Security on vanstechelman.eu

Testing for CVE-2018-11784 - Apache Struts 2 Open Redirect vulnerability

Thu, 04 Oct 2018 07:57:17 +0000

On Wednesday 3 October 2018 the Apache Software Foundation has released information about an Open Redirect vulnerability in Apache Struts 2. The vulnerability received identifier CVE-2018-11784.

The vulnerability announcements describes the vulnerability as follows:

When the default servlet returned a redirect to a directory (e.g. redirecting to ‘/foo/’ when the user requested ‘/foo’) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Scanning for CVE-2017-0143 (EternalBlue) using nmap (MS17-010)

Sat, 01 Jul 2017 08:30:00 +0000

With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. This vulnerability has been assigned CVE-2017-0143. The vulnerability is also often nicknamed EternalBlue. This page explains how you can scan for it from a Windows machine using nmap.

The SMBv1 server in many Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets, aka “Windows SMB Remote Code Execution Vulnerability.” This vulnerability is actively being exploited.

Scanning for CVE-2017-5638 using nmap

Tue, 14 Mar 2017 21:00:00 +0000

On March 6, 2017, Apache disclosed a vulnerability in the Jakarta multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on the targeted system using a crafted Content-Type header value.
This vulnerability has been assigned CVE-ID CVE-2017-5638.
This page explains how you can scan for it from a Windows machine using nmap.

Scan for FREAK using nmap

Sun, 08 Mar 2015 19:56:11 +0000

Not everyone is vulnerable to the potential attack vector that researchers from INRIA, a French research institute, and Microsoft disclosed recently. In order to be vulnerable, the computer or server must support a class of deliberately weak export cipher suites. Support for these weak algorithms has remained in many implementations, however they are typically disabled by default. Nevertheless, the researchers discovered that several implementations incorrectly allow the message sequence of export ciphersuites to be used even if a non-export ciphersuite was nogotiated. This post shows how you can test a server to detect if it has been configured to allow export cipher suites to be used.
\

Scan for POODLE using nmap from a Windows machine

Wed, 15 Oct 2014 10:17:34 +0000

Researchers from the Google Security Team have published findings about a vulnerability in SSL 3.0. CVE-2014-3566 has been allocated for this protocol vulnerability. It is possible to use nmap to scan for the presence of this vulnerability by doing a scan on the supported SSL/TLS protocols. This post shows how to scan for the POODLE weakness using nmap.

Scan for Heartbleed using nmap from a Windows machine

Thu, 10 Apr 2014 08:01:14 +0000

You may have heard of “Heartbleed”, a flaw in OpenSSL that could allow the theft of data normally protected by SSL/TLS encryption.

It is possible to scan for the presence of this vulnerability using different methods.
This page explains how you can scan for it from a Windows machine using nmap.

HTML5 LocalStorage

Sat, 22 Jun 2013 09:07:45 +0000

This article presents the HTML5 LocalStorage (and SessionStorage) objects and discusses some security implcations and recommendations. Furthermore JavaScript examples are given on how HTML5 can be easily used.

Testing randomness with Stompy

Thu, 04 Apr 2013 13:27:11 +0000

Stompy is a fairly advanced entropy verifier for session cookies, XSRF tokens, OTPs, and other random data. It goes well beyond FIPS-140-2, performing n-dimensional spectral testing as well.

Scanning for SNMP services with default community strings

Thu, 08 Dec 2011 10:03:12 +0000

You can use the following commands to scan a netblock for the presence of systems with an SNMP service which still use the community strings “public” and/or “private”.

How to bypass domain policy firewall settings

Wed, 17 Aug 2011 07:28:38 +0000

How to enable the Windows Firewall, even though Domain Policies are prohibiting you from enabling it…

Backtrack 4 customization

Fri, 20 May 2011 07:37:11 +0000

This page is mainly a checklist for myself to know how I have to customize a freshly downloaded version of Backtrack 4. ### Change keyboard layout Use the following command to change the keyboard layout: dpkg-reconfigure console-setup Accept all default, except changing the origin to Belgium (if you want to use be-latin1). ### Update all packages apt-get update apt-get upgrade ### Configure SSH You still have to generate your SSH keys sshd-generate

Using SkipFish through Burp Suite

Wed, 18 May 2011 12:30:08 +0000

This how-to explains you how to use SkipFish through a proxy. It will show you how you have to configure Burp Suite and which parameters you need to supply to SkipFish so that all SkipFish’s traffic will flow nicely through Burp Suite.

HTML event handlers

Mon, 21 Dec 2009 13:31:13 +0000

The following is a list of event handlers which can be used in HTML code to execute Javascript code.

FSCommand(): attacker can use this when executed from within an embedded Flash object
onAbort(): when user aborts the loading of an image
onActivate(): when object is set as the active element
onAfterPrint(): activates after user prints or previews print job
onAfterUpdate(): activates on data object after updating data in the source object
onBeforeActivate(): fires before the object is set as the active element
onBeforeCopy(): attacker executes the attack string right before a selection is copied to the clipboard - attackers can do this with the execCommand(“Copy”) function
onBeforeCut(): attacker executes the attack string right before a selection is cut
onBeforeDeactivate(): fires right after the activeElement is changed from the current object
onBeforeEditFocus(): Fires before an object contained in an editable element enters a UIactivated state or when an editable container object is control selected
onBeforePaste(): user needs to be tricked into pasting or be forced into it using the execCommand(“Paste”) function
onBeforePrint(): user would need to be tricked into printing or attacker could use the print() or execCommand(“Print”) function
onBeforeUnload(): user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent
onBlur(): in the case where another popup is loaded and window looses focus
onBounce(): fires when the behavior property of the marquee object is set to “alternate” and the contents of the marquee reach one side of the window
onCellChange(): fires when data changes in the data provider
onChange(): select, text, or TEXTAREA field loses focus and its value has been modified
onClick(): someone clicks on a form
onContextMenu(): user would need to right click on attack area
onControlSelect(): fires when the user is about to make a control selection of the object
onCopy(): user needs to copy something or it can be exploited using the execCommand(“Copy”) command
onCut(): user needs to copy something or it can be exploited using the execCommand(“Cut”) command
onDataAvailible(): user would need to change data in an element, or attacker could perform the same function
onDataSetChanged(): fires when the data set exposed by a data source object changes
onDataSetComplete(): fires to indicate that all data is available from the data source object
onDblClick(): user double-clicks a form element or a link
onDeactivate(): fires when the activeElement is changed from the current object to another object in the parent document
onDrag(): requires that the user drags an object
onDragEnd(): requires that the user drags an object
onDragLeave(): requires that the user drags an object off a valid location
onDragEnter(): requires that the user drags an object into a valid location
onDragOver(): requires that the user drags an object into a valid location
onDragDrop(): user drops an object (e.g. file) onto the browser window
onDrop(): user drops an object (e.g. file) onto the browser window
onError(): loading of a document or image causes an error
onErrorUpdate(): fires on a databound object when an error occurs while updating the associated data in the data source object
onExit(): someone clicks on a link or presses the back button
onFilterChange(): fires when a visual filter completes state change
onFinish(): attacker can create the exploit when marquee is finished looping
onFocus(): attacker executes the attack string when the window gets focus
onFocusIn(): attacker executes the attack string when window gets focus
onFocusOut(): attacker executes the attack string when window looses focus
onHelp(): attacker executes the attack string when users hits F1 while the window is in focus
onKeyDown(): user depresses a key
onKeyPress(): user presses or holds down a key
onKeyUp(): user releases a key
onLayoutComplete(): user would have to print or print preview
onLoad(): attacker executes the attack string after the window loads
onLoseCapture(): can be exploited by the releaseCapture() method
onMouseDown(): the attacker would need to get the user to click on an image
onMouseEnter(): cursor moves over an object or area
onMouseLeave(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseMove(): the attacker would need to get the user to mouse over an image or table
onMouseOut(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseOver(): cursor moves over an object or area
onMouseUp(): the attacker would need to get the user to click on an image
onMouseWheel(): the attacker would need to get the user to use their mouse wheel
onMove(): user or attacker would move the page
onMoveEnd(): user or attacker would move the page
onMoveStart(): user or attacker would move the page
onPaste(): user would need to paste or attacker could use the execCommand("Paste") function
onProgress(): attacker would use this as a flash movie was loading
onPropertyChange(): user or attacker would need to change an element property
onReadyStateChange(): user or attacker would need to change an element property
onReset(): user or attacker resets a form
onResize(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeEnd(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeStart(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onRowEnter(): user or attacker would need to change a row in a data source
onRowExit(): user or attacker would need to change a row in a data source
onRowDelete(): user or attacker would need to delete a row in a data source
onRowInserted(): user or attacker would need to insert a row in a data source
onScroll(): user would need to scroll, or attacker could use the scrollBy() function
onSelect(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectionChange(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectStart(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onStart(): fires at the beginning of each marquee loop
onStop(): user would need to press the stop button or leave the webpage
onSubmit(): requires attacker or user submits a form
onUnload(): as the user clicks any link or presses the back button or attacker forces a click

Secure Software Development Guides

Mon, 10 Aug 2009 14:33:44 +0000

This page contains a collection of publicly available secure software development guides. Each guide has its own approach to introducting security in the software development lifecycle.

Windows Server 2003 Security Guide - The Member Server Baseline Policy

Mon, 27 Oct 2008 16:33:25 +0000

An overview of all options and settings available in the Windows audit policy and user rights assignments.

Windows Server 2003 Security Guide - The Domain Policy

Sat, 25 Oct 2008 12:00:20 +0000

An overview of all options and settings available in the domain policy.

Doing a DNS zone transfer

Wed, 16 Jul 2008 09:55:14 +0000

This article shows how you can perform a DNS zone transfer using nslookup on Windows and using dig on Linux.

Security Good Practices

Wed, 13 Feb 2008 17:31:04 +0000

This page contains a list of URLs that contain good practice guides, audit procedures and technology standards that are freely available.

Using openssh without a password

Sun, 10 Feb 2008 16:17:47 +0000

How to configure OpenSSH to use SSH keys for authentication instead of a password.

Using the WebScarab bean shell to modify requests/responses

Sun, 10 Feb 2008 11:40:57 +0000

This article shows how you can use the WebScarab bean shell to modify requests and responses that are transmitted and received by WebScarab.