Showing posts with label WebSite Hacking. Show all posts
Showing posts with label WebSite Hacking. Show all posts
I was just browsing through the web and accidently found a site called clickfans I found an error likeUninitialized string offset:.I was just seeking out what it was I just tried Sql injection on the site and it failed then I just tried admin bypass with Unaccepted Charecters and it was a success and I was able to login to admin page.But interesting thing was that most of the other Social Exchange sites was also vulnerable as it was also made up of the same script
Lets Begin H3cking:
Just Find A Social Exchange Site
Find Its Login Page
In Username And Password Field Enter ‘=’ ‘or’
Note: Its Better To Coppy Above Query(‘=’ ‘or’) From Here As It Contains Spaces.
The above query sets a true condition in Sql
Now if the site is Vulnerable you will be logged in to the first user in the database, Gennerally first user will be the Admin
Then I thought how to login to a specific User in the database:
Then I used Sql Ignore Query(--)
Then I thought how to login to a specific User in the database:
Then I used Sql Ignore Query(--)
What this query dids is that it ignores the things after(--) setting the condition to true let us look bellow example
I used the bellow query as Log In name and left the Password to be blank
admin' --
Note: Its Better To Copy Above Query(admin' -- ) From Here As It Contains Spaces.
I used the bellow query as Log In name and left the Password to be blank
admin' --
Note: Its Better To Copy Above Query(admin' -- ) From Here As It Contains Spaces.
So when the query passes the admin is taken as username and the password field is ignored setting the condition to be true,So that you can login to system with username admin without password
Note:You Can Replace Admin With Any Username That Is In The Database Of That Particular Website.
You can try different methords for extracting usernames Like Sql Injection
Other Bypass Queries- admin' --
- admin' #
- admin'/*
- ' or 1=1--
- ' or 1=1#
- ' or 1=1/*
- ') or '1'='1--
- ') or ('1'='1--
The worlds tweeting network twitter is down.They did not say what was wrong or when the service would be restored.The twitter shows a page as bellow.Page has a unknown error
The The site The site status says the following message:
“Users may be experiencing issues accessing Twitter. Our engineers are currently working to resolve the issue.”
Here is my latest tutorial on defacing a website with Drupal file Browser ExploitGoogle Dork: inurl:"/imce?dir="
Find a vulnerable website:
Now Navigate To Folders Like Root ect
Click Upload
Select A Html Or Php Deface Page
Select A Html Or Php Deface Page
Click Upload
Now you can acess ur defaced page
Note:Some Sites May Only Accept .Jpg Or .Png Formats
Live Demo:
Ftp File Transfer Protocol is a protocol just like Tcp or Ip Which is used to transfer files between remote computers.Mainly used in web servers
Steps:
Open Computer
Go To Bellow AddressControl Panel\Programs Click Turn Windows Function On Or OffGo To Internet Information Services
Double Click To Get Ftp Server Check Ftp Server Click Ok
Using Ftp:
To use ftp go to Command Promt and enter query FTPTo connect to a server: open domainname/ip eg:open 192.152.132.61
To Login use bellow commands: User (X:(none)): username Replace username with your username
Commands:! delete literal prompt send? debug ls put statusappend dir mdelete pwd traceascii disconnect mdir quit typebell get mget quote userbinary glob mkdir recv verbosebye hash mls remotehelpcd help mput renameclose lcd open rmdirNote:This Is Just An Introduction To Brute Force Attacks And Web Defacing Using Anonymous Ftp
Both Topics Coming Soon After My Sem Exams!!
To hack a website in most cases admin page is more important.I will show you a simple trick to find admin pagesI will use a simple loop hole in robots.txt
Do you know about robots.txt file ?
Yes it is file to spiders of search engines to decide what to crawl and what not to crawl. The Robot Exclusion Standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web crawlers and other web robots from accessing all or part of a website
Yes lets start:
First select a website eg:www.google.com
Then after the address add /robots.txt to website adress
Now ur Url will be www.google.com/robots.txt
Now you will get a txt file showing all pages which is disallowed by admin to search engine
If the site admin is a good Administrator he will not allow admin page to be crawled by search engine
Now seach for admin you will find admin page
See bellow
Deface Page is common term in Hacking.Defacing website is becoming popular now adays.And this post is for the beginners in hacking What Is Defacing:
Defacing a website means Replacing the index page of a website with a Deface Page.It is actually an attack on a website that changes the visual appearance of the site or a webpage
It is usually done when a hacker gains illegal acess to a website.It is done by crackers
It is usually done when a hacker gains illegal acess to a website.It is done by crackers
What Is A Defaced Page:
It is a Webpage usually html created by hacker with his own customizations and credits. This page usually includes the "Hacking Codename." In most cases Website Defacer makes fun of the system administrator for maintaining poor security. Most times, the defacement is harmless and isdone to show cracker's skills
You can Download Popular Deface Pages Here.
Download
Note: Edit with a text editor ,Replace text and images with yours.And you are Done
Download
Note: Edit with a text editor ,Replace text and images with yours.And you are Done
Havij is a Advance Injection Tool used by hackers to steal information from data base.The normal copy of Havij is free. Read my post on hacking Website Using Havij Tool Read Now
Now I am giving free Havij 1.15 Pro version to my readers.
New Havij Pro 1.5 Includes:
MsSql With No Error
MsSql With Error
MsSql Blind
MsSql Time Based
Ms Access
Ms Access Blind
Oracle
Oracle Error Based
And much more
See Details On Installation And Working Download Guide
How To Download:
I Cannot give you the download link here as the may Penalyze me under DMCA(CopyRight Act)
You can Comment ur Mail Id Bellow ,I ill Mail u Personally.
Or You Can Directly Download Click Bellow(Due to mass requests)
Download
Or You Can Directly Download Click Bellow(Due to mass requests)
Download
Website Coping or Website Ripping is the process of Downloading A Complete Website with its images, javascripts, links, pages and all other things linked with a Website.If u save a page from a browser it will not include every script’s and images, It also excludes the pages linked with the website and only downloads the current page. Now lets learn How To Copy A Website Fully
First select the Website(Copy its url)
Then Download HtTrack
Install and open HtTrack
Skip the welcome page by click Next
Enter the details bellow:
Enter the details bellow:
Project Name: Website name(eg RealHackers)
Project category: Any category(Hacking)
Base Path: Select the Folder you want to save website details after copiying
Click Next
Enter the details bellow
Action: Download website(s)
Click Add Url button and enter ur website address without http://
Note: You can also add multiple websites at a time
Click Next
Adjust Values as on the image bellow
Click Finish and wait till it completes its Downloading
After Downloading you will find your copied website in the Folder you selected earlier
Today I am going to teach you Website Hacking Using Havij Powerfull Sql Injetion ToolIt is simple to hack with this Professional Tool Havij.You will learn how to get Usernames
Passwords and other details from vulnerable sites.
Go to google enter the dorks bellow
inurl:class.php?id=
inurl:faq2.php?id=
inurl:article.php?id=
inurl:main.php?id=
More can be found from Google!
inurl:article.php?id=
inurl:main.php?id=
More can be found from Google!
Select a vulnerable website
eg; http://thewsite.com/class.php?id=12
Add (') without brackets to the adress
and the website above will be like http://thewsite.com/class.php?id=12'
Download Havij Sql Injection Tool
Download
Open Havij
Enter the site address in the Target Field and click Analyse
Wait till the tool analyses
Then if ur site is vulnerable you will be getting the database name in log field
eg “Current DB: ViRtUaL_SEdA_MaIn”
Click on Get DBS
Select A Database
Click on Get Tables
Select A Table
Click on Get Colums
Select Some Columns eg username,password, ect
Click on Get Data
You will be getting Usernames and Passwords
Note:Passwords will be in encrypted form(eg; *3F5FB6596AF8D91ED7B5AC13071C73BF3E819A9A)
How to Decrypt passwords
Click on MD5
Paste the encrypted password and click Start
Now you will have the plain Passwords
now you will have to find the Admin page
How to find the Admin Page
Click Find Admin
Enter the site address and click Start
Now Login Sucessfully
Note:This tutorial is only for practicals in your own Labs and Websites
Update:
Download: Havij 1.5 Pro Full Version Download
In above posts i wrote about advance Website Hacking and in this post I am writing about a simple way to hack a website and upload ur file using TmEditGo to Google
Enter bellow Dork without quotes
“inurl:/editor/tmedit/popups/insert_image_en.php”
Search for a vulnerable website
You will get something like bellow
Choose the file
Define the path(Put Website Url Here)
Click Ok
Click Upload
Wait till it uploads
View ur file:
Remember: Hacking Is Fun. But Also A Crime!
Today I am going to teach you how to hack a website. Ie how to upload ur files to others website without their permission.This is my first tutorial on RealHackers about website hacking with a live demo
Lets Begin:
Go To Google
Type: "inurl:/HTMLEditor/editor//filemanager//connectors/" without quotes
Select a website
I am selecting The website:
Ok just replace things after “connectors/to “uploadtest.html”
Now the above url will become :
http://www.royzband.com/cms/HTMLEditor/editor/filemanager/ connectors/uploadtest.html
Now you will see something like bellow
Now select the file u want to upload
I am selecting metrix.gif
And select the “File Uploader” as PHP
Click Upload and wait….
You will get a PopUp msg saying that ur File Has Been uploaded Successfully
Viewing The File:
Just go to
“http://www.website.com/Url You Got After Uploading Here”
ie Uploaded File URL as bellow
My Url would be:
OR:
If u get errors likes
Uploder Disabled
Content Forbiden
U are unlucky, just try another site.
Remember: Hacking Is A Crime In Real World..And Fun In www.RealHackers.In
