Mad Irish

Hydra Brute Force Utility

Hydra is a powerful, multi-protocol brute force attack tool. Brute force attacks involve guessing authentication credentials in an attempt to gain access to a system. Brute force is, over time, the most successful way to break simple authentication. The main disadvantages of brute force attacks are the time required to try username and password combinations, and the fact that these types of attacks are extremely noisy. Noise, in this instance, means that brute force attacks generate a lot of traffic, and potentially quite a bit of evidence of the attack. It is even possible to perform a denial of service attack using brute force tools. By attempting authentication repetitively over periods of time it may be possible to tie up system resources to such an extent that legitimate users cannot access the resource.

• Auditing Drupal Modules for XSRF Vulnerabilities
• Using Drupal XML-RPC to Bypass Authentication Failure Detection
• Auditing Drupal Modules for XSS Vulnerabilities
• Securing Drupal User Accounts
• Brute Forcing Drupal
• Monitoring Drupal for Insecure Settings
• Exploiting PHP PCRE Functions
• PHP Null Byte Poisoning
• Writing OSSEC Custom Rules and Decoders
• PHP Arbitrary File Include

Thinking Security

Security vulnerability in code may be a permanent reality. Given the average number of bugs in software, and the moving state of security, it may be impossible to produce secure software. Added to this crisis is the fact that software is deployed on systems that are increasingly permanently connected to the network. This constant connection means a persistent, global threat. Traditional defences such as firewalls are increasingly proving useless at mitigating this threat. This situation leads us to question whether current security paradigms are working. What can the information security community do to combat a persistent, and growing, problem of vulnerable software being exposed to attack?

Monitoring Drupal with OSSEC

Drupal 6 provides the syslog module by default which allows Drupal to write some log entries directly to the system log. OSSEC open source host based intrusion detection system is a perfect system for monitoring events in a system log. By implementing a custom decoder and a few rules you can easily modify your OSSEC installation to monitor your Drupal site for common attacks, including brute force attacks or other malicious activity.