BruCON 2012 (Lightning Talk) Ghent, Belgium (27th Sept. 2012) Cutting accounts down to scythe! ---------- Abstract: ---------- Scythe is a framework for user/account enumeration. It is designed to allow users to easily extend and add new modules as required for POC attacks during penetration tests. The framework offers the ability to check a list of user accounts/email addresses against a given website to see which accounts are valid. Advanced features include cookie and CSRF token support, as well as error detection and timeout/retry functions. Currently in beta, available from gi

1. Cutting accounts down to
SCYTHE!
Chris John Riley

3. “THE WISEST MAN, IS HE
WHO KNOWS, THAT HE
KNOWS NOTHING”
SOCRATES: APOLOGY, 21D

4. NOT
AN EXPERT!

5. 1) What
2) Why
3) How
4) Q’s

6. WHAT?

7. FRAMEWORK FOR
USER
ENUMERATION

9. What
Written in Python
Threaded
Modular
Description files (XML)
Easy to use
Hopefully!

10. WHY?

11. BECAUSE
PENETRATION
TESTERS ARE…

13. Why
Speed up account enumeration
 POC Examples
Offer advanced features
 Cookie support
 CSRF token collection
 Wait / Retries
 Threading

14. HOW?

15. IT ALL STARTS
WITH A MODULE

16. BASIC

17. Basic module
<module>
<site>
<name>basic module</name>
<url>
<![CDATA[https://example.com/signup_check/
username=<ACCOUNT>]]>
</url>
<method>GET</method>
<successmatch>taken</successmatch>
</site>
</module>

18. ADVANCED

19. <!-- Wordpress.com - Logon user enumeration issue -->
<module>
<site>
<name>Wordpress.com</name>
<url><![CDATA[https://wordpress.com/wp-login.php]]></url>
<method>POST</method>
<postParameters>
<![CDATA [log=<ACCOUNT>&pwd=<RANDOM>redirect_to=http://wordpress.com]]>
</postParameters>
<headers></headers>
<requestCookie>False</requestCookie>
<requestCSRF>False</requestCSRF>
<successmatch>The password you entered for the email or user</successmatch>
<negativematch>Invalid email or username</negativematch>
<errormatch>You have exceeded the login limit</errormatch>
<date>13/09/2012</date>
<version>2</version>
<author>CJR</author>
<category>blogs</category>
</site>
</module>

20. <!-- Wordpress.com - Logon user enumeration issue -->
<module>
<site>
<name>Wordpress.com</name>
<url><![CDATA[https://wordpress.com/wp-login.php]]></url>
<method>POST</method>
<postParameters>
<![CDATA [log=<ACCOUNT>&pwd=<RANDOM>redirect_to=http://wordpress.com]]>
</postParameters>
<headers></headers>
<requestCookie>False</requestCookie>
<requestCSRF>False</requestCSRF>
<successmatch>The password you entered for the email or user</successmatch>
<negativematch>Invalid email or username</negativematch>
<errormatch>You have exceeded the login limit</errormatch>
<date>13/09/2012</date>
<version>2</version>
<author>CJR</author>
<category>blogs</category>
</site>
</module>

21. <!-- Wordpress.com - Logon user enumeration issue -->
<module>
<site>
<name>Wordpress.com</name>
<url><![CDATA[https://wordpress.com/wp-
login.php]]></url>
<method>POST</method>
<postParameters>
<![CDATA
[log=<ACCOUNT>&pwd=<RANDOM>redirect_to=
http://wordpress.com]]>
</postParameters>

22. <headers></headers>
<requestCookie>False</requestCookie>
<requestCSRF>False</requestCSRF>
<successmatch>The password you entered for the email or
user</successmatch>
<negativematch>Invalid email or username</negativematch>
<errormatch>You have exceeded the login limit</errormatch>
<date>13/09/2012</date>
<version>2</version>
<author>CJR</author>
<category>blogs</category>
</site>
</module>

23. ADD A LIST OF
USERNAMES /
EMAILS

24. # usernames/email 1 per line
test
testuser
testuser2
testtest
devuser
…
or just -–account=test,test2,…

25. MIX AND LEAVE TO
RUN FOR A FEW
MINUTES

28. How
 XML contains replacement points
 <ACCOUNT>
 <RANDOM>
 <CSRFTOKEN>
 These are used to create testcases

29. GOALS

30. Goals
 Flexible Running
 Single module (targeted)
 --single wordpress.com
 Category of modules
 --category=blogs
 Single account
 --account=test
 Filename containing accounts
 --accountfile=accounts.txt

31. Goals
 Flexible Handling
 Error detection
 Retry on error (<errorcode>)
 -- retries and --retrytime
 Handles cookies and CSRF tokens
 <CSRF_URL>
 <CSRF_regex> to extract token
 Insert into request using <CSRFTOKEN>

32. Goals
 Flexible Output
 Verbose output
 Detailed request info
 Output success to file
 Summary at completion
 Debug mode
 Stores body and headers for each request

35. GITHUB.COM/CHRISJOHNRILEY/SCYTHE

36. Questions?

37. GO FORTH AND
ENUMERATE ALL
THE THINGS!

38. Thanks for coming
http://c22.cc
contact@c22.cc