Targeted Web Attacks
Comments(0)
Targeted Web Attacks
Part 2 of Social Networks the New Fingerd
Author david.kierznowski_at_gmail.com
http://michaeldaw.org
1. Introduction
I recently released an article titled, “Social networks the New FingerD”. This article gave an example of using LinkedIn in passive username enumeration attacks. This article will discuss using Search engines and OpenPGP key servers as additional enumeration resources. None of these ideas are new, but in my opinion require a bit more light, especially when looking at RSnake’s recent XSS Top Vulnerability post
2. Purpose
At the moment XSS attack scenarios are very broad. XSS to create a botnet or propogate a worm etc etc. There is no real direction toward actual focused XSS exploitation. In theory one could own the continent(s) and then filter out specific targets, but lets face it, this is probably not the smartest thing to do.
3. The How?
My initial thoughts on targeted Web attacks “from the Internet” include some of the following ideas:
Backdooring the Company Homepage
Many users have their browser’s default (or startup) page set to the company website. However, this may not work in some cases as internal users often connect to an Intranet website rather then an Internet website. Another solution to this problem may be to backdoor another website associated with the company (i.e. company webmail, or Citrix Gateway).
Information Gathering Attacks
In most cases, specific exploitation requires fore-knowledge of our target. For example, Jane Daw works at company X as a legal secretary. Once this information is known any number of “specific” attacks can be launched. These attacks can occur via HTTP, Email, social engineering and password brute forcing to name a few.
Over the last month, pdp (architect) and I (was that the right way round, can never remember) have been working on backdooring a number of web technologoies. So far our list includes:
* Web Pages
* Flash
* Quicktime
* PDF
* MP3 (Although this uses Quicktime)
So the question still remains, what web resources do we have available to us to passively enumerate users within an organisation?
We have already discussed using Social Networks such as LinkedIn. Two other possibilities are as follows:
* Public Key Servers
* Search Engines
3.1 Public Key Servers
Public key servers allows a single repository for users to store their public keys on the Internet. This allows users to encrypt email between two parties easily without having to hastle the recipient for their public keys.
This service is an excellent resource to enumerate employee details within an organisation.
Example search for google.com using “http://keyserver.veridis.com:11371“:
--snip-- Results 1 - 30 of about 41 for google.com. (0.019 seconds) Key(s) Key ID Size Creation Expiration *hidden* *hidden*@google.com 0x4F79C91B 4096/1024 2006/06/13 2011/06/12 *hidden* *hidden*@google.com 0x8475A4CF 2048/1024 2001/05/07 Never *hidden* *hidden*@google.com 0x9038F60E 2048/1024 2001/02/20 Never *hidden* *hidden*@google.com 0xE617F27A 1024 2005/07/13 2006/07/13 *hidden* *hidden*@inodes.org 0xD02F8773 1024/1024 2000/03/08 Never *hidden* *hidden*@google.com 0x20C9885A 2048/1024 2005/10/12 Never *hidden* *hidden*@red-bean.com 0xEC6B5156 1024/1024 1998/11/09 Never *hidden* *hidden*@google.com 0x4E844EF3 1024 2005/07/27 2006/07/26 *hidden* *hidden*@google.com 0x2349D344 2048/1024 2005/12/06 2007/12/06 *hidden* *hidden*@google.com 0x438046E4 2048/1024 2005/12/12 Never --snip--
3.2 Search Engine
Search engines when used correctly can yield very sensitive information. For more information on this see: http://johnny.ihackstuff.com/.
4. Tools
I was thinking about writing a tool to automate these checks, however, when bouncing it off pdp (architect), I found he had already done the work.
His tool is a little outdated but provides support for both Google and OpenPGP checks. It can be found at the following URL:
http://www.gnucitizen.org/projects/met/