HTTP Enumeration Using Nikto

Hello All,
      Here I am again for you with new article on HTTP enumeration using Nikto.
Enumeration is pre-phase of hacking cycle where attacker tries to gather more and more information about the target.

What is Nikto?

    Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers.

 Steps:
1. From a BackTrack shell, type the following (only type what's in bold):

user1@bt:~#cd /pentest/scanners/niktouser1@bt:~#pwd

Syntax breakdown:
cd /pentest/passwords/nikto: change into the directory 
/pentest/passwords/nikto
pwd: program name to print current directory

2. Update the Nikto databases and plugins from cirt.net by typing the following (only type what's in bold):

user1@bt:~#./nikto.pl -update

Syntax breakdown:
./nikto.pl: PERL script to run
-update: program option to update Nikto databases and plugins

3. Run the Nikto PERL script to scan a Windows target web server (only type what's in bold, on one line):

user1@bt:~#./nikto.pl -h win_target_IP_address > /root/ceh/nikto_win_scan

Syntax breakdown:
./nikto.pl: PERL script to run

-h win_target_IP_address: the IP address of the Windows target system
> /root/ceh/nikto_win_scan: redirect the output to a file called nikto_win_scan in the /root/ceh directory

4. Examine your results:

user1@bt:~#cat /root/ceh/nikto_win_scan | less

5. Record your results:

6. Repeat step #3 using your UNIX target IP address (only type what's in bold, on one line):

user1@bt:~#./nikto.pl -h unix_target_IP_address > /root/ceh/nikto_unix_scan

7. Examine your results:

user1@bt:~#cat /root/ceh/nikto_unix_scan | less

8. Record your results:

in case more details require/doubt feel free contact me.

More To refer:  Banner Grabbing using Telnet

Learn PHP in 30 Minutes

Hello Guys,
          Here I am again for you with new articles those who is looking to learn programming.
while surfing on the internet i came across article about Learn PHP in 30 minutes. I thought to share the video with you.

What is PHP?

The PHP Hypertext Preprocessor (PHP) is a programming language that allows web developers to create dynamic content that interacts with databases. PHP is basically used for developing web based software applications.

PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. Originally created by Rasmus Lerdorf in 1994, the PHP reference implementation is now produced by The PHP Group. While PHP originally stood for Personal Home Page, it now stands for the recursive backronym PHP: Hypertext Preprocessor.

pre-requisite before to start learn php need to setup the environment for PHP. If you are on Windows, just download and Install XAMPP or WAMP Server.

In case any doubt put the comment else contact me.

WhatsApp Trick 1 | How to Hide Private Stuff without Application.

Hello Guys,
           I have observed most of the time bachelors have one questions about how to hack WhatsApp which is the most popular chatting application which is acquire by Facebook Inc.

I thought to share one trick with you all to hide files/video/music/ pics etc without 3rd party application..

Tips:
I have studied application functionality which are available in Google play which claims to hide pics and videos. 
The application directly change the extension of the files e.g. test.jpg to xcdsc.jdw (most of the application use their own extension to hide apps from Gallery and from Search.)

Simple trick go to file Manager. in setting there is options to show/hide directories. we will make a use of it.

Steps:
Create any folder e.g. "Whatsapp" put all your private stuff which you want to hide from anyone (especially from Mom/Dad/Bro/Sis/Friends).

Search it or go to Gallery.  yes of course it will be visible.

Now do little change in the folder name "WhatsApp" to ".WhatsApp"
I have only added "." (dot) before the folder name.

Now you are not able to get the folder in Gallery.

Reason:

WhatsApp treat this type of file as system file and hide it from normal user view. to unhide you have to go to file manager and apply the setting "show/hide directory" to view it.

Its Done.

Please comment on the article and in case any difficulties contact me to get it done.

Root Android Devices with Rootx

ROOTx

The ROOTx App can root almost any android at no cost or any installation of new roms !!

Instruction to root the device

• Plug your phone via USB Cable

• Turn on your device

• Allow unsigned programs

• Enable USB debugging and Choose an

• Choose an Option Below

• Type it in and hit enter Twice :)

Compatible Mobile Devices:

1. SAMSUNG GALAXY Y,Y DUOS AND ALL SGY MODELS
2. HTC (ONLY AFTER S-OFF AND GOLDCARD)
3. SAMSUNG GALAXY S SERIES
4. SONY EXPERIA Z, J, L (REST NOT TESTED)( unlocked bootloader only)
5. SAMSUNG ACE,ACE DUOS
6. KARBONN A5,A7,A7+
7. ALL MICROMAX ANDROID MODELS(Bootloader unlocked)
8. SWIPE TABLETS AND PHABLET (X74,X74S,HALO,AND ALL OTHERS)
9. Micromax bolt series(boot loader unlocked)
10. Samsung gt I5510/I550
11. Samsung galaxy Note/Note 2
12. Samsung Galaxy S4 (All Ee locked and us simlocked are supported!!) (New tested)
13. Samsung galaxy Grand/Spica
14. Samsung gt 551/t-red versions too (vietnamese)
15. MID Generic tablets (all versions)
16. DIFRNCE DIT4350
17. Karbonn A12, A15, A21, A30
18. fake galaxy s1,2,3,4 ( MKT DEVICES )
19. Karbonn Smart Tab 1,7,8,10
20. ( smart tab 2 is bootlocked with new firmware  )
21. FPT F8, KTouch w619 , Karbonn A5
22. Galaxy Note 800
23. Magicon MNote
24. Old XOLO FIRMWARES ( devices before A500 )
25. Sky Vega Racer IM-a770k ICS
26. Sky Vega Racer IM-a760k ICS
27. Pyle Astro PTBL92BC
28. Audiosonic 7? Quad Core T7-QC Tablet

Original Thread:
http://forum.xda-developers.com/showthread.php?t=2239958

Download Rootx

Rootx v2.2

Banner Grabbing Using Telnet Command

Hello Guys,
           Here I am again with new article. Today I well known you about the Banner Grabbing Techniques which attacker used to gather information about the target Web servers.

There is tried & true manual technique is available for enumerating the banners and application information.

Banner grabbing is a technique used to glean information about a computer system on a network and the services running on its open ports

e.g.

[root@prober] nc www.targethost.com 80
HEAD / HTTP/1.1

HTTP/1.1 200 OK
Date: Mon, 11 May 2009 22:10:40 EST
Server: Apache/2.0.46 (Unix)  (Red Hat/Linux)
Last-Modified: Thu, 16 Apr 2009 11:20:14 PST
ETag: "1986-69b-123a4bc6"
Accept-Ranges: bytes
Content-Length: 1110
Connection: close
Content-Type: text/html

In this exercise we will make a use of "Telnet" connection to various TCP ports on target system & record banner information that is presented.

Demo 1: Banner Grabbing Using Telnet.

1. from your Kali Linux, open a shell & type following commands

root@kali:~ telnet Target_IP 80 (hit enter few times)

2. what web server application running on the target.
3. Repeat the step 1 again for known port numbers to check the services running.
4. record your result.

HTTP Commands for banner grabbing

1. Connect using telnet and type: HEAD / HTTP/1.0

telnet www.test.com 80

Trying 100.100.100.100...
Connected to www.test.com.
Escape character is '^]'.
HEAD / HTTP/1.1


  HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 1768
Content-Type: text/html
Server: Microsoft-IIS/7.0
Set-Cookie: ASPSESSIONIDACBATBQQ=MJOLBPPDBKPCDFREKDMLCEOHF; path=/
X-Powered-By: ASP.NET
Date: Tue, 06 Aug 2015 03:42:18 GMT
Connection: close
Connection closed by foreign host.

 2. Let's try the option command, I like this: OPTIONS / HTTP/1.0


Trying 100.100.100.100...
Connected to www.test.com.
Escape character is '^]'.
OPTIONS / HTTP/1.1

HTTP/1.1 200 OK
Allow: OPTIONS, TRACE, GET, HEAD, POST
Server: Microsoft-IIS/7.5
Public: OPTIONS, TRACE, GET, HEAD, POST
X-Powered-By: ASP.NET
Date: Tue, 26 Aug 2015 05:47:39 GMT
Connection: close
Content-Length: 0
Connection closed by foreign host.

Error if  I type wrong commands(lower case letters):

Trying 100.100.100.100...
Connected to www.test.com.
Escape character is '^]'.

options / http/1.1      ---- I typed lower case

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Tue, 26 Aug 2015 05:50:08 GMT
Connection: close
Content-Length: 311
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request</h2>
<hr><p>HTTP Error 400. The request is badly formed.</p>
</BODY></HTML>
Connection closed by foreign host.

It is basic level of Banner Grabbing without using 3rd Party Tools like netcat, nikto, ssh etc.

More To refer:

Banner Grabbing using Netcat
Active Stack Fingerprinting Using Nmap
Passive Stack Fingerprinting Using Ettercap
FTP Enumeration 
SSH Enumeration
SMTP Enumeration Using Telnet
HTTP Enumeration Using Nikto



  

SQL injection for Fun | Blackhattrick Blog

Disclaimer:

Performing this kind of activity is illegal. Please refer the article for knowledge purpose.Blog owner is not responsible if any unethical activity will done.

Hello Guys,

                Here I am again for you with new article on Sql Injection.

Here I use Google Dorks to look for Vulnerable Sites for SQL Injection. 

Note: you must know about Google hacking cheat sheet.

SQL Injection:

                SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

Follow the Steps:

Go to Google Search for enter string below,

inurl:"/admin/_login.php /admin/_login.phpinurl:index.php?id= -

 Here I use “inurl:"/admin/_login.php” for demonstration.

After search you may open any web site to check for vulnerability.

Suppose if your web URL is: www.site.com/admin/_login.php replace _login.php with index.php,

if the web page does not change(remains as it is) then your Sql injection will work 99%.

 Almost 88% web sites are vulnerable as per study.

Try Sql injection Cheats. I will use ' or 1=1; #

Bingo!!!!!!!!!!

You got Administrator Panel Access !!!!!

Benefits:

In Organizations, Analyst/administrator can use the trick to check whether vulnerability present on the server so they can patch it on priority.

Your Good comments Encourages me to keep posting Nice Articles so keep Commenting & Sharing

Hacker`s Friendly Search Engine | Blackhattrick Blog

Hello Guys,
Reconnaissance is the Pre-phase of Hacking life cycle.
Hacker first initiate information Gathering/collection activity by Active & Passive Way.
There are search engines available where attacker can get information about the target easily on Internet.

Information such as Port opened with additional details, geographical information, who.is info, services running, open-source security reports about phishing, malware, botnets and other malicious activities. Search for IP addresses or domains in our reputation database.

I came across Following Search Engines listed as below:
 

• https://cymon.io
• https://exchange.xforce.ibmcloud.com
• https://duckduckgo.com (Search Engine)
• https://www.shodan.io
• https://censys.io/

https://cymon.io

Cymon is the largest tracker of open-source security reports about phishing, malware, botnets and other malicious activities. Search for IP addresses or domains in our reputation database. Cymon ingests events and other malicious activities from almost 200 sources daily. On average, more than 15,000 unique IPs and 100,000 events are processed each day.

https://duckduckgo.com (Search Engine)

 https://exchange.xforce.ibmcloud.com

IBM X-Force Exchange is a threat intelligence sharing platform enabling research on security threats, aggregation of intelligence, and collaboration with peers.

https://censys.io/

Censys is a search engine that allows computer scientists to ask questions about the devices and networks that compose the Internet. Driven by Internet-wide scanning, Censys lets researchers find specific hosts and create aggregate reports on how devices, websites, and certificates are configured and deployed. [more information

https://www.shodan.io

Shodan is the world's first search engine for Internet-connected devices

Benefits:

As an attacker you can collect information about your target passively.As an Security Analyst you can collect the information about the target whom attacking on your Company Infra.

Guys, If you know other Hackers Search Engines put the comment to other also know.

Your Good comments Encourages me to keep posting Nice Articles so keep Commenting & Sharing