Today i will show you how to make your own software as a installer so watch this and feel free to comment........
Read more...
Software Installer by Pak Defender from Anonymous Ghost on Vimeo.
Thursday 30 October 2014
How to Install Wordpress On Xammp....
Today I will show you how to install wordpress on xampp watch this and feel free to comment.......
Read more...
Sunday 26 October 2014
How to Find Injection Point FOR SQL Injection......
Hello Guys .....Today i will tell you how to find injection point for sqli in a simple trick and you can easily inject ....
Please every Injectors must comments there methods here which i will ask now
Please every injectors mention there methods to find out
Injection Point in the website[SQLI]
MY methods --->
1. inurl:.php?id= site:www.sitename.com
2.site:www.sitename.com "php?"
Sometimes i use this =>
site:www.target.com php
site:www.sitename.com .php? / .php?id=
Inurl.php?whatever= site:in
ip:127.0.0.7 "php?id"
site:example.com id
site:"*.site.com" inurl:"php?"
site:target.com ".php?id="
site.com/robots.txt
sometimes search fields
This is purely for Educational purpose only. Don’t use it for illegal.if you do, you will be in jail.
Saturday 18 October 2014
BASIC CSRF (CROSS SITE REQUEST FORGERY) TUTORIAL
This tutorial will explain how to perform A Basic Cross Site Request Forgery Attack (CSRF).
So let's start the tutorial,
What is CSRF Attack?
Read more...
So let's start the tutorial,
What is CSRF Attack?
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.
source: owasp
...
Requirements to practice.
source: owasp
...
Requirements to practice.
1. Brain
2. Browser
3. Burp Suite (Regular or Professional, both will work)
...
If you don't have Burp Suite, Download it from
http://portswigger.net/burp/
I won't cover How to set up Burp Suite,
the following is the link to an awesome tut to setup Burp.
2. Browser
3. Burp Suite (Regular or Professional, both will work)
...
If you don't have Burp Suite, Download it from
http://portswigger.net/burp/
I won't cover How to set up Burp Suite,
the following is the link to an awesome tut to setup Burp.
http://portswigger.net/burp/tutorials/
...
Let's Start!
...
You have now configured Burp Suite,
Just Start it,
Turn off the Intercept for now.
...
Open Firefox or any other browser,
go to Router Default Gateway:
in mine case it is
http://192.168.1.1/
you will be asked for username and password,
generally most of the routers have default user : password combination as
Code:admin:admin user:user admin:pass admin:password user:password
if you can't open your Router Gateway,
....![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sIf4qfHoUWdEF4cD3DsInornE3qNJJSctY5Rd0zndhqMYFsaCVCziIduBneivHS6TmK-oHPy1DYtuQ1QEsTezuBwOk-s08Jg8aChgKthk8cf4h1Gth=s0-d)
...
now we have successfully opened the Router Gateway,
...
Find Password Change page,
for my case it was
>Maintainance>Administration
...
Now we can see the options to change password,
go to Burp Suite Window and Click on
Proxy Tab>Intercept
turn intercept ON.
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tKM9Hezb-l2nJToxA_WxAq1uCJoLrsuFPVdC8pN7gvrGCRAU01nwpaaw28d1sBKUFkWVJEC7vyT9ieGuk3oDzP9mTlnmm1S4n1v6B_tCD7WmLnLxgm=s0-d)
...
and now,
in the input of New Password and Confirm password we will enter:
pass : pass
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uGi0sTZv7nrxg8gng5fP0_iOb_znYrSFOnep4NkDrKyNzOzmBdQIEA95PGecJu9GcRdDuRy0Yn98ygZviBtO1kX1gRYsPJEg7SfdK4rgiEpfs3Ve5w3Q=s0-d)
...
Note:Old password was 'admin'.
...
Make sure you have turned intercept ON.
Click on Save in Router Gateway.
...
Now Burp Window will appear with some sort of HTTP HEADERS and POST details.
you will see at the end,
that, it's displaying what we just entered in the Password form.
uiViewTools_Password=pass&ui.....all that!
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tMpghi_kZ_d27SP-2AjQbwgWWqc59fy1WBXWH5J7ejf4C_J__so6t8aP7JBWFuCI9BkJ7u5uu3g3G9qZHpkWOocwEL4JYXZEYqUbe3Hi0NBN9YPWDrRw=s0-d)
....
in this http request we can see that there is no ANTI-CSRF protection Token!
..
Code:Anti-CSRF tokens are some sort of hash or random combinations of letters, numbers, which gets validated on the server to make sure that request is from a authenticated user, with his own permission, not forged!
...
now right click on Burp window,
go to
>Engagement tools>Generate CSRF PoC
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tdMEvGytaOLxN1OB8VkLG--fuwVLFpbMkPSS7Iwb6nyW-5Bk027k3Kkf5v-VRtJm0vFEW1xzXztLenzihapFVK5ijX_krKbmoudly7qrYNu-GhQX-0=s0-d)
...
a new window/dialog box will appear with some html codes,
copy that,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sTSb9M75CA8uyRpFi_uJlG-Jw5uMH7rCqSwhabvCIr4yOjMUz634I4GIHRSIzCXWg1hIYNUWdBkrD9gkaiy-KBrJRh_gboH_7TqXUjOl4eawgl018U_A=s0-d)
...
save that code as a html document. / or Test in browser
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vP89HPLb5qLo1s9mhSncyNYwtOK4BiV_njQD2mfBUFWXLIXnr64fSUnBZmnoohk34mgGITP_675yVt_qh61VSLnuPvdufB-MBcyHYn5KDjfn_FjE5V=s0-d)
...
Drop the Http Request by clicking on Drop button in the interception tab,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vCjTrTrUtOXursW_pEUrPKePfr2WiMilmFpZ-c_XIEaMqLOXMNQnbUs7qKj_R-X4Wk6WKuCWGm2FrW6RMbRcIH3DJ0wutEh2pRbn5WjT4KKRMfaTilTg=s0-d)
...
>This is not change the password!
>Just Stop the request of password change.
>Your Router Gateway still is on old password!
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uyX6740D34XcP0lT_Eekrv7H3qeH0XRLjuFLNe-m34HFd4X2i3Qencn5-ozyHGbTmZHFt8JWks9sT_2aUROVL4STsFdWdCBiSYt4Auj1g9GEonVBPF0Q=s0-d)
...
>For confirmation,
i logged in using old password 'admin'.
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_slK84GNSfyNrq_-S64xgF--FLHLg6WuhJVZKzz1bPsiOzImjyCBZvyTg0St8S0FUb-k0RDYyox5iy08CsBLaPYKGABlhU-5dSmhMPHREn6u6FM7kVb=s0-d)
...
i used the old pass, and logged it,
it means just because i dropped request, password didn't changed to 'pass', and was still the old one, 'admin'.
...
Now Open the .html file you saved in your Drive,
you'll see a submit button,
>Make sure your intercept is ON!
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vvqenRGRhhIOQhncRhJAmwrLcjAVlwZISQaLgs0695AETt6rGwqwI0orkkYxaK8kgFoyTYOeqAG1a0C-xawqlpdml9l_r_dXJJgTMUHKoWTn3MSxDjKQ=s0-d)
...
After Clicking on that,
Again Burp Window will appear,
and show the same HTTP and POST Request which we got after password change page on Router Gateway Before,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sSOUBRrECc0Eot66nDUz0etvG0tLa7dPlRYrLEpn9OnvJK_sh5tJZ5vR461pANiXAxSGdpArCqKbkWcRg32bYzqobGwFdg7LxiS2ZW2zPcZdjZkUy6=s0-d)
...
Now Click on Forward, to allow the page to perform requests,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sG4jeNcDO6zwCWAyS1Ob1hXThPYV2_TpiL3sVvG0jGUYpggXtXjdSZmZprkFx1WfXejjUy9Z8K0zEznlhUI3L6tvedb9Y_KwdWR_y0FqvCzFHQHbL2Og=s0-d)
...
Voila, You just changed the password using CSRF,
without opening the router page,
without entering details,
password is changed, with POST request,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ssjHMy8s9b7g1BmaDo3XeYbBQYs3q2RBTgTPkPRJKn8QGUc81I86efUfNlEJxiykQlGpUhR9F7wCbBC0guUwNNkSgez9IQo-eFFK0_daNyhLKyRotU=s0-d)
...
Trying new password 'pass', opens the router gateway password change page!
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tv16von22pVwysJpJYXs1adDZrsDwzqM6H8e0qEMAx8ZSDSpddJhpCGnZgGcmfDmDtXF-pbUmcmKwYi9VNmEoIuAb9Ur1L9Ng95xCLRA_vvtWVZe2TsA=s0-d)
...
here is a proof that password changed,![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v2uGhp2e9Se5QT967p9pQzcW8dQ5jmRKyuHRnUziIapm8g1cxngD9QGGw-zqb4iOxzu1WKPHuOEZ6txPs4KcKuatYL1lwPnq3SMD-hUh5r7NPw8A-F=s0-d)
the Authorization header with some base64 is actually the user : pass,
...
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tGh9vRmcEskiyx1ovwsAQgl3SCwoA_ZWxqkxZQkae3CEZD8BoopvYuaeEquAHmt5svTSDSCS-orrskMB9qpFGhYChnIKcJ1a-GjbXp79VarTOk0N0v=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uiJEFOoo2uz5tgwI-Rn_V1Oq60TC1mF2NQkRwm1ByyMo_mq3W-1CYK-hXaxJkZ3tBbD7Zf5g8j3mdHNYoO-c-elWbHmUBDsNasNCbgU51PSlH57J6aEw=s0-d)
....
which is the base64 encode of 'admin : pass', the old one was for 'admin:admin'
...
...
The whole idea behind CSRF is to change user details, without actually letting the victim know, enter, and interact on the target page.
this is done by POST request on sites withno X-Csrf/Anti-Csrf protections.
...
Some times the site will have Anti Csrf token,
but still an attacker can bypass the Anti-CSRF protections, just by checking if the tokens are validated on server or it's an easily guess-able combination.
>I will post on CSRF protection bypassing, soon.
....
Thank You!
Let's Start!
...
You have now configured Burp Suite,
Just Start it,
Turn off the Intercept for now.
...
Open Firefox or any other browser,
go to Router Default Gateway:
in mine case it is
http://192.168.1.1/
you will be asked for username and password,
generally most of the routers have default user : password combination as
Code:admin:admin user:user admin:pass admin:password user:password
if you can't open your Router Gateway,
....
...
now we have successfully opened the Router Gateway,
...
Find Password Change page,
for my case it was
>Maintainance>Administration
...
Now we can see the options to change password,
go to Burp Suite Window and Click on
Proxy Tab>Intercept
turn intercept ON.
...
...
and now,
in the input of New Password and Confirm password we will enter:
pass : pass
...
...
Note:Old password was 'admin'.
...
Make sure you have turned intercept ON.
Click on Save in Router Gateway.
...
Now Burp Window will appear with some sort of HTTP HEADERS and POST details.
you will see at the end,
that, it's displaying what we just entered in the Password form.
uiViewTools_Password=pass&ui.....all that!
...
....
in this http request we can see that there is no ANTI-CSRF protection Token!
..
Code:Anti-CSRF tokens are some sort of hash or random combinations of letters, numbers, which gets validated on the server to make sure that request is from a authenticated user, with his own permission, not forged!
...
now right click on Burp window,
go to
>Engagement tools>Generate CSRF PoC
...
...
a new window/dialog box will appear with some html codes,
copy that,
...
...
save that code as a html document. / or Test in browser
...
...
Drop the Http Request by clicking on Drop button in the interception tab,
...
...
>This is not change the password!
>Just Stop the request of password change.
>Your Router Gateway still is on old password!
...
...
>For confirmation,
i logged in using old password 'admin'.
...
...
i used the old pass, and logged it,
it means just because i dropped request, password didn't changed to 'pass', and was still the old one, 'admin'.
...
Now Open the .html file you saved in your Drive,
you'll see a submit button,
>Make sure your intercept is ON!
...
...
After Clicking on that,
Again Burp Window will appear,
and show the same HTTP and POST Request which we got after password change page on Router Gateway Before,
...
...
Now Click on Forward, to allow the page to perform requests,
...
...
Voila, You just changed the password using CSRF,
without opening the router page,
without entering details,
password is changed, with POST request,
...
...
Trying new password 'pass', opens the router gateway password change page!
...
...
here is a proof that password changed,
the Authorization header with some base64 is actually the user : pass,
...
....
which is the base64 encode of 'admin : pass', the old one was for 'admin:admin'
...
...
The whole idea behind CSRF is to change user details, without actually letting the victim know, enter, and interact on the target page.
this is done by POST request on sites withno X-Csrf/Anti-Csrf protections.
...
Some times the site will have Anti Csrf token,
but still an attacker can bypass the Anti-CSRF protections, just by checking if the tokens are validated on server or it's an easily guess-able combination.
>I will post on CSRF protection bypassing, soon.
....
Thank You!
This is purely for Educational purpose only. Don’t use it for illegal.if you do, you will be in jail.
