XSS attacks are from
http://ha.ckers.org/xss.html. Caveats:Google.com has been programatically disallowed, but as you can
see, there are ways of getting around that, so coverage in this area
is not complete. Most XSS broadcasts its presence by spawning an alert dialogue.
The displayed code is not strictly correct, as linebreaks have been forced for
readability. Linewraps have been marked with ». Some tests are
omitted for your convenience. Not all control characters are displayed.
src="j%20a%20v%20a%20s%20c%2 »
0r%20i%20p%20t%20%3A%20a%20l »
%20e%20r%20t%20(%20'%20X%20S »
%20S%20'%20)" alt="j a v a s »
c r i p t : a l e r t ( ' X »
S" />
I will introduce you to new hacking tools
and techniques, though, one tool that we will be using in all of those
areas is called the Browser Exploitation Framework, or BeEF (don't ask
me what the lowercase "e" stands for).
Similar to Metasploit, BeEF is a
framework for launching attacks. Unlike Metasploit, it is specific to
launching attacks against web browsers. In some cases, we will be able
to use BeEF in conjunction with Metasploit to launch particular attacks,
so I think its time for us to become familiar with it.
BeEF was developed by a group of developers led by Wade Alcorn.
Built on the familiar Ruby on Rails platform, BeEF was developed to
explore the vulnerabilities in browsers and test them. In particular,
BeEF is an excellent platform for testing a browser's vulnerability to
cross-site scripting (XSS) and other injection attacks.
Step 1: Start Cooking BeEF
BeEF is built into Kali Linux, and it can be started as a service and
accessed via a web browser on your localhost. So let's start by firing
up Kali and cooking a bit of BeEF. Start the BeEF service by going to
"Applications" -> "Kali Linux" -> "System Services" -> "BeEF"
-> "beef start."
Step 2: Opening a Browser to BeEF
The BeEF server can be accessed via any browser on our localhost
(127.0.0.1) web server at port 3000. To access its authentication page,
go to:
http://localhost:3000/ui/authentication
The default credentials are "beef" for both username and password.
Great! Now you have successfully logged into BeEF and are ready to begin using this powerful platform to hack web browsers.
Note that in the screenshot below that
my local browser, 127.0.0.1, appears in the left hand "Hooked Browsers"
explorer after I clicked on the link to the demo page. BeEF also
displays its "Getting Started" window to the right.
Step 3: Viewing Browser Details
If I click on the local browser, it will
provide with more choices to the right including a "Details" window
where we can get all the particulars of that browser. Since I am using
the Iceweasel browser built into Kali, which is built upon Firefox, it
shows me that the browser is Firefox.
It also shows me the version number
(24), the platform (Linux i686), any components (Flash, web sockets,
etc.), and more information that we will be able to use in later web
application hacks.
Step 4: Hooking a Browser
The key to success with BeEF is to "hook" a browser. This basically
means that we need the victim to visit a vulnerable web app. This
injected code in the "hooked" browser then responds to commands from the
BeEF server. From there, we can do a number of malicious things on the
victim's computer.
BeEF has a JavaScript file called
"hook.js," and if we can get the victim to execute it in a vulnerable
web app, we will hook their browser! In future tutorials, we will look
at multiple ways to get the victim's browser hooked.
In the screenshot below, I have "hooked" an Internet Explorer 6 browser on an old Windows XP on my LAN at IP 192.168.89.191.
Step 5: Running Commands in the Browser
Now, that we have hooked the victim's browser, we can use numerous
built-in commands that can executed from the victim's browser. Below are
just a few examples; there are many others.
Get Visited Domains
Get Visited URLs
Webcam
Get All Cookies
Grab Google Contacts
Screenshot
In the screenshot below, I selected the
"Webcam" command that many of you may be interested in. As you can see,
when I execute this command, an Adobe Flash dialog box will pop up on
the screen of the user asking, "Allow Webcam?" If they click "Allow," it
will begin to return pictures from the victim's machine to you.
Of course, the text can be customized,
so be imaginative. For instance, you could customize the button to say
"You have just won the lottery! Click here to collect your winnings!" or
"Your software is out of date. Click here to update and keep your
computer secure." Other such messages might entice the victim to click
on the box.
Step 6: Getting Cookies
Once we have the browser hooked, there is almost unlimited possibilities
of what we can do. If we wanted the cookies of the victim, we can go to
"Chrome Extensions" and select "Get All Cookies" as shown in the
screenshot below.
When we click on the "Execute" button to
the bottom right, it will begin collecting all the cookies from the
browser. Obviously, once you have the user's cookies, you are likely to
have access to their websites as well.
BeEF is an extraordinary and powerful
tool for exploiting web browsers. In addition to what I have shown you
here, it can also be used to leverage operating system attacks. We will
be using it and other tools in my new series on hacking web
applications, mobile devices, and Facebook, so keep coming back, my
greenhorn hackers.
Since I started working with Snowden's documents, I have been using a
number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap,
which physically isolates a computer or local network of computers from
the Internet. (The name comes from the literal gap of air between the
computer and the Internet; the word predates wireless networks.) But this is more complicated than it sounds, and requires explanation. Since we know that computers connected to the Internet are vulnerable
to outside hacking, an air gap should protect against those attacks.
There are a lot of systems that use -- or should use -- air gaps:
classified military networks, nuclear power plant controls, medical
equipment, avionics, and so on. Osama Bin Laden used one. I hope human rights organizations in repressive countries are doing the same. Air gaps might be conceptually simple, but they're hard to maintain
in practice. The truth is that nobody wants a computer that never
receives files from the Internet and never sends files out into the
Internet. What they want is a computer that's not directly connected to
the Internet, albeit with some secure way of moving files on and off. But every time a file moves back or forth, there's the potential for attack. And air gaps have been breached. Stuxnet was a US and
Israeli military-grade piece of malware that attacked the Natanz nuclear
plant in Iran. It successfully jumped the air gap and penetrated the
Natanz network. Another piece of malware named agent.btz, probably Chinese in origin, successfully jumped the air gap protecting US military networks. These attacks work by exploiting security vulnerabilities in the
removable media used to transfer files on and off the air-gapped
computers. Since working with Snowden's NSA files, I have tried to maintain a
single air-gapped computer. It turned out to be harder than I expected,
and I have ten rules for anyone trying to do the same: 1. When you set up your computer, connect it to the Internet as
little as possible. It's impossible to completely avoid connecting the
computer to the Internet, but try to configure it all at once and as
anonymously as possible. I purchased my computer off-the-shelf in a big
box store, then went to a friend's network and downloaded everything I
needed in a single session. (The ultra-paranoid way to do this is to buy
two identical computers, configure one using the above method, upload
the results to a cloud-based anti-virus checker, and transfer the
results of that to the air gap machine using a one-way process.) 2. Install the minimum software set you need to do your job, and
disable all operating system services that you won't need. The less
software you install, the less an attacker has available to exploit. I
downloaded and installed OpenOffice, a PDF reader, a text editor, TrueCrypt, and BleachBit.
That's all. (No, I don't have any inside knowledge about TrueCrypt, and
there's a lot about it that makes me suspicious. But for Windows
full-disk encryption it's that, Microsoft's BitLocker, or Symantec's
PGPDisk -- and I am more worried about large US corporations being
pressured by the NSA than I am about TrueCrypt.) 3. Once you have your computer configured, never directly connect it
to the Internet again. Consider physically disabling the wireless
capability, so it doesn't get turned on by accident. 4. If you need to install new software, download it anonymously from a
random network, put it on some removable media, and then manually
transfer it to the air-gapped computer. This is by no means perfect, but
it's an attempt to make it harder for the attacker to target your
computer. 5. Turn off all autorun features. This should be standard practice
for all the computers you own, but it's especially important for an
air-gapped computer. Agent.btz used autorun to infect US military
computers. 6. Minimize the amount of executable code you move onto the
air-gapped computer. Text files are best. Microsoft Office files and
PDFs are more dangerous, since they might have embedded macros. Turn off
all macro capabilities you can on the air-gapped computer. Don't worry
too much about patching your system; in general, the risk of the
executable code is worse than the risk of not having your patches up to
date. You're not on the Internet, after all. 7. Only use trusted media to move files on and off air-gapped
computers. A USB stick you purchase from a store is safer than one given
to you by someone you don't know -- or one you find in a parking lot. 8. For file transfer, a writable optical disk (CD or DVD) is safer
than a USB stick. Malware can silently write data to a USB stick, but it
can't spin the CD-R up to 1000 rpm without your noticing. This means
that the malware can only write to the disk when you write to the disk.
You can also verify how much data has been written to the CD by
physically checking the back of it. If you've only written one file, but
it looks like three-quarters of the CD was burned, you have a problem.
Note: the first company to market a USB stick with a light that
indicates a write operation -- not read or write; I've got one of those -- wins a prize. 9. When moving files on and off your air-gapped computer, use the
absolute smallest storage device you can. And fill up the entire device
with random files. If an air-gapped computer is compromised, the malware
is going to try to sneak data off it using that media. While malware
can easily hide stolen files from you, it can't break the laws of
physics. So if you use a tiny transfer device, it can only steal a very
small amount of data at a time. If you use a large device, it can take
that much more. Business-card-sized mini-CDs can have capacity as low as 30 MB. I still see 1-GB USB sticks for sale. 10. Consider encrypting everything you move on and off the air-gapped
computer. Sometimes you'll be moving public files and it won't matter,
but sometimes you won't be, and it will. And if you're using optical
media, those disks will be impossible to erase. Strong encryption solves
these problems. And don't forget to encrypt the computer as well;
whole-disk encryption is the best. One thing I didn't do, although it's worth considering, is use a stateless operating system like Tails.
You can configure Tails with a persistent volume to save your data, but
no operating system changes are ever saved. Booting Tails from a
read-only DVD -- you can keep your data on an encrypted USB stick -- is
even more secure. Of course, this is not foolproof, but it greatly
reduces the potential avenues for attack. Yes, all this is advice for the paranoid. And it's probably
impossible to enforce for any network more complicated than a single
computer with a single user. But if you're thinking about setting up an
air-gapped computer, you already believe that some very powerful
attackers are after you personally. If you're going to use an air gap,
use it properly. Of course you can take things further. I have met people who have
physically removed the camera, microphone, and wireless capability
altogether. But that's too much paranoia for me right now. This essay previously appeared on Wired.com. EDITED TO ADD: Yes, I am ignoring TEMPEST attacks. I am also ignoring black bag attacks against my home.
Hm, you actually can install everything you need without connecting to
Internet ever. Most of Linux distributions have offline installations
made specially for this purpose. They include most of drives/packages
available. And if that's not enough, you can easily add missing
drivers/packages/software yourself.
»
»
»
