· 9 years ago · Aug 31, 2016, 05:56 PM
1
2 ▄▀▀▀▀▄ ▄▀▀▄ ▀▄ ▄▀▀▀▀▄
3 â–ˆ â–„â–€ â–ˆ â–ˆ â–ˆ â–ˆ â–ˆ â–ˆ
4 ■▄▄▀▀ ■█ ▀█ █ █
5 █ █ █ ▀▄ ▄▀
6 ▀▄▄▄▄▀ ▄▀ █ ▀▀▀▀
7 â– â–ˆ â– ZINE 1
8 â–
9_______________________________________________________________________________
10
11 TABLE OF CONTENTS
12
13 0.0 Introduction
14 0.1 Credits
15 1.0 OwnagePranks
16 2.0 Dark Army
17 2.1 - Introduction
18 2.2 - A first glimpse ( " rkhunter wont protect
19 2.3 - Dark Army Ownage ( _ * you from PHP shells.
20 3.0 KickassPastes * ( \ ___
21 4.0 LeakedSource " " \ _/ /
22 5.0 Credits ( * ) ___/ |
23 ) " _ o)'-./__
24 * _ ) (_, . $$$
25 ( ) __ __ 7_ $$$$
26 ( : { _) '--- $\
27 ______'___//__\ ____, \
28 ) ( \_/ _____\_
29 .' \ \------''.
30 |=' '=| | )
31 | | | . _/
32 \ (. ) , / /__I_____\
33 '._/_)_(\__.' (__,(__,_]
34 @---()_.'---@
35_______________________________________________________________________________
36
37 0. INTRODUCTION
38
39 Greetingz, we are zn0 -- we pretend to be girls in exchange for credit cards.
40 We also make people who record Youtube videos pretending to be Indian tech
41 support call Indian tech support to get back their domain back (lol).
42
43 Anywayz, lube up your assholes because you're about to witness some good old
44 fashioned rape. I'm not talking exotic either, I'm talking prison shower rape.
45
46________________________________________________________________________________
47
48
49 1. OWNAGEPRANKS
50
51 You may of heard of a website called Twitter?
52 -- well this zine has nothing to do with that.
53
54 We liked how all you morons used it with your little egg ass profile pictures.
55 You morons need to hatch already and do something with those egg shells, like
56 us. We put them shells to good use; just ask the owner of ownagepranks.com
57
58 root:x:0:0:root:/root:/bin/bash
59 bin:x:1:1:bin:/bin:/sbin/nologin
60 daemon:x:2:2:daemon:/sbin:/sbin/nologin
61 adm:x:3:4:adm:/var/adm:/sbin/nologin
62 lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
63 sync:x:5:0:sync:/sbin:/bin/sync
64 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
65 halt:x:7:0:halt:/sbin:/sbin/halt
66 mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
67 uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
68 operator:x:11:0:operator:/root:/sbin/nologin
69 games:x:12:100:games:/usr/games:/sbin/nologin
70 gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
71 ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
72 nobody:x:99:99:Nobody:/:/sbin/nologin
73 dbus:x:81:81:System message bus:/:/sbin/nologin
74 vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
75 abrt:x:173:173::/etc/abrt:/sbin/nologin
76 haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
77 ntp:x:38:38::/etc/ntp:/sbin/nologin
78 saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
79 postfix:x:89:89::/var/spool/postfix:/sbin/nologin
80 sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
81 tcpdump:x:72:72::/:/sbin/nologin
82 apache:x:48:48:Apache:/var/www:/sbin/nologin
83 named:x:25:25:Named:/var/named:/sbin/nologin
84 mysql:x:498:499:MySQL server:/var/lib/mysql:/bin/bash
85 cpanelhorde:x:500:500::/var/cpanel/userhomes/cpanelhorde:/usr/local/cpanel/
86 bin/noshell
87 mailnull:x:47:47:Exim:/var/spool/mqueue:/bin/false
88 dovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologin
89 dovenull:x:497:498:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/
90 nologin
91 cpanel:x:32001:502::/var/cpanel/userhomes/cpanel:/usr/local/cpanel/bin/noshell
92 cpanelphpmyadmin:x:32002:503::/var/cpanel/userhomes/cpanelphpmyadmin:/usr/local/
93 cpanel/bin/noshell
94 cpanelphppgadmin:x:32003:504::/var/cpanel/userhomes/cpanelphppgadmin:/usr/local/
95 cpanel/bin/noshell
96 cpanelroundcube:x:32004:505::/var/cpanel/userhomes/cpanelroundcube:/usr/local/
97 cpanel/bin/noshell
98 mailman:x:32005:506::/usr/local/cpanel/3rdparty/mailman:/usr/local/cpanel/bin/
99 noshell
100 cpanellogin:x:32007:509::/var/cpanel/userhomes/cpanellogin:/usr/local/cpanel/
101 bin/noshell
102 cpaneleximfilter:x:32008:510::/var/cpanel/userhomes/cpaneleximfilter:/usr/
103 local/cpanel/bin/noshell
104 cpaneleximscanner:x:32009:511::/var/cpanel/userhomes/cpaneleximscanner:/usr/
105 local/cpanel/bin/noshell
106 cpses:x:496:497::/var/cpanel/cpses:/sbin/nologin
107 buklau:x:501:512::/home/buklau:/usr/local/cpanel/bin/noshell
108 betaop:x:502:513::/home/betaop:/bin/bash
109 calls2:x:503:514::/home/calls2:/usr/local/cpanel/bin/noshell
110 systest:x:32010:32010::/home/systest:/bin/bash
111 ownage:x:504:515::/home/ownage:/usr/local/cpanel/bin/noshell
112 cpanelrrdtool:x:32011:32011::/var/cpanel/userhomes/cpanelrrdtool:/usr/local/
113 cpanel/bin/noshell
114 smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
115 freeswitch:x:495:495::/usr/local/freeswitch:/bin/bash
116 cpanelconnecttrack:x:32012:32012::/var/cpanel/userhomes/cpanelconnecttrack:
117 /usr/local/cpanel/bin/noshell
118 nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
119
120 In their cron.hourly we found this:
121
122 -----BEGIN 01-rkhunter.sh-----
123
124 #!/bin/sh
125 # 01-rkhunter A shell script to update and run rkhunter via CRON
126
127 XITVAL=0
128
129 # Get a secure tempfile
130 TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit
131 1
132
133 if [ ! -e /var/lock/subsys/rkhunter ]; then
134
135 # Try to keep the SysInit boot scan from colliding with us (highly unli
136 kely)
137 /bin/touch /var/lock/subsys/rkhunter
138
139 # Source system configuration parameters.
140 if [ -e /etc/sysconfig/rkhunter ] ; then
141 . /etc/sysconfig/rkhunter
142 else
143 MAILTO=root@localhost
144 fi
145
146 # If a diagnostic mode scan was requested, setup the parameters
147 if [ "$DIAG_SCAN" == "yes" ]; then
148 RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --append
149 log --display-logfile"
150 else
151 RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
152 fi
153
154 # Set a few critical parameters
155 RKHUNTER=/usr/bin/rkhunter
156 LOGFILE=/var/log/rkhunter/rkhunter.log
157
158 # Run RootKit Hunter if available
159 if [ -x $RKHUNTER ]; then
160 /bin/echo -e "\n--------------------- Start Rootkit Hunter Update -----
161 ----------------" \ > $TMPFILE1
162 /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1
163 /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ------
164 ---------------" \ >> $TMPFILE1
165 /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1
166 XITVAL=$?
167 /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -------
168 ---------------" \
169 >> $TMPFILE1
170
171 if [ $XITVAL != 0 ]; then
172 /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)"
173 $MAILTO
174 fi
175 /bin/cat $TMPFILE1 >> $LOGFILE
176 fi
177
178 # Delete the gating lockfile
179 /bin/rm -f /var/lock/subsys/rkhunter
180 fi
181
182 # Delete the secure tempfile
183 /bin/rm -f $TMPFILE1
184
185 exit $XITVAL
186
187 -----END 01-rkhunter.sh-----
188
189 options single-request
190 nameserver 10.0.80.11
191 nameserver 10.0.80.12
192
193 Linux s89.webhostingsurplus.com 2.6.32-504.8.1.el6.x86_64 #1 SMP Wed Jan 28 21:
194 11:36 UTC 2015 x86_64
195 /home/ownage/public_html/forums ( drwxr-x--- )
196_______________________________________________________________________________
197
198 2.1 - INTRODUCTION
199
200
201 This chapter will expose the hacking group called the Dark Army.
202 The Dark Army are a group full of faggots who decided to go around acting all
203 top-shit, hacking into some random websites thinking it would go without any
204 consequences. Well, you were wrong.
205
206 You know what the devil says:
207 "Sin, sin, sin, you faggots are going in my DOX-BIN".
208
209 As with most hacking groups formed in 2016, this one is full of trash-talking
210 kids with no real knowledge, or even the will and/or motivation to learn anything
211 new.
212
213 We were able to Social Engineer their group while logging everything they were
214 saying and we quickly realized that we had already pwned most of the members
215 before, and that half our work was already done.
216
217 MESSAGE FOR OTHER HACKERS: u suck, zn0 number #1
218
219 Now, onwards with the ownage of The Dark Army!
220_______________________________________________________________________________
221
222 2.2 - A FIRST GLIMPSE
223
224
225 |/|
226 |/| Our goal was to rip this crew to sheds, which was not very hard.
227 |/| We'll give you a little peek into how these kids operate and some
228 |/| small mistakes they did which we noticed...
229 |/|
230 |/| Our first act of charity (putting these sick puppers with rabbies down)
231 |/| was as you expected -- easy. Here is evidence that cavemen still exist.
232 |/|
233 |/| There were five volunteers of anal rape, from what we noticed.
234 |/| Internet, meet:
235 |/|
236 |/| * Twiz.....: (Fat, smells bad, swats)
237 |/| /¯) * Lxtz.....: (Spic, sabu jr, swats)
238 |/|/\/ * Max......: (Literal caveman, 100% moron)
239 |/|\/ * Hostile..: (His alias is very accurate if he was trying to be sarcastic,
240 |/|/ literally seen a more Hostile child with autism on public transport)
241 |/| * Taylor...: (Cries over e-girls. Proof here: https://www.youtube.com/watch?v=DVWYvroP_UQ
242 (¯¯¯) He then claims to troll -- yeah dude, you got trolled by giving your bedroom
243 (¯¯¯) water damage you fat, digsuting, sad excuse of a man)
244 (¯¯¯)
245 (¯¯¯) Their means of communication was Discord (I know, you were expecting smoke signals
246 (¯¯¯) from these fucking cavemen), so all we had to do was get one of the members to send
247 (¯¯¯) us an invite link and then we'd gain trust and start slipping chat-logs and information
248 /¯¯/\ from their conversations.
249 / ,^./\
250 / / \/\ We played a game we like to call, "UR-GETTING-DOXED" and found some pretty
251 / / \/\ interesting/funny stuff. When we were reading their so-called zine
252( ( )/) we noticed almost every single hyper-link starts with "http://"
253| | |/| rather than "https://". This means the author of the zine (@hackingyolife)
254| | |/| does NOT use a basic browser addon such as HTTPS everywhere,
255| | |/| which gives off a very unserious impression.
256( ( )/)
257 \ \ / / It's hard to take them seriously.
258 \ `---' /
259 `-----'
260_______________________________________________________________________________
261
262 2.3 - DARK ARMY OWNAGE
263
264
265 Now we have a good understanding of how modern day cavemen try to communicate
266 and what their mindset is like. We talked to Twiz on Discord and gained his trust
267 and before we knew it we had an invite link to the "Dark Army".
268
269 We realized almost everyone used their microphones to talk, so we joined their
270 voice channel and started listening to them. We quickly learned that Twiz and
271 Lxtz were both Brittish and around ~15-16 years old.
272
273 Like we have already mentioned, we had already pwned Lxtz numerous times
274 before, so a big part of our work was already finished. We started logging
275 all their conversations and recording their voice-chat so we could get
276 voice-prints of them all.
277
278 Here's a little quiz. How did we obtain UID 0 on Lxtz server and computer?
279
280 A. Using an 0day B. Backdoored C script
281 C. Smoked meth while jacking off
282
283 If you said B, you are correct! We used the getuid() C function to make
284 sure he ran the script as root.
285
286 if(getuid() != 0)
287 {
288 printf("You need to run this program as root.\n");
289 return 1;
290 }
291
292 Then it would wget a IRC-bot perl script silently in the background,
293 run it and remove it. That's it. We managed to pull this off twice,
294 on his main computer and his server.
295
296 root:x:0:0:root:/root:/bin/bash
297 daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
298 bin:x:2:2:bin:/bin:/usr/sbin/nologin
299 sys:x:3:3:sys:/dev:/usr/sbin/nologin
300 sync:x:4:65534:sync:/bin:/bin/sync
301 games:x:5:60:games:/usr/games:/usr/sbin/nologin
302 man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
303 lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
304 mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
305 news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
306 uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
307 proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
308 www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
309 backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
310 list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
311 irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
312 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
313 nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
314 libuuid:x:100:101::/var/lib/libuuid:
315 syslog:x:101:104::/home/syslog:/bin/false
316 messagebus:x:102:106::/var/run/dbus:/bin/false
317 usbmux:x:103:46:usbmux daemon,,,:/home/usbmux:/bin/false
318 dnsmasq:x:104:65534:dnsmasq,,,:/var/lib/misc:/bin/false
319 avahi-autoipd:x:105:113:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
320 kernoops:x:106:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
321 rtkit:x:107:114:RealtimeKit,,,:/proc:/bin/false
322 saned:x:108:115::/home/saned:/bin/false
323 whoopsie:x:109:116::/nonexistent:/bin/false
324 speech-dispatcher:x:110:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh
325 avahi:x:111:117:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
326 lightdm:x:112:118:Light Display Manager:/var/lib/lightdm:/bin/false
327 colord:x:113:121:colord colour management daemon,,,:/var/lib/colord:/bin/false
328 hplip:x:114:7:HPLIP system user,,,:/var/run/hplip:/bin/false
329 pulse:x:115:122:PulseAudio daemon,,,:/var/run/pulse:/bin/false
330 lxtz:x:1000:1000:Lxtz,,,:/home/lxtz:/bin/bash
331
332 His absolutely hilarious .bash_history: https://ghostbin.com/paste/v9fy5
333
334 view-source:https://web.archive.org/web/20160629214059/http://lxtzy.xyz/
335
336 Scroll to the bottom of the websites source and you'll see a little
337 message from Taku...
338
339 Not only that, but he also kept a text-file on his disk with all
340 of his emails, usernames, passwords, link to his IRL instagram
341 account and much, much more.
342
343 We also created a PiratenPad and copy pasted their zine in there,
344 but we changed the words "DarkArmy" to "TheGods" and then added a
345 1x1 pixel IP logger and tucked it between some lines of text.
346
347 We then sent this to Lxtz and made him click it. We ended up with this log:
348
349 #|Date/time IP address Country/City Browser Operating System Referring pages
350
351 1|26.08.2016 02:21:20 2.26.238.46 United Kingdom/Birmingham Chrome Windows 7
352 2|26.08.2016 02:17:41 31.169.51.155 Norway/unknown Firefox Linux
353 3|26.08.2016 02:17:34 31.169.51.155 Norway/unknown Firefox Linux
354 5|26.08.2016 02:16:59 2.26.238.46 United Kingdom/Birmingham Chrome Windows 7
355
356 He probably shared this link with someone else (...possibly Twiz?) and
357 that's the reason for the Norweigan IP address. That IP address is from a VPN, so
358 that's a dead end.
359
360 Summary:
361 * His real name is Kyle Ruston.
362 * He was rooted, twice.
363 * ...and he was arrested.
364
365 https://i.imgur.com/GoDDxjW.jpg
366
367 Twiz was on a dynamic IP, but never turned his router off and waited for his
368 DHCP server to assign him a new IP address. Instead, he's been on the same
369 one for quite a long time -- 86.10.24.186.
370
371 Twiz was arrested on August 26, 2016.
372
373 The group is now strung together by Max and Hostile, we'll see how long
374 the group lasts...
375
376 UPDATE: Like predicted, the group is now disbanded. :)
377
378 https://i.imgur.com/kK92aI5.png
379_______________________________________________________________________________
380
381 3. KICKASSPASTES/KICKASSSITES
382
383 TL;DR: Spicy extra news
384 -- kickasssites.co and kickasspastes.com were r4p3d and the owner extorted
385 into leaving the internet.
386
387 -----BEGIN kickasspastes.sql-----
388
389 web application technology: PHP 5.6.20
390 back-end DBMS: MySQL >= 5.0.0
391 Database: ufmvgbmj_katcomment
392 Table: uyeler
393
394 [57 entries]
395 +----+-----+-----------------+------+------+-------+-------+---------+-----------------------------+----------------------------------+--------+---------+----------------+----------------+----------+----------------+-----------+----------------+
396 | id | ban | ipno | isim | icon | sehir | unvan | yasne | email | sifre | social | soyisim | kulladi | seolinki | cinsiyet | son_tarih | socialtip | kayittarih |
397 +----+-----+-----------------+------+------+-------+-------+---------+-----------------------------+----------------------------------+--------+---------+----------------+----------------+----------+----------------+-----------+----------------+
398 | 2 | 0 | 73.151.197.209 | | | | 0 | | unify@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | unify | unify | | 20160421001233 | | 20160421001233 |
399 | 3 | 0 | 73.151.197.209 | | | | 0 | | Anima@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | Anima | anima | | 20160421055804 | | 20160421055804 |
400 | 4 | 0 | 73.151.197.209 | | | | 0 | | Aloe@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | Aloe | aloe | | 20160421062939 | | 20160421062939 |
401 | 5 | 0 | 73.151.197.209 | | | | 0 | | evaluati0n@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | evaluati0n | evaluati0n | | 20160421194353 | | 20160421194353 |
402 | 6 | 0 | 73.151.197.209 | | | | 0 | | ofccc@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | ofccc | ofccc | | 20160421195249 | | 20160421195249 |
403 | 7 | 0 | 73.151.197.209 | | | | 0 | | SirAk001@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | SirAk001 | sirak001 | | 20160421195350 | | 20160421195350 |
404 | 8 | 0 | 73.151.197.209 | | | | 0 | | tarantino@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | tarantino | tarantino | | 20160425013947 | | 20160425013947 |
405 | 9 | 0 | 73.151.197.209 | | | | 0 | | jaygomez1958@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | jaygomez1958 | jaygomez1958 | | 20160502183331 | | 20160502183331 |
406 | 10 | 0 | 73.151.197.209 | | | | 0 | | jerkyturkey@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | jerkyturkey | jerkyturkey | | 20160502183728 | | 20160502183424 |
407 | 11 | 0 | 73.151.197.209 | | | | 0 | | mikey1ra@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | mikey1ra | mikey1ra | | 20160502183614 | | 20160502183614 |
408 | 12 | 0 | 24.93.108.203 | | | | 0 | 1950011 | yvettecollier2015@gmail.com | 91c134f09cd693b28c1ff68ef9048dd2 | | | PoisonedLaura | poisonedlaura | | 20160503162329 | | 20160503124927 |
409 | 13 | 0 | 81.244.0.159 | | | | 0 | | coolinaro2015@gmail.com | 2122a6dd157c9b21b5c8593289e4ed81 | | | Kesme | kesme | | 20160504125424 | | 20160504125424 |
410 | 14 | 0 | 39.52.248.128 | | | | 0 | | c3rvine@outlook.com | 9d40b51d283074a906c37369f098aeab | | | c3rvine | c3rvine | | 20160504225257 | | 20160504225257 |
411 | 15 | 0 | 73.151.197.209 | | | | 0 | | drdak43@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | drdak43 | drdak43 | | 20160505172550 | | 20160505172550 |
412 | 16 | 0 | 73.151.197.209 | | | | 0 | | bigdaddyg@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | bigdaddyg | bigdaddyg | | 20160505172805 | | 20160505172805 |
413 | 17 | 0 | 73.151.197.209 | | | | 0 | | Doxking@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | DoxKing | doxking | | 20160505223911 | | 20160505223911 |
414 | 18 | 0 | 73.151.197.209 | | | | 0 | | Armando@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | Armando | armando | | 20160505224050 | | 20160505224050 |
415 | 19 | 0 | 73.151.197.209 | | | | 0 | | bethanyuk@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | bethanyuk | bethanyuk | | 20160510145854 | | 20160510145854 |
416 | 20 | 0 | 73.151.197.209 | | | | 0 | | 9inofshmo@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | 9inofshmo | 9inofshmo | | 20160510150030 | | 20160510150030 |
417 | 21 | 0 | 103.9.114.118 | | | | 0 | | fgfxcgbgfhgfh@yahoo.com | 1824dd1dddffa9240333e1e5334693e4 | | | dalimtv26 | dalimtv26 | | 20160512032721 | | 20160512023211 |
418 | 22 | 0 | 43.231.76.158 | | | | 0 | | osmangoni8285@gmail.com | 057f5f6a1fdbb17da7fed031e61886cd | | | dfsfsf | dfsfsf | | 20160513102505 | | 20160513102505 |
419 | 23 | 0 | 43.231.76.161 | | | | 0 | | dma14224@laoeq.com | 592e8a8c774a9885055776e4df5fb75d | | | jkjkjkj | jkjkjkj | | 20160513110324 | | 20160513110324 |
420 | 24 | 0 | 119.30.38.235 | | | | 0 | | moklesmore@gmail.com | 39e54557297588ff21e0321095a17e38 | | | hasinaroy | hasinaroy | | 20160514232707 | | 20160514232707 |
421 | 25 | 0 | 178.80.201.22 | | | | 0 | | a500a@icloud.com | e063dd0f12e15b93eb9975586e06070f | | | Ahmaddd | ahmaddd | | 20160515025321 | | 20160515025321 |
422 | 26 | 0 | 73.151.197.209 | | | | 0 | | IKravinMo@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | IKravinMo | ikravinmo | | 20160516170228 | | 20160516170228 |
423 | 27 | 0 | 73.151.197.209 | | | | 0 | | beedee241@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | beedee241 | beedee241 | | 20160516170404 | | 20160516170404 |
424 | 28 | 0 | 46.219.251.20 | | | | 0 | | natagomwork@gmail.com | 981118977eb8fe323bd68d2c3e035ce0 | | | cherrytooya | cherrytooya | | 20160517174200 | | 20160517174200 |
425 | 29 | 0 | 73.195.129.74 | | | | 0 | | ddd@gmail.com | 362aafb702972c9126afd0ee04fb3f88 | | | Kr23 | kr23 | | 20160519154546 | | 20160519154546 |
426 | 30 | 0 | 103.206.248.132 | | | | 0 | | paripage1@gmail.com | ec91b931398324d4224cdcdc9c6e219b | | | raohd | raohd | | 20160521054229 | | 20160521054229 |
427 | 31 | 0 | 172.88.234.15 | | | | 0 | | Adamrocksbro@gmail.com | 692535680f5664b3b781e13cad68c514 | | | Repotretarddoc | repotretarddoc | | 20160525005404 | | 20160525005404 |
428 | 32 | 0 | 73.151.197.209 | | | | 0 | | Falonefal@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | Falonefal | falonefal | | 20160525163416 | | 20160525163416 |
429 | 33 | 0 | 73.151.197.209 | | | | 0 | | siezy@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | siezy | siezy | | 20160525163532 | | 20160525163532 |
430 | 34 | 0 | 73.151.197.209 | | | | 0 | | Stedw@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | Stedw | stedw | | 20160525163639 | | 20160525163639 |
431 | 35 | 0 | 73.151.197.209 | | | | 0 | | ultronisright@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | ultronisright | ultronisright | | 20160525163807 | | 20160525163807 |
432 | 36 | 0 | 73.151.197.209 | | | | 0 | | obeyyourbrain@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | obeyyourbrain | obeyyourbrain | | 20160525163852 | | 20160525163852 |
433 | 37 | 0 | 73.151.197.209 | | | | 0 | | JohnathanWu@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | JohnathanWu | johnathanwu | | 20160525164154 | | 20160525164154 |
434 | 38 | 0 | 72.130.104.215 | | | | 0 | | jameskeen63@yahoo.com | f2cacdfdeac24a8df18cfaa9e77d1b3c | | | jaykay | jaykay | | 20160531011252 | | 20160531011252 |
435 | 39 | 0 | 89.34.237.12 | | | | 0 | | richoffhackin@yahoo.com | da133449d555cbbffee523507032ca55 | | | richoffhackin | richoffhackin | | 20160531075222 | | 20160531075222 |
436 | 40 | 0 | 59.153.233.119 | | | | 0 | | michaelriley@kayouhui.com | f8d7f337510f366a539dabd5254994f8 | | | jacky | jacky | | 20160602030055 | | 20160602030055 |
437 | 41 | 0 | 213.205.252.209 | | | | 0 | | Pierce.black2000@gmail.com | e702509e759da6635676368da492b305 | | | Heyitshannahhh | heyitshannahhh | | 20160608193657 | | 20160608193657 |
438 | 42 | 0 | 119.30.39.23 | | | | 0 | | somonraja@gmail.com | 7c79dd68b400e6b0c9f99f8f221dae26 | | | somonraja | somonraja | | 20160614183404 | | 20160614183404 |
439 | 43 | 0 | 184.183.171.241 | | | | 0 | | glasscutter2000@gmail.com | 6cd91dac5a394e08d2b169c0800c50c0 | | | glasscutter | glasscutter | | 20160615195106 | | 20160615195106 |
440 | 44 | 0 | 220.253.182.204 | | | | 0 | | test@testing.com | 4297f44b13955235245b2497399d7a93 | | | k michael | k-michael | | 20160617102956 | | 20160617102956 |
441 | 45 | 0 | 86.84.183.155 | | | | 0 | | jambattle@hotmail.com | 79ddc7a4687c2d423fd7dc45c01cc484 | | | transferman | transferman | | 20160618070710 | | 20160618070710 |
442 | 46 | 0 | 116.58.202.164 | | | | 0 | | es.arah554@gmail.com | 3099ca6d6fc2992cb7535009af036051 | | | jakson90 | jakson90 | | 20160618222138 | | 20160618222138 |
443 | 47 | 0 | 91.97.192.92 | | | | 0 | | xItzREax@gmail.com | 1a7bf91ac3d6a6b2d58cf41863ca43e5 | | | preamiscute | preamiscute | | 20160620171103 | | 20160620171103 |
444 | 48 | 0 | 119.30.47.32 | | | | 0 | | tushermalakarbd1@gmail.com | e8fde5941c97f3d620c2111a43cc29c1 | | | sportsteam | sportsteam | | 20160621083052 | | 20160621083052 |
445 | 49 | 0 | 160.176.231.47 | | | | 0 | | dmx6900@gmail.com | d235fff00ac86e238475d57d7856f78e | | | hakikx | hakikx | | 20160626152439 | | 20160626152439 |
446 | 50 | 0 | 83.217.8.79 | | | | 0 | | s70x@sigaint.org | 10493b6557def01019a8ea8089198adf | | | s70x | s70x | | 20160627092638 | | 20160627092638 |
447 | 51 | 0 | 130.227.104.172 | | | | 0 | | nico9551@hotmail.dk | fb6a71584b6ec6aa372c5123e7816370 | | | Nico9551 | nico9551 | | 20160702003336 | | 20160702003336 |
448 | 52 | 0 | 45.249.184.22 | | | | 0 | | furiasgogo@gmail.com | 950a836ed436762243e4abb6ca174815 | | | furiasgogo | furiasgogo | | 20160703134948 | | 20160703134948 |
449 | 53 | 0 | 93.199.99.254 | | | | 0 | | Tobiasrester123@aol.de | 5008fde6f6cb25434cf5cb6db5016dad | | | Visari | visari | | 20160709010123 | | 20160708190753 |
450 | 54 | 0 | 94.219.187.240 | | | | 0 | | ledaniel@web.de | 2893c52579d037d4e88218bde7e01aad | | | leshapiro | leshapiro | | 20160709010026 | | 20160709010026 |
451 | 55 | 0 | 73.151.197.209 | | | | 0 | | unity@yopmail.com | f4a82f42000c5e00b414ead8ef64f93f | | | unity | unity | | 20160711005921 | | 20160711005921 |
452 | 56 | 0 | 83.196.113.101 | | | | 0 | | manon.hissung@orange.fr | 00c14bf4dd9ed014a3ac63ddf5a85a53 | | | Manon Vilmint | manon-vilmint | | 20160714161919 | | 20160714161919 |
453 | 57 | 0 | 87.177.126.13 | | | | 0 | | anne131186@web.de | 53b732de8bf75fa66edc84337b6830f5 | | | lila1311 | lila1311 | | 20160714225910 | | 20160714225910 |
454 | 58 | 0 | 119.30.47.161 | | | | 0 | | proggaa@yahoo.com | 4e8208dc38626bb7132cad6a98faee82 | | | rtrtttt | rtrtttt | | 20160716132125 | | 20160716132125 |
455 +----+-----+-----------------+------+------+-------+-------+---------+-----------------------------+----------------------------------+--------+---------+----------------+----------------+----------+----------------+-----------+----------------+
456
457 Database: ufmvgbmj_katcomment
458 Table: pages
459 [1 entry]
460 +----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+-----------+-----------+
461 | id | text | tarih | pagetitle | iceriktip |
462 +----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+-----------+-----------+
463 | 1 | KickassComments is a comment system created specifically for the KickassSites network. KickassSites is a network of beautiful websites that strive to provide the most amazing service possible. You can see our websites here: http://kickasssites.co/ | 20160711010250 | | about |
464 +----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------+-----------+-----------+
465
466 Database: ufmvgbmj_katcomment
467 Table: begen
468 [3 entries]
469 +----+----------+----------------+---------+---------+-----------+
470 | id | icerikid | tarih | kulladi | tiplike | begenitip |
471 +----+----------+----------------+---------+---------+-----------+
472 | 1 | 15 | 20160421195312 | 6 | like | yorum |
473 | 2 | 37 | 20160513102545 | 22 | unlike | yorum |
474 | 3 | 92 | 20160525163901 | 36 | unlike | yorum |
475 +----+----------+----------------+---------+---------+-----------+
476
477 -----END kickasspastes.sql-----
478
479_______________________________________________________________________________
480
481 4.0 LEAKEDSOURCE
482
483
484 LeakedSource.com has lately become known around the script kiddies as an
485 essential hacking tool and it gives anyone the opportunity to become a
486 hacker. Many skid groups have "earned" their fame by using the site, and
487 many celebrities have got their accounts hacked because of it.
488
489 We found everything from DOM-based XSS to authentication bypass.
490
491 The XSS is at https://www.leakedsource.com/main/removal?s=1. Click "Yes"
492 and then "Continue". For the email you'd type your XSS payload.
493
494 e.g, "><h1>XSS</h1>"@gmail.com
495
496 The payload has to end with the suffix "@gmail.com or your payload will
497 not be recognized as an email. Then complete the rest of the form and you
498 should see your XSS payload being executed.
499
500 Next up, we have a pretty serious authentication bypass. You can pull
501 passwords from LeakedSource databases without paying for their service.
502
503 https://www.leakedsource.com/main/unlockapi
504
505 For this you'd need an addon like HackBar, Tamper Data or Live HTTP Headers
506 so you can modify POST requests. First you have to make sure you are logged
507 in on LeakedSource. It does _not_ have to be an account with a paid
508 package -- infact, this vulnerability is a lot cooler without one.
509
510 When you are logged in you should see "error" upon visiting the link.
511 Now pull out your browser addon and add these two parameters to your POST
512 request:
513
514 id1=73&id2=272
515
516 You can play around with the numbers. The first parameter (id1) is the
517 current database you are searching in, and the second parameter (id2) is
518 the database entry.
519
520
521_______________________________________________________________________________
522
523 5.0 CREDITS
524
525 Rukia: Hacked stuff (leader of zn0)
526 BadLuckJosh: Hacked OwnagePranks.com
527 Taku: Hacked stuff, helped writing zine (zn0 member)
528 sas: Helped writing zine (friend of zn0, lover of veggies)
529
530 Shoutz to friends: Xavier, v1tal, Cloud, h3x, sAv, TeOz, MLP.
531_______________________________________________________________________________zn