50
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 1/50
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 2/50
! " # "# $
#
Professor - Sipe
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 3/50
% & '
Alice: But I don't want to go among mad people.The Cat: Oh, you can't help that. We're all mad here. I'm
mad. You're mad.Alice: How do you know I'm mad?The Cat: You must be. Or you wouldn't have come here.
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 4/50
(
& )* ( + # &
, ( *$ - (
, $ #, ( . #
&,, /
, 0) 12
$$ &
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 5/50
-, 345 ## 6 7 # # &
, 89 ## 6 7 # # 7#, :;5 ( < 6 ## . # &
7& ;=;>
, =;5 ## 6 7 # &>
, / 0) 1 ?= ?# 7 #
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 6/50
@
!
,
"# $ % !, ! ""#
"& $ $ '% (!
, $ % & ' ( ""#
"$)% !
, ) * ""#
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 7/50
*
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 8/50
+ ,
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 9/50
' -
# 6$$ (
0) 1$ ( 1
$$A.
B (# B
# 8<
A.
.
<
% + 6 " &! #
&
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 10/50
' -
7 # &
+ ! #
) ( #
& . ($ ) (
+ 7# " )
$#
&
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 11/50
&
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 12/50
( *
#, * (
- &%, > # (
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 13/50
.
C( # A$ # &
%6
&7 $ #& $ *
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 14/50
.
$ - (, $ $ ( @ # D
, $ $ ( ( # 7 # &(, 6 $ (, +
- (A# + # (
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 15/50
/
, > # (
+ #$ # $ 8
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 16/50
- 0
Security
Usability
low
high
low high
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 17/50
. &
(> + #
, ) E,, & &, 7 # & &
, $ &A.
, #& & (
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 18/50
, @ D , & 6 # # ( ## (
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 19/50
, 1
$ (, ) ( &
F (F G
, ( ( @ $ D - (# > (
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 20/50
1 2
HH
. H# H
#H
) H# &
HH
G
) ( ( &, ## #H8 . (
) ( ;;; 4', @> B 84 ; D # H .
$, I $ 8I # H .
!, + , -"-!. / 0 1 2-
+ 6 &, #H ( 7 $ 7, @% # $ >& $ D @ 6 7 D
+ & #& # ( ( $, H(, H$ # # & H.# I I
http://www.googleguide.com/advanced_operators.html
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 21/50
#
I ($ # $I B666 ($ # $
# & H ( . HI $ ( @
# & H.# #HD $ # .# D
#H $ #H #
I . I # J . H6 7 # < J . H #
K $ J . HIK ( @
# & H ( ( *CALM K""A MK A" $
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 22/50
& 3
1, % , % , 3''4 , %
5, 1 6167%%%5 8 1, 3''4 , % 1 2 1 59 :;+
, -$
10 2 0 2 1 - 10 2 0 2 1 -
, <=1 1% >1 2 1 ? >
, 4, ?
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 23/50
4 3 5
H( (# $ B666 ( (# $, # G (
) ( $, , %
A & % &
, H88 #7 $8 M
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 24/50
H88 $8 8N; =8' O M ;;N, 6 7 ; =, =;B=;B ;;N
- (# H I+ 6 7& 7 ; =@, =P N;; ; B=9B ;;:
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 25/50
> ( , > ( ##, C * N Q
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 26/50
&
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 27/50
. 6
$ # A
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 28/50
- 78 9
> # 7 7 6R H
, % $F >&F > 7
, #, ( $ $
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 29/50
8
7$ $ #S T # U $ VS8 T 6 7 (
# # ( E, 7
F & 6 7#
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 30/50
8 :
$$,, A + (, " $
( # (, /
, #, $
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 31/50
8 ; <
1. Link to Accountin email
2. Embedded scriptSent to target
3. Script executed on clientbrowser
4. Script provides cookie
and session data
5. Hacker users credentials
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 32/50
8
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 33/50
- &
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 34/50
=* , > :
Username: ‘Password: a
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 35/50
=* , > <
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 36/50
=* , > , (
Username: access' or 1=1 --Password: a
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 37/50
=* , > ,
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 38/50
=* , > 3 <
? @ ''
' group by login.primarykey having 1=1 --
' union select min(username),1,1,1,1 from loginwhere username > 'a'--
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 39/50
=* , > A / & 3
? 7 3 9% % % %3 @ ? BBB ?''
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 40/50
, :
Remote Machine Details
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 41/50
6 C #C*
This would be fine if it werean admin
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 42/50
7, + * # + +
F 0) 1F + 6 " &
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 43/50
>
Beast
+
Tutorial:http://www.youtube.com/watch?v=KjbjPVG0BPU&feature=relate
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 44/50
-, - (#
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 45/50
: D : E
2, K > ( K") * #
, K & 7& (, " #& & $, " # + 6 K, K, # & (
F .
, ( &, K & #
F %, " #& & &
, ( + 6, # # &, A $ # $, & " 6
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 46/50
) $ , @* $ # * D , *
F L $
F >F
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 47/50
C
> 6 ( $, H88666 7 (86(7 8 ( 8 # 8 6 8 &7 6
! # 7 # & . #, 666 (, H88666 6 (8 . 8 M=;M ;;3, H88 # (8
#, H88666 # 8 (B ( $ B $, H88666 7 $8 ' O:3
& + # &, H88666 (8 8 # 8
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 48/50
*
H88. B.& ( 8 M/ M # .
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 49/50
$$ &
2 ( % # E
% * #6 &
7 ## (
- ) E
8/3/2019 The Dark Arts-Color
http://slidepdf.com/reader/full/the-dark-arts-color 50/50
0
& 6 2
C $
