nessusrc

November 6, 2009 Leave a comment

I was given a nessusrc file to run with and not much explanation.  I was able to successfully run a few scans, but nothing too exciting came from them.  I thought (naively) that if I were to install some vulnerable webapps on the VM (Mutillidae or Damn Vulnerable Web App) I would get some more interesting results; of course I was wrong.  I figured it probably had something to do with the plugins that were running and other settings defined in the nessusrc file, so this is my attempt at explaining what I find.

Renaud was kind enough to reply to someone else’s question on the same topic.  He described the sections of the nessusrc file as follows:

SERVER_PREFS: these are the options which are sent back to the nessus daemon. They are all documented on the nessusd side – see /usr/local/etc/nessus/nessusd.conf

SCANNER_SET: the list of port scanners that are enabled by the user. You can merge this section within PLUGIN_SET, because scanners are plugins

PLUGIN_SET (currently absent in my file): the list of plugins which are enabled/disabled. The format is <id> = [yes|no].

SERVER_INFO: is un-necessary, it simply contains information about the last nessusd you connected to (this is used for XML export)

PLUGINS_PREFS: acts like the SERVER_PREFS section, except that very few options are thoroughly documented. However the most important ones (like SMB password) should be self-explanatory.

He also points us to update-nessusrc, which is a Perl script written to simplify the loading of plugins in your scans.  The script is dependent on several Perl modules, some of which are not included in the base Perl package.  TheGeekStuff.com provided a guide that helped me get through manually installing the necessary modules I was missing.  (Beware if you have just installed the basic Perl module, you will be missing some modules that the ones listed as requirements for update-nessusrc are dependent on – HTML-Parser, HTML-TagSet, URI, and possibly a few others.)

For those new to Perl, when configuring the update-nessusrc script to work with your setup, make sure you enclose the host address, user_name, and user_pass in single quotes.  Not enclosing them in quotes got me a “open_sock_opt_hn: invalid socket address” error and an hour of searching for what that meant.

Categories: Nessus Tags: ,

Install Bare-bones Debian 5 (Lenny) on VMWare Workstation

November 2, 2009 1 comment

I’m just getting started with creating my own virtual environment so that I can start figuring out Nessus, WebInspect, Nmap, and several other scanning tools.  This is the process I followed to setup a bare-bones (no GUI) Debian 5 linux system.

Download ISO

  1. Download the 8MB .iso image – mini.iso

Create and Configure VM

  1. File > New > Virtual Machine
  2. Custom, Next
  3. Choose desired workstation compatibility (e.g., Workstation 5)
  4. Installer disc image file (.iso), locate downloaded .iso from step 1
  5. Guest OS – Linux
  6. Version – Other 2.6.x kernel, Next
  7. Enter desired VM name and location for VM
  8. Select number of processors (e.g., 1)
  9. Select memory to allocate, 256MB should be plenty, Next
  10. Choose desired network connection (because of my location on my network I chose NAT), Next
  11. I/O Adapter type, leave default (LSI Logic), Next
  12. Create a new virtual disk, Next
  13. Virtual Disk Type – SCSI
  14. Max disk size 8GB (I chose to split into 2GB chunks, but it’s up to you), Next
  15. Name disk file or leave default, Next
  16. Check ‘Power on this virtual machine when finished’, Finish

Install and Configure OS

  1. You must be connected to the internet for this installation
  2. Choose Advanced options, hit enter
  3. Choose Expert install, hit enter
  4. Choose language – default (highlighted), enter
  5. Choose country – default (highlighted), enter
  6. Choose locale – default (highlighted), enter
  7. Choose other locales – hit ‘tab’, and then enter
  8. Choose keyboard – default (highlighted), enter
  9. Choose keymap – default (highlighted), enter
  10. Detect network hardware – default (highlighted)
  11. Start PC card – default (highlighted)
  12. PCMCIA (should be blank) – tab and then enter
  13. Detect network hardware  – default (highlighted)
  14. Config network – default (highlighted)
  15. Primary network – default (highlighted)
  16. Auto DHCP – choose YES
  17. Hostname – name it what ever you like, tab and then enter
  18. Domain name (should be blank) – hit tab then enter
  19. Choose mirror – default (highlighted)
  20. Protocol for file download – default (highlighted)
  21. Debian archive mirror country – default (highlighted)
  22. Debain archive mirror – choose whatever one is possibly closest to you
  23. HTTP Proxy (should be blank, unless you’re behind a proxy) – tab then enter
  24. Debian version to install – default (highlighted)
  25. Download installer components – default (highlighted)
  26. Installer components to load (choose nothing, should be default) – tab then enter
  27. Configure the clock – default (highlighted)
  28. Set clock using NTP  – default (highlighted)
  29. NTP server to use – default, hit tab then enter
  30. Select your timezone, enter
  31. Detect disks – default (highlighted), enter
  32. Partition disks – default (highlighted), enter
  33. Partition method – choose ‘Guided – use entire disk’, enter
  34. Select disk to partition – default (highlighted), enter
  35. Partitioning scheme – default (highlighted, unless you’d prefer something else), enter
  36. Partition overview – default (highlighted), enter
  37. Write changes to disks – choose yes
  38. Install base system – default (highlighted)
  39. Kernel to install – choose linux-image desired (at the time of this I’ve chosen -2.6.26-2-686)
  40. Drivers to include in the intitrd – default (highlighted)
  41. Setup users and pass – default (highlighted)
  42. Enable shadow pass – default (highlighted)
  43. Allow login as root – default (highlighted)
  44. Root pass, tab and then enter
  45. Confirm root pass, tab and then enter
  46. Normal user account – choose no and then enter
  47. Configure the pack manager – default (highlighted)
  48. Use non-free software – default (highlighted)
  49. Use contrib software – default (highlighted)
  50. Services to use – default, tab then enter
  51. Select and install software – default (highlighted)
  52. participate in package usage – default (highlighted)
  53. Choose software to install – choose nothing (deselect selected), tab and then enter
  54. Install the Grub boot loader – default (highlighted)
  55. Install Grub 2 – default (highlighted)
  56. Install the Grub boot loader to master boot record – default (highlighted)
  57. Grub password (should be blank) – tab and then enter
  58. Finish the installation – default (highlighted)
  59. System clock set to UTC – default (highlighted)
  60. Installation is complete – default (highlighted)
  61. System reboots
Categories: linux Tags: ,

Nmap

January 14, 2009 Leave a comment

Scanning tools are useful both to hackers and system administrators.  Nmap is a very useful, free scanning utility.  The first objective is to find out what hosts are out on a network.  Issuing the command “nmap -sP 192.168.100.*” would bring back all the hosts on the 192.168.100.0 network.

example of using nmap -sP

example of using nmap -sP

The next step is to stack fingerprint the network using the command “nmap -sT 192.168.100.102”:

nmap -sT

nmap -sT

To see what Nmap is doing, you can use Wireshark to capture the packets that go to and from the target computer.  Here’s an example of nmap hitting port 80 on the target computer:

wireshark_nmap_st1

This command (nmap -sT) shows you the ports open on the target system, as well as the services running on those ports.  This can help you identify what operating system the computer is running which allow you to probe deeper and find out, for example, the type of server and version.  If you’re worried about your scan showing up on the target computer’s logs (as evident in the three-way handshake completed when identifying port 80 as open in the above image), you can do a stealth mode scan with “nmap -sS x.x.x.x”.

Running the command “nmap -O x.x.x.x” will have Nmap guess the operating system on the machine.  I didn’t have much success with that command (from the command line), but using the GUI and command “nmap -T4 –version-light -sV -F -O 192.168.100.102”, it guessed the OS as Windows along with a list of possible versions.

nmap_gui_os_scan

Nmap GUI

Network traffic generated from using Nmap, shown by its signature, can be very detectable.  Nmap can be configured to mask its signature from being easily detected.

Three-way Handshake

November 3, 2008 Leave a comment

The three-way handshake is the process by which two computers create a reliable connection to eachother using TCP (Transmission Control Protocol).  The computer requesting the connection sends out a synchronize packet (SYN), when the second computer receives this packet it responds by sending a synchronize packet and an acknowledgement packet (SYN/ACK).  When the initiating computer receives the acknowledgement from the requested computer, it then sends an ACK packet as well, completing the three-way handshake.  There now exists an open-communication channel between the two computers until one issues a “FIN” or “RST” packet or the connection times out.

This is a very important concept in IT security, and it is also very exploitable.  When you think about it, the requesting computer is making sure it is connecting to the right computer before completing the connection.  What happens if someone intercepts the SYN packet (disguised as the designated computer) and sends a spoofed SYN/ACK and the requestor then completes the connection thinking it’s connected to the desired computer?  Or someone can listen in on the connection you’ve made (if it isn’t secure) and disguise information/malware to look like it came from the computer you’re talking to.

Another vulnerability occurs when someone maliciously sends out a flood of SYN packets from a spoofed IP address to a server, causing the server to consume large amounts of resources trying to keep up with these malicious packets.  This is a form of a denial-of-service attack (DoS).  This vulnerability is less of a worry with modern networks.

Sources: wikipedia, Computer Security Lab Manual

Categories: network Tags: , , ,

ping and arp

October 29, 2008 Leave a comment

Ping is a tool used to check the connectivity of a certain host, using ICMP (Internet Control Message Protocol).  At the command line you can ping an IP address or domain name and see how long the target takes to respond.  When this happens, ARP (Address Resolution Protocol) resolves the domain name or IP address to the target’s MAC (Media Access Control) address.  Displayed below is an example of how this works.  Once an address is pinged, it’s resolved MAC address is written to the ARP cache, which can be displayed using the “arp -a” command.

The tricky part comes in figuring out if that is really the correct MAC address for the target computer.  If you’re trying to identify someone who has tried to access your network illegally, they most likely used ARP spoofing.  More on this later…

Categories: Windows Command Line Tags: ,

Security Tools

October 13, 2008 Leave a comment

The following are a few tools of which I am currently aware.  I’ve used some, and plan to dive deeper into each of them, and hopefully discover others along the way.  I’ll republish this list as I get further along.

  1. Backtrack – live CD, combination of Auditor and WHAX, tons of security/forensics tools
  2. Helix – live CD, can also run as an application in Windows, forensic tools
  3. SecurityDistro – more live CD’s with loads of security tools
  4. WebGoat – a tutorial on web security
  5. p0f – OS fingerprinting tool, for profiling your targets
  6. MetaSploit – ” useful information to people who perform penetration testing, IDS signature development, and exploit research”
  7. KeePass – “a free open source password manager, which helps you to manage your passwords in a secure way”
  8. Wigle.net – Wireless Geographic Logging Engine
Categories: Security Tools Tags:

Purpose of This Security Blog

October 9, 2008 Leave a comment

I’d like to keep track of my experiences and record the knowledge I gain as I start exploring the world of IT security more in depth.  I do not claim to be an expert on any of the topics I introduce here; but welcome any further insights or questions from anyone who takes the time to visit El Blog de Seguridad.

I hope this can become some sort of a digital resume to help display the experience I gain working with and researching IT security.  I’d like to set a public goal of publishing here at least once a week (so bug me if you don’t see anything newer than a week).

Categories: Uncategorized Tags: ,