Scan websites against XSS with OWASP Scrubbr v1.0

Scrubbr is a BSD-licensed database scanning tool that checks numerous database technologies for the presence of possible stored cross-site scripting attacks. The tool was partially inspired by "Scrawlr", a trimmed-down version of HP’s WebInspect which was released for free after the so-called "asprox" mass-SQL injection bot exploited hundreds of thousands of insecure ASP sites.

Download XSS Scanning Tool Here

BlackSheep: Way to Avoid FireSheep!

This is an intelligent tool in a sense that you get to know the IP address of the attacker who is running FireSheep. Suitably, BlackSheep is also a Firefox plugin, that is designed to combat FireSheep. It does so by dropping ‘fake’ session IDs on the wire and then monitoring traffic to see if it has been hijacked. BlackSheep identifies FireSheep via a request to a domain that it identifies session information. Using this hijacked session information, FireSheep contacts the targeted host in order to obtain the name of the hijacked user along with an image of the person, if available. When identified, the user will be receive the following warning message:





FireSheep and BlackSheep can not co-exist on the same Firefox profile as they share a lot of common code. If you need to use them on the same machine, use different Firefox profiles.

Download BlackSheep v1.0.0 (blacksheep-latest.xpi) here.

Hack Facebook/Twitter Or Any Email Account With Session Hijacking

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.



As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:






Double-click on someone, and you're instantly logged in as them.

That's it.

Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.

Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

By Codebutler..

A PRACTICAL WAY TO FIND ADMINISTRATOR WEB PAGE

Administrator web page is the most important pages in a web. Because, from here a web control facilities. One of the hacking technique which is still popular is trying to find the administrator account on this page through a variety of techniques such as exploits, bruteforce, SQL Injection and also include requesting assistance with a number of software password hacking.

Regardless of any technique, hackers agree if the administrator page is one of the most essential web pages and the most search for exploitation. Typically, the administrator page url address is http://www.sitename.com/admin.php, http://www.sitename.com/admin.html and so forth.

Because of the susceptibility of admin pages, its url address recently deliberate in secret by using the unique url address to make difficult to guess, at least give a little trouble on the hackers to find it.

The groups of Indian hackers (Indian Cyber Army), released a site called Admin finder that can help us to find administrator page. The web address is: http://adminfinder.cyberarmy.in/.

On a black background sites, we only are asked to enter the url address of a target site with the end slash mark (/), then press the Submit Site Bottom. AdminFinder will look for administrators pages. administrators web pages will be displayed with a description in the left column. If found, will be given a description "Found!" with Red color. While that does not exist, will be given a "Not Found!" description with yellow color. The red color with the description "Found!" is the administrator page. It’s easy right?.