Nytro

O sa fac eu un update, sa vad cum stau cu timpul. PS: Ma pis pe el de Nessus, sta 2 ore sa isi updateze pluginurile. Am mai adaugat cate ceva. Cred ca va avea vreo 3-3,5 GB dezarhivat.

RSTCore ocupa 90 de MB. Adica 88.1 de MB Am 2 GB de RAM, i-am alocat 1 GB, deci VirtualBox consuma ceva mai mult de 1 GB pe Linux, de aceea apare atat in System Monitor. http://i34.tinypic.com/2mq876o.png Edit: Update: http://i38.tinypic.com/104qlqv.png

Screenshot: http://i35.tinypic.com/1547vbb.png Am pus eu "bliss" pe fundal si am aranjat iconitele

In primul rand, nu inteleg de ce pui atatea intrebari cand se vede ca nu te intereseaza? Server proxy pentru ce, pentru HTTP? http://www.codeguru.com/cpp/i-n/internet/http/article.php/c3383 http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=6762&lngWId=3 http://www.partow.net/programming/tcpproxy/index.html http://www.codeproject.com/KB/IP/howtoproxy.aspx Ceva imi zice ca nu o sa te ocupi de asa ceva, si ca iar vei veni cu cine stie ce intrebare si ne vom pierde timpul cu tine.

Am mai pus eu 3 "oglinzi"

Ai fi surprins sa afli cat de prosti sunt unii credinciosi. Eu plec din start de la ideea ca "este credincios, esti din start mai prost decat mine". Oarecum... Edit: http://home3.paulschou.net/tools/xlate/ Cifra 6 in binar e "110" nu ca in diagrama postata de "KillBOT". Scrieti: "mue" la Text si dati Encode. O sa vedeti forma binara: 0110[B]110[/B]1 01[B]110[/B]101 0[B]110[/B]0101 Deci "mue" contine pe Satanta! Deci cand dati muie, scoateti o bucata de Satana din voi. Deci daca dati mult muie ajungeti calugari.

Fireste, doar sunt gratis. Si tot ce e gratis e bun, chiar daca rugineste in garaj nefiind folosit niciodata...

Atunci ii dam ban baiatului

Primul base64: http://pastebin.com/sXuDLdPK Apoi, acel base64 din ce e in link-ul de mai sus e encryptat cu un xor simplu. Si cred ca dupa aceea se ajunge la sursa originala. In loc de: eval($codelock_decrypter["c"]); Pui si tu: echo $codelock_decrypter["c"]; Si te uiti in sursa paginii rezultate.

Posteaza aici PHP-ul. Dar cel mai probabil e obfuscat, deci va fi destul de greu sa ajungi la sursa propriu-zisa.

Sa fim serios, cel mai bun tutorial de configurare ar fi un manual de limba engleza.

Cine mai comenteaza aiurea la topicurile de "bun venit" are ban. Utilizatorii isi fac o parere gresita din cauza unor ratati ca voi. _|_

Ce nu imi place la Chrome e ca nu prea e customizabil, prea putine setari iti permite sa faci.

Eu nu prea am mai folosit Windows, dar am incercat si IE si imi place cum se misca. IE 7 era cam greoi, dar IE 8 imi place. Cred ca o sa se vada niste diferente intre IE8 si IE9, si asta in bine.

Pai cam asta ar fi probleme. Daca nu e detectabil si pare curat pe virustotal, e posibil sa fie cryptat/bindat. Oricum, majoritatea link-urilor de download contin programele infectate, la asta s-a ajuns cu furtul informational...

Nu aia inseamna sa dai drepturi de autor. Asadar, nu e nevoie sa se specifice pagina de unde au fost luate informatiile, doar daca e vorba de un articol care nu are specificat autorul, sau alte astfel de cazuri.

Nu prea am inteles ce vrei sa zici. Pui ce nume de tabel, ce coloana sau ce fisier vrei tu. Numai sa exista pe server.

Nu o sa contina nici un mecanism de localizare prin GPS. E acelasi lucru ca si cu buletinu: o poza cu tine si alte prostii. Dar e mai "cool", mai "trendy". Nu prea ii inteleg pe analfabetii aia de credinciosi care: "Cipu contine pe Satana!!". Care e legatura intre cipurile astea si Satana?

Baza de date "mysql" impreuna cu tabelele sale exista deja. Apartin serverului MySQL.

Cred ca e vorba de [..] adica [ .. ] si cred ca merge

Programare http://www.codexpert.ro/

Am reparat si "meniul" de emoticoane. Acum nu se mai repeta (primele care apar acolo): Astept aici probleme legate de emoticoane. Nu vreau sa vad alte prostii sau teste aici.

Am votat Mandriva pentru ca asta e distributia pe care o folosesc si care cred ca mi-a placut cel mai mult. Avantaje: KDE (poti alege Gnome la instalare, eu nu suport Gnome), Package Manager care nu iti creaza atatea probleme ca Synaptic (bine, am vrut sa dezinstalez Avahi si imi scotea si Eclipse si multe alte lucruri utile cu care habar nu am ce legatura are), ai acele optiuni ale sale (Configure your computer) de unde poti face multe modificari utile, vine cu o larga gama de pachete, se updateaza singur automat (eu am si upgradat la Spring) si multe altele. Si mi-a mai placut Slackware, care este mai putin user-friendly dar de la care am invatat multe. Imi placea ca steteam logat pe root si faceam ce ma taia capul, mi-am editat toate fisierele de "start-up", faceam ce ma ducea capul, si il facusem sa booteze foarte repede (scosesem sa seteze hardware clock, hostname si multe altele).

MySQL Injection - Simple Load File and Into OutFile | MySQL Injection - Simple Load File and Into OutFile (tutorial) | | Author: MikiSoft ---------------------------------------------------------------- === [ Part 1 - Introduction ] If you know (basic) MySQL Injection, you can read this tutorial... Ok, let's see now what are Load File and Into OutFile. -- What are Load File and Into OutFile? That are syntaxes (used in MySQL Injections). Load File: Reads the file and returns the file contents as a string. Into OutFile: Writes the selected rows to a file. The file is created on the server host, so you must have the file privilege to use this syntax. File to be written cannot be an existing file, which among other things prevents files (such as "/etc/passwd") and database tables from being destroyed. (... from: MySQL.com) Ok, let's begin now! - [ Part 2 - Access to "mysql.user" table and file privileges ] If you are using MySQL Injection method (to hack sites), and before you find target table (and columns), check, if you have access to "mysql.user" table. And you must replace in URL one visible column (i.e. number, that is shown, on page), with (string) "user", to see user name. Let's see our example: http://vulnsite.com/index.php?id=-1+union+all+select+1,user,3,4+from+mysql.user-- In our example, column (number) 2 can be seen on our vulnerable page. If page returns user name, in place where is that visible column (shown) on site, that's good - you have access (to "mysql.user" table), and you can continue to read this tutorial. Don't forget to remember user name that you have seen! In our example that happens (we have access to "mysql.user" table), and we can continue to check now if we have file privileges. You must now replace in URL: "user", with (string) "group_concat(user,0x3a,file_priv)", to check, if you have file privileges on (your) vulnerable site. Here is our example: http://vulnsite.com/index.php?id=-1+union+all+select+1,group_concat(user,0x3a,file_priv),3,4+from+mysql.user-- Now on place, where is that (visible) column shown (i.e. replaced), it lists users and file privileges (in format: User name:File privileges, ...), and you must find user name that you have seen before, and when you find that user name, look on right side (near that user name), and if it writes "Y" (that means Yes), you have file privileges (and you can continue to read this tutorial), otherwise, if it writes "N" (that means No), you haven't file privileges. In our example we have file privileges (of course) - "... ,ouruser:Y, ...". Let's go now to the next part. - [ Part 3 - Using Load File syntax ] Load File is useful when you want to read some (configuration) files (it's like LFI - Local File Inclusion), ex. "/etc/passwd", "/etc/shadow", etc. Syntax is: load_file('FILE') Here is our example - if we want to read "/etc/passwd" file: http://vulnsite.com/index.php?id=-1+union+all+select+1,load_file('/etc/passwd'),3,4+from+mysql.user-- In place where is column (number) 2, it will show (source of) "/etc/passwd" file (on page). Note 1: "../" - means move to directory back. Note 2: If it shows error (when you try to read some file) - it has magic quotes enabled (it add slashes before and after "'" symbols), and you have to (avoid that and) convert file name (i.e. text/string), to Hex or Char (and then remove "'" symbols): For Hex - Always put "0x" (text) before hex string (without any spaces), and that (final) string must not contain (any) spaces(!) ; ex. (Load File - "/etc/passwd":) load_file(0x2f6574632f706173737764) For Char - Usage: char(NUMBERS,NUMBERS,NUMBERS...) ; If you convert string (i.e. text) to Char, and if converted text (to Char) contain spaces (between numbers), you must replace all that spaces with commas(!) ; ex. (Load File - "/etc/passwd":) load_file(char(47,101,116,99,47,112,97,115,115,119,100)) BTW. Here is one translator, i.e. text to Hex and (text to) Char converter: http://home2.paulschou.net/tools/xlate/ That's all for Load File syntax. - [ Part 4 - Using Into OutFile syntax ] Into OutFile is useful when you want to write/make some file (on your vulnerable site/server), ex. make (simple PHP) file, that is vulnerable on RFI (Remote File Inclusion), and then exploit that hole... Syntax is: INTO OUTFILE 'FILE' Note 1: That syntax must be always on end (it's like table)! Ex. ...+INTO+OUTFILE+'/FILE'-- To write (your) text in (your) file (on vulnerable site/server), replace in URL one visible column (i.e. number, that is shown, on page), with (your) text (to be written, in your file), in quotes... Let's see our example - we want to write text "testing" in file "test.txt" (on our vulnerable site/server), in site directory: http://vulnsite.com/index.php?id=-1+union+all+select+1,"testing",3,4+INTO+OUTFILE+'/home/vulnsite/www/test.txt'-- Note 2: If you have two or more visible columns (i.e. numbers, that are shown, on your vulnerable page), you have to replace that columns (i.e. numbers, in URL), with word "null"(!) (If you don't replace, that numbers will be written together with your text in your file, on vulnerable site/server.) In our example, visible columns are - 2 and 3 (and we must do replacing): http://vulnsite.com/index.php?id=-1+union+all+select+1,"testing",null,4+INTO+OUTFILE+'/home/vulnsite/www/test.txt'-- And then, if page loads normally (without any errors), we have successfully made our file (on our vulnerable site/server), and location of our file (on our vulnerable site/server), will be: http://vulnsite.com/test.txt Note 3: If you want to use in (your) text (to be written, in your file) Return/Enter button, just (type your text somewhere - in converter/translator, and) convert it to Hex or Char... Note 4: You must write (i.e. make all your files) into site path, otherwise, Into OutFile syntax won't work. Note 5: If it shows blank (i.e. error, on page), where should be located (your) text (to be written, in your file) - it has magic quotes enabled (it add slashes before and after "'" symbols), and you have to (avoid that and) convert text (i.e. string), to Hex or Char (and then remove "'" symbols) - see above explanation (and link to converter), in (end of) part 3... Warning: Don't convert (your) file name into Hex or Char, otherwise, it won't work (that's only for Into OutFile syntax)! And, if (your) vulnerable site have magic quotes (feature) enabled, Into OutFile syntax will not work. That's all for Into OutFile syntax. - [ Part 5 - End ] That's all about that syntaxes, used in MySQL Injections (with access to "mysql.user" table, of course)... I don't know what else to say, just - GL & HF!!! -- Greetz to (communities): Ljuska.org, MadSpot.org That's all folks! Bye. === @ Exploit-DB

By Victor A. Milokum, Apriorit Inc | 17 Mar 2010 Articolul: http://www.codeproject.com/KB/system/sst-unhook.aspx