Autopilot Websites & Manual Websites

Hackers associated with the hacktivist collective Anonymous say they have leaked gigabytes of data from Epik, a web host and domain registrar that provides services to far-right sites like Gab, Parler and 8chan, which found refuge in Epik after they were booted from mainstream platforms.

In a statement attached to a torrent file of the dumped data this week, the group said the 180 gigabytes amounts to a “decade’s worth” of company data, including “all that’s needed to trace actual ownership and management” of the company. The group claimed to have customer payment histories, domain purchases and transfers, and passwords, credentials and employee mailboxes. The cache of stolen data also contains files from the company’s internal web servers, and databases that contain customer records for domains that are registered with Epik.

The hackers did not say how they obtained the breached data or when the hack took place, but timestamps on the most recent files suggest the hack likely happened in late February.

Epik initially told reporters it was unaware of a breach, but an email sent out by founder and chief executive Robert Monster on Wednesday alerted users to an “alleged security incident.”

TechCrunch has since learned that Epik was warned of a critical security flaw weeks before its breach.

Security researcher Corben Leo contacted Epik’s chief executive Monster over LinkedIn in January about a security vulnerability on the web host’s website. Leo asked if the company had a bug bounty or a way to report the vulnerability. LinkedIn showed Monster had read the message but did not respond.

Leo told TechCrunch that a library used on Epik’s WHOIS page for generating PDF reports of public domain records had a decade-old vulnerability that allowed anyone to remotely run code directly on the internal server without any authentication, such as a company password.

“You could just paste this [line of code] in there and execute any command on their servers,” Leo told TechCrunch.

Leo ran a proof-of-concept command from the public-facing WHOIS page to ask the server to display its username, which confirmed that code could run on Epik’s internal server, but he did not test to see what access the server had, as doing so would be illegal.

It’s not known if the Anonymous hacktivists used the same vulnerability that Leo discovered. (Part of the stolen cache also includes folders relating to Epik’s WHOIS system, but the hacktivists left no contact information and could not be reached for comment.) But Leo contends that if a hacker exploited the same vulnerability and the server had access to other servers, databases or systems on the network, that access could have allowed access to the kind of data stolen from Epik’s internal network in February.

“I am really guessing that’s how they got owned,” Leo told TechCrunch, who confirmed that the flaw has since been fixed.

Monster confirmed he received Leo’s message on LinkedIn, but did not answer our questions about the breach or say when the vulnerability was patched. “We get bounty hunters pitching their services. I probably just thought it was one of those,” said Monster. “I am not sure if I actioned it. Do you answer all your LinkedIn spams?”

Many home routers, IP webcams, and web applications still rely on HTTP authentication these days, and we, as system administrators or penetration testers, need to make sure that the system or user accounts are not using weak credentials. Now, thanks to the NSE script http-brute, we can perform robust dictionary attacks against HTTP basic, digest, and NTLM authentication.

This article is an excerpt taken from the book Nmap: Network Exploration and Security Auditing Cookbook – Second Edition, written by Paulino Calderon. This book includes the basic usage of Nmap and related tools like Ncat, Ncrack, Ndiff, and Zenmap and much more.

In this article, we will learn how to perform brute force password auditing against web servers that are using HTTP authentication and also against popular and custom web applications with Nmap.

Brute forcing HTTP applications

How to do it…

Use the following Nmap command to perform brute force password auditing against a resource protected by HTTP’s basic authentication:

$ nmap -p80 --script http-brute <target>

The results will return all the valid accounts that were found (if any):

   PORT   STATE SERVICE REASON
   80/tcp open  http   syn-ack
   | http-brute:  
   |   Accounts
   |     admin:secret => Valid credentials
   |   Statistics
   |_    Perfomed 603 guesses in 7 seconds, average tps: 86

How it works…

The Nmap options -p80 --script http-brute tells Nmap to launch the http-brute script against the web server running on port 80. This script was originally committed by Patrik Karlsson, and it was created to launch dictionary attacks against URIs protected by HTTP authentication.

The http-brute script uses, by default, the database files usernames.lst and passwords.lst located at /nselib/data/ to try each password, for every user, to hopefully find a valid account.

There’s more…

The script http-brute depends on the NSE libraries unpwdb and brute. Read the Appendix B, Brute Force Password Auditing Options, for more information.

To use different username and password lists, set the arguments userdb and passdb:

$ nmap -p80 --script http-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt <target>

To quit after finding one valid account, use the argument brute.firstOnly:

$ nmap -p80 --script http-brute --script-args brute.firstOnly <target>

By default, http-brute uses Nmap’s timing template to set the following timeout limits:

• -T3,T2,T1: 10 minutes
• -T4: 5 minutes
• -T5: 3 minutes

For setting a different timeout limit, use the argument unpwd.timelimit. To run it indefinitely, set it to 0:

$ nmap -p80 --script http-brute --script-argsunpwdb.timelimit=0 <target>
$ nmap -p80 --script http-brute --script-args unpwdb.timelimit=60m <target>

Brute modes

The brute library supports different modes that alter the combinations used in the attack. The available modes are:

• user: In this mode, for each user listed in userdb, every password in passdb will be tried:

$ nmap --script http-brute --script-args brute.mode=user <target>

• pass: In this mode, for each password listed in passdb, every user in userdb will be tried:

$ nmap --script http-brute --script-args brute.mode=pass <target>

• creds: This mode requires the additional argument brute.credfile:

$ nmap --script http-brute --script-args brute.mode=creds,brute.credfile=./creds.txt <target>

Brute forcing web applications

Performing brute force password auditing against web applications is an essential step to evaluate the password strength of system accounts. There are powerful tools such as THC Hydra, but Nmap offers great flexibility as it is fully configurable and contains a database of popular web applications, such as WordPress, Joomla!, Django, Drupal, MediaWiki, and WebSphere.

How to do it…

Use the following Nmap command to perform brute force password auditing against web applications using forms:

$ nmap --script http-form-brute -p 80 <target>

If credentials are found, they will be shown in the results:

   PORT  STATE SERVICE REASON 
   80/tcp open  http  syn-ack 
   | http-form-brute: 
   |   Accounts 
   |     user:secret - Valid credentials 
   |   Statistics 
   |_    Perfomed 60023 guesses in 467 seconds, average tps: 138

How it works…

The Nmap options -p80 --script http-form-brute tells Nmap to launch the http-form-brute script against the web server running on port 80. This script was originally committed by Patrik Karlsson, and it was created to launch dictionary attacks against authentication systems based on web forms. The script automatically attempts to detect the form fields required to authenticate, and it uses internally a database of popular web applications to help during the form detection phase.

There’s more…

The script http-form-brute depends on the correct detection of the form fields. Often you will be required to manually set via script arguments the name of the fields holding the username and password variables. If the script argument http-form-brute.passvar is set, form detection will not be performed:

$ nmap -p80 --script http-form-brute --script-args http-form-brute.passvar=contrasenia,http-form-brute.uservar=usuario <target>

In a similar way, often you will need to set the script arguments http-form-brute.onsuccess or http-form-brute.onfailure to set the success/error messages returned when attempting to authenticate:

$nmap -p80 --script http-form-brute --script-args http-form-brute.onsuccess=Exito <target>

Brute forcing WordPress installations

If you are targeting a popular application, remember to check whether there are any NSE scripts specialized on attacking them. For example, WordPress installations can be audited with the script http-wordpress-brute:

$ nmap -p80 --script http-wordpress-brute <target>

To set the number of threads, use the script argument http-wordpress-brute.threads:

$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.threads=5 <target>

If the server has virtual hosting, set the host field using the argument http-wordpress-brute.hostname:

$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.hostname="ahostname.wordpress.com" <target>

To set a different login URI, use the argument http-wordpress-brute.uri:

$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uri="/hidden-wp-login.php" <target>

To change the name of the POST variable that stores the usernames and passwords, set the arguments http-wordpress-brute.uservar and http-wordpress-brute.passvar:

$ nmap -p80 --script http-wordpress-brute --script-args http-wordpress-brute.uservar=usuario,http-wordpress-brute.passvar=pasguord <target>

Brute forcing WordPress installations

Another good example of a specialized NSE brute force script is http-joomla-brute. This script is designed to perform brute force password auditing against Joomla! installations. By default, our generic brute force script for HTTP will fail against Joomla! CMS since the application generates dynamically a security token, but this NSE script will automatically fetch it and include it in the login requests. Use the following Nmap command to launch the script:

$ nmap -p80 --script http-joomla-brute <target>

To set the number of threads, use the script argument http-joomla-brute.threads:

$ nmap -p80 --script http-joomla-brute --script-args http-joomla-brute.threads=5 <target>

To change the name of the POST variable that stores the login information, set the arguments http-joomla-brute.uservar and http-joomla-brute.passvar:

$ nmap -p80 --script http-joomla-brute --script-args http-joomla-brute.uservar=usuario,http-joomla-brute.passvar=pasguord <target>

To summarize, we learned how to brute force password auditing against web servers custom web applications with Nmap. If you’ve enjoyed reading this post, do check out our book, Nmap: Network Exploration and Security Auditing Cookbook – Second Edition to know more to learn about Lua programming and NSE script development which will allow you to further extend the power of Nmap.

Read Next

Discovering network hosts with ‘TCP SYN’ and ‘TCP ACK’ ping scans in Nmap [Tutorial]

Introduction to the Nmap Scripting Engine

Exploring the Nmap Scripting Engine API and Libraries

A very unfortunate event took place recently in Mexico where two gangs fired shots at each other and killed a few people at a restaurant, including Anjali Ryot, an Indian-origin techie/travel blogger.

Who Was Anjali Ryot?

Anjali Ryot, a California-based techie and a travel blogger, hailed from Himachal Pradesh, India. She worked with LinkedIn on the post of senior reliability engineer and was actively associated with the company since July. Before that, she worked as a senior reliability and service engineer at Yahoo for 5 years.

The engineer had a passion for traveling which also turned her into a travel vlogger. Currently, her Instagram handle has a massive fan following of 42.5k followers. Her passion for traveling took her to the most beautiful places of the world like Italy, Puerto Rico, the Philippines, Hawaii, and California (her current place of residence). Her Instagram handle reads “never stop dreaming”.

Name: Anjali Ryot 

Age: 29 years

Place of Birth: Himachal Pradesh 

Current City: California 

Profession: Reliability Engineer at LinkedIn 

Social Media: @thestylelagoon, both on Instagram and Twitter. 

Religion: Hindu 

Nationality: Indian

According to the sources, Anjali traveled to Mexico on the 18th October 2021 to celebrate her 30th event and was shot dead at a restaurant in a firing that happened between the two groups. This sudden demise of the female has left everyone in utter remorse.

What Happened At the Restaurant?

The incident took place at 10:30 pm on the 18th October, at the terrace of the LA Malquerida Restaurant, Tulum, Mexico. If the reports are to be believed, Anjali and four other foreign tourists were dining on the terrace of the restaurant, when four men armed with assault rifles started firing at the adjoining table.

The bullets so fired hit the foreigners. Anjali, along with a German woman, was killed on the spot, while three other people from Netherlands and Germany, were left wounded. They are currently being treated at the hospice for their injuries. The other deceased woman has been identified as Jennifer Henzold.

Soon after the incident occurred, authorities pointed to a confrontation between the culprits, recognized as two rival groups that operate drug sales in the area. Mexico, as it is, is touted as the hub of drug trading and trafficking.

As soon as the news reached the family members of the deceased, they broke into tears and still cannot come to terms with the fact with the sudden demise of their beloved daughter.

More About Mexico Drug Cartel

The brutal drug war of Mexico claims over thousands of lives every year. The power trafficking groups battle out with each other to claim their vicinity and influence in the drug market. These cartels actively control many areas of the country. According to the news, they also have an upper hand in the country’s internal politics and are responsible for political corruption to a great extent. The drug cartels also associate themselves with several kidnappings, assassinations, and other crimes, causing a lot of fear among the locals.

The U.S. Government suggests that Sinaloa Cartel, hailing from Mexico, is one of the largest organizations of drug trafficking throughout the world.

Stay connected for more such trending news and updates all around the world.

Governor Kathy Hochul received a Covid-19 vaccination booster dose after she cut a ribbon at Binghamton University’s Decker College of Nursing and Health Sciences.

Hochul visited the recently-renovated Endicott Johnson factory building on Corliss Avenue in Johnson City on Monday.

Binghamton University President Harvey Stenger noted $133 million is being spent in the village to develop the school’s 15-acre Health Sciences Campus.

Hochul praised those who worked to bring the long-dormant structure back to life.

The governor then received a Moderna booster shot as university and local officials looked on. Last March, Hochul received a Johnson & Johnson vaccination.

Responding to a reporter’s question, Hochul indicated there are no plans to reopen mass vaccination sites at this time.

The governor said the “situation is different” now compared to several months ago when vaccines first became available.

With the anticipated federal approval of vaccinations for children as young as five years old, Hochul said there currently is an “ample supply.” But if long lines or shortages develop, she said the state could reopen mass vaccination sites “very quickly.”

Contact WNBF News reporter Bob Joseph: [email protected].

For breaking news and updates on developing stories, follow @BinghamtonNow on Twitter.

Sandbox Percussion – Victor Caccese (BM ’11, Percussion), Terry Sweeney (BM ’13, Percussion), Ian Rosenbaum (BM ’08, Percussion), and Jonathan Allen – premiered the Seven Pillars film anthology, 11 films that were commissioned to accompany their latest album of Andy Akiho’s music, on their YouTube channel on Thursday, October 21 at 8:00 pm EDT.

MEXICO CITY (AP) — An Indian American woman from San Jose, California, was one of two foreign tourists killed in the apparent crossfire of a drug-gang shootout in Mexico’s Caribbean coast resort of Tulum.

Authorities in Quintana Roo, the state where Tulum, Playa del Carmen and Cancun are located, Oct. 22 said one of the dead women was Anjali Ryot.

An Instagram account under the same name showed a post of Ryot lounging and smiling on a seaside pier in Tulum two days earlier. It listed her as a travel blogger from Himachal, India, living in California. A linked Facebook page said she lived in San Jose.

A German woman who was killed has been identified as Jennifer Henzold, though no hometown was immediately available for her.

Three other foreign tourists were wounded in the shooting late Oct. 20 at a street-side eatery that has some outdoor tables, right off Tulum’s main strip. They included two German men and a Dutch woman.

The German Foreign Office issued a travel advisory about the violence, advising its citizens “if you are currently in the Tulum or Playa del Carmen area, do not leave your secured hotel facilities.”

The gunfight apparently broke out between two groups that operate street-level drug sales in the area, according to prosecutors. The tourists were apparently dining at the restaurant and may have been caught in the crossfire.

The shooting occurred on Tulum’s ‘Mini-Quinta,’ a reference to Playa del Carmen’s larger, flashier bar and restaurant zone known as Quinta Avenida, or Fifth Avenue.

On Oct. 22, the civic group Citizens Observatorio of Tulum posted photos of hand-lettered signs that appeared at a local market in Tulum, signed by a drug gang known as Los Pelones, roughly “the Shaved Heads.”

The sign said the shooting “was a warning, so you can see we mean business,” adding “you either get in line or we are going to continue shutting places down like the Mini Quinta,” an apparent warning to pay extortion demands for protection money.

“We are in control here,” the sign added. The gang, part of the Gulf Cartel, has long extorted protection money from bars and night clubs in Cancun, but has now apparently extended operations further south to Playa del Carmen and Tulum. The gang is also fighting the Jalisco Cartel and other groups for the area’s lucrative drug market.

The killings threatened Tulum’s reputation as a low-key carefree beach town without the crowding and problems of Cancun.

After the shooting, U.S. tourist James Graham said he had come to Tulum with the idea of possibly buying a property there to rent out on AirBnB. “Right now, we are not so sure we’re going to buy anything here,” Graham said.

There have been signs the situation was out of control months ago. In June, two men were shot to death on the beach in Tulum and a third was wounded.

And in nearby Playa del Carmen, police stage a massive raid Oct. 21 on the beach town’s restaurant-lined Quinta Avenida, detaining 26 suspects — most apparently for drug sales — after a city policewoman was shot to death and locked in the trunk of a car last week. Prosecutors said Oct. 22 they have arrested a suspect in that killing.

Crime “has gone up a little with extortion, with drug sales to foreigners and Mexicans,” the prosecutors office said in a statement about the raid.

The administration of President Andrés Manuel López Obrador has pinned its hopes on Tulum, where it has announced plans to build an international airport and a stop for the Maya train, which will run in a loop around the Yucatan peninsula.

India-West Staff Reporter adds: According to a PTI report, Ryot has been working as a senior site reliability engineer on LinkedIn since July, and was previously employed by Yahoo, a Californianewstimes.com report said. She was in Mexico with her husband Utkarsh Shrivastava to celebrate her birthday.

Ever get that feeling something is too good to be true? Well, usually that something is, in fact, too good to be true.

That’s exactly what Shimano has said about a website appearing to sell Shimano components at up to 65% off suggested retail price (RRP). The Shimano-clearance website focuses mainly on fishing equipment with pages for reels, rods, apparel, baits, storage, and tools, but also features a “bike components” tab with a drop-down menu offering “off-road bike pedals” and “road bike pedals.” Within these pages, the website lists an extensive list of Shimano pedals with genuine photos, accurate naming and descriptions, but the prices are just too good to be true.

The site, which we won’t link to, can be found at Shimano dash clearance dot store on an Internet portal near you.

Dura-Ace R9100 pedals for $99.98? Why not just price the pedals at $91.00 and pull both my legs. Fancy some XTR pedals legendary for their mud-clearing ability for just $92.99? Well, be warned, it’s only bank accounts getting cleared here.

In a statement on Shimano.com, dug up by our friends at Bicycle Retailer and Industry News, the Japanese cycling and fishing equipment giant warned customers a “fake website was found to be posing as Shimano”. Highlighting the website’s attention to detail and apparent authenticity the statement continued, “the website is using the Shimano logo, product images and other content without our authorization”.

Offering free shipping for orders of more than $40, and featuring a countdown timer to make this once-in-a-lifetime deal even more unmissable, the website has many of the hallmarks of a genuine website. Furthermore, the “about us” page has a heartwarming and welcoming photo of ten people smiling somewhat awkwardly at a camera positioned directly above them. But don’t be fooled.

The first warning sign something is amiss lies in the opening paragraph. “We leverage the latest tools and technologies to make it as easy as possible for our customers to shop for everything they need to make their businesses go.” How many businesses depend on Dura-Ace pedals to “make their businesses go”? There follows some BS about Shimano-clearance’s “culture built on transparency, collaboration, and innovation”, its “rapid growth”, and award-winning pedigree. That’s funny, given that presumably very few, had even heard of this great website with such stunning deals on Shimano components until the real Shimano released this statement. If anybody finds the real website they ripped this terrible corporate boilerplate from, let us know in the comments.

Back to the pedals page and more alarm bells are ringing. The prices are ridiculously cheap, even in a world with online retailers regularly offering 18, 25, or even 33% discount on current Shimano products, but more alarmingly this company “obsessed with our customers” has no place for the PD-M520, the world’s most reliable pedal. For a company claiming to be “a team of great people who win and lose together (we prefer winning!)”, this is clearly a loss.

If you need any more, the last clue is the empty social media links at the bottom left of the page. Click on any of the Instagram, Facebook, Pintrest, or YouTube links to jump directly to those sites own home page. Either this award-winning company has such rapid growth it has had no time to create social channels, or Shimano (the real reel manufacturer Shimano) is correct, and this is a fake website, scamming people of their money. I’d bet my last genuine, new, unopened Dura-Ace chain and a pair of used Ultegra pedals it’s the latter. 

With another attempt on the November 2 Linn County ballot to bring a casino to Cedar Rapids, whatever limited chance there was may be hindered yet again by news of four Iowa casinos being fined for “violations involving minors”.

This is why we can’t have nice things

Four casinos in the state are being charged a combined $130,000. Starting with Catfish Bend in Burlington, Radio Iowa says that according to an administrator with the Iowa Racing & Gaming Commission (you know, the entity that holds the fate of our potential casino in its collective hands), an underage patron entered this casino and was given free rein for 47 minutes. “He entered the casino floor unchallenged, was on the floor for 47 minutes. It was not discernable whether the individual had gambled — pulled a ticket out of the machine, and based on a preponderance of the evidence, we felt the individual did gamble“, said Brian Ohorilko. Catfish Bend is going to pay $30,000 for this violation, $10k more than the usual fine for such, because of their lack of surveillance and the age of the minor making it more challenging to determine the severity of the violation.

Next up: Horseshoe Casino in Council Bluffs

Two underage violations were found here, costing Horseshoe $60,000. A minor female who had entered with an adult was caught using slot machines undetected after 30 minutes. In the second violation a few months later, a 17-year-old entered the casino floor and gambled for five hours before action was taken.

Prairie Meadows major facing fines

An underage male got onto the floor, with two adults, and gambled unchallenged for 60 minutes before security noticed. Prairie Meadows, who had previously announced they’d be closing their race track permanently, will pay $20,000.

Finally, a casino in Northwood will also pay $20,000 after a minor was allowed on the floor to gamble for 60 minutes unchallenged.

Each violation took place within the last 365 days, and as a reminder, the Iowa Racing and Commission was involved in determining the penalties for the violations. In a week or so, they decide yet again if we should get our casino. With these recent infractions likely to leave a bad taste in the committee’s mouth this close to that vote, now we have a new obstacle. Casino backers in Linn County should hope that officials can at the very least ensure the security will be shored up to avoid these violations.

12 Stupid Iowa Laws Still on the Books