MySQL Security Assesment Script in BT4

So this is a short write up on using the MySQL security Assessment Script
by Carlos Perez

Of course you will need a mysql database to target.
If you want a pre-made setup then get the metasploitable package.

Grab some shell and navigate to the /pentest/database/mysqlaudit/ directory.
Then just run the command with no options.

-----------------------------CODE---------------------------------------

root@bt:/pentest/database/mysqlaudit#./mysqlaudit.py

MySQL Security Assesment Script Version 1.0

By: Carlos Perez, carlos_perez[at]darkoperator.com
USAGE:
python ./mysqlaudit.py Targer IP User Password Report


Target : The system you whant to do the assement on, port 3306 should be open.
User : User account with DBA privelages on the server to use for the assesment.
Password : password for the user account.
Report : Name of text file to wich to write the report.

-----------------------------CODE--------------------------------------

Simple enough the only thing you will need of course is the log-on credentials.
This time we will run the scan against our metasploitable setup and see what happens.

-----------------------------CODE--------------------------------------

root@bt:/pentest/database/mysqlaudit# ./mysqlaudit.py 192.168.2.103 root root /tmp/msqlauditreport.txt
root@bt:/pentest/database/mysqlaudit#

-----------------------------CODE--------------------------------------

So in order to see what our report shows we can either open it with a text editor or we can cat the output back to the screen.
Since the report is quite long I will only show a little of it here.
-----------------------------CODE--------------------------------------

root@bt:/pentest/database/mysqlaudit# cat /tmp/msqlauditreport2.txt | less

Severity: High

Description:

MySQL authentication is based on usernames and passwords stored in a table

called mysql.user. To create a user, a row is added to this table. MySQL
also supports wildcards and blank values in the USERNAME and HOST fields of
the table. By indicating a blank username and a blank password, you allow
anonymous access to the MySQL database.
Solution:

To remove the anonymous user, run the following commands:
shell> mysql -u root [password]
mysql> DELETE FROM mysql.user WHERE User = '';

Anonymous user was found

User Connection Location
anonymous ---->localhost
anonymous ---->ubuntu804-base

-----------------------------CODE-------------------------------------

As you can tell there is a high level flaw in our setup.
So this tool will allow the Penetration tester to target mysql databases and will determine some basics when it comes to the security of the system.

Have fun.

Using NeXpose in Back Track 4

So here is Using NeXpose in Back Track 4. In this video, I will setup a simple scan of a Windows server. After the scan I briefly show the results that are produced.
If you haven't seen the install video, then it is here on the blog so take a look at it too.
I hope you enjoy it.

The Links.
Blip.tv
Vimeo
Youtube


And of course embedded here:

Installing NeXpose in Back Track 4

Small video on installing NeXpose from Rapid7 into Back Track 4.
I thought about making a text with picture tutorial but after taking the needed screen shots, I thought it would be just as easy to record the screen.

Blip.tv Link
Vimeo Link
Youtube Link

Of course you can also watch it here.

Up and Running with OpenVAS in Back Track 4 part 2

As promised here is part two of Up and Running with OpenVAS in Back Track 4. This time we will update the NVT (network vulnerability tests) database.
Then we will setup a scan against a generic vanilla install of windows server 2008.
I hope you enjoy and find it useful.
The video can be found on blip.tv here
You can also get it at Vimeo here.
You can also find it at the Remote-Exploits (Back Track) Forums here.

Up and running with OpenVAS in BT4

Just as the title says this is a small video on getting OpenVAS setup and running.
A brief walk through on adding a user to the system, creating a certificate for the user, starting the server and client, setting up a task with scope and running the task, within Back | Track 4.
The video is available here on blip.tv
And here on vimeo
Enjoy!
You can also watch it below.

Up and Running with OpenVAS in Back Track 4 from archangel.amael on Vimeo.

In the next video I will walk through updating the OpenVas Server and running a task in the dork-lab network.