How To Make A Crypter FUD

http://hotfile.com/dl/118583080/6bc6f37/Film.wmv.html

Sql Injection - From Bug To Shell

==Intro==
Welcome to the world of Web Application security, in our day and age you'd think from the thousands of
reports of records being stolen, accounts being compromised, and websites being 'defaced' that developers
would learn to secure their web apps. But people don't like security as it often takes the place of convenience
and, as I'm sure you're all aware, of this is a lazy generation. People like things that you just double click and it
does what you need it too, I'm really going off on a rant here but developers of web applications often either
don't know about security (It's not mentioned in most tutorials you find on programming), don't care, or just
forgets and doesn't bother to test his/her code before releasing it. One of the most common mistakes is SQL
Injection and in this paper I'll take you from exploit to patch so sit back and relax and enjoy.

==Error In Coding?==
A basic PHP script requesting data from SQL will look a little something like this

This will ofcourse work and the link will look like shop.php?id=1. This code does work so why is
it so wrong? Well what if we were to put something other than what they want us too? What if we put our
own query into that id field and not an integer as they've linked us, You're probably seeing it already but for
others I'll show an example. Let's request shop.php?id=1' the apostrophe will end the id = '' and give us id =
''' and thus give us an error [If error_reporting isn't turned off].

You have an error in your SQL syntax; SELECT * FROM products_tabs WHERE products_id = '1''

So lets take a look at that in the code
$rows = mysql_query("SELECT product,price,image FROM prods WHERE id = ''', $link);
As you can see we ended the ID = '' and added a ' to the end so what if we used another SQL statement with
the UNION query, we could then execute any command we wanted to the SQL DB.

==Oh So Exploitable==
So you're thinking ah who cares I don't have anything of use in my sql db just some product information so I have nothing to worry about.
WRONG

SQL Injection allows so much more than just reading data it also allows them to read any file on your server
and write into files. To do this attackers use a query known as LOAD_FILE() and INTO OUTFILE/DUMPFILE
'/path/filename.php'. Once an error occurs it will show a path to the file that errored for debugging and of
course it's the full path to where you're files are kept so going back to our code an attacker could do this...

$query = mysql_query("SELECT product,price,image FROM prods WHERE id = '' UNION SELECT
'' INTO OUTFILE '/var/www/shell.php', $link);

If this directory is writeable
then the hacker has just put a "Web shell" onto your server and from there has full access to everything.

==SO WTF HOW DO I FIX THIS GOD I HATE HACKERS==
Don't hate hackers we're simply trying to help you fix problems which could cause harm to your site if, say,
a competing company doesn't like your business and they discover this. So the next time you receive an
email from a hacker saying that your site is vulnerable don't get scared or angry simply thank them for their
service, patch the hole, and offer them a little something for helping you

Now onto the patching First your code a very simple if() can be added to fix this

if(!is_numeric($id)) { die("Nope not vulnerable ;D"); }

This checks if $id is numeric if it's not
it terminates the script then and there but if it is it continues and works flawlessly. It's not the only way mind
you but it does the job for variables that need to be numeric only.

As for error_reporting it's not a huge flaw but it does help out so to disable this [after you've debugged] simply
add to the top of your script error_reporting(0);, this will turn off all error reporting for this particular script.

For LOAD_FILE and INTO OUTFILE/DUMPFILE simply make sure that the user your using to connect with your
script doesn't have FILE permissions he probably doesn't need them anyway. To do this type the following:

sql> REVOKE FILE ON *.* FROM 'user_name'@'host_name';

And you're good to go! Remember
to always watch your logs and NEVER EVER EVER EVER EVER EVER use your script to login to mysql as root NEVER.

Hotwiring A Car

The easiest way to hotwire cars

Get in the car. Look under the dash. If it enclosed, forget it
unless you want to cut through it. If you do, do it near the
ignition. Once you get behind or near the ignition look for two
red wires. In older cars red was the standard color, if not, look
for two matched pairs. When you find them, cross them and take
off!

Social Engineering, The Concept, & Theory in Practice

In essence, by definition, Social Engineering is the act of manipulating people into performing actions or divulging confidential information. When it comes down to being a hacker, social manipulation is a key factor in pulling off what your desired outcome will be. Of course you cannot feel sorry for your victim and still expect manipulation to be successful. Reason is simple, when you tell the truth for example, are you hesitant, and shaking while on brink of utterly shitting your new jeans you just bought? i would hope not. For most people, when they tell the truth, they are confident and straightforward. The person uses piercing eye contact, and their body expresses and open book of interest. What do i mean? When telling the truth, usually the person uses body language to aid him/her in explanation to the person. This is a major plus because of the fact that you are feeding yourself with attention by expressing yourself with body language as if your telling a near death life experience. If you ever told a serious story, i highly doubt you stood there looking at the floor in monotone voice saying,"Well, i almost died today." Pay attention to your tone of voice, eye contact and

body language as these are important roles in manipulation. When you manipulate, you are telling the truth. Yes you read correct and no i'm not talking out my ass. Think about it, what does it mean to tell the truth? it means confidence. You can't expect someone to believe you if your nervous and trying to explain to them that it wasn't you who stole the last cookie in the jar. If you are nervous, you are an open book of suspicion. This tells the person that you know what you did was wrong, and as a result you feel guilty for being confronted with such notion. But on the retrospect, if you are bold like the tiger in Chinese mythology, people will see you as more of telling the truth because you have nothing to hide, wink wink.



With that in mind, there is more. Manipulation has everything to do with psychopathology of the victim as well as with the manipulator. You ready for this? reverse psychology. I would hope you all have heard of this before at some point in your life. Reverse psychology is getting the person to conform to your will by the opposite request. If someone tells you to go do your homework, naturally our going to feel a bit compelled for rebellion. Now, if someone said, "You know what, don't do your homework because i know you're lazy." You could feel this is true, so to defend yourself from such negative attack, you will do the opposite to prove them wrong. OR you will know this is wrong, so to show them you are truly not as they suspect, you will end up doing the homework anyways. Point in example: I take care of the "mentally challenged" and don't ask me how do i like it because i'll tell you right now i hate the very forethought of dealing with the profoundly stupid people. The one i take care of is a rebellious little punk, and he doesn't listen to anything unless it benefits him. So, here is where the reverse psychology comes into play. I say, "Fine, I guess you don't want to go swimming then since you don't want to be good. No problem, i'll go swimming since it's so hot outside, and i will enjoy the cold water. Looks like you will be the only one who wont enjoy it since you want to be bad." Suddenly, he goes from being the rebellious punk to the ass kisser all because of the power of verbal usage. This doesn't just apply to stupid people, it applies to everyone to some extent or another because we all want to get our own way in social situations. To dumb it down, were no better than that screaming 10 year old next door who wants that last piece of cake before supper. Only as we get older we tend to succumb to denial, and call it maturity. Another thing that is important is provoking a dominant position. In the animal kingdom-yes including us, we all want to appeal to others as the alpha male superior. Some people can pull this off easier than others because of what has been deemed to be intimidating, ex: tall over being a midget, body builder over being overweight, etc. In Social Engineering, you must take this stance to cause any effect. The inferior will always obey the superior. It's the natural order of life, and it will never change. Let's raise their expectations as well shall we? of course. Here is an example, "Okay, you don't have to go out with me, but if you don't you will always wonder if you would of found that true happiness that you have been longing for your entire life. I know you're going to date someone else, and chances are you are going to get hurt just like before. When you do, you are going to think of me and say, i wonder if i should of went with him instead to find what i want in my life and find happiness.." Then you can elaborate, "So, sine you know this is true, do you really want to go down that road and take that chance, or would you rather be with me where you know that you will be happy for once? " The concept raising expectations in the person is to spark their imagination and give them something to think about. Of course you want to choose your words carefully so that it always makes you look like the good guy, and any chance they make other than what you want will always be negative. To take it further, if for example a girl has been raped, you can say, "You don't want to go with him because he seems to be that kind of person that forces himself on people and that's not good. I don't believe in forcing myself on people, i think there should be shared union between both people in the relationship." See, you choose your words carefully making yourself look like the good guy, while making any other choice a dire consequence. I want to now talk about a beautiful thing called "guilt". In fact, guilt can suck if your the one who feels it, but what of the other person? it can work wonders. Here is another example, "Okay, no go ahead with your friend, i'll just stay home and maybe ind a movie to watch by myself.." It's called playing the victim. It goes with social engineering to a key because while the underlying factor is that you want to leech what you can from your victim, it leaves the victim feeling hopeless, and guilty. What do you do to avoid feeling guilty since were not bad people, we feel guilt. To avoid such feelings of overbearing disgust, we give in. Now for some people like myself included this is no content. But, for some it is and it will take awhile to work at perfecting. Lets see, what about exaggeration and it's importance? exaggeration is important along with everything else i cover in this tutorial because to be interesting and convincing, you need to elaborate with your words. Exaggerate the situation, instill guilt by making yourself the victim. Again another example, "I swear to you it was raining so hard you could hear it pounding on the windshield, and my wipers were on max power but it wasn't good enough. I'm a good driver, but because the rain made the road wet, and i couldn't see anything in front of me, the car flipped over countless amount of times, and my body was thrown like a rag doll from the vehicle smacking my head onto the concrete and started losing consciousness from the impact. I only had one thought that popped into my mind from the fear of dying, and it was you. " The use of imagery provokes emotion because the listener imagines this and tries to sympathize by actually seeing this happen. This is helpful for when you want something from your victim as well. Now take that and compare it to a non-exaggerated story, "Well, it was raining outside and it was hard to see. The car ended up flipping and i fell out, and ended up in the hospital." See my point? if not, re-read it before you move on.



To wrap this tutorial up, i will add that to pull all this off, you must play the Narcissist. Yes, the pathological self absorbed, greedy, manipulating ever so "innocent" person that takes all and gives nothing back. The Narc' is the perfect being in his mind who he feels everyone should respect him. Everyone who doesn't has the problem and he is completely innocent from anything he does. He is the charmer, social engineering his way to the top to take all and give nothing back unless it makes him look good. He is absent from guilt, and his quench for power makes him ruthless and unstoppable. He is the chameleon in every situation because he adapts to the situation at hand to get what he wants from the victim. He will toy with emotions, and play the victim and stop at nothing until his goal is achieved flooding himself with narcissistic supply or positive attention that he craves. When i say adapting to the situation, i mean just that. Step outside yourself for a second and learn all you can from your victim so that you can play the perfect person in their eyes, or that best friend, or whatever so that you can use that against them later down the road as an attack method to get what you want from them. After all, no one wants their "best" friend to reveal their darkest secrets, so what do they do? they give in. Now you may be wondering, who will this work for? i can say anyone who is reading these very words that i am typing out to you. Okay great! now who will this fail? the paraplegic that has to use that electronic monotone voice command button to speak. "WOMAN.GO.MAKE.ME.A. SANDWICH. SANDWICH. SANDWICH.THIS-THING-WONT-STOP.HELP.OVERLOAD. SANDWICH."



Now, have you ever seen that hot girl who is dating some over weight guy, with the bald patch, and you just know he's miserable in bed and cannot wait to open up that bag of cheetos when he gets home? We all have trust me. Now why wont she date you instead? I'll tell you. Woman want that absurd fantasy life where the prince rides on the golden path of righteousness on his white stallion out of his way to rescue the infamous woman to wed and make the next princess of the land for ever and ever. This is not how life is. But, to the woman, it is. The woman wants that special someone that stands out amongst the rest and yet knows will take care of her, worship her, buy her materialized possessions (Diamonds-that will shut her up), someone to always give positive reinforcement for their failures and even positive comments on their atrocious looks in the morning. They will settle for less as long as they are provided with this. They are very emotionally insecure, so to keep from feeling so helpless, they seek out their hopeless romantic endeavor; even if it means settling for the fat guy first in line at the lunch-eon. The woman wants reassurance and guidance, and they want security. How do you go about providing that? well you are reading a social engineering tutorial are you not? so get busy! first off, woman want emotional connection on that princess meets prince level. So, start off by casually introducing yourself to her by saying,"Hey, how are you?" NOT "Hey, what's up?" The latter works best because it tells her, you are more interested in how she is feeling rather than what she is doing. Of course asking what she is up to is perfectly fine, after you wow her with your amazing skills in Social Engineering. From there, put on a mask of the prince, that one she's been longing for her whole life. How? engage in conversation and ask her key questions on what she looks for in a man. After much valuable info has been gathered, guess what you get to do? plat the narcissist. Adapt to the role she is looking for, and kiss her ass from time to time. Once she realizes you are the "one", that perfect ever omniscient man she has been longing for, you can start to slack off. Because as said before, once you raise her expectations and she sees you as a perfect person for her, you can slack off by doing more of what you want, or get her to do more of what you want from her. If she dislikes the concept, manipulate her into doing so. You can do this by threatening to not talk to her ever again. This will scare her because the last thing she wants to do is lose the best thing that has ever happened to her.



That wraps it up for the best tutorial on social engineering straight from myself. I know all this because it comes naturally for me, and i apply these things all the time in various situations and it never fails. So, if you ever need a question on this topic, don't hesitate to send a PM my way, and i can help you out. Now i have given you the tools necessary to get what you want in your life- be it the job, girl, to stay home from school, whatever. I hope you enjoyed the reading, now get out there and Social Engineer like it was your day job.