GnackTrackR3.iso Mirror! 21/12/2010

The guys over at RubyRingTechnologies have been kind enough to host GnackTrack on 4 individual servers, there's now no longer any need to wait for your download. To get your copy of GnackTrackR3 the quick way please goto the downloads page and check out the mirror links.

Read more »

Posted in: GnackTrack,OS

GnackTrackR3.iso torrent. 18/12/2010

Due to the number of downloads we have had to once again release a torrent. To download GnackTrackR3.iso via a torrent please goto the downloads page. Meanwhile we are trying to sort out a few mirros such as ibiblio and mirror.ac.uk. If anyone has any other recommnedations please let us know immediately.

Read more »

Posted in: GnackTrack,OS

GnackTrackR3 based on Ubuntu 10.10! 15/12/2010

After the recent rush to get GnackTrackR2 ready in order to comply with Tenables request we felt that the version didn't under go a full iteration of bug testing. And so, we are proud to announce GnackTrackR3. This version is based on the more recent Ubuntu 10.10 so has better wifi support out of the box as well as the added benefits of a default install of the 2.6.35 kernel. We have added many new tools to this release so get it
# whilst it's hot!

Read more »

Posted in: GnackTrack,OS

[08/10] Linux Security Summit 2010 slides published

I've updated the papers section of the site to include my slides from the Linux Security Summit 2010. The title of the presentation was "Linux Security in 10 Years". In the presentation, I demonstrated the threat of kernel exploitation, how kernel exploitation subverts access control/container-based security, the need to have a broader view of system protection, in particular the need for kernel self-protection.

# grsecurity

Read more »

Posted in: Linux,Security,Tutorial

Havij v1.13 Advanced SQL Injection

Description:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.

The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.

The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.


What's New?

* Oracle error based database added with ability to execute query.
* Getting tables and column when database name is unknown added (mysql)
* Another method added for finding columns count and string column in PostgreSQL
* Automatic keyword finder optimized and some bugs fixed.
* A bug in finding valid string column in mysql fixed.
* 'Key is not unique' bug fixed
* Getting data starts from row 2 when All in One fails - bug fixed
* Run time error when finding keyword fixed.
* False table finding in access fixed.
* keyword correction method made better
* A bug in getting current data base in mssql fixed.
* A secondary method added when input value doesn't return a normal page (usually 404 not found)
* Data extraction bug in html-encoded pages fixed.
* String or integer type detection made better.
* A bug in https injection fixed.

How to use

This tool is for exploiting SQL Injection bugs in web application.

For using this tool you should know a little about SQL Injections.

Enter target url and select http method then click Analyze.

Note: Try to url be valid input that returns a normal page not a 404 or error page.



Licence

The free version of Havij is free software. We hope it be useful for you.
This software is provided "as is" without warranties.
Feel free to share and distribute it anywhere but please keep the files original!

There is a commerical version of Havij that is not free.
To purchase Pro version of Havij please visit Here


Disclaimer

We are NOT responsible for any damage or illegal actions caused by the use of this program. Use on your own risk!

Follow the link below to download Havij 1.13 free version:

Havij v1.13 Free (MD5 checksum: 276a84bda58a9def55eef35bf2838a77)


#indonesiancoder.com

Read more »

Posted in: Hacking,Havij,Tools,Tutorial

Vigilantes Take Offensive in WikiLeaks Censorship Battle

Internet vigilantes stepped up attacks in support of WikiLeaks on Wednesday, downing Visa’s web site in a widening protest against a handful of companies that banned the secret-spilling site after it began publishing hundreds of secret U.S. diplomatic cables.


The outages, organized by the group Anonymous under the banner “Operation Payback,” have taken the battle between WikiLeaks supporters and opponents over web censorship to the streets, so to speak, sparking a series of tit-for-tat retaliations that appeared to be growing at the time this article was posted.

At stake is not just the future of WikiLeaks, the protesters seem to believe, but freedom on the net in general — a principle worth defending by any means possible, however dubious.

“There are people that want to send a message that the Internet is a sovereign territory,” according to Barrett Lyon, CEO of 3Crowd and one of the early pioneers in fighting DDoS (distributed denial of service) attacks from 2000 to 2006.

Online speech and corporate attempts to control it have sparked firefights before, but the naked control of commercial service providers over WikiLeaks’ cash flow and internet presence has sparked an unprecedented reaction that may not be easily brought to heel.

An Anonymous member or sympathizer wrote to Wired.com to announce the attacks, passing along this statement from the chat channel being used to organize the attack:

We are the clear logic used to unveil wrongdoing. The general public, clouded by misleading information mostly by the media with a political agenda, fails to see and understand this wrongdoing. Because of this, those who do the wrongdoing escape unpunished. Anonymous is here to ensure punishment does not go unserved to those who deserve it.

In an interview, Lyon called the attacks historic in how well-organized the attackers are, estimating as many as 5,000 people may be involved and noting that the organizing site includes an FAQ, a propaganda operation and a radio station.

Anonymous, which has its roots in the uncensored crook of the 4chan message boards, has a history of such attacks, including a recent campaign against the record industry for attacking file sharing sites, mass-infiltrating an online game for kids to protest its stupidity, and an earlier long-running campaign against the Church of Scientology.

The Scientology attacks were investigated by the FBI, and at least one Anonymous member was jailed for his part in clogging Scientology’s websites.

Few who are part of Anonymous are actual “hackers,” and instead join in the attacks by running specialized software provided by more technically adept members. Instruction for which sites to target and when are passed around dedicated online chat channels and websites, creating a sort of online insurgency.

Anonymous’ DDoS tool has an unusual twist, according to Lyon, incorporating features that allow members to connect to the botnet voluntarily, rather than mobilizing hijacked zombie machines. It is called LOIC, which stands for “Low Orbit Ion Cannon,” and evolved from an open source website load-testing utility. A new feature called Hivemind was added, which connects LOIC to anonops for instructions, and allows members to add their machines to an attack at will.

However the software does not mask a user’s IP address, and has generated complaints from its users that it sucks up all their available bandwidth when it’s in attack mode.

Despite the high level of organization, Lyon said the attacks themselves are not particularly sophisticated. “It is mediocre, at best,” he said. “There is a lot they are doing wrong, and yet they are still succeeding.”

Visa.com stopped responding early Wednesday afternoon Pacific time, while Mastercard.com fell at least eight hours earlier and remains unresponsive. Neither company’s backend credit-processing systems are affected, though purchases that require a secondary web confirmation (e.g. Verified by Visa and Mastercard SecureCode) are reportedly not working, since they require online verification.

Mastercard, Visa and PayPal all cut off WikiLeaks in the past week, citing violations of their “terms of service” agreements, but no such action has been taken against The New York Times and other publications that are reprinting and reporting on the cables.

The U.S. State Department has called the ongoing publication of the 250,000 diplomatic cables “illegal,” but no charges have been filed against the site. Publishing government documents, even classified ones, is not explicitly illegal in the United States, though it is in England.

WikiLeak’s credit card processor Datacell is planning to sue over the shutdown, according to WikiLeaks’ Twitter feed.

Anonymous earlier attacked and took down for several hours a Swiss bank that froze an account belonging to WikiLeaks founder Julian Assange. Anonymous is also aiming at PayPal.com, an attack which could, if successful, block financial transactions, but so far that site remains up.

Twitter and Facebook, meanwhile, which have so far refused to ban WikiLeaks, dropped Anonymous late Wednesday, prompting the group to re-register on Twitter within minutes under a new name.

Adding to the insult, Anonymous on Wednesday afternoon publicly posted what looks to be more than 10,000 credit card numbers along with expiration dates, though early analysis indicates the numbers are fake.

On Wednesday, even as its site was inaccessible, Visa sought to assure the public that everything was fine.

“Visa’s processing network, which handles cardholder transactions, is functioning normally, and cardholders can continue to use their cards as they routinely would. Account data is not at risk,” the company said in a e-mailed statement.

Visa, however, dodged the question of why it blocked WikiLeaks and seemed to be trying to shrug off the takedown as if no attack were underway.

“Separately, Visa’s corporate website — Visa.com — is currently experiencing heavier-than-normal traffic. The company is taking steps to restore the site to full operations within the next few hours.”

WikiLeaks itself has suffered from denial of service attacks since last Sunday, including one from a “patriotic” hacker. That’s when the site began publishing cables provided to the site by Pfc. Bradley Manning, according to chat logs first reported by Wired.com, who had access to them as part of his work as an intelligence analyst in Iraq. Manning is in jail in Quantico, Virginia, awaiting trial.

Assange is also now in custody in London related to sex-crimes charges in Sweden, which has the organization scrambling to operate. Assange is expected to fight extradition.

Read more »

Posted in: Barrett Lyon,Cables,DDoS,Julian Assange,WikiLeaks

Maria Ozawa getting married?

Read more »

Posted in: Maria Ozawa,Married