After the research on SSL certificate grading on banks in Hong Kong, I am going to do another research on banks in Hong Kong to see what services they are running with, such as web server or protection. I am based on the List of banks in Hong Kong for the test. The standard site URL and personal online banking URL have been tested for the purpose. The web application vulnerability testing is not in the scope. The test is carried out on April 20, 2016.



DBS Bank (Hong Kong) 星展銀行(香港) and Standard Chartered Bank (Hong Kong) 渣打銀行 are running with Akamai which provides DDoS/DoS protection to their clients. Meanwhile, Akamai also provides Web Application Firewall (WAF) to their clients. WAF can protect the web applications from being attacked by SQLi, XSS, CSRF and etc, even the web applications have these kind of vulnerabilities. I will not discuss about the WAF bypass here. Anyway, WAF can do the job well in general speaking.



Public Bank (Hong Kong) 大眾銀行(香港) and Chong Hing Bank 創興銀行 are running with G2 Web Services which is also considered to provide secure services.



It seems that almost all the bank websites in Hong Kong are protected by firewall or/and WAF as I cannot fetch any information from some of the sites during the test. It does not mean that the sites that I can fetch information are not protected by firewall or/and WAF.



In conclusion, I am sure that DBS Bank (Hong Kong) 星展銀行(香港) and Standard Chartered Bank (Hong Kong) 渣打銀行 cannot be DDoS/DoS.



With reference to my previous research on SSL certificate, DBS Bank (Hong Kong) 星展銀行(香港) is the most secure bank in Hong Kong at the time of this writing. Their IT department is doing a great job on security. If their IT department can implement HPKP on the SSL certificate, it will be very great. Anyway, congratulations!



REFERENCE



The Personal Online Banking URL :



Bank of China (Hong Kong) 中國銀行(香港)

- Personal Customers - https://its.bochk.com/login/ibs_lgn_index_e.jsp

- System Details - Powered by: Servlet/3.0



Dah Sing Bank 大新銀行

- ebanking Personal - https://www.dahsing.com/eBank/jsp/login/ebank_id_login_frm.jsp

- System Details - Running on: Microsoft-IIS/7.5 and Powered by: ASP.NET



DBS Bank (Hong Kong) 星展銀行(香港)

- iBanking - https://internet-banking.hk.dbs.com/IB/Welcome

- System Details - Running on: AkamaiGHost



Public Bank (Hong Kong) 大眾銀行(香港)

- Net Banking - https://ebank.publicbank.com.hk/index0028.html

- System Details - Running on: G2



Shanghai Commercial Bank 上海商業銀行

- Personal Internet Banking - https://www.shacombank.com.hk/ibanking/servlet/com.ibm.dse.cs.servlet.CSEstablishSessionServlet/customer/en_US

- System Details - Running on: IBM_HTTP_Server



Standard Chartered Bank (Hong Kong) 渣打銀行

- Online Banking - https://ibank.standardchartered.com.hk/nfs/login.htm?lang=en_US

- System Details - Running on: AkamaiGHost



Wing Lung Bank 永隆銀行

- Personal Net Banking - https://www.winglungbank.com/EnNbMainR.html

- System Details - Running on: IBM_HTTP_Server



* The banks that not in the list are not getting any information during the test.





The standard site URL :



China CITIC Bank International 中信銀行國際

- http://www.cncbinternational.com/home/en/index.jsp

- System Details - Powered by: Servlet/2.5



Chong Hing Bank 創興銀行

- http://www.chbank.com/en/index.shtml

- System Details - Running on: G2



Dah Sing Bank 大新銀行

- http://www.dahsing.com/en/html/index.html

- System Details - Running on: Microsoft-IIS/7.5 and Powered by: ASP.NET



DBS Bank (Hong Kong) 星展銀行(香港)

- https://www.dbs.com.hk/index/default.page

- System Details - Running on: AkamaiGHost



Fubon Bank (Hong Kong) 富邦銀行(香港)

- http://www.fubonbank.com.hk/web/html/index_e.html

- System Details - Powered by: Servlet/3.0



Industrial and Commercial Bank of China (Asia) 工銀亞洲

- http://www.icbcasia.com/ICBC/%E6%B5%B7%E5%A4%96%E5%88%86%E8%A1%8C/%E5%B7%A5%E9%93%B6%E4%BA%9A%E6%B4%B2/EN/

- System Details - Running on: Microsoft-IIS/7.5 and Powered by: ASP.NET



Public Bank (Hong Kong) 大眾銀行(香港)

- http://www.publicbank.com.hk/en/home

- System Details - Running on: G2



Shanghai Commercial Bank 上海商業銀行

- http://www.shacombank.com.hk/eng/personal/index.jsp

- System Details - Running on: IBM_HTTP_Server



Standard Chartered Bank (Hong Kong) 渣打銀行

- https://www.sc.com/hk/

- System Details - Running on: AkamaiGHost



Wing Lung Bank 永隆銀行

- http://www.winglungbank.com/wlb_corporate/en/index.html

- System Details - Running on: IBM_HTTP_Server



* The banks that not in the list are not getting any information during the test.



That's all! See you.

UFONet - is a tool designed to launch DDoS attacks against a target, using 'Open Redirect' vectors on third party web applications, like botnet.

See this links for more info:
- CWE-601:Open Redirect
- OWASP:URL Redirector Abuse


Main features:

--version             show program's version number and exit
  -v, --verbose         active verbose on requests
  --check-tor           check to see if Tor is used properly
  --update              check for latest stable version

  *Configure Request(s)*:
    --proxy=PROXY       Use proxy server (tor: http://localhost:8118)
    --user-agent=AGENT  Use another HTTP User-Agent header (default SPOOFED)
    --referer=REFERER   Use another HTTP Referer header (default SPOOFED)
    --host=HOST         Use another HTTP Host header (default NONE)
    --xforw             Set your HTTP X-Forwarded-For with random IP values
    --xclient           Set your HTTP X-Client-IP with random IP values
    --timeout=TIMEOUT   Select your timeout (default 30)
    --retries=RETRIES   Retries when the connection timeouts (default 1)
    --delay=DELAY       Delay in seconds between each HTTP request (default 0)

  *Manage Botnet*:
    -s SEARCH           Search 'zombies' on google (ex: -s 'proxy.php?url=')
    --sn=NUM_RESULTS    Set max number of result to search (default 10)
    -t TEST             Test list of web 'zombie' servers (ex: -t zombies.txt)

  *Configure Attack(s)*:
    -r ROUNDS           Set number of 'rounds' for the attack (default: 1)
    -b PLACE            Set a place to 'bit' on target (ex: -b /path/big.jpg)
    -a TARGET           Start a Web DDoS attack (ex: -a http(s)://target.com)

Serangan DDoS bisa dilakukan dengan beberapa tools untuk DDoS seperti LOIC, Hulk DDoSser, dsb. Nah saya akan tunjukkan cara melakukan DDoS menggunakan HOIC (High Octane Ion Cannon)

1. Anda bisa download terlebih dahulu toolsnya disini

Berikut tampilan dari HOIC












2. Buka file yang habis di download dan klik 2x pada HOIC.exe

3. Lalu klik tanda + pada bagian bawah TARGETS

4. Pada kolom URL masukkan url/link dari target. Contoh: http://www.google.com

5. Ubah power menjadi high

6. Bagian booster kosongi saja jika tidak tahu fungsinya, langsung klik "add"
7. Ubah THREADS-nya menjadi 5

8. Terakhir klik 1x pada target dan klik "FIRE TEH LAZER!"

Tunggu proses DDoS minimal 1 jam sampai target anda benar - benar DOWN. Untuk mengecek target sudah down atau belum bisa dicheck di sini. Selama proses DDoS berlangsung, komputer yang anda gunakan akan lelet, tapi itu normal dalam proses DDoS

Saran > Sebaiknya untuk melakukan serangan DDoS ini dilakukan bersama sama dengan tim anda untuk mensukseskan aksi DDoS. Makin banyak orang yang melakukan DDoS secara serempak, semakin mudah target down.Di harapkan pakai HIDE IP ADDRES supaya aman 

• HTTP DDoS with valid requests
• HTTP DDoS with invalid requests (similar to a DC++ attack)
• SMTP DDoS
• TCP connection flood on random port

Bahan :
=>Perl >> D0wnl04d <<

Usage

USAGE: ./goldeneye.py  [OPTIONS]

 OPTIONS:
     Flag           Description                     Default
     -t, --threads      Number of concurrent threads                (default: 500)
     -m, --method       HTTP Method to use 'get' or 'post'  or 'random'         (default: get)
     -d, --debug        Enable Debug Mode [more verbose output]         (default: False)
     -h, --help     Shows this help

Changelog v2.0

• 2013-03-26 Changed from threading to multiprocessing. Threading is bad because its subject to GIL.
• 2012-12-09 Initial release

• Added error handler in GetCookie().
• Added new services into lists of zombies.
• Removed non-working services from lists of zombies.

Usage
1. Start the program: davoset.pl
2. Enter URL of the site to attack: Site: http://site
3. Get the site attacked via your list of zombie-servers.
Or from command line:

perl davoset.pl u=http://site
perl davoset.pl u=http://site l=list.txt m=1 c=100