Local Attacks - Revision history

Edmund at 21:43, 29 January 2017

2017-01-29T21:43:57Z

← Older revision		Revision as of 00:43, 30 January 2017
Line 306:		Line 306:

	[['''''!!! This article is served for education purpose only, I will not responsibility for any harm made by other ones !!!''''']]		[['''''!!! This article is served for education purpose only, I will not responsibility for any harm made by other ones !!!''''']]

			[[Category:Operatsioonisüsteemide administreerimine ja sidumine]]

Lphanvan: /* References */

2016-06-02T19:34:46Z

References

@@ Line 233: / Line 233: @@
                                                      [[File:Dtb.png]]
                                                                                          Figure 3: Login to database via shell
 =References=

Lphanvan: /* How to avoid Local Attack? */

2016-06-02T19:34:36Z

How to avoid Local Attack?

← Older revision		Revision as of 22:34, 2 June 2016
Line 264:		Line 264:

	'''https://www.youtube.com/watch?v=HpY6JxIzs1g'''		'''https://www.youtube.com/watch?v=HpY6JxIzs1g'''

	~~=How to avoid Local Attack?=~~
	~~In my opinions, Local attack is one of dangerous attacking methods I have used so far. Below are my experiences to avoid the Local attack:~~


	~~- Should not use the source code when we do not know where it comes from, malicious code might be attached.~~

	~~- Checking the update of source codes as well as server to fix vulnerability frequently.~~

	~~- Change the password to be stronger and hard to brute force.~~

	~~- Set chmod 400 for sensitive files and 101 for folders.~~

	~~- Use VPS instead of using host to avoid local attack.~~

	~~- Data back up and scan the data to realize it's having malicious code or not.~~


	~~These are my experiences to avoid Local Attack. Surely, It might not a perfect way to avoid, but at least it could help us to reduce the risk.~~

	=Conclusion=		=Conclusion=

Lphanvan: /* How to avoid Local Attack? */

2016-06-02T19:31:33Z

How to avoid Local Attack?

← Older revision		Revision as of 22:31, 2 June 2016
Line 283:		Line 283:

	These are my experiences to avoid Local Attack. Surely, It might not a perfect way to avoid, but at least it could help us to reduce the risk.		These are my experiences to avoid Local Attack. Surely, It might not a perfect way to avoid, but at least it could help us to reduce the risk.

			=Conclusion=

			As what I wrote above are an outline of the Local Attack method which attackers can use their php shell to exploit not even one website it could be all of websites are standing in a same server. In which the attack can execute the command line to your server to find out the password of your database or host. Get Root access is possible if the Linux server are not being updated. Those steps above might not be used successfully in some cases, because it depends on the configuration of administrator and the version of server is setting up.

	=Contact=		=Contact=

Lphanvan: /* Conclusion */

2016-06-02T19:31:16Z

Conclusion

← Older revision		Revision as of 22:31, 2 June 2016
Line 264:		Line 264:

	'''https://www.youtube.com/watch?v=HpY6JxIzs1g'''		'''https://www.youtube.com/watch?v=HpY6JxIzs1g'''

	~~=Conclusion=~~

	As what I wrote above are an outline of the Local Attack method which attackers can use their php shell to exploit not even one website it could be all of websites are standing in a same server. In which the attack can execute the command line to your server to find out the password of your database or host. Get Root access is possible if the Linux server are not being updated. Those steps above might not be used successfully in some cases, because it depends on the configuration of administrator and the version of server is setting up.

	=How to avoid Local Attack?=		=How to avoid Local Attack?=

Lphanvan: /* Local Attack Introduction */

2016-06-02T17:34:16Z

Local Attack Introduction

← Older revision		Revision as of 20:34, 2 June 2016
Line 17:		Line 17:
	==What is Local Attack?==		==What is Local Attack?==

	In generally, once we host the website to server, after that the user will be provided an " user account" and the directory/folder to mange their website. For instance, the user 1 has a website "A" and one directory/folder : /home/user1 to manage user 1. Similarly, the user 2 has a website "B" and one directory/folder /home/user2 to manage.		In generally, once we host the website to server, after that the user will be provided an " user account" and the directory/folder to mange their website. For instance, the first user has a website "A" and one directory/folder : /home/user1 to manage first user Similarly, the second user has a website "B" and one directory/folder /home/user2 to manage.

	Local attack is ~~the~~ the method which is applied to hack a website in the same server. For example, I want to attack website "A" from user 1, but unfortunately I could not find out the vulnerabilities to exploit and get an lien from it, that means I have no way to attack based on this site "A". So, I will look for the websites which are being on the same server with "A", could be website "B" or "C".		Local attack is the method which is applied to hack a website in the same server. For example, I want to attack website "A" from user 1, but unfortunately I could not find out the vulnerabilities to exploit and get an lien from it that means I have no way to attack based on this site "A". So, I will look for the websites which are being on the same server with "A", could be website "B" or "C".

	Based on site "B" or "C"~~, the~~ both of them are getting some vulnerabilities or another words is " hackable ". After getting the authorities on ~~those~~ site "B" or "C", I will upload the php file named " Shell " to the server of "B" or "C" it's also the server of website "A". The hacking process is starting from now.....		Based on site "B" or "C" both of them are getting some vulnerabilities or another words is " hackable ". After getting the authorities on these site "B" or "C", I will upload the php file named " Shell " to the server of "B" or "C" it's also the server of website "A". The hacking process is starting from now.....

	[[File:Local1.png]]		[[File:Local1.png]]

Lphanvan: /* Abstract */

2016-06-02T17:30:17Z

Abstract

← Older revision		Revision as of 20:30, 2 June 2016
Line 1:		Line 1:
	= Abstract =		= Abstract =

	This article will be ~~concerning~~ about one of the common hacking methods in recent decades or even nowadays it is still being used by attackers. Its named Local Attack, this name is not the international official name for it. It was called by many Vietnamese Hackers, by somehow I realized it's quite good to describe partly of this attack method, so I'd like to take this name to be " our speaking" at least in this article. "This name is not available in google if you type by English "		This article will be concerned about one of the common hacking methods in recent decades or even nowadays it is still being used by attackers. Its named Local Attack, this name is not the international official name for it. It was called by many Vietnamese Hackers, by somehow I realized it's quite good to describe partly of this attack method, so I'd like to take this name to be " our speaking" at least in this article. "This name is not available in google if you type by English "


	I will illustrate the definition of Local Attack as well as the ~~difficult~~ we will be suffered ~~in during the time using~~ it beside its powerful. I will be talking detail step by step belongs with the certain knowledge what we need to know basically to do much straightforwardly and more understand its purpose. The knowledge requirement will be not hard to stop you getting the most powerful of hacking such as Web App, Linux command lines, Networking, etc.		I will illustrate the definition of Local Attack as well as the difficulties we will be suffered when we apply it beside its powerful. I will be talking detail step by step belongs with the certain knowledge what we need to know basically to do much straightforwardly and more understand its purpose. The knowledge requirement will be not hard to stop you getting the most powerful of hacking such as Web App, Linux command lines, Networking, etc.

	~~Due to~~ the security of our website and server, I will not show the php shell link in this article. I apologize for this inconvenient.		Because of the security of our website and server, I will not show the php shell link in this article. I apologize for this inconvenient.

Lphanvan: /* The basic command lines using for Local Attack */

2016-06-02T17:26:57Z

The basic command lines using for Local Attack

← Older revision		Revision as of 20:26, 2 June 2016
Line 186:		Line 186:

	tar -zxvf enderhacked.tar.gz (unzip files enderhacked.tar.gz)		tar -zxvf enderhacked.tar.gz (unzip files enderhacked.tar.gz)

			See more here: http://linuxcommand.org/lts0070.php

	===Some techniques to get useful information from config.php===		===Some techniques to get useful information from config.php===

Lphanvan: /* Shell */

2016-06-02T17:26:10Z

Shell

← Older revision		Revision as of 20:26, 2 June 2016
Line 79:		Line 79:
	See more here:		See more here:

	http://linuxcommand.org/lts0010.php		-http://linuxcommand.org/lts0010.php

	http://linuxcommand.org/learning_the_shell.php		-http://linuxcommand.org/learning_the_shell.php

	''*I recommend you use those shells or download it in virtual machines .''		''*I recommend you use those shells or download it in virtual machines .''

Lphanvan: /* Shell */

2016-06-02T17:26:02Z

Shell

← Older revision		Revision as of 20:26, 2 June 2016
Line 77:		Line 77:
	In this tutorial, I will use the shell php named: '''Shell r57 or c99'''. You can download it on google		In this tutorial, I will use the shell php named: '''Shell r57 or c99'''. You can download it on google

	See more here: http://linuxcommand.org/lts0010.php		See more here:

			http://linuxcommand.org/lts0010.php

			http://linuxcommand.org/learning_the_shell.php

	''*I recommend you use those shells or download it in virtual machines .''		''*I recommend you use those shells or download it in virtual machines .''