20+ .htaccess Hacks Every Web Developer Should Know About

Apache's .htaccess(hypertext access) configuration file can be a very powerful tool in a web developer's toolkit if used properly. It can be found in the webroot of your server and can be easily edited using any text editor. In this article I'm going to show you 20 .htaccess hacks and how to use them.

Before I start with this article I'd like to start by saying that abusing the .htaccess file will hurt the performance of your website. The .htaccess file should only be used if you have no other way to achieve certain things.

Make sure to back up your current .htaccess file before applying any of the following hacks.

1. Prevent Hotlinking

Tired of people using your bandwidth by putting the images hosted on your server on their website? Add the following code at the bottom of your .htaccess file to prevent hotlinking.

1	Options +FollowSymlinks

2	#Protect against hotlinking

3	RewriteEngine On

4	RewriteCond %{HTTP_REFERER} !^$

5	RewriteCond %{HTTP_REFERER} !^http://(www.)?domainname.com/ [nc]

6	RewriteRule .*.(gif|jpg|png)$http://domainname.com/img/stop_stealing_bandwidth.gif[nc]

NOTE: The following article explains better methods to "prevent" hotlinking:
Link building secrets by Maurizio Petrone

DNS Spoofing- Ettercap Backtrack5 Tutorial

DNS Spoofing attack

Spoofing attack is unlike sniffing attack, there is a little difference between spoofing and sniffing. Sniffing is an act to capture or view the incoming and outgoing packets from the network while spoofing is an act to forging one's source address. In spoofing attack an attacker make himself a source or desire address. This is basically done by using some tricks.

Exploiting Software: How to Break Code | Greg Hoglund, Gary McGraw

Addison Wesley | ISBN: 0201786958 | 2004 | PDF | 512 pages | 7.58 MB

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers. Exploiting Software is loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

Abusing VLANs With BackTrack

In this post I'm going to have a little fun with VLANs. As I've been studying for the CCNA cert I've been reading how great VLANs are, so in this post i'm going to have a little fun with some really cool tools from the Backtrack distro. My aim is to demonstrate why simlpy placing hosts in a seperate VLAN might sometimes not be enough if you really don't want anyone to have access to them. Let's get started.

Tools:

• BackTrack.
• Yersinia.
• vconfig.
• Wireshark.
• Nmap.

List of Best Ethical Hacking / Penetration Testing Tools

Here is list of useful and Best Software tools that helpful in Ethical Hacking and Penetration Testing, Forensics ...

MetaSploit

Metsploit is a very Powerful PenTesting Tool . Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. The Metasploit Project is also well known for anti-forensic and evasion tools, some of which are built into the Metasploit Framework. Very useful tool for Information Gathering, Vulnerability Scanning, Exploit Development, Client side exploits,...

Official site: Click Here

Post Exploitation & Meterpreter Scripting -Metasploit

Metasploit has now become the king of tools used in penetration testing. It’s comprised of a collection of all available exploits. The tool has its pros and cons; 

Some advantages are:

• It automates the process of penetration testing.
• Fast (less time require).
• Reliable.
• It offers a lot of advanced features that we will discuss step by step .

Subterfuge - Man-in-the-Middle (MiTM)Attack Framework Tutorial

 

Subterfuge, a Framework to take the arcane art of Man-in-the-Middle(MiTM) Attack and make it as simple as point and shoot. A beautiful, easy to use interface which produces a more transparent and effective attack is what sets Subterfuge apart from other attack tools. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network, and even exploiting machines through race conditions.

Fast Track Hacking-Backtrack5 Tutorial

Backtrack 5 contains different tools for exploitation, as discussed before about metasploit and armitage for this article i will discuss about fast track, however I have received different request to write more tutorial for armitage, i will write for armitage too later. Fast Track is a compilation of custom developed tools that allow penetration testers the ease of advanced penetration techniques in a relatively easy manner.

Some of these tools utilize the Metasploit framework in order to successfully create payloads, exploit systems, or interface within compromised systems.

If you are beginner and dont have any idea about vulnerability, payload and shell code than first read the article " Introduction to metasploit".

Crack SSL Using SSLStrip With BackTrack5

Well this is the tutorial based article, so you must know about SSL (secure socket layer) and something about Backtrack5 because we are using backtrack5 for this tutorial, if you are using some old version like backtrack4 or if you are using some other Linux so you must be sure to install all the dependencies that being used in this tutorial.

 Secure socket layer or SSL used to established a secure and encrypt connection between user and the server and we would like to break this secure connection so the sniffing will be occur successfully.

To crack SSL protection we launch man in the middle attack, so doing this we need some tools and the requirement list is

• Linux (Backtrack)
• Arpspoof
• IP Tables
• SSL Strip
• Netstat

Metasploit Tutorial 2

Basics Part 2 - Using The Inbuilt Codes

Welcome to the Metasploit Basics Part 2 . Make sure you read the first part before reading this.In this part we will talk about using the Exploits , Payloads , Auxiliary , Nops and Encoders.I think i don't need to explain what are these because it is already discussed in the first part

Metasploit have
+ -- --=[ 684 exploits - 355 auxiliary
+ -- --=[ 217 payloads - 27 encoders - 8 nops

This may vary in your metasploit according to your version.

The Basic use of metasploit
1. Pick which exploit to use
2. Configure the exploit with remote IP address and remote port number
3. Pick a payload
4. Configure the payload with local IP address and local port number
5. Execute the exploit

Now time for a example  

Type "show exploits"  see the list of exploits available. Many of the exploits listed here are going to work against the target servers.But the difficult part is to know if the exploits will work or not =P

I will use ....

Metasploit Tutorial 1 - Understanding The Framework

What is Metasploit ?

The Metasploit Project is an open-source computer security project which provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Its most well-known sub-project is the Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive, and security research.

Basically Metasploit is tool which provides complete environment for hacking.

Metasploit is ran by rapid7 community & Metasploit is the biggest software which is written in ruby

Why metasploit is recommended ?

1.      metasploit is free n easy to use and one can develop his own exploits,payloads etc & use it with metasploit easily.

2.       It comes with over 690 exploits & which are updated on regular basis(0days also included).

3.      We can use diffrent plugins,external tools to improve the productivity of metasploit for example SET(social engineering toolkit), beEF, XSSF, Nexpose , NMAP, W3af etc(we will continue to it in next posts)

Metasploit is available in 3 versions

1.      Metasploit Pro - for pentester

2.      Metasploit Express- for IT security teams

3.      Metasploit Framework - Its an open source & avialable for download for free

you can download metasploit from official website - www.metasploit.com

Buffer Overflow Ebooks Collection

 Hi all users, here we've collected some E-books set concerning Buffer overflow vulnerability, shellcoding,.. and i would like to share them:

This set contains the following  E-books :

METASPLOIT FRAMEWORK

Metasploit Framework is command line framework of metasploit where everything is to be done manually with commands it is much stable than other GUI versions of metasploit.

Metasploit Framework is free to download as we all know metasploit is open source.

 The basic steps for exploiting a system using the Framework include -

WHAT IS METASPLOIT

The Metasploit Project is an open-source computer security project which provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Its most well-known sub-project is the Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive, and security research.

Metasploit – The Penetration Tester’s Guide Ebook

"The best guide to the Metasploit Framework." —HD Moore, Founder of the Metasploit Project

The Metasploit Framework makes discovering, exploiting, and sharing vulnerabilities quick and relatively painless. But while Metasploit is used by security professionals everywhere, the tool can be hard to grasp for first-time users. Metasploit: The Penetration Tester's Guide fills this gap by teaching you how to harness the Framework and interact with the vibrant community of Metasploit contributors.

Once you've built your foundation for penetration testing, you'll learn the Framework's conventions, interfaces, and module system as you launch simulated attacks. You'll move on to advanced penetration testing techniques, including network reconnaissance and enumeration, client-side attacks, wireless attacks, and targeted social-engineering attacks.

Learn how to:

• Find and exploit unmaintained, misconfigured, and unpatched systems
• Perform reconnaissance and find valuable information about your target
• Bypass anti-virus technologies and circumvent security controls
• Integrate Nmap, NeXpose, and Nessus with Metasploit to automate discovery
• Use the Meterpreter shell to launch further attacks from inside the network
• Harness standalone Metasploit utilities, third-party tools, and plug-ins
• Learn how to write your own Meterpreter post exploitation modules and scripts

How to Hack Windows XP in LAN using Backtrack 5

The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.

Requirements

• Backtrack  5
• Windows XP Machine (Target)

Open Your Backtrack terminal and Type cd  /pentest/exploits/set

Now Open Social Engineering Toolkit (SET) ./set

Now choose 2, “Website Attack Vectors”.