On social engineering

Author: lost blog: lost.cq.cn from www.2cto.com reprinted please indicate the source

Respect others and respect yourself. Please do not trample on your personality because of a small article in the district. Thank you for your support, understanding, and cooperation!

In my impression, social engineering is just a dumb. Sometimes you know how to manage passwords when you penetrate. But you do not know the background. No way.

You need to find a place to upload the webshell.

I met it once and managed to fool me for three days. Speaking of looking for the background, I will tell you about the background experience.

That is, when the password was last infiltrated, it was known. The website has a default admin background.

However, I don't know how to log in with the password. It's a headache. That station must win. It's a portal station. Management fooled me. Pay attention to the default background.

In the past two days, I thought that the password I had cracked was from another station. The mysql5.0 database was so troublesome that I had to exit the database directly. I transferred it to the database for two days.

I am still a friend of mine. He said that web separation is impossible from my experience. I told him that there is another background that he does not believe. I said you couldn't find it.

Then I found it. I view images on the homepage of my website,Http://up.2cto.com/Article/200907/20090723201120157.jpg

You can try it out.Http://lost.cq.cn/pass_admin/The result is true in the background.

In fact, you can go to the homepage to view the original code and find sensitive information. Maybe it's the background.

When the background was exhausted, we went back to the topic and obtained the password when penetrating a large portal, provided that the background was not found.

The permission cannot be read or written. mysql4.0 is not the root permission. Do not go to phpmyadmin.

There is no way to complete all the methods. Only the social engineering website administrator,

Finally, obtain the background path in WEBSHELL.

I directly sent my horse to the Administrator and asked him to put it on his own.

I said his website has a vulnerability and I wrote a patch. The key is how much you know about him.

Basically, I can see what filtering method is used for filtering. Then I will ask him if his filtering file is written like this.

Then I told him that I had obtained his account and password and told him that I was not malicious, but only for security detection.

The account and password were reported to him. He saw that it was indeed, and his defense against me was very weak.

Then the attacker is attacked. He intentionally asked if the filtering code was written by him. Then he asked him about the website.

Finally, I am specialized in security maintenance. If you need it later, you can contact me. By the way, the price is also presented to the newspaper to confuse the administrator.

Before leaving, I asked him if he would fix the vulnerability. It is generally not clear that even if he said yes, you can figure out how he fixed the vulnerability.

There are too many ways for social workers. You need some concealed information from his website in your hand.

When I started this station, I thought about finding a part-time girl to go to social engineering... suddenly ......