Sunday, December 19, 2010


Creating a simple Chat application


///////Client Application//////// 
A
) Client side: UdpClient udpClient = new UdpClient(); private void Form1_Load(object sender, EventArgs e) { 
udpClient
.Connect("192.168.0.1",15000); // we can use textbox and type other PC IP address 
}
private void button1_Click() { try 
      
{ 
      sendBytes 
= Encoding.ASCII.GetBytes(txtMessage.Text); 
      udpClient
.Send(sendBytes, sendBytes.Length, txtname.Text, 15000);  
      
} 
      
catch (Exception) 
      
{ 
        
throw; 
      
}          } ////////////////Server application////////// 
B
)Server side: delegate void SetTextCallback(string text);
private void Form1_Load(object sender, EventArgs e) 
        
{ 
            
Thread thdUDPServer = new Thread(new ThreadStart(serverThread)); 
            thdUDPServer
.Start(); 
        
}
public void serverThread() { 
            
UdpClient udpClient = new UdpClient(15000); 
            
while (true) 
            
{ 
          
IPEndPoint RemoteIpEndPoint = new IPEndPoint(IPAddress.Any, 15000); 
          
Byte[] receiveBytes = udpClient.Receive(ref RemoteIpEndPoint); 
          
string returnData = Encoding.ASCII.GetString(receiveBytes); 
    
SetText(RemoteIpEndPoint.Address.ToString() + ":" +                     returnData.ToString()); 
            
} }
private void SetText(string text) {  
    
if (this.lbConnections.InvokeRequired) 
    
{ 
       
SetTextCallback d = new SetTextCallback(SetText); 
       
this.Invoke(d, new object[] { text }); 
    
} 
    
else 
    
{ 
       listBox1
.Items.Add(text); 
    
} }

Creating a simple Chat application: 
It consists of two executables, one a client, the other a server. These two programs 
could be physically separated by thousands of kilometers, but as long as the 
IP addresses of both computers are known, the principle still works.

A) Writing a simple UDP client 
To get started, open Visual Studio .NET, click New Project, then click 
Visual C# projects, and then Windows Application. Set the name to 
�UDP Client� and press OK. You could alternately click Visual Basic .NET 
projects and follow the code labeled VB.NET in the examples. 
Now, design the form and Name the button button1 and the textbox tbHost and 
Second textbox txtMessage.

From the code, we can see that the first task is creating a 
UDP Client object. This is a socket that can send UDP packets. 
A port number is chosen arbitrarily. Here, the port number 15000 is used, 
simply because it is easy to remember and it is not in the first 1024 port numbers, 
which are reserved for special use by IANA. 
The first argument in the Connect method indicates where any data should be sent. 
Here, we can use textbox (i.e., whatever is typed into the textbox). If you have access 
to only one computer, you would type localhost into this window; otherwise, if you are 
using two computers, type the IP address of the server.

Type the message in text box and you can easy to send message 

You also need to include some assemblies by adding these lines to just 
under the lock of the 
using 
statements at the top of the code: 
C# 
using System.Net; 
using System.Net.Sockets; 
using System.Text; 
using System.IO;

B) Writing a simple UDP server 
The purpose of the UDP server is to detect incoming data sent from the 
UDP client. Any new data will be displayed in a list box.

As before, create a new C# project, but with a new user interface, as 
shown below. The list box should be named listBox1.

A key feature of servers is multithreading (i.e., they can handle hundreds 
of simultaneous requests). In this case, our server must have at least two 
threads: one handles incoming UDP data, and the main thread of execution 
may continue to maintain the user interface, so that it does not appear hung.

Here, I use delegate to handle the cross thread error.

Again, we use the UdpClient object. Its constructor indicates that it 
should be bound to port 15000, like in the client. The Receive method is
blocking (i.e., the thread does not continue until UDP data is received). In 
a real-world application, suitable timeout mechanisms should be in place 
because UDP does not guarantee packet delivery. Once received, the data is 
in byte array format, which is then converted to a string and displayed onscreen 
in the form source address: data.

There is then the matter of actually invoking the serverThread method 
asynchronously, such that the blocking method, Receive, does not hang 
the application. This is solved using threads as follows:

To finish off, the following assemblies are to be added: 
C# 
using System.Threading; 
using System.Net; 
using System.Net.Sockets; 
using System.Text;

Saturday, December 4, 2010

Different ways to hack a WEBSITE

1. The Simple SQL Injection Hack

In its simplest form, this is how the SQL Injection works.

Suppose we enter the following string in a Username field:

' OR 1=1

The authorization SQL query that is run by the server, the command which must be satisfied to allow access, will be something along the lines of:

SELECT * FROM users WHERE username = ‘USRTEXT '
AND password = ‘PASSTEXT’

…where USRTEXT and PASSTEXT are what the user enters in the login fields of the web form.

So entering `OR 1=1 — as your username, could result in the following actually being run:

SELECT * FROM users WHERE username = ‘' OR 1=1 — 'AND password = '’

Two things you need to know about this:
['] closes the [username] text field.

'' is the SQL convention for Commenting code, and everything after Comment is ignored. So the actual routine now becomes:

SELECT * FROM users WHERE username = '' OR 1=1

1 is always equal to 1, last time I checked. So the authorization routine is now validated, and we are ushered in the front door to wreck havoc.

Let's hope you got the gist of that, and move briskly on.



2. Backdoor Injection-

Using SQL commands in search forms can potentially do some extremely powerful things, like calling up usernames and passwords, searching the database field set and field names, and amending same. Do people really get hacked through their search forms? You better believe it. And through forums, and anywhere else a user can input text into a field which interacts with the database. If security is low enough, the hacker can probe the database to get names of fields, then use commands like INSERT INTO, UNION, and so forth to get user information, change product prices, change account settings/balances, and just about anything else… depending on the security measures in place, database architecture and so on.

3.SQL Injection in the Browser Address Bar

Injections can also be performed via the browser address bar. I don't mean to have a pop at Microsoft, but when it comes to such vulnerabilities, HTTP GET requests with URLs of the following form are most often held to be vulnerable:

http://somesite.com/index.asp?id=10

Try adding an SQL command to the end of a URL string like this, just for kicks:
http://somesite.com/index.asp?id=10 AND id=11

See if both articles come up. Don't shoot your webmaster just yet if it's your own site and you get two articles popping up: this is real low-level access to the database. But some such sites will be vulnerable. Try adding some other simple SQL commands to the end of URLs from your own site, to see what happens.

As we saw above, access to the database raises a number of interesting possibilities. The database structure can be mapped by a skilled hacker through ill-conceived visibility of error messages — this is called database footprinting — and then this knowledge of table names and so forth can be used to gain access to additional data. Revealing error messages are manna - they can carry invaluable table name and structural details.

The following illustrative string is from Imperva.

http://www.mydomain.com/products/products.asp?productid=123 UNION SELECT username, password FROM USERS

There are vast swathes of information on SQL Injection available, here are a couple of good sources:
GovernmentSecurity.org
SecurityDocs.com

4. Cross Site Scripting (XSS)

XSS or Cross Site Scripting is the other major vulnerability which dominates the web hacking landscape, and is an exceptionally tricky customer which seems particularly difficult to stop. Microsoft, MySpace, Google… all the big cahunas have had problems with XSS vulnerabilities. This is somewhat more complicated than SQL Injection, and we'll just have a quick look to get a feel for it.

XSS is about malicious (usually) JavaScript routines embedded in hyperlinks, which are used to hijack sessions, hijack ads in applications and steal personal information.

Picture the scene: you're there flicking through some nameless bulletin board because, yes, you really are that lazy at work. Some friendly girl with broken English implores you to get in touch. 'Me nice gurl', she says. You've always wondered where those links actually go, so you say what the hell. You hover over the link, it looks like this in the information bar:

[%63%61%74%69%6f%6e%3d%274%74%70%3a%2f%2f%77%7…]

Hmmm…what the hell, let's give it a bash, you say. The one thing I really need right now is to see an ad for cheap Cialis. Maybe the linked page satisfies this craving, maybe not. Nothing dramatic happens when you click the link, at any rate, and the long day wears on.

When a link in an IM, email, forum or message board is hexed like the one above, it could contain just about anything. Like this example, from SandSprite, which helps steal a session cookie, which can potentially be used to hijack a session in a web application, or even to access user account details.


Stealing cookies is just the tip of the iceberg though — XSS attacks through links and through embedded code on a page or even a bb post can do a whole lot more, with a little imagination.

XSS is mostly of concern to consumers and to developers of web applications. It's the family of security nightmares which keeps people like MySpace Tom and Mark Zuckerberg awake at night. So they're not all bad then, I suppose…

For additional resources on this topic, here's a great overview of XSS (PDF) and just what can be accomplished with sneaky links. And here's an in-depth XSS video.

5.Authorization Bypass

Authorization Bypass is a frighteningly simple process which can be employed against poorly designed applications or content management frameworks. You know how it is… you run a small university and you want to give the undergraduate students something to do. So they build a content management framework for the Mickey Bags research department. Trouble is that this local portal is connected to other more important campus databases. Next thing you know, there goes the farm

Authorization bypass, to gain access to the Admin backend, can be as simple as this:
Find weak target login page.
View source. Copy to notepad.
Delete the authorization javascript, amend a link or two.
Save to desktop.
Open on desktop. Enter anything into login fields, press enter.
Hey Presto.

6.Password Cracking

Hashed strings can often be deciphered through 'brute forcing'. Bad news, eh? Yes, and particularly if your encrypted passwords/usernames are floating around in an unprotected file somewhere, and some Google hacker comes across it.

You might think that just because your password now looks something like XWE42GH64223JHTF6533H in one of those files, it means that it can't be cracked? Wrong. Tools are freely available which will decipher a certain proportion of hashed and similarly encoded passwords.

7.Google Hacking

This is by far the easiest hack of all. It really is extraordinary what you can find in Google's index. And here's Newsflash #1: you can find a wealth of actual usernames and passwords using search strings.

Copy and paste these into Google:

inurl:passlist.txt
inurl:passwd.txt
…and this one is just priceless…
“login: *” “password= *” filetype:xls

Such strings return very random results, and are of little use for targeted attacks. Google hacking will primarily be used for finding sites with vulnerabilities. If a hacker knows that, say, SQL Server 2000 has certain exploits, and he knows a unique string pushed out by that version in results, you can hone in on vulnerable websites.


... All info is for educational purposes only