Application Specific Vulnerabilities

A specific application can be anything from a video game to a web server. Masters can write these
programs or they could be written by amateurs, one is never quite sure. For every operating system there is
a user with a different set of needs, so application vulnerabilities typically don’t affect everybody.
However, this doesn’t mean millions of people still cannot be effected (consider a flaw in Microsoft
Internet Explorer, and how many people that would effect.)
Flaws in applications, like flaws in operating systems, are of the highest speed of execution but require a
more personalized touch than does straight operating system vulnerabilities. Sometimes the flaw might not
manifest itself until a condition of use occurs, making actual automation difficult. However, the critical
interaction required by the attacker is locating specifically which computers run the targeted application.
Here is an example of an application (in this case, the LARN game that comes bundled with many versions
of the BSD operating system), programmed accidentally with a vulnerability, that allows administrator
access to the host.
Sample Vulnerability [LARN bug, Discoverer: Snocrash, BSD 4.4]
          If a person scores 263 point in larn, it causes the system to
          mail the user. The process of mailing the user causes a
          potential IFS vulnerability which can be used to exploit root
          access.
This attack is not “instant” although this particular example was meant to show that non-automated
situations do exist. Keep in mind that the Vulnerability Map is an approximation of expected time and
interaction.

download free vulnerability book

w3af: Better, Stronger, Faster

w3af: Better, Stronger, Faster: "

Since our latest release back in November, the w3af team has focused on making the framework better, stronger and faster. By downloading this release you’ll be able to enjoy new vulnerability checks, more stable code and a about 15% performance boost in the overall speed of your scan. Here’s what’s new:

• Now using bloom filters instead of sqlite3 databases, which are persistent on disk, effectively increasing scan performance by about 15%!


• Fixed most of the bugs that cause w3afMustStopExceptions and wrote debugging code to allow us to identify the remaining ones.


• Based on many community requests we’ve updated our XML output plugin and wrote an XSD file to help other tools parse the output from our scanner.


• Added new plugin to measure the number of hops for port 80 vs 443 and perform a comparison. Which is useful to identify load balancers, reverse proxies and any other network appliances.

On top of that, we’ve also worked on writing unit tests and a continuous integration system that we’ll use for testing our code each night. When we complete this task, we’ll be able to deliver high quality code on each release, with fewer bugs and no regressions.

As usual, you can find the download link on the w3af.com website, where you’re going to be able to find videos, users’ guide and much more.

"

Today Is The Day You Become A Man: Hand-Welded AT-AT Available For $450

Today Is The Day You Become A Man: Hand-Welded AT-AT Available For $450: "Conceptually, this AT-AT made of old computer parts is amazing. Its well-detailed, includes real battle scarring, and it looks like it could stand in for one of the AT-ATs in the second Star Wars movie, The Wrath of Kahn. Practically, however, I worry that this $450 model available now on Etsy in a limited edition of 1 is really a make or break situation for a collector. Do you buy this and accept that you will no longer see a member of the opposite sex in the nude? Or do you let it go, secure in the knowledge that one day your offspring will drive their own AT-ATs throu"

Found User Information:

It is a real fun to find user’s information over the net.
However, it is not so easy to find them. One has to really dig very deep and do
a lot of experiments for the same. The techniques defined here gives just a
primary idea about how to go ahead if one is interested in finding such
information.

backlink list

* http://www.imtalk.org/cmps_index.php?pageid=IMT-Website-Submitter
* http://verifiedfile.com/seo/
* http://www.websolhosting.com/free-instant-backlinks.php
* http://backlinks.itamer.com/index.php
* http://seo.woothy.com/index.php
* http://www.freesitescripts.com/
* http://www.totalping.com/

install aircrack on ubuntu 10.04

INSTALLING AIRCRACK-NG + AIROSCRIPT-NG + AIRDROP-NG + AIRGRAPH-NG ON UBUNTU

If present, remove and delete the old directory, before continuing
- If you have installed Aircrack-ng from Repository use Synaptic

Code:

sudo apt-get remove --purge aircrack-ng

- If you have installed Aircrack-ng from source code (SVN version):

Code:

cd ~/aircrack-ng
sudo make uninstall
cd
rm -rf aircrack-ng

Update your OS and install these ESSENTIAL and recommended package BEFORE proceeding

Code:

sudo dpkg --configure -a && sudo apt-get install -f && sudo apt-get update

Code:

Types of Viruses

Introduction

There are thousands of viruses, and new ones are discovered every day. It is difficult to come up with a generic explanation of how viruses work, since they all have variations in the way they infect or the way they spread. So instead, we'll take some broad categories that are commonly used to describe various types of virus.

File Viruses (Parasitic Viruses)

File viruses are pieces of code that attach themselves to executable files, driver files or compressed files, and are activated when the host program is run. After activation, the virus may spread itself by attaching itself to other programs in the system, and also carry out the malevolent activity it was programmed for. Most file viruses spread by loading themselves in system memory and looking for any other programs located on the drive. If it finds one, it modifies the program's code so that it contains and activates the virus the next time it's run. It keeps doing this over and over until it spreads across the system, and possibly to other systems that the infected program may be shared with. Besides spreading themselves, these viruses also carry some type of destructive constituent that can be activated immediately or by a particular 'trigger'. The trigger could be a specific date, or the number of times the virus has been replicated, or anything equally trivial. Some examples of file viruses are Randex, Meve and MrKlunky.

Boot Sector Viruses

A boot sector virus affects the boot sector of a hard disk, which is a very crucial part. The boot sector is where all information about the drive is stored, along with a program that makes it possible for the operating system to boot up. By inserting its code into the boot sector, a virus guarantees that it loads into memory during every boot sequence.

A boot virus does not affect files; instead, it affects the disks that contain them. Perhaps this is the reason for their downfall. During the days when programs were carried around on floppies, the boot sector viruses used to spread like wildfire. However, with the CD-ROM revolution, it became impossible to infect pre-written data on a CD, which eventually stopped such viruses from spreading. Though boot viruses still exist, they are rare compared to new age malicious software. Another reason why they're not so prevalent is that operating systems today protect the boot sector, which makes it difficult for them to thrive. Examples of boot viruses are Polyboot.B and AntiEXE.

Multipartite Viruses

Multipartite viruses are a combination of boot sector viruses and file viruses. These viruses come in through infected media and reside in memory. They then move on to the boot sector of the hard drive. From there, the virus infects executable files on the hard drive and spreads across the system. There aren't too many multipartite viruses in existence today, but in their heyday, they accounted for some major problems due to their capacity to combine different infection techniques. A significantly famous multipartite virus is Ywinz.

Macro Viruses

Macro viruses infect files that are created using certain applications or programs that contain macros. These include Microsoft Office documents such as Word documents, Excel spreadsheets, PowerPoint presentations, Access databases, and other similar application files such as Corel Draw, AmiPro, etc. Since macro viruses are written in the language of the application, and not in that of the operating system, they are known to be platform-independent they can spread between Windows, Mac, and any other system, so long as they're running the required application. With the ever-increasing capabilities of macro languages in applications, and the possibility of infections spreading over networks, these viruses are major threats.

The first macro virus was written for Microsoft Word and was discovered back in August 1995. Today, there are thousands of macro viruses in existence-some examples are Relax, Melissa.A and Bablas.

Network Viruses

This kind of virus is proficient in quickly spreading across a Local Area Network (LAN) or even over the Internet. Usually, it propagates through shared resources, such as shared drives and folders. Once it infects a new system, it searches for potential targets by searching the network for other vulnerable systems. Once a new vulnerable system is found, the network virus infects the other system, and thus spreads over the network. Some of the most notorious network viruses are Nimda and SQLSlammer.

E-mail Viruses

An e-mail virus could be a form of a macro virus that spreads itself to all the contacts located in the host's email address book. If any of the e-mail recipients open the attachment of the infected mail, it spreads to the new host's address book contacts, and then proceeds to send itself to all those contacts as well. These days, e-mail viruses can infect hosts even if the infected e-mail is previewed in a mail client. One of the most common and destructive e-mail viruses is the ILOVEYOU virus.

There are many ways in which a virus can infect or stay dormant on your PC. However, whether active or dormant, it's dangerous to let one loose on your system, and should be dealt with immediately.

Cain and Abel application

The following appendices work to support these endeavors with the Cain and Abel application. Current versions of this application can be located at the author’s site at www.oxid.it.

What you will need:

1. current version of Cain from www.oxid.it

2. Windows 2000 or Windows XPSP1 configured workstation

Getting started:

What is a Virus?

Have you ever ask your self that question befor? well here i am going to show you the basic of what a virus really is. A virus is a piece of code so will try to do wierd actions on your computer. Copy itselfs to diffrent places on the computer is the most commont action it will do. They may attach it self to a spesifc program or spesifc file type. The importent part to a virus is to survive as long as Possible. The writters to the virus want it to stay alive. What a virus will do is try to gain access to the system of the computer to take control over important Functions of the system. This is how a virus will try to stay alive. Some viruses may also try to attack Threats as AV’s disable important functions like “Task Manager” so you can’t turn off the Processes the virus is running in.

google dork

SQLi(SQL-injection)


inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=

Full MySQL injection tutorial

TABLE OF CONTENT:
#INTRO
#WHAT IS DATABASE?
#WHAT IS SQL INJECTION?
#BYPASSING LOGINS
#ACCESSING SECRET DATA
#Checking for vulnerability
#Find the number of columns
#Addressing vulnerable part
#Finding MySQL version
#MySQL 5 or above injection
#MySQL 4 injection
#MODIFYING SITE CONTENT
#SHUTTING DOWN THE MySQL SERVER
#LOADFILE
#MySQL ROOT
#MAJOR MySQL COMMANDS
#FINALIZING THE INJECTION TUTORIAL
#REFERENCES
#SECURITY SITES
#WARGAMEZ SITES
#GREETZ AND SHOUTZ
#THE END

INTRO!!
Greetz to all, I'm PinningYou. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language. Now lets begin our walkthrough of SQL injection.

WHAT IS DATABASE?
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.

WHAT IS SQL INJECTION?
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..

CTD...

MySQL Injection Tutorial BYPASSING LOGINS
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:
SELECT USER from database WHERE username='admin' AND password='pass123'
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.
In this example, the attacker can enter the following user data in the login form:
username: a or 1=1--
password:blank
So, this would make our query as:
SELECT USER from database WHERE username='a' or 1=1-- AND password=''
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.
So our above query becomes:
SELECT USER from database WHERE username='a' or 1=1

Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.
Few such combinations are:
username:' or 1='1 password:' or 1='1
username:' or '1'='1' password:' or '1'='1'
username:or 1=1 password:or 1=1
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..
That's all about bypassing logins.
CTD...

---

ACCESSING SECRET DATA
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.

Sub-section 1:
Checking for vulnerability
Suppose, u got a site:
http://www.site.com/article.php?id=5
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.
So, it is:

Blind SQL Injection tutorial

Let's start with advanced stuff.

I will be using our example

http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1 <--- this is always true

and the page loads normally, that's ok.

now the real test


Simple SQLi Dumper v5.1 [ How To ]

USE THIS TOOL FOR EDUCATION PURPOSE ONLY.
WE ARE NOT RESPONSIBLE OF ANY DAMAGE AND IMPROPERLY USE OF THIS TOOL.
USE IT AT YOUR OWN RISK!!
SSDp coded by Vrs-hCk ( ander[at]antisecurity[dot]org )
SSDp How To by NoGe ( mario[at]antisecurity[dot]org )
[o] what is SSDp?
SSDp is an usefull penetration tool to find bugs, errors or vulnerabilities in MySQL database.