When Databases Attack – Finding Data on SQL Servers

When Databases Attack – Finding Data on SQL Servers

Introduction

A few weeks ago I presented a webinar called “When Databases Attack”. It covered some SQL Server database configuration issues that are commonly overlooked and targeted by attackers. For those who are interested it can be viewed HERE. This is a response to some requests for script examples. In this blog I’ll provide a few scripts for finding sensitive data quickly in SQL Server. In the future I’ll provide scripts for other attacks as well.

Finding Sensitive Data
There are a lot of great tools available for finding data quickly on a SQL Server. Some are commercial and some are open source. Most of them can be useful when gathering evidence during PCI penetration tests or when simply trying to determine if sensitive data exists in your database. In this section I’m going to cover how to find and sample data from SQL Servers using my TSQL script, and the Metasploit module based on the script.

TSQL Script – FindDataByKeyword.sql
This script will search through all of the non-default databases on the SQL Server for columns that match the keywords defined in the script and take a sample of the data. For more information please refer to the comments in the script.
Important Note: This script does not require SYSADMIN privileges, and will only return results for databases that the user has access to.

Download the “finddatabykeyword.sql” TSQL script from:

1. https://github.com/nullbind/Metasploit-Modules/blob/master/finddatabykeyword.sql.

Read More

WordPress Asset-Manager PHP File Upload Vulnerability

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'
require 'msf/core/exploit/php_exe'

class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::PhpEXE

Read More

Hacking Apps For Apple iPhone Devices

              iPhone, an apple device with million copies and handed to people for nearly every field. This article focuses on the geeks out there looking for apps which could enhance their abilities and interest in hacking. Here are top 5 hacking apps for apple iPhone devices.

1). iKeyguard keylogger Hacking Apps For Apple iPhone

iKeygaurd Keylogger Hacking apps for Apple iPhone

Read More

Mobile MITM Attack

What is Android?

To get a better understanding of what Android is capable of, we should first get a good handle on what it actually is.

In 2005, Google acquired a little known company called "Android, Inc", which had been developing software for mobile phones. Soon after, Google began filing various patents with a focus on mobile phone technology. This prompted the media to begin speculating that Google was planning on releasing a "G-Phone" to go head-to-head with Apple's immensely popular (and largely unchallenged) iPhone.

But in 2007, rather than announcing a single phone they intended to bring to market, Google brought together a group of some of the most important companies in the mobile industry and created the Open Handset Alliance (OHA), a consortium designed to develop open standards for mobile devices. The OHA revealed that their first product would be an open source mobile OS, called Android, designed to run on the full gambit of mobile devices (phones, tablets, netbooks, etc), rather than an OS tied to a specific piece of hardware (like Apple's iOS). In October of 2008, the HTC Dream (more commonly referred to as the G1) was released and became the first official Android device.

Android is made up of several software layers which are intended to make the OS more modular and easier to develop for. Android is based on the 2.6.x Linux kernel which handles hardware interaction, GNU userspace utilities for low-level system management, and various open source libraries such as OpenGL, SQLite, and FreeType.

Read More

How to Type Special Characters

If you often need to switch between the on-screen Alphabet and Number keyboards just to type a comma in a sentence, then why not check out below to find out more?

While on the Alphabet keyboard:

• , (comma) => touch and hold the Full-stop key (.)
• ' (single quotation mark) => touch and hold the Full-stop key, and slide to choose the single quotation mark (')
• " (double quotation mark) => touch and hold the Full-stop key, and slide to choose the double quotation mark (")
• Turn caps lock on/off => double-tap the Shift key to lock, single-tap to unlock.
• Special letters not on the keyboard? => touch and hold a key, then slide to choose a variation (See the screenshot).
• Need just a digit or symbol from the Number keyboard? => touch the ?123 key and slide to a digit or symbol key, and you're back to the Alphabet keyboard automatically.

Read More

SSH back door

Many times I'll be at a site where I need remote support from someone who is blocked on the outside by a company firewall. Few people realize that if you can get out to the world through a firewall, then it is relatively easy to open a hole so that the world can come into you.
In its crudest form, this is called "poking a hole in the firewall." I'll call it an SSH back door. To use it, you'll need a machine on the Internet that you can use as an intermediary.
In our example, we'll call our machine blackbox.example.com. The machine behind the company firewall is called ginger. Finally, the machine that technical support is on will be called tech. Figure 4 explains how this is set up.

Figure 4. Poking a hole in the firewall

Here's how to proceed:

Read More

Session ID Analysis

In this tutorial we focus on session ID analysis. If you are not familiar with session ID’s I’ll do a quick explanation. HTTP is a stateless protocol, so it’s equivalent to walkie talkies or CB radios. You’ll send a request and wait for a reply, you don’t have a constantly open communication line as you would with a phone. So in order to emulate this open communication the HTTP protocol uses session ID’s, commonly known as cookies. These cookies are simply agreements between you and the web application that you are who you claim to be. Once you have exchanged your cookie with the website you can then talk back and forth as long as the cookie is tied to your communication. So there’s the quick and dirty intro to session ID’s. So the next logical question is how does this session ID process work or even better how should it work? Let’s use a web mail application as an example:

1. You login to your web mail account
2. Your web mail provider sends you a “random” cookie that is tied to your login session
3. Each time you click on a new message within your Inbox your cookie is sent along to validate who you claim to be, that way you’ll get your next message and not another person’s message.

Read More

Speaking Leet : Language of Hackers

To speak leet, you more or less need to un-learn proper english. The history of leet goes back to the early days of online message boards, or forums, where users can post messages to carry on a threaded conversation. In an attempt to “Clean-Up” the language that users would sometimes post, admins added a filtering system to the message board which would replace restricted words with some type of alternative. For example, the word “crap” might become “crud.” It didn’t take people long to figure out that you could get around this filter simply by altering the original word somehow, like changing “crap” to “c-r-a-p” or “krap” or “crrrap.” it was soon obvious that these filtering systems could never possibly cover every variation because people would just keep inventing new ones, and so leet was born.

Read More

How to find or remove the Virus ?

How to find or remove the Virus ?
If you’ve let your guard down–or even if you haven’t–it can be hard to tell if your PC is infected. Here’s what to do if you suspect the worst.
Heard this one before? You must run antivirus software and keep it up to date or else your PC will get infected, you’ll lose all your data, and you’ll incur the wrath of every e-mail buddy you unknowingly infect because of your carelessness.
You know they’re right. Yet for one reason or another, you’re not running antivirus software, or you are but it’s not up to date. Maybe you turned off your virus scanner because it conflicted with another program. Maybe you got tired of upgrading after you bought Norton Antivirus 2001, 2002, and 2003. Or maybe your annual subscription of virus definitions recently expired, and you’ve put off renewing.
It happens. It’s nothing to be ashamed of. But chances are, either you’re infected right now, as we speak, or you will be very soon.

Read More

Resetting Ubuntu 11.10 Password

Hey Guys,
If you’ve forgotten your Ubuntu 11.10 Password you can reset it within minutes. I will tell you two methods to reset your Ubuntu Password. The first one is by booting it in recovery mode and second one is by using any Live OS.

Let’s start with the recovery mode first as it takes less time and easy to do in comparison to the second one method:

Boot up your Ubuntu. Press and Hold ‘Shift’ Key while the machine is booting. You will get the GRUB Menu like this:



Select the second option which is ‘Recovery Mode’ and press Enter. After pressing enter system will start booting and you will get a list of options like this:

Read More

Internet Access In Backtrack Virtual Machine

Hey Guys,
I’ve found that some people are struggling hard to access internet in there backtrack virtual machine from their USB Modem, so today I am going to tell you how you can access internet in your virtual machine by your datacard.
Open Network Adapter Settings ( Run -> ncpa.cpl )
Right Click on your USB Modem Adapter and go to properties.

Read More

Cracking Linux Password when Grub cannot be changed

in the previous post we learnt about cracking Linux Password using the Grub – Dropping to Single User Mode. However, if the Grub is password protected, then this method will not work. So in such cases, we can use the Linux Live CD to crack the Linux Password. Follow the below given steps to change the Linux Password, using the Linux Live CD.

1. Boot your computer from your Linux Live CD, choosing “Try Linux without any change to your computer” from the boot menu.

Read More

BackTrack 5 Released – The Most Advanced Linux Security Distribution & LiveCD

We have of course been following BackTrack since the very early days, way back in 2006 when it was just known as BackTrack – A merger between WHAX and Auditor.  They’ve come a long way and BackTrack is now a very polished and well rounded security distro, most of the others have dropped off the map leaving BackTrack as the giant in the security LiveCD space.
The last major release was BackTrack Final 4 Released – Linux Security Distribution – back in January 2010.

The BackTrack Dev team has worked furiously in the past months on BackTrack 5, code name “revolution” – they released it on May 10th. This new revision has been built from scratch, and boasts several major improvements over all our previous releases. It’s based on Ubuntu Lucid LTS – Kernel 2.6.38, patched with all relevant wireless injection patches. Fully open source and GPL compliant.

Read More

How To Hack Facebook Account Using Wireshark

In this tutorial we will have out look on how you can hack facebook account using wireshark. First of all I must clear you even though you'll get access to victim's account you'll not get his/her password, next this trick will work only on LAN with hub. It will also work on LAN with switch but you'll have to perform ARP poisoning, click on link to know more.
Here surely I 'll not discus how to use wireshark please read our previous tutorials to know how to use wireshark.

For this hack you'll need wireshark which is a packet sniffing tool, Mozilla Firefox web browser and add n edit add-on for Mozilla Firefox. Now I assume you have all above components for hacking facebook and you are connected in a hub based LAN or LAN which has been ARP poisoned. So now click on capture button and start capturing packets.

Read More

SSL And TLS Attacks | SSL Man In The Middle

In our last post we discussed a little about attacking weak ciphers in this post we will have our look on how a Man In The Middle (MITM) attacks can be performed over SSL and TSL encrypted data transfer. The attack uses SSL strip developed by Moxie Marlin Spike with a ARP spoofing tool and a packet sniffer. The attack can be exclusively performed from UNIX and Linux based platforms hence I suggest you to use Dsniff. Practically SSL strip was developed to demonstrate how an attacker can lead visitors to visit his/her site from legitimate site. The attack used misinterpretation of null characters vulnerability which existed in several certificates during 2009.

I think its not good to demonstrate how attack can be performed since Moxie Marlin Spike has already provided a nice tutorial on his own website with a video. 

Read More

Google trick to find private pictures!

Maybe you are a "voyeur".

Maybe you need some pictures for your school work.

Of course you can go to a dedicated website where you can find lot of free pictures.

But you can also dig some private pictures directories.

Try this little code in Google, you may find lot of Non public pictures

 

Quote:

intitle:index.of +"Indexed by Apache::Gallery"

search by adding a word at the end, for example:

Read More

Hack about 80% of every website out there

All right,
You kids need to stop asking for someone else to hack your "friends" forum, your girlfriends myspace page, etc.

You want to learn to hack, stop asking stupid questions.

There is ONE tool, that was created originally to protect from hackers. Unfortunately, it's one of the best friends a hacker will ever have :

It's called Acunetix.

Acunetix is a tool that scans websites for known vulnerabilities. It will list all possible sql, xss, html injections, all java injections, all passwords and database weaknesses, all ftp weaknesses, etc. All form submissions exploits that the website can be targeted with. Remote upload and download vulnerabilities.

Read More

Beaver's SMS Bomber Pro

Features Include:
Full Feature List:
Custom SMTP Server (Make Sure You Type It Right)
Custom Carrier Gateway (If Your Victims Gateway Is Not In The Large List You May Find And Enter it Yourself)
Custom Number Of SMS To Send (Finally Have Where You Can Enter Any Amount To Send)
Save/Load Settings (Will Save Everything You Enter In The Fields, Restarting Your Computer Will Lose The Saved Settings)
Fixed XP GUI Issues
Stop Bombing At Any Time
Watch The Number Of SMS Sent In The Title Bar
No Longer Freezes While Sending
Added A Recent slave's Box Where You Can Select An Entry And Right-Click It To Bomb It Again Or Delete It From The List
Save/Load Recent Victims List

Read More

Use SSH Tunneling to surf net invisibly

Unable to surf net over work/college ? Want to surf net invisibly ? Well,we have a solution for that,SSH Tunneling.An SSH tunnel is an encrypted tunnel created through an SSH protocol connection. SSH tunnels may be used to tunnel unencrypted traffic over a network through an encrypted channel.In easy language,you can surf net without being monitored and even surf blocked sites too.SSH Is pretty awesome.

Without leaving your seat,you have a way to control a computer which ay be located anywhere on this planet.

Read More

Hack Gmail Accounts

Today i will explain you How to hack Gmail account step by step. In my previous article i have explained you the basic technique involved in hacking Gmail account or password but not explained that in extended way but today i will disclose you how the hackers really hack the gmail account or gmail password using fake pages or simply called Phish pages and the technique involved is called Phising.

NOTE: THIS IS FOR EDUCATIONAL PURPOSES ONLY. DON'T MISUSE IT.

 

Read More