Hacking Challenge

Me and my buddie have our own little web site breakfree.com. What we do is build and host web sites for people in our local area. What we need you to do is test our system for holes. If you do get into our system tell us how you got in and where the hole is, and if you want tell us how you would fix the problem... Im putting my trust in all of you not to **** up our system. If you feel the need to deface our web site all the power to yeah. We dont care about ittle stuff like that... defaceing take nothing but a minute to fix. So with that say and done have fun..


HAPPY HACKING
:shootem:


Keepen it real
FreeAgent

You host several other sites?

At you customers page http://www.breakfree.com/customers/ following links are down (could not locate remote server):

www.deejaycorner.com
www.gleamchemicals.com.au

They did not pay there bill this month... When they pay it will be back up....

I would remove these links then. Now it looks like your service is bad.
It's not good PR to have broken links. ;)
Or you should rerout those links to a page that says unavailable or something similar

btw: if you see many attempts on your FTP server or firewall logs that could be me probing your ports... :)

Hey FreeAgent,

I'am currently surfing through your proxy... did you know you are running a public proxy?
Thx for doing this, it's a very fast proxy... if you did not knew this send me a PM about the prob.

wow.. a wargame.. hehe

Hey FreeAgent. This may sound a bit odd. But if it's untrue just act like i've never posted...

It's a hosting site, and nowhere in the site does it have your handle their. But then again I don't know your real name - so I'm not bugging. Another thing, is that it seems to me as if your trying to make a lame attempt at hacking into one of their *many selections* of websites :p And were supposed to tell you exact detials on how we got in eh? ...hmmm,...sounds a bit off if you ask me.

But if not...I'll see what I can do mate. It's a host, so it should be secure...:)

Just looknig at it I found this info so far

HTTP/1.1 200 OK
Date: Sun, 27 Jan 2002 03:36:28 GMT
Server: Apache/1.3.22 (Unix) mod_perl/1.26 PHP/4.1.1 mod_ssl/2.8.5 OpenSSL/0.9.6a
X-Powered-By: PHP/4.1.1
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

Like [WebCarnage] said how can you prove that this is your site?

Hmmm...I did a scan aswell on http://www.breakfree.com

And I found NONE of the folders contained in that site protected in any way...care to check up on that. And I find a 'lack-of-folders' for this particular site. I mean,...here's a list:
[list=1]
aboutus
contactus
customers
design
hosting
icons* -> Small
images* -> Images
onlineacct
servers[/list=1]
* Has subfolder(s)

And none of these require passwords to enter. I also found that there was no "Bin" or "CGI-Bin" folder...odd. And because of the lack of security. One could easily program a bruteforcer and crack any account. For there seems to be no limit for how many times you can input an invalid account name and password. And yes,...I did test this*. But I have no reason to muck up any sites. Just thought I'd let you, the seemingly impossible, webmaster. Furthermore, one could easily URL-Surf to just about any folder he or she wanted. And thats not good. Try to fix that up a bit.

* when you enter an invalid usrname and pwrd. This URL will keep on continuing itself:
http://www.breakfree.com/onlineacct/login.php?error=1
Try seeing if you can alter the HTML in there so after 3 or 5 unsuccessful attempts a cookie will be installed so no furthermore trying can and will be allowed for the next 24 hours, or next reboot. Just an idea.

Sorry about the late post.... Well let me start off by telling you how and where we run breakfree.com. Breakfree is ran out of my friends house for two good reasons. 1 my friend is rich and his dad springs the bill for the T1 modem he is running. 2 He has a whole wing of his dads house to him self. So we made one of his rooms into an office so to speak. Pat (thats my friend) is a linux and Unix wiz so he wanted to make a linux server. I know little to nothing about linux and unix so I left that all to him. Ok now here is what i do with breakfree.com. I do all the html,java,and php so i guess you can say im the interface man. I make all the stuff you can see and he does the guts the stuff you dont see.

Why did we start breakfree.com?
We just started it for a little extra money to help us with school. Right now we only host our friends sites. I told you guys to try and crack into the site b/c I want to start hosting more people so we can get more money... But before I can do that i need to know that I have a hack free system. Now I know we dont lol so before I start opening to the common public we need to fix all the problems you just listed... You all made some really good points. My buddie Pat is shocked that we have this ment problems lol he was under the impression that his firewall was up and running I guess not hehehe. You guys had no problem getting in.... So thanks for your help and keep checking in from time to time to see if we are getting better...

Oh before I go if you know of any good fire walls or any programs to help us with our security let us know about it.....
Thanks again for all your help.......

Keepen it real
FreeAgent

Well.. I did a scan and found 12 ports open... 2 with no deamons runnig and 1 that is questionable...

64.132.148.100 www.breakfree.com

21 File Transfer Protocol [Control]
|___ 220 ftp.breakfree.com NcFTPd Server (free educational license) ready...
22 SSH Remote Login Protocol
|___ SSH-1.99-OpenSSH_3.0.2p1.
25 Simple Mail Transfer
|___ 220 blackie.breakfree.com ESMTP..
53 Domain Name Server
80 World Wide Web HTTP
|___ HTTP/1.1 200 OK..Date: Sun, 27 Jan 2002 11:18:38 GMT..Server: Apache/1.3.22 (Unix) mod_perl/1.26 PHP/4.1.1 mod_ssl/2.8.5 OpenSS
110 Post Office Protocol - Version 3
|___ +OK <[email protected]>..
143 Internet Message Access Protocol
|___ * OK Courier-IMAP ready. Copyright 1998-2001 Double Precision, Inc. See COPYING for distribution information...
389 Lightweight Directory Access Protocol
443 https MCom
993 NO DEAMON
1002 NO DEAMON
1720 h323hostcall

You should also get a full version FTP deamon... Not an educational licence :p

FreeAgent: How much time do we have to play with ur server???
I have no time at the moment but would love to make a serious breakin attempt later. (In a couple of days or so)
It would be nice to know, so nothing gets messed up while u have live customers online..

I will give you all 4 more weeks to play around... And it does not really matter if you punt one of the sites off line... All we have is two paying customers and both of those customers did not pay there bill for this month so ****em have fun......

Keepen it real
FreeAgent

I'll give it a go for you. It might be a day or so.

I love invitations.

KorpDeath - you will pay for stealing my avatar. FJEAR!

LOL

If I got the time.....

Ok check this out.. Pat and I just had a good idea.... If you get into the system here is what we want you to do... Make an intro page or a splash page for breakfree.com on it just sign your name.. just make sure that you put a link back to breakfree.com or just make the intro page a preload page..... Have fun..... Oh and if someone beats you on making the intro page just sign your name I guess make a list or something.... And im going to talk to pat to see if we can do something for the people that complete this mission... Maybe some thing like free hosting or some free software.... I dont know just an idea I will see what Pat thinks he is the rich kid not me lol.....

Keepen it real
FreeAgent :borg:

And here is a word from Pat about the findings so far....

Im impressed with [WebCarnage] perfectionist-ism... ppl like that find good
loop
holes... Too bad he doesn't know where to look just yet.
Although, he did make an excellent observation about the account login.
This
will be taken care of shortly. Likelihood of him getting in is slim,
but
never the less a possible threat.

As for VictorKaum , thanks... it is a fast line... I will have to look into the
status of the proxy and see if it is truly operational.


Hope you all enjoy, and I look forward to your further findings.

Pat

And in a phone chat with me he had this to say also..

In response to the floders that [WebCarnage] found he sayed... This is a website that helps promote the business, sales.... Why would I protect a directory to something I want people to see?
Why would I put a blanket over an bill board on US 19? (us 19 os a major road by us)

Again in response to [webCarnage] about not finding a Bin or CGI-Bin folder pat sayed this... This is not odd... We don't run cgi's in those dirs... so why would we need them?

But yet again in response to [WebCarnage] about the lack of security and using a bruteforcer to crack into any account Pat sayed this... Very good point. This will be taken care of...

And the last response to [WebCarnage] about Try seeing if you can alter the HTML in there so after 3 or 5 unsuccessful attempts a cookie will be installed so no furthermore trying can and will be allowed for the next 24 hours, or next reboot. Just an idea. at sayed, A cookie should not be used for that type of function. Something server side, such as a session login count, or IP abuse log should audit that.

And thats about all i can rember about the phone call lol sorry about that...

Keepen it real
FreeAgent :borg:

Quote:

---

As for VictorKaum , thanks... it is a fast line... I will have to look into the
status of the proxy and see if it is truly operational.

---

Your proxy is still available on the net... I enjoy surfing through it.
Yippieee ;)

You have a lot of open ports as stated before...

Hey FreeAgent is this truely your server?

I tried to contact breakfree but they do not respond...

freeagent I am in y-bor city I did a real scan on that site found 3 bugs and found 57 bad cgi-scripts and other (numerous)

I am a cracker>>> Hey I live like 15 min. away from Ybor.... Im going there tonight to get my drink on with a few friends.... If you want to meet up with us email me [email protected]

Keepen it real
freeAgent

VictorKaum>>> If you want a fast reply email [email protected] tell him you know me my real name is James.... If you does not know you he will not relpy.... I dont deal with email he does... If you want to contact me about something you found you can email me at [email protected]


Keepen it real
FreeAgent

Alright I see whats up might be going to a big azz party in Sarasota tonight (inxtremes)the quay

FreeAgent. . . not that I dont trust you, but I e-mailed the admin of this website to make sure. They said they would respond in 48 hours. We shall see if u are telling the truth. :) I just like to be sure before I do anything.

RogueSpy thats cool with me.....


Keepen it real
FreeAgent

Quote:

---

Originally posted by RogueSpy
FreeAgent. . . not that I dont trust you, but I e-mailed the admin of this website to make sure. They said they would respond in 48 hours. We shall see if u are telling the truth. :) I just like to be sure before I do anything.

---

I did exactly the same but unfortunatly after I already did some attempts... ;)

There was no reply. FreeAgent explained on PM why. The person who handles the e-mail only respond to knonw ppl. Do we believe this crap?
perhaps...

If we include the real name of freeAgent (= James) and ask to respond then perhaps Pat (the person that does the email) will respond.

One of us will respond.... who ever gets there first.... Im at school till 7pm at pat is in orlando doing his mcse testing.....


Keepen it real
FreeAgent

I made sure to include that in the e-mail I sent to them.

Quote:

---

Date: Fri, 1 Feb 2002 11:41:20 -0500
From: "Matthew Morey" <[email protected]> Add to address book
To: <[email protected]>
Cc:
Subject: Re: xtrspeed.com Auto-responce
Reply-to:

--------------------------------------------------------------------------------


My name is Matthew R. Morey. I am Vice President of BreakFree Communications
which owns the domain breakfree.com
As I contact my lawyer, I am requesting the following information.

All info on the user "freeagent"
including possible ip's used to post info
email address
exact logs of posting dates and times
AS WELL as any other information as to the reasons this would go so far
without contacting the site owners.

This act WAS NOT invited by BreakFree and will be given appropriate
consideration into litigation.

Any contact info will be sent to my self, [email protected]
This post is to be removed IMMEDIATELY.

Thank you for your time
Matthew R. Morey
BreakFree Communications Inc.
[email protected]

---

Explinations please!?!?!

RogueSpy: lol! excelent move! gotta see how this one turnes out... roflmao
uuuuhhuuuu... FreeAgent where r u??? uuuuhhhhuuuuu!? hehehe....
ok.... I'll say that the chances for him explaining his way out of this one r very slim...

RogueSpy: w00t! :D :D :D

Excellent post Rogue Spy

Quote:

---

This act WAS NOT invited by BreakFree and will be given appropriate consideration into litigation.

---

I wote them a e-mail I never got no response! But now I know I will "Not" attempt to hack that site no more!

Quote:

---

It's not COOL to try to get people locked up again "FREEAGENT"

---

:fpissed: :fpissed: :argue: :kissass: :lildevil: :flip: :shocked: :ubergun:

Quote:

---

Me and my buddie have our own little web site breakfree.com. What we do is build and host web sites for people in our local area. What we need you to do is test our system for holes. If you do get into our system tell us how you got in and where the hole is, and if you want tell us how you would fix the problem... Im putting my trust in all of you not to **** up our system. If you feel the need to deface our web site all the power to yeah. We dont care about ittle stuff like that... defaceing take nothing but a minute to fix. So with that say and done have fun..

---

Was "LAMEAGENT" trying to break into that web site have the people at "antionline" find the holes,poorly written cgi-scripts, the bugs in that system for him I think so. Were you Trying some "SOCIAL ENGINEERING" :mad: :confused: PLEASE EXPLAIN!

For the prove that FreeAgent challenge is false, fake, lame

see my thread about the response from breakfree.

Quote:

---

Victor:

Thanks for emailing before doing such an activity. Please do not
perform
any sort of testing.
In response to the "contest", there is none. Any such contest is
totally
unauthorized.
Also: Be aware that there is no one by the name of James on the
BreakFree
staff.

Again, Thank you for emailing before commencing.

Pat
BreakFree Communications
www.breakfree.com - 877.738.7110

---

damn is this really a lie? That sucks for us

Please cease & desist from posting to this thread. It has been requested by the VP of BreakFree that this topic not be discussed any further for now. Thank you. . . .

BTW. . . VictorKaum. . . ur not trying to take credit for my work are you? :firedevil

Wow.... It was all a lie..... HE WILL FEEL THE WRATH OF ALL CAPS!!! :verypisse

...Like I said before. I HIGHLY doubted this was FreeAgent's. I hope this "kid" gets taken out of AntiOnline. For I'm sure we can all agree this "kid" needs a booting.

It's funny...how lamers and script kiddies get smarter ways of asking: "How do you hack websites" each day.

Damn...I only wish the worst for FreeAgent.

[P.S. - And yes, incase your wondering, I did too send an email...I'm just waiting for my 48 hours to run up I guess...what a shame eh? ...what a shame.]

No offense to some of you guys... but... Do you have any idea how often people post these things falsely in order to get back at a site or to get someone in trouble? It's all too common. I was surprised to find that this thread still exists. I'm glad at least someone decided to do investigative work.

Greetings All:

Ok, no offense or anything, but you people are stupid. What in the hell were you thinking attacking a site because some anonymous nobody makes a post on a forum basically saying "try to hack us, because we're lame".

We're not talking about rocket science here people, we're talking about rule #1 of penetration testing. Don't do it, unless you have a signed contract from an executive of the company, the proper liability insurance, and some idea of what the hell you're actually doing. None of you had any of that.

I'm closing this thread.