(Demo) Ethical Hacking - Web Parameter Tampering

It could be fun and effective to show simple but interesting hacking demo while discussing application security with clients, to show how easy it is, and how serious the results could be.

One of the recommended "simple demo" is Web Parameter Tampering, on payment gateway.

Scenario:

- When people are going to pay for an item online, it is not difficult to change the price (so-called "Web Parameter") with the assistance of hacking tools.

- There are easy tools for Web Parameter Tampering. I take TamperIE as an example.

Tool: TemperIE (Download: http://www.bayden.com/tamperie/)

Demo Site for a "successful" tempering:

http://www.bayden.com/sandbox/shop/

I would suggest you go through with above demo site first.

Here I "test" this with an online shop......Let's see if I could succeed.

Important Note: I do not engage hacking as a habit, but to share with the public how back guy would perform hacking. Through this exercise, good guy understands how bad guys act, and try a different way to make the bad guy a hard time.

#1 - I (a bad guy) would like to purchase a blouse online, however, I think $45 is too expensive for me.

#2 Once I click "pay now", my pre-installed parameter tampering tool prompts, and shows me parameters on this webpage. Price is one of those as highlighted.

#3 $49 +$30 shipping. Total $79. Too expensive for me! So I change the price to $9 with the tool.

 

#4 However......The website is smart enough to detect the change of a parameter (the price).

#5 How Taobao detect this? We could see a parameter "SecStrNoCCode", which is believed to be a hash of the page and is used to check against the change of web parameters from page to page. Any change of parameter would induce a different hash. My best guess of the full meaning of this name is "Security String No Change of Code"

 

Penetration Test for Enterprise Data Loss

An enterprise suspects leakage of confidential information to competitors, because of frequent bid loss recently. Senior management would like to have an external party (security service provider) to find out if there exist possible channels, that internal or external hackers leaking out or sniffering bid information.

What should be involved in a Penetration Test for Data Loss Prevention:

1. Define Objectives of the Penetration Test

- What area is going to be evaluated? (DLP, etc)
- What are required to be found out? (Vulnerabilities, Risks, Recommendations)

2. Define the Scope of Penetration Test (ie. The Investigation Focus)
Service provider has better to spend most effort in this part in the early phase of project.

- What are being investigated? ...data loss (DL) in this case
    (DL via email, **
     DL via removable medias,
     DL via other service (eg. Web Portal, File Server to external)
     DL via physcial access
     DL via network level attack)

- Taking DLP via Email as an example, analyse what are the possible "cause" of data loss?
   (Human Factors - e.g., user mistakes or being social engineering attack,
    Under Password Attack - e.g., brute force attack,
    Machine Remote Controlled - e.g., PC or server being controlled and email box can be easily accessed,
    Login Credential Sniffed - e.g., by sniffing on network,
    etc.)

- Not at the causes can be proved/tried in the pentest, especially when limited budget or resources are available. Should works according to priorities.  For example, enterprise would focus on "Machine Remote Controlled" and "Login Credential Sniffed", this could be because these are usually the high risk area that the service provider/enterprise has experienced.

- Service provider will plan the pentest by assuming herself as the possible internal/external hackers who steal data by  (A) "remotely control on target machine (email server in this example)" and  (B) "sniffing (email) login credential".

3. State Assumptions

State role and responsibility of service provider and enterprise and what are excluded, which could otherwise become controversy.

4. Standard and Guideline that the pentest follows

(for example)
- White Hat. Inc
- ISO 17799

5. Explain the Methodology

(as from open standard or service provider usual practice.)

6. Zero Knowledge Pentest (Step-by-step what to do)
- Targets service (Email, WebMail, Some other important related services)
- Netcraft Search Web by Domain
- DNS Whois Query
- Domain Lookup
- Traceroute
- ICMP Traffic Test
- Sifting Contents by Server and by Google
- SSL Server Certificates
- Identified Services
- Email OWA Passward Guessing
- Identified Vulnerabilities

7. Internal Vulnerability Assessment (Step-by-Step what to do)
(for example, if focus on wireless network...)
- Wireless access points
- Devices that connected to wireless network
- Vulnerabilities identified in access points and end-point devices

8. Recommendations
bla bla bla based on the foundings...  :)
~~~~~

Again, the above is not a complete security review on DL.  Instead, this exercise is a pentest against certain high risk DL areas, like possibly infected email and important servers, wireless access point, and the endpoint device that connected to access point, etc.

Ethical Hacking -- Proxy Hunter

Proxy Hunter is a proxy application that lets you scan for proxy servers.
Proxy Hunter is also a malware if it is unintentionally installed in your PC.

Proxy Hunter could be an danagerous tools if it is used by Hacker or Botnet, as those found (free) Proxy may be utilized as Zombie and could hide the Hacker away when Hacker lauch a DDoS to his/her target.

The reason to share Proxy Hunter info here is let people know how a Hacker can look for resource launching DDoS attack. We are not aiming at promoting Hacking as a habit.

As Proxy Hunter could be a tools for devils, it is not easy to Google search a valid download link. Here is the portal you could find it

URL: http://download.pchome.net/
filename: proxyht310b.zip

After installation, open it, and YOU MUST read the Warning.

 

Considering the damage that a Proxy Hunter could do, and some PC users may unintentionally installed with a Proxy Hunter, your PC's AV software will not recommend a Proxy Hunter. Click "Allow" only when you are sure what you are doing now.

 

Launch Proxy Hutner. Following the Step-by-Step tutorial : (in Chinese)
URL:  http://www.360doc.com/content/09/1204/12/261866_10342617.shtml

Or this simple tutorial (in English):
http://www.proxysecurity.com/proxy-hunter.php



The searching may need several hours for a Class B.   ......to be continued....