Skip to content
Permalink
main
Switch branches/tags

web-hack-mirror/mirror/2000/10/08/www.oy2k.state.oh.us/index.html

Go to file
 
 
Cannot retrieve contributors at this time
241 lines (121 sloc) 7.02 KB
Raw Blame
Open in GitHub Desktop
<html>
<head>
<title>Hacked By Neon-Lenz - Grey-Hat Project</title>
<!-- Hacked By Neon-Lenz -->
<!-- Penetrated as a Grey-Hat Project -->
</head>
<body text="#CCCCCC" bgcolor="#000000" link="#3366FF" vlink="#3366FF" alink="#3366FF">
&nbsp;
<br><font size=+4><b><font color="#3333FF">H</font></b>acked <b><font color="#3333FF">B</font></b>y
<b><font color="#3366FF">N</font></b>eon-Lenz</font>
<p><font size=+1><b><font color="#3366FF">S</font></b>pecial <font color="#3366FF">N</font>ote
<font color="#3366FF">T</font>o <font color="#3366FF">T</font>he <font color="#3366FF">A</font>dmin:</font>
<br>Admin, you should care as much about the security of your server as
the Y2K problem.
<br>As written on the cover of the book "Hacking Exposed" :
<p><b><i>"Network Security is Y2K without the deadline."</i></b>
<p><a href="default.bak">Click here</a> to
continue to the <b>Ohio Y2K Help Center</b> (default.bak)
<p><font size=+1><b><font color="#3366FF">T</font></b><font color="#CCCCCC">o
</font><b><font color="#3366FF">A</font></b><font color="#CCCCCC">dmin</font><font color="#3366FF">:</font></font>
<br>I've removed the logs to erase my own presence. I haven't checked your
other directories
<br>nor have i deleted anything from your harddisk. I haven't planted any
backdoors or stolen
<br>any data from your harddisk. My purpose was to warn you and other administrators
<br>who are reading this defacement on any of the hacked archive mirrors,
that their webservers
<br>are potential to some known web-vulnerabilities which can lead to a
hack/defacement. Your
<br>default.htm has been backed up as default.bak. It can be access right
<a href="default.bak">here</a>.
If you need more assistance
<br>into fixing your webserver, then you can contact me at the following
e-mail address : <a href="mailto:neonlenz@hushmail.com">neonlenz@hushmail.com</a>
<p><b><font size=+2><font color="#3366FF">T</font><font color="#CCCCCC">he</font><font color="#FF0000">
</font><font color="#3366FF">G</font>rey-Hat
<font color="#3333FF">P</font>roject:</font></b>
<br><b><font size=+2>-----------------------------</font></b>
<p><font size=+1><font color="#3366FF">A</font> <font color="#3366FF">s</font>mall
<font color="#3366FF">e</font>xplanation<font color="#3366FF">:</font></font>
<br>This site was hacked using an<b> "<font color="#3366FF">I</font>nput
<font color="#3366FF">V</font>alidation
<font color="#3366FF">A</font>ttack"</b>.
<br>These kinds of attacks are usually executed by receiving input of external
users.
<br>The input are usually given and received via port 80 which is then
executed by an
<br>ASP/CGI&nbsp; program. Some script (usually samples from a webserver
software) in your public
<br>directory will then progress the input given by the external user.
There are various vulnerabilities
<br>on the web, some of them allow external users to view and download
files where they shouldn't
<br>have access to, some causes webservers to hang and some even allow
external users to give
<br>commands which are going to be executed locally on the remote webserver.
Those are usually
<br>done by spawning a remote shell using the interpreters cmd.exe (NT-lineages)
or command.com (9x-lineages) ).
<p><font size=+1><font color="#3366FF">U</font>pdate: Input Validation
Attacks are not <u><font color="#3366FF">ONLY</font></u> limited to NT/9x
running IIS,</font>
<br><font size=+1>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Input Validation Attacks can also be found on IRIX (often seen) and other</font>
<br><font size=+1>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*nix-based servers running any kind of webserver OS with CGI enabled.</font>
<p><font size=+1><font color="#3366FF">W</font>hat <font color="#3366FF">y</font>ou
<font color="#3366FF">c</font>an
<font color="#3366FF">d</font>o
<font color="#3366FF">t</font>o
<font color="#3366FF">p</font>revent
<font color="#3366FF">t</font>hat<font color="#3366FF">:</font></font>
<br>Very simple, by removing all the unnecessarily samples and subdirectories
<br>like <u><font color="#3366FF">/cgi-bin</font></u> in your public directory.
If you really have the need to use the
<br>samples or the subdirectories, then you will need to contact your software
<br>vendor for help or just visit your software vendor's website for official
patches.
<p><font size=+1><font color="#3366FF">I</font>f you want more info about
<font color="#3366FF">C</font>omputer
<font color="#3366FF">S</font>ecurity, visit the following resources:</font>
<p><a href="http://packetstorm.securify.com">Packetstorm</a> - (Biggest
Security-Archive on the web, very up-to-date, community's favorite)
<br><a href="http://www.securityfocus.com">SecurityFocus</a> - (Home of
Bugtraq, the webmasters are well-known to the security-community)
<br><a href="http://www.ntsecurity.nu">NT-Security</a> - (Created some
nice NT-tools for you to test, small and compact, a must)
<br><a href="http://www.wiretrip.net/rfp">Wiretrip</a> (Good resource for
info about Input Validation Attacks, the webmaster is actually the one
who made it famous)
<br><a href="http://www.technotronic.com">Technotronic</a> - (Nice Microsoft
Archive, webmaster is the creator of the famous WinFingerPrint)
<br><a href="http://www.alldas.de">Alldas</a> (Great all-round security
website, hosting hacked websites, exploits. German Admin, check it)
<br><a href="http://www.hack.co.za">Darknet</a> (Hosting exploits, which
you can use to test your own server, also the biggest Exploit archive on
the web)
<br><a href="http://www.attrition.org">Attrition</a> - (famous website,
Government's and the Security Community's favorite, hosts hacked websites).
<p><b>None</b> of those websites mentioned are affiliated with me in any
means,
<br>so don't bother them concerning this defacement. Thank you.
<p><font size=+1><font color="#3366FF">P</font>.S. : <font color="#3366FF">S</font>orry
for my poor English.</font>
<p><font size=+1><b>&nbsp;</b>-------------------</font>
<br><font size=+1>&nbsp;<b><font color="#3366FF">S</font></b>HOUTS <b><font color="#3366FF">T</font></b>O:</font>
<br><font size=+1>------------------</font>
<br>/ <b>T</b>ribunal / <b>H</b>erbless / <b>F</b>ux0r / <b>n</b>exus /
<b>G</b>-Force
Pakistan / <b>N</b>e[r0 / <b>e</b>lectr0n /
<br>/ <b>d</b>islexik / <b>p</b>r|est / <b>F</b>0kus / <b>Z</b>yvr / <b>A</b>ttrition
/ <b>A</b>lldas / <b>H</b>axordot / <b>u</b>4ia / <b>sl</b>eight /
<br>/ <b>C</b>isco / <b>{</b>} / <b>N</b>ohican / <b>D</b>arkSky / <b>D</b>utch
Hackers / <b>P</b>acketstorm / <b>K</b>eyDet89 /
<p><font size=+1>If you want to send me an e-mail send it to <a href="mailto:neonlenz@hushmail.com">neonlenz@hushmail.com</a></font>
<p><font size=-1>/ Penetrated By <a href="mailto:neonlenz@hushmail.com">Neon-Lenz
</a>as
a grey-hat project to warn insecure webservers. /</font>
</body>
</html>
<!-- www.attrition.org web hack mirror - watermark or something -->