Nikto part I

Salah satu program untuk scanning server yg terkenal adalah nikto ( cirt.net ) , berikut penulis mencoba untuk memberikan contoh implementasinya untuk scan server web, btw maaf ya yang punya server ane cuman iseng dan tidak merusak sistem anda jika ada intruder lain di sistem anda sama sekali saya tidak terlibat didalamnya ^_^.

1. contoh scan paling dasar dari nikto

root@bt:/pentest/web/nikto# perl nikto.pl -h jehz.com.my
- Nikto v2.1.4 --------------------------------------------------------------------------- + Target IP: 204.45.108.42 + Target Hostname: jehz.com.my + Target Port: 80 + Start Time: 2011-08-02 21:19:39 --------------------------------------------------------------------------- + Server: Apache/2.2.19 (Unix) mod_ssl/2.2.19 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 + Root page / redirects to: http://jehz.com.my/cgi-sys/suspendedpage.cgi + mod_ssl/2.2.19 appears to be outdated (current is at least 2.8.31) (may depend on server version) + Number of sections in the version string differ from those in the database, the server reports: openssl/0.9.8e-fips-rhel5 while the database has: 1.0.0.100. This may cause false positives. + OpenSSL/0.9.8e-fips-rhel5 appears to be outdated (current is at least 1.0.0d). OpenSSL 0.9.8r is also current. + FrontPage/5.0.2.2635 appears to be outdated (current is at least 5.0.4.3) (may depend on server version) + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST + FrontPage - http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html + mod_ssl/2.2.19 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). CVE-2002-0082, OSVDB-756. + /cgi-sys/formmail.pl: Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found. + /cgi-sys/guestbook.cgi: May allow attackers to execute commands as the web daemon. + OSVDB-27071: /phpimageview.php?pic=javascript:alert(8754): PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html.
--- cut ---

dari contoh keterangan diatas terlihat bahwa target memiliki beberapa bug dan masih ada lagi dibawahnya.
2. Untuk scan target dengan port tertentu

root@bt:/pentest/web/nikto# perl nikto.pl -h 204.45.108.42 -p 443

- Nikto v2.1.4 --------------------------------------------------------------------------- + Target IP: 204.45.108.42 + Target Hostname: bliss.theservergroup.info + Target Port: 443 + Start Time: 2011-08-02 22:33:56 ---------------------------------------------------------------------------
+ Server: Apache/2.2.19 (Unix) mod_ssl/2.2.19 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635

3.Scan terhadap beberapa port tertentu ;

root@bt:/pentest/web/nikto# perl nikto.pl -h 204.45.108.42 -p 80,88,443,22,21

- Nikto v2.1.4 --------------------------------------------------------------------------- + No web server found on bliss.theservergroup.info:88 ---------------------------------------------------------------------------

heheh itu aja dulu untuk kombinasi dengan tools lain ntar aja.... lagian orang tadarusan ane malah liat-liat yg gak ane... ntar malah merusak puasa ane ^_^.

Read more »

Anti Scanning Port pada Mikrotik

Scaning port pada server adalah salah satu teknik untuk mencari celah keamanan yang bisa dimanfaatkan oleh penyerang/intruder.

Di mikrotik kita bisa melakukan block terhadap serangan jenis ini dan sekaligus mengeblok ip asal penyerang , berikut scriptnya :

#---- script ---

/ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list " disabled=no
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"
/ip firewall filter add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"
/ip firewall filter add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"
/ip firewall filter add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"

# block ip penyerang

/ip firewall filter add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no

#---------- end

Selamat mencoba ;)

Read more »

Blokir Worm dan Virus di Mikrotik

Langsung aja, jalankan perintah berikut atau buat aja scriptnya ( t-x46 style ^_^ ).

============================================================

/ip firewall filter
add chain=forward connection-state=established comment="allow established connections"
add chain=forward connection-state=related comment="allow related connections"
add chain=forward connection-state=invalid action=drop comment="drop invalid connections"
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop Blaster Worm"
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop Messenger Worm"
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster Worm"
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Conficker Worm"
add chain=virus protocol=tcp dst-port=593 action=drop comment="Drop Kido Worm"
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________"
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom"
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________"
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester"
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server"
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast"
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx"
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid"
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm"
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus"
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y"
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle"
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop Beagle.C-K"
add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop MyDoom"
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor OptixPro"
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm"
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm"
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser"
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B"
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop Dabber.A-B"
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop Dumaru.Y"
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop MyDoom.B"
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus"
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2"
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop SubSeven" add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, Agobot, Gaobot"
add chain=forward action=jump jump-target=virus comment="jump to the virus chain"


================================================================


good luck ;)

Read more »

Konfigurasi Mikrotik sebagai gateway Internet

Untuk menjadikan mikrotik sebagai gateway internet ikuti dan sesuaikan langkah-langkah berikut ;

========================================================
/interface set ether1 name=local
/interface set ether2 name=speedy1
/ip address add address add=192.168.1.1/24 interface=local
/ip address add address add=192.168.2.2/30 interface=speedy1
/ip dns set servers=203.134.193.74,202.134.0.155
/ip firewall nat add chain=srcnat out-interface=speedy1 action=masquerade

================================================================

oke untuk selanjutnya silahkan test koneksi internet anda dan pastikan IP di client sesuai dengan kelas di mikrotik (local)

good luck ;)

Read more »