Dino Hacks

Collusion Attack is one of the ways to bypass android permissions and steal user's data. It requires the attacker or a rogue developer to create and install 2 android application in the user's phone. Both these apps can communicate with each other, share data and then sending it to the attacker.  There are 2 ways to communicate between 2 apps: overtly and covertly. An example of overt communication is to use intents to pass data between 2 apps. An example of covert communication is to use files. One app can write to a file in the internal storage and another app can read that file. An sophisticated way of covert communication would be to communicate by scheduling various events and calculating the time difference.  In this post, I am demonstrating the overt way of communications. I have 2 apps: Contact reader app (Phone reader App) and a Calculator App   A pictorial representation of the demo:  Code snippets: So, the contact reader app will have the permission t...

Hi,Everyone! This post is about audi sqli labs lesson 1. Audi Sqli labs is a vulnerable web application which is designed for practicing various forms of sqli injection. You can download it from github: https://github.com/skyblueee/sqli-labs-php7 and follow this video: https://www.youtube.com/watch?v=Ri0e249x5PY for installation. Let's get started with lesson 1. Lesson 1: Let's add ?id=1 in the url. Well, this means that ?id=1 works. Now, let's try to break this query. You can try different values of id such as 10000000, asdwqe,@, ' etc. When you try ?id=1' , you will see an error message. Let's analyse the error. The important part is : ''1'' LIMIT 0,1'  Remove the first single quote: '1'' LIMIT 0,1 Remove "LIMIT 0,1" : '1'' This means that our given input is being enclosed in a single quote(').  You can fix the query while keeping the value of id as 1' by commenting out the...

Kioptrix level 2 is a boot-to-root machine. Let's hack this machine! Setup is same as kioptrix level 1. So first, we need to find the ip address of the machine. So,192.168.56.103 is the ip address of the Kioptrix level 2 machine. Let's run nmap scan: 192.168.56.103 As per our scan, we have SSH, a website , CUPS and MySql running. I tried connecting to ssh, nothing happened. Also, I couldn't find the exploit for this version openssh. Website Let's check out the website: http://192.168.56.103:80 Well, the website has a login form. Let's see if it is vulnerable for sql injection.  Boom!! We got in! This might be vulnerable for command injection. Let's try. Well, it is vulnerable to command injection!! We have apache user permissions. So, we need to try escalate our privileges to root by using a local privilege escalation. For that, let's find the details of OS version and linux kernel. So, we have know that li...

Kioptrix level 1 is one of the easiest boot-to-root machine. It is best suited for beginners to practice their pentesting skills. In this article, we will talk about how to hack kioptrix level 1. Kioptrix level 1 is Red-hat linux 32 bit machine which can easily be run with just 512 MB. You can download the virtual machine from the vulnhub. I hope the reader of this article can figure out how to setup this in a virtual machine. The host machine would be kali 2019.3. The virtualbox version is 6.0. So,after booting up the machine from the virtualbox, we need to find its ip address.We will use the tool netdiscover. The result: 192.168.56.102 is the kioptrix machine. Let's run a simple nmap scan using this ip address. The result: So, basically, we have 6 ports open. Port 22 is ssh using OpenSSH 2.9p2. Port 80 and 443 are using Apache 1.3.20 and mod_ssl version 2.8.4. We also have port 32768 and port 111 which seems to RPCs. Lastly, we have port 139 running samba but...