Cybers Cafe's: Agustus 2011

Jumat, 12 Agustus 2011

"jsp Webfolder Managment" A new shell and Deface upload exploit

"jFoler, jsp Webfolder Managment" A new shell and Deface upload exploit
Hi Mates !! Hapy holi to evryone checkout holi special post here
zac+efron+2012.jpg (371×230)

so i'm back with a new exploit
its a new remote file upload vulnerability, you can upload your deface page, files and shells on websites, without gaining Admin acess
mostly vulnerable websites for this attacks belongs to China and Tiwan (.cn and .tw)
Dork : www.topronet.com ,All Rights Reserved.Any question, please email me cqq1978@Gmail.com
and
JFoler 1.0 A jsp based web folder management tool by Steven Cee
(its not a Particular dork, please try to modify it and if you sucessfull modified then leave new dork in comment)
Just select any site from search results and now upload your deface page or shell
shell upload : for shell uploading rename your asp shell (shell.asp) to shell.jsp then upload it, you can try .php too, every Extension is allowed but in some sites you can't excute php and asp shell
Path : depends on website
to View your upload file just goto http://www.site.com/yourfilehere
Live Demo :
http://www.coalworld.net/detail/09/10/30/00000006/berk.jsp
http://jangbiya.com/img/upload/jsp.jsp
http://www.shnotary.gov.cn/notarial/UserFiles/Vote/MMYB1330972040320.jsp
http://www.zzb.ks.gov.cn/images/ycjy-yh.gif.jsp
http://www.zjdx.gov.cn/uploads/upload_20091128_162444_fcktemplates.jsp
Results : http://www.coalworld.net/backlinks.html

Rabu, 10 Agustus 2011

How to Hack IIS Exploit websites : The Most Easiest way of Website Hacking

In Internet Information Server Exploit website we can upload the Defaced page on the Vulnerable Server without any User Name or Password. It is most Easiest way to Website Hacking.

STEP 1: Click on Start button and open "RUN".

STEP 2: Now Type this in RUN

%WINDIR%\EXPLORER.EXE ,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{BDEADF00-C265-11d0-BCED-00A0C90AB50F}

Now A Folder named "Web Folders" will open.

STEP 3: Now "Right-Click" in the folder and Goto "New" and then "Web Folder".

STEP 4: Now type the name of the Vulnerable site in this. e.g." http://autoqingdao.com/ " and click "Next".

STEP 5: Now Click on "Finish"

STEP 6: Now the folder will appear. You can open it and put any deface page or anything.

STEP 7: I put text file in that folder. Named "securityalert.txt" (you can put a shell or HTML file also). If the file appear in the folder then the Hack is successful but if it don't then the site is not Vulnerable.

Now to view the uploaded site i will go to "http://autoqingdao.com/securityalert.txt"
In your case it will be " www.[sitename].com/[file name that you uploaded] "

Some IIS Exploit Websites For Practise

Senin, 08 Agustus 2011

TinyFileBrowser ~ Remote file Upload Vulnerability

Title : TinyFileBrowser ~ Remote file Upload Vulnerability
Google Dork : "inurl:tinybrowser/upload.php"

Lets Start : Open google.com/ncr or you country dOmain like Google.co.in and enter This dork
"inurl:tinybrowser/upload.php"

Vulnerable website's title will TinyBrowser :: Upload in search results
and in sOme sites it will show you website directory in title :)
click on Vulnerable website only ... igNore sOme extra results

Now You'll Got a page Like this image

For uploading Your files click on upload ... and click on browse to view Your Uploaded File :)

you can upload [.html],[.txt],[.jpg],[.gif],[.bmp] [.php not allowed] but atleast you can try as

php.jpg :P ... but in sOme websites you can upload images and txt file Only .. but

dont worry ... u can notify your deface as image or text file :D

Must levae a comment if you like this Post :)

"Nothing is impossible in this world even Nobody is Perfect "

Sabtu, 06 Agustus 2011

paw is a Vunerablity, you Can Upload your deface & Shell Easily in Vunerable websites

Lets Start

open www.google.com
enter The Dork inurl:"spaw2/dialogs/"
or
inurl:"spaw2/uploads/files/"
You will Got results Like this "Index of/ spaw2/dialogs/"
or : site.com/abc/spaw2/uploads/files/abc/abc.pdf

Now replace The Spaw2/Uploads/abc/abc ur with this url

for example i got this website
so Now i will replcae

with
Now the URL is

Now you will Got a window like this (click to see)

if you want to Upload deface page then Select files option ... and i f you want to upload shell then select image option and upload your shell as shell.php;,jpg
see You uploaded deface here

www.site.com/profile/spaw2/uploads/

comment here if any prOblem

Rabu, 03 Agustus 2011

'preventing sql injections'

Hi Guys !
here, this is a quick tutorial on 'preventing sql injections', don't wrry if u don't know php, this is php friendly :)

There are usually two types of attacks :

1. URL based
2. Form based

Major reason for both of them is 'badly architectured parametres'
many say That remove/rename or unlink the database configuration file, ofcourse this will work but this is NOT the solution, as it will halt the functionality of the site, your
Dynamic website will turn into just html pages in seconds, this is anologus to condition like, because of fear of robbery you don't buy anything for yourself too: P
what we will be doing is sanitizing and validating php variables, we have make sure That our critical global arrays like get, post, files, session, cookies etc allow data which we
Want them to store and nothing else, because we can't trust the fact that users will enter expected data. What we mean is suppose you have site script like this:

blabla.com/news.php?id=8

Now what dis means is, in our "news.php" script (in global GET array) we have an array location $_GET[id] which contains the value which is being passed via URL,
In our case it is '8', what usually careless admins do is, pass on the get[] as it is to the database query which is to be executed so that proper content for id=8
Can be extracted from database and thrown on the user screen, SQL query can be like :

$news_query = "SELECT * FROM news WHERE NEWS ='".$_GET['id']."'";

Now if we manipulate the URL and write 'something' in place of 'expected' integer then we may break normal query and can execute our own queries!
by breaking a query i mean, as in the above example we wrote

NEWS ='$_GET[id]'

if instead of expected id we write something like ==> 8'; eval_query; #
now what our new url is ==> blabla.com/news.php?id=8'; eval_query; #
our new query becomes ==> $news_query = "SELECT * FROM news WHERE NEWS ='8'; eval_query; #';
# is used to comment out query part after it, so now as u can see our "eval query" will be executed with normal expected query, eval query can be { DROP TABLE news} which will drop the "news"!
we can prevent this if instead of directly using get[] variable in query we first validate them and then use them, by validating I mean, we make sure that URL variables contains
only that data which we want them to store and nothing else (in this case, we want integers for id values), this depend on the programming of the script, we may sometimes want alphabets(lower case or upper case or both),
numbers, some special characters etc . . . php gives us some function to do the same :
in this case we can use "preg_replace" or maybe 'ereg_replace', i advertise preg_replace cause it has lot more functionality and is faster than ereg :) [you can search php.net if you want details about them]
so here we want only numbers in id fiels so we wil add this line before querying it :

$id = $_GET['id'];
$vald_id = preg_replace('#[^0-9]#i', '', $id);

first line is getting id variable from url via get and storing it in local variable $id, next we are cleaning it using preg_replace, so that it only contains numbers from 0-9 (if anything else is there it will replace it with a blank.space) and nothing else, we will use this cleaned variable
$vald_id in our query.
if we want some(defined) special characters along with alphabets we can write (in place of [^0-9]) :

preg_replace('#[^A-Za-z,.?$@!]#i', '', $id);

Now how to patch panels/forms of sites against sql
suppose there is an admin panel say
blabla.com/admin/
hit [ctrl+u] view source, crawl source and search for [action=], cause every html form will be processin and submitting form elements using php scripts, if its written something like
action="<?php echo $PHP_SELF;?>" ==> this means php script is calling itself and its processing is done in same script
if instead there ist written :
action="login.php" [it can also call lol.php dosn't matter :P]
this means all form data goes to login.php processed there and then sent to database. Main culprit is login.php because it is not filtering variables correcty!
go to login.php, it wil be having lines looking like
$username = $_POST['user'];
$pass=$_POST['pass'];
$loginquery = "SELECT * FROM tbl_admin WHERE username ='$username' AND password = '$pass'";
$result = mysql_query($loginquery);
so we need to clean POST array elements before using them in a query

we will use preg_replace as before and we will also use
strip_tags as we don't want any html javascript elements in our form data,
basic syntax is ==> strip_tags($variable)
if you want to allow certain tags like <br> then we can also do that as ==> strip_tags($var, '<br>')
i intended to make a short tut but i failed :p hope you

Senin, 01 Agustus 2011

Cpanel Cracking

Today we will Learn CPANEL cracking or Hacking i.e gaining password for port no 2082 on website first of all we need a cpanel cracking shell on the server because we are going to crack those websites cpanels which are hosted on the shelled server.

so lets start i am using cpanel.php [download it here]shell for cracking :) we need two things in cracking first one is usernames of the websites that are hosted on the server second is a good password dictonery [Get Passwords List Here]

so

 in first step :-
 grab the usernames of the websites using command ls /var/mail
 or use the "Grab the usernames from /etc/passwd" option in the shell

press the go button
  we have done from our side
  lets wait and watch ,if we have supplied good passwords then shell will show a message 
   " [~]# cracking success with username "xyz" with password "xyz"   "
  otherwise it will show 
   "[~] Please put some good passwords to crack username "xyz" :( "

  so chances of success depends on password list that we are using in cracking process

[GUEST POST]

Credits To z3r0 c00l and Team Indishell

Cybers Cafe's