Tuesday, July 27, 2010

The Basics of Hacking

I will be writing about the basics of hacking servers; I will cover how to scan and/or exploit vulnerable daemons (services) running on the target server, and how to discover and/or exploit web-script vulnerabilities. You will need to know your way around a computer before reading this. And if you don't know what a word means, Google or Wiki it!; if you don't understand a concept, post here and I will try to clarify. Thanks for reading, hope this helps.

Tools Required:
Port Scanner - nmap - http://nmap.org/
Worlds No1 Browser - FireFox - http://firefox.com/



Daemon Vulnerabilities:
Description....

Daemons (also commonly known as services) are the processes that run on a computer that allow it to do things such as serve pages with the HTTP protocol, etc. (although they do not always necessarily interact over a network). Sometimes these daemons are poorly coded, which allows for an attacker to send some sort of input to them, and they either crash, or in worse cases, they run any code the attacker chooses.
Scanning For Vulnerabilites

Well, this is where a little common sense comes in, because we need to answer one question: Which ports to scan? Well, with a little googling, we'd know that the default port for the HTTPD (web daemon) is 80, for the FTPD it's 21, etc. So if we wanted to know the version of the HTTPD running on the server, we'd run "nmap targetsite.com -p 80 -sV". NOTICE the -sV argument; it is vital, otherwise nmap will just return whether or not the port is open, and won't provide us with the daemon's version. This is great and all, but we don't want to just scan one port at a time do we? Well nmap has us covered there, so just scan multiple ports by seperating each target port with a comma (,) like so: "nmap targetsite.com -p 21,80 -sV". However, if you don't mind the scan taking a while longer, you can scan a range of ports like so: "nmap targetsite.com -p 1-1000 -sV". This will scan all ports between 1 and 1000.

Checking For Vulnerability

After your scan has finished, nmap will display the open ports on your target, along with their version (if they were identifiable, usually they are). An example return would look like this: "80/tcp open http Apache httpd 2.0.32". Taking this information, we search on milw0rm for "Apache". After skimming through the results, we see that the target is vulnerable to this vulnerability, which when run on the target server will make it crash.

Using the Exploits
This varies, depending on the language that the exploit is coded in; google on how to do this, since it would just be wasting my time how to use all of the different languages here.

Common Web-Script Vulnerabilities
Description
In this section, I will be writing about vulnerabilities in a webserver's server-sided code. Here are the topics I will be covering:
  • SQL Injection
  • (Cross-Site Scripting)
  • (Remote/Local File Include)
#################################################
-------------------------------------------------------------------
...................................................................................................................

0 comments:

Post a Comment