.:: Dark Site ::.

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Private Network Using Ike Scanner On Backtrack. 
So there is a myth on everyone mind that VPN Provide Full Protection Against Hacker (Means no hacker can hack :P )...so its never like that if there exist some loop hole than any attacker can hack network against any high security but VPN Does ensure some level of protection..still we will discuss some good and bad point in VPN connection. 
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-Qb7ZSMAmlIs/UrsXs4_dfGI/AAAAAAAAFTg/TIa-jCxFpuc/s1600/vpn-service.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Penetration Testing VPN Network" height="300" src="http://3.bp.blogspot.com/-Qb7ZSMAmlIs/UrsXs4_dfGI/AAAAAAAAFTg/TIa-jCxFpuc/s620/vpn-service.jpg" width="550" /></a></div>The meaning of doing VPN penetration testing because it help the organisation to baseline (identify the loopholes that exist in the present implementation and modify the configuration accordingly to protect itself from known problems) its current VPN security posture, identify threats and weaknesses, and implement a new security policy that will mitigate risks. 
 
Penetration Testing A VPN Network Involves several phases those are :- 
 
<li>Scanning or identifying the VPN gateway. 
<li>Fingerprinting the VPN gateway for guessing implementation. 
<li>PSK mode assessment and PSK sniffing. 
<li>Offline PSK cracking. 
<li>Checking for default user accounts. 
<li>Testing the VPN gateway for vendor specific vulnerabilities. 
 
this first step you can easily do with tools like <a href="http://www.darksite.co.in/2013/08/nmap-commands-for-hackers-kali.html">nmap</a> 
Example :- 
<blockquote>root@bt:~# nmap -sU -p 500 172.16.21.200 
Starting Nmap 5.51 (http://nmap.org) at 2011-11-26 10:56 IST 
Nmap scan report for 172.16.21.200 
Host is up (0.00036s latency). 
PORT STATE SERVICE 
500/udp open isakmp 
MAC Address: 00:1B:D5:54:4D:E4 (Cisco Systems) 
 
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds 
</blockquote>Now as you now i have used -sU For Udp Scan And -p is for specifying port to be 500. 
 
IKE Scan Tool :- 
Ike-scan is a simple but powerful command-line tool that is used to find and fingerprint VPN gateways. It sends specially crafted IKE packets to target gateways and enlists any IKE responses that are received. By default, Ike-scan works in main mode, and sends a packet to the gateway with an ISAKMP header and a single proposal with eight transforms inside it. 
 
Each transform contains a number of attributes like DES or 3DES as the encryption algorithm, SHA or MD5 as the integrity algorithm, a pre-shared key as the authentication type, Diffie-Hellman 1 or 2 as the key distribution algorithm and 28800 seconds as the lifetime. 
 
Initial VPN discovery with Ike-scan is as shown below: 
<blockquote>root@bt:~# ike-scan -M 172.16.21.200 
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 
172.16.21.200 Main Mode Handshake returned 
HDR=(CKY-R=d90bf054d6b76401) 
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) 
VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation) 
 
Ending ike-scan 1.9: 1 hosts scanned in 0.015 seconds (65.58 hosts/sec). 1 returned handshake; 0 returned notify 
</blockquote>The -M shows each payload in a line, so that the output will be neat and easy to understand. The output can be any of the following: 
 
<li>0 returned handshake; 0 returned notify: This means the target is not an IPsec gateway. 
<li>1 returned handshake; 0 returned notify: This means the target is configured for IPsec and is willing to perform IKE negotiation, and either one or more of the transforms you proposed are acceptable. 
<li>0 returned handshake; 1 returned notify: VPN gateways respond with a notify message when none of the transforms are acceptable (though some gateways do not, in which case further analysis and a revised proposal should be tried). 
In the example shown, the VPN gateway replies with one returned handshake and the acceptable transform set has these parameters: 
<blockquote>Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800 
 
Custom transform sets can be tried against the target with the 
"--trans" switch: 
 
--trans=(1=1,2=2,3=1,4=2) 
</blockquote>where 1=Encryption Algorithm, 2=Hash Algorithm, 3=Authentication Method, 4=Group Description, and 5=Group Type. 
 
Kindly refer to <a href="http://www.ietf.org/rfc/rfc2409.txt">RFC 2409</a> Appendix A for a complete understanding of transform set values. There are a number of other tools like ipsectrace, ipsecscan, etc., available for IPsec scanning, but undoubtedly Ike-scan is one of the best and a frequently updated tool. 
 
Vulnerability assessment tools like Nessus, Nexpose, etc, can be used to identify the vulnerabilities of VPN implementations. A full security audit on the target gateway with such types of tools will generate a detailed report with all identified problems and the mitigation steps available. 
 
Further penetration testing i will post on later tutorial plese leave your comment below if you have any query.

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Pri...

Free Learn Wifi Security With Vivek Ramachandran ( Books | Video Tutorials & Concepts )

Hi everyone it really Feel great that Vivek RamaChandran Sir has done an awesome video series of wifi security which makes you clear on most of the concept related to wifi security .past few days i have a great interest on learn wifi security so i found wifi security by vivek sir and let me tells you this video series some contain some quality training material with live practicals and clear cut understanding. 
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-ZWnr2QHW2iA/UrqnroEwaxI/AAAAAAAAFTI/jdFiIZaBDg0/s1600/free+learn.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="free download wifi hacking videos and books" src="http://1.bp.blogspot.com/-ZWnr2QHW2iA/UrqnroEwaxI/AAAAAAAAFTI/jdFiIZaBDg0/s1600/free+learn.png" /></a></div>You must have seen our previous Post 
 
<a href="http://www.darksite.co.in/2013/05/free-download-backtrack-5-wireless.html">Free download BackTrack 5 Wireless Penetration Testing By Vivek Ramachandran</a> Which share free e book by vivek sir. 
 
let me tell you about some contents about the video series:- 
 
It Contain fully practical with explanation.it is best for penetration testers, security enthusiasts and network administrators. 
This video series will take you through a journey in wireless LAN (in)security and penetration testing.it will also teach you very basics of how WLANs work, graduate to packet sniffing and injection attacks, move on to audit infrastructure vulnerabilities, learn to break into WLAN clients and finally look at advanced hybrid attacks involving wireless and applications 
 
A non-exhaustive list of topics to be taught includes: 
 
<li>Bypassing WLAN Authentication – Shared Key, MAC Filtering, Hidden SSIDs 
<li>Cracking WLAN Encryption – WEP, WPA/WPA2 Personal and Enterprise, Understanding encryption based flaws (WEP,TKIP,CCMP) 
<li>Attacking the WLAN Infrastructure – Rogues Devices, Evil Twins, DoS Attacks, MITM, Wi-Fi Protected Setup 
<li>Advanced Enterprise Attacks – 802.1x, EAP, LEAP, PEAP, EAP-TTLS 
<li>Attacking the Wireless Client – Honeypots and Hotspot attacks, Caffe-Latte, Hirte, Ad-Hoc Networks and Viral SSIDs, WiFishing 
<li>Breaking into the Client – Metasploit, SET, Social Engineering 
<li>Enterprise Wi-Fi Worms, Backdoors and Botnets 
 
About VivekRamachandran (Author of Book /Trainer):- 
 
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-m1av9AeJqps/UrqodsnCGOI/AAAAAAAAFTQ/u6ulo66ok74/s1600/vivek+sir.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img alt="Vivek Ramachandran" src="http://2.bp.blogspot.com/-m1av9AeJqps/UrqodsnCGOI/AAAAAAAAFTQ/u6ulo66ok74/s1600/vivek+sir.jpg" /></a></div>Vivek has been into Wireless security research since 2003 ,He was also one of the winners of Microsoft Security Shootout contest held in India among a reported 65,000 participants,his work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. He has spoken/trained at top conferences around the world including Blackhat USA and Abu Dhabi, Defcon, Hacktivity, Brucon, ClubHack, SecurityByte, SecurityZone, Nullcon, C0C0n etc.He is best known in the hacker community as the founder of SecurityTube.net where he routinely posts videos on Wi-Fi Security, Assembly Language, Exploitation Technique. 
 
i think you all security geeks knows him so no need to write more about him. 
 
<a href="http://securitytube.aircrack-ng.org/Wi-Fi-Security-Megaprimer/WLAN-Security-Megaprimer-v1.iso">Download All Free Video Tutorial</a> (iso File 4.2 GB) 
you can also see all video tutorial part wise <a href="http://www.securitytube.net/groups?operation=view&groupId=9">here</a> 
 
TO start up with you need ALFA NETWORK AWUS036NH 2W USB Wireless N Adapte You can easily purchase from<a href="http://www.ebay.com/itm/ALFA-NETWORK-AWUS036NH-2W-USB-Wireless-N-Adapter-WiFi-b-g-N-2000mW-/400611594109?pt=US_USB_Wi_Fi_Adapters_Dongles&hash=item5d464fcf7d"> ebay</a>/amazon .You also need to <a href="http://www.darksite.co.in/2012/05/how-to-install-backtrack-5-r1-in-your.html">set up backtrack</a> on your laptop/pc(<a href="http://www.darksite.co.in/2012/08/how-to-install-vmware-tools-in-backtrack.html">vmweare/virtual box</a>) which i think very easy and i know even a kid can do it. 
 
So Even i have Started to learn wifi security gone upto 22+ videos and the whole video series contain 45+ Videos so have fun and special thanks to vivek sir _/\_ for making these videos and sharing it for free.

Free Learn Wifi Security With Vivek Ramachandran ( Books | Video Tutorials & Concepts )

Hi everyone it really Feel great that Vivek RamaChandran Sir has done an awesome video series of wifi security which makes you clear on most...

How to Protect your website from web vulnerability Scanners

Hello here i come with a small trick but quite useful it can make your website safe from kiddie hackers :P. some time actually new born hackers do use various web scanners like Acunetix, nessus, Openvas & other scanner available at backtrack.so being a web sec guy how can you protect your website from such automated scanner the code is very simple all you need to do is Just add the below given codes to your .htaccess file . <div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-RPof0-1im78/UrYVEu9P77I/AAAAAAAAFS4/3serRHoAdqA/s1600/hacker.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="protect from web vulnerability scanners" src="http://4.bp.blogspot.com/-RPof0-1im78/UrYVEu9P77I/AAAAAAAAFS4/3serRHoAdqA/s620/hacker.png" /></a></div><blockquote>RewriteEngine On 
<�IfModule mod_rewrite.c> 
RewriteCond %{HTTP_USER_AGENT} ^w3af.sourceforge.net [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} dirbuster [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nikto [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} SF [OR] 
RewriteCond %{HTTP_USER_AGENT} sqlmap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} fimap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nessus [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} whatweb [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} Openvas [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} jbrofuzz [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} libwhisker [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} webshag [NC,OR] 
RewriteCond %{HTTP:Acunetix-Product} ^WVS 
RewriteRule ^.* http://127.0.0.1/ [R=301,L] 
<�/�IfModule> 
(Please Remove � On Original Code) 
</blockquote>after adding this content to .htaccess save it now.this is just a counter step taken to stay away from web scanners. hope you like this post do share ,comments ,like and thank you :) .

How to Protect your website from web vulnerability Scanners

Hello here i come with a small trick but quite useful it can make your website safe from kiddie hackers :P. some time actually new born hack...

installing Nessus Scanner For Network Vulnerability in Backtrack

uhh...hi everyone after a long days i have started posting tut so lets get started today we will be installing nessus scanner on backtrack and using it.<a href="http://www.darksite.co.in/2012/05/how-to-install-and-configure-best.html">Check my long old post :D </a> 
<h3>What is Nessus is For?</h3><div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-pbnxCY-pry8/UrVfLlBYacI/AAAAAAAAFSo/5Hyj477KZN4/s1600/nessus.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/-pbnxCY-pry8/UrVfLlBYacI/AAAAAAAAFSo/5Hyj477KZN4/s320/nessus.jpg" /></a></div>Nessus is a network vulnerability scanning program thats give you power to find you all the Vulnerability present on the network/host . It is free for personal use. Its can detect vulnerabilities on the systems. Nessus is the most popular vulnerability scanner in the computer security. Nessus allows scans for vulnerabilities, Misconfiguration, default passwords / common passwords / blank passwords on some system accounts, etc. You can use Nessus to scan your system and patch the vulnerability. If you want install Nessus on Backtrack 5 R3 first thing to do is download it from <a href="http://www.tenable.com/products/nessus/">http://www.tenable.com/products/nessus/</a> 
 
So we will discuss how we can install it online (if you are having internet connection) 
Nessus 4.4.1 now comes pre-installed on BackTrack 5 and requires that the user activate the installation. 
Here are the commands to install nessus : open terminal and type(if you don't know :P) 
 
apt-get install nessus 
 
After install it, create an account with adduser command like this 
 
/opt/nessus/sbin/nessus-adduser 
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-SwkweRQbTY4/UrVbLiCeDcI/AAAAAAAAFSQ/CRXG3w8ZclU/s1600/BT5-Adding-User.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/-SwkweRQbTY4/UrVbLiCeDcI/AAAAAAAAFSQ/CRXG3w8ZclU/s400/BT5-Adding-User.png" /></a></div>After you've entered a username, the nessus-adduser program asks you if the user account should have admin privileges or not. It is recommended that the initial user account have admin privileges so you can use the Nessus Web Interface to create subsequent accounts. The only difference between a Nessus admin user and a regular user is the ability to create user accounts. 
<h3>Registering Account For Nessus</h3> 
Once you have Nessus installed on BackTrack 5, you will need to obtain a Nessus activation code. If you wish to purchase a ProfessionalFeed, you can visit the <a href="https://store.tenable.com/">Tenable Store</a>. If you are using Nessus at home or wish to evaluate Nessus, you can <a href="http://www.tenable.com/products/nessus/nessus-homefeed">register a HomeFeed</a>. It’s important to note that the HomeFeed is limited to 16 IP addresses per scan (whereas the ProfessionalFeed allows you to scan an unlimited number of IP addresses). The ProfessionalFeed also gives you access to features such as Configuration and Sensitive Data Auditing, SCADA plugins, Nessus Technical Support and access to the Tenable Customer Portal. 
 
After registering they will send you activation code to your email. After you get the key, run this command, fill change xxxx-xxxx-xxxx-xxxx-xxxx with your key 
 
/opt/nessus/bin/nessus-fetch --register xxxx-xxxx-xxxx-xxxx-xxxx 
 
It will take some time because plugin is being updated. After the update complete, run your Nessus 
 
/etc/init.d/nessusd start 
 
Then open your browser and type this in the URL of the browser 
 
https://localhost:8834/ 
(You can also access the Nessus Web Interface remotely/outside by using the IP address assigned to BackTrack 5 (e.g. https://192.168.37.210:8834/).) 
 
Nessus will run on the secure channel https and on the port number 8834. 
 
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-B7FcjH3YytI/UrVdkT0oTdI/AAAAAAAAFSc/A1cq0Dj8tRo/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-B7FcjH3YytI/UrVdkT0oTdI/AAAAAAAAFSc/A1cq0Dj8tRo/s320/2.png" /></a></div> 
Now try and use Nessus for your own risk :-D.. 
 
Next tutorial i will post how to scan a host and get a report using nessus scanner.if you need anyhelp on any tools do post as a comment i will definitely reply on you also i also encourage everyone to use Backtrack if you wann learn more on security things 
.

installing Nessus Scanner For Network Vulnerability in Backtrack

uhh...hi everyone after a long days i have started posting tut so lets get started today we will be installing nessus scanner on backtrack a...

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Free Learn Wifi Security With Vivek Ramachandran ( Books | Video Tutorials & Concepts )

How to Protect your website from web vulnerability Scanners

installing Nessus Scanner For Network Vulnerability in Backtrack

Popular Posts

Blog Archive