When talking about ClickJacking, people will first think how to use it to Hijack Web Cam or microphone. Let’s forget about webcam jacking thingies this time. Been thinking of how to use iFrame redressing (ClickJacking) techniques to exploit web application security. Finally my mind lands to a word, which is known as ‘Worm’.
Just like the Click-Jacking style Joomla CMS hijacking. CSRF and Automation are needed to infect blogs, CMS, forums, and etc. Possible? Yes indeed!
Scenario :
- Victim log in to his/her blog, and does not sign out from it.
- Victim visits a malicious site with Click-Jacking, any clicks there will trigger a CSRF attack which will attempt to insert a script into victims blog theme. (Just like WordPress Theme Editor)
- The script will generate an iFrame containing Click-Jacking
- Now the victim’s blog become a zombie that will attempt to infect all his/her blog’s visitors blog.
Isn’t it lovely? Just a thought . . .
There was a rare fenomena last night in our sky. You could see a smiling sky : A Moon and 2 stars – Scientist said it’s Venus and Jupiter, forming a smiling face in the sky. If you missed it, I give you this :
The Moon Smiles at you
Click The Image to Enlarge
See? Even the sky wants you to smile. Cheers 
Here is the Click-jacking Proof Of Concept video made by me. On the video, I show you how to pawn or hack a joomla powered site using click-jacking.
How it works :
- First a victim logged into his Joomla Powered site Administration Control Panel
- He didn’t logged out from the service
- He visited a malicious site
- He clicked on something (anything on the page)
- By the time he clicked, his Joomla Powered site password has been changed without his notice
Been pissed off several weeks, until my blog is UP few days ago. A long story to be told. Moved hosting server several times and can’t get my domain added. Traffic went down drastically, people are running away, less than 50 visitors a day, that’s what I’ve been through.
Well enough for the sad thingies. I am very happy to announce that there is a site for you guys to test your hacking skills LEGALLY !! Don’t worry, it’s 100% legal, the site is mine 
Your mission is to take out 3 hidden pictures stored on this server, and email me to see if you got the correct one. It’s not a hard task tough, I estimated people can own it within an hour. Just take it as a challenge 
Here is the Challenge site : http://www.sekuriti.info/challenge/
Tell me your progress and let me know if you have beaten it!
WINNERS :
1. Tukimin, Singapore. 30 November 2008.
Accounts Security Part IV
A Password Security Related Article by Calvin Limuel a.k.a. r3ck0rd
Howdy ho! Has it been a loss since my previous post about Accounts Security? Did you enjoy my previous posts about your accounts’ security? Have you done those tips? You haven’t? OK I haven’t done those too (some, but not the same mistake hehe ). Well then, finally the fourth part, eh? And I hope you enjoy this post. Containing, maybe not so fresh, because may be discussed outside somewhere, or taken from a portion of an article in my blog, but helping tips for you to workout. Happy securing!
The Indonesian Hacking & Security Conference. Make sure you are here!
While I am not sure whether the ‘ClickJacking Proof of Concept’s video below is the ClickJacking technique that RSnake and Jeremiah Grossman mentioned, but I am very sure you might interested with the Youtube Video of Webcam ClickJacked below (The Video PoC by Guy Aharonovsky) :
First of all, this post is for Indonesian therefore will be written in Bahasa Indonesia. Sorry for English readers 
Para pengunjung blog yang terhormat, pernah merasa bingung tidak pada saat memilih mobil? Misalnya memilih merek, memilih model, dan tentunya memilih harga. Pada saat ini, terdapat banyak sekali merek mobil seperti Toyota, Honda, Mitsubishi, Hyundai, dan lain sebagainya. Tetapi pilihan saya tetap mobil Toyota, selain sparepart gampang didapatkan, juga keawetan mesin sudah teruji. Dan paling penting harga resell (harga seken) juga ga jelek sekali lah
4 tahun lalu saya membeli mobil Toyota Corona, harganya sekitar Rp. 58.000.000 dan beberapa saat dulu saya jual, tau ga harga pasarannya berapa? Rp. 74.000.000,- Naik sekitar Rp. 16.000.000,-. Hehehe. Yup, karena pada saat saya membeli FTZ masih berlaku, sedangkan pada saat saya jual kemaren FTZ sementara dicabut, sehingga harga mobil Ex Singapore naik drastis. Lumayan kan?
Sekarang bingung juga nih karena ingin meng-kredit atau menyicil mobil baru tapi bingung mau pilih yang mana diantara 3. Ada 3 model mobil yang akan saya bahas disini, yaitu :
Continue reading »
Howdy my blog’s readers! Did you notice my blog title changes? Before it was : “Zoiz Blog : A Web Application Security Blog”. And now, “Zoiz Blog : Was A Web Application Security Blog”. Well, it means that I can no longer barely have time to do research in webappsec. It’s a lame blog anyway, cheers
BITS (BatamCity! IT Solutions) founded by me and co-founded by Mr. Feny, is a company operates in Information Technology Solutions, just like it’s name We develop Web Application, Intranet Application, Inventory & GL system, logo design, training and consulting.
Beside working at BITS, I am also a Lecturer at Universitas International Batam (UIB) teaching “Internet Security”. And I am going to be the speaker on the coming university seminar (Webappsec Related topic).
I just got my degree as “Sarjana Komputer” or something like “Bachelor of Science” recently.
These are the jobs that keeps me busy from blogging. But I’ll still go blogging when I have time
And this is the picture taken at the first Hackers Day events (What the hell?! Wasn’t I supposed to post this 3 months ago?? HAhaha. Sorry guys, better late than never )
From Left to Right : Calvin, Zoiz, Th0R, FamilyCode, Izal, JKR, Eric, ??
That’s all folks.
It’s been couple of weeks since my last post. I’ve been very busy managing my newly set up company. And I think it’s time to post another (lame) article right here on this very (lame) blog.
After reading “Thousand Ways to SQL Injection“, people started to ask me whether it is possible to launch a SQL injection using XSS? Some of them questioned me about the possiblity of it, some of them don’t even believe it’s possible. And well some of them say that’s gonna happen but don’t know how or never came accross one.
Let’s take a look at the following ‘fictive’ (and lame) scenario of SQL Injection using XSS :
As we know that site abc.com uses GoodGoodCMS_v1.0 as their Content Management System. Mr. Z, the attacker, found out that GoodGoodCMS has a XSS flaw on the admin page. But well there is nothing much to exploit since GoodGoodCMS doesn’t uses Cookies as the authentication method. But Mr. Z did found out that the GoodGoodCMS uses Cookies values in SQL Query without a proper filter.
Guess what? Mr. Z pull a XSS and insert something like this:
<script>document.cookies=”1; UPDATE admin_table SET password=\’yihaa\’ WHERE id=1″;</script>
This is my concept of SQL Injection using XSS. Correct me if I am wrong, and you are very welcome to shout your ideas about this topic here.
Thanks
Zoiz – http://zoiz.web.id
Recent Comments