Security Reliks

Hey everyone. So th3j35t3r (the jester) just released one of his recon tools!  He describes it best himself as a “Non- Invasive and Non-Detectable WebServer Reconnaissance Scanner”. He goes on in his normal military tone to explain:

The intel gained serves both as actionable in the sense that it could be directly used to help root a box, while at the same time giving a good overview of stuff that’s present on the box and where it is within the directory structure.

What Does it Do Exactly?

Foxone is a php script that identifies vulnerabilities similarly to other tools like Goolag or SiteDigger. Essentially, foxone uses a mysql database of specific google dorks/queries (see GHDB). When the tool is ran, it fetches the vulnerable urls (from a table called vulnerable_urls) from the database and submits a number of queries. All of the queries are essentially an entry from the vulnerable_url’s table as well as a site: <target> google filter. Each request is submitted in a non-api fashion utilizing the traditional php file_get_contents method. It then scrapes away unnecessary html, parses to determine if the vulnerability is found, and outputs a report upon completion. Included in this report are descriptions of how identified vulnerabilities could be used for further exploitation. One of the nice parts of foxone is that it will update and prioritize vulnerabilities for future scans based upon those that are found more frequently in your own endeavors.

How to install

Installation is a synch. Download it from his blog here. Then from within the foxone directory:

1.Start mySql

# /etc/init.d/mysql start

2. Login to mySql as root/toor

# mysql -u root -p

3. Create the database (he calls it ‘pathfinder’ in the sql script, but it doesn’t matter)

mysql> create database pathfinder

4. Select the database

mysql> use pathfinder

5. run the foxone.sql script

mysql> source foxone.sql

6. Exit mysql, and open foxone(.php) in your favorite text editor. We then need to edit lines 23-26 to look like:

$database_srvr = "localhost";
$database_name = "pathfinder";
$database_user = "root";
$database_pass = "toor";

7. Test it!

# php foxone test

FoxOne Server Reconnaisance Tool v0.5
by th3j35t3r: http://www.twitter.com/th3j35t3r
‘There’s an unequal amount of good and bad in most things,
the trick is to work out the ratio and act accordingly.’

Successfully loaded all 6540 modules.
Anti False-Positive Filter is ENABLED!

The Jester?

For those unfamiliar with who th3j35t3r is, I recommend reading up on him from the following articles. The latter of the two is written by a buddy of mine TJ O’Connor who brings very real insights into the operational future of individuals like th3j35t3r.

Meet a Cyber Special Ops Warrior

The Jester Dynamic: A Lesson in Asymmetric Unmanaged Cyber Warfare