Perimeter
7/30/2010
07:08 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Real-World Attacks With Social Engineering Tookit

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.

Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.According to Dave Kennedy (aka Rel1k), he created the Social Engineering Tookit (SET) for a couple of reasons: hackers are doing these same attacks, we need to promote user awareness, and security controls to prevent these attacks need to be tested. Essentially, it gives penetration testers a streamlined way to perform social engineering attacks using exploits available in the Metasploit Framework. Since penetration testers are hired to gain access into a network as a malicious hacker would, they should be using the same techniques to verify existing vulnerabilities such as poor user awareness and unpatched client applications.

Codenamed "Arnold Palmer," the new 0.6 release of SET includes a slew of new features and bug fixes. It provides three major attack vectors, including spear-phishing, Web attacks through site-cloning, and malicious USB/DVD/CDs, along with the brand new Arduino-based Teensy USB HID device.

The existing attack vectors are very good, but I'm most excited about the Teensy attack vector since I've been dabbling in hardware hacking more lately. The Teensy can act as a keyboard and mouse allowing an attacker to inject keystrokes into a system and deploy an attack payload (such as the Metasploit Framework's meterpreter) via PowerShell or WSCRIPT. The attack bypasses any autorun protections that may be implemented since it simulates a keyboard and not a USB storage device.

In addition to the Teensy-based attack, SET 0.6 includes TabNabbing, the option to use the Python HTTP server or Apache Web server, the Man-Left-in-the-Middle attack, over 45 bug fixes, Ettercap DNS poison attacks, and the latest Adobe, LNK, and Internet Explorer exploits. The Java Applet attack, available previously, has also been released as open source as of version 0.6, and it's been improved to evade antivirus through heavy obfuscation of the Java and payload.

SET is truly an incredible tool and Dave has done an amazing job at developing something that can really help penetration testers be more effective at testing areas -- namely humans -- that are often overlooked. As he stated during his presentation, "if you aren't doing social engineering as part of your regular penetration tests, you are seriously missing out." For more information about social engineering, check out the social-engineer.org site and listen to their excellent podcast.

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.