Dynamic Host configuration protocols (DHCP, BOOTP)
- Open protocols that do not use encryption (Telnet, rlogin…)
Well these protocols can show if there is a problems in the network and what we have to test in the network for example:
- If we found DHCP/RIP protocol we should test Man in the middle attack.
- For the Spanning-Tree Protocol (STP), testing the root bridge electing which allows intercepting all neighbors segment.
- On the DTP it is also possible to change port mode to trunk and intercept legitimate traffic.
To test these attacks you can use Yersinia. Yersinia is a network tool designed to take advantage of some weakness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.
This is for the datalink layer, next we can move to the ARP-poisoning attack, we can choose for this attack one of two tools or both (Cain & Abel or Ettercap ) a successful ARP-poisoning attack can allows pentester to get in the clear passwords of various information resources – database, Active directory domain name and others but it’s very important to lunch the tool on a single target to do not Dosing the system.
For the network layer we can add other tools but globally that can do a good job to include in the main report.
make sure you subscribe to my RSS feed!
SUBSCRIBE
Latest Comments