SombrerosBlancos.com

Check out the wicked security system you can make from that old monitor you were about to throw away!
Ranked 4.20 / 5 | 284371 views | 80 comments

Click here to watch the video (02:02)
Submitted By: NK5
Tags:
Monitor Hacks Security System High Voltage Electric Shock Fence Flyback Transformer Protect Valuables 
Categories: How To Science & Tech

Today i was performing a pentest on a very big network. After struggling a bit i managed to upload files to a web server, an antivirus was running so many known tools didn’t work, so it’s time for more creativity. I pulled the http-proxy, a python based proxy developed by Edge-security, and compiled it into binary with py2exe, created an self-extracting zip, and uploaded to the server. I configured the proxy to listen on the port 53, as they leave that port unfiltered, neat

Well, so far so good, now i needed to know which machines were running webservers. I could have programmed a python scanner and upload it, but i was running out of time, so i went for wfuzz, the swiss knife for application testing (every body says their tool is a swiss knife), i used this command line to scan for web servers in the internal LAN through the proxy:

me —-> Server w/proxy —->LAN

wfuzz -x serverip:53 -c -z range -r 1-254 –hc XXX -t 5 http://10.10.1.FUZZ

Some wfuzz switchs:

-x set proxy
–hc is used to hide the XXX error code from the results, as machines w/o webserver will fail the request (this is added on the new version).

With this command line, i will get every web server on the segment 10.10.1.X, i had to repeat this line for every segment the compromised server could reach, just that easy, fast and fun.

The http-proxy i used is part of the next framework that is being baked at Edge-security, stay tuned..

See you soon, Laramies.

¿Cómo analizamos un algoritmo con sólo el binario del programa?, ¿Cómo mejoramos un programa sin tener el código fuente?, ¿Cómo dividimos sin restar?, un usuario curioso siempre se siente atraído a develar los secretos tras el código y este documento es un buen punto de partida

¿Cómo analizamos un algoritmo con sólo el binario del programa?, ¿Cómo mejoramos un programa sin tener el código fuente?, ¿Cómo dividimos sin restar?, un usuario curioso siempre se siente atraído a develar los secretos tras el código y este documento es un buen punto de partida

Nuevo Windows, incompatibilidades, características, errores, faltas en la traducción y muchos mitos, este reportaje resume aproximadamente un mes de utilizar Windows Vista en un régimen diario, con la calidad y enfoque especial de la mayoría de los documentos presentes en mi sitio

Nuevo Windows, incompatibilidades, características, errores, faltas en la traducción y muchos mitos, este reportaje resume aproximadamente un mes de utilizar Windows Vista en un régimen diario, con la calidad y enfoque especial de la mayoría de los documentos presentes en mi sitio