Israel Private 0Day Shell Upload Exploits ASP|PHP

Hey Guyz ..Today I found some FRESH Private Israel 0Day Exploits . So i thought of sharing with you all....So lets Start....

1). First 0Day Shell Upload ASP | PHP

# Google Dork -|-

'prod1.aspx?pid=' site:il or You can also create your own Dork

# Exploit Upload 1 -|-
/admin/adminbanners.aspx

# Exploit Upload 2 -|- 
/admin/AdminPics.aspx

When you upload your asp or php shell just Check Code Source of the page you will see your url

2). Second 0day Upload

# Dork -|- 
inurl:/index.php?categoryID= site:il
inurl:/index.php?ukey=auth
inurl:/index.php?ukey=feedback
inurl:/index.php?ukey=pricelist
inurl:/index.php?ukey=auxpage_faq
inurl:/shop/index.php?categoryID=
inurl:ukey=product&productID=

# Exploit -|-
/published/common/html/xinha/plugins/ImageManager/manager.php

‪#‎Exploit‬ -|-
/published/common/html/xinha/plugins/ExtendedFileManager/manager.php

3). Third 0day Upload Blind Sql Injection

 This just Targets with havij or manually and admin page of the script is www.target.co.il/QAdmin

# Dork -|- 

intext:cybercity site:il
inurl:index.php?id= <-- Page 4
intext:medicine site:il
inurl:index.php?id= <-- page 2

Read more ...

Top 10 Free Vpn Services!!!

Top 10 Free VPN Servies
First of all, lets talk about what a VPN is.
VPN simply means “Virtual Private Network”. Basically it’s a private network which lets users to connect to other users or remote sites using a public network usually internet. It uses “virtual” connections routed through the Internet from the company’s private network to the remote site or employee instead of physical connections. In short , it is private network constructed within a public network infrastructure, such as the global Internet.
Why You Need VPN

To protect privacy, either on a LAN or a public hotspot.
Anonymous Internet Surfing Full anonymity by hiding your real IP address.
Bypass geographical blocks from certain websites Unlike a proxy, you get secured connection for all programs you are using Quality Network ensures your VPN service will be fast wherever you are in the world Protection against your ISP Bypass ISP Blocking for VOIP Applications like Skype.

Top 10 Free VPN Servies
1. UltraVPN
(https://www.ultravpn.fr/) It is a free VPN client/ server SSL VPN solution based on OpenVPN. It encrypts and anonymizes your network connection making your connection safe and secure. You need to download and install the client and create a (username, password) to use this service.
2. Logmein Hamachi
( https://secure.logmein.com/products/hamachi2/download.aspx )
It’s a great free VPN service from the well known guys who are behind the Logmein Service of remote apps management. It’s free for non-commercial and personal use. Features : No hardware required – A quick, simple and easy-to-use VPN that just works Secure communications – Encrypted tunneling across public and private networks Flexible networking – Combines the ease of an SSL VPN with the connectivity of an IP-sec VPN Web-based management – Deploy to anyone, manage from anywhere, access anytime Free for non-commercial usage – Absolutely free for non- commercial use.
3. Packetix
(http://www.packetix.net/en/)
Its a japanese free VPN solution with technology developed by SoftEther Corporation.You can use PacketiX.NET online test service for free.Here’s what you can do with this service. You can create your private Virtual VPN Hub. You can configure and use the hub for free.You can use all functions the PacketiX VPN software has to offer, such as creating a remote connection to your home network or uniting local networks at different sites. With our system, you won’t need to set up a VPN server with a global IP address yourself. The VPN server administration is done over an easy web interface.
4. Open VPN
( http://openvpn.net/index.php/opensource/downloads.html )
Open VPN drives UltraVPN, OpenVPN is a SSL/TLS based VPN, it provides high security and privacy. The biggest difference between PPTP VPN and OpenVPN is you need install OpenVPN client software to use OpenVPN service, and OpenVPN DO NOT work on mobile devices such as Iphone, Ipad Windows Mobile and Android. But OpenVPN works on Windows, Mac and Linux.
5. Your Freedom
( http://www.your-freedom.net/index.php?id=downloads )
This one is basically not a VPN service but its performs almost the same function with great ease, hence i included this in this list. It provides both a free and paid service. Free service limits to six hours of usage per day (up to 18 hours per week). You need to install a client on your system and a user name & password to use this.
6. Macro VPN
(http://www.macrovpn.com/)
Just like other services MacroVPN offer free VPN service for the user’s, it provides 128bit PPTP encrypted VPN Connection Service, protection on wifi hotspot. Normally assigned US based IP’s.
7. Hotspot Shield
( http://hotspotshield.com/?lg=en)
Hotspot Shield is a free VPN service which protects your entire web surfing session; securing your connection at both your home Internet network & Public Internet networks (both wired and wireless) . Hotspot Shield protects your identity by ensuring that all web transactions (shopping, filling out forms, downloads) are secured through HTTPS.Here also, you need to download and install a client to use it on your computer.
8. Its Hidden
(http://itshidden.com/)
Itshidden is part of Port 80 Limited(Seychelles) company providing both free VPN and paid services of VPN It creates a secure connection encrypting all the data protecting your privacy and securing you. You dont need to install any software. ItsHidden.com works on all Platforms including Windows, Mac, Linux, IPhone etc
9. CyberGhost
(http://cyberghostvpn.com/)
This a free VPN service from Germany which helps you route you through a German IP. The free service is limited to 10GB traffic every month, which is more than enough for surfing on websites, chatting and email.
10. Gpass
( http://gpass1.com/gpass/)
This is another free VPN service product of the World’s Gate, Inc which offers Internet solutions for information freedom in China and other regions. You need to install a software client to use this.

Read more ...

Free VPN • 100% Free PPTP and OpenVPN Service

Vpnbook

Free Open Vpn And PPTP
Surf Anonymously
100% Free Vpn Service

PPTP VPn :

• Free PPTP VPN Account (Easy to setup, no need to download any software, works with all Windows, Mobile and PS3 Devices)
  • Server #1: euro195.vpnbook.com
  • Server #2: euro213.vpnbook.com
  • Server #3: uk180.vpnbook.com (UK VPN - optimized for fast web surfing; no p2p downloading)
  • Server #4: us1.vpnbook.com (US VPN - optimized for fast web surfing; no p2p downloading)
  • Server #5: us2.vpnbook.com (US VPN - optimized for fast web surfing; no p2p downloading)
  • Username: vpnbook
  • Password: spa5urEp
  • More servers coming...

OpenVPn :

• Free OpenVPN Account (Requires Download of the free opensource OpenVPN Client, OpenVPN offers the best anonymity and is impossible to block by your government, school or Internet Service Provider.) - You should try all the profiles and see which provides the fastest and most stable speeds.
  • Server #1: Download Euro1 Server OpenVPN Certificate Bundle
  • Server #2: Download Euro2 Server OpenVPN Certificate Bundle
  • Server #3: Download UK Server OpenVPN Certificate Bundle (UK VPN - web surfing only; no p2p)
  • Server #4: Download US1 Server OpenVPN Certificate Bundle (US VPN - web surfing only; no p2p)
  • Server #5: Download US2 Server OpenVPN Certificate Bundle (US VPN - web surfing only; no p2p)
  • All bundles include UDP53, UDP 25000, TCP 80, TCP 443 profile
  • Username: vpnbook
  • Password: spa5urEp

Read more ...

How Hackers hack any account using Authentication flaws - 1st

                                       Hello, buddies my last post was about Web Server Hacking through Command Injection and as you know Injection is most dangerous Web Application vulnerabilities and 2nd is Session Management and Authentication flaws (As per OWASP Top 10 Vulnerabilities 2013). So today we'll learn Authentication flaws.

What is Authentication Flaws ?
It is little tough to describe Authentication flaw. Developers frequently build custom authentication and session management schemes, but building these correctly is hard. As a result, these custom schemes frequently have flaws in areas such as logout, password management, timeouts, remember me, secret question, account update, etc. Finding such flaws can sometimes be difficult, as each implementation is unique. Such flaws may allow some or even all accounts to be attacked. Once successful, the attacker can do anything the victim could do. Privileged accounts are frequently targeted.

Finding an authentication flaw isn't easy you'll have to analyze HTTP data, How Web App works, Encoding, How it get validated and all you've to become clever hacker to find that, It's an art in itself.

Authentication Flaw Exploitation Tutorial
So today we'll learn simple Authentication vulnerability exploitation tutorial. It's pretty amazing, just follow the below steps.

Requirements :

• OWASP-BWA (Broken Web App) Pentesting lab
• Burp Suite
• Brain

Start OWASP-BWA Virtual Machine, Open Homepage and Click on WebGoat.NET. It is also one kind of penetration testing box for learners and beginners in Ethical Hacking and Security Researching.

You'll be redirected to Homepage Just Click on Setup Database blue button.

Now Navigate to : WebGoat Coins Customer Portal > Forgot Password

Click on Image to enlarge it

Here, you know all website which uses login forms, they have members accounts, password and ID database. Then definitely they have password recovery options in case you forgot your password, you can retrieve. But often, many web application have authentication flaws just you need to understand how it works and what type of security it uses. So Now, assume that you are hacker and WebGoat.NET is your target - assume this is popular social networking or business website and this contain Authentication flaw, you need to find it and exploit it. The flaw is in the forgot password that leave some security question answer in Base64 encoded text, you need to crack it and hack any users account.

Authentication flaws is little hard to find but very interesting you just have to understand web application logic and method they uses to authenticate users.

• Back to tut guys! : Now you need to get email of any user, Just type any alphabet like a or m it will automatically suggest you an email. Choose any one for eg m using this email : sky@havelzbyszekco.com.
  
  
  Click on Image to enlarge it
  
  
  
• Click on Proceed : and you'll get security question, now you've to find authentication flaw to hack security question.
  
  
  Click on Image to enlarge it
  
  
  
• So m trap here, i can't get password until i provide right security question answer, Now my question is where Web application stores this security question answer to validate it, and how it works? lets capture this in Burp Suite and understand.

Commonly many web application leaves Security question answer in Source Code, Cookie, Parameters, etc it can be anywhere you've to use logic and your great mind to know where and how it works using logic, tools & Hackers mind.

• Just type any bogus answer and click on recover password : And start analyzing parameters, source code, Cookies, and every content that passes between browser and web server. m using Burp Suite.
  
  
  Click on Image to enlarge it
  
  
  
• Guys as you all know it is already vulnerable, so we don't need to find it - just start understanding above image : and you'll see one cookie named encr_sec_qu_ans= well, this contain Question answer.
  
• As I told you web application uses many ways to validate users answer through cookie, source code or even parameters - so here the WebApp is using Base64 Encryption text in Cookie that validates users security question answers and gets validated. Fine! lets decode it :
  
  
  
• Select the Base64 Encrypted text > Right click on it and Send to Decoder
  
  
  Click on Image to enlarge it
  
  
  
• Well, now its simple just click on Decode as Base64
  
  
  Click on Image to enlarge it
  
  
  
• Sounds Pretty cool! you'll get another Base64 Encryption, well mostly web app do this to protect data as much they can, so decode it again.
  
  
  Click on Image to enlarge it
  
  
  
• Wow! so till now i hope you've understand what exactly is Authentication flaws, it is one kind of logic to understand web application and Hack it. So we got an answer, CALIFORNIA! - it is not necessary that every website uses same method to validates users security answer, may be they do but different encryption like MD5, SH11 SH-256, or any you just need to become clever hacker to understand.
  
• We've successfully exploited Authentication flaw in WebGoat.NET, now back to browser and enter correct answer and click on recover password.

Click on Image to enlarge it

Well, this is only called Authentication flaw - now you can hack any users account without any social engineering. There are many such kind of flaw in web application just we need to understand how it works.

: If you want live Tutorial then Watch Below video of Complete Post :
Click here to view me on youtube : Full Screen mode

The word i repeated most was : Just Try to understand how web application work! - I hope you understand what i mean. To become clever hacker learn Programming, Networking, WebApp architecture, and logics. We've many kind of Ethical Hacking articles, Books, Tools, Post, Tricks, tutorials, & Online books like D Hacker Drive. 

Thank you for reading my post, do a share if you like it, as always feel free to comment and let me know your problem. Sharing is caring :)

- 



#Copied :D

Read more ...

Announcement : Our Own Proxy Giving about 500 MBPS+

 

Presenting Our Own Proxy Server 

Any type of Hacking & Fraudent activites Will be logged and Given to FBI for Further actions so Keep Safe...

Proxy server address.

http://95.85.18.66/

Read more ...