Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 44 guests online
Free Business and Tech Magazines and eBooks
You are here:
Home
Resources
Tutorials
How to hack through port 80
EH-Net
May 21, 2013, 05:24:49 AM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Resources
>
Tutorials
(Moderator:
don
) >
How to hack through port 80
Pages:
1
[
2
]
Go Down
« previous
next »
Print
Author
Topic: How to hack through port 80 (Read 63447 times)
0 Members and 1 Guest are viewing this topic.
oneeyedcarmen
Full Member
Offline
Posts: 233
Klaatu, Borada,Necktie?
Re: How to hack through port 80
«
Reply #15 on:
June 05, 2008, 09:34:56 PM »
Quote from: BillV
There is a difference between "asking a question" and "asking a question properly." For the former, most communities will flame you to death and shun you from ever returning.
Absolutely true. Yet as evidenced by mine and Bill's questions, not on EH.net, though we may have a little fun. The majority of those here are not here
Quote
fievershly fighting for the chance to up their post/reply count.
And as Bill said:
Quote
At this point however, I'm not sure who would be willing to respond.
...which is a real shame, because looking back through the original poster's previous posts, he/she seems to be here to learn and share experiences like the rest of us. Just think about what you're asking and how. Though there may be no such thing as a stupid question, there is most definitely such a thing as an incomplete one.
Logged
Reluctant CISSP, Certified ASS
don
Editor-In-Chief
Administrator
Hero Member
Offline
Posts: 4165
Editor-In-Chief
Re: How to hack through port 80
«
Reply #16 on:
June 05, 2008, 09:44:08 PM »
Girls, girls... you're all pretty.
Let's all ease up a bit. Thangvt asked a vague question, and English is obviously not his first language. So let's ask for clarification first before jumping down his throat. Granted his answer was still vague, but let's show him how we do things here.
This is the "Ethical" Hacker Network. Most people here take that very seriously, and thus can be a little overzealous in protecting that unique philosophy on this site. So we can also cut some slack to those who respond that way.
This site has always been kind to newbies yet firm with those who even slightly appear to be unethical. But we've always been polite in doing so. Let's not change that.
So let's try to get the communication on this site back on track before we start looking like other sites out there that are rude and do not foster an open and sharing community of professionals.
Agreed?
Don
Logged
CISSP, MCSE, CSTA, Security+ SME
phn1x
Newbie
Offline
Posts: 26
Re: How to hack through port 80
«
Reply #17 on:
June 05, 2008, 09:48:29 PM »
not for nothing but with my sarcasm aside, I was trying to provide the dude with a valid path of research. Billv has a point about bad questions but in my year + of lerking I constantly see threads get bashed without any answer given. Think about how irritating that must be for people..
And everyone wonders where the white hat hate comes from...
Logged
don
Editor-In-Chief
Administrator
Hero Member
Offline
Posts: 4165
Editor-In-Chief
Re: How to hack through port 80
«
Reply #18 on:
June 05, 2008, 09:57:50 PM »
Agreed and your pointing him to a couple books was a kewl way to help regardless of whether he had permission or not. You're also correct as I stated earlier that sometimes we are overzealous. But if I'm being fair, your stating that asking if permission is in place is BS... I respectfully disagree.
All in all, if the end result is that we all understand each other better and are more tolerant and polite, then that will make this community even better.
Don
«
Last Edit: June 05, 2008, 10:04:08 PM by don
»
Logged
CISSP, MCSE, CSTA, Security+ SME
phn1x
Newbie
Offline
Posts: 26
Re: How to hack through port 80
«
Reply #19 on:
June 05, 2008, 10:08:26 PM »
I'm not saying having permission is BS, I'm saying It's like people have a script running in the background:
for post in forum;do echo "unethical `cat /dev/urandom` && `tienes permission`">> forum?post=$post;done;
open every howto "`cat /dev/random`" and within the first three posts of the thread inevitably there will be a "do you have persmission." You might as well modify the php on your board to automatically include it after the author submits the post.
If you give advice to someone who then acts in malice, no one can take litigation towards you as the site owner. You are providing a service to 'ethical hackers', I'd imagine you have that in your disclosures and within the terms of service agreement. Ergo, you are more than covered legally. Furthermore, the way our justice system works is the burden of proof lies on the prosecution. Having been through a few law classes I understand that one of the elements the prosecution would have to prove beyond a reasonable doubt is the contributor acted with malice. So, I don't understand why it's such a big deal. Personally I see it as an immediate cop out to answering a question regardless of how poorly it is asked. Now, there are the immediately obvious posts from skiddies just looking for a ./ to get in to a box. The post from the other day was an excellent example. The one im talking about is the "help me hack whatever the hell it was .com"
Logged
BillV
Hero Member
Offline
Posts: 1892
Re: How to hack through port 80
«
Reply #20 on:
June 05, 2008, 10:12:09 PM »
Agreed. I'm glad I'm pretty, Don
Quote from: phn1x
in my year + of lerking I constantly see threads get bashed without any answer given. Think about how irritating that must be for people..
I would say that in general, sure, there are lots of places that are exactly as you've described. I think that a very strong majority of the posts here end with answers. If you take a look at ones you've described, the failure is more due to the fact that the person seeking the answer didn't put forth enough initiative in following-up (just like this thread). Wouldn't you agree?
I understand what you're saying. I've asked questions that weren't answered in the past. Yes, of course it was irritating, but if I needed to re-clarify my question or provide more information I typically did so... I wanted the answer
Quote from: phn1x
I'm not saying having permission is BS, I'm saying It's like people have a script running in the background. If you give advice to someone who then acts in malice, no one can take litigation towards you as the site owner. You are providing a service to 'ethical hackers',
There is enough information available here, and elsewhere on the web, to be useful for someone with malicious intent. Not every question receives a "do you have permission"' response from the get go. If you were to post a specific/detailed security question, you're more than likely to receive some good answers. This goes back to my earlier reply of asking questions properly. Aside from giving information away that in turn is used for malicious intent, from my perspective it's more about not specifically supporting people that want to gain that knowledge for unethical purposes. Make sense?
«
Last Edit: June 05, 2008, 10:26:10 PM by BillV
»
Logged
oneeyedcarmen
Full Member
Offline
Posts: 233
Klaatu, Borada,Necktie?
Re: How to hack through port 80
«
Reply #21 on:
June 05, 2008, 10:19:31 PM »
Quote
If you give advice to someone who then acts in malice, no one can take litigation towards you as the site owner.
You may not be legally responsible, but morally is another question.
phn1x, we've both contributed to a few of the same threats on LSO as well. I respect your experience and what you have to say. You seem to have been in this game for a bit longer than I have, so I'd think you'd understand asking for clarification. It's very difficult to give an answer when you don't really know the question.
I suppose I could've just responded, "42."
(geek check)
I hope there's no harm, and most importantly that we haven't scared thangvt away. I got burned a few times early on here...though admittedly well deservedly so. Hell, it still happens pretty regularly
But I think it's fair to say that we all mean well.
And now that we've hijacked this thread...
Logged
Reluctant CISSP, Certified ASS
g00d_4sh
Sr. Member
Offline
Posts: 394
Re: How to hack through port 80
«
Reply #22 on:
June 06, 2008, 01:30:27 PM »
*Puts down his Pan Galactic Gargle Blaster* Yeah, I suppose it would have been easier to answer his question if he'd used the terminology and jargon we use. And been very specific in his post. Something like:
"I have permission, and what I'm trying to do is learn how to tunnel over port 80 into a computer to pen test it. Any suggestion?"
In that case, I WOULD still be temped honestly to simply google "port 80 tunneling" and paste the link like so:
http://www.google.com/search?client=opera&rls=en&q=port+80+tunneling&sourceid=opera&ie=utf-8&oe=utf-8&safe=active
I guess part of the frustration I see, is when the exact same questions are asked over and over, without the poster having done a quick google search or even better, looked through the multitude of thread titles for something that might be applicable and done a little reading. Wow... that sounds a bit grumpy of me, could be due to the fact I'm off the back meds. :/
I think for the most part, the vast majority of questions I see asked are answered fairly quickly if possible, and generally with some good links for followup for the poster. I've lurked around other forums, and I would have to say ours is rather friendly, and I don't feel the need to watch for port scanning on my comp after I make a post that not everyone would like
. But no, I agree with Bill and Don both. We SHOULD be polite and helpful, but I also think that taking time to think out a question fully, do a little personal research, and word it as to be clear is a responsibility of a poster as well. We all have responsibilities, and we should live up to them.
Logged
"Bad.. Good? I'm the guy with the gun"
eth3real
Sr. Member
Offline
Posts: 309
Re: How to hack through port 80
«
Reply #23 on:
June 06, 2008, 03:32:11 PM »
Quote from: g00d_4sh on June 06, 2008, 01:30:27 PM
http://www.google.com/search?client=opera&rls=en&q=port+80+tunneling&sourceid=opera&ie=utf-8&oe=utf-8&safe=active
&sourceid=opera
Would you also recommend him to use Opera?
Logged
Put that in your pipe and grep it!
g00d_4sh
Sr. Member
Offline
Posts: 394
Re: How to hack through port 80
«
Reply #24 on:
June 06, 2008, 03:56:40 PM »
Heh... well Opera is my browser of choice.
I suppose I COULD copy a link over in IE, but that would be such a... pain. Love the Opera heh. I can't stand a slow browser.
Logged
"Bad.. Good? I'm the guy with the gun"
eth3real
Sr. Member
Offline
Posts: 309
Re: How to hack through port 80
«
Reply #25 on:
June 06, 2008, 07:09:11 PM »
Quote from: g00d_4sh on June 06, 2008, 03:56:40 PM
Heh... well Opera is my browser of choice.
I suppose I COULD copy a link over in IE, but that would be such a... pain. Love the Opera heh. I can't stand a slow browser.
Same here. I think that's the only reason I noticed it.
Logged
Put that in your pipe and grep it!
g00d_4sh
Sr. Member
Offline
Posts: 394
Re: How to hack through port 80
«
Reply #26 on:
June 06, 2008, 07:25:59 PM »
Nice, an old Finish friend of mine turned me onto it a while back. I used Mozilla for a bit... and IE when I had to, but neither really grabbed me. I've found Opera rather quick, minimalist, easy to tweak, and generally just a better browser. It's actually one of my 'No nos' I insist upon at work. We're only supposed to use IE, but I can't stand how slow some of our web based custom programs are... Opera helps a little with the speed which helps me keep my sanity. Last couple incarnations of it have fixed a number of the formatting issues they were having too. (Opera)
Logged
"Bad.. Good? I'm the guy with the gun"
Thangvt
Newbie
Offline
Posts: 13
Re: How to hack through port 80
«
Reply #27 on:
June 07, 2008, 03:13:28 AM »
Thank all!
Sorry about my question, it's not clear.
I'm preparing for pentest and script is :
- The network of customer open only port 80 to client can browser Web.
And i want to understand, how the hacker can tunnel from outside network to inside network through port.
I'm researching about this way. Don't for hacking and i'm not bad guy.
I think that EH is community so if i don't understand i can ask and share.
Sorry..! Thanks all.
Logged
eth3real
Sr. Member
Offline
Posts: 309
Re: How to hack through port 80
«
Reply #28 on:
June 07, 2008, 08:59:49 AM »
I'm not the best hacker around, but you might use a reverse HTTP shell for that.
Logged
Put that in your pipe and grep it!
Kev
Sr. Member
Offline
Posts: 428
Re: How to hack through port 80
«
Reply #29 on:
June 07, 2008, 02:10:53 PM »
Hacking through port 80 is most commonly done by one of 2 methods. Either through something exploitable already running there or something exploitable the hacker placed. If you have never done this before, start off with the most basic techniques and play with netcat on 2 of your systems on your home network and see if you can connect. From there you can develop all kinds of possibilities. Code an encrypted version of netcat that will self install, etc... If port 80 is open then something is running there and the firewall allows certain kinds of port 80 traffic. Is it vulnerable to an exploit? Is it a webserver? Can you do a SQL injection or perhaps exploit the buffer, etc... Just because you see an open port doesn't mean you can magically connect to it with some secret command on your windows command prompt. Its interesting how many people that don't hack think this way. You have to determine what is running on that port and see if you can exploit it. If not then you have to try to connect from their side to you.
«
Last Edit: June 09, 2008, 09:33:19 PM by Kev
»
Logged
Pages:
1
[
2
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
GAWN - GIAC Assessing Wireless Networks
: Karen Millen Dresses Things did improve as the decade gone on
(0) by
dtree70fx
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Programming
: Finished Python Course in Codecademy now what?
(11) by
securitian
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
Tutorials
: Need guidance
(8) by
r0ckm4n
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
Web Applications
: Nessus and Nikto
(4) by
Seen
Network Pen Testing
: Cracking salted MD5 hash
(4) by
n37sh@rk
CEH - Certified Ethical Hacker
: Passed my C|EH
(3) by
n37sh@rk
Mass Media
: EC-council hacked, irony at his best?
(0) by
j0rDy
Web Applications
: SQL Injection into an INSERT statement.
(6) by
eyenit0
Network Pen Testing
: Solution for sipXtapi INVITE Message CSeq Field Header Remote Overflow
(1) by
m0wgli
Web Applications
: dns
(2) by
H1t M0nk3y
Other
: BSides Boston
(0) by
3xban
Career Central
: InfoSec in Central, FL
(2) by
tturner
Web Applications
: Web vulnerability scanner
(4) by
H1t M0nk3y
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
Free Business and Tech Magazines and eBooks
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.