Archivo de la categoría: Linux

10 things you should be doing if you care about security in your Tech Startup

I’ve been working in the startup world as a Software Engineer for a little bit more than two years now, as most of you already know, I’m very passionate about information security so I decided to create a list of things you can do to protect your technology Startup (most of them for free).

SPOILER ALERT: This publication is not going to be your typical article about which crypto cipher is better to use, IDS comparisons or talking about specific DLP products , instead, I would like to cover 10 actions (more like advices) you can take if you value your product, your data, your employees and if you want to protect your Startup in general.

So if you are the CEO, CTO, some high executive or a decision maker in your Startup this information is for you.

1: Enforce the use of password managers

Everything starts with a password, literally, sign-in into your computer is one of the first thing most of you do every morning. Whether email clients, social networks, instant messaging apps, or online banking all this requires the user to provide a password in order to access the service so it’s natural for common users to want to think in a password only 1 time and then reuse it across multiple services.

Reusing passwords (even with small variations) it’s a bad thing because once your password is guessed/stolen it can be used to compromise all your other accounts (facebook, twitter, instagram, gmail, outlook, etc), attackers can automate the process using hacking tools such as credmap: The Credential Mapper.

So how do we prevent employees passwords to be guessed (dictionary attack) while at the same time make sure they are using strong and unique passwords on each one of their accounts? The answer is Password Managers.

Password Managers allow you to have one master password (for choosing a strong master password please refer to my talk How to create secure passwords) and then generate all the others you need based on a secure configuration such as secret length, character types, etc.

So the next time you want to access your favorite social network you just need to copy and paste the password, that also prevents your password for being stolen in case of a keylogger attack. You don’t want your community manager accounts to be stolen right?

There are a lot of good solutions out there for managing your passwords, some of them are free and open-source and some others requires you to buy a license, I personally use KeePass which is free, here is a list of the most popular password managers, doesn’t matter which one you want to choose but go ahead and start using password managers if you are not doing it yet!

2: Use multi-factor authentication if possible

The key of security is to add multiple layers of protection so in case one of them fails the other ones handle the risk, in particular for protecting accounts we can suggest our employees to use 2 factor or multi-factor authentication every time they can, so if a data breach happen and the passwords are stolen and cracked, attackers are still unable to log into the accounts because they are missing the token generator.

Now a days most of the more popular services support multi-factor authentication using one time passwords, token generators (such as google authenticator) or even hardware authenticator devices.

Personally I use a Yubico authenticator key and I’m very happy with it 🙂 every time I need to access my accounts from a new IP address or an unrecognized browser, websites such as Facebook or Gmail will ask for my authentication key, that’s very helpful because even if my password is leaked/cracked or someone guess it, they still need the physical key to access the service. 

If you don’t have a budget or prefer not to spend money on this you still can enforce multi-factor authentication using these free apps (every employee can have a token generator right on his smartphone):

3: Choose a secure instant messaging application

Every organization use some kind of real time communication application (Slack, Microsoft Teams, etc) and sometimes employees need to share sensitive information between them, they do not realize the information is also being shared with the third-party service provider who can read it.

Fortunately, nowadays more and more services support security features such as end to end encryption which means all communications between devices are encrypted (each device has a public and a private key) and not even the service provider can read them because they don’t have the private keys.

Another cool feature is self-destruct messages, basically you can set a timer so messages only exists during a particular amount of time after being send and then are destroyed, very useful when you want to share sensitive data such as passwords.

Some free apps that include these features are:

4: Securing all Email communications

Email communications is an essential part in every organization, making it a very attractive vector for attackers, according to a new report from PhishMe, 91% of Cyberattacks start with a phishing email, so even if you have advanced network controls, deceiving your users is still easy.

Nowadays attackers have access to sophisticated phishing tools like SET (Social-Engineer Toolkit) or Gophish which they use to target your employees, they also have access to large repositories of open-source phishing tools they use to tune and adapt their attacks to specific people.

Most of this tools allow attackers to spoof corporate emails and trick your users into downloading malicious files into their systems and into your network, spotting spoofed email addresses is very difficult for common users however using security software like PGP (Pretty Good Privacy) & GPG can help you to mitigate the issue.

Enforcing the use of software such as GPG (GNU Privacy Guard) could help your startup in many ways, like verify the legitimacy of a received messages or encrypt an email content so only a specific user can read them.

You can verify if a message you receive is legit by using the public key of the sender (usually another employee in the organization), meaning: if the person that sent you the email also signed the message using his private key and that private key is associated with the public key you have, then you are guaranteed the message is coming from the right person.

I know this sounds a little bit confusing at the beginning, but the main idea is that every person in the company has a key pair, a public key and a private key, everybody exchanges their public keys while keep their private keys to themself, so when I want to send a message to Mr John Doe I write the message normally and then I proceed to sign it with my own secret key, optionally I can encrypt the message using the public key of John Doe, so the message can only be decrypted and read it by the private/secret key of John, finally John can use my public key to verify the signature I applied to the original message (the one I generated with my private key).

If you still don’t get it don’t worry about it, nowadays most email clients support PGP and the process for verifying and decrypting emails is automatically, there is also a chrome extension called FlowCrypt that I highly recommend!

This message was encrypted with my public key and then sent to me, not even google can read this.
The message decrypted on my browser via the FlowCrypt browser extension

5: Encrypting all your drives

Now we are introducing the concept endpoint protection and “data loss prevention“, in fact I think most of you already use some form of data encryption software, I’m not going to go deep into the details but encrypting your drives could protect your data in many cases, ie: someone steal a company hard drive and try to mount it in another computer to read the information.

If your employees are MacOS users, the operating system already come shipped with FileVault enabled by default, if they use Windows they can use BitLocker and if they use a modern Linux distribution (ie: Ubuntu) full disk encryption is also available.

Data encryption has pros and cons, but the benefits are superior from a privacy and security stand point so I highly recommend to use full disk encryption in all company devices if possible, also the solutions I mentioned above are all free, so you don’t need to spend any money on this one too in order to protect your employees.

6: Encourage secure coding best practices

Usually, when you start a new company then financial resources are limited and you need to be very careful with the people you hire, basically you want to have the best developers, people that are really good at whatever they do but also are wiling to learn and adapt to different situations, you want Rockstar developers.

Rockstars developers have the potential for learning anything, so feed them with the right content, Open Security Training contains great resources about different topics of security like Introduction to Secure Coding, the best part is, are you ready?, its all FREE! in fact this is how I have been learning about security all this years.

Besides Open Security Training there is also The Open Web Application Security Project (OWASP), which is also a good resource for starters so they can learn how to create secure web applications and also secure mobile apps.

Everybody can learn about Security these days, encourage your developers to do it (give them time and resources) and your team will become stronger!, here are some extra sources I had used in the past:

7: Consider hiring a security expert to join your team or an external security team

This advice is more for mature startups or executives who already have a budget to spend on cybersecurity, but it can also apply if you are a small startup and have some friends in the security community.

The idea is to have someone in your team that can give you advice and guidance on different security matters, ie: implementing a security plan for the software development process, do threat modeling in your organization, security infrastructure (IDS, IPS, firewalls, etc), security training, network protection or just make sure your employees are safe are just some examples of things your tech Startup needs from a security perspective.

Besides having your own security guy consider hiring an external security team too, having the security assessment of an external team allow you to simulate more realistic attacks to your organization so you can be more prepared when the real thing happen.

Here are some personal thoughts about security people:

  • Security people are different
  • We enjoy talking about security all the time
  • We want to get asked about how to protect X or Y technology
  • We enjoy challenges and puzzles
  • we enjoy to break stuff and tell you how to fix them.

8: Start a bug bounty program

Companies doesn’t like the idea of their product being hacked, personally I believe that way of thinking need to change because it’s a good thing to have a group of white hat hackers finding vulnerabilities in your software before the bad guys do it.

You can start a bug bounty program with a well defined scope so people can try to hack your product legally (you can even set some special environments for this), there are some guidelines regarding how much to pay depending on the type of vulnerability but if you are still a small startup you can also offer some “swag” like t-shirts or gadgets.

In return you get (most of the time) an army of high quality security researchers that will deliver good vulnerability reports, including how to fix your security issues, everybody wins 🙂

Some popular bug bounty platforms right now are:

9: Encourage a cybersecurity culture in the Startup

The success of the cybersecurity strategy in the organization depends pretty much on the people, you can not just spend a lot of money on security assets like Firewalls and Antivirus and expect everything to be magically safe, it’s not possible because people are always the weakest part in the chain. Security is like a game and everybody need to play including high executives like CEOs and CTOs.

In order to have a culture of cybersecurity organizations have tried different things through the years, even punishing their employees, which is not very effective because people end hating security policies. In general people tend to care about security only when affects them directly but they also like rewards so there is a “new” trend in the security community about using gamification in which basically you reward your employees when they have a responsible security behaviour.

Those action might include:

  • Employees getting rewards when reporting phishing emails
  • Escort people without badge outside the facilities
  • Report suspicious USB drives or hardware that should not be there to the IT/Security department.
  • Enforce people to lock their workstation when not using them by sending emails (using the unlocked account) about free donuts for the whole floor/department/team :p

The idea of all this is to be fun while at the same time the organization become more secure against external threats.

10: Be transparent about Security issues and data breaches

Your biggest fear became true, your Startup got hacked and your information is all over the Internet, If you followed all my advices chances are your sensitive information like passwords are encrypted, which is useless for the attackers, however you still have a moral (and in some places legal) duty, you need to notify your customers and employees about the data breach (according to GDPR you have 72 hours to report a personal data breach after it’s discovered) basically every minute you wait is a minute attackers can invest into cracking and recovering the information so it’s better to communicate the incident, so people can start acting accordingly (change passwords, cancel credit cards, etc).

If you decide to hide the breach and continue without doing anything eventually everybody is going to know about hack and your reputation will be irreversibly damaged (nobody will trust you anymore) so its better to be open with your customers an accept the failure, the shame will be momentary but you will do the right thing.

There is no such thing as a Silver bullet in Cybersecurity, It’s not a matter of if you are going to be hacked or not, it’s about when is going to happen and if your organization is going to be prepared, and this is true for all companies.

Some final thoughts

Security people are often seen as blockers in the organization but I assure you, they have good intentions so please listen to them. Security is hard to implement and even harder to maintain so if you are the CEO/CTO/[Person with authority] of the startup consider to join the security team so you can experience first hand the whole process 🙂

Finally, all these advices are based on my personal opinion (I’m just a security enthusiast) so if you think I should add something else please leave it in the comments.

Happy hacking 🙂

CTF OverTheWire: Natas7

Continuamos con la serie de tutoriales del CTF Natas, ahora toca el turno de natas7.

Natas Level 6 → Level 7
Username: natas7
URL:      http://natas7.natas.labs.overthewire.org

Utilizamos la bandera obtenida en el reto anterior y accedemos a la URL indicada en las instrucciones del reto, veremos una pantalla como la siguiente.

Inspeccionamos el código fuente de la pagina y observamos un par de cosas interesantes:

Vemos dos hypervinculos (index.php?page=home y index.php?page=about) y un comentario que dice:

<!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->

Dependiendo el valor del parámetro page el contenido de la pagina cambia, todo apunta a que estamos ante una vulnerabilidad de tipo Local File Inclusion, escribimos texto aleatorio solo para verificar la vulnerabilidad.

Efectivamente podemos ver la ruta del archivo php en el servidor (path disclosure), debido a esta vulnerabilidad podemos leer cualquier archivo al que el usuario que ejecuta el servidor web tenga acceso, por ahora solo nos centraremos en obtener la bandera del reto con http://natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8

La bandera para acceder a natas8 es DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe

En este reto aprovechamos un fallo de seguridad llamado Local File Inclusion, con el que es posible leer otros archivos que no son accesibles directamente en el servidor.

Happy hacking 🙂

Security Fest #CTF – Zion write up

Para este reto nos daban un archivo comprimido zion.tar.gz, procedemos a descomprimirlo y obtenemos otro archivo llamado YouKnow.

El archivo no tiene extension pero utilizamos el comando file para ver que tipo de archivo es.

Parece un archivo de Microsoft Word Office y sabemos que los archivos docx en realidad son archivos en formato zip.

Procedemos a descomprimir YouKnow

Obtenemos varios archivos y carpetas, comenzamos a analizarlos de uno por uno, sin embargo no encontramos nada que haga referencia a la bandera del reto. (analice la imagen del conejo con un par de herramientas de esteganografía pero no había nada)

Damos un paso atrás y abrimos el archivo YouKnow en un editor hexadecimal de su elección, you utilice Sublime

Observamos la cabecera estándar PK del formato ZIP

Al ir analizando el archivo, hacia el final, algo salta inmediatamente a la vista.

Parece que hay otro archivo Zip concatenado al primero pero los bytes están en orden inverso (observen como el archivo termina en KP, y vemos algunos strings como lmx que seria xml).

Podemos utilizar python para invertir los bytes del archivo fácilmente.

open('YouKnow_reversed','wb').write(open('YouKnow','rb').read()[::-1])

Obtenemos el archivo con los bytes invertidos y procedemos a descomprimirlo.

Obtenemos nuevamente varios archivos y carpetas.

Y en donde estaba la imagen anterior del conejo rojo ahora encontramos otra imagen, esta vez de un conejo azul que nos muestra la bandera del reto 🙂

La bandera del reto es sctf{m41nfr4m3_4cc3ss_c0d3_1337_4lw4s}

Bonus

Programe una pequeña herramienta en python llamada reverse bytes para invertir los bytes de un archivo utilizando una cli mas amigable.

usage: rbytes.py [-h] [-o OUTFILE] infile

A simple python script for reverse the bytes of a file.

Author: Lenin Alevski Huerta Arias
Year: 2018

positional arguments:
  infile                Input file

optional arguments:
  -h, --help            show this help message and exit
  -o OUTFILE, --outfile OUTFILE
                        Output file

Happy hacking 🙂

Solución del #CTF CPMX9 de Blog de Alevsk

Hola, como muchos saben, este blog esta registrado como comunidad tecnológica en Campus Party, cada año gente del estado de Michoacán nos organizamos para asistir al evento, jugar, divertirnos, aprender y sobre todo pasar un buen rato 🙂

Ser comunidad de CPMX tiene algunas ventajas por ejemplo obtener códigos de descuento y entradas gratuitas para rifar entre los miembros de la comunidad pero este año realice una dinámica diferente, hace mas o menos 1 semana anuncie en redes sociales (Facebook y Twitter) un pequeño reto CTF en donde poder ganar una entrada no fuera cuestión de suerte. Muchas gracias a todos los que participaron y felicidades a los ganadores.

A continuación dejo la solución de cada uno de los retos por si hay gente que se quedo con dudas 🙂

0x01 – 8.8.8.8 or 1.1.1.1?

A Dan Kaminsky le gusta ( ͡° ͜ ʖ ͡°) www.alevsk.com

Este reto es bastante sencillo si sabes un poco de cultura general de como funciona Internet. 8.8.8.8, 1.1.1.1 y Dan Kaminsky son claras referencias al sistema DNS.

En este tipo de retos es muy común que la información se encuentre escondida en el record TXT, pero también existen muchos otros tipos de DNS records. Vamos a utilizar la herramienta nslookup y con los siguientes comandos podemos listar los records TXT de cualquier dominio.

$ nslookup
> set q=TXT
> alevsk.com

La bandera de este reto es: ctf_flag{3550dd06-aec9-4841-96cb-dbfb093c6991}

0x02 – Cipher

Cipher es probablemente el reto mas complicado de este CTF, las instrucciones del reto nos muestran el siguiente texto cifrado.

h8s, s, l2e0 4o,h w8orwgx ochg0 h8s,n h8g0g s, r2 he0rsrm .owyx l2e hoyg h8g .4eg 5s44 _ h8g ,h20l grz,n l2e !oyg e5 sr l2e0 .gz orz .g4sg1g !8ohg1g0 l2e !orh h2 .g4sg1gx l2e hoyg h8g 0gz 5s44 _ l2e ,hol sr !2rzg04orz orz s ,82! l2e 82! zgg5 h8g 0o..sh_824g m2g,x h8g c4om s, whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu

En la mayoría de los retos básicos de criptografía encontramos dos tipos de cifrados:

Podemos intentar resolver esto con alguna herramienta automática como Rot13 Online o Caesar Cipher pero no hay resultados. No queda otra cosa mas que empezar a hacer un analisis del texto y aplicar distintos ataques criptograficos 🙂

Utilizamos uno de mis lenguajes de programación favoritos, python, para comenzar a recolectar estadísticas interesantes del texto.

Comenzamos separando el texto cifrado por espacios y contando el numero de veces que se repiten las palabras

from collections import Counter
import re

encrypted = "h8s, s, l2e0 4o,h w8orwgx ochg0 h8s,n h8g0g s, r2 he0rsrm .owyx l2e hoyg h8g .4eg 5s44 _ h8g ,h20l grz,n l2e !oyg e5 sr l2e0 .gz orz .g4sg1g !8ohg1g0 l2e !orh h2 .g4sg1gx l2e hoyg h8g 0gz 5s44 _ l2e ,hol sr !2rzg04orz orz s ,82! l2e 82! zgg5 h8g 0o..sh_824g m2g,x h8g c4om s, whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu"

words = encrypted.split()
word_counts = Counter(words)
print(word_counts)
{
	'l2e': 6,
	'h8g': 5,
	's,': 3,
	'5s44': 2,
	'orz': 2,
	'hoyg': 2,
	'_': 2,
	'l2e0': 2,
	'sr': 2,
	'zgg5': 1,
	'grz,n': 1,
	'!orh': 1,
	'whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu': 1,
	'0o..sh_824g': 1,
	',h20l': 1,
	'!8ohg1g0': 1,
	',hol': 1,
	'.owyx': 1,
	'h8s,': 1,
	'4o,h': 1,
	'h8s,n': 1,
	'!2rzg04orz': 1,
	'.4eg': 1,
	'c4om': 1,
	',82!': 1,
	'.g4sg1g': 1,
	'e5': 1,
	'w8orwgx': 1,
	'0gz': 1,
	'r2': 1,
	'he0rsrm': 1,
	'.g4sg1gx': 1,
	'82!': 1,
	'h8g0g': 1,
	'h2': 1,
	'm2g,x': 1,
	's': 1,
	'!oyg': 1,
	'ochg0': 1,
	'.gz': 1
}

La palabra que se repite mas veces es l2e (6 veces), pero también vemos l2e0 (2 veces) que es una variación de la palabra anterior, algo similar ocurre con h8g y h8g0g y algunas otras más.

La complejidad de este reto disminuye notoriamente ya que sabemos lo que estamos buscando en el texto, la bandera 🙂 y sabemos cual es el formato que deben seguir las mismas.

ctf_flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

En una cadena de texto lo suficientemente larga debemos encontrar un símbolo que se repita siguiendo el mismo patrón que el de la bandera si no estuviera encriptada, es decir:

* = (simbolo de guion)

(8 simbolos)*(4 simbolos)*(4 simbolos)*(4 simbolos)*(12 simbolos)

La palabra mas larga que arrojo nuestro análisis es whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu, probamos “alineando” el formato de la bandera en esa palabra para ver si cumple con el patrón:

whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu
         xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Tenemos una coincidencia 🙂 acomodamos el resto de la bandera y comenzamos a crear un diccionario con los caracteres a sustituir en el texto y podremos empezar a romper el cifrado (encontrar el alfabeto que fue usado para la sustitución)

whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu
ctf_flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

Agregamos el diccionario a nuestro script y hacemos la sustitución.

encrypted = "h8s, s, l2e0 4o,h w8orwgx ochg0 h8s,n h8g0g s, r2 he0rsrm .owyx l2e hoyg h8g .4eg 5s44 _ h8g ,h20l grz,n l2e !oyg e5 sr l2e0 .gz orz .g4sg1g !8ohg1g0 l2e !orh h2 .g4sg1gx l2e hoyg h8g 0gz 5s44 _ l2e ,hol sr !2rzg04orz orz s ,82! l2e 82! zgg5 h8g 0o..sh_824g m2g,x h8g c4om s, whcjc4om{dzz9bk}v_pbdi_i}v3_op33_c3p39d.owvwpu"
decrypted = ""
replace = {
	'w': 'c',
	'h': 't',
	'c': 'f',
	'j': '_',
	'4': 'l',
	'o': 'a',
	'm': 'g',
	'_': '-',
	'u': '}'
}

for c in encrypted:
	if c in replace:
		decrypted += replace
	else:
		decrypted += c

print(decrypted)

Vemos que la palabra flag se encuentra en otras partes del texto y no solo en la bandera, lo que sugiere que el texto esta escrito en ingles

t8s, s, l2e0 la,t c8arcgx aftg0 t8s,n t8g0g s, r2 te0rsrg .acyx l2e tayg t8g .leg 5sll – t8g ,t20l grz,n l2e !ayg e5 sr l2e0 .gz arz .glsg1g !8atg1g0 l2e !art t2 .glsg1gx l2e tayg t8g 0gz 5sll – l2e ,tal sr !2rzg0larz arz s ,82! l2e 82! zgg5 t8g 0a..st-82lg g2g,x t8g flag s, ctf_flag{dzz9bk}v-pbdi-i}v3-ap33-f3p39d.acvcp}

Todavía tenemos otras 2 palabras, l2e y h8g, que se repiten bastante en el texto, si encontramos cual es su equivalente nuestro texto sera todavía mas legible. Investigando un poco encontré un articulo bastante interesante The Most Common Three Letter Words (Las palabras mas comunes de 3 letras)

Hacia al final del texto podemos leer algo que dice:

t8g flag s, ctf_flag{dzz9bk}v-pbdi-i}v3-ap33-f3p39d.acvcp}

si t8g puede ser the (que se encuentra en la lista de palabras populares) y s, es is la frase final seria

the flag is ctf_flag{dzz9bk}v-pbdi-i}v3-ap33-f3p39d.acvcp}

Parece que nos vamos acercando, probamos agregando estas letras a nuestro diccionario.

replace = {
	'w': 'c',
	'h': 't',
	'c': 'f',
	'j': '_',
	'4': 'l',
	'o': 'a',
	'm': 'g',
	'_': '-',
	'u': '}',
	'8': 'h',
	'g': 'e',
	's': 'i',
	',': 's',
}

this is l2e0 last charcex afte0 thisn the0e is r2 te0rirg .acyx l2e taye the .lee 5ill – the st20l erzsn l2e !aye e5 ir l2e0 .ez arz .elie1e !hate1e0 l2e !art t2 .elie1ex l2e taye the 0ez 5ill – l2e stal ir !2rze0larz arz i sh2! l2e h2! zee5 the 0a..it-h2le g2esx the flag is ctf_flag{dzz9bk}v-pbdi-i}v3-ap33-f3p39d.acvcp}

Mas palabras salen a la luz:

afte00 es r

l2e0 se vuelve l2er, por lo tanto en la frase this is l2er last charcex, l2er es remplazado por your y el texto tiene aun mas sentido 🙂 !!!

charce … r es n (chance)

this is your last chancex after thisn there is no turning

Tenemos suficiente texto legible para realizar una búsqueda en google y darnos cuenta que el texto es una frase famosa de la película The Matrix

Completamos el resto del diccionario con las letras que nos hacen falta.

Nota: en este punto de la solución me di cuenta que cometí un error al momento de diseñar el reto y no se puede avanzar mas, gracias a @unmanarc por reportar el problema

Por lo tanto la bandera de este reto es ctf_flag{ddd9bk}v-pbdi-i}v3-ap33-f3p39dbacvcp}

0x03 – A new security policy standard

Si encuentras una vulnerabilidad en www.alevsk.com deberías reportarla utilizando los canales adecuados 🙂

Tanto el nombre del reto como la descripción nos da una pista acerca de que debemos investigar sobre nuevos estándares en políticas de seguridad, algunas personas se confundieron en este reto pues creían que tenían que encontrar vulnerabilidades en esta pagina, pero la solución es mas sencilla que eso.

security.txt es un estándar propuesto (similar a robots.txt) para que los sitios web puedan anunciar sus políticas de seguridad y consiste en publicar un archivo de texto en el directorio .well-known donde comuniquemos información importante como por ejemplo la direccion de contacto en la que los hackers pueden reportar las vulnerabilidades encontradas de nuestro sitio web, en este caso https://www.alevsk.com/.well-known/security.txt

# If you would like to report a security issue
# you may report it to me on www.alevsk.com
# ctf_flag{1999251d-df25-4d4a-846b-d4267f471b23}
Contact: [email protected]
Encryption: https://pgp.mit.edu/pks/lookup?op=get&search=0xFF4F600D674B6DED

La bandera de este reto es: ctf_flag{1999251d-df25-4d4a-846b-d4267f471b23}

0x04 – Foogle

Neo: Why do my eyes hurt? Morpheus: You’ve never used them before.

Descargar imagen

Este reto involucra esteganografía y es muy fácil de resolver, descargamos la imagen que nos indican las instrucciones y comenzamos a realizar el análisis, lo mas sencillo y lo primero que intentamos es ver si la imagen contiene en sus bytes alguna cadena de caracteres que tenga sentido.

Podemos utilizar la herramienta hexdump para hacer esto.

$ hexdump -C foogle.png

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 04 34 00 00 02 60  08 06 00 00 00 75 21 33  |...4...`.....u!3|
00000020  a1 00 00 01 7c 69 43 43  50 49 43 43 20 50 72 6f  |....|iCCPICC Pro|
00000030  66 69 6c 65 00 00 28 91  63 60 60 2a 49 2c 28 c8  |file..(.c``*I,(.|
....
....
....
000be000  7b 3a e3 0d e3 7e e2 66  21 44 35 e4 e6 ce 49 93  |{:...~.f!D5...I.|
000be010  6e 35 05 78 c2 39 98 9c  ae db e4 fd 69 9f 8b 31  |n5.x.9......i..1|
000be020  94 4e ca e5 4d c1 c5 ba  13 c0 eb 99 ff 07 7b ee  |.N..M.........{.|
000be030  41 67 d0 72 4a 54 00 00  00 00 49 45 4e 44 ae 42  |Ag.rJT....IEND.B|
000be040  60 82 59 33 52 6d 58 32  5a 73 59 57 64 37 59 6a  |`.Y3RmX2ZsYWd7Yj|
000be050  4d 77 4f 57 55 77 4e 57  4d 74 5a 6a 49 79 4e 43  |MwOWUwNWMtZjIyNC|
000be060  30 30 4e 44 4d 33 4c 57  46 6a 5a 44 6b 74 59 57  |00NDM3LWFjZDktYW|
000be070  52 68 5a 54 6b 35 4e 6a  45 30 4d 6d 56 6b 66 51  |RhZTk5NjE0MmVkfQ|
000be080  3d 3d                                             |==|
000be082

También podemos utilizar el comando strings.

$ strings foogle.png

Al final del archivo hay una cadena de caracteres muy peculiar, parece que es un mensaje codificado en base64, tomamos el string y lo decodificamos con alguna herramienta como https://www.base64decode.org/

La bandera de este reto es ctf_flag{b309e05c-f224-4437-acd9-adae996142ed}

0x05 – Information leak

Información critica ha sido leakeada en los archivos de este repositorio x.x

Como la descripción nos indica, tenemos que revisar los archivos del repositorio donde esta hospedado el CTF, y no solo eso, tambien tenemos que revisar el historial de commits, vemos que en uno de los commits un archivo llamado 0x05_secret.txt fue publicado en el repositorio.

La bandera de este reto es ctf_flag{163f0835-8fc0-4fd0-b96b-dcd724cbe200}

0x06 – We can fix it!

Otro participante trato de robar la bandera de este reto pero sin querer la daño, ¿Puedes repararla? Descargar imagen

Este reto nos presentaba un codigo QR “dañado” (los bordes de la imagen han sido recortados), por lo que si tratamos de leerlo nos dará un error

Pero nada que un poco de photoshop no pueda arreglar 🙂

La bandera de este reto es ctf_flag{d55bd4f6-bff1-45b4-836e-7df1839e7d70}

Espero se hayan divertido mucho y aprendido algo nuevo al participar en este reto.

Happy hacking 🙂

CTF OverTheWire: Natas4

Continuamos con la serie de tutoriales del CTF Natas, ahora toca el turno de natas4.

Natas Level 3 → Level 4
Username: natas4
URL:      http://natas4.natas.labs.overthewire.org

Utilizamos la bandera obtenida en el reto anterior y accedemos a la URL indicada en las instrucciones del reto, veremos una pantalla como la siguiente.

Como lo hemos hecho anteriormente, revisamos el codigo fuente pero no encontramos nada interesante, tampoco hay archivo robots.txt

Nos concentramos en el mensaje que aparece en la pantalla: Access disallowed. You are visiting from “” while authorized users should come only from “http://natas5.natas.labs.overthewire.org/”

Acceso deshabilitado. Nos estas visitando de “” mientras que los usuarios autorizados deberian de venir desde “http://natas5.natas.labs.overthewire.org/”

El mensaje anterior sugiere algún tipo de validación del lado del servidor en donde se revisa el origen de la petición, damos click en el link de refresh, inspeccionamos las cabeceras del request utilizando google developer toolbars y observamos que el mensaje de la pagina cambio.

Observamos una cabecera interesante llamada referer cuyo valor actual es http://natas4.natas.labs.overthewire.org/, veamos si es posible definir nuestro propio valor utilizando cURL.

Abrimos una consola y escribimos

$ curl --help
Usage: curl [options...] <url>
Options: (H) means HTTP/HTTPS only, (F) means FTP only
....
 -r, --range RANGE   Retrieve only the bytes within RANGE
     --raw           Do HTTP "raw"; no transfer decoding (H)
 -e, --referer       Referer URL (H)
 -J, --remote-header-name  Use the header-provided filename (H)
....

Genial, con el parámetro -e / –referer podemos definir nuestra propia URL.

○ → curl --user natas4:Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ --referer http://natas5.natas.labs.overthewire.org/ http://natas4.natas.labs.overthewire.org/
<html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas4", "pass": "Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ" };</script></head>
<body>
<h1>natas4</h1>
<div id="content">

Access granted. The password for natas5 is iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
<br/>
<div id="viewsource"><a href="index.php">Refresh page</a></div>
</div>
</body>
</html>

La bandera para acceder a natas5 es iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq

* Aprendimos que el referer header no es garantía de que el request viene del origen que el cliente nos esta diciendo, esto podría ser considerado una vulnerabilidad de Broken Access Control de acuerdo al top 10 de vulnerabilidad de OWASP.

Happy hacking 🙂