#!/zitstif.no-ip.org/

Due to US Federal prosecutors, if you try to follow my instructions from this post:

http://zitstif.no-ip.org/?p=484

You will not be able to. Megaupload has been taken down. Along with copyright infringing materials, legitimate non-copyright infringing materials like the re-sized bt5.img are no longer accessible.

Luckily, I still had the re-sized bt5.img and I have uploaded it to archive.org:

http://ia601203.us.archive.org/0/items/Backtrack5ArmImgFile/bt5.7z

Md5sum: 4f378f01b35b598d0b7f7b8177499cb2

When you extract the bt5.7z file, the hash of the bt5.img should be:

Md5sum: 0e1211c5ba7ba3debe1c472e5a0e5b96

Thanks for pointing out the fact that megaupload is no longer up Alec!

Imprimis, if you are not familiar with the concept of social engineering, take a look at:

https://en.wikipedia.org/wiki/Social_engineering_(security)

If you are looking for a good book on this topic, then I would highly suggest buying a copy of:

http://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539/ref=sr_1_1?ie=UTF8&qid=1327118815&sr=8-1

As for software implementations that you can use to leverage social engineering attacks on targets, David Kennedy‘s Social Engineering Toolkit (SET) is probably one of the best, if not only social engineering frameworks that I know of. SET does not really rely on vulnerable services which I believe is one of the most useful aspects of this toolkit. What you do have to rely on is social engineering. Services and software will be patched while humans will most likely always be vulnerable to social engineering attacks due to misplaced trust.

Despite the fact that this framework is practically the only of its kind, it does have some limitations in certain realms, namely the web site cloning feature. The issue I have ran into with SET is due to the user agent string not being easily switchable. To switch the user agent string for SET, you must manually edit the cloner.py (which is located in/src/webattack/web_clone/ directory) .

The default user agent of SET is:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

This means that when the Social Engineering toolkit makes a request on a website and clones it, the response of the web service is based on this user agent string.

What if I want to clone a website that is the mobile version? What if I want to clone a website that checks to see if end users are Microsoft Windows users? This is where the Social Engineering Toolkit User Agent Switcher(setuas.sh) is applicable. This is a very simple Bash shell program that edits the user agent string in the cloner.py module of SET to whatever you like. Simply execute this:

./setuas.sh /pentest/exploits/set/src/webattack/web_clone/cloner.py

You will then be prompted to enter in a user agent string which for instance could be:

Mozilla/5.0 (Linux; U; Android 2.3; en-us) AppleWebKit/999+ (KHTML, like Gecko) Safari/999.9

For the moment this is just a quick hack to address the issue. I believe that the SET team should add an option in the config file (/set/config/set_config) for end users to adjust accordingly.

setuas.sh is located here:

http://zitstif.no-ip.org/set/setuas.sh

If you want to just see the plain text version of this file, it is located at:

http://zitstif.no-ip.org/set/setuas.txt

The following post superficially applies the concepts of Kolmogorov complexity of an object and natural language programming using the bash shell. Part of the inspiration for this post came from this video: http://www.youtube.com/watch?v=KyB13PD-UME

In this post we will be treating strings as objects in a similar sense of Kolmogorov complexity. Then we will apply an alias name or function name to the object which then the alias/function name can be perceived as a natural language sentence.

Take the following object:

sudo nmap -sP -n -T4 $(netstat -rn | awk ‘{print $2}’ | egrep ‘[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}’ | fgrep -v “0.0.0.0” | sed -e ‘s/\([0-9]\)\{1,3\}$/1-254/g’)

To individuals who are not familiar with the bash shell or bash shell programming, this object does not make a whole lot of sense. What does it do? What does it mean? Why is this one-liner algorithm useful to some individuals?

For those of who you aren’t sure, this one-liner algorithm is used for ping sweeping your local subnet based upon the gateway’s IP address. So if your gateway is 192.168.1.1 then when the bash shell expands and processes the sub-shell variable $(netstat -rn | awk ‘{print $2}’ | egrep ‘[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}’ | fgrep -v “0.0.0.0” | sed -e ‘s/\([0-9]\)\{1,3\}$/1-254/g’‘), it would result with 192.168.1.1-254. Lastly, the string would result with sudo nmap -sP -n -T4 192.168.1.1-254.

To take the time to type out this 196 character object each time you connect to a network that you’re exploring, would be extremely tedious and time consuming. Ergo to save an individual some time and keystrokes, this is where we will apply the ‘alias’ function that is built into the bash shell:

alias PingSweepLocalSubnet=”sudo nmap -sP -n -T4 $(netstat -rn | awk ‘{print $2}’ | egrep ‘[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}’ | fgrep -v “0.0.0.0” | sed -e ‘s/\([0-9]\)\{1,3\}$/1-254/g’)”

Here the 20 character alias PingSweepLocalSubnet saves the end user 176 characters to type and makes more sense depending on if the user is familiar with networking terminologies. Granted this may not be, “the shortest description of this object” and the proper simplifying algorithm according to Kolmogorov complexity method, but this is where the idea of natural language programming is applied. With this object, if we use the Kolmogorov complexity concept, is nearly incompressible. I wanted this alias to be time saving and to be almost a form of natural language programming.

We must also remember that we do not necessarily need to use the ‘alias’ function from the bash shell. We can also achieve the same result by using ‘function’ from bash shell:

function PingSweepLocalSubnet()
{
sudo nmap -sP -n -T4 $(netstat -rn | awk ‘{print $2}’ | egrep ‘[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}’ | fgrep -v “0.0.0.0” | sed -e ‘s/\([0-9]\)\{1,3\}$/1-254/g’);
}

In turn end users may want to use function assignments rather than aliases. Aliases are limited and are simply string substitutions. For further reading on using aliases or functions take a look at: http://linuxgazette.net/issue53/eyler.html Whether or not the end user decides to use ‘alias’ or ‘function’ is subjective to the user.