hacking: Server hacking

Showing posts with label Server hacking. Show all posts

Home HTTP Server – How to create one

In this tutorial we will see how to create an HTTP server. A web server is software installed on a computer that allows other computers to access specific files on that computer/server. There are many reasons to create your own home servers. For example: file sharing, so you can download files from your home computer from anywhere or you can create a web site on own server etc. Simply said It works like this; You choose a directory on your computer , in that directory add folders, files like music,video and etc. When you put the IP address of your computer the in web browser you can see all the files from that folder and you candownload those files. Let’s now create a server(HTTP server!) using Apache(a server client):

1. You must have:
Broadband internet connection always on
Windows on your computer

2. Create a folder on your disc , in this example I created a folder on E:\my server
3. Download apache_2.2.10-win32-x86-no_ssl.msi and install it, set parameters( for localhost type something like a myserver.com(doesn’t really matter), also type your email address in field “Administrator@ Email Address” ) as shown below, choose where you want to install it.

Enter email address where you want to receive tutorials when we post them! It’s free!

4..When you install Apache , go to directory where you installed it (p.e. “C:\Program Files\Apache Software Foundation\Apache2.2\conf”) , here you will find a httpd file.
Open that file with notepad.

After this will appear notepad with long and complicated code, don´t worry, you must change just 3 things.

5. In notepad file find #DocumentRoot “C:/Program Files/Apache Group/Apache2/htdocs” and replace with#DocumentRoot “E:\my server”. Also find #<Directory “C:/Program Files/Apache Group/Apache2/htdocs” and replace with <Directory “E:\my server”. E:\my server is folder where you put files which will appear on your server. In this example I created that folder on local disc E:. You can create your folder in any other place, but then type that path here. Find #AllowOverride None and change to AllowOverride All.

After this, save file like httpd.conf.

6. Type in web addresses http://localhost/ or your IP Address, you should see something like this

Every files you put in folder , which we created in step 2 , will be shown on http://localhost/

7. If you want access own server from other computers. You must forward a port in the router we’re using. The port we need to forward is port number 80. Why? Because by default it’s the port used for HTTP. Port forwarding actually means opening a tunnel through the router so that the router wouldn’t reject the connections that are trying to connect to it. How to port-forward? With every router it’s different. Here are theinstructions for every one of them. You must also turn off you firewall.

That is all. Enjoy your home server. If you have questions, post them in the comments area.

Note: Creating home server is risky,when you open port, there is a possibility to have someone a breach in your computer .Before you start, make sure your computer has all the latest patches and security updates, and that you’ve done a thorough spyware and virus scan. This tutorial is only for advanced users

Read User's Comments(0)

Top20 Scan Method : Hacking Web Servers

08:12 | Labels: Server hacking

This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI (www.sans.org)

Hacking Tool: WebInspect

WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.

It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.

It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages

WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.

With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.

Network Tool: Shadow Security Scanner

http://www.safety-lab.com

Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.

Shadow Security Scanner includes vulnerability auditing modules for many systems and services.

These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and

These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.

Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.

The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.

Countermeasures

IISLockdown:

IISLockdown restricts anonymous access to system utilities as well as the ability to write to Web content directories.

It disables Web Distributed Authoring and Versioning (WebDAV).

It installs the URLScan ISAPI filter.

URLScan:

URLScan is a security tool that screens all incoming requests to the server by filtering the requests based on rules that are set by the administrator.

UrlScan is a security tool that screens all incoming requests to the server by filtering the requests based on rules that are set by the administrator. Filtering requests helps secure the server by ensuring that only valid requests are processed. UrlScan helps protect Web servers because most malicious attacks share a common characteristic they involve the use of a request that is unusual in some way. For instance, the request might be extremely long, request an unusual action, be encoded using an alternate character set, or include character sequences that are rarely seen in legitimate requests. By filtering unusual requests, UrlScan helps prevent such requests from reaching the server and potentially causing damage.

Summary

Web servers assume critical importance in the realm of Internet security.

Vulnerabilities exist in different releases of popular web servers and respective vendors patch these often.

The inherent security risks owing to compromised web servers have impact on the local area networks that host these web sites, even the normal users of web browsers.

Looking through the long list of vulnerabilities that had been discovered and patched over the past few years provide an attacker ample scope to plan attacks to unpatched servers.

Different tools/exploit codes aids an attacker perpetrate web server hacking.

Countermeasures include scanning, for existing vulnerabilities and patching them immediately, anonymous access restriction, incoming traffic request screening and filtering.

Read User's Comments(0)

How to setup your own ftp server

05:12 | Labels: Server hacking

Process-1:

First of all u have to get an static IP-Address.
Need a a static ip-address for ur FTP Server.Necessity for getting this static ip-address is ur not suppose to use ur own IP-Address.The main reason is u dont want to show ur IP-Address to everyone , there are many other reasons too but leave them aside..

1) Goto no-ip & create urself a free account.

2) Now ur account been created & ll receive ur account password via mail to ur email address.

3) After getting ur password login to ur account of no-ip.com
4.After getting logged in, click upon add a HOST its on the left menu.

5) Type any hostname u want (eg:-abc) & select any domain from da given list (eg:-ftpserve.com) Click on Submit.

6) Now u have owned ur own static address (example: abc.serveftp.com)

7) Now click downloads button which is present above on the page & click on which operating system ur using & den download DNS update client or u can download it from here directly, this is for microsoft window users..

8) After getting downloaded, u have to install this software & login here with ur email addresss & p/w wen asked for it.

9) At last tick on da check box present at the static address.

10) U have ur own static web address.

Process-2:
Installation & setting of the FTP-Server

1) You have to install Serv-U 4.1.03 , download this software from here

2) Run Serv-U & use da wizard to setup ur FTP.

3) Click on next until u have been asked for IP-Address, leave it as it is & click upon next.

4) Enter ur domain name u have registered (example: abc.serveftp.com) it above in da domain field & click upon next.

5) U ll be asked for anonymous access, select No & click upon next.

6) Next u ll be asked for creating a named account, select yes & click upon next.

7) Choose any user name u wish (eg:-xyz) & clcik upon next.

8) Enter password for dis account (eg:-adc341) for security purpose choose difficult password.

9) U ll be asked for da home directory for the account which u have created above.Select directory & click upon next.

10) Click on yes for locking dis account to da home directory, doing dis da user cannot further move up into home directory, click upon next.

11) At last ur account has been created click finish.

Process-3:
Configuring the user accounts which u have been created.

1) On the left tree-menu, select da account which u have been created above & den click upon General Tab.

2) Goto Hide 'Hidden' Files.

3) Check Allow only and enter the number one in the box.

4) Set da maximum downloading speed upto wat extent u want.As this is an account so many ll be using so set it low(eg:-10-20) to save ur bandwidth.Don't leave it blank as uers can download with full bandwidth.

5) choose how many users u want to login at on time.It depends on ur connection speed try these (56 - 1, ISDN - 3, ADSL or cable - 5-6 users.)

6) Click upon Dir Access Tab.

7) Now u can c home folder here.Highlight it & make ur permission.

8) If u want only users to download check only these Read,List & Inherit.

9) If u want ur users to upload into ur server & bu tto only 1 particular folder but not to downlaod, click upon dat add button & then select dat folder, Now u have to highlight dat folder & set these permissions on dat folder.Check,Write,Appened,List,Create & Inherit after setting these permissions click on the arrow which is present at the bottom right-hand corner.U want dis upload folder 2 be list first, before da home folder.

10) If der is any folder which u dont want anyone to access it, & it is present in the home folder, den click da add button & den select da folder.Now u have to highlight dat folder & see dat no all da checkboxes are left.After doing this click upon upper arrow which is present at bottom right hand corner.

11) There are many things u can do, These are only the basics....

12) Your server is now ready to be connected..

13) Login with your username & password...

Read User's Comments(1)

hacking

Categories

Archives

Blog Roll

Home HTTP Server – How to create one

Top20 Scan Method : Hacking Web Servers

How to setup your own ftp server