存档

文章标签 ‘Tutorial’

Tutorial Thc-Hydra

2010年4月14日 admin     3,506 views 没有评论

来源:exploit-db.com

hydra著名黑客组织thc的一款开源的暴力破解工具，其有windows和linux多个平台的版本，本文就是介绍hydra用法的教程。
_ _ _ _
| |_| |__ ___ | |__ _ _ __| |_ __ __ _
| __| ‘_ \ / __|____| ‘_ \| | | |/ _` | ‘__/ _` |
| |_| | | | (_|_____| | | | |_| | (_| | | | (_| |
\__|_| |_|\___| |_| |_|\__, |\__,_|_| \__,_|
|___/ TUTORIAL BASICO THC-HYDRA [PT-BR]
___________________________________________________________________________________
- Por : MDH3LL
- Contato :    mdh3ll@gmail.com
- Data 10/04/2010
__________________________________________________________________________________

INDICE :
___________________________________________________________________________________
-0×00 – Instalando THC-HYDRA no (Windows XP).
-0×01 – Executando.
-0×02 – Opções.
-0×03 – Exemplos{
– Exemplo (1) FTP
– Exemplo (2) http-head
– Exemplo (3) http-post-form
– Exemplo (4) POP3
-0×04 – Proxy.
___________________________________________________________________________________

* THC-Hydra:Open Source/Multiplataforma/
* Desenvolvido por uma organização Alemã chamada “The Hacker’s Choice”(THC).
* O Programa pode ser adquirido gratuitamente no site oficial do projeto : http://freeworld.thc.org/thc-hydra/

阅读全文…

分类: 工具代码 标签: , , ,

MySQL注射经典教程

2010年3月29日 admin     1,897 views 没有评论
SQL Injection Tutorial by Marezzi (MySQL)
From milw0rm.com
In this tutorial i will describe how sql injection works and how to
use it to get some useful information.
First of all: What is SQL injection?
It’s one of the most common vulnerability in web applications today.
It allows attacker to execute database query in url and gain access
to some confidential information etc…(in shortly).
1.SQL Injection (classic or error based or whatever you call it) :D
2.Blind SQL Injection (the harder part)
So let’s start with some action :D
1). Check for vulnerability
Let’s say that we have some site like this
http://www.site.com/news.php?id=5
Now to test if is vulrnable we add to the end of url ‘ (quote),
and that would be http://www.site.com/news.php?id=5′
so if we get some error like
“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc…”
or something similar
that means is vulrnable to sql injection :)
2). Find the number of columns
To find number of columns we use statement ORDER BY (tells database how to order the result)
so how to use it? Well just incrementing the number until we get an error.
http://www.site.com/news.php?id=5 order by 1/* <– no error
http://www.site.com/news.php?id=5 order by 2/* <– no error
http://www.site.com/news.php?id=5 order by 3/* <– no error
http://www.site.com/news.php?id=5 order by 4/* <– error (we get message like this Unknown column ’4′ in ‘order clause’ or something like that)
that means that the it has 3 columns, cause we got an error on 4.
分类: 渗透测试 标签: ,