It has been a while since my last post as usual. I have been working on getting my CCNA, but I am dealing with so many vendors/projects/work that I may have to do that at the end of the year. It has been a good journey since I set up the CCNA hardware. Next, I took the VMware ESXi course which was a fun experience. I saw the benefit of storage vmotion which is awesome when you want to clean up your virtual machines that are on local disk of your ESX/ESXi servers. However, you have to have the full license (ENTERPRISE) in order to use it. Very expensive in my opinion but it is worth it. VMware is a great company even though they have little Linux (Workstation) support.
Next, I signed up to the
HackingDojo by Thomas Wilhelm. You can sign up for 150 dollars a month. I think they have added a subscription where you can pay about 1000-1200 dollars for a lifetime subscription. I subscribed for two months to keep myself sharp on my offensive skills. I really liked the course and I think given enough time, it will be one of the best courses out there. A little rundown of the course is that you have a 6 levels that you must reach. You can start wherever you would like but I started at the Shodan level which is basically the 2nd level. In order to advance to the next level you must pass an exam. You are given about 48-hours to pass the exam. You can schedule an attempt for the next level at any time. However, I would suggest (and so would Thomas) that you look at the videos and read the forums to learn the lessons of the current level. In addition to the videos, you were able to skype with a teacher who is highly qualified so he/she can answer questions and further explain any lessons you have trouble with. Also, they would answer any personal questions you had such as career questions and suggestions. Very helpful in my opinion. I had a lot of experience already in a lot of the topics since I have already passed the OSCP, OSCE and GPEN courses. However, the topic of password attacking (local and remote) was definitely an eye opener. I thought I had a grasp however, as usual there are most aspects to learn. It was actually stated on one my favorite sites, EthicalHacker.Net. The url is "http://www.ethicalhacker.net/content/view/341/2/". The short of it is that when you have hashed passwords that you want to crack, you have to take into account that you may be dealing with a password that was encoded in base64 instead of unicode before it was hashed.
It seems that you run into that situation when you have passwords with special characters since it is based on words from different countries ( Japan, Germany, France, China, Africa, etc). The special characters may sometimes be change to base64 substitution and then, hashed into SHA-1 or SHA384, SHA512, MD5, DES, 3DES, etc. There is no way to tell if it was a base64 or unicode used in the hash so you have to try both. Of course, Thomas has his students do homework assignments. He gave a list of hashes to break and he gave you hints of the password origins such as Germany or Africa. I struggled a while until I setup a couple of scripts that converted wordlists I found from the Internet.
Wordlists:
http://www.cotse.com/tools/wordlists1.htm
http://www.cotse.com/tools/wordlists2.htm
http://g0tmi1k.blogspot.gr/2011/06/dictionaries-wordlists.html?m=1
http://www.skullsecurity.org/wiki/index.php/Passwords
http://www.dicts.info/uddl.php
http://www.isdpodcast.com/resources/62k-common-passwords/
http://packetstormsecurity.org/Crackers/wordlists/
There are more wordlists on the Internet of course but I just wanted to list a few urls as examples. Once you have collected relevant wordlists, you need to convert the words with special characters to UNICODE and BASE64. Depending on the length of your wordlists, it will usually take a while. Once that is done, you have to use the new "converted" wordlists against the given hashes. You can use JTR [John the Ripper (http://www.openwall.com/john/)] or even use your own coding to test against the hashes. In addition, to help with the wordlists, you can use programs such as cewl (http://www.digininja.org/projects/cewl.php) and rsmangler (http://www.digininja.org/projects/rsmangler.php). I had the most success using the "cewl" tool. It was very effective for me but I invite you to check it out for yourself.
I also learned more about passive information gathering. There is a lot of information about a person, group or organization on the Internet that you can find for free or a small fee. The best tool for this kind of recon work is of course Google. You can actually search a web cached version of a website which is helpful if you have a scope that limits your interaction with a target website. You can use it with the url: "
http://webcache.googleusercontent.com/search?q=cache:www.testtargetsite.com". You can also use the "wayback" site: "http://archive.org/web/web.php" to find older versions of the target site if it is available. These are some of the sites I used to find information on targets:
https://www.google.com
http://www.zabasearch.com/
http://www.dogpile.com/
http://www.zoominfo.com/
http://www.spokeo.com/
http://www.alexa.com/
http://www.zoominfo.com/
Again, there are more sites to use but I had success with those sites. In conclusion, I have to say, the HackingDojo is a course to take if you want to learn more about hacking and penetration testing. I was very happy with the course and I learned a lot. I wanted to take a pause from the course, so I can sharpen my python skills. I want to take the course from SecurityTube: "
http://securitytube-training.com/certifications/securitytube-python-scripting-expert/". It looks like I will be a better python programmer after taking a course like that. I will try to provide info once I have started the course. Till next time. Oh, here are the conversion scripts. I am sure there are better ways to script these, but again, I am a work in progress.
Conversion Scripts
#!/usr/bin/python
# -*- coding: utf-8 -*-
'''
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
# Name: splitdictionary.py
# Original Author: Agoonie
# The script is to pull dictionaries and grab words. Then, it converts the words to base64 if they have special character entities...
# Created: 08/25/2012
# Last Edited: 08292012
# Version Num: 1
# Requirements: Written and tested in Python 2.65
# CREDIT:
# I used information from all of the following:
# Author: J-rock
# J-rock Script: base64_to_text.py
# gomputor.wordpress.com/2008/09/27/search-replace-multiple-words-or-characters-with-python/
# http://wiki.webz.cz/dict/
# http://www.dicts.info/uddl.php
# stackoverflow.com/questions/6116978/python-replace-multiple-strings
# docs.python.org/library/stdtypes.html
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
'''
import re,string
import os,sys
import os.path
codes = {'"': '"', '&': '&', '<': '<', '>': '>',
'¡': '¡', '¢': '¢', '£': '£', '¤': '¤',
'¥': '¥', '¦': '¦', '§': '§', '¨': '¨',
'©': '©', 'ª': 'ª', '«': '«', '¬': '¬',
'': '­', '®': '®', '¯': '¯', '°': '°',
'±': '±', '²': '²', '³': '³', '´': '´',
'µ': 'µ', '¶': '¶', '·': '·', '¸': '¸',
'¹': '¹', 'º': 'º', '»': '»', '¼': '¼',
'½': '½', '¾': '¾', '¿': '¿', 'À': 'À',
'Á': 'Á', 'Â': 'Â', 'Ã': 'Ã', 'Ä': 'Ä',
'Å': 'Å', 'Æ': 'Æ', 'Ç': 'Ç', 'È': 'È',
'É': 'É', 'Ê': 'Ê', 'Ë': 'Ë', 'Ì': 'Ì',
'Í': 'Í', 'Î': 'Î', 'Ï': 'Ï', 'Ð': 'Ð',
'Ñ': 'Ñ', 'Ò': 'Ò', 'Ó': 'Ó', 'Ô': 'Ô',
'Õ': 'Õ', 'Ö': 'Ö', '×': '×', 'Ø': 'Ø',
'Ù': 'Ù', 'Ú': 'Ú', 'Û': 'Û', 'Ü': 'Ü',
'Ý': 'Ý', 'Þ': 'Þ', 'ß': 'ß', 'à': 'à',
'á': 'á', 'â': 'â', 'ã': 'ã', 'ä': 'ä',
'å': 'å', 'æ': 'æ', 'ç': 'ç', 'è': 'è',
'é': 'é', 'ê': 'ê', 'ë': 'ë', 'ì': 'ì',
'í': 'í', 'î': 'î', 'ï': 'ï', 'ð': 'ð',
'ñ': 'ñ', 'ò': 'ò', 'ó': 'ó', 'ô': 'ô',
'õ': 'õ', 'ö': 'ö', '÷': '÷', 'ø': 'ø',
'ù': 'ù', 'ú': 'ú', 'û': 'û', 'ü': 'ü',
'ý': 'ý', 'þ': 'þ', 'ÿ': 'ÿ', 'Œ': 'Œ',
'œ': 'œ', 'Š': 'Š', 'š': 'š', 'Ÿ': 'Ÿ',
'ƒ': 'ƒ', 'ˆ': 'ˆ', '˜': '˜', 'Α': 'Α',
'Β': 'Β', 'Γ': 'Γ', 'Δ': 'Δ', 'Ε': 'Ε',
'Ζ': 'Ζ', 'Η': 'Η', 'Θ': 'Θ', 'Ι': 'Ι',
'Κ': 'Κ', 'Λ': 'Λ', 'Μ': 'Μ', 'Ν': 'Ν',
'Ξ': 'Ξ', 'Ο': 'Ο', 'Π': 'Π', 'Ρ': 'Ρ',
'Σ': 'Σ', 'Τ': 'Τ', 'Υ': 'Υ', 'Φ': 'Φ',
'Χ': 'Χ', 'Ψ': 'Ψ', 'Ω': 'Ω', 'α': 'α',
'β': 'β', 'γ': 'γ', 'δ': 'δ', 'ε': 'ε',
'ζ': 'ζ', 'η': 'η', 'θ': 'θ', 'ι': 'ι',
'κ': 'κ', 'λ': 'λ', 'μ': 'μ', 'ν': 'ν',
'ξ': 'ξ', 'ο': 'ο', 'π': 'π', 'ρ': 'ρ',
'ς': 'ς', 'σ': 'σ', 'τ': 'τ', 'υ': 'υ',
'φ': 'φ', 'χ': 'χ', 'ψ': 'ψ', 'ω': 'ω',
'ϑ': 'ϑ', 'ϒ': 'ϒ', 'ϖ': 'ϖ', '–': '–',
'—': '—', '‘': '‘', '’': '’', '‚': '‚',
'“': '“', '”': '”', '„': '„', '†': '†',
'‡': '‡', '•': '•', '…': '…', '‰': '‰',
'′': '′', '″': '″', '‹': '‹', '›': '›',
'‾': '‾', '⁄': '⁄', '€': '€', 'ℑ': 'ℑ',
'℘': '℘', 'ℜ': 'ℜ', '™': '™', 'ℵ': 'ℵ',
'←': '←', '↑': '↑', '→': '→', '↓': '↓',
'↔': '↔', '↵': '↵', '⇐': '⇐', '⇑': '⇑',
'⇒': '⇒', '⇓': '⇓', '⇔': '⇔', '∀': '∀',
'∂': '∂', '∃': '∃', '∅': '∅', '∇': '∇',
'∈': '∈', '∉': '∉', '∋': '∋', '∏': '∏',
'∑': '∑', '−': '−', '∗': '∗', '√': '√',
'∝': '∝', '∞': '∞', '∠': '∠', '∧': '∧',
'∨': '∨', '∩': '∩', '∪': '∪', '∫': '∫',
'∴': '∴', '∼': '∼', '≅': '≅', '≈': '≈',
'≠': '≠', '≡': '≡', '≤': '≤', '≥': '≥',
'⊂': '⊂', '⊃': '⊃', '⊄': '⊄', '⊆': '⊆',
'⊇': '⊇', '⊕': '⊕', '⊗': '⊗', '⊥': '⊥',
'⋅': '⋅', '⌈': '⌈', '⌉': '⌉', '⌊': '⌊',
'⌋': '⌋', '〈': '〈', '〉': '〉'}
def replace_all(text,dic):
for k,v in dic.items():
text = text.replace(k,v)
return text
if len(sys.argv) != 3:
print "[+] Usage: ./filename [wordlist-to-split] [newwordlist]"
sys.exit(1)
wordlist= sys.argv[1]
finallist = sys.argv[2]
mywordlist = []
finalwordlist = []
if os.path.exists(wordlist):
print "I have found your wordlist!\n\n" + wordlist + "\n\n"
file = open(wordlist,'r').read()
words = re.split(r'[\t,\n,\s]', file)
for word in words:
mywordlist.append(word)
else:
print "I cannot find the file! "
mywordlist = list(set(mywordlist))
mywordlist.sort()
filename = "tempname.txt"
f = open(filename,'w')
f.write("\n".join(mywordlist))
f.close
akey =[]
for key,value in codes.iteritems():
akey.append(key)
for line in mywordlist:
finalwordlist.append(replace_all(line,codes))
for char in akey:
if char in line:
finalwordlist.append(line)
finalwordlist = list(set(finalwordlist))
finalwordlist.sort()
g = open(finallist,'w')
g.write("\n".join(finalwordlist))
g.close
os.remove("tempname.txt")
print "Your new file is done and it is called " + finallist
#!/usr/bin/python
# -*- coding: utf-8 -*-
'''
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
# Name: splitdictionary.py
# Original Author: Agoonie
# The script is to pull dictionaries, grab words from docs in a directory. Then, it converts the words to base64 if they have special character entities...
# Created: 08/25/2012
# Last Edited: 08292012
# Version Num: 1
# Requirements: Written and tested in Python 2.65
# CREDIT:
# I used information from all of the following:
# Author: J-rock
# J-rock Script: base64_to_text.py
# gomputor.wordpress.com/2008/09/27/search-replace-multiple-words-or-characters-with-python/
# http://wiki.webz.cz/dict/
# http://www.dicts.info/uddl.php
# stackoverflow.com/questions/6116978/python-replace-multiple-strings
# docs.python.org/library/stdtypes.html
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
'''
import re,string
import os,sys
import os.path
import glob
codes = {'"': '"', '&': '&', '<': '<', '>': '>',
'¡': '¡', '¢': '¢', '£': '£', '¤': '¤',
'¥': '¥', '¦': '¦', '§': '§', '¨': '¨',
'©': '©', 'ª': 'ª', '«': '«', '¬': '¬',
'': '­', '®': '®', '¯': '¯', '°': '°',
'±': '±', '²': '²', '³': '³', '´': '´',
'µ': 'µ', '¶': '¶', '·': '·', '¸': '¸',
'¹': '¹', 'º': 'º', '»': '»', '¼': '¼',
'½': '½', '¾': '¾', '¿': '¿', 'À': 'À',
'Á': 'Á', 'Â': 'Â', 'Ã': 'Ã', 'Ä': 'Ä',
'Å': 'Å', 'Æ': 'Æ', 'Ç': 'Ç', 'È': 'È',
'É': 'É', 'Ê': 'Ê', 'Ë': 'Ë', 'Ì': 'Ì',
'Í': 'Í', 'Î': 'Î', 'Ï': 'Ï', 'Ð': 'Ð',
'Ñ': 'Ñ', 'Ò': 'Ò', 'Ó': 'Ó', 'Ô': 'Ô',
'Õ': 'Õ', 'Ö': 'Ö', '×': '×', 'Ø': 'Ø',
'Ù': 'Ù', 'Ú': 'Ú', 'Û': 'Û', 'Ü': 'Ü',
'Ý': 'Ý', 'Þ': 'Þ', 'ß': 'ß', 'à': 'à',
'á': 'á', 'â': 'â', 'ã': 'ã', 'ä': 'ä',
'å': 'å', 'æ': 'æ', 'ç': 'ç', 'è': 'è',
'é': 'é', 'ê': 'ê', 'ë': 'ë', 'ì': 'ì',
'í': 'í', 'î': 'î', 'ï': 'ï', 'ð': 'ð',
'ñ': 'ñ', 'ò': 'ò', 'ó': 'ó', 'ô': 'ô',
'õ': 'õ', 'ö': 'ö', '÷': '÷', 'ø': 'ø',
'ù': 'ù', 'ú': 'ú', 'û': 'û', 'ü': 'ü',
'ý': 'ý', 'þ': 'þ', 'ÿ': 'ÿ', 'Œ': 'Œ',
'œ': 'œ', 'Š': 'Š', 'š': 'š', 'Ÿ': 'Ÿ',
'ƒ': 'ƒ', 'ˆ': 'ˆ', '˜': '˜', 'Α': 'Α',
'Β': 'Β', 'Γ': 'Γ', 'Δ': 'Δ', 'Ε': 'Ε',
'Ζ': 'Ζ', 'Η': 'Η', 'Θ': 'Θ', 'Ι': 'Ι',
'Κ': 'Κ', 'Λ': 'Λ', 'Μ': 'Μ', 'Ν': 'Ν',
'Ξ': 'Ξ', 'Ο': 'Ο', 'Π': 'Π', 'Ρ': 'Ρ',
'Σ': 'Σ', 'Τ': 'Τ', 'Υ': 'Υ', 'Φ': 'Φ',
'Χ': 'Χ', 'Ψ': 'Ψ', 'Ω': 'Ω', 'α': 'α',
'β': 'β', 'γ': 'γ', 'δ': 'δ', 'ε': 'ε',
'ζ': 'ζ', 'η': 'η', 'θ': 'θ', 'ι': 'ι',
'κ': 'κ', 'λ': 'λ', 'μ': 'μ', 'ν': 'ν',
'ξ': 'ξ', 'ο': 'ο', 'π': 'π', 'ρ': 'ρ',
'ς': 'ς', 'σ': 'σ', 'τ': 'τ', 'υ': 'υ',
'φ': 'φ', 'χ': 'χ', 'ψ': 'ψ', 'ω': 'ω',
'ϑ': 'ϑ', 'ϒ': 'ϒ', 'ϖ': 'ϖ', '–': '–',
'—': '—', '‘': '‘', '’': '’', '‚': '‚',
'“': '“', '”': '”', '„': '„', '†': '†',
'‡': '‡', '•': '•', '…': '…', '‰': '‰',
'′': '′', '″': '″', '‹': '‹', '›': '›',
'‾': '‾', '⁄': '⁄', '€': '€', 'ℑ': 'ℑ',
'℘': '℘', 'ℜ': 'ℜ', '™': '™', 'ℵ': 'ℵ',
'←': '←', '↑': '↑', '→': '→', '↓': '↓',
'↔': '↔', '↵': '↵', '⇐': '⇐', '⇑': '⇑',
'⇒': '⇒', '⇓': '⇓', '⇔': '⇔', '∀': '∀',
'∂': '∂', '∃': '∃', '∅': '∅', '∇': '∇',
'∈': '∈', '∉': '∉', '∋': '∋', '∏': '∏',
'∑': '∑', '−': '−', '∗': '∗', '√': '√',
'∝': '∝', '∞': '∞', '∠': '∠', '∧': '∧',
'∨': '∨', '∩': '∩', '∪': '∪', '∫': '∫',
'∴': '∴', '∼': '∼', '≅': '≅', '≈': '≈',
'≠': '≠', '≡': '≡', '≤': '≤', '≥': '≥',
'⊂': '⊂', '⊃': '⊃', '⊄': '⊄', '⊆': '⊆',
'⊇': '⊇', '⊕': '⊕', '⊗': '⊗', '⊥': '⊥',
'⋅': '⋅', '⌈': '⌈', '⌉': '⌉', '⌊': '⌊',
'⌋': '⌋', '〈': '〈', '〉': '〉'}
def replace_all(text,dic):
for k,v in dic.items():
text = text.replace(k,v)
return text
if len(sys.argv) != 2:
print "[+] Usage: ./filename directory"
sys.exit(1)
path = sys.argv[1]
mywordlist = []
finalwordlist = []
for wordlist in glob.glob(os.path.join(path,'*.txt')):
file = open(wordlist,'r').read()
words = re.split(r'[\t,\n,\s]', file)
for word in words:
mywordlist.append(word)
(filepath, ffilename) = os.path.split(wordlist)
finallist = "c_"+ffilename
mywordlist = list(set(mywordlist))
mywordlist.sort()
filename = "tempname.txt"
f = open(filename,'w')
f.write("\n".join(mywordlist))
f.close
akey =[]
for key,value in codes.iteritems():
akey.append(key)
for line in mywordlist:
finalwordlist.append(replace_all(line,codes))
for char in akey:
if char in line:
finalwordlist.append(line)
finalwordlist = list(set(finalwordlist))
finalwordlist.sort()
g = open(finallist,'w')
g.write("\n".join(finalwordlist))
g.close
os.remove("tempname.txt")
print "Your new file is done and it is called " + finallist
