1-866-PLYNT-24
|
The Wonders of Packet Editors
In a recent pen test, the Windows Packet Editor became our unlikely tool of choice to perform a replay attack.
While testing a web application recently, we observed that it was sending a hash value of the password during login. Since a password is hashed to the same value on each login, we guessed that the application would be vulnerable to password replay attacks. But to show this we had to intercept and modify the data. For HTTP traffic, this is generally done using application proxies like Burp Proxy that we discussed a few weeks ago.
However, we could not use Burp Proxy in this application as the application was using a java applet for sending the data to a non HTTP port. The applet was establishing a direct socket connection to the server. The web proxy tool was unable to capture any data as it was not going via the browser, but directly from the applet via the socket. There was no place to configure the applet to send the data via a proxy.
We then took a different approach and decided to use a TCP packet editor such as Windows Packet Editor (WpePro). WpePro allows modification of data at TCP level. Using WpePro one can select a running process from the memory and modify the data sent by it before it reaches the destination.
For testing our application we began by defining a filter in WpePro (filters are defined in WpePro to modify data at TCP level). In the filter the hexadecimal value of an incorrect password was replaced by the value of a correct password. The filter was then applied and WpePro was configured to modify data generated by the applet.
After this, we entered the incorrect password in the application. The applet created a hash of the incorrect password and sent it to the server. But WpePro replaced the hash value of incorrect password with the hash value of correct password as defined in the filter and we logged into the application, proving the application was vulnerable to a real replay attack.
WpePro could be a useful tool for testing thick client applications or web applications which use applets to establish socket connections on non http ports. There’s a lot more about WpePro here.
Plynt provides penetration testing and code review services to clients worldwide. If you are interested, please contact us for a quote. We’ll get back to you within one working day.Add yours.closed for this post.
WPE Pro is a packet sniffing/editing tool which is generally used to hack multiplayer games.
We used it while testing a web application. The password mentioned is the one used by the user to log into the application.
where can i get it?
Can someone send me FAQ to this program on mail ? ;)
sebastian.m@interia.pl
Hi,
My apologies first for replying to the post so late.
'Sup' you can download it from this link
http://www.hypothetic.org/wpeproalpha.zip
A good tutorial on as to how to use it can be read here
when i try to target process i get "DLL injection failed" error :( How to fix this???
Hi Mati,
Check if you have any antivirus program installed on your machine. Most of the antivirus programs classify WpePro as a Trojan software and will prevent it from being properly executed.
You will need to add WpePro to the exclusion list of your antivirus program.
where can i get the source code?
wpe have no send button why?
pls tell me where can i download wpe pro!
thanks
With Wpe Pro you need to create predefined filters and select the target program.
It does not have the functionality which allows a user to intercept and modify data on the fly, therefore it does not have a 'send' button.
The download link is there in an earlier post, not sure if the source code is available.
do you know of any similar to wpe pro programs for packet editing?
thanks to 5 floor.
but the version of WPE has no sending package function.
or I don't find it yet?
i didnt exactly get it ...isit..game id cracker or something ?
Kind of complicated...it is ..tell me can i use them to crack kalonline id's coz basicly i was looking something like that but i m not quite
my problem is..... I CANT TARGET A FILE IT KEEP "DLL INJECTION FAILED"
even i close anti virus it also say... injection failed
Hi,
While using WpePro I did not recieve any DLL Injection errors. So I am not really sure as to what could be the possible reason for its occurence.
You could however ensure the following and check if the error still persists
1) Check that you have downloaded the correct version according to your OS.
2) Add WpePro to the exclusion list of your antivirus.
3) Ensure that the executable file and the dll are in the same directory.
4) Download from a different location to check for corrupt files.
At the moment I am not aware of other similar programs. In case any one else is, would be glad to hear bout it.
This is a very popular hacking tool and most game developers have known of this program and its uses. Most of the games you are playing have Hacking Prevention systems that block DLL injections to their games, there are ways to bypass the system but thats on your own.
There are many forums where you can go to to learn more
www.mpcforum.com
Hope I answered some questions
Where exactly am I to extract these files.
Where exactly am I to extract these files.
Also, The second link (How to use WPE) doesn't work.
God damn you idiots, WPE just edits packets realtime
the only use would be debugging or malicious.
i hav the error in wpe that says"dll injection failed".i hav got no antivirus,all files of wpe r in the same folder n other gamers at the same site r being able 2 use wpe but i cant cuz of the error.plz som1 help me:teenprince@gmail.com
yo i dled it but wenever i click on open, the wpe pro dusnt open? whats wrong?
a decent article ruined by lamers, yes, wpepro can send packets, once you edit the packets you have the option of number of times you wish to send, and at how many intervals.
Can you edit packets of web-based game? How do i know what to change?
Monthly Archives
- September 2008
- August 2008
- July 2008
- May 2008
- April 2008
- March 2008
- January 2008
- December 2007
- November 2007
- April 2007
- March 2007
- February 2007
- January 2007
- August 2006
- July 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
- November 2005
- October 2005
- September 2005
- August 2005
- July 2005
- June 2005
- May 2005
Syndication
You can read full entries of Palisade Blog using an RSS reader. Use this link —
I don't quite comprehend what's really happening... are you saying that WPE can send your password of a game to somewhere?