Different PH sites including random sites Breached

A Defacer who claimed to be "Yamiko" initiated a MASS defacement attack to different PH like websites including some random sites.

 

The defacement page says: "Hello Admin~ Im Yamiko with a special greet to the admin of the Websites". As of now we don't know whats the reason in hacking and defacing this sites, but as stated in the mirrors it is Just for fun.

Some of the defaced sites are PH universities, forums, establishments and agency websites like

STI Zamboanga City Campus
GCA Team Forum
cpreyeshospital
What is my IP PH
onlinetravelexpress.com.ph and much more.

See the Full Mass Defacement Mirrors below
http://www.youdeface.com/?user=Yamiko

Here are some of the defaced sites:

http://www.onlinetravelexpress.com.ph/~smwd/index.php
http://stizambo.com/~smwd/index.php
http://cpreyeshospital.com/~smwd/index.php
http://theamberwing.com/~smwd/index.php
http://phildeafres.org/~smwd/index.php
http://emanjacela.com/~smwd/index.php
http://jcacubao.com/~smwd/index.php
http://staunchnook.com/~smwd/index.php
http://vyncebarroswebdev.com/~smwd/index.php
http://victorreyes.net/~smwd/index.php
http://miraculousmedalapostolate.com/~smwd/index.php
http://boristickets.com/~smwd/index.php
http://victoriosports.com/~smwd/index.php
http://batanestourpackages.com/~smwd/index.php
http://thearticlegeek.com/~smwd/index.php
http://ampiyas.com/~smwd/index.php
http://ajjose.com/~smwd/index.php
http://onlinetravelexpress.com.ph/~smwd/index.php
http://cityofsands.com/~smwd/index.php
http://colorplay.ph/~smwd/index.php
http://pesosense.com/~smwd/index.php
http://philippine-retirement.com/~smwd/index.php
http://lifeisaonegrand.com/~smwd/index.php
http://sympaxenergy.com/~smwd/index.php
http://kaizenhrprovider.com/~smwd/index.php
http://iprotect.com.ph/~smwd/index.php
http://balisongmaker.com/~smwd/index.php
http://shutterblogger.com/~smwd/index.php
http://philippinephotographyblog.com/~smwd/index.php
http://elnidotoursandpackages.com/~smwd/index.php
http://newworldpages.com/~smwd/index.php
http://bolilandgarden.com/~smwd/index.php
http://epicureanlens.com/~smwd/index.php
http://welmanville.net/~smwd/index.php
http://ilprog.net/~smwd/index.php
http://para-forum.com/~smwd/index.php
http://towerinnmakati.com/~smwd/index.php
http://markontoy.com/~smwd/index.php
http://foodsonthespot.com/~smwd/index.php
http://metascanit.com/~smwd/index.php
http://camiguintrips.com/~smwd/index.php
http://digitalshots.biz/~smwd/index.php
http://boracayspecials.com/~smwd/index.php
http://websafety.com.ph/~smwd/index.php
http://cebubeverlyhotel.com/~smwd/index.php
http://chibusquephotography.com/~smwd/index.php
http://laspinasmedicalsociety.com/~smwd/index.php
http://nyssaebora.com/~smwd/index.php
http://curlydianne.com/~smwd/index.php
http://hmepay.com/~smwd/index.php
http://unidentifiedyou.com/~smwd/index.php
http://jasiltraveltours.com.ph/~smwd/index.php
http://percentjobs.com/~smwd/index.php
http://hakunamatata.ph/~smwd/index.php
http://kitchensbest.com.ph/~smwd/index.php
http://farmersnotebookph.com/~smwd/index.php
http://teeshirts.ph/~smwd/index.php
http://eventsphilippines360.com/~smwd/index.php
http://hydroscape.com.ph/~smwd/index.php
http://holyfamilyschoolqc.edu.ph/~smwd/index.php
http://delfi.com.ph/~smwd/index.php
http://guzmancollege.edu.ph/~smwd/index.php
http://dps.edu.ph/~smwd/index.php
http://healthactivist.ph/~smwd/index.php
http://estudiopintado.com.ph/~smwd/index.php
http://rommagroup.com.ph/~smwd/index.php
http://imandugeno.com/~smwd/index.php
http://patches.com.ph/~smwd/index.php
http://fullcirclemonsters.ph/~smwd/index.php
http://realtylistingsph.com/~smwd/index.php
http://singphil.org/~smwd/index.php
http://kabayanradio.com/~smwd/index.php
http://triconti.ph/~smwd/index.php
http://silvermisttravelexpress.com/~smwd/index.php
http://dec.edu.ph/~smwd/index.php
http://autodrive.com.ph/~smwd/index.php
http://pusongcebu.com/~smwd/index.php
http://aimc.com.ph/~smwd/index.php
http://rapapharmacy.com/~smwd/index.php
http://kotsedeals.com/~smwd/index.php
http://kolossiresort.com/~smwd/index.php
http://balikbayantourpackages.com/~smwd/index.php
http://goexploreph.com/~smwd/index.php
http://philippines-hotels.org/~smwd/index.php
http://discoverbayog.net/~smwd/index.php
http://neilsonsnet.com/~smwd/index.php
http://kendokamanila.com/~smwd/index.php
http://behindthepenname.com/~smwd/index.php
http://philippineprimeproperties.com/~smwd/index.php
http://dcti.edu.ph/~smwd/index.php
http://ebigaymo.com/~smwd/index.php
http://jcphil.org/~smwd/index.php
http://digitize.ph/~smwd/index.php
http://ideacubeph.com/~smwd/index.php
http://strobertstransnational.edu.ph/~smwd/index.php
http://galileoenoteca.ph/~smwd/index.php
http://lancasternewcitycavite.com.ph/~smwd/index.php
http://jademarine.com.ph/~smwd/index.php
http://bquick.com.ph/~smwd/index.php
http://powerhouse.com.ph/~smwd/index.php
http://panitikan.com.ph/~smwd/index.php
http://iag.org.ph/~smwd/index.php
http://shoot.ph/~smwd/index.php
http://bus.com.ph/~smwd/index.php
http://tupt.ph/~smwd/index.php
http://lemontreeinn.com.ph/~smwd/index.php
http://whatismyip.ph/~smwd/index.php
http://gentlefamilyhomecare.org/~smwd/index.php
http://rodeostar.com.ph/~smwd/index.php
http://sabaytayofoundation.org/~smwd/index.php
http://marnil.com/~smwd/index.php
http://dcti.edu.ph/~smwd/index.php
http://federicocruz.com/~smwd/index.php
http://jcphil.org/~smwd/index.php
http://digitize.ph/~smwd/index.php
http://ideacubeph.com/~smwd/index.php
http://strobertstransnational.edu.ph/~smwd/index.php
http://galileoenoteca.ph/~smwd/index.php
http://lancasternewcitycavite.com.ph/~s...dex.php
http://digiguard.com.ph/~smwd/index.php
http://asist.edu.ph/~smwd/index.php
http://kikayforever.ph/~smwd/index.php
http://drop.com.ph/~smwd/index.php
http://thewetlook.com.ph/~smwd/index.php
http://villaruz.com.ph/~smwd/index.php
http://austhealth.ph/~smwd/index.php
http://uppress.com.ph/~smwd/index.php
http://thebookshelf.ph/~smwd/index.php
http://cyberbullying.ph/~smwd/index.php
http://thelordreigns.ph/~smwd/index.php
http://bantay.ph/~smwd/index.php
http://automotivefranchises.org/~dori15/index.php
http://santos.ph/~smwd/index.php
http://nicart.ph/~smwd/index.php
http://spmamplasan.com.ph/~smwd/index.php
http://gamotnijuan.com.ph/~smwd/index.php
http://alterilexposed.com/~dori15/index.php

EBay asks 145 million users to change passwords after cyber attack

BOSTON/BANGALORE (Reuters) - EBay Inc said on Wednesday that a cyber attack carried out three months ago has compromised customer data, and the company urged 145 million users of its online commerce platform to change their passwords.

The company said unknown hackers stole email addresses, encrypted passwords, birth dates, mailing addresses and other information in an attack carried out between late February and early March. The files did not contain financial information.
An eBay spokeswoman said a large number of accounts may have been compromised, but declined to say how many. EBay said it found no evidence of unauthorized access to financial or credit card information at its PayPal payments subsidiary, which encrypts and stores its data separately.
EBay shares were down 0.2 percent late Wednesday afternoon, compared with a 0.9 percent rise in the Nasdaq Composite Index.
The e-commerce company's stock has steadily fallen since late March as part of a broader slide in technology shares. Last month, eBay reached an accord with activist investor Carl Icahn, who had been calling for the company to spin out PayPal, which is growing quickly.
FRAUD ALERT
Security experts advised EBay customers to be on the alert for fraud, especially if they used the same passwords for other accounts.
"This is not a breach that only hurts EBay. This is a breach that hurts all websites," said Michael Coates, director of product security with Shape Security.
He said that companies typically only ask users to change passwords if they believes there is a reasonable chance attackers may unscramble encrypted passwords.
Once the passwords are unscrambled, attackers could use automated software that seeks to log into thousands of popular services, including Facebook, Twitter, popular email services and online banking sites, he said.
EBay spokeswoman Amanda Miller said the company was making the request "out of an abundance of caution" and that it used "sophisticated," proprietary hashing and salting technology to protect the passwords.
Amit Yoran, senior vice president of EMC Corp's RSA security division, said that cyber criminals sometimes take data from multiple breaches, combining them into detailed portfolios that fraudsters can use for scams.
"We are seeing a level of sophistication in the cybercrime world where they are able to pull data from multiple exploits to create stronger profiles of individuals," Yoran said. "The more detailed information fraudsters have, the better their ability to successfully perpetrate fraud."
NO SIGNS OF FRAUD
EBay said its investigation of the breach is ongoing, with assistance from law enforcement.
"For the time being, we cannot comment on the specific number of accounts impacted," eBay spokeswoman Kari Ramirez said. "However, we believe there may be a large number of accounts involved."
The company said it had not seen any indication of increased fraudulent activity on eBay and that there was no evidence its PayPal online payment service had been breached.
EBay provided little information about how the hackers got in. It said they obtained login credentials for "a small number" of employees, allowing them to access eBay's corporate network.
It said it discovered the breach in early May and immediately brought in security experts and law enforcement to investigate.
"We worked aggressively and as quickly as possible to insure accurate and thorough disclosure of the nature and extent of the compromise," Miller said when asked why the company had not immediately notified users.
When asked who was behind the attack, she said: "We will not speculate on who is responsible at this time."
ASSESSING RESPONSIBILITY
Research analysts said there was not enough information available to assess whether eBay had been negligent.
"The real key question going forward will be if any money has been stolen, or any unauthorized activity been performed," Wedbush Securities analyst Gil Luria said. "As long as this is not the case, this thing will come and go and will not be an issue for eBay."
Security experts say that virtually every major corporation, government agency and other organization has been hacked at one time.
They say it is almost impossible to prevent hackers from getting into networks using social engineering techniques such as sending carefully crafted phishing emails that lure targets to tainted websites or entice them to click on malicious links. In some cases they infect websites frequented by their targets, such as the sandwich shop of a local restaurant or professional organizations.
EBay's shares fell as low as $50.30 in early trading on the Nasdaq before recovering to $51.83 in late afternoon.
EBay has been attacked before. In February, the Syrian Electronic Army hacking group breached and defaced websites belonging to PayPal UK and eBay.
One of the biggest breaches at a U.S. company was at retailer Target Corp, where hackers last year stole some 40 million credit card numbers and another 70 million customer records.
Last month, U.S. web media company AOL Inc urged its tens of millions of email account holders to change their passwords and security questions, saying a cyber attack compromised about 2 percent of its accounts.
(Additional reporting by Deepa Seetharaman in San Francisco and Saqib Iqbal Ahmed in Bangalore; Editing by Rodney Joyce, Savio D'Souza, Robin Paxton and Dan Grebler)

What is DHCP?

 What is DHCP, its Benefits, its lease Lease process…. Explained the Dummy way

DHCP and its benefits explained.

As explained in almost all articles related to DHCP, DHCP is Dynamic Host configuration Protocol, A protocol used to ease administration of network by automating the IP address assignment on a network.

1. They Help in avoiding the IP address conflicts which may arise due to manual assigning of IP addresses by the network administrators.
2. If the Network topology changes, an administrator needs to reflect the new changes at one central location and all machines update themselves at the next lease request/renewal time. Else without it imagine changing DNS server IP or a Default gateway IP on a network having 1000 clients.
3. It helps in address management as stale IP addresses can be reused without any human intervention. Like if machines are replaced, an administrator has to reassign the same IP as old machine and if the replaced machine is plugged in somewhere on the network.

In today’s networking world, one cannot imagine life without DHCP. It is a client server technology, therefore has a server component and a client component. The server component is supported by almost all operating systems and many networking devices like routers, Switches.

Metasploit Autopawn with postgreSQL

Metasploit Autopawn with postgreSQL

Many times I thought in the past why my manual exploits worked with bind shell or reverse shell but not when using autopawn. I thought of digging into it and found some articles which described using something other than SQLITE3.
We have seen the similar warning when we use command db_driver.
This issue has been nicely mentioned on metasploit sites but i thought of writing this article for Dummies like me who have hard time understanding some articles………….. :)
OK to start with, we would be needing the following………
1. Backtrack version 4
2. A little bit of Dumbness
Here we go……………….
1. We need to install postgreSQL if it is not installed on your system, if you are using backtrack then it is installed by default. in case it is not here is how to get it.
apt-get install postgresql postgresql-client postgresql-contrib
apt-get install pgadmin3
2. Configuring it. If you try to run the postgresql by using the script placed in /etc/init.d it will throw an error saying 

#/etc/init.d/postgresql-8.3 start (could not load server certificate file "server.crt": No such file or directory)

use nano or kate to open /etc/postgresql/8.3/main/postgresql.conf and look for line ssl = true. Once u find it just comment it out and save and exit.
#nano /etc/postgresql/8.3/main/postgresql.conf
#ssl = true (requires a restart)
Now start the service by typing at prompt /etc/init.d/postgresql-8.3 start
#/etc/init.d/postgresql-8.3 start
Now we are ready so we can check if the server is running by issuing the following command.
# su postgres –c psql
then quit by typing q
Now to assign a password to this account we can do the following
# passwd postgres
Now give the password to account and we are ready to go….
open MSFCONSOLE and type the following
msf>db_driver postgresql
db_connect postgres:password@127.0.0.1/somename
ready to rock and roll

What is Arp-Proxy (Proxy Arp), where it is used and why?

What is Arp-Proxy (Proxy Arp), where it is used and why?

What does the word Proxy mean?

We all are very much familiar with this word in our life. Somewhere, someday we need to stand in for someone for their work, accompany  someone as the original person is not available or assign someone to do something's on our behalf, may be mark our attendance in class when we would be late or we bunk the class.

Similarly in this computer world when we ask a resource to perform a specific function on someone's behalf  it is called a proxy. We also have heard the word "Proxy" in context of internet surfing a lot but what is it ??????????????

After all I am DUMB.  

So Let us start

Objective: What is proxy arp or arp proxy, where and why it is used?
I would walk you through some scenarios. Please be patient and follow closely.     

Scenario: We have 3 machines each with following IP addresses and MAC (Media access Control) addresses.

• PC 1 ----------- 192.168.0.1, --------Mac Address = Mac1
• PC 2 ----------- 192.168.0.2, --------Mac Address = Mac2
• PC 3 ----------- 10.0.0.1     , --------Mac Address = Mac3

       Scenario 1:  The PC number 1, 2 and 3 connected to the same switch.
       Scenario 2: The PC number 1, 2 and 3 connected to a router.

Explanation: What is going on behind the scene????????????

When Machines start to communicate with each other over TCP/IP and on Ethernet, this is a generic process they follow irrespective of the operating system installed. To explain let assume PC1 is trying to Ping with PC2 and PC3.

PC1---------Ping----------PC2

PC1---------Ping----------PC3

PC1 when starts to ping PC2 first thing it does is try to check whether the destination IP is local to it or remote. What I mean is it does an operation called ANDing where it tries to calculate the network ID of the destination by comparing it to its own subnet mask value and then comparing to its network ID.

If it is a match the destination is termed as LOCAL. If the network ID's do not match then the destination is termed REMOTE. The system follows different actions for different types of destinations.

WHEN Destination is LOCAL:

1. 
   
   
   The PC1 searches its ARP table to find the MAC address of the PC with IP address. In our case it tries to find MAC address corresponding to 192.168.0.2
   
   
2. 
   
   
   When an entry is found, the frames are marked for the MAC and sent on the wire.
   
   
3. 
   
   
   Else PC1 does a broadcast on network shouting IP 192.168.0.2 what is your MAC address. In the packet it also sends its IP and MAC.
   
   
4. 
   
   
   PC2 listens to and accepts the packet as it is for him and updates its ARP table, also called its MAC table with IP of PC1 corresponding to MAC 1 and sends a unicast reply back to the PC1 on MAC1.
   
   
5. 
   
   
   PC1 accepts the reply updates its MAC with entry of PC2. Thereafter communications happen and we see ping replies on the screen of PC1
   
   

WHEN DESTINATION IS REMOTE:

1. When the destination is marked as remote, the PC1 parses its routing table to find if it has a route to the destination.
2. The route preference is as follows:
   
   1. Specific route.
   2. Network route.
   3. Default route.
   
   
3. If there is a match, then the processing continues, else we receive Destination Host Unreachable message on our scenes.
4. When there is a match of route, the PC tried to find the MAC of next hop (gateway) by the above mentioned LOCAL process and sends the frames across.
5. Important: PC 2 has to follow the same steps to return the packet and also hope that devices (routers) in the path know the routes to destination or original source.

FOOD COOKED, BASICS UNDERSTOOD, TIME FOR THE REAL QUESTION ASKED

What is Proxy ARP?

Imagine Scenario 2 where all three PC's are behind different interfaces of the router. Now when the PC1 tries to ping PC3 on a different Network ID, it pings fine due to presence of default route on PC1 and PC3.

But now as we try to ping PC2 from PC1 it does not ping ??????????

Did you guess it, why it fails….

Correct

when PC1 tries to ping PC2 it tends to resolve the MAC of PC2 by doing ARP broadcast as the destination is on same subnet (LOCAL).

Router would block request to pass through, therefore it would not get reply of MAC finding request of PC1 which can be considered to be on a different physical subnet.

To make this work, a machine each can be setup in both the subnets such that when we do not get an answer of MAC requests and there is a request time out, this device provides its MAC back to source. Hence a proxy is done for ARP.

PC1 requested MAC of PC2 but as it is not available, the router with proxy arp enable replies back with its MAC to PC1 stating it is MAC of PC2.

Dumb PC1 sends packets to discovered MAC which bridges the packets to destination network. This is how proxy arp is formed or works.

Where is this proxy arp used?

This was used primarily in bridges which connected different physical subnets to make a big network.

Used in some firewalls in website publishing scenarios.

Used by attackers to do MITM attacks…..
......many more........

Find Vulnerable Column Using Various Techniques

Hello Friends, today i am giving you a notepad file and a video which teach you to get vulnerable columns using various Techniques.

Friends, Sometimes when u get column number using ORDER BY or GROUP BY method  then your next step is to Find which number is vulnerable in those all columns. But during some reasons you can't get vulnerable columns by using simple union select commands.
But friends dnt be worries I am giving you all those techniques Now.



Download video of Find vulnerable columns using many techniques from here :-
http://www.mediafire.com/download/h6b5bjvit7gykq2/How+to+get+Vulnerable+Column+Using+Many+Techniques+in+SQLI.rar


Download My text file from here :-
http://www.mediafire.com/view/kd6mvank9tdk5np/Find_Vulnerable_Column(2).txt


Thanks you readers friends. I hope u like my posts.  And friends  some techniques which I use in text file I not use in video so use that Techniques urself.........

MYSQL Error (') Dorks

====================================================================

inurl:(@version,0x3a,databse)

inurl:(user,0x3a,pass)

inurl:UNION+ALL+SELECT

inurl:+union+select+ from

inurl:+union+select+ pass

inurl:+union+select+ SHOP

inurl:+union+select+ admin

inurl:unhex(hex(@@version))

inurl:unhex(hex(concat(username,0x3a,password)))

inurl:"id=" & intext:"Warning: mysql_fetch_assoc()

inurl:"id=" & intext:"Warning: mysql_fetch_array()

inurl:"id=" & intext:"Warning: mysql_num_rows()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: getimagesize()

inurl:"id=" & intext:"Warning: is_writable()

inurl:"id=" & intext:"Warning: getimagesize()

inurl:"id=" & intext:"Warning: Unknown()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: mysql_result()

inurl:"id=" & intext:"Warning: pg_exec()

inurl:"id=" & intext:"Warning: mysql_result()

inurl:"id=" & intext:"Warning: mysql_num_rows()

inurl:"id=" & intext:"Warning: mysql_query()

inurl:"id=" & intext:"Warning: array_merge()

inurl:"id=" & intext:"Warning: preg_match()

inurl:"id=" & intext:"Warning: ilesize()

inurl:"id=" & intext:"Warning: filesize()

inurl:"id=" & intext:"Warning: require()