Dark Web Update: OpenBullet Credential Stuffing Configuration Leaks on Cracking Forum

Dark Web Update: OpenBullet Credential Stuffing Configurations Leaks on Cracking Forum

On or around April 20, 2020, Cracked forum user r0x posted in Configs/OpenBullet forum of cracked[.]to a direct download link to 750 OpenBullet configurations. A few days after that, Cracked forum user Arnab leaked 4615 OpenBullet configurations. OpenBullet is an open-source web application testing tool similar to Burp Suite. The users of Cracked modded OpenBullet in order to have private configurations for Cracked users. Although the modded version claims it should not be used for DDoS or credential stuffing, almost all of these configurations are used for credential stuffing against online platforms.

Recommendations

• If you find your organization in one of the leaked configurations, reach out to [email protected] to connect with an analyst to receive the configuration
• Consider building signatures in your firewall, WAF or logging solution to detect when attackers are trying to use these configurations against your applications
• Consider enabling additional dark web coverage to find mentions of your brand on the dark web

Details

OpenBullet is ".. a webtesting suite that allows to perform requests towards a target webapp and offers a lot of tools to work with the results. This software can be used for scraping and parsing data, automated pentesting, unit testing through selenium and much more". This software is an open source alternative to the widely-used web app pentesting framework BurpSuite. Users can download this software and modify web requests and responses as they travel to a web server to test various security vulnerabilities against the target web server.

In August of 2019, Cracked[.]to moderator ForlaxPy released a mod for OpenBullet. The purpose of this mod is to allow the Cracked community to share OpenBullet configurations with each other, as well as for the forum to make money off the mod by selling Authorization keys for the software.

Figure 1: Post by ForlaxPy for the Cracked OpenBullet mod

Although ForlaxPy says it is illegal to use this mod for credential stuffing and DDoS, he goes on to mention how users of Cracked can use this mod for checkers. Checker software is a term used by cybercriminals when identifying ways to check the validity of credentials against a target endpoint. The workflow to use this tool is to acquire combolists or data breaches, which contain username and password configurations, and then programmatically “check” the target login endpoint to see how many accounts within the list are valid credentials. Afterward, cybercriminals can use the account personally or sell access to others. As of 27 April 2020, there are over 357 pages of replies to ForlaxPy's post, which enables users to see the hidden content to download the software.

Cracked has a whole subforum dedicated to OpenBullet and the Cracked mod. On or around April 20, 2020, Cracked forum user r0x dumped approximately 750 OpenBullet configurations. r0x is a regular of Cracked and has over 156 posts in 2 years on the website. The user also links their own website for buying configs, located at www.cracking[.]zone.

Figure 2: Post by r0x advertising the dump

Once users reply to his post, they are presented with a direct download link to the dump and they can begin to use the configurations immediately.

On April 23 2020, Cracked forum user Arnab dumped a larger list of configurations, totaling 4,614 files.

Figure 3: Post by Arnab advertising the dump

Arnab is also a regular of Cracked and has over 100 posts in 2 years on the website.

ZeroFOX Alpha Team obtained both dumps to analyze the configurations. Arnab’s dump contained all but 4 OpenBullet configurations that were dumped by r0x. Most of the configurations that were dumped are clearly designed for credential stuffing checks. For example, a simple grep for password of all the files yielded 4461 matches, while a grep for password= parameter yielded 1421 results.

Many of these configurations have signatures that can be used for detection mechanisms. For starters, order of headers, parameters and the uniqueness of values to these parameters or headers can help identify someone performing credential stuffing.

For the full list of affected endpoints, applications or companies, refer to our posted Github Gist.