Category Hacking

Decommission USB Blocking on Linux

prashanthsams Leave a comment

If you previously blocked USB storage ports on your Linux machine to secure it against unauthorized access, you may need to reverse these changes. This guide provides a step-by-step approach to remove the USB block rule, allowing USB storage devices to function normally again.

1. Locate the USB Block Rule

If you’ve followed the previous guide or a similar process to block USB storage, you should have created a rule file in the /etc/udev/rules.d/ directory. The filename for this rule is likely 99-usbblock.rules.

2. Remove the USB Block Rule File

Use the following command to delete the file, thereby removing the block on USB storage devices:

sudo rm /etc/udev/rules.d/99-usbblock.rules

This step deletes the file that contains the blocking rule. Without this file, udev will no longer apply the restriction.

3. Reload udev Rules

After removing the rule file, you need to reload udev rules so that the system updates and stops enforcing the deleted rule:

sudo udevadm control --reload-rules

4. Trigger udev to Apply Changes

Finally, trigger udev to apply the updated rules immediately:

sudo udevadm trigger

With these steps, your Linux machine will no longer block USB storage devices, allowing them to be recognized and used as normal.

5. Verifying USB Functionality

To verify that the USB storage ports are no longer blocked:

Plug in a USB storage device (e.g., a flash drive). Use a command like lsblk or fdisk -l to check if the device is detected:

lsblk

If you see the USB storage device listed, then decommissioning was successful, and the system is now allowing USB storage access.

Block USB storage ports in Linux

prashanthsams Leave a comment

Blocking USB storage on Linux is a straightforward process using udev rules. Follow these steps to configure and enforce a rule to disable USB storage access:

1. Create a USB Block Rule

The following command creates a rule in the udev directory that disables any USB storage device from being authorized for use:

echo 'SUBSYSTEM=="usb", ATTR{authorized}="0"' | sudo tee /etc/udev/rules.d/99-usbblock.rules

This rule works by setting ATTR{authorized}="0" for any device under the usb subsystem, effectively blocking it.

2. Reload udev Rules

After adding the rule, you need to reload the udev rules for it to take effect:

sudo udevadm control --reload-rules

3. Trigger udev to Apply the Rule

Finally, use the following command to trigger udev and apply the rule immediately:

sudo udevadm trigger

With this configuration, any USB storage device plugged into your Linux machine will be blocked.

Intercept and Modify HTTP(s) Request | Burp Suite

prashanthsams Leave a comment
  • Download Burp Suite Community Edition link
  • Click on the Proxy tab.

  • And click on the Open browser button.
  • Enter the username and password details and switch back to the burp suite interface.

  • Click on the intercept is off button and switch back to the browser.
  • And click on the Login button.
  • Now, observe the login POST method’s request details including header and payload in the intercept body.

  • Now, try to modify the request body and headers if needed.
  • And click on the Forward button.

  • Keep pressing the Forward button until all the downstream API calls are finished.
  • Click on the HTTP history tab, select the POST request, and observe the response.

Attack HTTP traffic using Wireshark | CyberOps workstation

prashanthsams Leave a comment

HTTP

  • Download and install CyberOps workstation virtualbox image
  • Login with analyst as username and cyberops as password
  • Get the network interface name
ifconfig
  • Enter the below cmd to start collecting the traffic in the specific network, enp0s3
sudo tcpdump -i enp0s3 -s 0 -w httpdump.pcap
  • Here, we are saving the traffic data in a file with extension .pcap 
  • Open browser and enter any exploited website; say, http://altoromutual.com/login.jsp
  • Enter random username, password, and click login
  • Now, switch to the terminal and ctrl+c the process
  • Open wireshark through terminal
sudo wireshark-gtk
  • And select the pcap file from File->open; path: /home/analyst 
  • Now, filter the traffic with http 
  • Click on the POST request in the recorded list before select

  • Hacked!!

HTTPS

  • Open browser, enter any secured website, and do some actions; say, https://xyx.com
  • Make sure the wireshark process is running
  • Now, filter the traffic
tcp.port == 443

  • Can’t hack cos of the encrypted data 😦