As promised back in November, here is the first of my penetration testing tutorials. This tutorial will deal with the basics of Nmap, the popular port scanning security tool.

For this tutorial, you will need:

• Nmap
• A host (or hosts) that you own, or that you have permission to scan.

The host can be your computer (just use 127.0.0.1 as the IP address), or your home WiFi router (you can usually find the IP address of this in your network settings).

Performing your First Scan

The first thing we will do is run a default Nmap scan against an IP address. Enter the following command at your command prompt, or if you are using Zenmap (the graphical front-end to Nmap), put the command in the “Command” box.

nmap 192.168.1.1

Of course, replace 192.168.1.1 with the IP address you wish to scan (192.168.1.1 is the address of my home router). Then press enter. Nmap will start scanning the IP address you gave it, and should produce something like the following output:

Nmap Default Scan

As you can see, Nmap has detected that the host is up, and that it has 6 ports open or filtered. The entire scan took 9.37 seconds. What did Nmap actually do though? To understand this better, re-run the scan but add the -vv flag to the command:

nmap -vv 192.168.1.1

In case my readers haven’t noticed, I’ve changed the tagline of the blog from “A blog about Information Security, Cryptography, and Privacy” to “A blog about Information Security, Privacy, and Ethical Hacking”. If you don’t see it, try clearing your browser cache.

The reason for this small change in direction is threefold:

1. When I started this blog a couple of years ago, cryptography was one of my main interests. These days, whilst I still like reading up on advances in cryptography, I don’t find it as interesting as other aspects of information security.
2. Cryptography itself can be seen as a big part of “Information Security”, so it seemed pointless to effectively include it twice in the tagline.
3. I’ve worked as a penetration tester for almost 6 months now, so ethical hacking is now something I am focusing on and wanting to write about more.

So I’m going to start a small series of simple but detailed tutorials on various skills required when penetration testing. They will range from basic usage of nmap/nessus/metasploit to the more advanced cracking of stolen hashes and attacking web applications. If people have suggestions for other tutorials, be sure to contact me and I’ll do my best to put one together.

I will shortly be getting back to more regular blogging on security issues, but I thought I would inform the readers of my blog that recently I was awarded an MSc in Information Security from Royal Holloway, University of London. I was working on it for the past two years, and am happy to announce that I received a “Pass with Distinction”, the highest grade possible.

Last night I was also informed that my MSc Project (on Fuzz testing Web Applications) received a SearchSecurity.co.UK award for being of “outstanding quality”.

That’s all the personal news for now. I’ve been very busy at work over the past two months, so I have had less time to do personal projects like updating this blog.  As Christmas nears, I’ll have more time for these sorts of things. For now, thanks for reading!

Web applications are often notoriously insecure. With more of us migrating to web-based technologies, ridding the web of these insecurities becomes a top priority. Here are ten tips that should help you secure your web applications.

1. Send all confidential data over a secure connection.

At the very least, send user credentials (i.e. username and password) over HTTPS. At the very most, send all data over HTTPS, especially when your apps are dealing with large amounts of personal information. There are almost no excuses for not using HTTPS these days, especially when buying an SSL certificate is so cheap. Be aware that if you choose to only send credentials over HTTPS, your web application will be susceptible to session hijacking attacks.

Never send any confidential data in an email, especially password confirmation emails. Email is not a secure method of communication, and it probably never will be (PGP is not widely used at all). When dealing with passwords, always let the user set their own, as opposed to generating it for them. That way, you do not need to send their password in an email since they already know what it is.

2. Encrypt confidential data before storing it.

If your web application stores credit card numbers of users or other confidential data, make sure that this data is encrypted in whatever storage medium you are using. If your web application needs to access this data, it should be copied and decrypted in memory, before discarding the copy. At no point should the unencrypted data be stored in some permanent location.

Additionally, the key(s) used for encryption / decryption should not be stored in the same location as the encrypted data. This is to minimize damage if the storage medium is compromised (for instance, if hackers gain access to a database containing encrypted data, the decryption key should not also be compromised).

3. Salt and hash all passwords in the database.

This is possibly one of the most important things a web application designer should implement in terms of user security, but again and again we see large organizations and companies either ignoring or misunderstanding the importance of salting and hashing passwords.

There are absolutely no excuses for not salting and hashing passwords. Your web application should never be able to retrieve a user’s password, either for a comparison or for sending to the user in case they forget it. When the user first registers, their password should be concatenated with a salt (some unique random string of characters) and then hashed with a strong hashing algorithm (SHA-256 for example). PHP has a built-in function called crypt() that supports numerous hashing methods.

The terms Deep Web, Dark Web, Darknet, and Dark Internet are ones I see confused and misused on a regular basis on the Internet and in the media. This is my attempt to rectify this confusion and misuse by explaining what each of these terms means and when you should use them.

Deep Web

The Deep Web is quite simply any content on the Web which is not accessible to or indexed by standard search engine spiders. A search engine spider will typically crawl a website by visiting it and then visiting all the pages it links to, which includes pages local to the site and pages on other sites. Whilst this gives the search engine a pretty good view of the web, it misses out on a lot of other resources for various reasons:

• Standard search engine spiders do not try to log into any websites, so any resources protected by a login are not accessible to it.
• Content which explicitly denies access to search engine spiders (e.g. using a robots.txt file) is also left off the search engine index.
• A web server may host a file or directory of files that isn’t linked to anywhere on the web. These files and directories would be missed by search engines as they would (most likely) be by humans too.
• Content that requires input by a user to be generated (i.e. search results) may also be effectively invisible to search engine spiders.
• Some websites may require a special browser configuration to gain access.

You can think of the web as an ocean of content. Anything on the surface of this ocean is content that is being linked to openly. A search engine spider can only look at the content on the surface of the ocean, and any content in the deeper parts of the ocean (whether protected by a login, or just hidden from view) is inaccessible to it.

What it is important to remember is that the Deep Web has nothing necessarily to do with illegal activity, nor is it about being anonymous or hiding your identity. Most of us access the Deep Web on a regular basis, whenever we check web mail, or log in to a social networking site. If a search engine can’t see it, for whatever reason, it’s part of the Deep Web.

Dark Web

Conversely, the Dark Web does have numerous links to illegal activity and hiding one’s identity. It is a collection of websites that are only accessible over the Tor network, which hides your IP address and gives you complete anonymity. Not every website accessed over Tor is part of the Dark Web, since Tor allows you to browse anonymously on the regular web as well. However, the Tor network has a special pseudo-top-level domain suffix called “.onion” which is used to get to websites which host themselves over Tor, and are therefore only accessible via Tor.

Going to these websites without using a browser configured to use Tor is impossible, so the Dark Web is actually a subset of the Deep Web, and as such is not indexed by search engines. Whilst there are many websites on the Dark Web which do not promote illegal activity, there are plenty that do, including sites that sell drugs and weapons. A BBC report earlier this year highlighted the Dark Web quite well, and the hacktivist group Anonymous have attacked pedophilia-related websites on the Dark Web before.

Darknet

Wikipedia asserts that a darknet is a “private, distributed P2P filesharing network, where connections are either made only between trusted peers using non-standard protocols and ports or using onion routing.” Limiting the term to certain types of filesharing network is unhelpful in my opinion, and I see no reason a darknet cannot simply be any such network. This would make the onion routed part of the Tor network itself a darknet, and it is often called “The Darknet” (though there is more than one darknet, the onion routed part of the Tor network is still the most well known).

This too would make the Dark Web a part of the Darknet. However, it is important to point out that the Dark Web and the Darknet are not synonymous. Many other services can run on the Darknet, such as email, IRC, etc. The Dark Web is just one of these services, contributing a subset of traffic over the Darknet.

So a darknet (no capitalisation) is any network where connections are made only between trusted peers using non-standard protocols and ports or using onion routing. The Darknet (capitalised) is the onion routed part of the Tor network. This means that the Darknet is a darknet, in the same way as the Internet is an internet.

To make matters slightly more confusing, Project Meshnet used to be known as the “Darknet Plan”, though luckily the name was changed to more accurately reflect the nature of their project (and possibly to alleviate confusion).

Dark Internet

Finally, we end with a term which is completely unrelated to the three above, yet still manages to get confused with them. The Dark Internet refers to the unreachable network hosts on the Internet. They could be unreachable because a machine is turned off, or a network cable is damaged, or even because routing tables have become corrupted somewhere. Nobody, not even regular Internet users, can reach them. The Dark Internet is constantly changing; machines get taken offline, and some get put back online, but whilst they are offline, they are part of the Dark Internet.