Getting lists of exploits

We get a few questions each month on how to generate lists of exploits. There's a few ways:

• Visit exploitlist.immunityinc.com. Here you can look at some of the CANVAS Exploit Packs as well, and generate an XML with names and descriptions and so forth. We try to keep it updated, but it generally lags a bit. It's used most often by our partners in Vulnerability Assessment to rank vulnerabilities.
• Use ./canvasengine.py -e or ./canvasengine.py -D to generate .csv .xml or .txt . This is current as of whatever version of CANVAS you have installed and will include your CANVAS Exploit Packs. (a.k.a., this is how we create exploitlist.immunityinc.com) .

Of course, if you have any other questions, please contact us at support@immunityinc.com or for sales questions admin@immunityinc.com !

Vulnerability Assessment versus Exploitation

The release of SWARM has occasioned a few questions (on ArsTechnica, for example) that we wanted to address - in particular: What is the difference between SWARM and tools like Nessus.

One of the underlying technologies behind SWARM is Immunity's CANVAS exploitation engine. CANVAS scans and exploits small groups of hosts and then further penetrates into networks via MOSDEF, a Python C compiler.

Exploitation in this case means running buffer overflows, PHP include attacks, brute force attempts, or other techniques that will get the user a foothold on the remote machine to execute commands. The advantage here is that once you've broken into a machine, you know for a fact that it is vulnerable - not only is it definitively unpatched, but CANVAS will have shown that any secondary protective measures (Firewalls, IPS, IDS, HIPS, AV, etc.) were bypassed.

Vulnerability assessment tools (such as Nessus, OpenVAS, Qualys, etc.) have a different technique, which is largely based on light touches, plus a huge database of known vulnerabilities that match certain banner strings or protocol responses. This, while extremely fast, generates very high numbers of false positives. To supplement this, most vulnerability assessment tools offer a mode where you can, as an enterprise, give them an authenticated user and password and they will remotely log into your machines and look at files and registry keys directly. However, this does not adequately test for secondary protective measures such as AV or firewall rules.

The balance is simple: When testing a small number of hosts, any false negative is painful and you may find that vulnerability assessment tools will give you the most leads possible for your follow-on investigations. Often, these leads are followed up with an exploitation tool like CANVAS (Immunity sells a popular bundle with CANVAS and Nessus together at a discount). Here at Immunity we call this process "Vulnerability Verification".

For testing millions of hosts, as SWARM does, any false positive percentage is completely unacceptable. There simply isn't time for any human to post-process the results to narrow down what is really vulnerable and what is not.

There are, of course, many many other differences in the two kinds of technologies. But we wanted to clarify at least the difference in goals. Of course, if you have any questions on SWARM, or want to see a WebEx demo, please email us at admin@immunityinc.com.

SWARM

So I have a lot to say about SWARM, which we are finally talking about today. But first, two quick movies which you should watch.

This first movie is the actual SWARM engine user interface. Network conditions are something you discover at runtime and hence, SWARM performance optimizations are configurable at runtime.

This next movie is the SWARM data mining user interface.

Now that you've seen those, come by the BlackHat booth and the team will explain things in more detail.  Needless to say we're really excited to finally be showing this to the public! If you're a large corporation and you need answers about your network NOW rather than "at some point in the future" then we think you'll appreciate this level of scalable network situational awareness.

Please email any comments/requests to admin@immunityinc.com or visit www.immunityinc.com for more information.

CANVAS Reporting

CANVAS has great reporting finally

In the video above you can see the dramatically great reporting engine we've now integrated into CANVAS, which will be released in the next version.

This will soon be integrated into SILICA as well, probably in the next release, although no promises as the team is also working on STALKER integration and getting a few other minor features done (for example, FakeAP improvements).

And of course, we have a new product coming out that we're going to be demoing at BlackHat at our booth. See you there!

SILICA WPS Feature

So a few weeks ago I ran the WPS attack against one of our test AP's. I started it up, it auto-detected the safest delays and off it went. And went. And went.

Several days later it noticed the AP had started having some issues, so it stopped before it crashed it. This was "nice" but hardly the result I was looking for. It did, however, get the WPS info from the AP, meaning I had its exact version. I noticed that I also happened to have that version in the Info tab in SILICA.

SILICA WPS Information Tab - extremely useful information!

On a whim I restarted it, after manually configuring it to use the Linksys E3200 information. 42 minutes later, I had the WPA passphrase and the WPS pin. THAT was what I was looking for.

You'll notice the new version of SILICA does this for you automatically. If you want the old behavior, you need to go into Preferences and uncheck it. But by default it "does the right thing" and you should be getting many more passphrases now from the SILICA WPS attack.

The WPS Preferences Window lets you choose to do things manually
or just let SILICA make all the right decisions.

Thanks for reading! Please let us know if it works better for you now!