Security and Privacy in a Networked World/Too easy to misuse

Allikas: KakuWiki
Mine navigeerimisribaleMine otsikasti

Easy enough

Today's topic was inspired by the book Violent Python by TJ O'Connor - but similar easy recipes can also be found online (see links below). The book is definitely recommended, as it introduces using Python for a diverse array of security-related tasks (cracking passwords or Skype database, snooping at wireless connections etc) while only demanding programming skills ranging from very basic to intermediate.

Due to the open nature of our course, this topic will not contain anything that is not already openly available on Internet. Rather than "teaching new tricks", the point of the topic in our course is to make people aware of these simple techniques. Advanced folks can however find some more specific tips from the links provided.

Python (continued)

Strings

Manipulation of strings (textual values) is a common task for security-related scripts in Python - e.g. a web page URL (web address), an IP address or a serial number are all handled as strings. Finding, extracting and relocating substrings (e.g. replace the last block of an IP address with another) are all common.

A typical example is checking if a substring exists in a longer expression: 

signature = "MyServer version 5.05 Enterprise edition"
target = "5.05"
if (target in signature):
  print "This version can be attacked"
else:
  print "This server is secure"


READ MORE at http://docs.python.org/2/library/stdtypes.html#string-methods

Modules

One of the strong points of Python is modularity - one can link specific modules to his/her program to access a multitude of additional functions. The modules are linked to the program using the "import" directive.

We will briefly look at the socket module. Other useful modules in security context are os and sys that contain many useful function to access file systems of different operating systems (including all three major flavours in use today).

READ MORE at http://docs.python.org/2/tutorial/stdlib.html

The socket module

This module contains many handy tools to handle networking. While the full description is available here, let us just stop at some simple uses:

  • socket.socket() - in simple terms, this defines a new network connection. To connect to a specific IP address and port, we need to define a connection to a variable. The following example defines a variable "netcon" and creates a connection to an FTP port of a local network computer:
import socket
netcon = socket.socket()
netcon.connect("192.168.1.10", 21)
  • recv() - asks for a given number of bytes from an open connection. E.g. the previous example may be added something like this:
import socket
netcon = socket.socket()
netcon.connect("192.168.1.10", 21)
reply = netcon.recv(1024)
if ("Old FTP server SomeOldVersion" in reply):
   print "A good target!"
else:
   print "Sorry, no luck."


Notes:

  • Some servers would refuse to answer but many will do it. Typically, the first kilobyte (1024 bytes) of the reply will contain some information about the server - and in many cases, this includes the name and version of the software in use. Now, combining this with a known vulnerability database like SecurityFocus may produce a lot of possibilities.
  • Most web servers tend to refuse connection or ignore it, resulting in timeout (these should be handled by programs too, these examples here are very basic). However, other services (SSH, FTP, e-mail servers) are often more revealing.
  • It is possible to use basic Python (e.g. simple iterations) to automate similar scripts to scan large address blocks for a given vulnerability. E.g.
port = 21
for x in range(1,255):
  print "Checking "192.168.1."+str(x)+":"+str(port)
  ...

Additional reading and links

Study and Blog

  • This week's task will be given only to the course participants during the weekly chat session.
Pärit leheküljelt "https://wiki.kakupesa.net/index.php?title=Security_and_Privacy_in_a_Networked_World/Too_easy_to_misuse&oldid=4082"