[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] [Tool/API] desenmascara.me - Fingerprinting and assessing the web security awareness of website
From:       Emilio Casbas <ecasbasj () yahoo ! es>
Date:       2015-04-15 7:24:21
Message-ID: 414932309.3698790.1429082661344.JavaMail.yahoo () mail ! yahoo ! com
[Download RAW message or body]


desenmascara.me (in English can be translated as: Unmask me) is an online PoC tool whose goal \
is: to raise web security awareness among web owners in order to help decrease the constant \
rise of compromised websites.

The desenmascara.me PoC calculate a score also known as 'security awareness value' of any \
website (neither resources nor crawling) based on all the metadata available. Basically the \
score is based on a simple calculation of the more weak metadata you show the worst and in the \
other way around. It is explained as follows:

-Score < 0: a website is considered as prone to be compromised. (because it is based on known \
                and buggy software such as old Joomla, highly critical Drupal or Typo3 \
                versions...)
-Score between 0 and 20: a website is not considered as security aware (their owners have room \
                to improvement, they should take care)
-Score between 20 and 59: a website is considered somehow as security aware. (their owners have \
                done some tweaking to the site). Usually this is the normal status.
-Scoring 60 or higher: a website is considered as security aware (their owners have done some \
hardening either on the platform or in the web architecture)


Additionally as desenmascara.me will collect all the metadata possible from any website it can \
serve at the same time to two audiences:

-Auditors/pentesters: as 1 click method to Fingerprint a web server.
-Web owners without security background: trying to explain in a brief summary the web security \
awareness status based on all the info collected.

The metadata extraction will be totally passive just like browsing the website, otherwise the \
tool could not be online for public use. Some additional features of the tool by leveraging all \
the info collected are:

-Easy to use, only enter a website address to see what's behind the scenes
-Available in English and Spanish (based on the browser language)
-Detection of domains potentially being used for phishing (kind of: mail-google.com.ve, \
                applesupport.com.mx..)
-Detection of sites being mirrored from anothers (usually founds in Phishing, fake and \
                scareware websites)
-Detection of CMSs and versions (whatweb core)
 -Brief summary about the website configuration
 -Different report colours to highlight web security awareness
-Detection of domain registrar for .com & .net TLD (some are more security savvy than others)
-Detection and warnings about the danger of hosting third party providers.
-Warnings about old software being exploited in the wild like joomla-1.5, RoR CVE-2013-0156...
-Warnings about domains (.com & .net) expiring in the coming days
-Detection of properties file leak in Ruby on Rails. 
-Warnings about OpenSSL version afected by heartbleed.
-Warnings about Drupal Core - Highly Critical PSA-2014-003.
-Warnings about TYPO3 - Highly Critical Authentication bypass.
-Detection of hardening signs such as WAF, CDN, reverse proxy...
-In case of CloudFlare protected websites, it will try to show the real server IP.
-Detection of blacklisted websites by GoogleSafeBrowsing
-Detection of suspicious iframes or hidden spam
-Detection of misconfiguration on robots.txt files (i.e: exposing confidential information)
-Detection of defacements, directory listings, private IP address in comments...
-In the case of very known websites (Forbes, EA, .gov ...) will inform about known security \
                incidents which they were victim of.
-Stats about general web security awareness and some details of compromised websites

The goal of this tool is NOT to consider a website either secure or insecure, but to consider \
the website owners security aware in different levels as explained.

In my observations during the last years I could spot a common pattern among the vast majority \
of compromised websites being used in all kind of malware campaigns: they are all poor \
maintained.

With this PoC the goal is to highlight the importance to keep updates the websites. The lowest \
the score the more vulnerable a website is and therefore prone to be compromised. Bear in mind \
that this analysis is valid for most of the current attacks on the web nowadays; compromised \
websites to serve as redirectors, to store phishings, as proxys for exploit kits and any \
malicious purposes of malware campaigns. All the above activity within the compromised websites \
is taking place without their owner´s knowledge, in web servers which can be online during \
years without updates. All the malicious activity is happening behind the scenes. Later the \
owner of the website will get complains either from their users or the hosting company. The \
problem is that these owners are not security aware (nor the hosting companies). But if you \
have deployed a website you should take some precautions, you can not rely on the sofware \
vendors, community or the hostings. It is like driving a car, you need formation and a license \
and then you need to keep you car in good status, doing the yearly checks and so on, in order \
to not be a danger in the road. By not taking precautions you would be considered as an \
irresponsible and you will end up with fines at best. The same in Internet, if you do not take \
precautions with your website then you are feeding the malware ecosystem in the Internet.

Having done some tests [1] with the desenmascara.me scoring towards tens of websites from the \
same malware campaign. And by observing the results during the last years of using this scoring \
I can see the accuracy to evaluate the relation between poor maintained websites and how they \
become compromised is around 80%.

Therefore I have decided to publish an API [2] to this service with an interesting use intended \
for an initial fulldisclosure and as a wake up call for their web owners: querying URLs prone \
to be compromised: http://desenmascara.me/api/howto#pronetld

You can play with http requests such as:
http://desenmascara.me/api/lessscorebytld/gov
http://desenmascara.me/api/lessscorebytld/br
http://desenmascara.me/api/lessscorebytld/com

There is nothing illegal nor unethical on providing this information. All the info is public, \
the desenmascara.me service just collect it and interpret it.

http://desenmascara.me


REFERENCES

[1] http://pwnedwebsites.com/how-to-spot-website-easy-target.html[2] \
http://desenmascara.me/api/howto

Thanks
Emilio

 
 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]