|
Author
|
Topic: Site security... hacking google and shtuff...
|
PeterWiggin
Resident PenIs MC
|
posted 01-30-2002 01:47
   
So im sure like most things with computers there are a multiple ways to do things such as fucking with someones site... but what does it consist of? Are you hacking into the place that serves and stores thier page? Or do you fuck with the DNS resolution so its pointed to a different page? Not like I want to do that to anyone... but im readin all this CCNA stuff and most of the router security can't be messed with (to my knowledge, which is by no means 1337) unless one has physical access. So if the place has relatively decent people working for them shouldn't it be easy to keep people out of your shite? Of course theres always the exception to the "We are a secure network" statement... but shouldn't it be plausable to keep out 99% of would be hackers????peter? IP: Logged |
FaRaN
Member with a member bigger than the member with a member
|
posted 01-30-2002 04:25
YesIP: Logged |
Jimbo
1 dr3w j00 4 p1ggy!
|
posted 01-30-2002 07:54
Probably 95% of site hacks are accomplished by running a r00t exploit on the webserver the site is hosted on and getting access that way. Most of the rest are accomplished through finding an exploitable loophole in some active technology (CGI, ASP, etc) used on that page to update and/or maintain it - whether that be a programming loophole, or just some jackass leaving the default admin UN/PW up for a commercially available application (hello UBB admin5/tugboat), or somebody picking a stupid fucking password.  IP: Logged |
hussain
S4d4m Hussain, 1st General, IRC & Script Kiddie Division
|
posted 01-30-2002 09:59
"The answer is Purple"IP: Logged |
LaMFear
Dutch Pen - Cock sucking champ of 1999
|
posted 01-30-2002 10:18
shouldn't that be "light-urple"?IP: Logged |
Slug
Uber PenIs
|
posted 01-30-2002 14:22
If I'm not mistaken you can hack router's routing table its just really difficult or somethig...I'm in my second semester of CNA but I dont really know anything oher thanits possibleIP: Logged |
shir0t
PenIs
|
posted 01-30-2002 15:07
Script kiddie in the making... Yeah, router hacking is pretty tough but it's all security through obscurity, propriety cisco software. You can get a kit and do it, but it isn't the 20 minute beatoff session defacing on windows is. IP: Logged |
eod
TREAT MERIGHT!
|
posted 01-30-2002 15:11
quote:
Originally posted by Slug:
If I'm not mistaken you can hack router's routing table its just really difficult or somethig...I'm in my second semester of CNA but I dont really know anything oher thanits possible
CNA as in Novell? or did you mean CCNA? IP: Logged |
xclusive069
drooling cretin
|
posted 01-30-2002 16:15
CNAas in Canadian Nationality Assesment his mom is going to be so proud IP: Logged |
Jimbo
1 dr3w j00 4 p1ggy!
|
posted 01-30-2002 18:05
BWAHAHAHAHA!burn. IP: Logged |
PeterWiggin
Resident PenIs MC
|
posted 01-30-2002 18:43
well, in my free time im studying for my MCECC... thats the MS emoticon certified creator... im going to make BANK... on a side note... hacking router access-lists to get into the intranet would do more good than the route tables because the route table updates regularly and would probably correct themselves. 180 seconds or sumpthin. what does a r007 exploit consist of. Im assuming you gain "root" access obviously. How would you exploit an active technology like asp cgi coldfusion etc.? Not specifically.. just theoretically... peter the unskilled IP: Logged |
Jimbo
1 dr3w j00 4 p1ggy!
|
posted 01-30-2002 22:02
Either find a weakness in the code itself behind the script (doesn't password authenticate if you manufacture direct links to manipulate the script, can be fork bombed, etc etc etc) or find a weakness in the moron using it (uses "password" for his password, etc).Basic stuff. IP: Logged |
fenomas
argument nazi
|
posted 01-30-2002 22:20
As for hacking some existing technology (like asp), there could be two flavors. The "known weakness" type would be where you read on a web page about a flaw, say that asp overflows after 256 characters in the query string or something like that, and use a url that someone made up that will use that flaw to run a command as root. The "custom-built old-world craftsman" variety would be where you start giving scripts input that they didn't expect, and try to figure out if, for example, the person who wrote the script might be passing user input directly into a system call, or something like that. Then you could put get the system to execute commands you put in the user input. A r00t exploit would be where someone says, "run this scr1p+ on a redhat 6.2 b0x that uses sendmail 8.5, and it will give you r00t access", so you run the script on such a box, and once you've got root you give your own account root perms, or install a backdoor/trojan/keylogger, or get the shadow passwd file to crack at leisure, or whatever. andy IP: Logged |
Dave
Almighty lord of relevant links
|
posted 01-31-2002 02:25
bugzilla is a great place to get info on known weaknesses in progs that will give you root; the fixes are often posted right away, but people are either lazy or unbelievably hopeful that they'll never get hit (not to mention that you don't lightly fuck around with the config/settings on progs for production machines.IP: Logged |
Slug
Uber PenIs
|
posted 01-31-2002 16:33
CNA as in Cisco Networking AcademyIP: Logged |
hussain
S4d4m Hussain, 1st General, IRC & Script Kiddie Division
|
posted 02-01-2002 01:21
Bleh, maybe you should have the script kiddy monkier. quote:
Originally posted by fenomas:
As for hacking some existing technology (like asp), there could be two flavors. The "known weakness" type would be where you read on a web page about a flaw, say that asp overflows after 256 characters in the query string or something like that, and use a url that someone made up that will use that flaw to run a command as root. The "custom-built old-world craftsman" variety would be where you start giving scripts input that they didn't expect, and try to figure out if, for example, the person who wrote the script might be passing user input directly into a system call, or something like that. Then you could put get the system to execute commands you put in the user input. A r00t exploit would be where someone says, "run this scr1p+ on a redhat 6.2 b0x that uses sendmail 8.5, and it will give you r00t access", so you run the script on such a box, and once you've got root you give your own account root perms, or install a backdoor/trojan/keylogger, or get the shadow passwd file to crack at leisure, or whatever. andy
IP: Logged |
eod
TREAT MERIGHT!
|
posted 02-01-2002 09:40
Oops on the cisco routers
http://www.theregister.co.uk/content/55/23916.html IP: Logged |
PeterWiggin
Resident PenIs MC
|
posted 02-02-2002 13:52
i could keep asking questions foreverso ill stop there... thanks though. peter IP: Logged |
UBBFriend: Email This Page to Someone!
PenIs Forum
