YGN Ethical Hacker Group Blog

- Added some searches - Added Category & site selection q = query string c = category s = site http://yehg.net/q?TinyBrowser&c=Exploits http://yehg.net/q?TinyBrowser&c=Exploits&s=milw0rm http://yehg.net/q?TinyBrowser&c=Exploits=securityfocus http://yehg.net/q?TinyBrowser&c=Exploits&s=osvdb http://yehg.net/q?TinyBrowser&c=Exploits&s=packetstorm

http://yehg.net/lab/#words Pentest Wordlists from wfuzz tool. We host them for quick online reference. Note they are not comprehensive but rather enough. They are implemented as client-side scanning word lists in our WebPageFingerprinting script. /injections xss_basic.txt xss_rsnake.txt xss_all.txt XML.txt SQL.txt Traversal.txt /stress alphanum_case.txt alphanum_case_extra.txt char.txt doble_uri_hex.txt test_ext.txt uri_hex.txt /general|crack names.txt userlist.txt big.txt big2.txt catala.txt common.txt dic1.txt euskera.txt medium.txt passlist.txt common_pass.txt spanish.txt weak_passwords_module_passlist.txt weak_passwords_module_userlist.txt extensions_common.txt mutations_common.txt subdomains.txt /vulnerability apache.txt cgi.txt cgis.txt coldfusion.txt debugs.txt domino.txt fatwire.txt fatwire_pagenames.txt frontpage.txt iis.txt iplanet.txt jrun.txt netware.txt oracle9i.txt php.txt sharepoint.txt sunas.txt tests.txt tomcat.txt vignette.txt weblogic.t

Download: MP4 | SWF Description: This movie shows how an attacker exploits an XSS vulnerability in Rapidshare.com and steals current logged in Rapidshare user's cookie which is then sent to his mailbox. Demonstrating with sample vulnerable XSS page seldom enlightens people with the real danger of XSS.We hope using the real site may make people(developers) greater awareness on the XSS threat. No doubt, we have reported this vulnerability to the Rapidshare team and they have fixed it.

- Added Text FX, Encrytion/Hashing http://yehg.net/encoding

============================================================================== TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilitis ============================================================================== Discovered by Aung Khant, YGN Ethical Hacker Group, Myanmar http://yehg.net/ ~ believe in full disclosure OSVDB ID: 56602 , 56603 Secunia Advisory ID: 36031 Advisory URL: http://yehg.net/lab/pr0js/advisories/tinybrowser_1416_multiple_vulnerabilities Date published: 2009-07-27 Severity: High Vulnerability Class: Abuse of Functionality Author: Bryn Jones (http://www.lunarvis.com) Author Contacted: Yes Reply: No reply Product Overview ================ TinyBrowser is a plugin of TinyMCE JavaScript editor that acts as file browser to view, upload, delete,rename files and folders on the web servers. Vulnerabilities ================== #1. Default Insecure Configurati

============================================================= Google Mail (Gmail) Fail to do Security Check Vulnerability ============================================================= Discovered by Aung Khant, YGN Ethical Hacker Group, Myanmar http://yehg.net/ ~ believe in full disclosure Advisory URL: http://yehg.net/lab/pr0js/advisories/gmail_fails_to_referer_check Date published: 2009-07-27 Severity: High Vulnerability Type: Lack of security check Vulnerability Consequence: Spoofing/Phishing Attack Success Vendor: Google Inc URL: http://google.com Vulnerable URL: https://www.google.com/accounts/ServiceLoginAuth?service=mail Description =========== Google mail service for custom domains checks the HTTP referer field for authenticating, i.e when a user have submitted username and password. If the HTTP refer field doesn't contain https://mail.google.com/a/yourname.com, then it warns the user the error message that asks him to login from his primary domain url. However, this securi

================================== Rapidshare Login Credential Leakage Vulnerability ================================== Discovered by Aung Khant, YGN Ethical Hacker Group, Myanmar http://yehg.net/ ~ believe in full disclosure Advisory URL: http://yehg.net/lab/pr0js/advisories/rapidshare.com_login_credential_leak_overhttp Date published: 2009-07-26 Vendor: Rapidshare (Free File Hosting Provider) URL: http://www.rapidshare.com, http://rapidshare.de Reported: Yes ([email protected]) Attacker: 1. Trojans or malwares that have sniffing capability 2. Malicious user who is running HTTP sniffer Where: User's computer / User's networks(LAN,WAN,Proxy,ISP,...etc) Overview ========== Upon understanding secure login, Rapidshare protects user credentials from HTTP Traffic sniffing with secure SSL page https://ssl.rapidshare.com/cgi-bin/premiumzone.cgi where users are redirected to when they go to the login page. Although it is their intention to protect, ther

Download Exploiting Gmail Weak Password Recovery This weakness has long existed since the introduction of Gmail. Description: Password reset/recovery questions shouldn't be too much simplistic. They shouldn't be any kinds that ask users to answer very security-weak answers such as 0-9,red-green-yellow-orange,etc. Date: June 2009 Keywords: Hacking Gmail, Cracking Gmail, through password recovery

http://yehg.net/lab/pr0js/advisories/php_support_ticket-2.2 ============================================================================== PHP Support Ticket 2.2 <= Multiple Vulnerabilities ============================================================================== Discovered by Aung Khant, YGN Ethical Hacker Group, Myanmar http://yehg.net/ ~ believe in full disclosure Advisory URL: http://yehg.net/lab/pr0js/advisories/php_support_ticket-2.2 Date published: 2009-07-23 Severity: High Vendor: Triangle Solutions Ltd (http://www.triangle-solutions.com/) Script URL: http://www.phpsupporttickets.com/ Demo URL: http://www.phpsupporttickets.com/modules/phpsupporttickets.com/demo/ Overview ========== This version of PHP Support Ticket is bundled together in today's one-click script installer of all/most web hosting providers. Customers have no clue of the vulnerabilities. Hosting providers always say marketing voice - easy deployment, one-click installation - but no security. #######

Greasemonkey Script: WebPageFingerprint Series Description: Six nice video series of how a very little Greasemonkey Script can do - Web Page fingerprinting, JS fingerprinting, Vulnerability/Backup file scanning, XSS/SQL/Command Injection fuzzing ...etc. Date: July 2008

WebScarab Demonstration Series Description: See how WebScarab is useful in web application security assessment. - Spidering - Finding Hidden Clues - Session Analysis - XSS Hunting - Dir Enumeration - Backups Enumeration Date: August 2008

Passive Vulnerability Scanning with RatProxy Description: See how a google security guy's RatProxy is good at Web Application Security Assessment. Date: August 2008

Attack Log Analysis with Scalp! Description: Scalp is a very great apache log attacker analyzer using php-ids IDS pattern file. If you scan your web site logs weekly or daily, you will see attacks are coming to your site on a regular basis. People tend to check their logs only after compromise is accomplished. It is too late. Attackers have 0wned their sites and manipulated log files! Date: Sept 2008

HTTP Form Brute Forcing With JHijack Description: The Initial reason for JHijack is to use it in numeric Session Hijacking but its uses depend only on who use it. We've given yet another example in Blind SQL Injection. This time, it can also be used as HTTP Form Cracker like an old school - Brutus. Date: Nov 2008

Why JS Malwares are still prevelent and bypassing AV Scanners Description: Even up to now due to today's AV Scanner's Poor Defense against web worms, we'll never be secure. This movie shows you how JS malwares can easily bypass AV Scanners using stupid string manipulation techniques. Date: May 2009

Session Strength Analysis With Stompy Description: Stompy performs NIST FIPS statistical tests on session generation and checks for correlations between arbitrary bits. A truly random token never exhibits correlation between the stage of one bit and the state of another. In this movie, I'll show you how to download, extract, compile, and run Stompy and analyze session tests for failure or pass. Ref: WAHH . Size: 10 MB Date: May 2008

Checking Weak SSL Ciphers With THCSSLCheck Description: If any weak or obsolete SSL ciphers are being used in particular web sites, then a suitably positioned attacker may be able to perform an attack to downgrade or decipher the SSL communications gaining access to user sensitive data. Ref: WAHH . Size: 2.05 MB Date: May 2008

Discovering Browser Plugin Vulnerabilities Description: See how attacker find flaws in web browser plugins to install malware to your computer. For example, if a plugin has vulnerable readFile/loadFile function, then he can read/load any files from your computer and then send them to his sever. Similarly, for saveFile function, he can overwrite any files on your disk with malicious content. Size: 9.38 MB Date: May 2008

Owning the box via Web Browser Flaw Description: You'll never think of how dangerous a link you've clicked! Generally exploiting browser vulnerabilities to gain remote access may bypass firewalls that are protecting your workstation. Firewalls typically block new, inbound connection attempts but allow users behind the firewall to create outbound connections, which allow both parties of that established connection to communicate freely in both directions over that channel. If an attacker wants to attack your firewall-protected computer, he will normally be blocked by your firewall. However, if the attacker instead hosts the domain evil.com and entices you to browse to www.evil.com, he now has a communication channel to interact with your computer. Ref: GHHB . Size: 11.3 MB Date: May 2008

XSS in phpMyAdmin 2.11.7 Description: A recorded XSS hunting movie in phpMyAdmin 2.11.7. Date: June 2008

OWASP WebGoat Web Hacking Simulation Series [over 40 Movies] Description: A Series of Full-Featured Web Hacking WalkThrough Simulations played in OWASP WebGoat v5.1 environment. General - Code Quality - Concurrency - Unvalidated Parameters - Access Control Flaws - Authentication Flaws - Session Management Flaws - Cross-Site Scripting (XSS) - Buffer Overflows - Injection Flaws - Improper Error Handling - Insecure Storage - Denial of Service - Insecure Configuration - Web Services - AJAX Security - Challenge. New movies will be added whenever WebGoat is updated. Size: N/A Date: April 2008

Trusting The Vulnerability Scanner: Danger of False Negative Sign Description: This movie is to educate developers who put their entire trust on security/vulnerability scanners. False Negative means "Scanner says it doesn't find any X vulnerability". But there actually exists X vulnerability. Be sure to read "About Movie.txt" file. Size: 2.05 MB Date: April 2008

Owning the box Via Web Application Flaw Description: See how an attacker can use our recent discovery of File-Upload vulnerability in Gmail-Lite to 0wn the entire box. This is to teach developers how a flaw in web application is evil. Size: 6.39 MB Date: April 2008

Performing Directory Brute-Force Attack Description: There are dozens of tools that let us brute-forcing directories names for sensitive information digging. In this movie, we illustrated Directory Brute-Forcing with the tool called 'JBroFuzz'. The reason why we like it is that it can brute force a large number of directories. As of this writing,the latest version JBroFuzz 0.8 has 58658 directories names that are commonly used by today's web sites. The only defense is you must not place/protect sensitive information in server-side (.htaccess). Just wanna show you - Security Through Obscurity is broken. Size: 3.51 MB Date: March 2008

Evading Firefox XSS-Warning Addon Filter Description: Just one example of how attackers can easily bypass today's security controls. We shouldn't too much reply on security products which have their own weaknesses. Size: 169 KB Date: March 2008

Exploiting Logic Flaw Description: This demonstration shows you on how a flaw in coding reveals sensitive information! Size: 2.75 MB Date: Feb 15, 2008

Finding XSS with Automated Tool Description: This training is an interactive version of the above training. It simulates you how to automate finding xss holes with fuzzers in quick and easy manner yourself . Size: 150 KB Date: Feb 6, 2008

Finding XSS with Automated Tool Description: This training shows you how to automate finding xss holes with fuzzers in quick and easy manner. Size: 1.18 MB Date: Jan 04, 2008

How Bad Guys Steal your Login Info Smartly Description: This demonstration shows you how bad guys or malicious web sites steal your login accounts info of your daily visited sites by exploiting via web browser's autoComplete feature . Size: 886.98 KB Date: Jan 11, 2008

Desirable Input Validation Baseline Check Description: This demonstration shows you on how you should implement baseline acceptable input filtering on visitors' inputs. Filtering inputs are the most important because 100% injection attacks (XSS,SQL,XPATH,OS CMD ...etc) come from inputs where filtering is weak or none. Developers should always be aware of inputs as well as outputs! You know Garbage In Garbage Out but for attackers, Garbage In Gold Out! Size: 4.09 MB Date: Jan 15, 2008

Attacking The Spammers with PhpMySpamFighter Description: Spammers use email collectors programs to grap our site visitors' emails. See our phpMySpamFighter Dos-attacks their programs. We hope there will be less spammers if this technique is used widely. In fact, it fights not only spammers but also your attackers who use the similar tools to probe your web sites. Size: 3.65 MB Date: March 2008

Download WFuzzFE Description: WFuzz FrontEnd (WFuzz UI) is what we just wrap GUI to the all-time famous wfuzz.py by Carlos del ojo & Christian Martorella ( Edge-security.com ). WFuzz is known as a Web Brute Forcer. It's a tool that got its fame thanks to its multithreading and flexibility to show only desired results based on HTTP Response Code, No. of Lines/Words. When fuzzing is done, firefox will open and show the result. Requirements: Python, JRE 1.5 >= Date: Oct 2008

Download Web Firewall Detector Typical Web Firewalls use a mechanism to classify anomaly traffics. This tool submits an old-school malicious (not dangerous) request, and tells you the type of firewall a particular web site use (if any). Mainly useful for blackbox security assessment. Coded years ago. Ref: Web Hacking Exposed 2nd Edition, ISBN:9780072262995 [REQUEST] <----> | Web Firewall | <----> [WebServer] Requirements: Perl Date: Nov 2008 No longer updated. We've contributed this wafd's signatures to w3af finger_WAF.py plugin.

Download Web Firewall Stress Tester A tool to be used for newly created OSS web firewall/proxy/servers 'coz I found vulnerability in this way. Submit (GET/POST/HEAD) user-defined packets to web firewall to test its security strength. Tell you at which packet length a firewall will crash. Good for Heap/buffer overflow hunting. [REQUEST] <----> | Web Firewall | <----> [WebServer] Requirements: Perl Date: Nov 2008

Download Joomla! Security/Vulnerability Scanner A regularly-updated scanner that can detect file inclusion, sql injection, command execution vulnerabilities of a target Joomla! web site. Requirements: Perl Start-Date: Dec 2008

We've found it impossible to run Portable Firefox with several security addons thanks to our contributing testers (Ko Soe Min, http://soemin.net & Ko Phyo, http://myanmaritpros.com ). To work around this problem, we zip-bundle hacking addons with runnable invokers (run.exe in Windows, run.pl in Linux). You must have firefox installed in your system. Make sure you already close any Firefox beforehand. Our Greasemonkey scripts Included . Download: version-1-light MD5: 80AED846164A1AECEB5AFE0759473DF2 version-2 MD5: 68C581305E2C16E9D51E41C7D75ED501 Requirement: Firefox Browser Date: Auguest 2008

Download NiktoFE Nikto FrontEnd (Nikto UI) is what we just wrap GUI to the all-time famous nikto.pl by Sullo ( CIRT Inc ).It usually takes several minutes(even hours) for a complete scan. When it's done, firefox will open and show the result. Requirements: Perl, JRE 1.5 >= Date: Oct 2008

Download phpMyAdmin Configuration Security Checker Thousands of web servers are running phpMyAdmin in more or less insecure settings. This configuration script will check user-defined configuration values against pre-defined secure values. Set config file path. Run it and save the test result and then delete this script. Coded for: phpMyAdmin 2.11.7 Date: July 2008

Download PHP Login Info Checker (LIC) v.01 In your web applications wherever user/admin registration is required, use this checker script to strictly enforce admins/users to select stronger passwords. It tests cracking passwords against 4 rules. You can extend it stricter/stronger passwords easily. It has also built-in smoke test page via url loginfo_checker.php?testlic . Demonstration: PHP Login Info Checker Demo Compatibility: PHP 4/5 Date: April 2008

Download Php-Brute-Force-Attack Detector (Former name: Php Attack Detection Engine) to detect your web servers being scanned by brute force tools such as WFuzz, OWASP DirBuster and vulnerability scanners such as Nessus, Nikto, Acunetix ..etc. This helps you quickly identify probable probing by bad guys who's wanna dig possible security holes. For more info... Requirements: PHP5, MySQL 4> Date: June 2008

Download Apache mod_rewrite security rules These rules act as a baseline web application firewall built on common attack strings. If you get banned during legitimate traffic, you'll have to remove troubled keywords. If you can't, post'em to us. We'll send you finer version that suits your site. It's a must for all web servers. Remember it cannot help most web application attacks such as Information Leakage, Insufficent Authentication/Authorization, Bruteforcing, Predicatable Resource Location, Logic flaws. Requirements: Apache with mod_rewrite module enabled Date: March 2009

Download PHPMySpamFIGHTER It makes/fills email extractors/spammers' programs with thousands of fake email addresses endlessly dynamically generated by phpMySpamFighter. So even if your site visitors post their email addresses in plain format, spammers will give up searching for correct ones. It may cause Denial-Of-Service attack back to their programs.In fact, it fights not only spammers but also your attackers who use the similar tools to probe your web sites. Compatibility: PHP 4/5 Resources: Demonstration

Download php-DDOS-Shield Php-Distributed Denial-of-Server Preventor. Nothing can stop DDOS? Don't be amazed. This is a tricky script to prevent idiot distributed bots which discontinue their flooding attacks by identifying HTTP 503 header code. Installation is to just do include. Requirement: PHP 4 > Date: July 30 2008

GoogleHacker A lightweight Windows HTA Application useful as your regular google hacking tool on Windows platform.A comprehensive search form bundled with sensitive keywords. It's capable of saving searches on disk and directly modifying keyword files. Started: Sept 2007

Download HackerFirefox Description: Portable Firefox With Web Hacking Tools Bundled Started: Dec 2007 Featured @ at OWASP

Download JHijackv.01 beta Description: A simple Java Fuzzer mainly used for numeric session hijacking and parameter enumeration. Requirement: JRE/JDK 1.4 or above Demonstrations: Session Hijacking BlindSQLInjection HTTP Form Brute Forcing Date: April 2008

A collection of our Greasemonkey scripts that aim to provide security for you and your site. We love to write Greasemonkey scripts than Browser Addons because Greasemonkey is more flexible. Any one can view and edit source codes with ease. They will forever be compatible with any versions of Gecko browsers while most security addons are no longer compatible with new versions unless their authors take pains to modify codes for compatibility. Send suggestions and bugs via our contact form at our home page. Feel free to modify codes to adapt your need. phpinfo() Security Checker Description: Whenver the script detects a phpinfo() page, it fingerprints it for how much secure that phpinfo page. It's a combination of my security thoughts and phpinfosec.com's project. Use it for security and performance issues. Ideal for web masters and web server admins who are a bit confused with phpinfo() page's numberous configuration items. Date: July 2008 WebPageFingerPrint (aka. Hackin

Download Web Application Security Papers Archived (WASPA) This project is a collection of web application security related documents, presentations, cheetsheets, guides and the like. As for always, those resources are scattered among thousands of resources on the web. Some are really worth to read but are sadly unknown by a whole large. The only noble aim of Security students, professionals, or researchers is to bring reliable security and countermeasures to our next-generation IT communication. I attempt to support this aim by collecting resources altogether in one place which can be downloaded by those who're eager for stronger security. Started: June 2008

Multiple vulnerabilities in PhpMyAdmin <= 2.11.7 - XSS in setup Cross-site Framing XSRF:ConvertCharset XSRF:CreateDatabase July, 2008

View Gmail-Lite XSS Hole Jan, 2008

View CodeIgniter Global XSS Filtering Bypass Vulnerability December, 2007

View Ning.Com Captcha Protection Bypass Vulnerability April, 2008

Input Flood Vulnerability in burglish chat Feb 23, 2006

View XSS Archive Screenshots Jan 03, 2008

View Apache Security Bypass Vulnerability in DOMPDF Dec, 2007

View Gmail-Lite Shell Code Execution Vulnerability March, 2008

View XSS-Warning Addon Filtering Bypass Vulnerability See demo movie March, 2008

Hacker Web Search Aggregator - Collection of site searches for Information Gathering phase.

This is our ongoing project to maintain the most live ever-updated comprehensive links repository. We take pains to make the HWD sure for quality links resources. Click the logo below to enter into hwd.

To generate assessment report, the following famous two methodologies are used as framework or checklists. Practical skills on tools and knowledge are required to perform the assessments accurately according to defined methodology. Carrying out assessments that satisfy all tasks mentioned in these methodologies ensures reasonable level of security. They provide pentesters baseline checklists so as not to miss anything. For more information, please buy "Web Application Hacker's Handbook" for Portwigger and download OWASP Testing Guide from owasp.org . If you'd like to propose hybrid methodologies combined with your own experience, don't hesitate to contact us. Over time, these methodologies need to be updated to cope with evolving attack vectors and threats. PortSwigger OWASP Testing Guide v2 OWASP Testing Guide v3 Privacy Policy: No data is sent to our server. Purely generated by JavaScript alone. Some words: Avoid using it as a checklist if you have

What a perfect whitehat! [ @SlideShare.net ]

Better Study Strategies [ @SlideShare.net ]

A Dark Intro To Google Hacking [ @SlideShare.net ]

Php5 Built-in String Filter Functions For Security [ @SlideShare.net ]

Introducing Malware Script Detector [ @SlideShare.net ]

An Apache Trick to protect sensitive/backup files Nov 2008

Ongoing Web Application Security Model (OWA-SM) May 2008

An Apache Trick to prevent Shell File Attack Nov 2008

Directory Bruteforce Attack Jan 09, 2008

Security Professional How to Jan 28, 2008

Why Session Protection Fails Jan 29, 2008

Ways to Protect Sensitive Files & Directories Jan 29, 2008

Web Browser Plugins Vulnerabilities => [ Download controller.php ] Feb 7, 2008

Hunting for Backdoor Scripts March 27, 2008

Things to do When you got hacked Nov 2008

Causes Of Security Flaws 101 Jan 07, 2008

What XSS Can Do Jan 02, 2008

Defeating X-Rummer Spam Bot Feb 19, 2007

Download Disclosure Vulnerability:phpinfo Jul 16, 2006

Download Jul 16, 2006

Download Jan 07 , 2006

Download May 13, 2006