Packet Injection Basics Presentation
Description: The Packet Injection basics presentation is an in-depth tutorial on various packet injection programming techniques. We will look at how to construct various headers and then bunch them together to form a complete packet and then how to send this packet over the network. This presentation is a necessary pre-requisite for all the other packet injection videos in this tutorial series. Links:<br><br>1. Raw sockets basics presentation <br><br>2. Tags: programming , Disclaimer: We are a infosec video aggregator and this video is linked from an external website. Comments:
Null Byte - The aspiring grey hat hacker / security awareness playground « Wonder How To
Security Testing your Apache Configuration with Nikto
Introduction By now you've got the perfect setup for your new Ubuntu 6.0.6 (Dapper Drake) box. You may have even followed the excellent Intrusion Detection and Prevention with BASE and Snort tutorial. And as an added precaution you installed DenyHosts to prevent hack attempts via ssh. But now that you've got your new LAMP server on the internet, how can you tell that your new web server is secure? This tutorial, inspired by one of the chapters in Hardening Apache by Tony Mobily (APress), will show you how to set up the free web server security scanner tool, Nikto. Remember, only scan servers you own or that you have permission to scan, or you could easily risk legal action and jail time. Let's get started. 1.1 Installing Net_SSLeay Net_SSLeay is a Perl Module that adds the ability to connect over SSL connections. I generally create a /src directory to download all my source files into, and will be doing that first. mkdir /src cd /src Now we can download the Net_SSLeay Perl Module source:
Irongeek.com
remote-exploit.org
Hacking Articles,Backtrack Tutorials,Hacking Tricks,Penetration Testing,Metaspolit Tutorial
Burp Suite Tutorial – The Intruder Tool
Hi everyone, I have been spending some time this week reviewing some of the old Security Ninja blog posts now that we are getting close to our second birthday. I wanted to create a list of things I’ve promised to write about but never got around to doing. The first item on my list is a tutorial for the Burp Suite. What is the Burp Suite? Burp Suite is an integrated platform for attacking web applications. Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. Source: The Burp Suite is made up of tools (descriptions take from the Port Swigger website): Proxy: Burp Proxy is an interactive HTTP/S proxy server for attacking and testing web applications. Spider: Burp Spider is a tool for mapping web applications. Scanner: Burp Scanner is a tool for performing automated discovery of security vulnerabilities in web applications. Enabling the Burp Suite Proxy Selecting a payload
RFI Tutorial (remote file inclusion)
Basically, the include function in PHP allows contents from local or remote files to be pretty much "copied and pasted" and executed in a script at runtime. Now suppose yo' dad wants a small website. All he wants is three pages.A blog page where he can update you on how many babies he has killed.A contact page with his email on it os people can ask advice on the best way to kill babies.An gallery page where he can show you pictures of all the babies he has killed. He creates four pages. blog.php, contact.php and gallery.php along with index.php, this is our "main" page that will contain a header, a side bar for navigation, some php and a footer. You would view the pages on his website like this.Code: for header//html for menu$page = $_GET['page'];include($page);? This means when we go to Code: What's wrong with this? What's the point of this? Undefined variables. Switching.
SQL Injection Cheat Sheet
Find and exploit SQL Injections with free Netsparker SQL Injection Scanner SQL Injection Cheat Sheet, Document Version 1.4 About SQL Injection Cheat Sheet Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL. Samples are provided to allow reader to get basic idea of a potential attack and almost every section includes a brief information about itself. Examples; (MS) means : MySQL and SQL Server etc. Table Of Contents Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks Ending / Commenting Out / Line Comments Line Comments Comments out rest of the query. -- (SM) DROP sampletable;-- # (M) DROP sampletable;# Line Comments Sample SQL Injection Attacks Username: admin'-- SELECT * FROM members WHERE username = 'admin'-- This is going to log you as admin user, because rest of the SQL query will be ignored. Inline Comments /*Comment Here*/ (SM) DROP/*comment*/sampletableDR/**/OP/*bypass blacklisting*/sampletableSELECT/*avoid-spaces*/password/**/FROM/**/Members /*!
