From the Pastor's Desk

Our Savior Lutheran Church

About Spaghetti
Author: m4ll0k

Github: m4ll0k
Twitter: m4ll0k

Spaghetti is an Open Source web application scanner, it is designed to find various default and insecure files, configurations, and misconfigurations. Spaghetti is built on Python 2.7 and can run on any platform which has a Python environment.

Spaghetti Installation:

Spaghetti's Features:
Fingerprints:

Server:
Web Frameworks (CakePHP,CherryPy,...)
Web Application Firewall (Waf)
Content Management System (CMS)
Operating System (Linux,Unix,..)
Language (PHP,Ruby,...)
Cookie Security

Discovery:

Bruteforce:Admin Interface
Common Backdoors
Common Backup Directory
Common Backup File
Common Directory
Common FileLog File
Disclosure: Emails, Private IP, Credit Cards

Attacks:

HTML Injection
SQL Injection
LDAP Injection
XPath Injection
Cross Site Scripting (XSS)
Remote File Inclusion (RFI)
PHP Code Injection

Other:

HTTP Allow Methods
HTML Object
Multiple Index
Robots Paths
Web Dav
Cross Site Tracing (XST)
PHPINFO
.Listing

Vulns:

ShellShock
Anonymous Cipher (CVE-2007-1858)
Crime (SPDY) (CVE-2012-4929)
Struts-Shock

Spaghetti Example:
python spaghetti --url example.com --scan 0 --random-agent --verbose

Download Spaghetti

More information

Our Savior Lutheran Church

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned. After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration. Basic tests check the supported cipher suites and protocol versions. In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner. The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget. The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More articles

Our Savior Lutheran Church

Give gifts this holiday season that inspires your favorite hackers to make something great. Our ten top picks for gifts to make 'em smile are perfect for hackers of all styles, ages, and interests.

Holiday gift guides always struggle when faced with nailing down a list for hackers — that's because hackers are as diverse in their interests and fascinations as they are diverse in gender, color, size and everything else. Someone with a multi-focused set of curiosity and unique gifts for finding out what makes the crackable crack may seem like a daunting individual to stuff a stocking for … but don't fret. With a keen eye on the latest interests in hacker culture, we've got a gift guide that can make the hacker in your life smile as they enjoy using your gift to hack and explore throughout the coming year.

Anonymity online: The Onion Pi

One of the most popular "snake oil" (fake) privacy gadgets is the so-called "Tor in a box" — a plug-and-play gadget that promises to make you anonymous online. Nearly all of these are made by clueless charlatans whose products put you at risk for privacy and security breaches. But your favorite hacker can just make or build an "Onion Pi" for $69.95, and with this free tutorial.

Attribution Dice

With Attribution Dice ($20), anyone can be a high-priced security consultant, and predict breach headlines before PR firms have a chance to feed them to reporters! With every security breach, hackers roll their eyes when headlines and PR firms roll out the same old, same old terms, methods and culprits. Instead of rolling eyes, your hacker can roll the dice, and wow friends, family, and neighbors with their hacker cyber-powers.

21 Bitcoin Computer

Money is always a welcome gift. Give the gift of going hands-on with Bitcoin with the 21 Bitcoin Computer. "The 21 Bitcoin Computer is ideal for buying and selling digital goods and services. You can use it to create bitcoin-payable APIs, set up your own personal digital goods store, pay people to share your content online, or host online games of skill." It's not cheap ($395) and comes with controversy, but it's a cool toy with a lot of potential, and 21 Inc. is going to be releasing an open source package for the device soon.

Gentleman's Bogota Lockpicks and Clear Practice Lock

Conventional wisdom suggests that all hackers know how to pick locks, but can they do it in style? A perfect stocking stuffer for slick hackers of all genders is the Gentleman's Bogota lockpick set ($34.95). These featherweights pin discreetly to a collar, hat, sleeve, vest, hemline, or wherever they choose. If the hacker you're shopping for wants to learn to lockpick, or just brush up on technique, throw in the clever Clear Practice Lock ($34.95).

Inverse Path USB Armory

Iemhacker-hacking-news-tutorial-hackernews

In this reviewer's opinion, every hacker should have a USB Armory in their stocking this year. The Inverse Path USB Armory ($130) is a little USB stick with an entire computer onboard (800MHz ARM processor, 512MB RAM), designed to be a portable platform for personal security applications — and lives up to its reputation as "the Swiss Army Knife of security devices."

Hack-A-Day Gift Card

The cornerstone of hacker culture Hack-A-Day has a store offering gift cards and merchandise a-plenty. In it, you'll find a Bukito portable 3D printer ($899.97), ever-popular Facedancer21 and Gootfet42, a low energy Bluetooth Arduino microcontroller called the Lightblue Bean, and the pocket-sized open source robot arm, Mearm.

Hackers 20th Anniversary Blu-Ray Edition

Hack the planet! The 20th anniversary of influential 1995 cyberpunk film "Hackers" was this year, and this cult classic got a special edition Blu-ray release, making it the must-have for the hackers in your life. The 20th anniversary "Hackers" Blu-ray features an hour-long "making of" documentary, rich video and audio transfer for the film itself, and interviews with: Cast members Matthew Lillard, Fisher Stevens, and Penn Jillette; hacking consultants Nicholas Jarecki and Emmanuel Goldstein; Director Iain Softley, and many more involved with the film's production and style.

A Hacker's hope for better sleep: The Re-Timer

Iemhacker-Top-10-Great-gifts-For-hackers

Hackers are increasingly hacking themselves to make their own systems run better, and one thing hackers struggle with is their sleep cycles and feeling rested. Something that can help out is the Re-Timer ($299), a retro-future looking set of glasses and kit that adjusts the circadian rhythm and suppresses the body's production of melatonin (the sleepy hormone our bodies produce which makes us feel tired). Based on 25 years of research and on the market worldwide for three years, the Re-Timer has its own jet lag calculator app, as well as its Sleep App for Fitbit that makes a customized schedule based on actual sleep tracked.

USB Rubber Ducky Deluxe and LAN Turtle

Iemhacker-USB-Rubber-ducky-delux-LAN-turtle

A longtime favorite with hackers, penetration testers and IT professionals, the USB Rubber Ducky Deluxe ($42.99)is a cross-platform (Windows, Mac, Linux, Android) testing and experimentation device that is detected as a keyboard — imagine the possibilities. This stocking stuffer pairs well with its animal friend LAN Turtle ($50), a covert sysadmin and pentest tool for remote access, network intel gathering, and man-in-the-middle monitoring through a simple graphic shell (all in a generic USB ethernet adapter case).

TechShop Gift Certificate

Give the gift of hacking and making: A gift certificate to a TechShop. "Part fabrication and prototyping studio, part hackerspace, and part learning center, TechShop provides access to over $1 million worth of professional equipment and software. We offer comprehensive instruction and expert staff to ensure you have a safe, meaningful and rewarding experience." There are TechShops in Arizona, California, Michigan, Missouri, Pennsylvania, Texas, and Virginia/Washington, D.C. (some states have multiple locations). Future locations include St. Louis, MO and Paris, France.

Products to avoid

If you see these products, run! You're better off with a lump of coal. Don't waste precious holiday money on "snake oil" privacy and security products like these:

Anonabox
Wemagin
Webcloak
iGuardian (now SHIELD)
LogMeOnce
Sever: The Anti-Villain Box

Related news

Our Savior Lutheran Church

Hello!

Î am a hacker who haș acceșș to your operatîng șyștem.
Î alșo have full acceșș to your account.

Î've been watchîng you for a few monthș now.
The fact îș that you were înfected wîth malware through an adult șîte that you vîșîted.

îf you are not famîlîar wîth thîș, î wîll explaîn.
Trojan Vîruș gîveș me full acceșș and control over a computer or other devîce.
Thîș meanș that î can șee everythîng on your șcreen, turn on the camera and mîcrophone, but you do not know about ît.

Î alșo have acceșș to all your contactș and all your correșpondence.
Why your antîvîruș dîd not detect malware?
Anșwer: My malware ușeș the drîver, î update îtș șîgnatureș every 4 hourș șo that your antîvîruș îș șîlent.

Î made a vîdeo șhowîng how you mașturbate on the left half of the șcreen, and în the rîght half you șee the vîdeo that you watched. Wîth one clîck of the moușe,
Î can șend thîș vîdeo to all your emaîlș and contactș on șocîal networkș. î can alșo poșt acceșș to all your e-maîl correșpondence and meșșengerș that you ușe.

Îf you want to prevent thîș, tranșfer the amount of $1200(USD) to my bîtcoîn addreșș (îf you do not know how to do thîș, wrîte to Google: 'Buy BTC').

My bîtcoîn addreșș (BTC Wallet) îș: 12ZLU11k4T1MCk8Kc5uxweTqTSamPiK5fD

After receîvîng the payment, î wîll delete the vîdeo and you wîll never hear me agaîn.
Î gîve you 48 hourș to pay.
Î have a notîce readîng thîș letter, and the tîmer wîll work when you șee thîș letter.
Fîlîng a complaînt șomewhere doeș not make șenșe becaușe thîș emaîl cannot be tracked lîke my bîtcoîn addreșș.
Î do not make any mîștakeș.

Îf î fînd that you have șhared thîș meșșage wîth șomeone elșe, the vîdeo wîll be îmmedîately dîștrîbuted.

Beșt regardș!

Our Savior Lutheran Church

KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
Phrack Magazine: Digital hacking magazine.
Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.
Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.

Our Savior Lutheran Church

Hello!

Í háve bád news for you.
14/03/2020 - on thís dáy Í hácked your operátíng system ánd got full áccess to your áccount oslcvero.godsamazinggrace@blogger.com

Ít ís useless to chánge the pássword, my málwáre íntercepts ít every tíme.

How ít wás:
Ín the softwáre of the router to whích you were connected thát dáy, there wás á vulnerábílíty.
Í fírst hácked thís router ánd pláced my málícíous code on ít.
When you entered ín the ínternet, my troján wás ínstálled on the operátíng system of your devíce.

Äfter thát, Í máde á full dump of your dísk (Í háve áll your áddress book, hístory of víewíng sítes, áll fíles, phone numbers ánd áddresses of áll your contácts).

Ä month ágo, Í wánted to lock your devíce ánd ásk for á smáll ámount of money to unlock.
But Í looked át the sítes thát you regulárly vísít, ánd cáme to the bíg delíght of your fávoríte resources.
Í'm tálkíng ábout sítes for ádults.

Í wánt to sáy - you áre á bíg pervert. You háve unbrídled fántásy!

Äfter thát, án ídeá cáme to my mínd.
Í máde á screenshot of the íntímáte websíte where you háve fun (how díd you másturbáte).
Äfter thát, í took off your joys (usíng the cámerá of your devíce). Ít turned out beáutífully, do not hesítáte.

Í ám strongly belíve thát you would not líke to show these píctures to your relátíves, fríends or colleágues.
Í thínk $932 ís á very smáll ámount for my sílence.
Besídes, Í spent á lot of tíme on you!

Í áccept money only ín Bítcoíns.
My BTC wállet: 1CRKWJcwVofS7HqP4UnezYFTWv1g4sKYqb

You do not know how to replenísh á Bítcoín wállet?
Ín ány seárch engíne wríte "how to send money to btc wállet".
Ít's eásíer thán send money to á credít cárd!

For páyment you háve á líttle more thán two dáys (exáctly 50 hours).
Do not worry, the tímer wíll stárt át the moment when you open thís letter. Yes, yes .. ít hás álreády stárted!

Äfter páyment, my vírus ánd dírty photos wíth you self-destruct áutomátícálly.
Nárrátíve, íf í do not receíve the specífíed ámount from you, then your devíce wíll be blocked, ánd áll your contácts wíll receíve á photos wíth your "joys".

Í wánt you to be prudent.
- Do not try to fínd and destroy my vírus! (áll your dátá ís álreády uploáded to á remote server)
- Do not try to contact me (thís ís not feásíble, sender áddress generáted áutomátícálly)
- Váríous securíty servíces wíll not help you; formáttíng á dísk or destroyíng á devíce wíll not help eíther, sínce your dátá ís álreády on á remote server.

P.S. Í guárántee you thát Í wíll not dísturb you ágáín áfter páyment, ás you áre not my síngle víctím.
Thís ís á hácker code of honor.

From now on, Í ádvíse you to use good ántívíruses ánd updáte them regulárly (severál tímes á dáy)!

Don't be mád at me, everyone hás theír own work.

Fárewell.

Our Savior Lutheran Church

Hello, I work as a Private Investigator.
Our agency received a case with an objective of hacking into your email, phone, cloud storage, network and collecting intelligence.
We work with hackers from China for tasks like that, and they are the best. As you can see, they did a good job. Your accounts and devices are compromised.
But we do have an ethical protocol in place.
After checking the background of the person who paid for the hacking and investigation on you, I have decided to come forward and offer you to buy the information about that person (name, contacts, emails and other proof).
You will also get a report on yourself (including a list of compromised accounts, devices, logs, screenshots, photos and documents).

Normally, we do not disclose sensitive information about our clients, but in this case we will be.

Upon reviewing this case, I found that something illegal was planned against you.
The materials we have collected on you are very sensitive and can be easily used to blackmail you.
We usually address personal and corporate espionage cases, but this case is different.

We have received a prepayment of 50% for your case from that person (total agreed upon cost was 12500 USD).
However, I will give you a discount (without any profit for the agency), if you decide to buy this information.
Do not try to email me back. This is a throwaway address. I have to protect identity, because the nature of this job is illegal.
After I get the payment, I will get back to you. You have 2 business days to make the transfer. It will cost you 40% of the unpaid balance.

We will process $2,500 payment through bitcoin. In case you have trouble with bitcoin, google how to fund it.
Send BTC to this wallet 1yjQZMv2gQdpiMctyYk3vNRKbZiyGVN3t

It will be up to you what to do after you get the information. We will delete all files. The original client will get nothing and will never know about our deal.
Please keep in mind, because I need to pay Chinese contractors, and if you decline this offer, I will have to go to the original client and send all intel to cover the costs.
But at least you know that now and have a free heads up of what's coming.

Friday, August 21, 2020

Spaghetti: A Website Applications Security Scanner

Thursday, August 20, 2020

Scanning TLS Server Configurations With Burp Suite

TLS-Scanner

Scan History

Additional functions will follow in later versions

Top 10 Great Gifts For The Hacker In Your Life

Related news

Thursday, July 16, 2020

H¡gh level of r¡sk. Your account has been hacked. Change yøur passwørd.

Monday, July 13, 2020

Ethical hacking : Top 9 best websites to learn hacking 2018

Friday, July 10, 2020

Chánge your pássword ímmediátely. Your áccount hás been hácked.

Tuesday, July 7, 2020

Personal notes on information request

From the Desk of Pastor Jack Diehl

Return to Our Savior Lutheran Church Web Site

Blog Archive