Reaver (WPS attack) and WPAMagicKey tools

(There is a Spanish version of this post | haga click aqui para acceder a este post en Español)
Just a few months ago we heard:  "WPA is down, we've cracked it!"



That's absolutely wrong, no body has cracked this security algorithm. Today, this will be our main idea.
At least, no body had published anything about WPA cracking. It was long time ago from WEP cracking but not yet for WPA (of course, WPA2 is included)

There are some ways to access to a WPA wireless network, but none of them could be called "cracking":

- Capture the WPA - TKIP handshake (aircrack + dictionary): this is not cracking because you need a later dictionary attack to be able to get the password. If you have no dictionary, you won't be able to get the password.
- Use the WPA Magic Key dictionaries (w/o aircrack): This tool can generate the default password list for this router if your wireless is WLAN_XXXX or JAZZTEL_XXXX and you never changed your password.
- John The Ripper (to use with aircrack): You can generate your own dictionary if you know the password pattern and it's not very long (shorter than 4 - 5 characters), if it's long your dictionary will be huge and you won't be able to use it. (View table and pie chart below)




From the calculations in the table above, it could be a bad idea try to crack by using brute force attack in a WPA wireless network.


In the pie chart below you can check what most passwords are in the strongest group (mixed character type).





Then, I think still nobody cracked a WPA password, right?


From the hacker point of view, the most important difference between WEP and WPA is what they transmits on the IP package. A WPA packet is not transmitting any information about the network master key, this is not true about WEP encryption.

Now, we must learn about WPS (Wikipedia EN). The most simple&easy way to think what's WPS: "WPS is a button which allows us to connect (or not) to a WiFi".
Finally, if nobody was able to crack a WPA... what the hell is reaver? what the hell can it do for me? will I be able to use reaver?

- Reaver: Is a script-tool which will use a WPS vulnerability algorithm to "cheat" a router and get the WPA key.
- As far as I know, reaver will only be able to help you when your're using TKIP (not supported for AES yet)
- Previous to execute "reaver" you should execute the "walsh" script-tool. It's a "twin-app" what will tell you which wireless networks are vulnerable to this attack.

There are lots of video tutorials about reaver... (my favority one is the first video)
Video#1 (here you will learn how to install too, very interesting)
Video#2

You maybe need this tips.

In most cases you will get reaver from linux distributions like Backtrack or WifiWay.
We will talk soon about the new rease of WifiWay (v.3)

You mustn't use this information for hacking, you have to use it just for learn about security, right?

We are legion


================================================================
Next Post: "PayPal is vulnerable, XSS"

Google Hacking, be careful with your web site!

(Now you can access to the Spanish version of this post | Puede acceder a la versión en Español de este post)

Hi there!
Long time ago from last post, I was very busy last months.
We're back again to talk about a old-classic way of hacking: "Google hacking".
This hacking is very simple a it doesn't require any advanced tool or software, it can be done just by using a 56k modem connection to the internet  (I really hope your connection is a bit faster than this  :D   )
All of us know about the advanced search algorithms and powerful data pickup of Google, I think Google is the most technologically advanced search engine in the world right now (in the last 5 - 10 years).
Google is much than a text box and a "Search" button; even much higher than a "I'm feeling lucky" button  :)
We should know Google has able to pickup data from other files than classic html web pages, every day Google is detecting a huge amount of pdf, doc,... files. Google has many filter and advanced search options, like search by filetype, by some text in a web address (url), by file extension...
This mechanism is simple as:
- Searching Doc. Watson logs from a machine
- Searching important information about personal data
- Searching files with users accounts
- Searching files with user and passwords!!!!
Yeah, absolutely, all of this info is there, we have free access at many files just using Google.
You can access to google help in order to learn about Google "commands" to perform some advanced searches.
Recently, this easy simple hacking type was used against many important security organisms from the U.S. and West-Europe.

This method can be considered "Social Engineering"

We are legion.
Next post: "Reaver and WPS attack"

WifiWay 2, hack the air!

(Visit the brand new version of this old post in Spanish)
Today we will write about "WifiWay".

WifiWay is a free open linux distribution which is "the son" of the WifiSlax distribution.
This is a well known linux distribution related with wireless auditing.

From the older one, WifiSlax, WifiWay inherited a lot of utilities and tools, like the aircrack framework, including airodump, aircrack, aireplay... etc.

Those tools was great but they were not easy-to-use for new users or auditors with a low knowledge.

This distribution evolved to "WifiWay 1.0", that distribution was simplified with a ".sh" script called airoscript and airoscript.es (Spanish version); that script helped users to launch auditories without the difficulty of long command line sequences and lots of "parameter:values"

WifiWay 1.0 had an "hole", dictionary attacks was not automated and simplified, yet.

A few time ago, WifiWay 2.0 arrived and got us a more simplified interface and some utilities related with dictionary attacks; it included a new version of airoscript, easier and more powerful, again.

Now, the current version is "WifiWay 2.0.3 final" a free open powerful automated linux distribution. It has a improved airoscript with "auto crack" mode, it allows us to automatically crack or attack a wireless access point near to us, yeah!, full automated :)

You can get longer information about at  http://www.wifiway.org/

Hey man, don't forget, just for auditing, not hacking
 :)
Enjoy it!

"We are legion"
Next Post: "Google hacking, be careful with your website!"

What the hell is Nessus? Fast overview

Today we will write about Nessus (from my point of view) the best vulnerability scanner.

There are many network scanners:
 * nmap: a very simple command line network scanner.
 * wireshark: a network sniffer, GUI and command line.
 * airodump: wireless scanner.
 * airsnort: an old wireless scanner.


There are many scanners, but none of them gets the level of nessus. This is my favourite one :)
Why?

Nessus is a free vulnerability scanner, you can use it as GUI or command line, no problem.

Nessus works as client <-> server. This is (in short), our nessus server will do the work which we launch from the nessus client.

The GUI client interface is very friendly and easy-to-use.
The command line has a powerful engine that allows us to integrate nessus with metasploit framework (we will talk about metasploit framework in later posts)

Once installed, up and running, we have a "light" version of nessus, it has only a few plugins available.

We have to go to the nessus website and register our nessus. (I asume we are NOT a company, just home users; companies should buy a enterprise version of nessus)

After register our nessus server, we can download all of plugins and full update our nessus engine.
Then we will have our nessus engine ready to run.

Thus, which is the functionality for this plugins?

Plugins are used as working modules, they are used to detect vulnerabilities, each one is dedicated to some type of vuln. Then, you should keep your plugins updated, in order to have the best vuln detection.

Nessus works in a three module manner:

- Policies: policies are used to define the scanner behavior, which IPs will be scanned...
- Scanners: this is the main nessus function, a scanner is a "policy running"
- Reports: a report is created after scanner execution, is the output of the scanner, listing all the vulns detected and the exploit, if it is available.


Those reports can be read by metasploit, to execute commands like "db_autopwn"     :)


"We are legion"
Next Post: "WifiWay2, hack the air!!!"(English)
Siguiente Post: "WifiWay2, hack the air!!!"(Español)

Differences between DDoSing/DoSing and hacking

Today we will talk about differences between DDoSing a service and hacking a server.

If you don't know what't DDoS and DoS, go to posts about LOIC and RefRef.
I asume all of we know what the hell is "hacking", now, we are all DoS experts :)

Could be DoS or DDoS considered a type of hacking? I think it is not, at all.
From my point of view, hacking is all actions that uses some security hole to break something in our systems.

By the way, if a guy is lauching a DoS attack, this guy is not breaking anything.
The attacker is not getting any information from our system, he is not thieving, he is not breaking.

Thus, why can be a DoS considered an illegal action? I can't understand that.
I think that arresting a guy for lauching a DoS attack is not correct at all.

I think we can explain it with a example:

===================================================================
You are going home after work.


When you arrive at home, a guy is in your house door, just "blocking" it.
Your door is not broken.
Should be this guy arrested? Is that correct?  I think not.


Instead that, you should think what you did to motivate this guy to block your house door.


You just may use other door or push him out of your door (this is just, reboot a service) and you will be able to use your house normally.
===================================================================

After the example, all of we may agree, DoS should not be considered illegal, because is not damaging anything, right?

"We are legion"
Next Post: "What the hell is Nessus? Fast overview"

"URGE" (Universal Rapid Gamma Emitter) Hijacking Twitter

(Spanish follows | Después en Español)

Today we will talk about the new tool called URGE. This is a tool to auto-tweet, just that.

Are you tired of trending topics from twitter never reflect our interests?
Are you tired of those trendings like "sex" or other non-actual topics?
Are you tired of twitter never reflects our world news or problems?

URGE is here to solve it, now you can tweet your news many times without the need of continous copy&paste&tweet.

This a hijacking tool:
 - NOT hacking, URGE is not exploiting any security hole.
 - NOT DoSing, it is not blocking twitter access.
 - NOT DDoSing, it is not coordinating a DoS.

Let's free the twitter trending topics!

"We are legion"
Next Post: "Differences between DDoSing/DoSing and hacking"

=================================================================

Hoy hablaremos sobre la nueva herramienta llamada URGE. Esta herramienta sirve para twitear automaticamente, solo eso.


Cansado de que los trending topics de twitter nunca reflejen tus intereses?
Cansado de esos trendings como "sexo" o otros desactualizados?
Cansado de que twitter nunca refleje los problemas y noticias mundiales?

URGE ha llegado para solucionarlo, ahora puedes twitear y retwitear tus noticias y novedades muchas veces sin la necesidad de copiar, pegar y twitear.

Esta es una herramienta de hijacking:
 - NO es hacking, URGE no está atancando a los sistemas de twitter.
 - NO es DoSing, no está bloqueando ni colapsando el sistema de twitter.
 - NO es DDoSing, no está coodinando ninguna ataque DoS.

Liberemos los trending topics de twitter!

"Somos legión"

Siguiente Post: "Differences between DDoSing/DoSing and hacking"

RefRef - Creating a huge army

(Spanish follows)

LOIC was retired due to most of the hacktivists who were arrested last year used this software.
Their connection data was tracked by police and they were finally arrested.
They should used several hidding methods like VPNs, proxies, connetion through cyber-cafe...

RefRef is the brand new weapon which is being tested from a few time ago. RefRef is called to replace LOIC (Low Orbit Ion Cannon) and upgrade its capabilities.

The weapon will be available for download from this month. First news about the tests reveals that RefRef have a lot of power :)

This new weapon offers new possibilities, due to it's based on JavaScript, this means that can be used from most platforms like computers, laptops, tablets, smartphones...
And maintains older ones like the possibility of creating "zombies", that is, to build up a bot-net and launch a huge attack at the same time.

RefRef has a new one advantage that turns it more powerful than LOIC, RefRef is able to perform SQL-i to create a devastating effect combined to the attack behavior from LOIC.


What is SQL-i?

Have you ever seen a web URL like this?

        www.myownweb.com/post?user=JohnDoh

Just try to change the parameter "user" to access to another data, something like:

        www.myownweb.com/post?user=MikeH

Yeah! You have completed your first SQL-i attack! :)
Of course, this is not representative for the RefRef behavior but this is the essence :)

Do you remember when people talk about "Web 2.0"?
I think "DDoS 2.0" is comming.


"We are legion"

PS: www.myownweb.com is just an example. Do not try to SQL-i attack this URL
Next Post: "URGE (Universal Rapid Gamma Emitter) Hijacking Twitter"
---------------------------------------------------------
Next topics:
- "URGE (Universal Rapid Gamma Emitter) Hijacking Twitter"
- "Operation Icarus"
- "Differences between DDoSing/DoSing and hacking"
- "Can we effectively hide our data connection?"
- "What the hell is Nessus?"


======================================================================
                      Spanish / Español:

LOIC ha sido retirado debido a que la mayor parte de los hacktivistas arrestados el año pasado habían utilizado esta aplicacion.
Los datos de su conexión fueron rastreados por la policia y fueron finalmente arrestados.
Deberían haber utilizado de forma combinada diversos metodos de ocultación de sus datos como VPNs, proxy y/o conexiones desde luegares publicos.


RefRef es la novedosa arma que está siendo probada desde hace algun tiempo. RefRef es el reemplazo de LOIC y mejorará sus capacidades.

Esta arma estara disponible para su descarga durante este mes. Las primeras noticias confirman  que es muy poderoso :)

Esta nueva arma ofrece nuevas posiblidades, debido a que esta basada en JS, esto implica que puede ser ejecutado desde diversas plataformas como ordenadores de sobremesa, portatiles, tables o telefonos de ultima generación.
Además mantiene las ventajas de LOIC como la posiblidad de crear PC zombis, esto es, crear una red de bots para preparar un ataque a gran escala.

RefRef tiene una novedad que la proporciona una gran ventaja frente a su predecesor, es capaz de atacar con SQL-i, lo que aumenta muchisimo sus capacidades.


¿Que es SQL-i?

¿Alguna vez habeis visto una direccion como esta?

        www.myownweb.com/post?user=JohnDoh

Probad a cambar el parametro "user" para intentar acceder a otros datos, algo así:

        www.myownweb.com/post?user=MikeH

Toma ya! Acabas de realizar tu primer ataque de injección SQL!
Por supuesto, esto no es representativo para RefRef, pero es la idea. :)

Recordais cuando se hablaba de la "Web 2.0"?
Pues os doy la bienvenida a "DDoS 2.0"


"Somos legion"

PD: www.myownweb.com no es más que un ejemplo. 
No intenteis atacar esta dirección, por favor.
Siguiente Post: "URGE (Universal Rapid Gamma Emitter) Hijacking Twitter"
---------------------------------------------------------
Proximos temas:
- "URGE (Universal Rapid Gamma Emitter) Hijacking Twitter"
- "Operación Icaro"
- "Diferencias entre DDoSing/DoSing y hacking"
- "Podemos ocultar de forma eficiente nuestros datos?"
- "Que coño es Nessus?"

Low Orbit Ion Cannon - One of the best weapons

(Spanish follows) (En Español a continuación)

--------------------------------------------------------------------------------------------------------------------------------

This post is dedicated to a great friend and journalist.

Today we will write about LOIC, one of the most used DDoS weapons on the internet.
But we will start from bottom to top.

What the hell is a "DoS"?

It stands for "Denial of Service", that means: it is to perform a huge number of requests to a server, a number enough to don't let the server to attend other request but yours.

A cool example could be a pub

When you go to ask for a pint of beer, the waiter could attend other people, but, if you ask for ten thousand pints of beer the waiter will become very busy to attend other request but yours.

Thus, what the hell is "DDoS"?

This stands for "Distributed Denial of Service", that means: it is to form a team and all of you perform a huge amount of requests, each one of you. This is to say, to perform several simultaneous "DoS" attacks.

I'll try to continue with the example of the pub.

If your friends and you go to a pub and all of you agrees to ask for ten thousand of pints at the same time, the waiter will become very busy, really overloaded.

Moreover, depending on the time you maintain this attack, the result of it may change.

A short time attack could be useful to know how the system can resist a stress load.
But, if the DoS or DDoS is maintained for a long time could cause a full system lock.

On our example in the pub:

If the waiter is working at full of his capacity during many time, he can suffer a heart attack and die.
(I really hope nobody will suffer a heart attack, it is just a example)

Now, we are DoS and DDoS experts :)

What is LOIC (Low Orbit Ion Cannon)?

LOIC is an application designed to perform stress tests on systems but it could be used to lauch a DoS or DDoS attack.
On the last version, it has many plugins that will allow you to perform very advanced attacks.
One of this plugins allows to let the control of your LOIC to another person, your PC becomes a "zombie" controlled by another PC.
If there is a PC controlling one million of zombies ... this is an army!!!

"We are legion"
Next Post: "RefRef - Creating a huge army"

====================================================================

Spanish / Español:

Este post está dedicado a un gran amigo y periodista.

Hoy vamos a escribir sobre LOIC, una de las armas DDoS más utilizadas en internet.

Pero vayamos de abajo a arriba.

¿Qué demonios es "DoS"?

Significa "Denegación de Servicio", esto es: ejecutar una enorme cantidad de peticiones a un servidor, un numero suficiente para no permitir al servidor que atienda ninguna peticion que no sea de las tuyas.

Un ejemplo chulo puede ser un bar

Cuando vas a pedirte una cerveza, el camarero puede ir atentiendo a otras personas, pero si pides diez mil pintas de cerveza el camarero estará un tiempo demasiado ocupado para poner cualquier pinta que no sea una de las tuyas.

Entonces, ¿Que demonios es "DDoS"?

Esto significa "Denegacion de Servicio Distribuido", eso es: que un equipo de atacantes ejecute una enorme cantidad de peticiones al mismo tiempo. es decir, varios DoS simultaneos.

Intentemos conitnuar con el ejemplo del bar.

Si tus amigos y tu vais a un bar y quedais de acuerdo para pedir diez mil pintas cada uno al mismo tiempo, el camarero estará muy ocupado, completamente sobrecargado de trabajo.

Ademas de todo esto, en función del tiempo que se mantenga el attack, el resultado del mismo podria variar mucho.

Un ataque breve puede ser muy util para saber como puede un sistema resistir una carga de estres.

Pero, si el DoS o el DDoS se matiene en un largo periodo de tiempo, es probable que el sistema acabe por caerse o bloquearse.

En nuestro ejemplo del bar:

Si el camarero esta trabajando a pleno rendimiento durante mucho tiempo, podria sufrir un paro cardíaco y morirse.

(Espero encarecidamente que nadie sufra un ataque cardíaco, tan solo es un ejemplo)

Ahora que somos expertos en DoS y DDoS :)

¿Que es LOIC?

LOIC is una aplicación diseñada para ejecutar ataques de estrers en diversos sistemas aunque puede ser facilmente utilizado para llevar a cabo un ataque DoS o DDoS.

En su última versión incluye una gran variedad de plugins que te permiten ejecutar ataques realmente complejos.

Uno de sus ultimos plugins permiten ceder el control de tu maquina a otro operador remoto, de forma que tu PC se convierte en un zombi.

Si hubiese un PC controlando un millón de zombis.... menudo ejercito!!!!.

"Somos legión"

Siguiente Post: "RefRef - Creating a huge army"