Some possible applications include:

1. basic network testing
2. identifying firewall rules
3. identifying IPS filters

Check it out: http://netalyzr.icsi.berkeley.edu/

http://code.google.com/p/fuzzops-ng/

Anyway, there is an update to ACT that will enable users to utilize it as part of scripting, etc.

How you can help

I have released it as the first beta release for two reasons:

1. I need more bug reports
2. I want to know what new features people want

Also…

I am looking for a developer with interest/experience with the ZAP (Zed Attack Proxy) OWASP tool. Simon (the creator) and I have been discussing a plugin module to integrate ACT into ZAP as an installable extension (NOT a combination of the tools). If you are interested, please contact me.

Check it out: https://www.owasp.org/index.php/OWASP_AJAX_Crawling_Tool

My favorite slide had to do with that obscure “Free Public WiFi” SSID that we see all over the place. I see these all the time at airports, but also at hotels and other commonly utilized public wifi areas. Apparently this is the default name for ad-hoc networks that are created by Windows XP SP2. Obviously this gets us excited ( MS 08-067). If they are running an XP SP2 box, we can probably assume that the machine is not frequently administered, and most likely not patched. Here are the simple steps that Josh Wright provided in order to exploit this machine:

IP 169.254.131.118.138 > 169.254.255.255.138: NBT UDP PACKET(138)

Go check out the demo here: http://vimeo.com/31059474

and download ACT here: http://code.google.com/p/fuzzops-ng/downloads/list

Why the rewrite?

Well, the first release (FuzzOps) was very buggy and not very well designed. It did not allow for the type of flexibility that I wanted from the tool.

Why did you modularize the crawler?

After reviewing the purpose of the tool and hearing about some needs in the community, I felt like a portion (the fuzzer) of the project would essentially be “reinventing the wheel”. However, the crawler itself is a unique functionality that lots of security professionals would like to utilize. So rather than tying the AJAX crawling code to the fuzzer, I have made it a module that can be used with any proxy out there. Tying these tools together can then allow security experts to properly crawl their target web applications utilizing their favorite proxy.

ACT (AJAX Crawling Tool) is part of the FuzzOps-NG project. You can download it here:

http://code.google.com/p/fuzzops-ng/downloads/list

Make sure to read the README on the wiki page.

NOTE: ACT is heavily dependent upon the work done by Seleinum and Crawljax. Please acknowledge them for this tool’s heavy lifting.

UDID

For those unfamiliar with iOS development, it is important to understand how UDIDs are utilized for use in applications. Rather than require the storage of credentials or a generated user ID within the user’s plist (properties) file, many applications rely upon an API call to locally grab the UDID and use that as the primary mode of identification between the server and the client. This removes the need to store passwords or other login credentials in a less safe environment. However, with the proposed changes developers will now need to generate their own unique IDs and store them within the applications plist file.

Application Spoofing/Hijacking

This change, however, may leave the device open to spoofing attacks (both targeted and brute-forced). Because a new application generated identifier will now reside within user accessible storage, the application is forced to trust possibly modified data. Any sort of salting or client-to-server encryption is also evaded because that is done by the application after fetching the stored ID and before the client contacts the server. This clearly stands out from normal network spoofing/hijacking, but can have the same result.

Solution

Admittedly, I havn’t put a ton of thought into a thorough solution. However, my initial assessment seems to indicate that if an application were to encrypt or encode the unique ID before sending it to the client, and again before storing it in the plist file. This would make modification of a stored ID impossible, as well as obfuscate it in transit to prevent sniffing the unencrypted ID. This bypasses the spoofing, as well as prevents a pass-the-hash type attack.

EDIT: Here is the proof-of-concept

iOS App Spoofing through plist Hijacking from Skyler Onken on Vimeo.

I am providing a link to the slides from my presentation. I also want to give a special thanks to Dan Manson for his help.

I recommend going to the slideshare and downloading the actual ppt. I use quite a few transitions, so the slideshare overlaps those.

Solving the US Cyber Challenge: Cyber Quest

And the pcap: http://www.mediafire.com/?33xynmkr75zeauy

Hyperpolyglot

Enjoy!