Showing posts with label Hacking. Show all posts

Session Cookie Based SQL Injection

Short Description: SQL injection is most dangerous attack for web application, there are a lot of different websites are vulnerable to SQL injection. There are different variant for SQL injection like a simple SQL injection, blind SQL injection and Cookies based SQL injection. As you know the basic idea about cookies and their importance, cookies are represent some session and normally they count in cross site scripting attack (XSS) but what is cookies based SQL injection. In this article we will discuss cookies or session based SQL injection attack. 

Did you say a “Cookie” 

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user’s browser and for the browser to return the state information to the origin site. The state information can be used for authentication, identification of a user session, user’s preferences, shopping cart contents, or anything else that can be accomplished through storing text data.
Cookies are not software. They cannot be programmed, cannot carry viruses, and cannot install malware on the host computer. However, they can be used by spyware to track user’s browsing activities – a major privacy concern that prompted European and US law makers to take action. Cookies could also be stolen by hackers to gain access to a victim’s web account.[1]


Where can I find my cookies?


Here is one way to get your stored cookies using your browser. This method is applied for Mozilla Firefox:


  1. From the Tools menu, select Options. If the menu bar is hidden, press Alt to make it visible.

  2. At the top of the window that appears, click Privacy.

 4. To modify settings, from the drop-down menu under “History”, select Use custom settings for history. Then enable or disable the settings by checking or unchecking the boxes next to each setting:


  • To allow sites to set cookies on your computer, select Accept cookies from sites. To specify which sites are always or never allowed to use cookies, click Exceptions.
  • To accept third-party cookies, check Accept third-party cookies. In the drop-down menu next to “Keep until:”, select the time period you wish to keep cookies on your computer.
  • To view the cookies stored on your computer, click Show Cookies… . In the window that appears, you can view the cookies on your computer, search for cookies, and remove any or all of the listed cookies.
  • To specify how the browser should clear the private data it stores, check Clear history when Firefox closes. Then, click Settings… . You can specify the items to be cleared when you close Firefox.

  4. Click OK until you return to the Firefox window.

To remove all cookies, from the Tools menu, select Clear recent history… . Check the items you want to clear, and then click Clear Now.



Are you talking about a Cookie Poisoning-like attack?


Cookie Poisoning attacks involve the modification of the contents of a cookie (personal information stored in a Web user’s computer) in order to bypass security mechanisms. Using cookie poisoning attacks, attackers can gain unauthorized information about another user and steal their identity.
Cookie poisoning is a known technique mainly for achieving impersonation and breach of privacy through manipulation of session cookies, which maintain the identity of the client. By forging these cookies, an attacker can impersonate a valid client, and thus gain information and perform actions on behalf of the victim. The ability to forge such session cookies (or more generally, session tokens) stems from the fact that the tokens are not generated in a secure way.[4]
To sum up, cookie-based SQL Injection is far to be a kind of Cookie Poisoning.

Cookie variables as a vector of SQL Injections:


SQL injection overview

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.
All data sent by the browser to a Web application, if used in a SQL query, can be manipulated in order to inject SQL code: GET and POST parameters, cookies and other HTTP headers. Some of these values ​​can be found in the environment variables. The GET and POST parameters are typically entered into HTML forms, they can contain hidden fields, i.e. information that is in form but not shown. GET parameters are contained in the URL and POST parameters are passed as HTTP content. Nowadays, and with the growth of Web 2.0 technologies, the GET and POST requests can also be generated by JavaScript.

Injecting malicious code in cookie:

Unlike other parameters, cookies are not supposed to be handled by users. Outside of session cookies which are (usually) random, cookies may contain data in clear or encoded in hexadecimal, base64, hashes (MD5, SHA1), serialized information. If we can determine the encoding used, we will attempt to inject SQL commands.



 function is_user($user) {

global $prefix, $db, $user_prefix;

if(!is_array($user)) {

        $user = base64_decode($user);

        $user = explode(“:”, $user);

$uid = “$user[0]“;

$pwd = “$user[2]“;

} else {

$uid = “$user[0]“;

$pwd = “$user[2]“;

}

if ($uid != “” AND $pwd != “”) {

    $sql = “SELECT user_password FROM “.$user_prefix.”_users WHERE user_id=’$uid’”;

$result = $db->sql_query($sql);

$row = $db->sql_fetchrow($result);

$pass = $row[user_password];

if($pass == $pwd && $pass != “”) {

return 1;

}

}

return 0;

}

The cookie contains base64 encoded form identifier, a field that is unknown and a password. If we use as a cookie 12345 ‘UNION SELECT’ mypass ‘:: mypass base64 encoded, the SQL query becomes:


  SELECT user_password FROM nk_users WHERE user_id=’12345′ UNION SELECT ‘mypass’

This query returns the password mypass, the same password as we have to provide. So we are connected.

How to inject the code in Cookies?

There are many HTTP interceptors and HTTP editors that can intercept the HTTP request before it is sent to the server. Then the tester can introduce his malicious SQL statement in the cookie field.
It’s like a get/post based SQL Injection, except that certain characters can’t be used. Forexample, ‘;‘ and ‘,‘ are typically treated as delimiters, so they endthe injection if they aren’t URL-encoded.

Conclusion

Cookie variables sometimes are not properly sanitized before being used in SQL query. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code. For the web application audits, cookie variables should be added to the list of parameters to be checked.

For more Updates Visit: amadahmad.blogspot.com


Who's Tracking Your Smartphone?


 Safety should always be our top priority. With the help of just a few short codes, you can find out more about the settings of your phone and work out whether or not your messages and information are protected and whether you’re being tracked.

We has gathered together some of the most useful and important codes for smartphones all in one article, together with some instructions for those who’re worried about being tracked.

With this code, you can find out whether your calls, messages, and other data are being diverted. The status of the different types of diversions that are taking place along with the number the information is being transferred to will be displayed on your phone’s screen. This function is most often set up by either jealous partners or parents who are trying to protect their kids from spam or criminals. Elderly people often become victims of this practice when they lend their phone to a stranger to make a single call. If they do so, they risk having information about where they live, who their friends and family are, their habits and daily activities, and even their financial circumstances passed on to criminals.
Dial this code if you want to find out where calls, messages, and data are being redirected to if it seems that no one can get through to you. The chances are in this case that your voice calls are being redirected to one of your cell phone operator’s numbers.
This is a universal code for switching off all forms of redirection away from your phone. It’s a good idea to use this before you have to use roaming. In this case, money won’t be taken from your account for calls that are redirected by default to your voice mail.
With the help of this code, you can find out your IMEI (International Mobile Equipment Identifier). If you know this number, you can find your phone if someone steals it. When switched on, its location is automatically conveyed to the network operator even if a different SIM card is inserted. If someone knows your IMEI number, they can find out the model and technical characteristics of your phone.
Special codes exist that allow someone to track your location and also to determine whether someone is following you. For this, you need the utility net-monitor. Type in one of the following codes:

for iPhone: *3001#12345#* 
for Android: *#*#4636#*#* or *#*#197328640#*#*

Step 1. Go to the section called UMTS Cell Environment, then UMTS RR info, and write down all the numbers under Cell ID. These numbers are the basic stations located nearby. Your phone will connect by default to the one that emits the best signal.

Step 2. Go back to the main menu, and click on the MM info tab, then on Serving PLMN. Write down the numbers under Local Area Code (LAC).

Step 3. With the help of these two numbers and an ordinary website (the fourth tab to the left), you can determine the location on the map of the basic station that your phone is connected to.

The ones to be suspicious of are mobile basic stations — this could be a truck or small bus with a large antenna. These kinds of vehicles are used at rock festivals and in places where Internet coverage is poor. If there’s one of them nearby, seemingly without any logical reason, it’s just possible that someone is engaged in spying.
If you use Android, you should periodically check your phone for viruses. Place Raiders one of the most dangerous ones that can infect your device. Developed by American experts, it was meant to show how vulnerable our devices are. Once it gets onto a phone, this Trojan takes a series of photographs of the surrounding area, creates a 3D model of the building you’re in, and then takes advantage of any Internet connection to send the data that it’s gathered, adding along with it all the data on the phone and your passwords.
  • National security agencies in virtually all countries now cooperate with cell phone operators, who often provide the former with access to information on any of their customers provided they have a warrant from a court. As a minimum, they provide data from the last three months.

  • If your phone has been tapped by a security agency, the chances are you won’t even notice. If a phone makes odd noises during a conversation, loses battery power rapidly, overheats, or unexpectedly restarts, this is merely an indication that you need to get it repaired rather than a telltale sign that you’re being listened to.

  • People generally don’t reveal all that much in phone conversations, so from the point of view of those who want to listen in it’s much more worthwhile to set up special devices ("bugs") in someone’s home. Radio wave detectors can be used to work out whether such bugs are present in a building.
  • Use messaging apps that are completely closed to outsiders, such as Telegram, Chare, Wickr, or Signal.

  • Determine what information it’s safe to make accessible to all. Should everyone really be able to find out your phone number or have access to information about your family, loved ones, or your lifestyle? Be very careful when posting photographs of children.

  • Don’t install unknown programs on your phone, keep close track of the apps you have installed, and use multiple security locks wherever you can. Don’t click on unsafe links, and don’t connect your phone to suspicious "free" charging points.

  • Only your cell phone operator should ever offer you tracking services, and they should only turn them on with your explicit agreement. Websites and applications that offer to find out the location of other people are almost certainly acting with criminal intent. Be careful!

For More Visit : www.amadahmad.blogspot.com

10 Best Password Cracking Tools Of 2016


Password cracking is an integral part of digital forensics and pentesting. Keeping that in mind, we have prepared a list of the top 10 best password cracking tools that are widely used by ethical hackers and cyber-security experts. These tools–including the likes of Aircrack, John the Ripper, and THC Hydra–use different algorithms and protocols to crack the passwords on a Windows, Linux, and OS X system.

W
hat is password cracking?

In the field of cyber-security and cryptography, password cracking plays a very major role. It’s basically the process of recovering passwords to breach (or restore) the security of a computer system. You can easily relate it to repeatedly guessing your phone’s unlock pattern or pin.
So, why do we need to learn about password cracking and the tools used to do so? The purpose of password cracking revolves around recovering the forgotten passwords of our online accounts, computers, and smartphones. Password cracking is also used by system administrators as a preventive measure. They keep checking them on the regular basis to look for the weak links.
Talking about the process of password cracking, most methods involve the use of a computer that generates a vast set of password candidates. A desktop computer tests more than hundreds of millions of passwords per second. A password cracking tool performs this task easily and checks these candidates to reveal the actual password.
The time needed to crack a password is proportional to the length and strength of that password. That’s why users are advised to use complex passwords that are harder to guess. The password cracking speed of a tool also depends heavily on the cryptographic function that’s used to generate password hashes. Thus, a potent hashing function like bcrypt is preferred over the likes of SHA and MD5.

Types of password cracking attacks:

Here’s I’ll be listing various types of password cracking attacks that are generally used by attackers:
  • Dictionary attack: This attack uses a file that contains a list of words that are found in the dictionary. This mode matches different combinations of those words to crack your device open.
  • Brute force attack: Apart from the dictionary words, brute force attack makes use of non-dictionary words too.
  • Rainbow table attack: This attack comes along with pre-computed hashes. Thus, this method is faster.
There are lots of other password cracking techniques like phishing, spidering, social engineering, shoulder surfing etc. Soon, I’ll be discussing them in detail in another article. So, let’s get started with our list of the best password cracking tools of 2016.

Best Password Cracking Tools Of 2016:

Disclaimer: We are publishing this list just for educational purposes. We don’t promote malicious and unethical practices.

1) John the Ripper


John the Ripper is one of the most popular password cracking tools available around. This free password cracking tool is chiefly written in C programming language. Encompassing a customizable password cracker, John the Ripper comes as a combination of many password crackers into one suite.
Its ability to auto-detect password hashtypes, makes it a preferred choice of ethical hackers to ensure security. A pro version of this tool is also available, offering better features and more effectiveness. Just like the popular hacking tool Metasploit, John also belongs to the Raspid7 family of security tools.
Supported platforms: John the Ripper is available for all major platforms, including Linux, Windows, DOS, and OS X.
Download link: John the Ripper

2) Aircrack-ng


Aircrack-ng (ng stands for new generation) is one of the best password cracking tools that hackers use to bump their annoying neighbors off their own Wi-Fi. Note that just like John the Ripper, Aircrack-ng is not a single tool. Instead, it’s a complete software suite that’s used to play with Wi-Fi networks.
In this free suite, you get a tool named aircrack that hackers use to crack WPA or WEP passwords. After analyzing the encrypted password packets, aircrack uses its cracking algorithm to break the passwords.
Using the well know attack techniques like FMS, this password cracking tool makes your job easier. Recently, a new attack named “PTW” has been included in the suite, which reduces the number of initialization vectors to break a WEP key.
Supported platforms: Aircrack is available for Linux, OpenBSD, FreeBSD, OX X, Windows, Android
Download link: Aircrack-ng

3) RainbowCrack


As the name suggests, RainbowCrack makes use of rainbow tables to crack password hashes. Using a large-scale time-memory trade-off, RainbowCrack performs an advance cracking time computation. According to your convenience, you are free to use the command line or graphical interface of RainbowCrack.
Once the pre-computation stage is completed, this top password cracking tool is about hundreds of times faster than a brute force attack. You also don’t need to prepare the rainbow tables yourselves. The developers have made different rainbow tables for LM, NTLM, MD5 and SHA1 available for free.
RainbowCrack’s GPU acceleration is another key feature that allows this free password cracking tool to offload the runtime computation to GPUs, reducing the cracking time even further.
Supported platforms: RainbowCrack is available for Windows and Linux
Download link: RainbowCrack

4) Cain and Abel


This renowned password cracking tool is a dependable software to recover various types of passwords using multiple techniques. Cain and Able lets you easily perform Dictionary, Brute-Force, and Cryptoanalysis attacks to crack encrypted passwords.
This multi-purpose hacking tool also comes with the ability to sniff the networks, record VoIP conversations, recover network keys, decode scrambled passwords, and analyze routing protocols.
Cain and Abel has two components. While Cain is the front-end application to recover your passwords and perform sniffing, Able is a Windows NT service that performs the role of traffic scrambling.
Supported Platforms: Cain and Abel is available for Windows
Download link: Cain and Abel

5) THC Hydra


Compared to other top password cracking tools, THC Hydra performs hacking attacks using numerous network protocols, including the likes of Asterisk, FTP, HTTP-Proxy, MYSQL, XMPP, Telnet, and more. Using these protocols, THC Hydra performs super fast brute-force and dictionary attacks against a login page.
This free-to-use tool helps the pentesters and security researchers to know how easy it would be to gain remote access to a system. This tool also lets you add new modules to increase the functionality. Via its GitHub page, you can also participate in the development process of THC Hydra.
Supported Platforms: THC Hydra is available for Windows, Linux, Solaris, FreeBSD, OS X
Download link: THC Hydra

6) HashCat


HashCat claims to be the fastest and most advanced password cracking software available. Released as a free and open source software, HashCat supports algorithm like MD4, MD5, Microsoft LM hashes, SHA-family, MySQL, Cisco PIX, and Unix Crypt formats.
This password cracking tool comes in both CPU-based and GPU-based versions, HashCat and oclHashcat/cudaHashcat, respectively. Using a well-documented GPU acceleration, many algorithms can be easily cracked using this tool.
Different types of attacks performed by this tool include brute force attack, combinator attack, fingerprint attack, dictionary attack, hybrid attack, mask attack, table-lookup attack, PRINCE attack, permutation attack etc.
Supported Platforms: HashCat is available for Windows, Linux, OS X
Download link: HashCat

7) Crowbar


Crowbar is a brute forcing tool that’s widely popular in the pen testing scene. It gives you the control to decide what’s submitted to a web server. While most brute forcing tools use username and password to deploy SSH brute force, Crowbar makes use of SSH keys obtained during penetration tests.
This free tool is created to support the protocols that are rarely supported by other popular password cracking tools. Currently, Crowbar supports VNC key authentication, OpenVPN, SSP private key authentication, and Remote Desktop Protocol with NLA support.
Supported Platforms: Crowbar is available for Windows, Linux, OS X
Download link: Crowbar

8) OphCrack



Just like RainbowCrack, OphCrack is another popular and free password cracking tool that uses rainbow tables to crack the password hashes. It’s widely used to crack Windows log-in passwords. Thanks to its ability to import and use hashes from multiple formats and sources, OphCrack is known to crack the passwords of a Windows computer in few minutes.
Available conveniently as a Live CD, a pentester can use it and leave no trace behind. For cracking Windows XP, Vista, and 7, one can also grab freely available rainbow tables. For professional use, larger tables are available for purchase.
Supported Platforms: OphCrack is available for Windows
Download link: OphCrack

9) L0phtCrack


Just like OphCrack, L0phtCrack is known for easily cracking Windows passwords. Using a wide set of attacks like dictionary, hybrid, brute force, and rainbow tables, this password cracking tool can also be deemed useful in sniffing hashes.
It’s a great way to target Windows desktops, networked servers, Active Directory, and primary domain controllers. Its schedule routine audit functionality lets you perform scans at a convenient time.
Supported Platforms: L0phtCrack is available for Windows
Download link: L0phtCrack

10) DaveGrohl


For Mac OS X, DaveGrohl is an open source password cracking tool that’s preferred by the Apple security experts. With a completely modern object-oriented codebase in Version 3.0, DaveGrohl has been made more useful for developers and users.
With the help of dictionary and incremental attacks, this tool lets you crack a password in minutes. Its distributed mode allows you to perform attacks using different computers and crack the same password hash for faster results.
Supported Platforms: DaveGrohl is available for OS X
Download link: DaveGrohl
Thank you for Reading