Entries tagged as python
creativecommons aavepyörä berlin br breakcore bundestag cedric copycan copyright corruptibles developingworld dvd elephantsdream epetition fdl film freeculture freemusic freesoftware fruechtedeszorns gema gemavermutung goa internet iromance jamendo kts license linux lug microsoft movie musik musikpiraten nerosdaysatdisneyland ogg paniq petition pioneerone planet presserat sciencefiction series sony tuxmas tuxmas07 überwachung vlc vorbis vorratsdatenspeicherung git security snallygaster websecurity ibm lenovo windows windowsrefund blog blogdieb cacert earth feed hackergotchi harvester karlsruhe lawblog mars openstreetmap recht rechtsanwalt rss ssl stadtmitte udovetter webmontag 0days 27c3 addresssanitizer adguard adobe aead aes afra aiglx algorithm altushost android antivir antivirus aok apache apt asan auskunftsanspruch axfr azure badkeys barcamp bash berserk bias bigbluebutton bleichenbacher bodensee botnetz braunschweig browser bsi bsideshn bufferoverflow bugbounty bundesdatenschutzgesetz bundestrojaner bundesverfassungsgericht busby bypass c ca cbc ccc cccamp11 cellular certificate cfb chcounter chrome chromium clamav clang clickjacking cloudflare cmi cms code compiz conflictofinterest cookie crash crypto cryptography csrf cve darmstadt datenschutz deb debian dell deolalikar diffiehellman dingens diploma diplomarbeit distributions dns domain drupal easterhegg edellroot eff email encryption english eplus facebook fedora fileexfiltration firefox firewall fortigate fortinet forwardsecrecy freak freewvs frequency fsfe ftp fuzzing gajim gallery gcc gentoo ghost gimp glibc gnupg gnutls gobi google gpg gsm gsoc gstreamer hackerone hacking hannover hash heartbleed helma http https infoleak informationdisclosure internetscan ircbot itsecurity jabber javascript jodconverter joomla kaspersky key keyexchange komodia leak lessig libreoffice luckythirteen malware maninthemiddle mantis math md5 memorysafety mephisto milleniumproblems mitm mobilephones modulobias moodle mozilla mpaa mplayer mrmcd mrmcd100b mrmcd101b multimedia mysql napster nessus netfiltersdk newspaper nist nss ntp ntpd observatory onlinedurchsuchung openbsc openbts openleaks openpgp openssl openvas osmocombb otr owncloud packagemanagement padding panda papierlos password passwordalert passwort passwörter pdo pgp phishing php pnp poodle privacy privatekey privdog protocolfilters provablesecurity pss rand random rc2 redhat rhein rpm rsa rsapss s9y salinecourier schlüssel science serendipity server session sha1 sha2 sha256 sha512 shellbot shellshock sicherheit signatures slides smime sni sniffing spam sqlinjection squirrelmail staatsanwaltschaft stacktrace study stuttgart subdomain sunras superfish support talk taz thesis tls tlsdate toendacms transvalid ubuntu unicef unicode update updates useafterfree userdir utf-8 verschlüsselung virus vortrag vulnerabilities vulnerability web webapps wiesbaden windowsxp wiretapping wordpress x509 xgl xine xmpp xsa xss zerodays zugangsdaten zzuf breach content-security-policy cookies core coredump crime csp grsecurity heist samesite segfault symlink time webhosting webroot webserver
Wednesday, April 11. 2018
Introducing Snallygaster - a Tool to Scan for Secrets on Web Servers
A few days ago I figured out that several blogs operated by T-Mobile Austria had a Git repository exposed which included their wordpress configuration file. Due to the fact that a phpMyAdmin installation was also accessible this would have allowed me to change or delete their database and subsequently take over their blogs.Git Repositories, Private Keys, Core Dumps
Last year I discovered that the German postal service exposed a database with 200.000 addresses on their webpage, because it was simply named dump.sql (which is the default filename for database exports in the documentation example of mysql). An Australian online pharmacy exposed a database under the filename xaa, which is the output of the "split" tool on Unix systems.
It also turns out that plenty of people store their private keys for TLS certificates on their servers - or their SSH keys. Crashing web applications can leave behind coredumps that may expose application memory.
For a while now I became interested in this class of surprisingly trivial vulnerabilities: People leave files accessible on their web servers that shouldn't be public. I've given talks at a couple of conferences (recordings available from Bornhack, SEC-T, Driving IT). I scanned for these issues with a python script that extended with more and more such checks.
Scan your Web Pages with snallygaster
It's taken a bit longer than intended, but I finally released it: It's called Snallygaster and is available on Github and PyPi.
Apart from many checks for secret files it also contains some checks for related issues like checking invalid src references which can lead to Domain takeover vulnerabilities, for the Optionsleed vulnerability which I discovered during this work and for a couple of other vulnerabilities I found interesting and easily testable.
Some may ask why I wrote my own tool instead of extending an existing project. I thought about it, but I didn't really find any existing free software vulnerability scanner that I found suitable. The tool that comes closest is probably Nikto, but testing it I felt it comes with a lot of checks - thus it's slow - and few results. I wanted a tool with a relatively high impact that doesn't take forever to run. Another commonly mentioned free vulnerability scanner is OpenVAS - a fork from Nessus back when that was free software - but I found that always very annoying to use and overengineered. It's not a tool you can "just run". So I ended up creating my own tool.
A Dragon Legend in US Maryland
Finally you may wonder what the name means. The Snallygaster is a dragon that according to some legends was seen in Maryland and other parts of the US. Why that name? There's no particular reason, I just searched for a suitable name, I thought a mythical creature may make a good name. So I searched Wikipedia for potential names and checked for name collisions. This one had none and also sounded funny and interesting enough.
I hope snallygaster turns out to be useful for administrators and pentesters and helps exposing this class of trivial, but often powerful, vulnerabilities. Obviously I welcome new ideas of further tests that could be added to snallygaster.