SexyCyborg goes Pentesting

[Nytro]

By SexyCyborg · 4 days ago · 37 images · 184,121 views · stats

I’ve been watching the TV show "Mr. Robot" and while I know not all of it is accurate some of it is and it got me curious. I’m already pretty comfortable with command line and remote server administration from my web development work, and it turns out a lot of ‘hacking’ tools are just testing tools any sensible IT professional would use- just without a GUI. So I spent this month hitting the books (well web pages) watching lots of videos and learning a bit about information security and penetration testing (I wonder how many idiot jokes that phrase is going to cause…). I still don’t know much, but I know a tiny bit more than I did. Enough to ask people who know more than me the right questions- and enough for a fun project.

So I got to thinking- if I had to do penetration testing on a corporate facility, how would I do it? Social engineering for one- I’m a natural honeypot. I think there's a reasonable chance that a guy might invite me back to their office after a few drinks in the neighborhood? But a handbag would be suspicious and leaving cell phones at the gate would be standard practice in any reasonably secure facility. My typical clothing does not leave room to hide anything- but that’s all the more reason they would not be suspicious of me.

So I devised the Wu Ying Shoes (???)! - Penetration Testing Platform Heels! "Wu Ying" means “shadowless", the name is from the folk hero Wong Fei Hung’s (???) famous "shadowless kick" (???). Wong Fei Hung is from Foshan, which is my ancestral home as well as the ancestral home of Bruce Lee. As legend has it, to execute the "shadowless kick" Wong would distract his opponent with a punch or upper body move while striking with his foot. With my shadowless shoes I distract the target with my…upper body and they don’t see the real danger on my feet:-) Also I get tired of English names for everything. If we are ever going to stop copying Western things we should stop copying Western names as well right? So "Wu Ying Shoes".

Each shoe has a drawer that can be slid out without my having to take the shoes off. This drawer can be customized for various payloads. (Just FYI- of course I asked the staff for spray and a cloth to wipe off the table carefully after I took these pictures).

For the purposes of this first test version, my right shoe contains a pen testing drop box. This is a wireless router running OpenWRT with a built in rechargeable battery that could either be left running inside the shoe (for war-walking, wifi sniffing and logging etc) or could be removed and plugged into a convenient open network jack as soon as I was inside and had direct access to the LAN. Once this is done you can gain remote access anytime you want via SSH tunnel.

Installing OpenWRT on the TL-MR10U is just like upgrading the firmware on any router. It’s two links and a button- nothing to it. There’s a lot of different software you can run once you have OpenWRT flashed. This router may-or-may-not be running a custom version of Wispi for the TP-Link TL-MR10U because if it was it would probably be illegal in China so maybe its not. But if it was I could run Jasager/Karma which lets you can fake being a friendly/known wifi access point and setup a fake login page to capture passwords, among other cool tricks. Wispi also has a few other handy utilities that you should never use in the real world but are pretty cool to try at home once or twice just so you know how.

In my left shoe there is a USB keystroke recorder. This is a pass-through device that goes into the back of the computer where you normally plug the keyboard in and records everything typed on the keyboard (so all passwords) in it’s built in memory.

A retractable ethernet cable for the OpenWRT router.

A shim for opening padlocks.

…and a basic lock pick set for gaining access to network cabinets, file drawers etc. I learned how to use the picks at a Locksport meet-up. I can only do simple locks but still loads of fun! Like little metal puzzles...

Here’s the model I made for 3D printing. I’m sticking with TinkerCAD just to annoy all the CAD snobs who keep commenting on it ;-P

I had to print it at 0.3mm so the layers are a little coarse. It was taking forever at 0.2mm (what I did my LED skirt control box at). Still looks decent. That’s PLA plastic. Infill is 20% and it supports my weight without any issues. Each shoe weighs about the same as a normal, non-printed shoe.

Obligatory denim overalls work-clothes shot for the boys. You know the world is a strange place when fan-service is overalls and the slutty mini-dress is “meh".

Removing the support structure. This kind of 3D printer can’t really do an overhang over 45% or so since each layer has to rest on the one below. Sacrificial columns are printed to support the overhang for printing and then peeled away afterwards. Source files are here if you'd like to make your own: http://www.thingiverse.com/thing:980191

LibraryBox can be a good way to share movies and ebooks with friends if you are traveling or don’t have wifi. I could see Piratebox being useful in time of disaster for sharing information when the wireless networks are down. It’s kind of like a mini-NAS. Wispi and Pentest drop boxes should of course should only be experimented with at home for educational purposes. While it’s good to know about this stuff always obey your local laws. People think all sorts of crazy stuff about China and I don’t want to talk politics- but my city Shenzhen is a really, really cool place to live (think Bladerunner) so there’s really no reason to do dumb stuff.

As always- thanks to my friends for helping to clean up my English above. I had a ton of technical help but I follow a strict “don’t do it for me, show me how” rule so learned a tremendous amount. As I’ve also mentioned before, I’m not much more technical than my female friends but I am patient, good at following tutorials and and asking questions. If you can follow a recipe I assure you that you could do this sort of thing also. Any women with questions about teaching themselves online should feel free to contact me on Reddit and I’d be delighted to offer any help I can. Remember ladies- if you are thinking about becoming a Maker, learning to code or doing hardware; if a girl who looks like me can do it, how hard can it really be? Edit: Normally I have to sort though about 50% identical replies to my posts on Reddit. For those flexing their fingers and getting ready to give me a hard time: Yes, they are fake. Yes, I feature them prominently and deliberately in everything I do. No, most of my projects do not have all that much technical merit- they are 90% silicone and 10% silicon ;-) No, if you point out the absolutely obvious no one will think you are insightful, edgy or cool. They will think you are 12.

Sursa: http://imgur.com/a/c4WNF#PEc4q1x

[Byte-ul]

what the fuck?

[Nytro]

Such security. Much wow. Pentest.

[Gushterul]

Ok, n-am citat in detaliu ce a bagat in el, dar e epic numai dupa cum arata tipa si ca idee de whatever:)

[iulik]

Hmmm dupa ce am vazut pozele astea mi-a venit si mie pofta de penetrare :> .

[q111]

Hmmm dupa ce am vazut pozele astea mi-a venit si mie pofta de penetrare :> .

404 Not Found Page -Redtube.com dc ti-ai sters contu futute-n gura?

[TheTime]

I'm a simple man. I see boobs, I press like.

[Nytro]

In sfarsit un tutorial pe care chiar il citeste lumea. Sau cel putin se uita la poze.

[UnixDevel]

oricum cand vine vb de soc eng se stie ca femeile sunt cele mai bune mai ales decolteu si damsel in distress