So once in a while you hear about some backdoor which was slipped into some source code. Mostly in C applications…so I was thinking how would this be done in Java? Most of the times the backdoors you hear about are very nasty and difficult to track down “bugs” in the source code like buffer overflows, race conditions and the likes. Since Java doesn’t really have buffer overflows(I’m ignoring faulty VM implementations for the moment) I was wondering what an other *hopefully* good way would be to introduce bugs you can exploit?
Archive for July, 2009
Tags: backdoor, certificate, java, mitm, ssl
Tags: dns, google, subdomain
Actually I called it GDNS but well…that would be to cryptic as a blog item title. This is also from the KD-Team archives. Enjoy. All it does is *TRY* and find all sub domains for a given domain with the use of google.
Tags: backdoor, icmp, shell, sniffer, tcp/ip, udp
Some sources from the old KD-Team website. This time it’s a connect back shell which gets activated when a certain keyword is seen in passing traffic. The advantage of this, is that you can activate your shell without raising to much suspicion. One thing though…it’s buggy. I made this back in the day and never bothered to fix some things. AFAIK it works under windows XP SP2 if it doesn’t well…try and fix it. I haven’t tested it since a long while.
Tags: apache, brute force, dirbuster, mod_negotiation, python, w3af
Or like most people will call it “just another mod_negotiation script”. Well yeah that’s true. I still think it has it’s added value during a brute force if it’s available. I’m not going to waste any space on explaining what the whole mod_negotiation thing is, because there are a number of excellent resources out there:
For the ones that are just curious how this boils down to source you can of course read the source of the module and some documentation about it, which is available over here:
So why did I write “yet another” script for this? Well first because I wanted to keep learning and practicing python. Also because I wanted my brute force attacks to be a little bit more efficient. So with this script instead of trying to guess the entire name(including the extension) of the file, I just guess the name and mod_negotiation will do the rest for me(read the links I provide, because it only works for mime types that are known to apache). So with a bit of luck you need less requests to find more files. For the ones working with w3af, it already has support for mod_negotiation testing.
The way to use this script would be to combine it with the excellent tool DirBuster. Just have DirBuster do a recursive directory brute force. Then take those results and feed them to my script with a decent file name list. This script is kind of an alpha version, just something I quickly whipped up.
[*] DiabloHorn https://diablohorn.wordpress.com
[*] Mod Negotiate File Brute Force
[*] mfbrute.py -t <target> -d <dir list> -f <file list>
[*] -t target to scan
[*] -d directories which will be scanned
[*] -f files which will be scanned
[*] -v verbose
[*] -h this help
You can get the src from here.
Tags: abstract expresionism, airport, art, barajas, eva grande, exposition, madrid
Well like you probably don’t remember a while back I wrote about art I enjoyed. Well to my surprise the artist has a exposition right at the airport of Madrid. It seems like the information is only available in Spanish for the moment being. Although the most important bit of information can be translated quite easily:
La exposición, situada en el pasillo que da acceso al Terminal T-2 del Aeropuerto desde el Metro y el Parking P-2
The exposition which is stationed in the hallway that gives access to the T-2 terminal of the airport coming from the metro and parking P-2
So if anyone is going to Madrid I recommend having a look. It is available until the end of July.
For people interested in art events in Madrid I recommend the following blog:
which at the time beeing happens to also inform about the exposition at the airport of Madrid.
Well I suspect that people already know about this. I didn’t, so I felt like blogging about it. Often when searching for specific directories on google it can be a pain in the ass, I mean you can combine “inurl” and “intitle” but still… so the other day I stumblod upon this nice feature of the “site” command. you can actually append a directory name to it!!
That actually seems to yield better results. For example I used it to search for a specific directory on some TLD and it worked fine. I particularly like it because it makes searching for a specific directory with specific characteristics a lot easier. A nice example to try for example could be, it results in (almost) only include directories which allow directory listing:
site:org/include/ intitle:”index of”
If you stretch it even further you *COULD* argue that you can do a directory search withouth actually hitting the target, of course it would be limited to the directories indexed by google.
If you already knew it then oh well…if not enjoy.