Sleeping Sheep Hackers...

The “Social Engineering Vulnerability Evaluation and Recommendation (SEVER)” methodology, located at http://www.kgb.to/SEVER_Instructions_Final.pdf , was recently highlighted to me, and also appeared in the darknet.org.uk blog in December 2011, although the document appears to date from April 2011.
The SEVER project hopes to

Provide the fastest means of training novices about complex social engineering concepts.
Provide penetration testers with a methodology that minimizes their effort while increasing their chance of success.

The truth is far from this, and the detail is unnecessary - I started writing references and in the end realised I was referencing at least every page, if not every paragraph.

In summary, the document is an “eighties text file” style rant about the author’s personal irritants; it doesn’t really detail a methodology at all, and concentrates on how to attack a single person rather than an organisation or other goal. For example as part of a Social Engineering engagement the author appears to advocate the exploitation of phobias, use of lighting to induce migraines in the target, gaining rapport with the target through mutual use of illegal drugs, and torture. I strongly suggest reading for entertainment purposes only.

In stating the above I’m presuming that Penetration Testers all obey the law, their job being to simulate the effect of criminal acts rather than commit them; also their intention is to show the customer that they are can be trusted with the information and access they’ve been granted. Also that as part of the engagement a Penetration Tester is not permitted nor willing to cause permanent physical and/or psychological damage to their client’s employees. The legal liability incurred by trying out many of the techniques listed would be “interesting.”

Humor: Yes, we did it!

matti — Mon, 30 Jan 2012 19:24:25 +0000

Yes folks,

We did it!!!
We are now an official hacking site.
You do not believe us? … Well, see for yourself

Yea baby

Cheers,
Matti

Hacking: Tools

matti — Sat, 28 Jan 2012 17:07:05 +0000

I am sometimes quite surprised of how many web security tools start with a single guy coding something up.

Here is such an example of a really cool tool written by guy from London Royal Holloway University, Anastasios Laskos:

http://arachni.segfault.gr

Really impressed by the high rate and accuracy of issues it discovers…

So thanks for that tool

Cheers,
Matti

Hacking: Traces on the Internet

matti — Sat, 28 Jan 2012 11:27:56 +0000

I was having a look at certain sites and tools that are good for finding things out about other people on the Internet.

Not for stalking but for Social Engineering.

Here are some of which I thought where quite useful….

Social Network Search Sites:

http://www.keotag.com/

http://www.howsociable.com/

http://monitter.com/

http://www.samepoint.com/

http://topsy.com/

http://attentio.com/products

http://tweetpsych.com/

http://tweetscan.com/

http://twitrratr.com/

http://www.neoformix.com/Projects/TwitterStreamGraphs/view.php

http://twendz.waggeneredstrom.com/

http://twittermap.appspot.com/

http://spy.appspot.com/

http://socialmention.com/

http://whostalkin.com/

Those might be good as well:

http://twittercounter.com/ (needs twitter account)
http://www.ubervu.com/ (demo must be requested)
http://www.alterian.com/socialmedia/products/sm2/ (demo must be requested)

People Search Sites:

http://namechk.com/

http://www.peekyou.com/

http://com.lullar.com/

http://www.google.de

People Search Tools

http://www.paterva.com/web5/

http://ilektrojohn.github.com/creepy/

http://code.google.com/p/fbpwn/

Exploiting

http://www.social-engineer.org/framework/Computer_Based_Social_Engineering_Tools:_Social_Engineer_Toolkit_%28SET%29

http://www.sptoolkit.com/documentation/001-the-spt-framework/

Cheers,

Matti

Security Principles and Maxims

tugrik — Fri, 22 Apr 2011 07:44:53 +0000

There’s an excellent post on Security Principles and Maxims over at http://blog.blackswansecurity.com/2011/04/security-principles-maxims/

When discussing the ubiquitous and nebulous “Best Practice”, it’s handy to have an actual list of what that is - and this is a great start.

Link: Fun with Audits

matti — Wed, 18 Aug 2010 20:54:23 +0000

http://download.101com.com/pub/itci/Files/ITCi_ITACL-InfoSec_0612_finalweb.pdf

http://www.revision-online.info/index.php/Hauptseite

http://www.sans.org/score/checklists/ISO_17799_checklist.pdf

http://www.auditnet.org/docs/ITAuditCL.pdf

and http://www.t2pa.com/

Hacking: Passwords again

matti — Tue, 17 Aug 2010 20:17:48 +0000

A lot of the testing nowadays goes back to do some account hacking.
The hope of a password being in a dictionary is long gone.
Too many security policies hindering people to chose weak passwords.

But users still have to be able to remember passwords.
So we do mutations and other things:

http://www.randomstorm.com/rsmangler-security-tool.php

http://www.remote-exploit.org/Wyd/

http://awlg.org/index.gen

So if you want to check your own password:

http://www.passwordmeter.com/