[Boomslang]

*stretching*
Ahh, I missed the community, also writing tutorials :Grin:
Today I'll show you a simple yet effective way to fool skids who's scanning your website. Sounds good right? :troll:

Okay, we know that there are plenty of tools used for assistance in Vulnerability Assesment process (which are oftenly used by skiddies). So what we'll do is simply making these tools completely useless. :Grin:
What will these tools try first is to crawl pages of your website (you can't scan for vulnerabilities if you don't know where to, do you?). So first, we need to understand that how this process actually works.

Page Crawling
Page crawling is basically a recursive process starts with visiting a page, then extract links in the source code (they gather it from <a href="/page.php"></a> and such tags), check if they're valid, visit new pages and do the same thing over and over again until there is no pages left.
So what we'll do is generating spoof links and configurate apache server to redirect those spoofed links to a custom page which will also generate new spoofed links everytime its visited. So crawler will be caught in an endless loop.
Lets start!

We have to get our hands a little dirty and write some PHP.
First, we need a random string generator function to create random spoof links. You can find plenty of them on internet, I'll just use this one.

PHP Code:

function RandomString($length) { $characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; $randstring = ''; for ($i = 0; $i < $length; $i++) { $randstring .= $characters[mt_rand(0, strlen($characters))]; } return $randstring; }

Now we need to embed some spoof links in the source code. Even its random, it has to be in a specific format so we can seperate them from other links.
I'm going to use this one, you can use something else;

Code:

/mypage_*.php (for pages) /mydir_*/ (for directories)

After we decided which format we'll use, lets embed some links via HTML tags.

Code:

<!-- Hello visitor, please do not visit the links below --> <a href="/mydir_<?php echo RandomString(15);?>/mypage_<?php echo RandomString(15);?>.php?<?php echo RandomString(3);?>=<?php echo RandomString(3);?>"></a> <a href="/mydir_<?php echo RandomString(15);?>/"></a>

We didn't write anything between <a> tags so because we don't want our visitors to click it. I also added a comment in case a visitor views the source code and encounter those links.

Now since we embed the spoofed links, we need to make it look valid. We'll use a feature of Apache called mod_rewrite to do so. More info about mod_rewrite: http://httpd.apache.org/docs/current/mod...write.html
If you messed with conditional rules before, you'll know that it uses Regular Expressions and it can be a pain in the ass sometimes.
But today is your lucky day, I've found the right expression sentence after countless trials :Grin:

Code:

RewriteEngine on # Anti Scanner Module RewriteCond %{REQUEST_FILENAME} mypage_(.*)\.php$ [OR] RewriteCond %{REQUEST_FILENAME} mydir_(.*)$ RewriteRule ^(.*)$ /antiscanner.php

antiscanner.php is our custom page which will be viewed when spoof links are visited. So lets fill that page with some content, it'd be meaningless if we leave it empty.
Paste the same code I gave before to embed more spoof links here.
Also try it with new tags, use some imaginations! Lol.

But I'm not satisfied. We need more content. Umm lets see... What was scanners looking for? Oh yes, vulnerabilities!
Lets throw some nasty errors over there :troll:

I wrote a function to display random errors from a list full of nasty errors.

PHP Code:

function ThrowError() { $errors = array("<br>Warning: include(4.php) [function.include]: failed to open stream: No such file or directory in PATH on line 3<br />", "<br \>Microsoft SQL Native Client error '80040e14' Unclosed quotation mark after the character string <br \>", "<br \>Query failed: ERROR: syntax error at or near \"'\" at character 56 in home/www/regs/home.php on line 121.<br \>", "<br \>SQLSTATE: 42000 (ER_SYNTAX_ERROR) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use<br \>", "<br \>ORACLE-00933: SQL command not properly ended<br \>", "function antiscanner($antiscanner)<br \>{<br \> return \$antiscanner;<br \>}<br \>", "<br>\"/usr/local/bin\"<br \>", "<br>\"c:/www/regs/home\"<br \>", "define( 'DB_NAME', 'database' );<br \>define( 'DB_USER', 'www.localhost.com' );<br \>define( 'DB_PASSWORD', 'antiscanner' );<br \>define( 'DB_HOST', 'localhost' );<br \>define( 'DB_CHARSET', 'utf8' );<br \>", "<br> root:!:0:0::/:/usr/bin/ksh daemon:!:1:1::/etc:bin:!:2:2::/bin:sys:!:3:3::/usr/sys: adm:!:4:4::/var/adm:uucp:!:5:5::/usr/lib/uucp: guest:!:100:100::/home/guest:<br />", "<br>SomeCustomInjectedHeader:injected_by_wvs <br />"); return $errors[mt_rand(0, sizeof($errors)-1)]; }

Lets also put a form there where they can try some injection on :troll:

PHP Code:

<form action="/mydir_<?php echo RandomString(15);?>/mypage_<?php echo RandomString(15);?>.php?<?php echo RandomString(3);?>=<?php echo RandomString(3);?>" method="post"> <p><?php echo RandomString(15);?>: <input type="text" name="<?php echo RandomString(10); ?>" /></p> <p><?php echo RandomString(15);?>: <input type="text" name="<?php echo RandomString(10); ?>" /></p> <p><input type="submit" /></p> </form>

Well, use your imagination for the rest. That's all what I got! :Grin:

Lets look at the results.

Results

Acunetix


HOLY MOTHER OF JESUS CHRIST! 116 SQL Injections and many other errors on a two page website? WTF?!?!

Intellitamper


You're drunk Intellitamper, just go home. Lol.

I hope you liked this tutorial :Grin:

Au Revoir..

[Boomslang]

@bluedog.tar.gz It doesn't seem like word-wrapping is enabled for Php tags :Confused:

[dropzon3]

A similar trick is used to cause problems for email harvesting; create a page that randomly generates emails and a link to another page which acts like yours does. Infinte loop of emails.

If you're interested in this stuff check out: Defense by numbers: Making problems for script kiddies and scanner monkeys - https://www.youtube.com/watch?v=I3pNLB3Cq24

It talks about creating false positives and generally causing problems for web exploit scanners; it was an interesting watch.

[h3r0]

This was pretty cool, I'm going to have to figure out a method to check for something like this (For my regex crawler). Is there a way to check if an apache rewrite ran, I'm assuming no?

[Boomslang]

This was pretty cool, I'm going to have to figure out a method to check for something like this (For my regex crawler). Is there a way to check if an apache rewrite ran, I'm assuming no?

I don't think so. But let me know if you find something :Smile:

[h3r0]

I'm thinking what if one were to strip out all links on the page, hash everything else, and then keep a list of hashes. When loading up a page if the page matches a hash ignore the urls from it.

[Lynux]

Hey thanks for this tutorial I may try to implement that into a project I am working on at the moment

[Boomslang]

Hey thanks for this tutorial I may try to implement that into a project I am working on at the moment

You could even add a function to antiscanner.php for logging visitors IP and User-Agent information.

[Lynux]

Hey thanks for this tutorial I may try to implement that into a project I am working on at the moment

You could even add a function to antiscanner.php for logging visitors IP and User-Agent information.

Hmm this could be quite useful especially for a botnet's panel at least that way you'd be able to start blocking the IP's etc and stop people from trying to break in

[TheEvilSocks]

Pretty cool! I'm not gonna use it, but still, it's awesome