Tuxtendo Rootkit [ Not found ]
URK Rootkit [ Not found ]
Vampire Rootkit [ Not found ]
VcKit Rootkit [ Not found ]
Volc Rootkit [ Found ]
Xzibit Rootkit [ Not found ]
X-Org SunOS Rootkit [ Not found ]
zaRwT.KiT Rootkit [ Not found ]
ZK Rootkit [ Not found ]
Performing additional rootkit checks
Suckit Rookit additional checks [ OK ]
Checking for possible rootkit files and directories [ None found ]
Checking for possible rootkit strings [ None found ]
Gareth Rushgrove
>> nosetests -v rkhunter-librato-test.py
rkhunter-libratoo-test.test_beastkit_not_installed ... ok
---------------------------------------------------------
Ran 1 test in 1.585s
OK
Gareth Rushgrove
Starting Nmap 5.21 ( http://nmap.org ) at
2013-09-18 15:09 BST
Nmap scan report for monitorama.eu
(141.101.116.49)
Host is up (0.17s latency).
Hostname monitorama.eu resolves to 2 IPs. Only
scanned 141.101.116.49
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in
24.18 seconds
Gareth Rushgrove
Slide 74
Slide 74 text
Gareth Rushgrove
Slide 75
Slide 75 text
it "should have one port open" do
@host.open_ports.should have(1).items
end
Gareth Rushgrove
Slide 76
Slide 76 text
Gareth Rushgrove
Slide 77
Slide 77 text
1) the monitorama.eu website should have one port open
Failure/Error: @host.open_ports.should have(1).items
expected 1 items, got 2
Finished in 8.99 seconds
1 example, 1 failure
Gareth Rushgrove
+
+[+] 2 issues were detected.
+
+[+] [1] Trusted -- Cross-Site Scripting (XSS)
+[~] ~~~~~~~~~~~~~~~~~~~~
+[~] ID Hash:
+[~] Severity: High
+[~] URL: http://victim/pictures/search.php
+[~] Element: form
+[~] Method: GET
+[~] Tags: xss, regexp, injection, script
+[~] Variable: query
+[~] Description:
+[~] Client-side code (like JavaScript) can be injected
+ into the web application which is then returned to
+ the user's browser. This can lead to a compromise
+ of the client's system or serve as a pivoting
+ point for other attacks.
+
Gareth Rushgrove