Table of Contents for
Python Web Penetration Testing Cookbook

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Python Web Penetration Testing Cookbook by Dave Mound Published by Packt Publishing, 2015
  1. Cover
  2. Table of Contents
  3. Python Web Penetration Testing Cookbook
  4. Python Web Penetration Testing Cookbook
  5. Credits
  6. About the Authors
  7. About the Reviewers
  8. www.PacktPub.com
  9. Disclamer
  10. Preface
  11. What you need for this book
  12. Who this book is for
  13. Sections
  14. Conventions
  15. Reader feedback
  16. Customer support
  17. 1. Gathering Open Source Intelligence
  18. Gathering information using the Shodan API
  19. Scripting a Google+ API search
  20. Downloading profile pictures using the Google+ API
  21. Harvesting additional results from the Google+ API using pagination
  22. Getting screenshots of websites with QtWebKit
  23. Screenshots based on a port list
  24. Spidering websites
  25. 2. Enumeration
  26. Performing a ping sweep with Scapy
  27. Scanning with Scapy
  28. Checking username validity
  29. Brute forcing usernames
  30. Enumerating files
  31. Brute forcing passwords
  32. Generating e-mail addresses from names
  33. Finding e-mail addresses from web pages
  34. Finding comments in source code
  35. 3. Vulnerability Identification
  36. Automated URL-based Directory Traversal
  37. Automated URL-based Cross-site scripting
  38. Automated parameter-based Cross-site scripting
  39. Automated fuzzing
  40. jQuery checking
  41. Header-based Cross-site scripting
  42. Shellshock checking
  43. 4. SQL Injection
  44. Checking jitter
  45. Identifying URL-based SQLi
  46. Exploiting Boolean SQLi
  47. Exploiting Blind SQL Injection
  48. Encoding payloads
  49. 5. Web Header Manipulation
  50. Testing HTTP methods
  51. Fingerprinting servers through HTTP headers
  52. Testing for insecure headers
  53. Brute forcing login through the Authorization header
  54. Testing for clickjacking vulnerabilities
  55. Identifying alternative sites by spoofing user agents
  56. Testing for insecure cookie flags
  57. Session fixation through a cookie injection
  58. 6. Image Analysis and Manipulation
  59. Hiding a message using LSB steganography
  60. Extracting messages hidden in LSB
  61. Hiding text in images
  62. Extracting text from images
  63. Enabling command and control using steganography
  64. 7. Encryption and Encoding
  65. Generating an MD5 hash
  66. Generating an SHA 1/128/256 hash
  67. Implementing SHA and MD5 hashes together
  68. Implementing SHA in a real-world scenario
  69. Generating a Bcrypt hash
  70. Cracking an MD5 hash
  71. Encoding with Base64
  72. Encoding with ROT13
  73. Cracking a substitution cipher
  74. Cracking the Atbash cipher
  75. Attacking one-time pad reuse
  76. Predicting a linear congruential generator
  77. Identifying hashes
  78. 8. Payloads and Shells
  79. Extracting data through HTTP requests
  80. Creating an HTTP C2
  81. Creating an FTP C2
  82. Creating an Twitter C2
  83. Creating a simple Netcat shell
  84. 9. Reporting
  85. Converting Nmap XML to CSV
  86. Extracting links from a URL to Maltego
  87. Extracting e-mails to Maltego
  88. Parsing Sslscan into CSV
  89. Generating graphs using plot.ly
  90. Index

Hiding a message using LSB steganography

In this recipe, we are going to create an image that hides another, using LSB steganography methods. This is one of the most common forms of steganography. As it's no good just having a means to hide the data, we will also be writing a script to extract the hidden data too.

Getting ready

All of the image work we will encounter in the chapter will make use of the Python Image Library (PIL). To install the Python image libraries by using PIP on Linux, use the following command:

$ pip install PIL

If you are installing it on Windows, you may have to use the installers that is available at http://www.pythonware.com/products/pil/.

Just make sure that you get the right installer for your Python version.

It is worth noting that PIL has been superseded with a newer version PILLOW. But for our needs, PIL will be fine.

How to do it…

Images are created up by pixels, each of those pixels is made up of red, green, and blue (RGB) values (for color images anyway). These values range from 0 to 255, and the reason for this is that each value is 8 bits long. A pure black pixel would be represented by a tuple of (R(0), G(0), B(0)), and a pure white pixel would be represented by (R(255), G(255), B(255)). We will be focusing on the binary representation of the R value for the first recipe. We will be taking the 8-bit values and altering the right-most bit. The reason we can get away with doing this is that a change to this bit will equate to a change of less than 0.4 percent of the red value of pixel. This is way below what the human eye can detect.

Let's look at the script now, then we will go through how it works later on:

  #!/usr/bin/env python

from PIL import Image

def Hide_message(carrier, message, outfile):
    c_image = Image.open(carrier)
    hide = Image.open(message)
    hide = hide.resize(c_image.size)
    hide = hide.convert('1')
    out = Image.new('RGB', c_image.size)

    width, height = c_image.size

    new_array = []

    for h in range(height):
        for w in range(width):
            ip = c_image.getpixel((w,h))
            hp = hide.getpixel((w,h))
            if hp == 0: 
                newred = ip[0] & 254
            else: 
                newred = ip[0] | 1

            new_array.append((newred, ip[1], ip[2]))

    out.putdata(new_array)
    out.save(outfile)
    print "Steg image saved to " + outfile

Hide_message('carrier.png', 'message.png', 'outfile.png')

How it works…

First, we import the Image module from PIL:

from PIL import Image

Then, we create our Hide_message function:

def Hide_message(carrier, message, outfile):

This function takes three parameters, which are as follows:

  • carrier: This is the filename of the image that we are using to hide our other image in
  • message: This is the filename of the image that we are going to hide
  • outfile: This is the name of the new file that will be generated by our function

Next, we open the carrier and message images:

c_image = Image.open(carrier)
hide = Image.open(message)

We then manipulate the image that we are going to hide so that it's the same size (width and height) as our carrier image. We also convert the image that we are going to hide into pure black and white. This is done by setting the image's mode to 1:

hide = hide.resize(c_image.size)
hide = hide.convert('1')

Next, we create a new image and we set the image mode to be RGB and the size to be that of the carrier image. We create two variables to hold the values of the carrier images width and height and we setup an array; this array will hold our new pixel values that we will eventually save into the new image, as shown here:

out = Image.new('RGB', c_image.size)

width, height = c_image.size

new_array = []

Next comes the main part of our function. We need to get the value of the pixel we want to hide. If it's a black pixel, then we will set the LSB of the carriers red pixel to 0, if it's white then we need to set it to 1. We can easily do this by using bitwise operations that uses a mask. If we want to set the LSB to 0 we can AND the value with 254, or if we want to set the value to 1 we can OR the value with 1.

We loop through all the pixels in the image, and once we have our newred values, we append these along with the original green and blue values into our new_array:

    for h in range(height):
        for w in range(width):
            ip = c_image.getpixel((w,h))
            hp = hide.getpixel((w,h))
            if hp == 0: 
                newred = ip[0] & 254
            else: 
                newred = ip[0] | 1

            new_array.append((newred, ip[1], ip[2]))

    out.putdata(new_array)
    out.save(outfile)
    print "Steg image saved to " + outfile

At the end of the function, we use the putdata method to add our array of new pixel values into the new image and then save the file using the filename specified by outfile.

It should be noted that you must save the image as a PNG file. This is an important step as PNG is a lossless algorithm. If you were to save the image as a JPEG for instance, the LSB values won't be maintained as the compression algorithm that JPEG uses will change the values we specified.

There's more…

We have used the Red values LSB for hiding our image in this recipe; however, you could have used any of the RGB values, or even all three. Some methods of steganography will split 8 bits across multiple pixels so that each bit will be split across RGBRGBRG, and so on. Naturally, if you want to use this method, your carrier image will need to be considerably larger than the message you want to hide.

See also

So, we now have a way of hiding our image. In the following recipe, we will look at extracting that message.