Killing (Deleting) Facebook Account - quick'n'dirty

Hi there,

I've been registered at Facebook since 2009. Now I've killed my account. This has several reasons:

- Since I've registered the spam and ads are increasing and now Facebook want's the users to watch ad videos in their timeline. So Facebook is just an advertising rostrum.
- I've been registered at ADN and really like it much more than Twitter or Facebook, I have to pay for it, but that's totally worth it as there are no ads.
- I don't want Facebook to track me and my behavior and Facebook has no real value to me anymore when compared to all the privacy issues.
- Instead of clicking dump Like Buttons of actions people talk about, I want to talk to a few people in real life or do a chit-chat via phone without any distractions. I don't even concentrate on the conversation when I was chatting via Facebook as I was always doing something aside, like googling, scrolling the Facebook timeline etc. Of course that's no real argument against Facebook, but a behavior that I want to change and Facebook is not supporting me by achieving this.
- Several weeks ago I've read a tweet, unfortunately I don't have a link to it, that Facebook is the new "going to the kitchen and looking in the fridge". And exactly that's how I feel when I'm using Facebook, sometimes I just think it's a waste of time.

So this is what I've done:

1. I requested for a copy of all my Facebook data. You can make this request when you go to your preferences and click on the link "download your Facebook data". An e-mail will be send to you with a download link. I've got the e-mail after some minutes and download the archive.

2. As I couldn't find a button for deleting my account in the preferences (I thought that it would be hard to find the delete button), I could find the following link in a blog:

https://www.facebook.com/help/delete_account

3. After clicking on this link your account is deleted. But it is only deleted if you don't login for the next 14 days. If you log in your account will be reactivated.

4. Use your free time wisely :-)

OVA VMware Fusion

Hey there,

I'm using VMware Fusion Version 4 and wanted to open a .ova file. I just wanted to play around a little on https://www.hacking-lab.com/, and the they provide a full virtual machine that is ready to connect to their test network via VPN. Unfortunately VMware Fusion 4 won't open it. According to the docs of VMware Fusion 5 you can just import an .ova file (http://pubs.vmware.com/fusion-5/index.jsp?topic=%2Fcom.vmware.fusion.help.doc%2FGUID-275EF202-CF74-43BF-A9E9-351488E16030.html), but that's not working in VMware Fusion 4.

I just found a tool called OVF Tool by VMware. Yo can download it here:

https://my.vmware.com/group/vmware/get-download?downloadGroup=OVF-TOOL-3-0-1 (you will need an account on VMware to download it)

After installing the command ovftool is availabe in "/Applications/VMware OVF Tool" in the CLI.

Here you can get the full user guide of ovtool or just enter

# ./ovftool --help

at the command prompt in the folder "/Applications/VMware OVF Tool".

By using the following command I could convert the .ova to .vmwarevm. You just need to enter the source file and your target where you want to save it:

./ovftool /Users/<username>/Downloads/lcd596vmware8.ova  /Users/<username>/Downloads/lcd596vmware8.vmwarevm


Maybe you can also just convert it to vmx or another fileformat which is more efficient, because now the file size increased from 2.6GB to 7 GB. But at least I can open it now.

Rebuild MiniPwner

Hi,

I just wanted to use my MiniPwner again after some months where it was just placed on my desk and unfortunately I forget the password and I also didn't wrote it in my KeePass File.

So I had to reinstall it. Luckily there is a rebuilding instruction of the MiniPwner in case there went something wrong with your MiniPwner (or you just forget about the password ;-) ).

In the rebuilding instructions it is mentioned to get the "squash-sysupgrade.bin". I couldn't get it on this URL as the folder is empty. So I used the latest firmware "openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory" for the TP-Link router from this directory on openwrt. The MD5Sum I got was:

root@Pulse:/tmp# md5sum owrt.bin
5d7bac7b467c42e215c60fcd0a00cc01

The image is available again.

On your Client where you've placed your openwrt image, you just start your netcat server.

# nc -l -p 3333 < openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin

On your TP-Link now just get the image via netcat:

# nc 192.168.1.2 3333 > /tmp/owrt.bin

The file should be on your TP-Link within a few seconds so you can abort the netcat session on it. After that just install the firmware:

# mtd -r write 703.bin firmware

After the installation of the firmware is done, which shouldn't take longer than one or two minutes, you need to configure your interface of the client that is connected to TP-Link to DHCP. The IP of TP-Link should be 192.168.1.1. You can now telnet to this IP:

$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------

BusyBox v1.19.4 (2012-08-26 12:49:54 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (12.09-beta, r33312)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/# 

You should now change your root password so that you can login via ssh in the future. Then you can ssh to your TP-Link and can continue the installation instructions on minipwner.org at step 12.

You can also navigate now to the Webgui under http://192.168.1.1/cgi-bin/luci.

IMPORTANT:

Right now it is not possible to execute "opkg update" as all the files in http://downloads.openwrt.org/snapshots/trunk/ are missing. There are several tickets about this issue, here and here.

But they are both almost 2 weeks old and it's not clear when the files are coming back. So here is what I did (thanks to flyingstar16, who posted this hint in one of the tickets):

1. Comment out the lines in /etc/opkg/xwrt.conf

root@Pulse:/etc# vim opkg/xwrt.conf
#src/gz X-Wrt http://downloads.x-wrt.org/xwrt/snapshots/trunk/ar71xx/packages

2. Comment out the line to http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages as it is not working and add the line "src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-beta/ar71xx/generic/packages"

root@Pulse:/etc# vim opkg.conf

src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-beta/ar71xx/generic/packages

#src/gz snapshots http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages
dest root /
dest ram /tmp
lists_dir ext /var/opkg-lists
option overlay_root /overlay

3. Now you can execute opkg update.


Some other hints:

When copying all the files in Step 19 in /etc/ to make a backup of them, I hadn't a firewall config and fstab. See my output:

root@OpenWrt:/usr/share# cp -f /etc/config/network /etc/config/network.orig
root@OpenWrt:/usr/share# cp -f /etc/config/wireless /etc/config/wireless.orig
root@OpenWrt:/usr/share# cp -f /etc/config/firewall /etc/config/firewall.orig
root@OpenWrt:/usr/share# cp -f /etc/profile /etc/profile.orig
root@OpenWrt:/usr/share# cp -f /etc/config/fstab /etc/config/fstab.orig
cp: can't stat '/etc/config/fstab': No such file or directory
root@OpenWrt:/usr/share# cp -f /etc/opkg.conf /etc/opkg.conf.orig
root@OpenWrt:/usr/share# cp -f /etc/config/system /etc/config/system.orig
root@OpenWrt:/usr/share# cp -f /etc/config/dhcp /etc/config/dhcp.orig
root@OpenWrt:/usr/share# cp -f ./network.1 /etc/config/network
cp: can't stat './network.1': No such file or directory
root@OpenWrt:/usr/share# cp -f ./wireless.1 /etc/config/wireless
cp: can't stat './wireless.1': No such file or directory
root@OpenWrt:/usr/share# cp -f firewall.1 /etc/config/firewall
cp: can't stat 'firewall.1': No such file or directory

But everything worked fine. I also skipped step 20 and 21 as the right MAC-Address for WiFi was already in the config. 

Here is a good explanation how to configure WiFi in OpenWRT.

Have fun.

Setup a Mailserver

Hy,

this post is not about pentesting, but this weekend I had to move a domain of a friend of mine to my Debian server. After moving the domain I needed also to setup a (IMAP-) mail server. I'm not so good into configuring a whole mailserver system, but I found this really great tutorial:

http://workaround.org/ispmail/squeeze/

It worked just like a charme. And even if you have a problem just look in the comments, there is for sure someone that already had the same problem. If not, look in /var/log/mail.log ;-)

Cheers.

Perl and https requests

Hi there,

today I was in the mood in writing some little perl script that I need for a project. To get the perl script running it was needed to execute some https requests.

First I was installing LWP::UserAgent and HTTP::Request via cpanm. Then I was writing a basis script that was executing a http request. I'm only interested in the header, so I don't want to print out the body content (I've found this litte code snippet here).

 #!/usr/bin/perl  
 use LWP::UserAgent; 
 use HTTP::Request;  

 my $URL = 'http://www.example.com/';  
 my $agent = LWP::UserAgent->new(env_proxy => 1,keep_alive => 1, timeout => 30);  
 my $header = HTTP::Request->new(GET => $URL);  
 my $request = HTTP::Request->new('GET', $URL, $header);  
 my $response = $agent->request($request);  

 if ($response->is_success){  
     print "URL:$URL\nHeaders:\n";  
     print $response->headers_as_string;  
 }elsif ($response->is_error){  
     print "Error:$URL\n";  
     print $response->error_as_HTML;  
 }  

This worked for me very well, but I needed to create a https request. When I was executing the same script with https instead of http I was getting the following error:

 Error:https://www.example.com/  
 <html>  
 <head><title>An Error Occurred</title></head>  
 <body>  
 <h1>An Error Occurred</h1>  
 <p>501 Protocol scheme 'https' is not supported (LWP::Protocol::https not installed)</p>  
 </body>  
 </html>  

So, I need to install LWP:Protocol:https, but this wasn't working:

 $ sudo cpanm LWP::Protocol::https  
 --> Working on LWP::Protocol::https  
 Fetching http://www.cpan.org/authors/id/G/GA/GAAS/LWP-Protocol-https-6.03.tar.gz ... OK  
 Configuring LWP-Protocol-https-6.03 ... OK  
 ==> Found dependencies: IO::Socket::SSL  
 --> Working on IO::Socket::SSL  
 Fetching http://www.cpan.org/authors/id/S/SU/SULLR/IO-Socket-SSL-1.76.tar.gz ... OK  
 Configuring IO-Socket-SSL-1.76 ... OK  
 ==> Found dependencies: Net::SSLeay  
 --> Working on Net::SSLeay  
 Fetching http://www.cpan.org/authors/id/M/MI/MIKEM/Net-SSLeay-1.48.tar.gz ... OK  
 Configuring Net-SSLeay-1.48 ... OK  
 Building and testing Net-SSLeay-1.48 ... FAIL  
 ! Installing Net::SSLeay failed. See /root/.cpanm/build.log for details.  
 ! Bailing out the installation for IO-Socket-SSL-1.76. Retry with --prompt or --force.  
 ! Bailing out the installation for LWP-Protocol-https-6.03. Retry with --prompt or --force.  

Openssl was installed, but I needed to install "build-essential libssl-dev" to get the installation of LWP:Protocol_https working:

 $ sudo apt-get install build-essential libssl-dev  

Now https requests can be made with perl:

 #!/usr/bin/perl  
   
 use LWP::UserAgent;  
 use HTTP::Request;  
   
 my $URL = 'https://www.twitter.com/';  
   
 my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 1 });  
 my $header = HTTP::Request->new(GET => $URL);  
 my $request = HTTP::Request->new('GET', $URL, $header);  
 my $response = $ua->request($request);  
   
 if ($response->is_success){  
     print "URL:$URL\nHeaders:\n";  
     print $response->headers_as_string;  
 }elsif ($response->is_error){  
     print "Error:$URL\n";  
     print $response->error_as_HTML;  
 }  
   

Response of twitter.com on port 443:

   
 $ ./hsts.pl   
 URL:https://www.twitter.com/  
 Headers:  
 Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0  
 Date: Thu, 06 Sep 2012 21:22:33 GMT  
 Pragma: no-cache  
 ETag: "f7a8e95e2978ac6f73209336152b9495"  
 Server: tfe  
 Vary: Accept-Encoding  
 Content-Length: 47126  
 Content-Type: text/html; charset=utf-8  
 Expires: Tue, 31 Mar 1981 05:00:00 GMT  
 Last-Modified: Thu, 06 Sep 2012 21:22:33 GMT  
 Client-Date: Thu, 06 Sep 2012 21:22:33 GMT  
 Client-Peer: 199.59.148.10:80  
 Client-Response-Num: 1  
 Content-Base: http://twitter.com/  
 Link: <http://a0.twimg.com>; rel="dns-prefetch"  
 Link: <http://api.twitter.com>; rel="dns-prefetch"  
 Link: </favicons/favicon.ico>; rel="shortcut icon"; type="image/x-icon"  
 Link: <http://a0.twimg.com/a/1346884958/t1/css/t1_core_logged_out.bundle.css>; media="screen"; rel="stylesheet"; type="text/css"  
 Link: <https://twitter.com/>; rel="canonical"  
 Link: <http://a0.twimg.com/a/1346884958/t1/css/t1_more.bundle.css>; media="screen"; rel="stylesheet"; type="text/css"  
 Refresh: 0; URL=/?_twitter_noscript=1  
 Set-Cookie: k=10.36.21.101.1346966553057924; path=/; expires=Thu, 13-Sep-12 21:22:33 GMT; domain=.twitter.com  
 Set-Cookie: guest_id=v1%3A134696655306150737; domain=.twitter.com; path=/; expires=Sun, 07-Sep-2014 09:22:33 GMT  
 Set-Cookie: _twitter_sess=BAh7CSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCOaBdp05AToMY3NyZl9p%250AZCIlNThkNmZkYjY2ODJjNTc0MzY0YTY2Y2M0YjI0OGU2NWE6B2lkIiUwMmUz%250AZTJjY2VkMjFiYWNmZjQ5MmI2MjQyNWU5ZTJiMw%253D%253D--7d08430b6a85e0006ac4c062a4218d5cf841f564; domain=.twitter.com; path=/; HttpOnly  
 Status: 200 OK  
 Title: Twitter  
 X-Frame-Options: SAMEORIGIN  
 X-Meta-Charset: utf-8  
 X-Meta-Description: Verbinde Dich sofort mit den Dingen, die für Dich am wichtigsten sind. Folge Freunden, Experten, Lieblingsstars und aktuellen Nachrichten.  
 X-MID: e88c4d8fc53fc1466f24f3cbc905d24fd89af901  
 X-Runtime: 0.07026  
 X-Transaction: 4998cc5789e9b2c0  
 X-UA-Compatible: IE=edge  
 X-XSS-Protection: 1; mode=block  
   

First step is done :-)

Vulnerable Web Applications

Hey there,

really a long time without a new post, but hopefully this will change in the future.

In this post I was listing some vulnerable VMs that can be used for pentesting at home. There are also several vulnerable Web Applications available, that can be used for pentesting. I've found a really great overview of vulnerable Web Applications.

I will use for local testing now Damn vulnerable Web Application (DVWA)

Here is a short description about DVWA copied from the DVWA website:

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

So the only thing you will need, after downloading DVWA is Apache/PHP/MySQL environment. This      can be easily realized with XAMPP, as it is a full package containing Apache Webserver with PHP and a MySQL Database and is available for a lot of plattforms (Mac OS X/ Windows / Linux / Solaris).

Hopefully I will have some time to execute a pentest against DVWA and to post some findings about it :-)

MiniPwner

Hey folks,

after waiting for two months my TP-Link Router has finally arrived yesterday. I'm not quite happy how the order was processed by volumerates.com. I ordered the TP-Link on 16th of January and volumerates gave an information in the automated E-Mail (after buying the router) that customers should write an E-Mail to them if they didn't get any response by volumerates.com within one week.
I didn't get any response within one week so I decided to write an E-Mail to them. => No Answer.
After another 4 weeks (I was in vacation abroad) still no answer. So I wrote another E-Mail => No Answer.
Then I openend a ticket on http://www.volumerates.com/. => No Answer.
I had no information at all for two months and there were also no E-Mails in my Spam Folder. Just one respond to my E-Mail that it will take one or two months would have been very good. I already thought my money is lost...

The happy part though is that it finally arrived and the installation instruction on MiniPwner.com worked as a charm.

Now I've got a fully working pentesting device with a RJ45 port, Wi-Fi and one USB-Port running OpenWRT. The USB-Port is already used by a 8 GB USB Flash-Drive.

Here a short overview of the installed tools so far:

root@OpenWrt:~# opkg list
aircrack-ng - 1.1-3
base-files - 104-r30857
base-files-network - 3
blkid - 1.42-1
block-mount - 0.2.0-7
busybox - 1.19.3-10
bzip2 - 1.0.6-1
crda - 1.1.1-1
dnsmasq - 2.59-2
dropbear - 2011.54-2
dsniff - 2.4b1-2
elinks - 0.11.7-1
firewall - 2-47
hotplug2 - 1.0-beta-4
iptables - 1.4.10-4
iw - 3.3-1
kernel - 3.2.9-1-7ca3c65ac3709dabad42d460596851da
kismet-client - 2010-07-R1-1
kismet-server - 2010-07-R1-1
kmod-ath - 3.2.9+2012-02-27-1
kmod-ath9k - 3.2.9+2012-02-27-1
kmod-ath9k-common - 3.2.9+2012-02-27-1
kmod-cfg80211 - 3.2.9+2012-02-27-1
kmod-crypto-aes - 3.2.9-1
kmod-crypto-arc4 - 3.2.9-1
kmod-crypto-core - 3.2.9-1
kmod-fs-ext4 - 3.2.9-1
kmod-gpio-button-hotplug - 3.2.9-1
kmod-ipt-conntrack - 3.2.9-1
kmod-ipt-core - 3.2.9-1
kmod-ipt-nat - 3.2.9-1
kmod-ipt-nathelper - 3.2.9-1
kmod-leds-gpio - 3.2.9-1
kmod-ledtrig-usbdev - 3.2.9-1
kmod-lib-crc-ccitt - 3.2.9-1
kmod-lib-crc16 - 3.2.9-1
kmod-mac80211 - 3.2.9+2012-02-27-1
kmod-nls-base - 3.2.9-1
kmod-ppp - 3.2.9-1
kmod-pppoe - 3.2.9-1
kmod-scsi-core - 3.2.9-1
kmod-tun - 3.2.9-1
kmod-usb-core - 3.2.9-1
kmod-usb-ohci - 3.2.9-1
kmod-usb-storage - 3.2.9-1
kmod-usb2 - 3.2.9-1
kmod-wdt-ath79 - 3.2.9-1
libblkid - 1.42-1
libbz2 - 1.0.6-1
libc - 0.9.33-104
libcom_err - 1.42-1
libext2fs - 1.42-1
libgcc - 4.6-linaro-104
libgdbm - 1.9.1-2
libip4tc - 1.4.10-4
liblzo - 2.05-1
libncurses - 5.7-5
libnet0 - 1.0.2a-8
libnids - 1.18-1
libnl-tiny - 0.1-2
libopenssl - 1.0.0g-1
libpcap - 1.1.1-1
libpcre - 8.11-2
libpthread - 0.9.33-104
libreadline - 5.2-2
librpc - 0.9.32-rc2-0a2179bbc0844928f2a0ec01dba93d9b5d6d41a7
libstdcpp - 4.6-linaro-104
libuci - 2012-02-24.1-1
libuuid - 1.42-1
libxtables - 1.4.10-4
mtd - 17
nbtscan - 1.5.1
netcat - 0.7.1-2
nmap - 5.51-3
openssh-sftp-client - 5.9p1-4
openvpn - 2.2.1-5
opkg - 618-2
perl - 5.10.0-7
ppp - 2.4.5-4
ppp-mod-pppoe - 2.4.5-4
samba2-client - 2.0.10-8
samba2-common - 2.0.10-8
snort - 2.8.4.1-3
swap-utils - 2.13.0.1-4
swconfig - 10
tar - 1.23-1
tcpdump - 4.2.1-1
terminfo - 5.7-5
uboot-envtools - 2011.06-4
uci - 2012-02-24.1-1
uclibcxx - 0.2.2-3
wireless-tools - 29-4
wpad-mini - 20111103-3
yafc - 1.1.1-2
zlib - 1.2.5-1