How LulzSec Ran the SevenProxies by @ThisIsGame0ver

How LulzSec Ran the SevenProxies -
Before we came along, on our much bigger, much more high tech boat with our High Orbit Ion Cannons!

by @ThisIsGame0ver

############################################################################################################
As some of you may be aware, the prior good ol' people at the LulzBoat (aka LulzSec) commited Hacks ACROSS huge infrastructure, networks and more..

Well, we're here to tell you HOW -

############################################################################################################
Senate Hack

Press Article - http://www.theregister.co.uk/2011/06/14/lulzsec_senate_bethesda_hack/

LulzSec used a now fixed Blind SQL Injection attack on the Senate's website, it's quite hilarious how the actual attack went about due to it being the "witness list" and all.

The SQLi method -
http://armed-services.senate.gov/e_witnesslist.cfm?id=<HERE>
############################################################################################################
The Sun Hack

Zone-H: http://www.zone-h.org/mirror/id/14442272

extras.thesun.co.uk was previously not protected via an Akamai Reverse Proxy, it was a simple bruteforce on their SFTP which led to an engaging story left upon the sun's website.
############################################################################################################
Battlefield Heroes Hack

The Battlefield Heroes attack wasn't even on the game itself, it was on the forum using a rather basic forum (PUBLIC) exploit.
EA was running MyBB 1.6.4, with the oh so common backdoor many off us have come to find packed into our lovely MS..

Exploit - http://www.exploit-db.com/exploits/17949/
############################################################################################################
Bethesda/Brink Hack

LulzSec hacked 200,000 accounts from the Franchise at Bethesda, in reality it was again another Forum exploit.. God these companies get hacked via Forum exploits all the damn time..

How you may ask? Using the 3.0.1 SQLi exploit -
http://www.exploit-db.com/exploits/12586/

Then once they had escalated privileges to the admin, shelled the site gaining access to the SQL databases & files linking to the games themselves.
############################################################################################################
Sony Hacks

The Sony hacks used SQL Injection, nothing easier then sticking in a comma and away you go, the thing that still interests me is how Sony has apparently "secured" their site, for example..

A simple DDoS Attack, the Sony.com.br website uses level3 servers to reverse proxy the site and "secure" it against ddos attacks..

Level3 IP: 199.83.128.57
But, it's not hard to go to the multiple subdomains that are not secured by this reverse proxy and find the ACTUAL -
Amazon Web Services IP: 174.129.232.33
############################################################################################################
Arizona DPS Hack

Article: http://www.guardian.co.uk/technology/2011/jun/24/lulzsec-claims-attack-us-police-website

So LulzSec hacked into the DPS?
Well, not exactly..

They actually infected a rogue government computer in the HR department for the Department of Public Safety, in turn grabbing files, data and gaining access to the software used (e.g. Payroll software such as Sage which had employee information saved including bank numbers & sort codes)
############################################################################################################

Compiled by @ThisIsGame0ver

#GameOver