Wednesday, April 16, 2014

WEBSITE HACKING WITH DOT NET NUKE EXPLOIT

In this tutorial I will tell you how hackers use a simple dot net nuke exploit to hack a website, Now the exploit I am talking about is found in hundreds and hundreds on DNN applications and it allows the hacker to upload an image on your server, This type of attack is also called one way Hacking and at the end of article I have also posted some countermeasures to help you defend your self against these kinds of attack.
Google Dork
A google dork is an act of using google provided search terms to obtain a specific result and this DNN vulnerability occurs only in those websites which have “/portals/0″ in their navigation, So goahead and search for inurl:”/portals/0″ where inurl asks the google to display all the url’s who have /portals/0 in their navigation1.Lets say the vulnerable website is: www.vulnerablewebsite.com/portals/02.Now we will just add Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx after the url so http://www.vulnerablewebsite.com/portals/0 will becomehttp://www.vulnerablewebsite.com/portals/0Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx3.Now a website is vulnerable to this type of attack you will get a similar windows like the below one:
4.Next enter the following Javascript in the address bar:
javascript:__doPostBack(‘ctlURL$cmdUpload’,”)
What this javascript will do is that it will enable us to upload our image to the server:
5.The hacker could upload any image on victims website.Countermeasures1.The easiest method is to rename your fcklinkgallery to some thing else but it will not prevent this attack, but you can protect it from script kiddie’s in this way, A skilled hacker can easily find the renamed file by using some Footprinting methods2.Another way to prevent this attack is to upgrade to IIS 7 or higher and a DNN version of 4.9.4 or higher

1 comment:

  1. Hello do you need to hack a Gmail account? i know of someone who can help.
    Mr James .I saw a review about him and I needed help hacking my Wifes Gmail account so i contacted him and he said he was going to help me.I gave him the information he required about my Wife’s account and afterwards i received all my wifes Gmail messages activity linked directly to me. He was reliable and trustworthy i just want to say thank you. If you need help you can contact him via Email(Worldcyberhackers@gmail.com) 
or whatsApp : +12678773020

    ReplyDelete