Tuesday, February 03, 2009

TippingPoint IPS evasion by packet fragmenting

I was recently testing a website which had and IPS running on it. The IPS was from TippingPoint and my task was to execute XSS & Sql Injection attacks on the site - after bypassing the IPS. Now bypassing the IPs was something I had only read about and had never done it first hand. SO this seemed to be a challenge.

The vulnerability details can be found here:

http://www.3com.com/securityalert/alerts/3COM-07-002.html
http://www.securityfocus.com/bid/24861/info

This vulnerability can be exploited by sending fragmented packets so that the IPS would not detect the traffic. This vulnerability exists only in TippingPoint TOS versions 2.1.x, 2.2.x prior to 2.2.5, and 2.5.x.

I used a tool called 'fragroute' which comes preinstalled in BackTrack3.

fragroute creates a route to the server you traget and all your traffic passes through fragroute - no need to configure proxy in web browsers. The configuration that worked for me was -

tcp_seg 24
ip_frag 64
tcp_chaff paws
print

This configuration goes in the conf file /pentest/scanners/fragroute-1.2/fragroute.conf and the command would be -

bt ~ # fragroute -f /pentest/scanners/fragroute-1.2/fragroute.conf xxx.xxx.xxx.xxx

After the command is executed, just browse to the site and your traffic will be fragged!

This thing worked for me. Another idea as suggested by BSDaemon (Rodrigo) would be to use gzip encoding. i.e. to send your traffic by encoding it using gzip and then send the traffic by fragging it. fragroute can be used to fragment the traffic. You will need to create a PHP script to send requests for you and use the function gzinflate to encode the traffic.

I have not tried this technique so I do not know the details of the working but this idea should give headway to anyone looking for help.

Any inputs / comments / feedback will be welcome :-)

Labels:

Sunday, January 20, 2008

You are kidding aren't you?

Many of you know that i like to show off my superior knowledge about technology and computers in general and try to belittle the ignorant mortals. So I've decided to start my own Internet Hall of Shame where I'll be posting outrageous entries salvaged from the Internet. The one below is a good contender for the top spot. This was posted in a discussion of "Why Linux will not displace Windows"

"Are you saying that this Linux can run on a computer without windows underneath it, at all ? As in, without a boot disk, without any drivers, and without any services ?

That sounds preposterous to me.


If it were true (and I doubt it), then companies would be selling computers without a windows. This clearly is not happening, so there must be some error in your calculations. I hope you realize that windows is more than just Office ? Its a whole system that runs the computer from start to finish, and that is a very difficult thing to achieve. A lot of people don't realize this.

Microsoft just spent $9 billion and many years to create Vista, so it does not sound reasonable that some new alternative could just snap into existence overnight like that. It would take billions of dollars and a massive effort to achieve. IBM tried, and spent a huge amount of money developing OS/2 but could never keep up with Windows. Apple tried to create their own system for years, but finally gave up recently and moved to Intel and Microsoft.

Its just not possible that a freeware like the Linux could be extended to the point where it runs the entire computer from start to finish, without using some of the more critical parts of windows. Not possible.

I think you need to re-examine your assumptions."

Cracks me up each time I go through it.

Labels: ,

Friday, January 18, 2008

And 'They' say "You spoil the environment"

This is a common statement that is hurled towards outsiders working in Bangalore. Lets divide the people into two clans and dig into it deeper – ‘Us’ and ‘Them’. ‘Us’ being the people from outside Bangalore/Karnataka and ‘Them’ being localities. Why are such things being said?

1) Booze
Them - You guys drink and create scenes.

Us - Ever be to a frigging wine shop? 90% of the people there are people in lungis, drinking desi, right there; in the shop.

I wonder if these shops even have the license to serve alcohol in the first place or they serve a drink or two to the cops have get away with it.

‘We’, do drink, but either at Pubs or in the privacy of our homes. If at pubs, we do not loiter on the streets because the cops sniff our asses like dogs to find out if we are drunk and extort money. If at home, we do not want to disturb the other people living in the vicinity. Booze culture has been prevalent in Bangalore since 1970's. I believe that was the time IT meant Income Tax and nothing else. ‘We’ have not aggravated the problem. If you do not believe me, just keep an eye on the sidewalks after 9:30 and see for yourself whom you find lying in the gutters - IT professionals or someone else?

Us - Yes, we do drink but ‘We’ do not spoil the environment after drinking. If ‘We’ did create a scene, you would make it impossible for ‘Us’ to live.

2) Crime rate
Them - Crime rate has gone up because of ‘You’.

Us - This is a joke, right?

We are at the receiving end of the crimes. And who are the people who commit them? No the outsiders, but the localities. Yes siree. We are the ones who are looted every night while traveling or beaten up for reasons known only to the mentally demented. Girls are harassed not by ‘Us’, but by those who are not outsiders. ‘We’ as not A-holes to come to a foreign land and do immoral activities. ‘We’ are the ones who are being harassed physically, mentally and financially (I'll come to that soon)


3) Climate
Them - The climate has become hot since this IT thing started. It’s not the same.

Us - Its happening all over the world. You are not exceptional. Welcome to the club. Some call it Global Warming. I'd just call it a natural change in climate.


4) Traffic & Pollution
Them - The traffic and pollution have increased. Lots of traffic jams. So much pollution.

Us - I agree the traffic problem has increased. But that’s the state of all growing cities. The government is earning a fortune as taxes because of IT and the least they can do is build a few flyovers to solve the problem of traffic jams at peak hours. I can't help it if the politicians are corrupt. They are one of 'You'. Another observation I've made is that the traffic jams are mostly created due to heavy motor vehicles (Buses, Trucks, and Tractors) which move slowly and do not allow other traffic to move forward. This city needs wider roads. Even 'We' hate these jams. 'We' are not entertained by them and just want to do our jobs and go home.

As for pollution, 'We' are pressed into riding Non-Polluting Vehicles, which we do. Check the pollution levels of Auto-Rickshaws, Buses, and Trucks. You'll find the culprits. Don't blame us.

5) Auto Rickshaws
Us - The auto rickshaws suck the last drop of blood from out veins. The pain that we go through while squabbling with them is equivalent to getting kicked in the nuts. Being charged 1.5 times fare at every possible opportunity just because ‘We’ are not from here is just done. Reasons cited – “I have to take a U-turn 1 kms away” (Wait for 5 minutes, you’ll get a passenger, that way you will not have to take a U-turn) “1.5 time because it’s a Sunday” (WTF??? Dude, didn’t you make enough money when you mugged that poor soul last night on Outer Ring Road??)

Them – ‘You’ earn so much, what do you care?

Us – Its hard earned money. You would know if you went out and worked rather than just live off the rent that you get by letting out your ancestors house.

6) Corruption
Them – Corruption has increased since ‘You’ guys have come.

Us – Lets just not get there. I don’t want to open a can-of-whoop-ass and expose what all goes on and why is there corruption. (Ever wondered why ITPL and Electronic City are in one end of the city and the new Airport on totally another end of the city?)

--
Disclaimer: I do not have a personal grudge against 'Them' This post is just a funny thought that crossed my deranged neuro system. While some of the things said above are true, others are just to piss 'Them' off. Please do not flood me with 'I hate you - go hang yourself' comments.

Labels: , ,

Thursday, January 17, 2008

Things I've learnt about the stock market

This post will not make you rich overnight. It's not one of those "Master the markets" crap. These are just some things I've learnt over the past one and a half year. I'm happy to share this with you. Don't expect that this is Guru gyan that you can't get anywhere else. You'll definately learn these things when you invest in stocks, but best not to learn it the hard way (Like I did in some cases)

1) Don't sell all your stocks at one go. Sell in lots. This is a wise thing to do as you the prices of the stocks that you are selling might still go higher. If you think that the prices will go down, sell more but as fas as possible, don't sell off everything at one go.

2) When the markets are falling, don't get panicky. Don't be in a hurry to sell off your stocks because the prices are falling. Sooner or later they will bounce back. Avoid trading when the markets are falling. Its like trying to catch a falling knife. You'll end up hurting yourself. As they say "When the rape in inevitable, lie down and enjoy it"

3) Set targets. Whether you buy or sell stocks, set targets and then act. If you want to sell a stock, set a target, once that target is achived, sell off the stock. The price might go higher, but it can go lower also. So act on targets. Don't get too greedy.

4) Start booking profits as soon as the market reaches "All time high" and all that jazz. It will crash as soon as it reaches some mark. Book profits at that time - sit on cash wait for the market to come down and get ready to buy.

5) Don't act blindly on tips. Research the company, check out its trading volume, price history and see which mutual funds have invested in it, etc. Compare the stocks with the stocks in the same category (Price history, comparative price). Its your money, you should know where to put it.

6) If you've invested in a slow moving stock which has not had much movement. Don't wait for it to move. It might move, but that'll take time. Get out of that stock and invest in a fast moving stock (Reliance ???? :-D )

7) Be patient. Give your money time to appreciate. Never ever take a hasty decision. You'll never profit out of it.

8) Don't put all your eggs in one basket. i.e. Have a diversified portfolio by investing in multiple sectors. Check out which sectors are hot and try to focus on them for that moment, but also keep a tab on what might come up in the future and invest in it while the prices are low.

9) Don't get obsessed with it. Playing with stocks is highly addictive. Try not to think too much about it. You will lose your focus if you think more than required.

10) Whenever you sell a profitable stock, keep a watch on its price. Buy it back as soon as it falls. These stocks can make you rich.

11) Don't just invest in stocks. See other options - Mutual Funds are doing good. Diversify your funds.

12) Avoid buying stocks when they are at all time high rates. People will say that it'll still go up. But its more likely to come down pretty soon. Buy the stock when the price comes down.

Hope you'll be careful about investing. Keep in touch with the market, play safe and you'll definately be profitable. Happy Investing :-)

Labels:

Wednesday, November 21, 2007

Having a bad day?

Labels: , ,

Tuesday, October 23, 2007

"Viral" Fever

No, its not the virus wala viral I am talking about here, but the viral marketing stuff -Advertisments. Webchutney has made some of the funniest virals I've seen till now and they are definately worth a look. Below is the list of some of the virals by webchutney. If there are more, lemme know, these things outta be shared with :-)

I like the "Thakur ka inteqam" and the "Chalis Chor" one and love it when the guy says "Bhains ki eyes" in that one.

http://www.thakurkainteqam.com
http://www.webchutney.com/virals/chalo_lanka.html
http://www.webchutney.com/virals/ChitiAyiHai.html
http://www.makkadman.com/
http://www.webchutney.com/virals/aao_viral.html
http://www.webchutney.com/virals/udi.html
http://www.webchutney.com/virals/mastbahaar.html
http://www.webchutney.com/virals/moving_train.html
http://www.webchutney.net/extras/airtel/chaalischor/chaalischor.html
http://www.microsoft.com/india/jugalbandi/
http://makemytrip.co.in/makemytrip/static/flash.htm

Labels: , ,

Sunday, March 18, 2007

30 Funny Seinfeld Quotes

● I was the best man at the wedding. If I'm the best man, why is she marrying him?

● It's amazing that the amount of news that happens in the world every day always just exactly fits the newspaper.

● What is a date really, but a job interview that lasts all night? The only difference is that in not many job interviews is there a chance you’ll wind up naked.

● You know you're getting old when you get that one candle on the cake. It's like, "See if you can blow this out."

● Men want the same thing from their underwear that they want from women: a little bit of support, and a little bit of freedom.

● Dogs are the leaders of the planet. If you see two life forms, one of them's making a poop, the other one's carrying it for him, who would you assume is in charge.

● Now they show you how detergents take out bloodstains, a pretty violent image there. I think if you've got a T-shirt with a bloodstain all over it, maybe laundry isn't your biggest problem.Maybe you should get rid of the body before you do the wash.

● That's the true spirit of Christmas; people being helped by people other than me

● There's very little advice in men's magazines, because men don't think there's a lot they don't know. Women do. Women want to learn. Men think, "I know what I'm doing, just show me somebody naked."

● According to most studies, people's number one fear is public speaking. Number two is death. Death is number two. Does that sound right? This means to the average person, if you go to a funeral, you're better off in the casket than doing the eulogy.

● Sometimes the road less traveled is less traveled for a reason

● The Swiss have an interesting army. Five hundred years without a war. Pretty impressive. Also pretty lucky for them. Ever see that little Swiss Army knife they have to fight with? Not much of a weapon there. Corkscrews. Bottle openers. "Come on, buddy, let's go. You get past me, the guy in back of me, he's got a spoon. Back off. I've got the toe clippers right here."

● Why do people give each other flowers? To celebrate various important occasions, they're killing living creatures? Why restrict it to plants? "Sweetheart, let's make up. Have this deceased squirrel."

● Why do they call it a "building"? It looks like they're finished. Why isn't it a "built"?

● People who read the tabloids deserve to be lied to

● Seems to me the basic conflict between men and women, sexually, is that men are like firemen. To men, sex is an emergency, and no matter what we're doing we can be ready in two minutes. Women, on the other hand, are like fire. They're very exciting, but the conditions have to be exactly right for it to occur.

● The big advantage of a book is it's very easy to rewind. Close it and you're right back at the beginning.

● I have a friend who’s collecting unemployment insurance. This guy has never worked so hard in his life as he has to keep this thing going. He’s down there every week, waiting on the lines and getting interviewed and making up all these lies about looking for jobs. If they had any idea of the effort and energy that he is expending to avoid work, I’m sure they’d give him a raise.

● To me, a lawyer is basically the person that knows the rules of the country. We're all throwing the dice, playing the game, moving our pieces around the board, but if there is a problem the lawyer is the only person who has read the inside of the top of the box.

● Men don't care what's on TV. They only care what else is on TV.

● The idea behind the tuxedo is the woman's point of view that men are all the same; so we might as well dress them that way. That's why a wedding is like the joining together of a beautiful, glowing bride and some guy. The tuxedo is a wedding safety device, created by women because they know that men are undependable. So in case the groom chickens out, everybody just takes one step over, and she marries the next guy.

● My parents didn't want to move to Florida, but they turned sixty, and that's the law.

● I will never understand why they cook on TV. I can't smell it. Can't eat it. Can't taste it. The end of the show they hold it up to the camera, "Well, here it is. You can't have any. Thanks for watching. Goodbye."

● Somebody just gave me a shower radio. Thanks a lot. Do you really want music in the shower? I guess there's no better place to dance than a slick surface next to a glass door.

● See, the thing of it is, there's a lot of ugly people out there walking around but they don't know they're ugly because nobody actually tells them.

● What would the world be like if people said whatever they were thinking, all the time, whenever it came to them? How long would a blind date last? About 13 seconds, I think. "Oh, sorry, your rear end is too big." "That's ok, your breath stinks anyway. See you later."

● You know what I never get with the limo? The tinted windows. Is that so people don't see you? Yeah, what a better way not to have people notice you than taking a thirty foot Cadillac with a TV antenna and a uniformed driver. How discreet. Nobody cares who's in the limo. You see a limo go by, you know it's either some rich jerk or fifty prom kids with $1.75 each.

● You can measure distance by time. "How far away is it?" "Oh about 20 minutes." But it doesn't work the other way. "When do you get off work?" "Around 3 miles."

● Are there keys to a plane? Maybe that's what those delays are sometimes, when you're just sitting there at the gate. Maybe the pilot sits up there in the cockpit going, "Oh, I don't believe this. Dammit..I did it again." They tell you it's something mechanical because they don't want to come on the P.A. system, "Ladies and gentlemen, we're going to be delayed here on the ground for a while. I uh..Oh, God this is so embarrassing...I, I left the keys to the plane in my apartment. They're in this big ashtray by the front door. I'm sorry, I'll run back and get them."

● I once had a leather jacket that got ruined in the rain. Why does moisture ruin leather? Aren't cows outside a lot of the time? When it's raining, do cows go up to the farmhouse, "Let us in! We're all wearing leather! Open the door! We're going to ruin the whole outfit here!"

Labels: ,